From 240b0a2d69b6ecd65a0ced4935f46f711e556671 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Thu, 5 Mar 2026 10:24:42 -0500 Subject: [PATCH 01/10] new file: packs/kubewatch-3.5.0/README.md new file: packs/kubewatch-3.5.0/charts/kubewatch-3.5.0.tgz new file: packs/kubewatch-3.5.0/charts/kubewatch/.helmignore new file: packs/kubewatch-3.5.0/charts/kubewatch/Chart.lock new file: packs/kubewatch-3.5.0/charts/kubewatch/Chart.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/README.md new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/values.yaml new file: packs/kubewatch-3.5.0/logo.png new file: packs/kubewatch-3.5.0/pack.json new file: packs/kubewatch-3.5.0/values.yaml --- packs/kubewatch-3.5.0/README.md | 329 ++++++++++++ .../charts/kubewatch-3.5.0.tgz | Bin 0 -> 27092 bytes .../charts/kubewatch/.helmignore | 21 + .../charts/kubewatch/Chart.lock | 6 + .../charts/kubewatch/Chart.yaml | 26 + .../charts/kubewatch/README.md | 325 ++++++++++++ .../kubewatch/charts/common/.helmignore | 22 + .../charts/kubewatch/charts/common/Chart.yaml | 23 + .../charts/kubewatch/charts/common/README.md | 346 +++++++++++++ .../charts/common/templates/_affinities.tpl | 102 ++++ .../charts/common/templates/_capabilities.tpl | 128 +++++ .../charts/common/templates/_errors.tpl | 23 + .../charts/common/templates/_images.tpl | 75 +++ .../charts/common/templates/_ingress.tpl | 68 +++ .../charts/common/templates/_labels.tpl | 18 + .../charts/common/templates/_names.tpl | 63 +++ .../charts/common/templates/_secrets.tpl | 140 +++++ .../charts/common/templates/_storage.tpl | 23 + .../charts/common/templates/_tplvalues.tpl | 13 + .../charts/common/templates/_utils.tpl | 62 +++ .../charts/common/templates/_warnings.tpl | 14 + .../templates/validations/_cassandra.tpl | 72 +++ .../common/templates/validations/_mariadb.tpl | 103 ++++ .../common/templates/validations/_mongodb.tpl | 108 ++++ .../templates/validations/_postgresql.tpl | 129 +++++ .../common/templates/validations/_redis.tpl | 76 +++ .../templates/validations/_validations.tpl | 46 ++ .../kubewatch/charts/common/values.yaml | 5 + .../charts/kubewatch/templates/NOTES.txt | 11 + .../charts/kubewatch/templates/_helpers.tpl | 33 ++ .../kubewatch/templates/clusterrole.yaml | 84 +++ .../templates/clusterrolebinding.yaml | 22 + .../charts/kubewatch/templates/configmap.yaml | 51 ++ .../kubewatch/templates/deployment.yaml | 136 +++++ .../kubewatch/templates/extra-list.yaml | 4 + .../kubewatch/templates/serviceaccount.yaml | 21 + .../charts/kubewatch/values.yaml | 474 +++++++++++++++++ packs/kubewatch-3.5.0/logo.png | Bin 0 -> 22320 bytes packs/kubewatch-3.5.0/pack.json | 28 + packs/kubewatch-3.5.0/values.yaml | 490 ++++++++++++++++++ 40 files changed, 3720 insertions(+) create mode 100644 packs/kubewatch-3.5.0/README.md create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch-3.5.0.tgz create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/.helmignore create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/Chart.lock create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/Chart.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/README.md create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/values.yaml create mode 100644 packs/kubewatch-3.5.0/logo.png create mode 100644 packs/kubewatch-3.5.0/pack.json create mode 100644 packs/kubewatch-3.5.0/values.yaml diff --git a/packs/kubewatch-3.5.0/README.md b/packs/kubewatch-3.5.0/README.md new file mode 100644 index 00000000..45d8d9a8 --- /dev/null +++ b/packs/kubewatch-3.5.0/README.md @@ -0,0 +1,329 @@ + + +# Kubewatch packaged by Bitnami + +Kubewatch is a Kubernetes watcher that currently publishes notification to Slack. Run it in your k8s cluster, and you will get event notifications in a slack channel. + +[Overview of Kubewatch](https://github.com/bitnami-labs/kubewatch) + +## TL;DR + +```console +$ helm repo add robusta https://robusta-charts.storage.googleapis.com && helm repo update +$ helm install my-release robusta/kubewatch +``` + +## Introduction + +This chart bootstraps a kubewatch deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.2.0+ + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm install my-release bitnami/kubewatch +``` + +The command deploys kubewatch on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ------------------------- | ----------------------------------------------- | ----- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | + + +### Common parameters + +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | -------------- | +| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | +| `nameOverride` | String to partially override common.names.fullname template | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the the deployment(s)/statefulset(s) | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the the deployment(s)/statefulset(s) | `["infinity"]` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | + + +### Kubewatch parameters + +| Name | Description | Value | +| ---------------------------------------- | -------------------------------------------------------------------------------- | ---------------------- | +| `image.registry` | Kubewatch image registry | `docker.io` | +| `image.repository` | Kubewatch image repository | `bitnami/kubewatch` | +| `image.tag` | Kubewatch image tag (immutable tags are recommended) | `0.1.0-debian-10-r513` | +| `image.pullPolicy` | Kubewatch image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `hostAliases` | Add deployment host aliases | `[]` | +| `slack.enabled` | Enable Slack notifications | `true` | +| `slack.channel` | Slack channel to notify | `XXXX` | +| `slack.token` | Slack API token | `XXXX` | +| `hipchat.enabled` | Enable HipChat notifications | `false` | +| `hipchat.room` | HipChat room to notify | `""` | +| `hipchat.token` | HipChat token | `""` | +| `hipchat.url` | HipChat URL | `""` | +| `mattermost.enabled` | Enable Mattermost notifications | `false` | +| `mattermost.channel` | Mattermost channel to notify | `""` | +| `mattermost.url` | Mattermost URL | `""` | +| `mattermost.username` | Mattermost user to notify | `""` | +| `flock.enabled` | Enable Flock notifications | `false` | +| `flock.url` | Flock URL | `""` | +| `msteams.enabled` | Enable Microsoft Teams notifications | `false` | +| `msteams.webhookurl` | Microsoft Teams webhook URL | `""` | +| `webhook.enabled` | Enable Webhook notifications | `false` | +| `webhook.url` | Webhook URL | `""` | +| `smtp.enabled` | Enable SMTP (email) notifications | `false` | +| `smtp.to` | Destination email address (required) | `""` | +| `smtp.from` | Source email address (required) | `""` | +| `smtp.hello` | SMTP hello field (optional) | `""` | +| `smtp.smarthost` | SMTP server address (name:port) (required) | `""` | +| `smtp.subject` | Source email subject | `""` | +| `smtp.auth.username` | Username for LOGIN and PLAIN auth mech | `""` | +| `smtp.auth.password` | Password for LOGIN and PLAIN auth mech | `""` | +| `smtp.auth.secret` | Secret for CRAM-MD5 auth mech | `""` | +| `smtp.auth.identity` | Identity for PLAIN auth mech | `""` | +| `smtp.requireTLS` | Force STARTTLS. Set to `true` or `false` | `""` | +| `namespaceToWatch` | Namespace to watch, leave it empty for watching all | `""` | +| `resourcesToWatch.deployment` | Watch changes to Deployments | `true` | +| `resourcesToWatch.replicationcontroller` | Watch changes to ReplicationControllers | `false` | +| `resourcesToWatch.replicaset` | Watch changes to ReplicaSets | `false` | +| `resourcesToWatch.daemonset` | Watch changes to DaemonSets | `false` | +| `resourcesToWatch.services` | Watch changes to Services | `false` | +| `resourcesToWatch.pod` | Watch changes to Pods | `true` | +| `resourcesToWatch.job` | Watch changes to Jobs | `false` | +| `resourcesToWatch.persistentvolume` | Watch changes to PersistentVolumes | `false` | +| `command` | Override default container command (useful when using custom images) | `[]` | +| `args` | Override default container args (useful when using custom images) | `[]` | +| `lifecycleHooks` | for the Kubewatch container(s) to automate configuration before or after startup | `{}` | +| `extraEnvVars` | Extra environment variables to be set on Kubewatch container | `[]` | +| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` | +| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` | + + +### Kubewatch deployment parameters + +| Name | Description | Value | +| --------------------------------------- | ----------------------------------------------------------------------------------------- | --------------- | +| `replicaCount` | Number of Kubewatch replicas to deploy | `1` | +| `podSecurityContext.enabled` | Enable Kubewatch containers' SecurityContext | `false` | +| `podSecurityContext.fsGroup` | Set Kubewatch containers' SecurityContext fsGroup | `""` | +| `containerSecurityContext.enabled` | Enable Kubewatch pods' Security Context | `false` | +| `containerSecurityContext.runAsUser` | Set Kubewatch pods' SecurityContext runAsUser | `""` | +| `containerSecurityContext.runAsNonRoot` | Set Kubewatch pods' SecurityContext runAsNonRoot | `""` | +| `resources.limits` | The resources limits for the Kubewatch container | `{}` | +| `resources.requests` | The requested resources for the Kubewatch container | `{}` | +| `startupProbe.enabled` | Enable startupProbe | `false` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | +| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `livenessProbe.enabled` | Enable livenessProbe | `false` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readinessProbe.enabled` | Enable readinessProbe | `false` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `customStartupProbe` | Override default startup probe | `{}` | +| `customLivenessProbe` | Override default liveness probe | `{}` | +| `customReadinessProbe` | Override default readiness probe | `{}` | +| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` | +| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` | +| `affinity` | Affinity for pod assignment | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Tolerations for pod assignment | `[]` | +| `priorityClassName` | Controller priorityClassName | `""` | +| `schedulerName` | Name of the k8s scheduler (other than default) | `""` | +| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | +| `podLabels` | Extra labels for Kubewatch pods | `{}` | +| `podAnnotations` | Annotations for Kubewatch pods | `{}` | +| `extraVolumes` | Optionally specify extra list of additional volumes for Kubewatch pods | `[]` | +| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Kubewatch container(s) | `[]` | +| `updateStrategy.type` | Deployment strategy type. | `RollingUpdate` | +| `initContainers` | Add additional init containers to the Kubewatch pods | `[]` | +| `sidecars` | Add additional sidecar containers to the Kubewatch pods | `[]` | + + +### RBAC parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------- | +| `rbac.create` | Whether to create & use RBAC resources or not | `false` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `serviceAccount.name` | Name of the service account to use. If not set and create is true, a name is generated using the fullname template. | `""` | +| `serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | + + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install my-release bitnami/kubewatch \ + --set=slack.channel="#bots",slack.token="XXXX-XXXX-XXXX" +``` + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +$ helm install my-release -f values.yaml bitnami/kubewatch +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +## Configuration and installation details + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Create a Slack bot + +Open [https://my.slack.com/services/new/bot](https://my.slack.com/services/new/bot) to create a new Slack bot. +The API token can be found on the edit page (it starts with `xoxb-`). + +Invite the Bot to your channel by typing `/join @name_of_your_bot` in the Slack message area. + +### Adding extra environment variables + +In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `extraEnvVars` property. + +```yaml +extraEnvVars: + - name: LOG_LEVEL + value: debug +``` + +Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values. + +### Sidecars and Init Containers + +If you have a need for additional containers to run within the same pod as the Kubewatch app (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. + +```yaml +sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +Similarly, you can add extra init containers using the `initContainers` parameter. + +```yaml +initContainers: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +### Deploying extra resources + +There are cases where you may want to deploy extra objects, such a ConfigMap containing your app's configuration or some extra deployment with a micro service used by your app. For covering this case, the chart allows adding the full specification of other objects using the `extraDeploy` parameter. + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `affinity` parameter. Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `podAffinityPreset`, `podAntiAffinityPreset`, or `nodeAffinityPreset` parameters. + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +### To 3.0.0 + +- Chart labels were adapted to follow the [Helm charts standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels). +- This version also introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/master/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade. + +Consequences: + +- Backwards compatibility is not guaranteed. To upgrade to `3.0.0`, install a new release of the Kubewatch chart. + +### To 2.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +### To 1.0.0 + +Helm performs a lookup for the object based on its group (apps), version (v1), and kind (Deployment). Also known as its GroupVersionKind, or GVK. Changing the GVK is considered a compatibility breaker from Kubernetes' point of view, so you cannot "upgrade" those objects to the new GVK in-place. Earlier versions of Helm 3 did not perform the lookup correctly which has since been fixed to match the spec. + +In https://github.com/helm/charts/pull/17285 the `apiVersion` of the deployment resources was updated to `apps/v1` in tune with the api's deprecated, resulting in compatibility breakage. + +This major version signifies this change. + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +## References + +- https://github.com/robusta-dev/kubewatch diff --git a/packs/kubewatch-3.5.0/charts/kubewatch-3.5.0.tgz b/packs/kubewatch-3.5.0/charts/kubewatch-3.5.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..1f3cfcca15e04631fc0438eddfee67adbdae0f61 GIT binary patch literal 27092 zcmV*5Ky<$!iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYed)qd$IJ$r9Q{c$ijg_@1%WvuGoSeI^lXm@UUVLpg?Vhx^ zhDb<4O%W^r%F)*OefIlc0FdCTBujSEv*z-d zNX-AVyLMZ}&iz3i97RlGNm(QYErfh5$(Zr^0G&o7j)mljFB48$IHvCj7nDTiKNiGk>=bl6VXlb&+}3O<~P!%YE;o_puca;d2^Gc=es-XG8_U@RLVG5`o|?;Yd!f zM1I0KiDWoOaWV|4m=J*?Ch3U!Kn#TdLl+_TuRV00M2Jd6BQ$3TN7r8oq9-KwuSHg)N2lZLR~J5a_x5%_?(H9VaWrmSllcwf0Swo5N~l&> zBiibs361>;maQ(DVkrrqGNFEqLI$6wLJ~X`Ej`p3rh+Bh*Icl4@6s{d_YS??*5?+B zf19VM|JBfLx{U?;e|LZXprro~_a62CLp+;S+m3GT@2P2lj){;1Bqn(8@M!Ry9DH?f z@YU|YVgLE_ul&8|`{X(99~}n65yppye>)(4-~Ssv+Q3gO#Wv$ zOo+G-1F%{C4|WgtOZMNv{{ExbmXatJ{i5z-Q3K0%3&~!kl9Tv86#N%Q%P00JYmK zgtoTOD{t)SzlzNb^lN2PPv^GccVwjFTAwgtE_1l37ea%`^WO`@$ z>_Tz{PBMj>q&N)c858Ph%>%l6qa+N~Ur3T^9Ac?hs^!8eG-JzGG^IYR)Jzdpp(zdE zH6D^sAoD-T5Dq{ba2P6a3E7+khz)-wzEpD9a%&CH@1IHlkF&KNa{pcyv{T2ze-(k; z1r(1XCM5OIlm$dBc$C0uP*W1gZP8Kd6G=u%D2V#0z-HCnuz(o$G$`l4c?22?>Kfcu zn8%zAiBUX5RYvGKN~#q)su${STfhuhK%$OieACPTjc_PP6G9f)iTS@|83QO}d=^Pe zBf^EH#zKl191LVd4kfB0BqVOa1oN>#$LgQW;h;~HH8vk@nw%v4ot&H$9F zUV7TaXKwA;lXwhOzt&c4EqJsYkeI7gJqbFC+cHM6vjoT7pU@cz(iROlp&2i;wM!Ue zpGvhP9+!%%ciVJ2O(Y15Y7Jqoz$o5Q^Q^`{2PjU$@Qj7jFE_6~p%}hZRUy>0{Ld}d%kHZ^07f;o^ zl2M5Y^i(NjA)oFb5(=W`8z_D{dduV)CxS%ssRoxD?#yB0QPvBXFM5d}ygN>4Kzh)E z=xxQEbQOhYH16tmR>CrJ50KlIZt5MlvtafTwvUErO4N$;vzhSiI7|~Em4ch%C;=Eg zCyHsU7Jz|>u}{3^IwrBW7QNIc>&7hTrn;r4dZIhmjX9lRNz#$;8I$BAp2ne7@bO(N zlDJ@uWNbKLLLP?{3nI{Q5IE`$J|V2XsTvJk^jYMSSc;w?d`5jDx)G5#j9=4e+`~c8 zC6VNmh^}PNeIos?0x!Bsy}_Sd(^5~dwS!dwUvRD!=QHp$=DmicD#meW%GzI&>1y** zdC9IxWJ({Oog(@s{jHgj z7Ql)GwbhiEgGHz7*`Kv&PT8;2l!d?R3c5cMZqc$m`ksgB*qK6uDubmwh897yL;xJj z--RYCC~jQ9MPmPh#wTi}S4U@CjWae)3&W2p^4ijxV{LKEuf9ElqS4)hS)h3>LhuM5$s-^cF*DK&a1|U?Yhx)#v(AG1VQZ zDptL*@}-e8H7e1|35ttljYe9ej8cWd!%WOI8ch;jZr=}C62Qh&5rvcVODz^oWrc`S z!{Cw?SQ4EO^AasyV_r`PsGu5Ge-uUpT@YuNjKw7KMudt<;`x!9x)U|i_mb<&H}=0? z;$OZw{O7N)_g`JU+dG)Q{doQBTh$Q-eVKu6iK&e9t5Nl)G~v9tJVV=LifPy>bZzl! z5&%kuUJ@Z`1l16LQcH18gh1Pz{FYFzO!ahD%)C402;b&R!p@zY;k?Qvz#_Dkw1);)d}6o!LL`0>!L~v{efb zPR@_tblqIr(QEmFC4i9aNcuwKl>W5sR8!Op;pOWK z<=4u~IO zuD9rOCBY$8a0YTa80 z?SeGp7GN@EQ6+?z@M#eMyMQRyzc62#YR4=nS3F}uW2Il&uw3c?uwipcgbOMpiR6rh z$&^$yo0fPFB^tr$X|@F8)yyzMt5`#camGvOx~-Bo91A!d;p|;HWZ5e_2-%yMWoyG< z+0gk=phNaW+X=doYh)xsvT52K^pcEdM9k}qFsU$sEEE~nl(Pu56!A4a_In>rIsfH%2Ewk2g5BIH{M!_DJp3KI`q zLfKF-L?fRQ*bGqSgRlS3rBDP>Q-?FV2)#8KQYk~Cdu~S08vG!E1GgDq%dyZZc7Zff z=>`z;<79yLc6X=gn<<&XX5il8(Hq)AwuZ7FTzD3SMYjO5Uj?$i3lP&P#wIzjTFvfd z$2velb<`L%I>=ysMVY-1>5N1~h%P5MpzxOtWaw=vW5OxSN>J+zeyt2d(kWqyv`{Yf&y~T9Fbxw< zE+?Fb2@3=Cjedb-`es>BBJq`kW}q(gi)K(Q_jjeft{4EtmwIuP5z@TN(?uCm2o*ay zK>OeW%j0VduO`;E9QdX1wyjmk+_{gnl~!Z#m7N*_Va7klmLBv;@O13u;N0Ul!bwOkV=m%D?#%*gofH zyKp9-vgfF1$+XIqis7SB;I%92Ww51Lq*YO^67YGBnq|mkv29gVEWnOga6HnHix65R z(HRR6Hm^_&?>uxmju)wGy#_^tNau35VYnn=X!mE{-Hk-xv=-zIz2%lKLJ=T15gE z)c*=Pl=?Y93O|L^TNaSwpl=>o^=}R<^`d}MZvU+O-IMc}RHBR2m$e7T?jg@(QrgX{ zz~-9FH8LR{k`Sq%lA$SVTQs9mJcV#g<^$BulbGz0F8)_H!c)?=nCWs05z`%XaWil3 zh@K%>7Ko^E>la__Sv)O;^FDezWENYPIASGjz$;S{t;Tja?|PZx8f5~#Ws(fa3UH@d zDQM3_nbc{VJT>%$y#*?t0wG~P!IUp(UIprcgv6JOI|C)|NE64`1ac+-v?7a@G}~AK z56MEp%^8PF=kJXUjj{wK3`5o&Am+4QV3wFu2JXBN3jzN9Y^%2XaShxQzgT$Pm=iLM zQ}jyh6y^`3_Xr0B?Jk6z5IFyyens0%np5?Wov_QX@wJ9E4yH7sLaBOlq~5Wqr%5Pj z9FlI@nvSi_p;ka!vY3TzJimyQ)o{WhA-NhM#R2*Y(w~s~t(qg2A@~jB*CE4!P{f9R zx)z15fQHm^!8Qc0(aQK5%res5u!edZ~d>I=JL+xS5^$s-Szlh775Y ziu-X8P+bJgOr6TEv|O-N+lczp8e3CyW-Qq*+4_s%&5c{4!nS*|q z5Iv1Db5;la1&%!fm~6*|aTGDxLZ*=QHWXp%#W4$sut6XiPLc&u;5ZH`394gjplV8d z98=guR=sRjM%T1|E(X&;*+M)`R%%B05K4@RZ1149QgrJ7z!AEb>Z5~;;kPpu2pbZH zj(uP0wM}~QObApLYtTKH$Mq-Es2w+b0F4r%jAIx3}HDXe;+QPI>g z-;u$`9EOLzNOLwCYASaX0h`_7)2G()*;!SI<1|B@D%5)R z%;X7CiZI5KDjV}=LPHbmpz0{$91@caMCTxQ_N>*qWNN}tW-%leNjVlxu+YwI66_$J zM1xif!DnCUTx{k5diMr(yJ;Xd;CQZ&qI+3X_@__mgB1eQu1w<4MjrI$_usoFcL~w1 zEkMZgC&a%tHsmE93sd}ak8#seCI7!nNEj0?JQ;5!70{ymk4J}x1^GWbe9Zs&FwgJ5 z_nx5{oesd57}1cZmC%c+B8xvE1N5w?8NT+=E>%z&k-z_*ZV+v!vREgzojRbA(R8Y5IR9S(zHR0;=~Q|5f_mcw#vV$wtz_Eztk_ zhtG@p|LEZPqyB%8r=W6OpM>H#H|=kQ%5f8R>AG13WBgpxC>Wp<%~EPH-+#Qw0SQRUG`ZYrFDOslZ=@MEd8b?u=Iz`cBFreiL9d^jtzY(D7YlKoOeCp(GT)6)4@8<2lz1`jZ;iLWc5Rb7Ya1<<9c2`-5_hTS_t$FUzPW(5r6In>k$w-Z~ z)zJgJmx&VzGdzIICfo9=VpSe7xnhiUs^R5#c7UX1pv`V9&yK}19OzKsbIE_D{m&uy&MgM&+)2ShaNjj)I;j;mbE^bL!Q$ zY!lDj34vmw%(R@%O_xVuHaB}^~NmY)Bs?7z$#wHX7j+5YPv9Uc|qe~$Ja*Z&Xmtg?Q0_@ZVNpT&>1~ z(!q01!dByDs!+`qS%i_C#|7EQpOCFVufOZEPT|n)x)_uX^)H2md%kxe3b03BgG1fX z_4YNHH*HEJ zx15%&I8E$K>E(*fQf0Ze^T(01m2v(ku+wHug~j7hcYfFzo!WD`>y1@i%h||z%Z?l; z5Ex%L_-1HU+P1jU21nHlU6-&k8?QnpOMt+)P?vVy*cvAIp9kUcO`j?bBE2gv$`X^dV?qhcqebaIX6>Ytk#Wq zYRcppWh3Ebi-vk*y9YU#E7I+A@AMXG)B%JD0-y4AIK8x(X!+uf!@9#g~d({6A@ob?pI13O# zVo*K&I??+up(SYEdF2~uge?+@BlmGKq$1mT!@}|MY z+h~^mql1H^{et}O9q#Wx%Kt+=|Mef;E@TqvYJ)9HN!IQDcdM1VGgj+?01fBpYwe+H zwVV`Y0%0hvbMNY;4f;HUt-fCT4UHL2$EF`TbNX?swlb9hK1cu z>Q)Q1wN9-$WK0UlajZt^y6Wm@rpWdo8^DYt#* zafHW&dw}8@C!GA2P(dXTtyb6NnZDQm+h1E)y=seGxLGI0``e8M3pi_-k&rcah!CWD-Fe|zQ~ z_25#74`*q<@SnH0vgF|%WV4EgR7jz-@TFgkfZ+&IOxsk}0SXeX=w&*ln*m~eAJIB; zCiYV=AR#fi9$nfw3{y!)Q!T4erkTFtRvbPu6| zGtP#&a`%^Sp>HASU+!A-Tb*IM^0`GXiSRjv8yTvLlxlz(k8WGHs9X1-hHuR^0PdAe zU8p0oY^ud8-MZkLm~)r6hg;sA8Nn7XV;YdCqws*cEv}mI zFaQ)DCkB>e8EYsUoU2F71gs}vJBw|LPR~hRw=Fs)dVFY$kdV0j^Hm)ln2&|g$H#mu zHjaeFgGTzGghB=IaQ12n`r{b1G8@@ja1Ad=W|N|q?4+gnl9IQ0U&pGZJ`kR@y8#3Y(xz10$MPX8nNTEQ*(3B+D|iLgVx&rLVkFCka3x}k1~Wr!Lj$=iVhL|zeHXFs&tGo>two5H zvolrWm-5(~EGN^NY}U+U4q}Zu26CH*;HqDreQP13hCDtQ|t$W&wbC87O};e|A%!cRDoCn#oQcj&6Bt_ z6yIE)p=~n7H0-QLwq}X}Vv;S8NwX4{G}1eBfEU6+z=;rO8}@GaqE%4^Vv8s?;>|XX zHWcA_!e($<7O@El!v#dU)nf=H(TI{TK-wE{KmPAZUF_&uD(==BCV&(?Ulwh#e z8#69Ds}pY-#B^@uX6DZgrKzzb3U@{fCvws}hof8cz4;FJjlO>O?dezPUmR5PJzF?~K=~h}oN% zu8L4fh?yANyDpMeMJ#5Oy1xQ3xCniXXGP}!l?|6f?EkRgx`?ervBLFTSG912_eSUL|zrKF5Q$(!6Yn^UQu7en)E?Et$ zg^1;Ii!@oV_8R$Yha|;pTXbOCJCSUPCCLX>p&=PDPSk9QN0M-xkD$EAokPsc9I;^e z23xBnno-Uo*n^m1PSuhQIBrPbPF)sNVO|5WiDLO29ZeK_Yi{QyAE{c$jk60KECT8! zvFIzbo5i7d5-;c4sI$jPh#AZAZdf%VR@|0$wuw}6D{N8UU)WL=Y^#a0 zEWM4M$G6FJNO&&lHqHC%gd^OEW>@`!X`wKyPeWI*kBs-FLO8`!RLnoNDrSYbq7Ji> zfXj{wm|d8duf=GY`m118kQXz3HK%dAs-;=X0tYR0Cvr8>tQIq#M8`rc)vu~(mPgBC zmDX7mvz2HDt-NK?Ib-r_70gVXwJ}SrBrl{>+OV~M3E@9B<%cfZG~KR*Sz(GTV5U~d zMAYDBF@qu`aBy57xf;x>5;9fbmP$Y_oziBW8VSf@1_^p`_>zQpenET|1zAYoss4rn z^$`jE6)3hYvP#qLE}&UVI0gOY;ACr`!MBZ~v;t<5P6tu5ixYfvJ0kb;ctdq?RVOB-6a@NcmYrEw7v!1eeT_LTpwkvW@ zR{NJrm|0b}HfoKS<#RPwt^-P#r31MxYBiXZZXc=LCT2l;2MUVyof_yAQXd3}j?k6; zc!j7y@bx$h*$oMhPL?u2SAvbC-iMrE?(lHsdb9FYk}CTQFpDJZZXCT^`!0`J&0Qr$ z+-}iZ7LX#*kSe-1YBe;gz8|Gx-UQ4brxCg)b0nEgsj&#J<@jt#%yj39+jtIUy1>Se zEBnFqUPcONL2ZjZDA-sroe*@aUG(ccHL~em3e)TjO=%`Jj9d+7&J8fln;DnRRWTdK ztZFn%m%`NPvuqQ+e9g={c-2Zk?&_Fj_F3eFK%R=UBHCusicf=HB z^U@SVx+HS1lUZ+c>qgVwrnV?hPH&nyB9M2Du7XM#v$}b+bbz+1wtJ*@qlndE=H`%X z)Ee(hC}B8_N?Fmhu!>qnS983^l}@zjhN-{ za;%)qb?q!XD7_rgOz7)Ax9IAeLH3OA0U3MLFL(1#6Q2cvOBPknJs~Vv!Na{g_tntM z=67B^Z{{&G^)`WA6=r&a_WbMPle-=nHlXisTehiHyJ5S^S>l>4)rWYpR?V_?h<%ga zb8&pgE&5?X^o+)kNecQGlnA1SFWaAC9I{VripJKlquIDBH)(w&qdvDvi9k07cU;I< zio}E^VE}n^09ddAj7?Zo6~^^J$EajZn5xJm;Z<}`gj$WH={+F!*Ng=fNVU6zuugYG z1san`*>fat@-&swV|b3CQH60+GD@|yIkw*`@VzEcx?N}D&x?ibfyTITsxMFS1(ZDW zO08vpZdf4fPztgWCc-RgEca1i&}o=gvguzbJ$s&-U^iESGfG$8t{UEJGJgTTkKeq8{E9kPl}II1b=RyNEvw)mo8{75naox( zXEPd*0NqR!ph5~ONDXx-0(3_P1ITk-m-Oqu(X(flG=BDMfd0u6z)5L8H=)-D2h7jg z&JUeA?j#qQrexR6%!L9XF%3=Dst?A#K<_WmX)ZTGmSinpzVHmTkhU(HrF#>0)0M23 zL;>ND2f52Nz^;PPbxL+xty2l>a>-dV4(D#-1EX|MAw2@**Nf9Mb8Y~frxS#dNF3u5w0NV^aZV!$wR19$k-vp zC?Yo|TNprqJZMtn^016dF`H1y=-nx%QC4mTsU;Ge$BHc0Vn@w#KBs^;nkAu9v}yh& z2yOFB5-hEqu{qy9WU|$I7n2Bmu%kGgdq&FG)aG3my@=fOhD>II-B_&SOv<`XX>%TA zUdzta8(A8$BnoV*IucNcVmu~jn;Orr&;-Bw$UY9cR~@g_I*n%3q=WmKf$o8^wa0>o zU|TCPU-f=vG(vw@)66ey^ouI?%aF+{oB2lLHYGx+CNU@25bHPya`AuVph|@X^3@1K z4oIw(AP$12N@?7xQZP7};m9WeVsYy1223{XIZ$+%Kwx(#C|dXs4*24W`D1U{AB_Ru9m z0YifARHJ|L2E3G|_cnmjC@?)X7xso2rMFHMk+PLet93d8geQ2W8IS~q*y&0lzk=XN z1lSvn0D;#IiNfLn$1&O_-q?fWA{n?Tk(~NqZH8<-)@&0qE(v!=4SJ7e6zfiAs~{aE zoXs&Fx}eiIoGVpMBVt%Pi+=Wf#siamtdz0PmQs_N!w9xDmkAWyE@&=DwhF9ZZg0&# zWpCa4S)B`fA@#DoI>&-mFH@NAC9-FX%K_@|?H_1HyP#7VV(v0oCP2ldsAH29SGO7Q zvOX8?(fvFy&@3Iln&Ptmj%o+7ueld5*K`9UkGwT@(o{DtyB$sv8AfSjS87x|~Y-w$q z?zcECWk^TA?o?iv)Ki9%GA)6 zHz;@N_6EU(s@Q3AMqN)m=#sNU&1VzF6tlHjO}sE+H(Ewo3+Mn zd@4)^O(20{o(~{MGT$m1Co~`pwzpnvht}|Rt9RAHLuY^PQXvu|IwlQoJmxrnJ}GIs zWN6>p^>$mWu1?5nedITwmI53b)JIGSRhDUL3H(tj@RmHgWej+I1~&~lVh5QEGL^L^p#rdeF*80V?Nh-)u16+OnuQaMSn3Y zxTVT;^ujwJv08*g{@g=v)Ntp-*bF!fma=#gsqF7L@~uNho46m84qub`Z8~uMvujY+ zBiixM8LT;W&=g-2By{8nmYG3hmoS-DPJ5=73+9Xx`AGZ(SPe&WlmKg}_00*31oFDq8puOF_-5o7Nvpst=1iHbX%BHZcQvxm~B&Zw*HR5Iv z6#L0UblIpYC!}jGS?KKOQJ&&o8BZCJ+T71VExir$Hj_bm><`CrNVU|c?|`M2Eqy#o zuW1!W`;5noW3$A`)|n%MB`jrepcce5GF{zACfTUYxou7sW;QvLGCfdBPZEw0Cu7Xh znb?x-)w|bTtM%;J50J&%APzF0%2}XiwIUJzpJ&e$N1SmogS#orYoW@m%Gv zaJoX<)&rr)Fr2Fe<3v~5gYNBH+B<;M$fhjK3NZJ|Fm)z(#G-KC@sz@H<*`a7SXH1{ z0LRpHstZXqI_X3@YM2GI9g*U7r4w>!U6vbL^;+nOIFirj2J(oPDRXEW8S z$J(s4tTF0{w_6sCxU#NP&opPSD0P@wXNqBCZJKC5c=S}F5%vkFAU#zr-=vd{dbVfS zM))McoHDDNjCLSqrRUTR7!j&@t3Rx8;ApM}IYT4sg|VS>tnYSBv#>&2G~t~mMr`g^ zAS1oi0h25nji^s?sEgHDlU1xd+xum<|I3t)jUBm_{@G0g>B2IjW0=-_ipF~IY#$^; zvwg)Z-)kpENTX|^d7;)Ak%?rS;!yO|>L#2KFhTa<-~DdPgzRRB=yC2j@RsRGMe$+C z#ywqvbX6a;;WOLoN@o7t@1@g8Ur#4mO%kp|SWWsNV{jFZaZKnH2^wOx_EB123N(iE zZreDHMQ0~Vhd%3fv|)U$G{bhb``hu*v9emOBX$!h##2Dx(45f^-_a-ld-U7)-+4+r zqp{V|-@gA&@vd(KRWWX1+8uI&uL;+KmiYyqqL|SLCZ-uBH#o>TEgvj#K(;WAVN0EUb{BBgzkh-5P; zj+J#DkeCx+72h$Fy}r|;Y8bRf__Ay)7#}V%N=Hw!+6aG5eG&3Aa1UwjtN z|5F(@d)YNNrd)u)rw#}n$Jn0`3tGN`lkWFh7!Ysqp-B3Hl+}jEpUUV!5j2?H#avP1}r_s$GuRO61~@_ zC$HXKyz1^L5&S+1i4d9XG@NU*$=63|@C`T}$DHU9qY=8{RKks3f{o-2=A;!+Avql; zGDjeb6&1)W0J|TkeSCpVFWTtq<8Q?T^B)&(KC#?u{0ZWd z6EtQs!ofom6F#Lv3l@%o794~$vvR3B-XHOnulgsu|I0|WUgq>ND`@>T7Ty24d$d=$ z|LgGi{^R|x5AqZ)2vw?f%=mnOPNNaWLh{5{3!wbzd4O7!Smt)ioVc77__#!du-m zhM?6&qa@OIb9HTBTT@Ikmw8v`!y7nW_`f@tr1$FDiOJry4^5g$cHmfNwS;iWsAC;xWN z61`ut-5*cJchLq5cHdbRn3#v*C?mSL{mvAHIg+8Q1qp>-p zreD9(J1{KLaSOT6j^LZ=<%BmU|gNJ$SlLbcD!n2u|(T zHcijr>vCGda{!W1kUUh)FRMV+HF8i5y&Gr`D$t2|=oJDTmLHFp1qFSWUW1#C1;pXJ zQB123*|m}PUK{AeFRC`A6lYDgh)J}q zGh=5&>lBNknA1p(P#edwmk&KkD-F<}Mcbu(sX0f#7xm1OYck(KPe5uF{mX+=#OR4u zaG>l=y-IadYB`Xf=rmmLi(1U$2KR8xmoS= zNMknbJ)AVIKEZaYrEYUF_m#_vOAFlk;#MJScNDdy1+CCzS;$rtv1J6TL8LY&O%G#g z=$1BMX*hG?<_rx-q!-y454`?cV*T%4FMcNvz=HMv^XGd<#r6OG{?X(5{~?|`tpDNu z>bi^RYh^XZMb5qV*(66t={!0P*${_0;VOP~VYmewN_CxLAkWTkJ3)FUE}q|IwLJ^P zHc$)M6>8JUW?EQkX`*8%V$Nbt;Y3)vac6_e11fj|`*g!37!&C&H)i@SVlRW28#zIy zGr~{UG{&5u_J8%gy?%GMU7q>t`M~R>0Acn&mt_MyrU(8^*6q z$Csm$sdKg>v7WC@EAmm22%H(q(aRu8qp^4W6<7tEB%RM$^eY=KNi2j(6UOPkAb@Kn5;j%e94SxEUoJ~Pp9d?@Z++IoG0oV1CDPT@T%Kw=S&z+k0S9|^ zynlAMY2VxbtJgY)qa>0ce?t80n$kB|$Hh6vg_20pFfFj}?R&dAq&UC!P+$y&c1(!4 z2|E*o1NZIUKYeN=l!gO(_K>eaiwd`GIK0Qnn0y3>7@XK3I6!QKe*Yb2kvbgEr%z}| ze4GfPA;W116Tf>+bSR-MOC$7O``*3@3O7kf+BA}c!x$+<`r#`^ zq)dWNev3=Zbmum1&^D+K^_zqs#nw<483orxwx)+(oAjYsX*K!KXl!p*)&D3wYf zT2ZqemFR{=PbHEQ&Tg#gSM3@sQ8&G#%x&)s!;w(Cxl*g^7m+mc?H5S}+i;K@soh3i znF{XC1&)G>`lYR(Q}Mky)#&;kp8$@Arh^x#{Zn*yd~xx^yYrV9=+*i8yK|kx4CK*d zRkLY1IM>%BTKO%WNrgk!y76{>qc4o5lzZ9!shphiEtBTBJeiTm+|tR3n;2~eu@KT6 z!cE>d6mSY^NFdFSJxNOD_U*MfOO@RVYtqglKg4t@HiGsy35WAX?$KkDSxXp}{=ZaOZeycrpBhc5oPP|56`=8BaW@)nIS4Zp1YtjA}yX9@dH zU+;T=_TRz5;q#*X*FW5SwErIBS;78umi#*Nole$;Oe8_c{4jh2|7)Xdq^%A3dCr*3 zqGqi9BPT?cMs2-&XHAN_**M=qYNv5Brb6;L<40SDG zoe`Y|c8#;*1*T06<66G$@6>ttM=-=kiJ#dBCWMyB&#F(sgn`AtLt}INPjs$orF6_nTbaXl=5Ao}l4NY0)eDQl1?*jc&tfJwU+uz9>16wN zZlG<6`rr~Xq?P41ARr|_wTwgK8qgijI|bUvbLnTJB0FD-m_2xRz93=!+~(TGpJnWS zvzL441;9f4zrRA*}KkzRTc2aa?) zcQwJmq0C zckp7t-fUG2N*4a_tX&vK+vK+#@TzEqPPtTlXn}6P8F@VoxU7(U*GZ(E?=Z5(b&&Zs zNb_@40Mz-b2kt^piQ1_^Z9SCjQXBRhKqUgXNLE8C3y?-K53Q4Z8-)zZql4mi+Z?cJ zxxrh-VihxG^Q!Jl@0d%j%mB0Bt@MC0887EC(K#65{t25Ka0$g=_gK#il(wG37qM)) zn!{+@6+s4HtsG=fiZX!vi<-j;G;!`0J7Bs7*CB$oS&N>h1!ybMwOqY9hGTW|-aBKtlTy?W#;x8uC!;LaklR|C zj66}})-y!zZKVU+b-^qiTm}1$2Cb$6B4oDKb0F1t){#A|d=R5t4Ad6~dL8U#ePK+|gGXjG6e~^ekcjo3ncN=Kt^a%l3bN@A3T4gFGwv z{~cStkZZnH9T?WJ#kCG7AIVH@oT3tgLy(>`7ujsHz^n~b;Jc|)ZVxt?Bj4Cn?n%n( z@>;b7-Qhf6!`zBj?a?zwLCqanaK%>~vbhI2R)sk+>z;sxZGSQI^CcG1Hg^F@DYn*x zc3twWN~%Zw`A2`2(EplC?ymk9`hWI{`JejFpFiJ!)c+6htf2p2eT?DKgNfeqwcZSK zQAC}Za&=6%bQBWmf;O?{rz-hwMmVPdLAT0mi+psn4}a3>MKT)EkEq=(+w>YqbLF1S z7z$`AoYVVDM0$@>b{_{Q(nTFG6H0m0v-@XdJG&jxe_KbyE#d^Sc%$}T+o=6Z`|h2> zDd9#*7|zje2@dIqs)b1$Lub9#4@5(U@=~>-Fc)cHHQYGm%;edsQ7>B{_p!Y)g9@~5 zNcHmVg(?f4u$cHAuXQ>~FAo7AY3R5^dzv}8fbI|+4tG##Y@2CrudA&*pJYF#yiz=Z zR4T9(-Q6YRlgLB_EX}VDo+&vrl>F40;+lKAGJ-`e%t6!buEK21E98YtnBCa(hvdcj zrL^Wo=R%^4F>Q_*)r@gPXXQ*>o-V1&yf>LHEcX-(FTHWvfRigMPNNMH(^zT)Vv~|5 z-_)|AQLB8ti+M-kmb<-ksoZjT+a<9(jqQjh-CQo4Q(w-)vq}{Agb}U$!8w7?B zeQNV(FP@YEPNjlPzt(El`Vu+PR-~$FAkF7Ci2lu!|lg6*l%d9%l>KMiDv}*XwKJ$8<&_yR1kA;U)!FYHc{jAl*yj zSwuW^tZzw$qx|-2I;M9A?b(>^UlSqC=5b2=4pbRd-w5ad27jf|h^==o!j|p7ZW*Xr z8W8ssPew_dM?BHDH|ZPRZ-~AYQIHwoI4sf>?t*r+W8C+CcAiH|CQNC2s<<-A?^>sG zXa#|CpkEXX4rA(+>#ew2?3#nVMZVAGcZj4a?L23DYr1~q+E^B6uX^Gx8-KM$T|_eq z*zQ+bNkzSLP3B9f9mp`ZhSt#;>aGdIF}EL8%fqOaYcj7s68P5fIjKTcV?fo#0uG~@ za;X9^c%gGV=LEMxZt{sIOOlhXkq>JuLsTuk!EtO43OJFM3YQm%MgjTQRO?BKbbavT zLUFSo7E4=th?8-|iR6^bh`vyAgmB0S4(7-Q*Fdn8RAxse^{$E&-jzG>YM0G2v7EF~e;3A(sWF5&g8V8z_jh9enGyaH$D(eIWuNMi ze41t!F&E53#J8m}6-Y>?*u6;>3Xm&=L1(ac35B|FruM%yu>a0OE2<@X($B_~SE!{O zM7;4pnPK9$Fr{$YLqE_kL^1WR(TH*(vkSfLwf0&*0}V{0s>cL%A;u`vmkMY7#q@M+ zcr!p8M**9rgwtU3aH1~ynz4}JC=cp~34v3ak|7)fNX(~07N&PDE&!c*Fe(h4!g%=h z#$A(RLSPzXS6FG|#`>Q`GBp14MQ4;zw{%FkrN#{|rG;zxAc2RzSkT-uWll*$LwRXd z%-dJfgBIX)9x8FER#4lgBZMnhShWQgZD-fy!9;F(&r$}CZB$X*@hR=w-xth^lb4}1w{o!d&cW8vNhE?A(^cGJ4iaY&ai(0@&i#g@{yT~)$PYW9!u$=XsHc^W6Xd-DS zyfKmAk@+{AO_f%6Z{QGZC@%^O0uQ`ENI)2%iiw>MG1HRI_VrpkI(Q`R}kdW(if z2PE>{+~RJ(opXkT!&4-}!;l0y!lnZC!j+=BQ$J5^*yWicp2gfL)f{I{NlQMPHU-Go zwrI2+j4GJaJ%Lt41ri|KDf>&gSKad1ystA@S}T6G zh1!aS`yyk-_O_d!CfA!H%d_LXB$Ru6{!q^{`+t&gJSO*c{LKQFwg4w zU)&r87n(H?ocXEL--dU5RUkWflBVbKNwqKDDX?rZm_k$8^3Hq!9Kq@90QYhqyXDL+ zMQ^T23Q(%%-r|#Q@kMi`#w`-i)#X~|(>D1Hwt;d*It90~ox|NS`q1M~?Vs9io(0#g zSX5UVGS!&X_U3Ui`SPA6^naG#;f^!F0{y>xv|Eb*c;0`E|9+5XCH)@-gs0v_?W|2* zvzB3+0x2sJg`j+Zr@muYyHNIlgHB4lZv`mC%R& zKYjYtMz?5)1vxrE-EKg97LZPbtLE#3h5;hc49zgtn`k=71ncPgh2vMCg&sURAk%p_ z-40$nA_Y*6GZel+AXFSu@O=pN2V{m;RegN>#z<*ezzrDz@QH6}8Z^ zq*!$&wvl#QdZ<%j7Q@fXgINouCOSiA6Yz+$shu+Q2reAC#_gLlU_$>|NwP|SGvAf! zjoHj{M$l_#(Kki{&BjyPsSHz)d^h|R?pZBtGNi@KXr?WdqIMiO-HPp+SO?#8GNVMt zM8&cHF#+Cp0A~$v-g{e%s`BrlEyCzA_PG{A&OYkHKmtfx%#cjLiElxnfLR2 z2r)aWa$>H%V$7H6K5WCM-#D2OF35N4<=_P}KTWATm$^lYgM7DbQ?GLSsgv8dbl9N~ zFy@ta&>H>tM(EI&VShe8pZ8h9{=dOIqS5&7OMr#`-`$e`_ppEXX#YRNvx5EqgXRN- zhb)oi!WYiM5N?LR<0i8|Wg%1k5|10wf1fiZoAi7oG}mW}qX2EEo{6>%I&LE;p?AmR z6fI`&zSVod-_R&P?Joc6r{J$oZp8%e9UcwZI^F0G$LDWP-+ntl=UMMjKqT=c3DCAO z$(_XEpFR!L8&&4hr_K&C#zvIheW4Tj=`HhcjyO@>B#{Z9!!t&MGPTW(S20|>1%Y8C zno-UoeQW}Pv+Hl5Ftj0D*h?rNfDiJtbWJN=)k@bX*>ZdrkCVs$l4r60cS2fvzxY@P z90eS&G8rt;|A)K%;{EUY{m1iv5A&>`|4k$iK_`|8vdnndl|h*6%lArGd@U0zm9bX} zu+BMT6ThaxTsDY5zgAc-1SEgD#FW!vA6aK@igiv*?1znkPq9uNAEIlp)$Q6Sv#Q8+ zFAYr3TC#`cu*m8%uE^@4mwLT7(EY8QBbOzvv-&I?eW_T>WDpF<(y^)>JQD)A6d+x; z03jHDF9<*5WJEtM1?HN}Jzc2)$wmyiv4q*GC_BGUXfq$y24)50+HiPMJof_`Xp3ja zV2`z9KN^DQq?GxSLZ!$)QFL3a5*1nMZf!_p1@pESA(nZ-%HOKv8?z0V#X10T9K@yj z@+{nn5K1>Du`(pFAp=A5k%koWxpP23`?Mh|107GKb+$2HIPur0+!l(8%^cF8u0Dg> zScrDcwdQ3gIvi6B1py)NBtM7$pFm1yox1=fN{Z3UAS_=}f5w-XD-yeMT= z!KD2sE{;;|vN%_;erarYq^pK_!>i*Q2Kn9qk}jj%=pO__m1`-?|*ub=T80~#RM#p)36HWXNq<`i={S*-R~fH3a8kagaYMoDSM_YRioe9gV!>MU9=u=L z2jQadMY_d|s{1!^i|Gokkgd~d3TLr1PH|SD%LQES-zQg?(Y`33oFH-umt3Zn7CGZg z$t9Rxm+uN9yJ<@44SL`VB9FeeWsQx^`QE_z8g69SxCGvJ@d+5Pe{A2I>BI`-eplaH z4U~0#ZwBla?t5F>LsMr#-=~LW!|R;dJ}h$6I0AJCH_g4eM4Of*e-P(cQy11zfA{Ya z{oG!ehkI7^|HVwmF(=};a0M6O0{>tCXulZ$wSVv!|Mf7>UHpG%nh7rc-`5-W{yF^h z#W(;noa)_wS()`bfKFTY98Dpo)#VRRV?>;COuU|S>$i{|_7?rWe`-}{QoPk`43*Ax7 zMlbK3sA!@%9u34^HFT(vIhPuN`wb&%?%9{*)VP~f9}u4gB+YSdE*K=pB#Sk8HqCiu zW=jO|Y=+xhHl}Mb@3K+XeruZ7YA;QLoKoiAH;b*lfrUl}YdeJ%lz8o=(%gf*U0<-k zYjWyVmU7y0*i&-~+>o}gmPyX!IyCa5{@MImi)YZ)JROVSITM{GRP8k{D==uWk;NM( z)eAkF!fLxXrVcLEeyUEsI}MA$+BQ}NykU2k)5R4z=59{020&~2#oWRAW4OjjCgF-h zP-9l!qjzSr%Y&tRbT8T?EBbx9+r3zWfUR5>%?7?ju8hSclQEyux2jUPWK_%ArCF%D z#e2{suCaPIRgyP%|G->a*`Lj6HWYPurS1)w&p@7&hnyQ{p)we266U26NZfMse} zA})xz%MVTEK93uEMgK1+0bMx};DYnNNBg^b#rV(t$NYZ}^R({b06te-@E6H(KsFx$ zs#)xd@%{oj^^RZoyq?cjw{So1-V!mFbIj^$%lTw$V>5F=uE|_@F_bL;f~13((|?iR zJ>jCpNtXlWRPkoIPFv@}t@mO}Wn=O=+AiG2SLjE(Dp;eluvWPO`K_{R);U<`a9`{C z)uOw&I?Svb!x>QFx*t~}Rq8}sOeDAH(&Wiu`Mn^=iM~m9wed78ycowskh7K0{387M zPS*O2LhFPo=BQooLrwdx@V8AH%P;S=bK=|z+}049=a#JZZs%2SZNn?a@m<%8 z98p@qHqF)5lfr85r)n5$uFW*iFVg9xXFPq6fL)5|-Y-pQ@X45o^Bz}O8?!>{r~Ue2 z)^*%5YbO24g!tFlU9&)Mz#kw!6_%nx+jCZdYnepb#%4hO{Q~t5I!lj4rP;9t|5w6u z4>mXjtWwWUU)w9#Tpc|ZwrgxJ)quGY;*N7i5!+_-LtkxJ)x0aQ>BY26zlw$@KuTgKq4v-9+YHO%SQo5C=l*qQ2W zFRNV~mlJcLk!02m0j#630YxLnKJn&w8s_qxWlOypZ%SrV)Ou5@+jXvp?=7ET&D{UB zsC`|`^vxg>V2P`nsE>PC!m7_EDt%Xwm-@zX%caHKBWN@(Efz8!_R@i_T@{(z(JC$$ zTF$slxy)WR)+p_Z`&8SPb}>cWLXpf}Fz4FB&YzD$^RPlwSZI`>qi()?wkTYH;`GmP zBdZ?9u>Kf%s|aOYc8VU$yI#?iNnG98O>I!yjyWExcH8wjdF^cJ)3FKHoHym&?pbM{ z+r6z)iG!KSaz(~Oo+O-;D03;cOPAr|C`dI&?mop*ODkQA>C`Wxk*#3RWwu!MbrH?l zgP)?GA{&kPXYo^1vCgTv&eQAE1bXGy{~A18>Q_>0=>vGwAKDsHrZ z!U9Kur`BK@YhQR2&3)zsPl-h_lxI*u48Yqzn${@*<;=6~rQ^$&L+?f-{( zw$K@tN>jmQzIwpbv=gCWLc>65@fiEpcua)X+CrBTDv(Ixm~knPn2<1pm=`ovJVc}M z4&o%llFrPunZ3tR(Aq)~8S5zNZS9ya(WvM@Iv#o#g>%FrsHspwG2tkr5%F5y%Zpzw z)Fjv1LMOnX=>5qB3MdyXZ%kzm{?+KWyy3ri5B{|;CgYy^$Nm(vsFwj6V*fgcVeKPY z&pdGxx1M=JeBFBH$!Xkr_J3Pj=so6?B?6tkd?i|5%-OHRmo1M51ow0~&VFrqGvTv< z^!`9Ti8}c|e|7xw%`0yjY@m&1`9FNVcTiaW_Ye1XAMgKukY@{ht?z}i((sxNxw2YL z6g#w9$LPa9NI1>E{(0NpET?7(PfXy3xt?S(^+hk#MSn32wWZ2*!23PsEQys$(M*Oy zHl{ur5_vGdS0uwwS_KU|L4o|R_p5ON?F#efW#yUNaRyutamlH4h%e)=ZzzE zfcoA?@1u>nF_-ZT(kt;yBkrYm=5N&)v^d0K(t3gv`Y3I9j*?i}sc9*|3&-@mZFkmh zUDGHSAhm+0<2N{NO^L+HdR8cFge#Uza6Py;O2SabLc)Hwtu>u%(+IWyLBf!s9~cjV zwnk!W3!O$Xy$G& zh}@X*Fjo))HD?mB;mr-(-eHwWSC%qhKk1|5o(PATQ#u)@xh|0u;CGr zM4+?mQpNKml5|S)D8`%x9%a1_+Wz{xv-6IJUILa#{Yvk|Pb8bdg68t|1@Z}(bVPkD ziP%wmKZct$BgluKSX2E}{hhOfBOIq;VnzIG7t3{B^H{Y$H;b&Iat z@ak{gy=xmkOLoup*T?5=_3!_*J6EU)lL_WQ4ioj_p)rYBU`SG;Nz4L^NKgG8Nm_+i ziiyvrF^fnfQ+zTH(N&&L>M+qHDbeKqFacpY!7(1va7l5h5R^N~*YZ!5BrX=V^~Got z4Y-5tJ9PGxk~j1DRk6Ef^p$p$m@7^1sA9XZysaloKcq@O+OtP=l-_ylw1B7p2ZSK9 z<0(GzuJoLS>`m~sc>0`0zp|m1nIBhGc;YzbEanv4xoJ_DZY+d5jQa|BW|Mdk)n)N? zAlxIKLSjiqNhnAW(Pi;;A>1FHG=c*vuo^K}#gh-QUxDNbc%FZKe1bR;Ea5&` z1>F_pD5yqrX*^HPU*3V3tKu26koxl~RF}mwW`Q7n!l|4aVE2J%MC1+Q*JovPm&MaS zSPjRO@wARCWjW_5YVj000)^^r3s}5>nLW#N_rACP*A)l77EhS+UvbX(N|XJ)&+?mk zR<_%hgSvvfaqou4rk?vj)D;B+eC8$bnB#zChXnN2nUd90iEd~ZA`*!NjzUzP^cd3_ ziL}r7hQJ#Q5>~i+0q&vG5xUAY>okjBS<^>vf>G0&oN#u7aD)IsSR})Hp_c3*h8kmp zVcF?rwso)1O#i)7@XmcMs?T+XF1Ci;Js zmXDfOh-RHp5{3v$g6pk30)}^>$T?%Oof_#jQbTN#-Y4J4g_MKAhTWKW}eA z8P1sOq_Mt2@&ppjd8ncTaT135D1f-C?7&OrUlXo*5S^1T6_U@9IX&v?eSfF^+g>N5O+F*XRaM7JSlzw*HmgZ? zMoXkVPO@>BMR~vRKwSw>&^@)uDW2~LNJ7W;(HN?Da zl(A~^gGJ4%Mb&o1B=rkUeC@IEDC-SFHty~1_W#z~ectPT)x$CEI<-ZYM%{k5f7El- z`aF{OW9kC;i9l6Ewd;#BEGL)qm|Qs>JmWNy!XDr-3yjzlwDDKzUONdkAWIcXjxYRa zBB~kalMoA`X7;N(qS8XajS}~N2~mB*)3GRU&G-4p6naX2%cVC}Pr_ zuu*by`T7D0I*v>^yZfbgk%+WgOjcgq>Z$lUFKf&)>j}#WR;aKCAu8AcuknzC_qAH6 zYx)i@_|48*i=68rP{p2i3i6&`$9--KAYEZ48Z^6o3z`PmTDtUti=#3kN;YOzi6y=7=u>G8G4FpO4=hQ z2sk}msEB`MrCXJFHzSxPPDCJw_ViNIr=TZp`v+!a2x|3Ww+vT zt--%B_5r=)Fl0C80HTf?O+TBoi%fSWAjN@Qt~H?2m8qZ$0}P1~yq@}-AV7)P8)PRWcw=rSE49CCt#Ir3p53Osi;n>*Lk zHAxTi6hdtiv=_Y3hs;??16oZVoqidQJo%QvZS@-)Ac>HkbKqg zGk>JV&cl*%JSLlqn)^JH?&f0cKF_R|V`e=ho*!c2I;mYRwHY=94u*_dV`ZBONg|(A zD@vz8#m2%}_VwrOEvIbF<^pigWvsKJZpxPXf~~dL|aQkx#mjpR_Ac}Tw$l&iFKKaLxlj?s&eUN!Y@#Cq+iV(srt9{0@T!5n>s z1B*v=xd$Wd``$H$o@Q15rC@0SlwYu1@VTkq%o*m7V}NcF1BeM3)=c6tE_+?c_d1LG zRWX)IMyr>`cr2QmtbbYM@Vl7Al(4Vu3oU_*lg@sMorLbg=0W4K7)!;BTrkPS zyn3fH0x|wfV`UA(lr-??M9tO`A=?vSwl{E@?R_x~L|{>0LP2;m>Wu7Gj!m`>M-%T~fBiuiqyP)2q&>)8WPy|1qj z3!3}+0f(4KeAiaiIetB_Sj?p4P3z2nnOL}G(_2a-80yW;2Ort!KQFru?E~f9gckcX zVRlB>+0Qk(8Jh|Q3Ua%)5RfyX16Y$`i1)H$;$em3vX1>82Ha`1nyS9br_Fv#2tU#u z0AiJPl^O1p#?)kxYku$* z98)$=MuOlL;HMOYQ9vOnST5|Y$sL>-H9gXN)MCHu?u;C*Z9nhU&<8Q$Rr`6@+&!-e zy&Ef@#ELEUTLOWv&IH!8Ujy|2UKYG+IRoMRyhif?WS?f#tzfyBNJ)5-lZN%ywcHy= z<$>nTtM;q-d}bR~d_0vM+g3h%W%)fM_m34v(LT!87`i7`NIwU8Ob^0)Arr` z3Oo0EZLV9lqbqFv?w8}^dG*3-CCWvbGCn;aQ@!?EWdRwBLRoAO+X57s;v`?yMvT_4 zl?b|B7-lqPBn5^Vl<|ztiS(*+G^rYcCAakf`vHI|GrF${GCmCelG1b-DV5du zq~=5GYy%4})JD%hxJ#MKwkiR|$&K70zxcJI5?9?cMZJPm)<*Ze1-%{D zhD;iiD!i=Q+}XK~F?zRQ4x`sDc#2(8Ko?L0$aELaE4*$ipKaz6)ozPOTP;%hptLRp z$z_!J!p=)e{hXG6k}P8!r;P?J`+0?DW@y?d;GCA`Q0%%)Sp6mAH!)%OH%BTNZEhRX?bgp=N?e=svWvx%<7h}Z{JXVLDxs|Mzt=DsOI2r8%@x7 zm1_ss;nB(4VWck2JQWKrMN02;U&7AL)83e{)4#)=2`gTj(0WVOy>CxI+YBapMw*B` z)+?uw)v1A5?hG1%p0f~jfKoG+k(B02Hq2(hA#pO+J8dcz%u5S`j>yqVrh47!^p>>w zy3;|Q-&kt8A~f}K2QS=E|D;JQ!ByW3xgAvFj$URWSKyI({o>_$F{ZIf@y8CrKCBBJ zT%|?r4G;?WECtu>z3zOC^qd!Ye)z4UCpaSMtDhhY6B>(zZU)yWqJJkv^nFG2A4U=V zM^HrndPO)~&r=7aVbl8r^rM|`uiHT(~daYE-0a=2$5%^O7pKFCMT4rBG;sn#K2D)QTI$d zg;eyYv;i2T?(lp?pAb47CM)2`>n$z1+d>wkPb^($xE0jr3+QdC@Ot|)`1m*&@RPTJvOChb@ zkq`c4^1y-+PPGx#%ouHE$iXbY8QK>9W|l3 zt#(D^oEkC*2MMd($T-))zIL!tv_rsIYHQNIyySYUNHC7zV0Z1f=^;In(8)IxO!V|c zcnM6(g38sqH1WC}Mb=McOgYJ!sGtq2I%^`EzfJ^|x_dWaxzR{?sqI*^QA=SmubX4d z7tM?r&9=Oa@1`>BdXm!#&D}KhQA{QbUqE8BM8t*O<)GDWA3GPjpDy-3&DqqLc)MHu z85WX;F_Bbm+EHS^;!|ThCxa4jv8SEoRMJV2Ldy8LG``?^);%@=tW}{z&PXb^b1Fr8 zK|{^lF8;e0WVMgUF92* zmF9lT|BFRd{;XH8T{l{Sz_v@E;EBE6@gO7dj5-QEa9DA>(GI-S4LbI#&gRd7_Ln&+ z(e(<%<7E8B4-M( zPmp4w79^)Z!lcUCxKIrRIj)!lzk!~NIdl$&Fc@~=mxJM8*bB}EC%+$^p1|3`@$tdo z$>8k}j*j8Y(c!Oylflv95RU#02Zw*bAA`eRdqA0asdt%SoxaF{&2c%8f}sW7aGh6g z^6|ASiy + +# Kubewatch packaged by Bitnami + +Kubewatch is a Kubernetes watcher that currently publishes notification to Slack. Run it in your k8s cluster, and you will get event notifications in a slack channel. + +[Overview of Kubewatch](https://github.com/bitnami-labs/kubewatch) + +## TL;DR + +```console +$ helm repo add robusta https://robusta-charts.storage.googleapis.com && helm repo update +$ helm install my-release robusta/kubewatch +``` + +## Introduction + +This chart bootstraps a kubewatch deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.2.0+ + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm install my-release bitnami/kubewatch +``` + +The command deploys kubewatch on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ------------------------- | ----------------------------------------------- | ----- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | + + +### Common parameters + +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | -------------- | +| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | +| `nameOverride` | String to partially override common.names.fullname template | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the the deployment(s)/statefulset(s) | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the the deployment(s)/statefulset(s) | `["infinity"]` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | + + +### Kubewatch parameters + +| Name | Description | Value | +| ---------------------------------------- | -------------------------------------------------------------------------------- | ---------------------- | +| `image.registry` | Kubewatch image registry | `docker.io` | +| `image.repository` | Kubewatch image repository | `bitnami/kubewatch` | +| `image.tag` | Kubewatch image tag (immutable tags are recommended) | `0.1.0-debian-10-r513` | +| `image.pullPolicy` | Kubewatch image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `hostAliases` | Add deployment host aliases | `[]` | +| `slack.enabled` | Enable Slack notifications | `true` | +| `slack.channel` | Slack channel to notify | `XXXX` | +| `slack.token` | Slack API token | `XXXX` | +| `hipchat.enabled` | Enable HipChat notifications | `false` | +| `hipchat.room` | HipChat room to notify | `""` | +| `hipchat.token` | HipChat token | `""` | +| `hipchat.url` | HipChat URL | `""` | +| `mattermost.enabled` | Enable Mattermost notifications | `false` | +| `mattermost.channel` | Mattermost channel to notify | `""` | +| `mattermost.url` | Mattermost URL | `""` | +| `mattermost.username` | Mattermost user to notify | `""` | +| `flock.enabled` | Enable Flock notifications | `false` | +| `flock.url` | Flock URL | `""` | +| `msteams.enabled` | Enable Microsoft Teams notifications | `false` | +| `msteams.webhookurl` | Microsoft Teams webhook URL | `""` | +| `webhook.enabled` | Enable Webhook notifications | `false` | +| `webhook.url` | Webhook URL | `""` | +| `smtp.enabled` | Enable SMTP (email) notifications | `false` | +| `smtp.to` | Destination email address (required) | `""` | +| `smtp.from` | Source email address (required) | `""` | +| `smtp.hello` | SMTP hello field (optional) | `""` | +| `smtp.smarthost` | SMTP server address (name:port) (required) | `""` | +| `smtp.subject` | Source email subject | `""` | +| `smtp.auth.username` | Username for LOGIN and PLAIN auth mech | `""` | +| `smtp.auth.password` | Password for LOGIN and PLAIN auth mech | `""` | +| `smtp.auth.secret` | Secret for CRAM-MD5 auth mech | `""` | +| `smtp.auth.identity` | Identity for PLAIN auth mech | `""` | +| `smtp.requireTLS` | Force STARTTLS. Set to `true` or `false` | `""` | +| `namespaceToWatch` | Namespace to watch, leave it empty for watching all | `""` | +| `resourcesToWatch.deployment` | Watch changes to Deployments | `true` | +| `resourcesToWatch.replicationcontroller` | Watch changes to ReplicationControllers | `false` | +| `resourcesToWatch.replicaset` | Watch changes to ReplicaSets | `false` | +| `resourcesToWatch.daemonset` | Watch changes to DaemonSets | `false` | +| `resourcesToWatch.services` | Watch changes to Services | `false` | +| `resourcesToWatch.pod` | Watch changes to Pods | `true` | +| `resourcesToWatch.job` | Watch changes to Jobs | `false` | +| `resourcesToWatch.persistentvolume` | Watch changes to PersistentVolumes | `false` | +| `command` | Override default container command (useful when using custom images) | `[]` | +| `args` | Override default container args (useful when using custom images) | `[]` | +| `lifecycleHooks` | for the Kubewatch container(s) to automate configuration before or after startup | `{}` | +| `extraEnvVars` | Extra environment variables to be set on Kubewatch container | `[]` | +| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` | +| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` | + + +### Kubewatch deployment parameters + +| Name | Description | Value | +| --------------------------------------- | ----------------------------------------------------------------------------------------- | --------------- | +| `replicaCount` | Number of Kubewatch replicas to deploy | `1` | +| `podSecurityContext.enabled` | Enable Kubewatch containers' SecurityContext | `false` | +| `podSecurityContext.fsGroup` | Set Kubewatch containers' SecurityContext fsGroup | `""` | +| `containerSecurityContext.enabled` | Enable Kubewatch pods' Security Context | `false` | +| `containerSecurityContext.runAsUser` | Set Kubewatch pods' SecurityContext runAsUser | `""` | +| `containerSecurityContext.runAsNonRoot` | Set Kubewatch pods' SecurityContext runAsNonRoot | `""` | +| `resources.limits` | The resources limits for the Kubewatch container | `{}` | +| `resources.requests` | The requested resources for the Kubewatch container | `{}` | +| `startupProbe.enabled` | Enable startupProbe | `false` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | +| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `livenessProbe.enabled` | Enable livenessProbe | `false` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readinessProbe.enabled` | Enable readinessProbe | `false` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `customStartupProbe` | Override default startup probe | `{}` | +| `customLivenessProbe` | Override default liveness probe | `{}` | +| `customReadinessProbe` | Override default readiness probe | `{}` | +| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` | +| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` | +| `affinity` | Affinity for pod assignment | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Tolerations for pod assignment | `[]` | +| `priorityClassName` | Controller priorityClassName | `""` | +| `schedulerName` | Name of the k8s scheduler (other than default) | `""` | +| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | +| `podLabels` | Extra labels for Kubewatch pods | `{}` | +| `podAnnotations` | Annotations for Kubewatch pods | `{}` | +| `extraVolumes` | Optionally specify extra list of additional volumes for Kubewatch pods | `[]` | +| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Kubewatch container(s) | `[]` | +| `updateStrategy.type` | Deployment strategy type. | `RollingUpdate` | +| `initContainers` | Add additional init containers to the Kubewatch pods | `[]` | +| `sidecars` | Add additional sidecar containers to the Kubewatch pods | `[]` | + + +### RBAC parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------- | +| `rbac.create` | Whether to create & use RBAC resources or not | `false` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `serviceAccount.name` | Name of the service account to use. If not set and create is true, a name is generated using the fullname template. | `""` | +| `serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | + + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install my-release bitnami/kubewatch \ + --set=slack.channel="#bots",slack.token="XXXX-XXXX-XXXX" +``` + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +$ helm install my-release -f values.yaml bitnami/kubewatch +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +## Configuration and installation details + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Create a Slack bot + +Open [https://my.slack.com/services/new/bot](https://my.slack.com/services/new/bot) to create a new Slack bot. +The API token can be found on the edit page (it starts with `xoxb-`). + +Invite the Bot to your channel by typing `/join @name_of_your_bot` in the Slack message area. + +### Adding extra environment variables + +In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `extraEnvVars` property. + +```yaml +extraEnvVars: + - name: LOG_LEVEL + value: debug +``` + +Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values. + +### Sidecars and Init Containers + +If you have a need for additional containers to run within the same pod as the Kubewatch app (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. + +```yaml +sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +Similarly, you can add extra init containers using the `initContainers` parameter. + +```yaml +initContainers: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +### Deploying extra resources + +There are cases where you may want to deploy extra objects, such a ConfigMap containing your app's configuration or some extra deployment with a micro service used by your app. For covering this case, the chart allows adding the full specification of other objects using the `extraDeploy` parameter. + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `affinity` parameter. Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `podAffinityPreset`, `podAntiAffinityPreset`, or `nodeAffinityPreset` parameters. + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +### To 3.0.0 + +- Chart labels were adapted to follow the [Helm charts standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels). +- This version also introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/master/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade. + +Consequences: + +- Backwards compatibility is not guaranteed. To upgrade to `3.0.0`, install a new release of the Kubewatch chart. + +### To 2.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +### To 1.0.0 + +Helm performs a lookup for the object based on its group (apps), version (v1), and kind (Deployment). Also known as its GroupVersionKind, or GVK. Changing the GVK is considered a compatibility breaker from Kubernetes' point of view, so you cannot "upgrade" those objects to the new GVK in-place. Earlier versions of Helm 3 did not perform the lookup correctly which has since been fixed to match the spec. + +In https://github.com/helm/charts/pull/17285 the `apiVersion` of the deployment resources was updated to `apps/v1` in tune with the api's deprecated, resulting in compatibility breakage. + +This major version signifies this change. + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore new file mode 100644 index 00000000..50af0317 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml new file mode 100644 index 00000000..ae5cd04c --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + category: Infrastructure +apiVersion: v2 +appVersion: 1.12.0 +description: A Library Helm Chart for grouping common logic between bitnami charts. + This chart is not deployable by itself. +home: https://github.com/bitnami/charts/tree/master/bitnami/common +icon: https://bitnami.com/downloads/logos/bitnami-mark.png +keywords: +- common +- helper +- template +- function +- bitnami +maintainers: +- email: containers@bitnami.com + name: Bitnami +name: common +sources: +- https://github.com/bitnami/charts +- https://www.bitnami.com/ +type: library +version: 1.12.0 diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md new file mode 100644 index 00000000..0b310144 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md @@ -0,0 +1,346 @@ +# Bitnami Common Library Chart + +A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between bitnami charts. + +## TL;DR + +```yaml +dependencies: + - name: common + version: 1.x.x + repository: https://charts.bitnami.com/bitnami +``` + +```bash +$ helm dependency update +``` + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }} +data: + myvalue: "Hello World" +``` + +## Introduction + +This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This Helm chart has been tested on top of [Bitnami Kubernetes Production Runtime](https://kubeprod.io/) (BKPR). Deploy BKPR to get automated TLS certificates, logging and monitoring for your applications. + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.2.0+ + +## Parameters + +The following table lists the helpers available in the library which are scoped in different sections. + +### Affinities + +| Helper identifier | Description | Expected Input | +|-------------------------------|------------------------------------------------------|------------------------------------------------| +| `common.affinities.node.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.node.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.pod.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | +| `common.affinities.pod.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | + +### Capabilities + +| Helper identifier | Description | Expected Input | +|------------------------------------------------|------------------------------------------------------------------------------------------------|-------------------| +| `common.capabilities.kubeVersion` | Return the target Kubernetes version (using client default if .Values.kubeVersion is not set). | `.` Chart context | +| `common.capabilities.cronjob.apiVersion` | Return the appropriate apiVersion for cronjob. | `.` Chart context | +| `common.capabilities.deployment.apiVersion` | Return the appropriate apiVersion for deployment. | `.` Chart context | +| `common.capabilities.statefulset.apiVersion` | Return the appropriate apiVersion for statefulset. | `.` Chart context | +| `common.capabilities.ingress.apiVersion` | Return the appropriate apiVersion for ingress. | `.` Chart context | +| `common.capabilities.rbac.apiVersion` | Return the appropriate apiVersion for RBAC resources. | `.` Chart context | +| `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context | +| `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for podsecuritypolicy. | `.` Chart context | +| `common.capabilities.networkPolicy.apiVersion` | Return the appropriate apiVersion for networkpolicy. | `.` Chart context | +| `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context | + +### Errors + +| Helper identifier | Description | Expected Input | +|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------| +| `common.errors.upgrade.passwords.empty` | It will ensure required passwords are given when we are upgrading a chart. If `validationErrors` is not empty it will throw an error and will stop the upgrade action. | `dict "validationErrors" (list $validationError00 $validationError01) "context" $` | + +### Images + +| Helper identifier | Description | Expected Input | +|-----------------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------| +| `common.images.image` | Return the proper and full image name | `dict "imageRoot" .Values.path.to.the.image "global" $`, see [ImageRoot](#imageroot) for the structure. | +| `common.images.pullSecrets` | Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global` | +| `common.images.renderPullSecrets` | Return the proper Docker Image Registry Secret Names (evaluates values as templates) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $` | + +### Ingress + +| Helper identifier | Description | Expected Input | +|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences | +| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context | +| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context | +| `common.ingress.certManagerRequest` | Prints "true" if required cert-manager annotations for TLS signed certificates are set in the Ingress annotations | `dict "annotations" .Values.path.to.the.ingress.annotations` | + +### Labels + +| Helper identifier | Description | Expected Input | +|-----------------------------|-----------------------------------------------------------------------------|-------------------| +| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context | +| `common.labels.matchLabels` | Labels to use on `deploy.spec.selector.matchLabels` and `svc.spec.selector` | `.` Chart context | + +### Names + +| Helper identifier | Description | Expected Input | +|--------------------------|------------------------------------------------------------|-------------------| +| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context | +| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context | +| `common.names.namespace` | Allow the release namespace to be overridden | `.` Chart context | +| `common.names.chart` | Chart name plus version | `.` Chart context | + +### Secrets + +| Helper identifier | Description | Expected Input | +|---------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.secrets.name` | Generate the name of the secret. | `dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $` see [ExistingSecret](#existingsecret) for the structure. | +| `common.secrets.key` | Generate secret key. | `dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName"` see [ExistingSecret](#existingsecret) for the structure. | +| `common.passwords.manage` | Generate secret password or retrieve one if already created. | `dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $`, length, strong and chartNAme fields are optional. | +| `common.secrets.exists` | Returns whether a previous generated secret already exists. | `dict "secret" "secret-name" "context" $` | + +### Storage + +| Helper identifier | Description | Expected Input | +|-------------------------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------| +| `common.storage.class` | Return the proper Storage Class | `dict "persistence" .Values.path.to.the.persistence "global" $`, see [Persistence](#persistence) for the structure. | + +### TplValues + +| Helper identifier | Description | Expected Input | +|---------------------------|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.tplvalues.render` | Renders a value that contains template | `dict "value" .Values.path.to.the.Value "context" $`, value is the value should rendered as template, context frequently is the chart context `$` or `.` | + +### Utils + +| Helper identifier | Description | Expected Input | +|--------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------| +| `common.utils.fieldToEnvVar` | Build environment variable name given a field. | `dict "field" "my-password"` | +| `common.utils.secret.getvalue` | Print instructions to get a secret value. | `dict "secret" "secret-name" "field" "secret-value-field" "context" $` | +| `common.utils.getValueFromKey` | Gets a value from `.Values` object given its key path | `dict "key" "path.to.key" "context" $` | +| `common.utils.getKeyFromList` | Returns first `.Values` key with a defined value or first of the list if all non-defined | `dict "keys" (list "path.to.key1" "path.to.key2") "context" $` | + +### Validations + +| Helper identifier | Description | Expected Input | +|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.validations.values.single.empty` | Validate a value must not be empty. | `dict "valueKey" "path.to.value" "secret" "secret.name" "field" "my-password" "subchart" "subchart" "context" $` secret, field and subchart are optional. In case they are given, the helper will generate a how to get instruction. See [ValidateValue](#validatevalue) | +| `common.validations.values.multiple.empty` | Validate a multiple values must not be empty. It returns a shared error for all the values. | `dict "required" (list $validateValueConf00 $validateValueConf01) "context" $`. See [ValidateValue](#validatevalue) | +| `common.validations.values.mariadb.passwords` | This helper will ensure required password for MariaDB are not empty. It returns a shared error for all the values. | `dict "secret" "mariadb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mariadb chart and the helper. | +| `common.validations.values.postgresql.passwords` | This helper will ensure required password for PostgreSQL are not empty. It returns a shared error for all the values. | `dict "secret" "postgresql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use postgresql chart and the helper. | +| `common.validations.values.redis.passwords` | This helper will ensure required password for Redis™ are not empty. It returns a shared error for all the values. | `dict "secret" "redis-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use redis chart and the helper. | +| `common.validations.values.cassandra.passwords` | This helper will ensure required password for Cassandra are not empty. It returns a shared error for all the values. | `dict "secret" "cassandra-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use cassandra chart and the helper. | +| `common.validations.values.mongodb.passwords` | This helper will ensure required password for MongoDB® are not empty. It returns a shared error for all the values. | `dict "secret" "mongodb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mongodb chart and the helper. | + +### Warnings + +| Helper identifier | Description | Expected Input | +|------------------------------|----------------------------------|------------------------------------------------------------| +| `common.warnings.rollingTag` | Warning about using rolling tag. | `ImageRoot` see [ImageRoot](#imageroot) for the structure. | + +## Special input schemas + +### ImageRoot + +```yaml +registry: + type: string + description: Docker registry where the image is located + example: docker.io + +repository: + type: string + description: Repository and image name + example: bitnami/nginx + +tag: + type: string + description: image tag + example: 1.16.1-debian-10-r63 + +pullPolicy: + type: string + description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + +pullSecrets: + type: array + items: + type: string + description: Optionally specify an array of imagePullSecrets (evaluated as templates). + +debug: + type: boolean + description: Set to true if you would like to see extra information on logs + example: false + +## An instance would be: +# registry: docker.io +# repository: bitnami/nginx +# tag: 1.16.1-debian-10-r63 +# pullPolicy: IfNotPresent +# debug: false +``` + +### Persistence + +```yaml +enabled: + type: boolean + description: Whether enable persistence. + example: true + +storageClass: + type: string + description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. + example: "-" + +accessMode: + type: string + description: Access mode for the Persistent Volume Storage. + example: ReadWriteOnce + +size: + type: string + description: Size the Persistent Volume Storage. + example: 8Gi + +path: + type: string + description: Path to be persisted. + example: /bitnami + +## An instance would be: +# enabled: true +# storageClass: "-" +# accessMode: ReadWriteOnce +# size: 8Gi +# path: /bitnami +``` + +### ExistingSecret + +```yaml +name: + type: string + description: Name of the existing secret. + example: mySecret +keyMapping: + description: Mapping between the expected key name and the name of the key in the existing secret. + type: object + +## An instance would be: +# name: mySecret +# keyMapping: +# password: myPasswordKey +``` + +#### Example of use + +When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. + +```yaml +# templates/secret.yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + labels: + app: {{ include "common.names.fullname" . }} +type: Opaque +data: + password: {{ .Values.password | b64enc | quote }} + +# templates/dpl.yaml +--- +... + env: + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} + key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} +... + +# values.yaml +--- +name: mySecret +keyMapping: + password: myPasswordKey +``` + +### ValidateValue + +#### NOTES.txt + +```console +{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} + +{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} +``` + +If we force those values to be empty we will see some alerts + +```console +$ helm install test mychart --set path.to.value00="",path.to.value01="" + 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: + + export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 --decode) + + 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: + + export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 --decode) +``` + +## Upgrading + +### To 1.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl new file mode 100644 index 00000000..189ea403 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl @@ -0,0 +1,102 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return a soft nodeAffinity definition +{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.soft" -}} +preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} + weight: 1 +{{- end -}} + +{{/* +Return a hard nodeAffinity definition +{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.hard" -}} +requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} +{{- end -}} + +{{/* +Return a nodeAffinity definition +{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.nodes.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.nodes.hard" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return a soft podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.soft" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + namespaces: + - {{ .context.Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname + weight: 1 +{{- end -}} + +{{/* +Return a hard podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.hard" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + namespaces: + - {{ .context.Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.pods" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.pods.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.pods.hard" . -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl new file mode 100644 index 00000000..b94212bb --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl @@ -0,0 +1,128 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return the target Kubernetes version +*/}} +{{- define "common.capabilities.kubeVersion" -}} +{{- if .Values.global }} + {{- if .Values.global.kubeVersion }} + {{- .Values.global.kubeVersion -}} + {{- else }} + {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} + {{- end -}} +{{- else }} +{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for poddisruptionbudget. +*/}} +{{- define "common.capabilities.policy.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "policy/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "common.capabilities.networkPolicy.apiVersion" -}} +{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for cronjob. +*/}} +{{- define "common.capabilities.cronjob.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "batch/v1beta1" -}} +{{- else -}} +{{- print "batch/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "common.capabilities.deployment.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "common.capabilities.statefulset.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apps/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "common.capabilities.ingress.apiVersion" -}} +{{- if .Values.ingress -}} +{{- if .Values.ingress.apiVersion -}} +{{- .Values.ingress.apiVersion -}} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end }} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for RBAC resources. +*/}} +{{- define "common.capabilities.rbac.apiVersion" -}} +{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "rbac.authorization.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "rbac.authorization.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for CRDs. +*/}} +{{- define "common.capabilities.crd.apiVersion" -}} +{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiextensions.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiextensions.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the used Helm version is 3.3+. +A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. +This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. +**To be removed when the catalog's minimun Helm version is 3.3** +*/}} +{{- define "common.capabilities.supportsHelmVersion" -}} +{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl new file mode 100644 index 00000000..a79cc2e3 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Through error when upgrading using empty passwords values that must not be empty. + +Usage: +{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} +{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} +{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} + +Required password params: + - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. + - context - Context - Required. Parent context. +*/}} +{{- define "common.errors.upgrade.passwords.empty" -}} + {{- $validationErrors := join "" .validationErrors -}} + {{- if and $validationErrors .context.Release.IsUpgrade -}} + {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} + {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} + {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} + {{- $errorString = print $errorString "\n%s" -}} + {{- printf $errorString $validationErrors | fail -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl new file mode 100644 index 00000000..42ffbc72 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl @@ -0,0 +1,75 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper image name +{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} +*/}} +{{- define "common.images.image" -}} +{{- $registryName := .imageRoot.registry -}} +{{- $repositoryName := .imageRoot.repository -}} +{{- $tag := .imageRoot.tag | toString -}} +{{- if .global }} + {{- if .global.imageRegistry }} + {{- $registryName = .global.imageRegistry -}} + {{- end -}} +{{- end -}} +{{- if $registryName }} +{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- else -}} +{{- printf "%s:%s" $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) +{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} +*/}} +{{- define "common.images.pullSecrets" -}} + {{- $pullSecrets := list }} + + {{- if .global }} + {{- range .global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names evaluating values as templates +{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} +*/}} +{{- define "common.images.renderPullSecrets" -}} + {{- $pullSecrets := list }} + {{- $context := .context }} + + {{- if $context.Values.global }} + {{- range $context.Values.global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl new file mode 100644 index 00000000..8caf73a6 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl @@ -0,0 +1,68 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Generate backend entry that is compatible with all Kubernetes API versions. + +Usage: +{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} + +Params: + - serviceName - String. Name of an existing service backend + - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.ingress.backend" -}} +{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} +{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} +serviceName: {{ .serviceName }} +servicePort: {{ .servicePort }} +{{- else -}} +service: + name: {{ .serviceName }} + port: + {{- if typeIs "string" .servicePort }} + name: {{ .servicePort }} + {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} + number: {{ .servicePort | int }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +Print "true" if the API pathType field is supported +Usage: +{{ include "common.ingress.supportsPathType" . }} +*/}} +{{- define "common.ingress.supportsPathType" -}} +{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the ingressClassname field is supported +Usage: +{{ include "common.ingress.supportsIngressClassname" . }} +*/}} +{{- define "common.ingress.supportsIngressClassname" -}} +{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if cert-manager required annotations for TLS signed +certificates are set in the Ingress annotations +Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations +Usage: +{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }} +*/}} +{{- define "common.ingress.certManagerRequest" -}} +{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl new file mode 100644 index 00000000..252066c7 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl @@ -0,0 +1,18 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Kubernetes standard labels +*/}} +{{- define "common.labels.standard" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +helm.sh/chart: {{ include "common.names.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* +Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector +*/}} +{{- define "common.labels.matchLabels" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl new file mode 100644 index 00000000..c8574d17 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl @@ -0,0 +1,63 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "common.names.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "common.names.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "common.names.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified dependency name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +Usage: +{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }} +*/}} +{{- define "common.names.dependency.fullname" -}} +{{- if .chartValues.fullnameOverride -}} +{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .chartName .chartValues.nameOverride -}} +{{- if contains $name .context.Release.Name -}} +{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts. +*/}} +{{- define "common.names.namespace" -}} +{{- if .Values.namespaceOverride -}} +{{- .Values.namespaceOverride -}} +{{- else -}} +{{- .Release.Namespace -}} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl new file mode 100644 index 00000000..a53fb44f --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl @@ -0,0 +1,140 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Generate secret name. + +Usage: +{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret + - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.secrets.name" -}} +{{- $name := (include "common.names.fullname" .context) -}} + +{{- if .defaultNameSuffix -}} +{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- with .existingSecret -}} +{{- if not (typeIs "string" .) -}} +{{- with .name -}} +{{- $name = . -}} +{{- end -}} +{{- else -}} +{{- $name = . -}} +{{- end -}} +{{- end -}} + +{{- printf "%s" $name -}} +{{- end -}} + +{{/* +Generate secret key. + +Usage: +{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret + - key - String - Required. Name of the key in the secret. +*/}} +{{- define "common.secrets.key" -}} +{{- $key := .key -}} + +{{- if .existingSecret -}} + {{- if not (typeIs "string" .existingSecret) -}} + {{- if .existingSecret.keyMapping -}} + {{- $key = index .existingSecret.keyMapping $.key -}} + {{- end -}} + {{- end }} +{{- end -}} + +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Generate secret password or retrieve one if already created. + +Usage: +{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - length - int - Optional - Length of the generated random password. + - strong - Boolean - Optional - Whether to add symbols to the generated random password. + - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. + - context - Context - Required - Parent context. + +The order in which this function returns a secret password: + 1. Already existing 'Secret' resource + (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) + 2. Password provided via the values.yaml + (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) + 3. Randomly generated secret password + (A new random secret password with the length specified in the 'length' parameter will be generated and returned) + +*/}} +{{- define "common.secrets.passwords.manage" -}} + +{{- $password := "" }} +{{- $subchart := "" }} +{{- $chartName := default "" .chartName }} +{{- $passwordLength := default 10 .length }} +{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} +{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} +{{- $secretData := (lookup "v1" "Secret" $.context.Release.Namespace .secret).data }} +{{- if $secretData }} + {{- if hasKey $secretData .key }} + {{- $password = index $secretData .key }} + {{- else }} + {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} + {{- end -}} +{{- else if $providedPasswordValue }} + {{- $password = $providedPasswordValue | toString | b64enc | quote }} +{{- else }} + + {{- if .context.Values.enabled }} + {{- $subchart = $chartName }} + {{- end -}} + + {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} + {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} + {{- $passwordValidationErrors := list $requiredPasswordError -}} + {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} + + {{- if .strong }} + {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} + {{- $password = randAscii $passwordLength }} + {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} + {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }} + {{- else }} + {{- $password = randAlphaNum $passwordLength | b64enc | quote }} + {{- end }} +{{- end -}} +{{- printf "%s" $password -}} +{{- end -}} + +{{/* +Returns whether a previous generated secret already exists + +Usage: +{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.exists" -}} +{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} +{{- if $secret }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl new file mode 100644 index 00000000..60e2a844 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper Storage Class +{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} +*/}} +{{- define "common.storage.class" -}} + +{{- $storageClass := .persistence.storageClass -}} +{{- if .global -}} + {{- if .global.storageClass -}} + {{- $storageClass = .global.storageClass -}} + {{- end -}} +{{- end -}} + +{{- if $storageClass -}} + {{- if (eq "-" $storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" $storageClass -}} + {{- end -}} +{{- end -}} + +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl new file mode 100644 index 00000000..2db16685 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl @@ -0,0 +1,13 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Renders a value that contains template. +Usage: +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }} +*/}} +{{- define "common.tplvalues.render" -}} + {{- if typeIs "string" .value }} + {{- tpl .value .context }} + {{- else }} + {{- tpl (.value | toYaml) .context }} + {{- end }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl new file mode 100644 index 00000000..ea083a24 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl @@ -0,0 +1,62 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Print instructions to get a secret value. +Usage: +{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} +*/}} +{{- define "common.utils.secret.getvalue" -}} +{{- $varname := include "common.utils.fieldToEnvVar" . -}} +export {{ $varname }}=$(kubectl get secret --namespace {{ .context.Release.Namespace | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 --decode) +{{- end -}} + +{{/* +Build env var name given a field +Usage: +{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} +*/}} +{{- define "common.utils.fieldToEnvVar" -}} + {{- $fieldNameSplit := splitList "-" .field -}} + {{- $upperCaseFieldNameSplit := list -}} + + {{- range $fieldNameSplit -}} + {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} + {{- end -}} + + {{ join "_" $upperCaseFieldNameSplit }} +{{- end -}} + +{{/* +Gets a value from .Values given +Usage: +{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} +*/}} +{{- define "common.utils.getValueFromKey" -}} +{{- $splitKey := splitList "." .key -}} +{{- $value := "" -}} +{{- $latestObj := $.context.Values -}} +{{- range $splitKey -}} + {{- if not $latestObj -}} + {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} + {{- end -}} + {{- $value = ( index $latestObj . ) -}} + {{- $latestObj = $value -}} +{{- end -}} +{{- printf "%v" (default "" $value) -}} +{{- end -}} + +{{/* +Returns first .Values key with a defined value or first of the list if all non-defined +Usage: +{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} +*/}} +{{- define "common.utils.getKeyFromList" -}} +{{- $key := first .keys -}} +{{- $reverseKeys := reverse .keys }} +{{- range $reverseKeys }} + {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} + {{- if $value -}} + {{- $key = . }} + {{- end -}} +{{- end -}} +{{- printf "%s" $key -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl new file mode 100644 index 00000000..ae10fa41 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl @@ -0,0 +1,14 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Warning about using rolling tag. +Usage: +{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} +*/}} +{{- define "common.warnings.rollingTag" -}} + +{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} + +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl new file mode 100644 index 00000000..ded1ae3b --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl @@ -0,0 +1,72 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Cassandra required passwords are not empty. + +Usage: +{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.cassandra.passwords" -}} + {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} + {{- $enabled := include "common.cassandra.values.enabled" . -}} + {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} + {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.dbUser.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled cassandra. + +Usage: +{{ include "common.cassandra.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.cassandra.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.cassandra.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key dbUser + +Usage: +{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.key.dbUser" -}} + {{- if .subchart -}} + cassandra.dbUser + {{- else -}} + dbUser + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl new file mode 100644 index 00000000..b6906ff7 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl @@ -0,0 +1,103 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MariaDB required passwords are not empty. + +Usage: +{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mariadb.passwords" -}} + {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mariadb.values.enabled" . -}} + {{- $architecture := include "common.mariadb.values.architecture" . -}} + {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mariadb. + +Usage: +{{ include "common.mariadb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mariadb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mariadb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.key.auth" -}} + {{- if .subchart -}} + mariadb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl new file mode 100644 index 00000000..a071ea4d --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl @@ -0,0 +1,108 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MongoDB® required passwords are not empty. + +Usage: +{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mongodb.passwords" -}} + {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mongodb.values.enabled" . -}} + {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} + {{- $architecture := include "common.mongodb.values.architecture" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} + {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} + + {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} + {{- if and $valueUsername $valueDatabase -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replicaset") -}} + {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mongodb. + +Usage: +{{ include "common.mongodb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mongodb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mongodb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.key.auth" -}} + {{- if .subchart -}} + mongodb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl new file mode 100644 index 00000000..164ec0d0 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl @@ -0,0 +1,129 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate PostgreSQL required passwords are not empty. + +Usage: +{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.postgresql.passwords" -}} + {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} + {{- $enabled := include "common.postgresql.values.enabled" . -}} + {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} + {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} + + {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} + {{- if (eq $enabledReplication "true") -}} + {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to decide whether evaluate global values. + +Usage: +{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} +Params: + - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" +*/}} +{{- define "common.postgresql.values.use.global" -}} + {{- if .context.Values.global -}} + {{- if .context.Values.global.postgresql -}} + {{- index .context.Values.global.postgresql .key | quote -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.existingSecret" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} + + {{- if .subchart -}} + {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} + {{- else -}} + {{- default (.context.Values.existingSecret | quote) $globalValue -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled postgresql. + +Usage: +{{ include "common.postgresql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key postgressPassword. + +Usage: +{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.postgressPassword" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} + + {{- if not $globalValue -}} + {{- if .subchart -}} + postgresql.postgresqlPassword + {{- else -}} + postgresqlPassword + {{- end -}} + {{- else -}} + global.postgresql.postgresqlPassword + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled.replication. + +Usage: +{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.enabled.replication" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.replication.enabled -}} + {{- else -}} + {{- printf "%v" .context.Values.replication.enabled -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key replication.password. + +Usage: +{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.replicationPassword" -}} + {{- if .subchart -}} + postgresql.replication.password + {{- else -}} + replication.password + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl new file mode 100644 index 00000000..5d72959b --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl @@ -0,0 +1,76 @@ + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Redis™ required passwords are not empty. + +Usage: +{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.redis.passwords" -}} + {{- $enabled := include "common.redis.values.enabled" . -}} + {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} + {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} + + {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} + {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} + + {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} + {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} + {{- if eq $useAuth "true" -}} + {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled redis. + +Usage: +{{ include "common.redis.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.redis.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.redis.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right prefix path for the values + +Usage: +{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.redis.values.keys.prefix" -}} + {{- if .subchart -}}redis.{{- else -}}{{- end -}} +{{- end -}} + +{{/* +Checks whether the redis chart's includes the standarizations (version >= 14) + +Usage: +{{ include "common.redis.values.standarized.version" (dict "context" $) }} +*/}} +{{- define "common.redis.values.standarized.version" -}} + + {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} + {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} + + {{- if $standarizedAuthValues -}} + {{- true -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl new file mode 100644 index 00000000..9a814cf4 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl @@ -0,0 +1,46 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate values must not be empty. + +Usage: +{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} +{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" +*/}} +{{- define "common.validations.values.multiple.empty" -}} + {{- range .required -}} + {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} + {{- end -}} +{{- end -}} + +{{/* +Validate a value must not be empty. + +Usage: +{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" + - subchart - String - Optional - Name of the subchart that the validated password is part of. +*/}} +{{- define "common.validations.values.single.empty" -}} + {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} + {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} + + {{- if not $value -}} + {{- $varname := "my-value" -}} + {{- $getCurrentValue := "" -}} + {{- if and .secret .field -}} + {{- $varname = include "common.utils.fieldToEnvVar" . -}} + {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} + {{- end -}} + {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml new file mode 100644 index 00000000..f2df68e5 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml @@ -0,0 +1,5 @@ +## bitnami/common +## It is required by CI/CD tools and processes. +## @skip exampleValue +## +exampleValue: common-chart diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt b/packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt new file mode 100644 index 00000000..d370a31e --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt @@ -0,0 +1,11 @@ +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +** Please be patient while the chart is being deployed ** + +To verify that kubewatch has started, run: + + kubectl get deploy -w --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }} + +{{- include "kubewatch.checkRollingTags" . }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl new file mode 100644 index 00000000..e9a51c31 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl @@ -0,0 +1,33 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "kubewatch.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Kubewatch image name +*/}} +{{- define "kubewatch.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "kubewatch.imagePullSecrets" -}} +{{- include "common.images.pullSecrets" (dict "images" (list .Values.image) "global" .Values.global) -}} +{{- end -}} + +{{/* +Check if there are rolling tags in the images +*/}} +{{- define "kubewatch.checkRollingTags" -}} +{{- include "common.warnings.rollingTag" .Values.image }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml new file mode 100644 index 00000000..bcc1e78d --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml @@ -0,0 +1,84 @@ +{{- if .Values.rbac.create -}} +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +kind: ClusterRole +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - "" + resources: + - configmaps + - daemonsets + - deployments + - events + - namespaces + - nodes + - persistentvolumes + - pods + - replicasets + - replicationcontrollers + - secrets + - services + verbs: + - list + - watch + - get + - apiGroups: + - apps + resources: + - daemonsets + - deployments + - deployments/scale + - replicasets + - replicasets/scale + - statefulsets + verbs: + - get + - list + - watch + - apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - list + - watch + - get + - apiGroups: + - extensions + - networking.k8s.io + resources: + - daemonsets + - deployments + - deployments/scale + - ingresses + - replicasets + - replicasets/scale + - replicationcontrollers/scale + verbs: + - get + - list + - watch + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - get + - list + - watch + {{- range .Values.rbac.customRoles }} + - apiGroups: {{ toYaml .apiGroups | nindent 4 }} + resources: {{ toYaml .resources | nindent 4 }} + verbs: {{ toYaml .verbs | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..2973f781 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml @@ -0,0 +1,22 @@ +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +kind: ClusterRoleBinding +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "common.names.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "kubewatch.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml new file mode 100644 index 00000000..31836f5f --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml @@ -0,0 +1,51 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-config" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + .kubewatch.yaml: | + handler: + {{- if .Values.slack.enabled }} + slack: {{- toYaml .Values.slack | nindent 8 }} + {{- end }} + {{- if .Values.slackwebhook.enabled }} + slackwebhook: {{- toYaml .Values.slackwebhook | nindent 8 }} + {{- end }} + {{- if .Values.hipchat.enabled }} + hipchat: {{- toYaml .Values.hipchat | nindent 8 }} + {{- end }} + {{- if .Values.mattermost.enabled }} + mattermost: {{- toYaml .Values.mattermost | nindent 8 }} + {{- end }} + {{- if .Values.flock.enabled }} + flock: {{- toYaml .Values.flock | nindent 8 }} + {{- end }} + {{- if .Values.webhook.enabled }} + webhook: {{- toYaml .Values.webhook | nindent 8 }} + {{- end }} + {{- if .Values.cloudevent.enabled }} + cloudevent: {{- toYaml .Values.cloudevent | nindent 8 }} + {{- end }} + {{- if .Values.smtp.enabled }} + smtp: {{- toYaml .Values.smtp | nindent 8 }} + {{- end }} + {{- if .Values.msteams.enabled }} + msteams: {{- toYaml .Values.msteams | nindent 8 }} + {{- end }} + {{- with .Values.extraHandlers }} + {{- toYaml . | nindent 6 }} + {{- end }} + {{- if .Values.lark.enabled }} + lark: {{- toYaml .Values.lark | nindent 8 }} + {{- end }} + resource: {{- toYaml .Values.resourcesToWatch | nindent 6 }} + customresources: {{- toYaml .Values.customresources | nindent 6 }} + namespace: {{ .Values.namespaceToWatch | quote }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml new file mode 100644 index 00000000..f1b6adb8 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml @@ -0,0 +1,136 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "common.names.fullname" . }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + replicas: {{ .Values.replicaCount }} + {{- if .Values.updateStrategy }} + strategy: {{- toYaml .Values.updateStrategy | nindent 4 }} + {{- end }} + template: + metadata: + annotations: + checksum/config-map: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- if .Values.podAnnotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "common.labels.standard" . | nindent 8 }} + {{- if .Values.podLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.podLabels "context" $) | nindent 8 }} + {{- end }} + spec: + {{- include "kubewatch.imagePullSecrets" . | nindent 6 }} + {{- if .Values.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName | quote }} + {{- end }} + {{- if .Values.schedulerName }} + schedulerName: {{ .Values.schedulerName }} + {{- end }} + {{- if .Values.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + restartPolicy: Always + serviceAccountName: {{ include "kubewatch.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.initContainers }} + initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: kubewatch + image: {{ template "kubewatch.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.extraEnvVars }} + env: {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }} + envFrom: + {{- if .Values.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }} + {{- else if .Values.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: {{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }} + {{- else if .Values.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }} + {{- else if .Values.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.resources }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: configuration + mountPath: /opt/bitnami/kubewatch/.kubewatch.yaml + subPath: .kubewatch.yaml + {{- if .Values.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: configuration + configMap: + name: {{ printf "%s-config" (include "common.names.fullname" .) }} + {{- if .Values.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml new file mode 100644 index 00000000..9ac65f9e --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml new file mode 100644 index 00000000..05a6bebf --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml @@ -0,0 +1,21 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "kubewatch.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.serviceAccount.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.annotations "context" $) | nindent 4 }} + {{- end }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/values.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/values.yaml new file mode 100644 index 00000000..0a9eca23 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/values.yaml @@ -0,0 +1,474 @@ +## @section Global parameters +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass + +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets Global Docker registry secret names as an array +## +global: + imageRegistry: "" + ## E.g. + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + +## @section Common parameters + +## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.fullname template +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname template +## +fullnameOverride: "" +## @param commonLabels Labels to add to all deployed objects +## +commonLabels: {} +## @param commonAnnotations Annotations to add to all deployed objects +## +commonAnnotations: {} +## Enable diagnostic mode in the deployment(s)/statefulset(s) +## +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) + ## + enabled: false + ## @param diagnosticMode.command Command to override all containers in the the deployment(s)/statefulset(s) + ## + command: + - sleep + ## @param diagnosticMode.args Args to override all containers in the the deployment(s)/statefulset(s) + ## + args: + - infinity +## @param extraDeploy Array of extra objects to deploy with the release +## +extraDeploy: [] + +## @section Kubewatch parameters + +## Robusta Kubewatch image versions +## ref: https://hub.docker.com/r/robustadev/kubewatch/tags +## Bitnami Kubewatch image versions (depricated) +## ref: https://hub.docker.com/r/bitnami/kubewatch-archived/tags +## @param image.repository Kubewatch image repository +## @param image.tag Kubewatch image tag (immutable tags are recommended) +## @param image.pullPolicy Kubewatch image pull policy +## @param image.pullSecrets Specify docker-registry secret names as an array +## +image: + repository: robustadev/kubewatch + tag: v2.9.0 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] +## @param hostAliases Add deployment host aliases +## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ +## +hostAliases: [] +## @param slack.enabled Enable Slack notifications +## @param slack.channel Slack channel to notify +## @param slack.token Slack API token +## +slack: + enabled: true + channel: "XXXX" + ## Create using: https://my.slack.com/services/new/bot and invite the bot to your channel using: /join @botname + ## + token: "XXXX" +## @param slackwebhook.enabled Enable SlackWebhook notifications +## @param slackwebhook.channel Slack channel to notify +## @param slackwebhook.username Slack username +## @param slackwebhook.emoji Slack emoji +## @param slackwebhook.slackwebhookurl Slack Webhook Url +## +slackwebhook: + enabled: false + channel: "XXXX" + username: "" + emoji: "" + slackwebhookurl: "XXXX" +## @param hipchat.enabled Enable HipChat notifications +## @param hipchat.room HipChat room to notify +## @param hipchat.token HipChat token +## @param hipchat.url HipChat URL +## +hipchat: + enabled: false + room: "" + token: "" + url: "" +## @param mattermost.enabled Enable Mattermost notifications +## @param mattermost.channel Mattermost channel to notify +## @param mattermost.url Mattermost URL +## @param mattermost.username Mattermost user to notify +## +mattermost: + enabled: false + channel: "" + url: "" + username: "" +## @param flock.enabled Enable Flock notifications +## @param flock.url Flock URL +## +flock: + enabled: false + url: "" +## @param msteams.enabled Enable Microsoft Teams notifications +## @param msteams.webhookurl Microsoft Teams webhook URL +## +msteams: + enabled: false + webhookurl: "" +## @param webhook.enabled Enable Webhook notifications +## @param webhook.url Webhook URL +## +webhook: + enabled: false + url: "" +## @param cloudevent.enabled Enable Cloudevent notifications +## @param cloudevent.url Cloudevent URL +## +cloudevent: + enabled: false + url: "" +## @param lark.enabled Enable Lark notifications +## @param lark.url lark webhook URL +## See: https://open.feishu.cn/document/ukTMukTMukTM/ucTM5YjL3ETO24yNxkjN +## +lark: + enabled: false + webhookurl: "" + +smtp: + ## @param smtp.enabled Enable SMTP (email) notifications + ## + enabled: false + ## @param smtp.to Destination email address (required) + ## + to: "" + ## @param smtp.from Source email address (required) + ## + from: "" + ## @param smtp.hello SMTP hello field (optional) + ## + hello: "" + ## @param smtp.smarthost SMTP server address (name:port) (required) + ## + smarthost: "" + ## @param smtp.subject Source email subject + ## + subject: "" + ## @param smtp.auth.username Username for LOGIN and PLAIN auth mech + ## @param smtp.auth.password Password for LOGIN and PLAIN auth mech + ## @param smtp.auth.secret Secret for CRAM-MD5 auth mech + ## @param smtp.auth.identity Identity for PLAIN auth mech + ## + auth: + username: "" + password: "" + secret: "" + identity: "" + ## @param smtp.requireTLS Force STARTTLS. Set to `true` or `false` + ## + requireTLS: "" + +## @param extraHandlers Manual handlers declaration +extraHandlers: {} + +## @param namespaceToWatch Namespace to watch, leave it empty for watching all +## +namespaceToWatch: "" +## Resources to watch +## @param resourcesToWatch.deployment Watch changes to Deployments +## @param resourcesToWatch.replicationcontroller Watch changes to ReplicationControllers +## @param resourcesToWatch.replicaset Watch changes to ReplicaSets +## @param resourcesToWatch.daemonset Watch changes to DaemonSets +## @param resourcesToWatch.services Watch changes to Services +## @param resourcesToWatch.pod Watch changes to Pods +## @param resourcesToWatch.job Watch changes to Jobs +## @param resourcesToWatch.persistentvolume Watch changes to PersistentVolumes +## @param resourcesToWatch.event Watch changes to Events +## +resourcesToWatch: + deployment: true + replicationcontroller: false + replicaset: false + daemonset: false + services: false + pod: true + job: false + persistentvolume: false + event: true + +## @param customresources Define custom resources to watch for changes +## Example: +## customresources: +## - group: monitoring.coreos.com +## version: v1 +## resource: prometheusrules +## +customresources: [] +## @param command Override default container command (useful when using custom images) +## +command: [] +## @param args Override default container args (useful when using custom images) +## +args: [] +## @param lifecycleHooks for the Kubewatch container(s) to automate configuration before or after startup +## +lifecycleHooks: {} +## @param extraEnvVars Extra environment variables to be set on Kubewatch container +## Example: +## extraEnvVars: +## - name: FOO +## value: "bar" +## +extraEnvVars: [] +## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars +## +extraEnvVarsCM: "" +## @param extraEnvVarsSecret Name of existing Secret containing extra env vars +## +extraEnvVarsSecret: "" + +## @section Kubewatch deployment parameters + +## @param replicaCount Number of Kubewatch replicas to deploy +## +replicaCount: 1 +## Kubewatch containers' SecurityContext +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod +## @param podSecurityContext.enabled Enable Kubewatch containers' SecurityContext +## @param podSecurityContext.fsGroup Set Kubewatch containers' SecurityContext fsGroup +## +podSecurityContext: + enabled: false + fsGroup: "" +## Kubewatch pods' Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container +## @param containerSecurityContext.enabled Enable Kubewatch pods' Security Context +## @param containerSecurityContext.runAsUser Set Kubewatch pods' SecurityContext runAsUser +## @param containerSecurityContext.runAsNonRoot Set Kubewatch pods' SecurityContext runAsNonRoot +## +containerSecurityContext: + enabled: false + runAsUser: "" + runAsNonRoot: "" +## Kubewatch resource requests and limits +## ref: https://kubernetes.io/docs/user-guide/compute-resources/ +## We usually recommend not to specify default resources and to leave this as a conscious +## choice for the user. This also increases chances charts run on environments with little +## resources, such as Minikube. If you do want to specify resources, uncomment the following +## lines, adjust them as necessary, and remove the curly braces after 'resources:'. +## @param resources.limits The resources limits for the Kubewatch container +## @param resources.requests The requested resources for the Kubewatch container +## +resources: + ## Example: + ## limits: + ## cpu: 200m + ## memory: 256Mi + limits: {} + ## Examples: + ## requests: + ## cpu: 100m + ## memory: 10Mi + requests: {} +## Configure extra options for startup probe +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes +## @param startupProbe.enabled Enable startupProbe +## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe +## @param startupProbe.periodSeconds Period seconds for startupProbe +## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe +## @param startupProbe.failureThreshold Failure threshold for startupProbe +## @param startupProbe.successThreshold Success threshold for startupProbe +## +startupProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## Configure extra options for liveness probe +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes +## @param livenessProbe.enabled Enable livenessProbe +## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe +## @param livenessProbe.periodSeconds Period seconds for livenessProbe +## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe +## @param livenessProbe.failureThreshold Failure threshold for livenessProbe +## @param livenessProbe.successThreshold Success threshold for livenessProbe +## +livenessProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## Configure extra options for readiness probe +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes +## @param readinessProbe.enabled Enable readinessProbe +## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe +## @param readinessProbe.periodSeconds Period seconds for readinessProbe +## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe +## @param readinessProbe.failureThreshold Failure threshold for readinessProbe +## @param readinessProbe.successThreshold Success threshold for readinessProbe +## +readinessProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## @param customStartupProbe Override default startup probe +## +customStartupProbe: {} +## @param customLivenessProbe Override default liveness probe +## +customLivenessProbe: {} +## @param customReadinessProbe Override default readiness probe +## +customReadinessProbe: {} +## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` +## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity +## +podAffinityPreset: "" +## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` +## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity +## +podAntiAffinityPreset: soft +## Node affinity preset +## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity +## +nodeAffinityPreset: + ## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] +## @param affinity Affinity for pod assignment +## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set +## +affinity: {} +## @param nodeSelector Node labels for pod assignment +## ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## @param tolerations Tolerations for pod assignment +## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] +## @param priorityClassName Controller priorityClassName +## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ +## +priorityClassName: "" +## @param schedulerName Name of the k8s scheduler (other than default) +## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ +## +schedulerName: "" +## @param topologySpreadConstraints Topology Spread Constraints for pod assignment +## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ +## The value is evaluated as a template +## +topologySpreadConstraints: [] +## @param podLabels Extra labels for Kubewatch pods +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ +## +podLabels: {} +## @param podAnnotations Annotations for Kubewatch pods +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ +## +podAnnotations: {} +## @param extraVolumes Optionally specify extra list of additional volumes for Kubewatch pods +## +extraVolumes: [] +## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for Kubewatch container(s) +## +extraVolumeMounts: [] +## @param updateStrategy.type Deployment strategy type. +## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy +## e.g: +## updateStrategy: +## type: RollingUpdate +## rollingUpdate: +## maxSurge: 25% +## maxUnavailable: 25% +## +updateStrategy: + type: RollingUpdate +## @param initContainers Add additional init containers to the Kubewatch pods +## Example: +## initContainers: +## - name: your-image-name +## image: your-image +## imagePullPolicy: Always +## ports: +## - name: portname +## containerPort: 1234 +## +initContainers: [] +## @param sidecars Add additional sidecar containers to the Kubewatch pods +## Example: +## sidecars: +## - name: your-image-name +## image: your-image +## imagePullPolicy: Always +## ports: +## - name: portname +## containerPort: 1234 +## +sidecars: [] + +## @section RBAC parameters +## +rbac: +## @param rbac.create Whether to create & use RBAC resources or not + create: false +## @param rbac.customRoles custom RBAC rules to be applied +## Example: +## customRoles: +## - apiGroups: ["monitoring.coreos.com"] +## resources: ["prometheusrules"] +## verbs: ["get", "list", "watch"] +## + customRoles: [] +## Pods Service Account +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +## @param serviceAccount.create Specifies whether a ServiceAccount should be created +## @param serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template. +## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account +## @param serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. +## +serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + annotations: {} diff --git a/packs/kubewatch-3.5.0/logo.png b/packs/kubewatch-3.5.0/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..298fdc27a5d9d8797829801ac7f4b0d08f62a101 GIT binary patch literal 22320 zcmXV1by$?!*Chl*kPeknB&3mU6hQ2LDHECg}?r zn#P%&^lLSbw4FIT4?Xq9yE}I;`;_AtbRL%WVN=*_P8N+q&y9u2&lf*Eh{SJ;CSa5& zp-ur_l;l}X??;`zlD)Ej$s$yxYt!=cAH)yq!1&s`&6rfXIY_&Y6OQMZ?#!!yOX5}a z^_q@nOz~z;90iGW^4=83cbWR1>3A3IZ-s=0h91k~s!B^UJd{tOr>D1k-$F)AEcclN z78?5QNgTI~wDjy2>{$F<-Y5A|seowMHGIS+OO5J@ai&Mclu7O#0lXlR}>h z>fTp!5nU1?_Ysrq<{qbLzXR;s>6awi6FBzD2K9-BQNJ1v`6)I=dEfWJIfH{vq|`q4 z9=hM7@SsdcrHpq~MN!`e3u0jk@El&j7L#MYx?qOhX2}f((vkO{RV(MB@uH;a!3HT+ zLci$XSlN(@Dt)dZt|~((tk*zm4=-pQ%ZF5GBo}&y?!N(HYN|8dY+&Y}ChHPsghW$2 zyp2;`XJ^HkC-kBHH88?@T!f%E@?$6QlN%6{agxPV%_02sjkjA##AHkNZMwu#YyfWo zwf@tYN;ixsw6n_Us_TUgS-+FvDn;dg^~&@auppM0XXbp5ZEW`T@q%Dz6UoxTLJKz{ zfi#Gyfc*~oC7Lp`@S{08Vr7*UvMxm1X7zDNzI{zELpQe3`=+Zn7_HHBq#=S!qc5{o zdq7x*Cp(B`7|&dK^EciHbxM&wut}un+}zv?H(Q?-5z5oLy0_LNCTDi)%VcskRVQl{!J|@NH6ZXXssI)N8 zf^T^a)j6AkEGw<=(<=4`)vv0nlOQzkndLMzCK7N`Q@GHeDeYqaF7^@?(%LRCkjOn- z8c9#flN;p@aFG4(dD0KQlEC7`;9DmQhEI>}!M92*_;$l@5c_E#%-Kl{lC8qstVdaX z2C*>q#+6VRY?h>B@?owV&gEgian5-iyjf{);N5$2`Km2(F??pHEw7tiZSWY;a=%=- zVR66-=nUWjyVqG6r79l}eh8oUWQ(EOJ>}4qauYHc;ez3gaYq9pMy^t3NUbQ2gb~8x zb$e+UQGdKJFSd1zONTRW0yDT;uQ#Nvnn~;OG&JWqSX4dp@m>KZmk%u>1JS@D51V|Y zU7GKSffQa$A<;S5Vq*6E0z#`#clu{4zdl<#1XnezA9ZHG^X-#NyC?L~@q64e z%lG`K!-Hnxg>oOU7|RcF54=!5z>+fLxq1<@TCdFb3-jC){NfFHwf;!-et+m{3<=D` zpwtoj4{Xf}&ToqCpwo24Aco_EdA?h4!Rv1A_?--s5puw;+O(%A%h;`YILGXnZfAsv z{0xpV6&$4-qtXEnc!Er|$?ivUld)57^SE4$CVK19T#1B`5$m=MW>u05pZFSITo!Ed z$^l+bO+*0eA7^`Ix_z|me>e^QO>1v&yQx8Z@8Ajeo_j|=PBmOaUL{j+g#WbSn(~(7 zpFc-33{r##ouT3M{lY)0o+@cE6#W5f%EA_!*rD`VWxnRhU}C$&lWKQkVIoDTXkkm54y_+Fucgf$rYtus?EX zY>JK3IHIB?S20CBM{~^4q=#Fg1t#O34y&L{II!lVjJ3J7K}` zgaN@djzd!jVTBvXy2xUO7Q=PkWO+Mlz*DTAaLT7FA7P8H?u=BAa-mz5xR2uY{mi-^ zfAHfXkGk#cfcfz%iVsrWSLEFv(-lt>Izzj|ynaD}TcWxgCzTV#g7pW|cnZ?eqy90! zK0bcGdvkdORZTN*^0`iVCF5EL(=B)h^fl@MPlOubo$dZTTAl%+%t`QmuQ>=}q?X1c zSy@Ox^o@=RjwVS9W7Z(DT@BpPquiND&s<#@{1)ON4I8H~@_%|!=PA}YA?3{VkmK_H zyWWBBXeM(zZwP46##1eKyg_!W$fw2F%O}N9lIATeGj#I?S_l44e+>mlk^8ydg5+EU zKvnU37)hUtZ7w)HK_r$@ObF$DS2XuzRTTm9Zg2Kn0AhM(oU6}$0|(dpf*a^TS`Pa; zf9%{%?`r$ZW>>%Vs!7y^{ZGeZwXtCAD~zmUB^8{4qq#hZNrLNg-sBpy)?rUBOVO|z z0IGV%oU_?JfrEEAK2L<6gKvuA{b_@~_pUwLU$4<&bJl{+ z52_2?FD6Iz2pcAR(wBzROHuj7P~2GO-xHT585l*%jr<*KBt z@s3nhA_N1i1JJ>SBzOfd_p-2@*=vcED123QdX1}kY1+LLYz9EjX0aZ+keNvOZy*q> z>|IS!Ts7ytC+7H%7Dlf%7DX0qX^Uw`A70Oix%+WfvCkH5>TKdMLb{Sz3?~N2(C-?O zyV(X%0ZXoRzc)&zg)4XZ=f=;=yQ;h6Gb|~}q_(MzrG*2D#WTci**gzKo2lhbvltA) z%DAdLBsOUuC~T~n{*qDG%%)9k$Xo?Vx-gL%%2!oYBn*#Q!vGVerDhW$X?{FgxY_*N zC~J#*dGsash`^#igC{G9rIF{~c7fFv)jT#I=H2p;WnJUib=Q?h?AI%>SqC6HagOF# zN`!8P{i!@o<1?EPy)PQ5ew}QPHSo6h5S%*#g#0~O?jZZJ(1+qGj{9E?q%3d*ge|*~ z$otrR3A6mp$BF>)tradVOp77OjSit8z;>bx~)-TE?o+t%jkUv^qlD;58k{S(7Gdj;yhCcTP3h1S4 zKRvUy-@|iFBekZhQJfMC$z339nt`yK1-SHV3$Eb>zU$o& z#}34SV&6yrRY16S9e>*puGnIP(Z^^9y%DqEfw;M&)b`hO=wATOX>Va?@OumI&s7}G z7p3&Qppj2vMCcW61=wS1dRIIWVfrxtKcJmBCE7ojP~H}_yey(j*?qBp>ag6F_Hkvl zVlLJyykN%w_k9by3fMOk9g89Np|7JfGZ}a9?cMuN7b*Z<=;C-NaJ1vo@*$VJ(Mzh^ z5ApcptvM^LJ~050yaDKeN(;LbfFiS4*n*C|MuQ)sl`{J?LVhv4?A`fG#YPHBXI0tK z{0r(u=;8xHE)h|*>vqW4TMe$HT=8a^cewD-r2GkD*d&7b2areIG0qcB7&QQ(ZY@tf zX?q{dJu9+l`j!O!6Ps|VV=oR zpT`dI!XLNee9qVu1~A-F(y@vy*`uzpGFO+4SRn-H?f9|Eo12q|>l&BVCHLkrN4<}e zuOt>J0<+n0;mF!p3hS4`YR902F(0M22&3p6n; zL^f$JpL(3XKh*7|H7+qIaYH9wWCL%$?^Us=Z*YT_z#jV|1Vyfx6PT1<#{{#rGxKQI zMCY#TBzvR5((`}SvYyyc6!~_nsQ;=$b4QcZ<@aAx(4k%xmrtVo@IgG%xwy{p7f8P- z?HI}SR?5g-n87-sNl%M@ox?l($O7kU1Kw#EEapHObeB3_6CRtT5h22{F+`_ zJaM2xLZc#I(6B60BBI7QlV@NL7h+hL9W$KAzKzA-PH*=`J2S7>EBls`pQ{6CNH?|a zVUte-Pz4Xb0xCB-b}!0?5QwyWHzPT4@HM#{mp%m?VQ=GyDWNjwkBqR9xKWf|3-^3P z!Lc!cj8yce3Rb{{BhI(;PVfW-aQayP{D!1Y`~i_qaf+#o9zLV1yJu-{JN1(|cQqwn zQ}idSX-VbBV~={-I|HxYZ)R8f0dLS{T9$>NwO%kWZZM^ zq1e4yz*U-7)}b}+y?-Hm@kR6NOH%tuBkp!#GA-_~>7Q5pTkQDqNuDlhxv?){gNV+6 z6jW4r1MXP>kgZ%$1zQc5OEXVVucX6%i^?kzG%*4nAYLRI0E21{2p=in@+$W_U7&H# zFmxCAoUtg(LAOpi)Wqr_@rpU`liGwS&Lf2rM}ETvZ~~bFXMl+P4CUN)S0D!W8~D6}KR1F5MP&oSE`8N%Nd}>*mQ`dAtuH zs!_%r!2)nn3WQbg+EjOaUx5Ty(_LzSA;uX%-V+obx>U0T_fx0MF8~HEJf3Lkq)xk~ zh+-PJff?-jf*9TZ*wa#Gx_$WhVo!|)xr{Z#+soVS2L$2oKzm`#UZ1mkLIaEz@SuN5 z&29?E#a_fa!=%k=_vFoKLGN>&8p3l@WUdxNgT{c+?%`HQ&JP;(^%E)8rsAP&_wvZ~ zzzf6x;BV;7Yxy$nG5D9{E$xY9seJ=+Ml+n!zZbfS?b)dn2?zqlUg}gH@1>`z@#}w& zNJ?(e_xSvMs%m}$40QJ<$q(=IlRl)9LR@bzx!xP z{2o2{;z{9zjkH``L6oA-O*g>1uVBI)WR6ZCGh&74C+lvtK47_KY!Mp zegd)*9{}8h^E^KLK7?s+8&vGZE6whuJ1u!ETsbZ7} zv-Zvl^27kKWwEHb#t<|_>pS2TaE}{BrfvXnaSrF65p(el2wV3SOmEVPKf{U@%5)dw9`EV!ER#-ljysE;t+FG<6$6X>ylw#?wz+fzWpP;rVhXe>wEm8hXNSZ3%iqtq8~fHfIobN4{Tyv8`!FGrFgJ{(iihb}C0zY?We_!JPGN#b#t z=x;$jX*=y9{p^(t{CTR_3w`70X+Kg>MDn#07GrgIyBI%%p|$v9griy@MP$V?GU?oX zE`RTX$kJ9#UI+Ziq96`iL?nKUMtY@Ja4y@ztR}e)pSqAE)uS@wuiO{wK#A=Co3gjt z-LQ~#I!M^@lH;@W7F9~0ei|j)5%oO*jOJ|!Q$kbC{jZ!A9F7^KC4B`#^+5G!xzK zY!bbnDv%o)TdA;S$2q=KSm0M@atEqaWy3bsO#T%8&I_q|r^hCsqRjA*23(pZ~tD4=l-B9KX3=0M&D*JUFHi(mRpmt|4n<3$0c zr-ZSFTGYxg)t)fj`I|sxZ5!TyxwoPexQU}sL*lNY|F8dhAZ2H7Q9Umg>Z^dWHu|M^ zFZGVZGP#+Rn$6xT`hJdO=jwAej5Luf9o@;AeWY7e^J1?;nxQ$8wf>A^u^yz(GYT(z z*UQsE*I4(p`scp?#vYJ{2+<|Mi_d4<*Lu696mFG%Uh^U^v>3#=0Q>*@$4m<(x^&LF zo%!kh9%Zq?bgS^DQUAd~L(NNTLq6RP4|cETRRbtNC*ng%rpNMTkTCSH9<*_s@d|$& zNIb>x5dj5i`R#^XqV3A!Ofht@|fpV$}5IDcZs(DEsRjiS&N!*14k8q4>D;)=$lfwL4_?Uc;#|cw{`7Y|hx3CS+X?Gw@w`Y~+bpFSi3v*?H z%D%+Jp6T#;XWM@@JrdUhi@s3D?_5!H7hdcnx3EOYJF>%=RnjNkLu38bQEM#PZmBp^ z3pls#W7o;`d?{qnQb))8dmBEN?(VZxHffIbKzGO0Li+{sa%y&4#43_iGiZzr{H{`B z(U=v|*PKQ~1MGp;#R6$I{m*HJo?csY%cIObDVtzUud|$mJZjwQVsTT-<7rx%(F%UA zbC0UN&FK%}ii=MmZvB+IRHPfA3Nt#ib#{kUfVZ|GfoBtXHn*U6xVpwKx-OQ?{VkvK z)Snqe08RE_k^ah6oD&A}#0Q1Ui9QEL;H88IjcB=QjbCv8dHl~So;lMPJ2fTUp0Z|i z_BWyv2%b0XYNTax`lknu*FBxq=9r*|MoH*Jd%mWa$mu^Y6$hIqs&r#`%A`3$# zmK3w-gm`$LB3g&Wm|~c>W87wKkR`=6q{?SL*BQ6|wD#S(J;ls-jENH+LQxTd)62RH z+6~EHlAn3gB3w9YMW^ehX2!1CC*(f17Ni9wYg5hPJU#K*m;7w9ILPyM)HLH2&(MVx zp?>PfI}35{EyWuax_IsD&sWAhuw%dZ+s}}e-tV#OBfiS%nZ~~;305#bNj2ttv1@II zF>iY?n&-r9dATK(0Z9t>-FEh&)QxNwB9G$yYW<|DBHj%7@2zO?ljgxoldH3}@pXE_ zjPM{6m_T)35nUo^aj}1??sUfG1svXnziq2c=+oZg9V{(fZj6l^9zYS^2LTD6kvi8F zj!XIr^Q~@JBTfw`d6XTT%uqV#M^TETGna$-pk@A7XEBGtyO*A<#+Tc9#{E82(EP9a zl_l2N#kX|!(qQ@@5!vHSUfj+>Ht@wy=AzYb{Gf!G7D(fP$KaZmh$eU zrii=K!t+R=U@jBi4(FmPBh!>_bB2^9g!E2F>WLNw^uJU}%_CtVs;F^y`Brcd8hZT( zH23@CaQZ4gAhe6B5wkdeHaAY7YeGx2_3ETEM{rduFYbui zd44sSpRGAh)_Nj6{oRh7f+H7=NV(Vd+(``&CgUgOI$`xce?K>7sR#`f1ihyIYIBZY z!tqf-j~s_Z;|#eZSj)gBg%lmyPklKs!HLdJ_9{`{C2KVg`& zEfrEtGlbSSEVSVRsPivs zAHm6P@p+#f-cx3P+%1I>CF(w)D^t6blWsc#^)dm5e>s`o&w)40i5~REpsHqrJe<J$I9gHbBh@Y_$J?&8d#%^%S2CaZ#3>+SbaLc9#d9}2Kpt-?6DaT!EwB|TYBAf1 zCQ2OICeM6?kyY~kMZtr$>Vvo=HIpi{omCdDg`w|sdcC5?5?Tx`SnQO@U0U!3_zBBh zax|-t!Y5q7pWo8L$=t2f^?xCI~7O8V{j+ z`pmAM%%+8JfXj9?YS+bYUkCY|J|^B3p@ipX9r!X>j6?T3F8t@^`wV<^fr3e9#UTu0 z;;vZ&)d=wkY`TI=RfO5$172g=d4$NA%H8zG=+X?suu#)yBRI zgq?P3ZvwFumL`&Ul))VInJV(1vBJ^<)DrrV`2mkH0gd)9&ZmSHNy~1ruc7b0^j=1t zAgn1`CNRu(LQ_exlDUDpRH{^ytOEVsP;Jza$fucFW>cI!H41BP;>IhZ)NA2m%jpNf z=&mXIF*|pXo}Td;1+K{h#H2%XZjG;o1MW!S_i}!ktF$Q%Fr(F$r}2xlWHW98GArvT z*iP_yX8W0xRs&4x3Nl^k90nUpQMIrcjTUOmw2v%qnPhsX;K2+4S?gb;PwpozeQ5*6 zJh~hYUwxSv6^y7Rsvda2X`J#vGEX-&6(eI~IDv#XT4Dx%GnT|VSwZHfQtJ36cW{dB z7YgTt0s<*oIs;8LL&mQ|Lst<7h;f!{bFHu$W~_MbzE7DfFel&QBK2T8;^JGjhUeCRSIqmpGPqJip3s8Ro6-A8u(IZRR+O#qwW1T-9+@EqY9M7Se1%#U#!rlih&VJ%VMb-(AIACZ;z zNu3Y9Lac^-dJmpBi*oXK&Jh%aN%LO_dIKP4LskS2z6r!-k|YcI^e(9bE8!9@K_0bN zPNXR<{R2nKlI1j4T|TKq^Mk%FHlOx`yYIr!^rWSCJRWUS5uJTBe9Bk&(`$#6=3(niTvo0%;L>t#AQ8t=DLB2>_K!ZctK2L zEiIW1Ouf;0ncF_16DrYjZm;rW!b5AGQs6d2H+_1aA$0MKmy``ip)w~~B7u~;4;HXD zE^w9;a@0Q&vUql_-Sp~jhf-L? zs`t>qQ|Fw-hXdMSZ1nV@;- z%1*_qW02G`1#}G)MuryFXCdlC_m$Y_~%UdBaCFP-;=N}&WjtfjjXkN{#oF9MzT!PdYCl{{s zPOzrv!V~uN_lKdmzOU%%hr=f_#9b`9J}0y&^N=qe(sSX$*BY?%=H4nSJqJYdw%v!A zc(c7q(cihLG6|F0iQ~PqL8~0aGK|r1fICFU{Q<=?E!wTsGY|kd`;W~_EuYzua|;-b zlwZgvnWxZ+O&FjVsGzdBVcKMKm4w+`-{_g$^tbx%*~bm-D#4lNU|ykt=O`o1pqTGb zfum){axDY$hex4I`Gw*0-f;GI{o35V4#jVAh2?zBHl19@0uS=J+K0b{ByS@P*@H7} zED>YB(d`5u*;o~q#&Mrv_*>cAmJ#X556QXSAipW>XOtUKY&WJ`Z|1KP{9x{5w7P+x zThnmYL^!Hq!zSn`IgxqyuAH6pz3erb+3nVG2-+_PL=Q*(@XzutYX6=cPo7BKg^+?mBJwjH}OY|$m6_m?MWPo$bejan0`UVyI6hs7I;7DE+v z$`l-#H15xeeOf+#mfPrXvSeAms-X)V%)%~r!?1QxmAKn!&~>{@<~Za`|GY=2oVo`` z_8!<6K2^hYSrgjBtrc%IAb^w-Ra0qMqR!IP7*tT}GpbMx`Uxf14x_b~nbvv=Nl;O_ zqFhpW12?~yD6~=$0*w*^h0l-8+b+3KkId2QTKCxiEUeysSWm0d$!sBfA?VCch zU+jh8(4hI9fJ)r3+Uv4sq9sw%(2a$g(_jCnkPK;bF*&hMJ6D-+^8!h$%B;f^TXS(G z&Suy2d|~ddIGpZC25})G-npcVj?q*%_~fWzRAhn##zpkR-VdQSvv+MU>(zR=%46i$ zB)asvK5!wmF2SCU>fDI-a@Dmz-Lj2()UV4?|-UE351T#)?gc?A~WPknPIb6tvGF1OqQ_i;Ig~TyossduwY;&bwTC9>X=9aziLH z{7LiGWcEvT0?SqeR*r1@H>4Kk=Az8+XpJWJ=Bt05ux&5(!UcIM#NhBD_x&dwBUHon zWpp}CnY;sGAI1m9Wtu{&CWWf(w{M!JJe8HjZSihXGl*)|muE^b(?ly+bIO#RynMo~mIRt9!ZMyJM&BYJ<|)=)63opGi< zOVX1|%2vwcCQGtnxfY>W|EK3eSZ;6V6&y)G>$75`Bho!t?N8`^dYZwVuJFcP*}a3~ z_}C@yhF1u8q{{aSyUbg2KWa5C{3;N0>Y63K%zok3>E7neli?CWWsPje`ohjs?0m+- z?M+Xi;l$ZKRg#8(IjZQJ@RS^p`!sd?>xvK`vhD1+QF&!+^8iT!_g=DJ^XW~Y4k;-H zqlMg`Ub9YuZgMp|jJkkk&5Um^L)Y2c$$<>uHdC-Qt++*8kl*&2_m(fo0}7fL*PiyD zDgs`&W!wQRP}a&&L?x9Q1MYkvDNt}FR0aGQTsolAq8B!zO%=ChxlWG1)uFEj21pupBnz9(-jA*t+v7R)7 z8OGDBPnuLv;;$i#4N#SYV}wXst%Da3x|j0W_0M}@Yv>fpFSONrnd3r3$w-gR*|8Zo zf=bZ(%ZR}DGeY1WHx&_66fN!;QREjWeI}FZtKXwxR2e*o8Cadt88EH|;H7;y_!X4A zW(1Bs35urBP_1&%Tko$9VGs5P1Jx-jep72yc^%Q7t$CXgCd*s02X@rc1d4U{Ur2pZWJJN&LB^>ohd81&p+ykb-fYuZ?U{{Juq5|O$^1Rb zE8E|SOA!;7^|D`k-kY?2cCBU<7hDsfC6~n1s$4~+bHybiE!Nvh&}5Tgwx%P@JtQ^z z#zwrA8ZV-ZXrlJ{MJmihM!JCw$U2OSa-!+Sh5AO;OUnJEFfgoz5fy(kK3D^d->_gH zc9%)uJxd=Hmbi)w@U(Gltb;7AbBCRErz`GMq}zHv_E3l}jO!Gzd4J&|DnF#=UB`uk zZaEr~t2WZQLI)*yIJY27E zl!A3s@Ta?UUIC>rgF0%1DsqX%qNwl)ptl zLk-kCer*AtDV9&+FK3cRf;LO+9hS$|d0;~i#Tv|YLxO>xiy;Kh%7qWSWKOPI6OJ7T z(%vkoR9`a3DRr8GHEZ7oA#gD`KV44g(W`R)6;|xozshc$vN_2c7^c@Q){O_|6=we_ zjAjk6&bP&Ex2s-51HrShkOx;n>7s&^2lI<)rPES+AUWZHxCuR4q&EBj zl%!$r@GdNQE*}M?5%_;=#vDi$7p13H@u96Et9}W3L{ByUI9=c$(Y(?oSfM#cR1>pW zF|`BB!S4xdq*%@%Of!YPzGBzJ9g&NxEphRl4CDAOb>n(>mVPG`+^S)mG*K5N^vR)0 z?x=hH-7A+e(L2B6&t6QZL_Ergclw6fU7Fw>Zzny zZGt}tdUljfmKsfl>|p5t3`uN`S~of6H&(({+A@hS5w5u7sr9Qx#h6NHOh|R2m??|T zo80CqWmhw}QW6-5CW-j^`hEApPX#KK78OG|uabi$mC*%?@61nK0}@?Z3V#*5HtEkM zb|^1C9*Y7m%mG~*VCy#;kvh+M_3NjX-Z*->QW6OMtc0yjk&hz%3eq{pZS=serctum|>y)76072a>uRbBe&6E;!{C>1nJ!mo-QGxa);+N`%;-!kE6w6I2Jyr!q9u zqxS>3zs+iJ8IaPWkh>4y^M(uWp$8XcZ7Lu#4}Jjrf645w1Ki`>Q))#Dx^Hpe!-k^N zHBUz}a+jW#_M+nV;8$^E+w1Vp`R-V_z5i1^K&OhyZ8X* z{fAwvbf$Ikr=ObA9Goze(bFlG!$L!4QJqb}b;)}6AW15uS$QKvYLI1XffhsI4d{v< z-q~2{Zu=-`i_kg0AnG>tmYc?f7jTZ!CB@hdDE;VM{thr!j2+NOnTG`Q?Po*<2`H9@ zKsQYoky^ete$eP+q3{*eocc>;BP_;o1*%X*FgUsy@paTe5yhViH{AF0i5WDVu^|0V z04c3zCjA+GVgwIH{z*A{@@cb4s3^!XVcuXk(I6dR_@4%%{~ji5C{StUT!bOSHFuL_ ziOR~=2=;+Z>w(Cn!DRE4$i84&FR$Ud?t);*viXoS(*gYEG0(R0rJ>Bw+f&7yg+%;I z6H&i$TT`Ni;3!Ku(93k4?}`U~#I!v;Z}FeMfq@m~W}|QD?TYUm2r5K{{z2pC!Y38* z5wBeY`jnc$&Jx3dB{g*|SEB&7nS{5bsfF3JX-Cm6pS7ojvLLo9&Z*%K%MzkGJRITDu3#|?&Dz>uvYOD}G5=!b06zC>1&vQB_U=1-p z^eVpOEN4HmoZXI{$6FZ(Unq2+pg?Mh3ES5QZZ+UX|d-mK@p(xv_fVd3&qU}hNkOUQR`)+gj>jF&JealeTy{IE=%W$_It(#T5G#Jmuos5JvcEhjKI zYo*xe`?XN!9wApv6;4cO1}y)84%l(WPNz?Y$~nuclB<{Aib)_6T@gRhT(?g$;Gl^n z9Tp0Z#ae#2%lWyt_lJ`I(rtd2r^FT|7X*HWg}#e^iRW)nMdnxfm^xz+mlT%2EFqED zDAMg#^c{$Ee48?|>dgQCM0o?O!dB}uZF;9$FY3{X`jkF5`=uOtm)D!;cO?c6#f2fm?rD_4C~Ju|a>pIG5kD?)ro(s-IHW;^O`N@58sd#&M179v@|%Pr?c zNbaPJ+3>OM0wMcfcS*6o7b_3MUFKF#v+p`nF0nr;_T6FW#iQnaB0mnYwwdy(oedeP zZRS^%fU!IV!0<>}cA%9)I+c+Iqa_`59~(XU5KQ-`oj-LFv>sP?>q(a@!p#kaN)mKTmJ+14ud>YLUubO^ z>ruSeJf0WT{B%lW`)t0(3*)tpe*GEGO7XWM?Js@R^PutE)%N>FSCR9S0%ym^4qN%= z0KwC97BV7oPo~Su{nYR!lgrC1qRM+F6N*X($HuOnV6Lx=?^ZbTC?)lOli8}IoUAW7 zOa1O=cJoNo#iIlF2yrWJ*_`(#M2#9;I12vT>ou-r^D(JQu5(Pcg*tZTwxJ&xZ8A_K z@j)OF5=V3L&usH_;aete>>2#~!r903$2p_P+R9WR0n{%`t5Yx=cUvp8aqDe1{%#5C zMsR_mgdSB~=u=s4au`n=;JQQWaNI%6$x&gXnZ3OAb2e&qJW1fTwIvb%_;GB>xGFUC z?^g(#Qu!l)N{5!CbuWdas%|2hmtBYL^aAdv7nFb zL-5GFHveSpe%XqM9cbGtH-A*BsoE?8^1>fD&a(bNrKQ^xfR!59)0OTOyJyuhdx>UV z1gVw-vp0?h>qMi-7p@D8tXO`2z{0X>V>CJ|hncUS>hF0b=8_?49v)M=Eqpj`r%xDg ztO8R%ed}w?7y#F|+U@`6AOHJU+h9$~S+`z_0ytS5_%{a^5%IBcM)u7BU`PfY|2VBqngujvkL*I1)eewu1 zNIxm8JEBVk6tSX#7us&zs&4{=L1sIn&OjwC&Ga!K4$N!(M@uSjJTSH$0Q2bh zAxU{rW0CA$^&@jyNPD&+wwIw&9MzaoOooVgbl4M6VP_T84RS9sEA6@Dcby<8fvd`u zd&EC!=$3-n(hfNP@oGB6*j-zt7jJ=^_Tc#0b0x=oIZ&?J0%tKRSa3#0t~qT>iN_1AwMTS`#kmhfNk^3sk&Ev3NtEs_HLYp92=`WyqmM03nc$NVnZ zMO{#g-P*)5`mzXJH3Of=6D950DWbFs)yT0}nbK(%C3Zp>G~@mR8qo z<5hIwN&ef+sZ37}WMWfW7eWp(0PEN0laf=FZu3U{8__vB_f#&^1V*OcMqQV8bw$yx z>JLyWLStjGGz1@4D`uy|_C;!zW z}2i1-o zSMJ5!bNB}W$q-V!->76G;xudtmvzQL;x3NqwLx0R%(WyPFN^Hdf{BQu+11Ase}cUY z4u7uD$pO4rkQ3J@rxwCJhfJ0tk8e)(+99nWY&Vtr<40hu-NFwRYz);5rUFmXfyPa} zQ!;y(>v~_{NdI?lea@APfRVdYunTHgIV|)lT4~#d|Efzi34QQ>x#v#_7xUp+j(DY9oEANdxvF>F{683cH{Pf8yi%Y<)&nUo5b#OOg&{$c8oTREuS# zF+=iVqx{Y=m6MNpNophgshtD%^__0!-c;OwC(UpNLZTa-9d96AoeM@+R(l?B4sz9I zgo(Fw`;^D>fp|6yWDC%=sW`v})3pWgP79Lj1yq%&4@ZGZl<$B|eg#}#H0I>1#XElm ztT%6%I$h1Wr!gnT@StT@x4q4n{WKjCy1Na3@<7-^oQd*7Lu70`E3Xa>1IEu3*rKQAO&)tlYiUmSOJH#=lmVkBU$qbV zR2WT5A89RtFTU#nmm&GDLQ5M%U)%HM2GSZ#p$!#yW-+)7nYErwPd}Cai?$O*g6f+k z`e^vB`BOL`69~n9@6P75xV`i|6_O&&{oFfmfedZT7u@K02bV<78L2uq#=t_~t#LLk zWgG&|;0o*lU@k@;H}M%QO?9+?Ehre<)1uEj+AOun=&D0Ye zDW0hGRQSFg9f;{d1MZ&SwP986u9n)*p)xJM1J2M{C{tYgPN{$oxthsuHQ_a91vCA! zFz8hPF|mMsT@udxogH*O{B}CPhQ3G&`uf-sTyB*OECH{DW@Ojr`EcREueHL^zuRhK ziXVZF?MyY@)L_hH7LEN{3w&A~->e)Sv-}GBDwhIKb0C16lYg@TXCl(xs!19}q_@u| zJuDV3HT9{rn;!TacQHE8iR3(gj+Mwwqs*CHPj&vN6l@g^`U1XyK)tI-P3XJVyq&I% zRObN-iXsy?$zUs31n~;Ye?BFJ9YJ%Khk~^4RkY?pxlngn2fLW)RkqT$7e|G|`!Og| z(1UH~5F9AZkkVN_dJF6j7oA;9{upZ*IC>V~>R=PNgI)Z7m@Hal4KL^|x;sX;zSW^% zz6T!{^LNvqMx;zkmQ}zvWvYan|0fmuCXf+;#uIf6l4uoP(>4}8fManQFh?h&{oCOz1_2tG=%d$ijs-k?{lt}gf$#34Rq z>_7BHYeId&Dbg;I5(WsQPkV72${0_jgx-_`0$yb&%~TlRzG~pMzKxqPa4pGF&TR7z zFhDw;qa8-mn%Bl1jp)Fh*^dB@V9{XGPQWy#q`VONdZ+--LD!)jSE)@Emlr?~*gk^A zL{5HTvUAJQ{8}YInqePG%ci<87ce;8^Sj>YVgrl$l=d$acBtaUwyMHW7we`FAK~tu zRb>cFpjIwHp~T6@O#d-c_`Vl#nAVN$NISGH1h{w7FMSdQNuB}n57-OgprP&e>jTwm zr-f!#dM9>u*Vy|40#SnIx^=D`x--cT_QS2ehxZ4VAh(X?U3VA?z$UuTA;{mXz?>Qy zN~xF*4+STY82AA|H@Z*Zd*!EHL3tppl?A28uL%WD7Qansd7`b^jw zFCZW%fD){S+8}v z=eSq}Bqv4R-@{Pg48LA6jl~J@*0XX#a{xr@W&KL#p>$5by;OoezZLB12i)$d#4;1oXg6-4;-&z6EJhia(_P*sQlc%mZHnwius4Ig)4JqQ zy=a&n>uKoEBCV0JvS_g4CLWL~QRsK;!`-FTXojgG=0k~eb#~>yJIC>xdcaB5)!_G1-^PcKcF zO_5yP?5Eg1d1-e1O|fXokHzP$s4#H|*?yg=?SLy~qH>3w0ds^ClI%Ek5gd5+u1b#c zWV>-YKn$2$%s-rkCWy`m5S{-4&DXJSOv&1QZqooXmiG5Viw?43%mo4wf)zGnR-+Q`vvP}r;r^P6H&$-W+ay`wq7XM>GAwJ^ zNiB5F>UxG4eHmM#m0}gX=k&G?XdC00f1-VT%~ZN;r)Zf#R`_$C-XwIYIz9gniYo1VZo-$Me>b?W< z`xPm;Ir<8?$m#Fl+M4Z6xHAXffnEi2eKL}ColhquxTp|V#>wZ2b`Cz}*mG&PFxqIp ze&A+B-W)Tn;l$pbJ`LjIZE9nriJsNzEg0c#p->y8dvo6D`CUC(_d3yBR7*^008-Y^ z0z|Wn?sI|vYvs!Sq5h&i24fq0e9Km2nPf?pEQLz4Wyuo08ObioO!h5IvL!TP>}zQ3 zB)b?YOc_b~YDmVCeU}+qJlFI53(rq@&F~rbo^$T|{l4dYkdo?>VaiIH2W$#oKDtg? zfC(v4fZgd!J&8-=1@ z&GkE4=GI@X4bhD3!+W4tbzX_<5WP$l+*#O40=BPi3DP{N{P#Y3`Gy91v+MQv!n1kyH?OItWS_o!qnmtJZxPG!*? zAefl$-Z|CQk^Fdmd_|kVbAZbDcdHT)en$dN)X)150qnUUJ}{$Z$%+@Re^u6bj?-?j zXQb+tBl;u0$SR-+3RDO4wqN_{lQ0Dt#|eA@3CpJs{$q0KJg)D=C5IFdDhCe0Cg3G_ zZp)}V661Mvl)(Z^58s`h z61X;YxE7<>9i5p{w%>V>StU)TG!DrGX^w}BW zz(KbKs(2GB!nKs06q3X1dM3BT%1ZEAI(Rhnw%-)FmhX6YtKzF?)KkuU0qF=nt=)i6 zmACFgfoWhzG6z$6V(7Xvn)%25t7-NC_Hqy%s5@^Mb`9#v)$xYc;2%lCqdW2xA$gc{ zZq6~eJlOwTstfQID%Amo37K14Kb?^s&bP4*LNE!B7o9hM37;;zHp2l(wZBvy%Xz?~ zCvp2^9C;|si#ZVGjrcAwam97()ICh4U1%@*3`NZH(h|mb*%xpIX+@`tZJ{SqhzM`=8({zTik%UY`))5wdfy*dJ5Lr+K9}su} z5V!?keFsT)OMOySLKv_~Xp|5zP8L`Z5n+azkGX;8oqd4$XEp*xr=6$ab|(f9DpmE! zc2K#_z0{l@!@UuKz zAhq%2{Jd|E!Cgk{9{7%j{(8Xk$qF=~&16=w z!_Y3U`;(W_!+&mE*r+)<@hhCkL57*?6bTaBaZz>y1oPR>{f*d=8OSd^kY5QPzs`6( z<8Mj$hB}S@L>8Rn2=6ZKdvFkybz;&N8BG@gzn$uZT$3QB1O2o)(=Dk9WVpS>WSz!$ z0dK$5rg;7`;4kX6_uq-bj3W(k6NKi1#HaIpjr|C>w+o0kN32d_l-8o7E$bpHVP*@lC*xm;C1B;2=I~s2M9wr{|~^TQ72?44=A<~8E~eu z3Ljp8bA%ZW3B(+Em3Gd|1`w5xb3U zfRJKls_*ZKfN-b{*lhjnO8E=O`G~ZhfV-t*H*lWjV&^Vm)>}tP{GbQoK&R-Wx;^7( z-fj+7-!RT#MgVyO2*XyyVa_B4Ir7movs=mD0?6&b9VWCX;m)3;k88X!w}dqGOJJVJi&V9>OAV%elNX_<|Yhr zLYQ&z#&2m=?4b?~7rDpSlw1Gg7o51@9)sAh1-bSp#qSlE!J)-)7zcQ7_y#Z!t%v$} z6!4a@=W_X4A>EN7-xpqDw!vqm+h_tIbPUBy;NsZ<8vV!b=+xjO?ILOMMw19*Cjgd_ z+anW`{zd9{di;qe7QUHU)b7m5YKRRx3$AI&M12ON`yoYA(wHage`VVvL5e7aUl8C~ zyHUV4>_C#2t6_}N6p(*9P~0y4v#hz?_?I(DmbDk@OxmD7KLb^d6#oBf?w}%##6{`NIJ!7O<6e zpkKrS#rLMRD{oVi@MS_(mv4}Mx~Nyu zkK;R^G&=@88%%jbxve9Kh-x>_dt~v2bC27Y80xTIbG_`Gcg)H+j2|pr^F13G1-YlJ zBIEmK=}ZRtmc?=-VKtWeR*VscT8`JQUT*6s;wjU6qlp|8nofyIiZ#?Y{x9geO5>oC zrD;jY;{|433n<}gh7m$+2qy9CE6X?WgFd}~NUl;9Uy`aIJ=cb=k-yLjGWK9I0;!UH zxtHVnv71(M4pStV$`o2&3$xm!8QJO;`L^e}5^d#9*G_VB?{=oP&6naF>p?&3A4o5} z7lXUWhvIf+O_@~f<}M9!qj_CgV(cd^cDpVg+xJ>JJF`yihW|O4I7m8vrA=H>ZWg-G z&SG_1C*v>??i$;QXcRfR2Kga>0exoj`#q>wEy$3UULx?q>iLaRA1$Lti{Q;7=EA9SJ`-4 zq~s_9c|{(m<;TV7Vr(7E^EM;ttQj818s4>He&{4P*%Vq+`w&x<3jf%>$anIiiAy21 znLv#F2=xyEt=;>!A=h&`Kg2ceYf zI$u8N1l=psm_{v06!er3WX;w@vKPS$lx+8UIPCx2JGfX5F88;fs}V6}X-c%Vnizt` znpKFBH`}g(eBPl`?OKzp4ch?2TuttT|ROcRP@6|_BfV45+p*JJRny3FsMz3PJI;JvFd&b17k zuK1O;cj7wULZWSBmXo+wh0Y| z3eVR-ZALekYAhRdK{{RVvs#p1InTAQI|bU$KosdehwWI5jL^=j zDf{31OjNvuk#vQpT@Q%ie6y)q+bPj7w_=nrga%nf9ZtPw{zR-VB*?;BJ0-S-{^eb3 zP6vhGcv>)7BJd5#dyhZC;O+sT%<;brI~xtJGta7$fSoLG61oGFFJ7NS`OH^fD24i z3l2>ezl?ZhM#;Ts5&1s)HA7`oB1eWP#PqqV(igX|wk8AG>WOSEwPJ zb&5srNjhfC)ghrfy)I5N3e|NqD>B~jZW)$=dsRx1HDB8d5vXIu?-a6H5QGS4C?75L z4pD?|%lR2mW!>4xN>6`9>@f|xsv+a7sxE$|uzP6H_Sn1K;tEe9r>C=RE`O%(0F1QW z-h4jTLl~V;2bx?kLB5N#{ezt)cSq;kn)avbr?|#IbgF@wfs-QFBbe%7c|W!d#(3)& z3}ak2%@K0GYsPGm%$-XC_w2r{MZ)b5x)?%x-zjF3l#hQ;c}jKo#D@pQY&oTV>9=l- zGV;0ar&uSt+cCPzgH2KMhY(}qYSu<+N7H3sadN-W^VNfkF=mI?C$AqXF#k-8*FA-k zyf$uV7}fsKDelypb_@&p$*4CkPb}by8q;}gHI>TlhD}df5~Bv8_RJUF`K0Kd9%r}9 zT8i(gN}nkOC4qN3S^3x_#*4jWXqg(HRzLY#W4h~(4Nd^$DBetQ1pIRvnYqKa9#i8rSJFLj3tN^;$E_SHr8x?eAM{cT~;BCf-UWyH zM(7v`v>0AAg!c`IfPjv^`vC`Ka?L{D_$G)q26a!4rghD@FHtzJFmeja!IV?S|zv$QNV3HjyeQ6rh+-%&IA*_FTn8kwAw&hQK>)rlN z1{*dzwt>wyW4NdWofpG&tN#|c+A~tUg1t}|BYiwq`7fw2zPT68!hFHkb7=KC78bQg zj)Cu}TZRMIX@ozIC`eU_`ywlgV`?}O2M5T$3+I0;Xdce;fh@MU9+rOv8CHBNKlQbT z>T@>o+c4&p0|K`~@qr8&?RqmgRUjC2+09 Date: Thu, 19 Mar 2026 16:37:49 -0500 Subject: [PATCH 02/10] new file: packs/trident-operator-26.0.2/README.md new file: packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz new file: packs/trident-operator-26.0.2/charts/trident-operator/.helmignore new file: packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/README.md new file: packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/values.yaml new file: packs/trident-operator-26.0.2/logo.png new file: packs/trident-operator-26.0.2/pack.json new file: packs/trident-operator-26.0.2/values.yaml new file: packs/trident-operator-addon-26.0.2/README.md new file: packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml new file: packs/trident-operator-addon-26.0.2/logo.png new file: packs/trident-operator-addon-26.0.2/pack.json new file: packs/trident-operator-addon-26.0.2/values.yaml --- packs/trident-operator-26.0.2/README.md | 24 + .../charts/trident-operator-100.2602.0.tgz | Bin 0 -> 11642 bytes .../charts/trident-operator/.helmignore | 23 + .../charts/trident-operator/Chart.yaml | 15 + .../charts/trident-operator/README.md | 24 + .../crds/tridentconfigurators.yaml | 54 +++ .../crds/tridentorchestrators.yaml | 25 + .../trident-operator/templates/NOTES.txt | 18 + .../trident-operator/templates/_helpers.tpl | 416 ++++++++++++++++ .../templates/clusterrole-rancher.yaml | 13 + .../templates/clusterrole.yaml | 458 ++++++++++++++++++ .../templates/clusterrolebinding-rancher.yaml | 14 + .../templates/clusterrolebinding.yaml | 14 + .../templates/deployment.yaml | 82 ++++ .../templates/postdeletecrdshook.yaml | 82 ++++ .../templates/postinstallupgradehook.yaml | 70 +++ .../templates/predeletecrdshook.yaml | 41 ++ .../templates/serviceaccount.yaml | 20 + .../templates/tridentconfigurator.yaml | 111 +++++ .../templates/tridentorchestrator.yaml | 108 +++++ .../charts/trident-operator/values.yaml | 327 +++++++++++++ packs/trident-operator-26.0.2/logo.png | Bin 0 -> 4314 bytes packs/trident-operator-26.0.2/pack.json | 16 + packs/trident-operator-26.0.2/values.yaml | 346 +++++++++++++ packs/trident-operator-addon-26.0.2/README.md | 24 + .../charts/trident-operator-100.2602.0.tgz | Bin 0 -> 11642 bytes .../charts/trident-operator/.helmignore | 23 + .../charts/trident-operator/Chart.yaml | 15 + .../charts/trident-operator/README.md | 24 + .../crds/tridentconfigurators.yaml | 54 +++ .../crds/tridentorchestrators.yaml | 25 + .../trident-operator/templates/NOTES.txt | 18 + .../trident-operator/templates/_helpers.tpl | 416 ++++++++++++++++ .../templates/clusterrole-rancher.yaml | 13 + .../templates/clusterrole.yaml | 458 ++++++++++++++++++ .../templates/clusterrolebinding-rancher.yaml | 14 + .../templates/clusterrolebinding.yaml | 14 + .../templates/deployment.yaml | 82 ++++ .../templates/postdeletecrdshook.yaml | 82 ++++ .../templates/postinstallupgradehook.yaml | 70 +++ .../templates/predeletecrdshook.yaml | 41 ++ .../templates/serviceaccount.yaml | 20 + .../templates/tridentconfigurator.yaml | 111 +++++ .../templates/tridentorchestrator.yaml | 108 +++++ .../charts/trident-operator/values.yaml | 327 +++++++++++++ packs/trident-operator-addon-26.0.2/logo.png | Bin 0 -> 4314 bytes packs/trident-operator-addon-26.0.2/pack.json | 17 + .../trident-operator-addon-26.0.2/values.yaml | 338 +++++++++++++ 48 files changed, 4595 insertions(+) create mode 100644 packs/trident-operator-26.0.2/README.md create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/.helmignore create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/README.md create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/values.yaml create mode 100644 packs/trident-operator-26.0.2/logo.png create mode 100644 packs/trident-operator-26.0.2/pack.json create mode 100644 packs/trident-operator-26.0.2/values.yaml create mode 100644 packs/trident-operator-addon-26.0.2/README.md create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml create mode 100644 packs/trident-operator-addon-26.0.2/logo.png create mode 100644 packs/trident-operator-addon-26.0.2/pack.json create mode 100644 packs/trident-operator-addon-26.0.2/values.yaml diff --git a/packs/trident-operator-26.0.2/README.md b/packs/trident-operator-26.0.2/README.md new file mode 100644 index 00000000..0f246c1a --- /dev/null +++ b/packs/trident-operator-26.0.2/README.md @@ -0,0 +1,24 @@ +NetApp Trident + +[![Support](https://img.shields.io/badge/support-official-0067C5.svg)](http://mysupport.netapp.com/info/web/ECMLP2619434.html) +[![Chat](https://img.shields.io/badge/chat-slack-4C9689.svg)](http://netapp.io/slack/) +[![GitHub last commit](https://img.shields.io/github/last-commit/netapp/trident.svg)](https://github.com/NetApp/trident/commits) +[![license](https://img.shields.io/github/license/netapp/trident.svg)](LICENSE) +[![Docs](https://img.shields.io/badge/docs-official-0067C5.svg)](https://docs.netapp.com/us-en/trident/index.html) +[![Go Report Card](https://goreportcard.com/badge/github.com/netapp/trident)](https://goreportcard.com/report/github.com/netapp/trident) + +Trident is a fully supported open source project maintained by [NetApp](https://www.netapp.com). It has been designed +from the ground up to help you meet your containerized applications' persistence demands using industry-standard +interfaces, such as the [Container Storage Interface (CSI)](https://kubernetes-csi.github.io/docs/introduction.html). + +Trident deploys in Kubernetes clusters as pods and provides dynamic storage orchestration services for your Kubernetes workloads. It enables your containerized applications to quickly and easily consume persistent storage from NetApp’s broad portfolio that +includes [ONTAP](https://www.netapp.com/data-management/ontap-data-management-software) (AFF/FAS/Select/Cloud), [Element](https://www.netapp.com/data-management/element-software) (HCI/SolidFire), as well as the [Azure NetApp Files](https://www.netapp.com/azure/azure-netapp-files/) +service, [Google Cloud NetApp Volumes](https://www.netapp.com/google-cloud/netapp-volumes/), and [Amazon FSx for ONTAP](https://www.netapp.com/aws/fsx-ontap/). + +Trident features also address data protection, disaster recovery, portability, and migration use cases for +Kubernetes workloads leveraging NetApp's industry-leading data management technology for snapshots, backups, +replication, and cloning. + +Detailed documentation for Trident can be found [here](https://docs.netapp.com/us-en/trident/index.html). + +See [NetApp's Support site](https://mysupport.netapp.com/site/info/version-support) for details on Trident's support policy under the [Trident's Release and Support Lifecycle](https://mysupport.netapp.com/site/info/trident-support) tab. diff --git a/packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz b/packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5aad9ff63eff782cf97a889adbabff8435dbf2a6 GIT binary patch literal 11642 zcmV-=Errq_iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ%avZmkAbft;Q{=QfLD3(px_J?$)AM;EI3#t%wM_MpJocVd zI8LCe(A_Yr3S|J*WLwt8zQ(@ZKFJ1dRj6w>FQVmH)(?pdB#?TWyRSyOhr4^PMt>RY9vr;h z{|k&Bje?#p=K`_6j2?`u-nc)>hcfabW}MJ;49h(aWm)la?=Tqc1tTxQJY*yjD)9*3 z;W&X%N(sy;g9v9aU6FJS=U5zN*%pT@EmLrOc?MiihUOSDMwdj^iy7pcq;n5IEN}t) z!N_0WEog$run;2S@1N z8^&}_ZCa3}bMG3jZYYcR*z-+GJl|61`C!L~=gVe!*ZC9|jN1D5?_f9BI|xSpXv<5H zq`y9{Jh95~7*LkQBt(*z-qM!e9gTv$L&fVS@Bha5U!pk2{81G^|M=fKc(uP~kFBP!7YPCx2h6pOlT^(`SWoLL)dzQ!3P0Ti$!&$M zXeZirZ@l2&9Q zKrCDkfkTlq3@DA@!{rXV!)b_jAfk{`0SS%BYz0D!CD)x8z!e1)MG)p((4?f8^oC}spV7#d%^kk5RH+_9sUW^h@$4UC z4-{{XoZkQp|C$qqqm!JGbbhHBNz(b*Jf%hQ=`9X(HA$;7x*jXnSC}Q-W&rq*AQ3K3 zZ!?BDSCUcW>HKTF8bh_MvTG_(Q1tW|&eB?zRwv_Hst<@IhX>8nB&wyhl0f;x35ZFW z-+EGQnYr(nrh?Hp#%vPjbCRAre3L>&BvVmb;in$BQgo%FV0oI#f#ME=vQ}jW>8gVb zu^Ls;1?wshy2MOEaS%1NvH^9Q5_i>5Ar?}SeOIekneP1#YpkBS9mx=J1ZyvJyX0VkPQNwtMS zsdZF6k)Fc?uY!IIgF!*lB#+|>jY+ryj)glnXL%e$rn9;TGc}i$jNxo{PQ`>_F6Rsv z%Owt(#L$L@o4orlz^h}hq9}DljKv9IfaIK2bh+);1?2)_s_kx|Gh1Sd14#vDQcSr( z0tfKYuo4EtC1S&vOos+|upM|MCe2&#MWKP-)A@V6#IYqo;*IGXVwFf|?K7mHYHGx4 z9-=8WfE4%{G??f_;?GHZqeih~v^#xRiJ1DC=RSJ;ijoJOQ+f3SI%(`CDZ#J{$ZC?VcmT}_mkg1O*3+OQjOm||r=rcynm%A&zwk(4?> z*A>7yo+Ck)*e*p7!^+@OJ%OX5NlntnF!<|;51i&*l2{szN4cOp&oat{?a+wuYL9Ml z$S@-`A|bf&49ovWIxi46D{c1k>1`P2Q5#~06S_pjU_%asG)56gF@u{0PJyIcpxC9c zAfZ`(lLRO8KEttO%TXJN1u1njcAR!(Z!}^bPK6%M%6HX4&4kh0l_jM_)7~F~Lbi~K zc|j8lOM(EUTG}&NO&b}i{vKwe9EWOkvoQtynq+YG{t}j$k(u=$bywXKiT8B=R;}C1 zS=s8dn9k?2C-k}=UJ86GfHL@n)3j70MFnFRNC>xaCu&6DqdX!K&WtczZCXS$DyQpe z<;uyV#MwWkIx4wq7TtIXt>JVhP)ly_{Mky2o-*C?tzGjIW!E!Rt*PCthr^=Qn*u`D zuVy9VQc+DTx{)$Pmy`&zwsZTiz*Lh@*=)4Jteb*ZXFm+R#!mhCPK4ch0ME)gp>C|a`QMYCL4M`(scvQ!lVXJm5{bV5JfWb_0HSkPv zrx99!-%=Lh6D&};XqbCKxxiQ`TcQAF7>S(Wz-yFs>J4L>M-xVuB$5l4G?L01bGTWM zaG`S{i;vRO+xCP>E-1IVo07#Y%i_vhu{G7)RVuLsS}tY)L{aSBx~5 z9bKu-qR{O+I-a!h!Vv4r{L19S^3?L==y>Ar0)?3#+BIrbT6dLvLGw6L%f-O6byyme z7w!iv7zueRnR05rghWFGo(u1gMtI1{C5~tBFj9^*xeAoF88I~4-$m9~M+?U@ zf1%64FLWx)kaS6}apZN?JBGol#2Bb`n4b_)W~{}1gNRTzF`$`H7NNx7g4Q+IxH!>kd}Q&Vq9ki!<^=FATT^*m@j}KfeY(hsyLYAR4z$y z1XC1V<22%d*IV}(_D9KxOB&Q5JJVzM0;S;svtzxax}dRg6320&IuRIUwKu+lgv<~AK=C?sMvp)}Us z9Do!Hlx0U+Q`tl-f`4N)&upUh^<#FLhHRzC`5v$AE=!$%AI`6iCJ*MIR8rYm9`dF2 zwfivRw~9+!TgDO1m&v)>AudufMg;mV{~gUO`J zbpyk8ssfT0bIiBjUY#DlgUQ9|k7uVpefzD~sL_$Vi*m&46}=h?%3$EG#h@%Tn&MP& zcvyd8*8K1hPM4Y@KxJ9QcY0oWRTXB+YNPcYsq# z4#UR31s^VbOO~#l=TqNoZ1Mn(;@FkX8zL4Z^IZ}g1{58Zr_v7HDj~P@AlVDx{KLs< ztxZbC+}0#{EJ)VU8g81S`q|jrx@knf0`dMvjbTge!fmPITgE)!3gA@gfe)8$$#=aY--=<-AuDv^L4t2pSR} zz}ZZ@_;4f@psk@c2m;TlF*QY$1nLRHdaM&fihW!=63VU2Fw4h!xED!Unab2RqaTP# z)}yOhu3p0Yeqj}^-eC&NG<9b6>u?V~uaQ%iKP0s#va#=d{6Ld?GJOP=gBAal1^N?e<#0+MPCartE&KCIYXteDW zNX+)(f^uP2hb3A!QCZK{=4$LHmyvO5N)0@xsIvk|tvA&!a~zjn#&9NW9bqgMZr!*} zOYQ2rTsjBml{_nMg|4TgXqTTxk%^5JPV>Ag@ z>$wQFBmoyX)smnW49ekZeQzW+daeP_GZgAVsr?mr6OARM0vCa+3`3H0A+2;ZuxVt-Y5Ld40faOI3$jbWh-USF~^?VON70j#=guD}o)>4~oAjy-}Wg30~HL1W5XY zBGDH2tXE5|{G$kvj_y>eH4SqdBhCW=&pW+ENfv9J>6UW=*HBK&bf<;2RZ~t|Gf~4lUwT!pyPS$7%)oqlf4h z{d)BOKNmR8e{r`G&`1)D@KgIXy)9_nZl4Pv*LS`h!VwK_V zq&}2u@G*Ql{QTLIP~PcnrWBxYo?5F*9R&+K1Lteyfni_|S4r3b_+_rLE#0Xl_)(uZ zl8_(lmjCY{Se}M(xUc>s$z?v9ky{w}12A<--Szpir>Q$;7zqrhz%a|>cm==aC^jbx zvP{t(ct2rXw}KZEgKPtbDGpK2F>tAB9EGl0Yn;N`$(9hIRkJ!e@X~A>oSa`uSfzI} z9Bv1matWCkM^<8-SKOSRQ)xsLJ|eYEjyNDiyrH&}u@a`rTrw+oX)_Cc8j#NXP52%2 zqMmOQ?c?t@@6eLQf(yEmhQd{JRub<>T*gQ$W-$0y?*A(v)auemHy5w=KPy7#^rjpk zHo^jN-J^C_NkOSoOg+7-pvo?-H^t?${@a9U!0*6t7E6<7@c#{9@Xx{BhY(E?nwoP~ z-4yD4O`@DU1HKq4s>gErB&iBeY&0m)D4Y4*1oOW))dr5Fm?j<-r&47e%Cew(ETlL| zS(*z@k>BChT$+1p`m#7wu&(`eg8f#S^fA!32J0~!v^T}to#R$hq(O9JeXZirI%zLM ztYZ`BR!W*3w2grFjqvJ7xAk}xTsKl3W494T6-TlGMg`ZZBdam%9TZhEm6CC4sGjzy z)lknI)=3-7E^b42h34>kU9(mPL0#nypD{(is;3qk401l zDE_qtqd9*u_=VGS&@o0!ur|S0=Pou?pT&ub9!aR4zv$C3^&=inHw~!$JLp&cnT;1; z(+g$HdT%e3U@heDzJ7IZxGC{#w0yT|S~(igPUYh(@fL;oMa9o;f5$jC~V-R&0WJlmRNQB`I&=$QV}c0bNe^+raMQ7KPzP?U$7P3}R1t7F#lb zSNMG7Z0zgsXXOw{BeO)X@!ZO9ubMbj=h9V(nRQXE2@Dq$wxpKXYVoFMhE)rzQe{_v zL%5CA9)G8Ip36KFPJ7N}Udygh6Y#_I7YQ3vdYxx5SndvBP{0r5fN(0c#fRU5KCVM% zu(hVWTcGYc5%BG>)#0~>TWYrhpw{y5R6Kl9pCg+tX)4aYkeF6E!M7?@kJiPdN^F%~ ziX@rCR21zu*Lbx9-{@`i@po0=Ai)AfNT9$KU8hlG1`EU|Eu_hMEo2`9Y_4HKRyZyHM#E@n>XDE^rLIAhbGC|tw2iva0rK0l&O5co1G7BUp_%GL4^~m5Y+V$1 zEoxh89qR{RGy&%(vF<6b*!v91P{^|3b-_@hv1nR>`rP=UZBHAXQKkw7mi{2j@>+_C zL05^oWhIdLZ9ug5vWD~X=keWv-h&l3AAv40wgHL;}6 zGW#sEUyICk7$Tvyu?h*+;YjMJM!YhD9_hmvzvNt)%dxm%xw=8H#|^eXyu9Vi9(Xf@ z!q`^}#EXpT8lf;bt@T|J=vQsh27qJd6tL}9uo{M&6)(^|>R@#1Z(~W#c6ROOYRlY| z>hI<+DS{O&{^!pUjSK1i-PO70G{WkL(o^=WI$%_7dncT>92(r)ObR+GcnUe#P!if? z;cJr*b8zjel@NRF#RFudt%_$UX_J!X98{TtinxR7Tx6!84dM`7aw>vWSX>qIzewMx z3zn+<+K3CAdIa24l^d{xmHe>Qre(%`?90!ey-f|iM>F@H%-Gw+)O!>|?}28X|6e^~ z`oGrK6aQ__F)$iq-)u+R?^%F#?|&TZ*W$nTb`N%UpX0xu;xo#i2vY3XI0@?eyzbi} zY>L7FgPXRKcD}5n(vXuu-cX;G`%7T<^m{GVtggF+)-!b9$s6UgeN z31dW(O{vg7ZjdM*WbjR3K=CueF?N1x^;TjxMIYE4P4rM7uUo1rx)5RJ%nkzk<0 z7;(OFul-T{!b_aCPdE1?@^Pp#ckqAZyt7Ha=2W1so!E>p8a-%i z7A<~&qR<*jUnP`0a2R&bPd~`dr zg+~1l)mPEwmX@zVm(A7h`!uIgvb8aN=G-IU?UB9Bb?jr&^6-9rimtlLP-vwiuc9T*b!kU444^rd z%TWsG(ZVqj52jUvqZfh*(M+zm1+7lyzb~tKsqY3tuFOLS7t{AEwfT*Zf}Du6vI+t zy4qBS>ZnroKEnx)NW1jZ^Ea!e@FH#s*HNu=Zxn|YaA9B0P?u24%)SDqPPd$(X2k2# zTio6bWNw_TS4Ua6z+5Q5RD%GS+gqTQ013Jlzk3sT6Ti&uEzwVa1YJu3$_1S>dZUig zkQQO9<#$Q00W`Zd$mEED>nyr$>$rg&n#yh}MNeW{P_JFRhhjfG&8d<&NHzQ|HkB7_r~a_l6j z*BfVf%pb|I^(b_%BWg1dTqhz;k>R9YjPBmJD#QQ4W^m$&^?irKeLQFQ7MHr-yr;wK z3FdvByGdZb%-x%;FVabEopK)s^jdB`7P*h1J@3td>Q)-furyX@!Y&*nNavPY7w^K6{#A{0aZr;p< zgW5!SHx1G=b~l-zd4|KWx;-F^Nr?Cuc0B;Kse|YC4K?*R>jf^>UiMaKovj|=c<+$B z3DLb;&5lb`zoT>;r${pzHM&Dl(BCDsVntuPfws$$OxM>r6Rkza|lt%EJ89}NI8jZ zNZm3U;pCNh{=834%7;LmMKVnilt!gQ`p~!oyDnywm7P<4AlqC)9hFyR*PnkbARICC z!FTsyeP-W2_wB3l-#Pam_P@a1awfWY=R@Zm>JCNvdiI{WaJqE4rbp=H!^uC-kA65U zGC*JI^_J0O>?DGI9mCjCjr0i;i*cc{)cyAjRQ3(mR(y}AE9xL!y26rm^gsT7ar)2W zi_??S^Q*I?_y2r*_P&L@Ar|4VyvTp3Rn0HF*iHu%?)HOz)!eDUVp2u?km0Dp!bBF( z46GsP>rHhzW$Wt$jeGIGX_PB3wbXND_l1|X*k=0tWj8I=v+>QV49ds09IOo|S%Iq) z58DJusi}5Hy(938$es!Fs_wJ5ipPR-Eg4SpvtCKDX3L3s)tIu?2X^f4(|=W-iRbSr zzMl18M!C?w_K-z7xgh4*HYRakAkBK6b2J~t$VaZo|h%=d3FnJ>g(3qWN80^3xCS3im36g)Q9lOEL59W8bL$ZtQ#;yIR+<$Wq?w20VPJicP zjjD}&o_%7vf$y`~kyF{lWvBf&I$hICl0h5miJEJu_M(=)AtLgpt7;{N#qRT9?G^Mq z$+fm@|I1{iSnUzDLF46Jzf38M4jxr(U)^17cht`rBC!-<;~}ZKsa(HF+tR*Yo}puv z-y)BJexBV;d`zD z*4Y31dx!P=pZ50lpWpv|lJAk7pnZ#l&320KvO!bbb6LOpkWprxZ*~@02$2~Lk})c1 zNaHbF9Zzf;l{502(P(5H-iXbynAqe!W$U!IdP1X~7OUCIj4s~{ue(`2o6Y?O#g6`E z5Z!&Mhqk%CL*@2vkhq&88|;l7K>a0-4Yot>xD|2-T#Y@DJMDk;A(9P0uGu-Nb1;G28U*w(N}9=~cw;PC;#}zz3f@KX&(C2cuvV?2er=p>|#tIJ|a#H=Mw- zYC#fAbK#^7Uhj=Y19$=7W1Oj1gaqvFK|)dvh{MtMmr$%gfrpG_0v3n^N+HiO%=G1> zKxeS~N|g#s<-PkEmy@I8FR-bhUsr0{tbW_rH)H+J){%c4U!R@RU*hYt{}_H0_wPFU zZ}0GR-`Gssh8!4JlQ z<#-1M{F-FP7bpCRewfB&Nsz#@z-Eq~!A@aYtZ}Ohe*XMWrsNn13R7%6Oi>U7_4Wbq z7~>3H)zTxHR-IKi=GbdPY2P4qTL=-w98xOu%YZekGjeYS)??T~J@bF{nC=5&fY;3b zySt6^Kcj<#!{_<`DZcyd?%vaHQw^EvjoWPGmH{<3T1LN4Rw+6DPLh_`S3tK09T>XG z>*AOB%ohJu}tB`UEq=xM-{O^Jm4+7mKG)rkLjwfC(5 zpX94MYdf6(HP?Pam6U5jV*$Cfv`iqnppVj-Z?1)_1WlJ7etjk0iMrtM+=+xV70igf z2I5oW$^ZJKVf?i?MX5MDsjM&RjkZAMQJt8`_AspUE{b_?*#>mCQ<<{9uu(Y&KE??M zGgbM$1QX@f9jy3`jLmey+~!J8ISt$MfrqZ z<<;Bnn)ou|jq$ob90uu(4iIS1K@$F{{ao&z-1=rlVu2Z!YEM(>b)-Oo*f_`f?-zcv-1TTmzgMfbB7cvLO$M=zEBOMdIu|E??hORWEQNBg6_#`=H% z`TfTy`R+EWd~jr;+bvwo9-H}u^{oAtvJjtOfx<<5C`<#a2#YzJEDzhu$eaS~`VGI* z0Z5gFq=Egu$kosbA+ig733X4YcMT}BU?nk5LwuAA%JWP|5w;Q7ge%Ccho0#Yr?;vG zr+{H%BfX8>uF@4njLO`z?#QG%R6)0sF=6y})keor4W@}WRX6eBHH9shbyCdVQkI|& zUKiN~sS)8)rjGK6i1&2fUaSVRrhlBn_bUFXtpN^9Z?K_;eoyD`@e;>H8`ZD2daIDt zT>(1(iL&ciOmBE6cM6E2jS?GLVb)znXBP!BMyGhvDegsfQNZN%2wF7+u5HWW0?!E- z_WkNgQu73R6}ZBr>wJo1EKUfk6f2Xn`ZM}I{ZUAnrb(^-Ufka!#C6^?R zWIa_sm1(@w^rG2CTdRidrd*JW?qYe`ns>*Z?L+YBeOe-GFgk6^+PEKkDt@{iY`Zd} z&|$UALW`N(ZYyfWq}fde$J1W{tL_1mz}DyA1g`F0YcuNTcv1l@Qq4>pW@n8sESp%` zNBjpY7zwNGa5E|>b3y+@`x>-gK$UU=54-(28|+R2s1^7nj%V*Mib*=Rm*`ZdfDWMc zDtZiX7T|RUDJBeO z&d_8y8@D)js*rlD1)o3nXa?O=$21Ld#&B9Aw2|9NUrXSdF}9l-ZB%!b-=qO@RBL}v z!$4UeUd|})H8$Jrz*23!Cux4WA?#0DF;t=b%H~iRNaEh*yOuyxi#w}U^jBF$c}q?S z+IELdnOokXbJ*(cS;x{x;*#-K9yPM5IVq19zs zca~X8u>tO+*-lRzP`$B%u%KL2_IaIz>YP#se0B>y(%10+sc365PbtHXg=0y?_Z40<%;_N9%rvn*~l`nv*yp=^Qc?UZXkYf%gKg7KDRwzHs0R z9LF$^=~Q2MO49ib=!Y4XSlvbDq@y(QUO!JLSp`d5?h1=HWyQ2lEY7W1L}$NuEY zbXZn2Md5Xxfet15HsCjz_iZpm*WR~*NaWv?k-7Kn|MXtKkBAYPb2vLW9BCrrSk!xSbR4)$Koi<>;}L9Zb&2+-wk$0qX8_`$s_&a-#zc+zkIyZ zs^RCCY85yh4oNZ(_=4a#QU|G~D4OG;Q6N5@%}7X4?2kr=ua92^d^z9NMaRQovNB+H zKO&^bkfbv@yus7q>G2QmCwqsxe?8bg2o@rVwNRxzgBbgJi$frXI>T6I_Wx?7Koh+{5RogVDE!HsjBaUhI|d5A{z3Z4wB_0h}$_i_i;WCZ0l_SfP{+YxVgD;Sg;+ynLeOC#W;lsb23kH&8Jb$1zY)Cpfo}(^3+ws zGZbRJ13V8GfVjf{vAAOZE_G-JoLNwKd3<^1u(vz{>4%&IhO30CejgIK(2H{QW~}bz zpyaN;-JJtT;rpT%`%0TS*`Lvft79OUc4cvhRw+tIXhTk%BUI|_zj@nG9p+N3aw@iW zdUM5o?M>k87%F?<*PMjc@k$Yb5hw9V7T|e;OKyvTBGrpp0RGSa`rjO;jG{!?#D5L+z~{ z9>+9~ws+v;X{t+$lM5U&M}0D8wvK>q!(hm#0<^lkk(w;;^o+mF;eEZqND6j5I9_F zs=0VVe8(8Jd84mOFM9sB-396UqhC7ueb_!o}I0 zF`nv4<3)VATsN&SV>RA0msXp)0!IZM=~`_}(msA8DsvAVZOs${jW z(i(`+^d8j73O?BKHKHu7+S;%?r}v;)RwF4^CWy6L**&POY~i->R9l-m=K3CVT5~m0 z6{upZMDBJFnc*;K#C+;|9j{E>OCD_YX0Bd-Q8`@|IhyaC;7hQ{J-wf;s3|ye@8cU2U&yKcjn^zE{ON` zCGeVlt1!P^ztK9Px(4&rB}UGlE_hAX{?UT`{5^lq-}CqU-Rb+k0RRC1|EwNJ2LKEK E0Py(_#Q*>R literal 0 HcmV?d00001 diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/.helmignore b/packs/trident-operator-26.0.2/charts/trident-operator/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml new file mode 100644 index 00000000..82160961 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +appVersion: 26.02.0 +description: A Helm chart for deploying NetApp's Trident CSI storage provisioner using + the Trident Operator. +home: https://github.com/NetApp/trident +icon: https://raw.githubusercontent.com/NetApp/trident/master/logo/trident.png +keywords: +- NetApp +- Trident +- operator +- CSI +kubeVersion: '>= 1.24.0-0' +name: trident-operator +type: application +version: 100.2602.0 diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/README.md b/packs/trident-operator-26.0.2/charts/trident-operator/README.md new file mode 100644 index 00000000..0f246c1a --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/README.md @@ -0,0 +1,24 @@ +NetApp Trident + +[![Support](https://img.shields.io/badge/support-official-0067C5.svg)](http://mysupport.netapp.com/info/web/ECMLP2619434.html) +[![Chat](https://img.shields.io/badge/chat-slack-4C9689.svg)](http://netapp.io/slack/) +[![GitHub last commit](https://img.shields.io/github/last-commit/netapp/trident.svg)](https://github.com/NetApp/trident/commits) +[![license](https://img.shields.io/github/license/netapp/trident.svg)](LICENSE) +[![Docs](https://img.shields.io/badge/docs-official-0067C5.svg)](https://docs.netapp.com/us-en/trident/index.html) +[![Go Report Card](https://goreportcard.com/badge/github.com/netapp/trident)](https://goreportcard.com/report/github.com/netapp/trident) + +Trident is a fully supported open source project maintained by [NetApp](https://www.netapp.com). It has been designed +from the ground up to help you meet your containerized applications' persistence demands using industry-standard +interfaces, such as the [Container Storage Interface (CSI)](https://kubernetes-csi.github.io/docs/introduction.html). + +Trident deploys in Kubernetes clusters as pods and provides dynamic storage orchestration services for your Kubernetes workloads. It enables your containerized applications to quickly and easily consume persistent storage from NetApp’s broad portfolio that +includes [ONTAP](https://www.netapp.com/data-management/ontap-data-management-software) (AFF/FAS/Select/Cloud), [Element](https://www.netapp.com/data-management/element-software) (HCI/SolidFire), as well as the [Azure NetApp Files](https://www.netapp.com/azure/azure-netapp-files/) +service, [Google Cloud NetApp Volumes](https://www.netapp.com/google-cloud/netapp-volumes/), and [Amazon FSx for ONTAP](https://www.netapp.com/aws/fsx-ontap/). + +Trident features also address data protection, disaster recovery, portability, and migration use cases for +Kubernetes workloads leveraging NetApp's industry-leading data management technology for snapshots, backups, +replication, and cloning. + +Detailed documentation for Trident can be found [here](https://docs.netapp.com/us-en/trident/index.html). + +See [NetApp's Support site](https://mysupport.netapp.com/site/info/version-support) for details on Trident's support policy under the [Trident's Release and Support Lifecycle](https://mysupport.netapp.com/site/info/trident-support) tab. diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml new file mode 100644 index 00000000..f3aa8971 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tridentconfigurators.trident.netapp.io +spec: + group: trident.netapp.io + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + x-kubernetes-preserve-unknown-fields: true + subresources: + status: {} + additionalPrinterColumns: + - name: Phase + type: string + description: The backend config phase + priority: 0 + jsonPath: .status.phase + - name: Status + type: string + description: The result of the last operation + priority: 0 + jsonPath: .status.lastOperationStatus + - name: Cloud Provider + type: string + description: The name of cloud provider + priority: 0 + jsonPath: .status.cloudProvider + - name: Storage Driver + type: string + description: The storage driver type + priority: 1 + jsonPath: .spec.storageDriverName + - name: Deletion Policy + type: string + description: The deletion policy + priority: 1 + jsonPath: .status.deletionPolicy + scope: Cluster + names: + plural: tridentconfigurators + singular: tridentconfigurator + kind: TridentConfigurator + shortNames: + - tconf + - tconfigurator + categories: + - trident + - trident-internal + - trident-external \ No newline at end of file diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml new file mode 100644 index 00000000..f16b855c --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml @@ -0,0 +1,25 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tridentorchestrators.trident.netapp.io +spec: + group: trident.netapp.io + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + x-kubernetes-preserve-unknown-fields: true + subresources: + status: {} + names: + kind: TridentOrchestrator + listKind: TridentOrchestratorList + plural: tridentorchestrators + singular: tridentorchestrator + shortNames: + - torc + - torchestrator + scope: Cluster diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt b/packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt new file mode 100644 index 00000000..acb0dd88 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt @@ -0,0 +1,18 @@ + +Thank you for installing {{ .Chart.Name }}, which will deploy and manage NetApp's Trident CSI +storage provisioner for Kubernetes. + +Your release is named '{{ .Release.Name }}' and is installed into the '{{ .Release.Namespace }}' namespace. +Please note that there must be only one instance of Trident (and trident-operator) in a Kubernetes cluster. + +To configure Trident to manage storage resources, you will now need to configure at least one storage +backend and add a matching storageClass. + +Examples of backend and storageClass definitions are available at official NetApp Trident documentation. + +Further, You may find all Trident releases and source code online at {{ .Chart.Home }}. + +To learn more about the release, try: + + $ helm status {{ .Release.Name }} + $ helm get all {{ .Release.Name }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl b/packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl new file mode 100644 index 00000000..bbf3dc01 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl @@ -0,0 +1,416 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "trident.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "trident.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "trident.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "trident.labels" -}} +helm.sh/chart: {{ include "trident.chart" . }} +{{ include "trident.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "trident.selectorLabels" -}} +app.kubernetes.io/name: {{ include "trident.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Trident operator level +*/}} +{{- define "trident-operator.logLevel" -}} +{{- .Values.operatorLogLevel }} +{{- end }} + +{{/* +Trident operator debug +*/}} +{{- define "trident-operator.debug" -}} +{{- .Values.operatorDebug }} +{{- end }} + +{{/* +Trident operator image +*/}} +{{- define "trident-operator.image" -}} +{{- if .Values.operatorImage }} +{{- .Values.operatorImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident-operator:{{ .Values.operatorImageTag | default .Chart.AppVersion }} +{{- else }} +{{- "" }}docker.io/netapp/trident-operator:{{ .Values.operatorImageTag | default .Chart.AppVersion }} +{{- end }} +{{- end }} + +{{/* +Trident force detach +*/}} +{{- define "trident.enableForceDetach" -}} +{{- if .Values.enableForceDetach | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident IPv6 +*/}} +{{- define "trident.IPv6" -}} +{{- if .Values.tridentIPv6 | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident SilenceAutosupport +*/}} +{{- define "trident.silenceAutosupport" -}} +{{- if .Values.tridentSilenceAutosupport | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident ExcludeAutosupport +*/}} +{{- define "trident.excludeAutosupport" -}} +{{- if .Values.tridentExcludeAutosupport | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +Trident AutoSupport image +*/}} +{{- define "trident.autosupportImage" -}} +{{- if .Values.tridentAutosupportImage }} +{{- .Values.tridentAutosupportImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident-autosupport:{{ .Values.tridentAutosupportImageTag | default .Chart.AppVersion | trunc 5}} +{{- else }} +{{- "" }}docker.io/netapp/trident-autosupport:{{ .Values.tridentAutosupportImageTag | default .Chart.AppVersion | trunc 5}} +{{- end }} +{{- end }} + +{{/* +Trident log level +*/}} +{{- define "trident.logLevel" -}} +{{- .Values.tridentLogLevel }} +{{- end }} + +{{/* +Trident debug (equivalent to debug level) +*/}} +{{- define "trident.debug" -}} +{{- .Values.tridentDebug }} +{{- end }} + +{{/* +Trident logging workflows +*/}} +{{- define "trident.logWorkflows" -}} +{{- .Values.tridentLogWorkflows }} +{{- end }} + +{{/* +Trident logging layers +*/}} +{{- define "trident.logLayers" -}} +{{- .Values.tridentLogLayers }} +{{- end }} + +{{/* +Trident log format +*/}} +{{- define "trident.logFormat" -}} +{{- if eq .Values.tridentLogFormat "json" }} +{{- .Values.tridentLogFormat }} +{{- else }} +{{- "text" }} +{{- end }} +{{- end }} + +{{/* +Trident audit log +*/}} +{{- define "trident.disableAuditLog" -}} +{{- if .Values.tridentDisableAuditLog | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident probe port +*/}} +{{- define "trident.probePort" -}} +{{- if eq .Values.tridentProbePort "json" }} +{{- .Values.tridentProbePort }} +{{- else }} +{{- 17546 }} +{{- end }} +{{- end }} + +{{/* +Trident image +*/}} +{{- define "trident.image" -}} +{{- if .Values.tridentImage }} +{{- .Values.tridentImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident:{{ .Values.tridentImageTag | default .Chart.AppVersion }} +{{- else }} +{{- "" }}docker.io/netapp/trident:{{ .Values.tridentImageTag | default .Chart.AppVersion }} +{{- end }} +{{- end }} + +{{/* +Trident image pull policy +*/}} +{{- define "imagePullPolicy" -}} +{{- if .Values.imagePullPolicy }} +{{- .Values.imagePullPolicy }} +{{- else }} +{{- "IfNotPresent" }} +{{- end }} +{{- end }} + +{{/* +Determines if rancher roles should be created by checking for the presence of the cattle-system namespace +or annotations with the prefix "cattle.io/" in the namespace where the chart is being installed. +Override auto-detection and force install the roles by setting Values.forceInstallRancherClusterRoles to 'true'. +*/}} +{{- define "shouldInstallRancherRoles" -}} +{{- $isRancher := false -}} +{{- $currentNs := .Release.Namespace -}} +{{- $currentNsObj := lookup "v1" "Namespace" "" $currentNs -}} +{{- /* Check if 'forceInstallRancherClusterRoles' is set */ -}} +{{- if .Values.forceInstallRancherClusterRoles }} + {{- $isRancher = true -}} +{{- end }} +{{- /* Check if the annotation prefix "cattle.io/" exists on the namespace */ -}} +{{- if $currentNsObj }} + {{- range $key, $value := $currentNsObj.metadata.annotations }} + {{- if hasPrefix "cattle.io/" $key }} + {{- $isRancher = true -}} + {{- end }} + {{- end }} +{{- end }} +{{- /* Check if cattle-system ns exists */ -}} +{{- $cattleNs := lookup "v1" "Namespace" "" "cattle-system" -}} +{{- if $cattleNs }} + {{- $isRancher = true -}} +{{- end }} +{{- $isRancher -}} +{{- end }} + +{{/* +Helper functions to render resource requests and limits for each container of trident from values.yaml +*/}} +{{- define "trident.resources.controller" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "trident.resources.node.linux" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "trident.resources.node.windows" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Helper functions to check if resources are actually defined (not just empty structure) +*/}} +{{- define "trident.hasControllerResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.controller -}} + {{- range $key, $val := .Values.resources.controller -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{- define "trident.hasNodeLinuxResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.node -}} + {{- if .Values.resources.node.linux -}} + {{- range $key, $val := .Values.resources.node.linux -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{- define "trident.hasNodeWindowsResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.node -}} + {{- if .Values.resources.node.windows -}} + {{- range $key, $val := .Values.resources.node.windows -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{/* +Helper function to check if operator resources are defined +*/}} +{{- define "trident-operator.hasResources" -}} + {{- $val := . -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + true + {{- end -}} +{{- end -}} + +{{/* +Helper function to render resource requests and limits for the operator +*/}} +{{- define "trident-operator.resources" }} +{{- $val := .}} +{{- if or $val.requests.cpu $val.requests.memory }} +requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} +limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml new file mode 100644 index 00000000..6300f2f2 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml @@ -0,0 +1,13 @@ +{{- if include "shouldInstallRancherRoles" . | eq "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: trident-operator-rancher +rules: + - apiGroups: + - management.cattle.io + resources: + - projects + verbs: + - updatepsa +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml new file mode 100644 index 00000000..92279962 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml @@ -0,0 +1,458 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: trident-operator + labels: + app: operator.trident.netapp.io +rules: + # Permissions same as Trident + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - apiGroups: + - "" + resources: + - persistentvolumes + - persistentvolumeclaims + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - persistentvolumeclaims/status + verbs: + - update + - patch + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - events + verbs: + - get + - list + - watch + - create + - update + - patch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - resourcequotas + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments + verbs: + - get + - list + - watch + - update + - patch + - delete + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments/status + verbs: + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots + - volumesnapshotclasses + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotclasses + verbs: + - create + - delete + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots/status + - volumesnapshotcontents/status + verbs: + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotcontents + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshots + verbs: + - list + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotclasses + verbs: + - list + - watch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents + verbs: + - get + - list + - watch + - patch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents/status + verbs: + - update + - apiGroups: + - csi.storage.k8s.io + resources: + - csidrivers + - csinodeinfos + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - storage.k8s.io + resources: + - csidrivers + - csinodes + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - trident.netapp.io + resources: + - tridentversions + - tridentbackends + - tridentstorageclasses + - tridentvolumes + - tridentvolumepublications + - tridentvolumereferences + - tridentnodes + - tridenttransactions + - tridentsnapshots + - tridentbackendconfigs + - tridentbackendconfigs/status + - tridentmirrorrelationships + - tridentmirrorrelationships/status + - tridentactionmirrorupdates + - tridentactionmirrorupdates/status + - tridentsnapshotinfos + - tridentsnapshotinfos/status + - tridentgroupsnapshots + - tridentgroupsnapshots/status + - tridentactionsnapshotrestores + - tridentactionsnapshotrestores/status + - tridentnoderemediations + - tridentnoderemediations/status + - tridentnoderemediationtemplates + - tridentnoderemediationtemplates/status + - tridentprovisioners # Required for Tprov + - tridentprovisioners/status # Required to update Tprov's status section + - tridentorchestrators # Required for torc + - tridentorchestrators/status # Required to update torc's status section + - tridentconfigurators # Required for tconf + - tridentconfigurators/status # Required to update tconf's status section + - tridentautogrowpolicies + - tridentautogrowpolicies/status + - tridentautogrowrequestinternals + - tridentautogrowrequestinternals/status + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + # Now Operator specific permissions + - apiGroups: + - "" + resources: + - namespaces + verbs: + - create + - patch + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - get + - list + - watch + - create + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - delete + - update + - patch + resourceNames: + - trident + - trident-csi + - trident-controller + - apiGroups: + - apps + resources: + - daemonsets + verbs: + - delete + - update + - patch + resourceNames: + - trident + - trident-csi + - trident-csi-windows + - trident-node-linux + - trident-node-windows + - apiGroups: + - "" + resources: + - pods/exec + - services + - serviceaccounts + verbs: + - get + - list + - create + - apiGroups: + - "" + resources: + - pods/exec + - services + verbs: + - delete + - update + - patch + resourceNames: + - trident-csi + - trident + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - delete + - update + - patch + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + - trident-csi + - trident + - apiGroups: + - authorization.openshift.io + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + - clusterroles + - clusterrolebindings + verbs: + - list + - create + - apiGroups: + - authorization.openshift.io + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + - clusterroles + - clusterrolebindings + verbs: + - get + - delete + - update + - patch + resourceNames: + - trident-node-remediation-access + - trident-controller + - trident-node-linux + - trident-node-windows + - trident-csi + - trident + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - list + - create + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tridentpods + - trident-controller + - trident-node-linux + - trident-node-windows + verbs: + - delete + - update + - patch + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - get + - list + - create + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + - trident + verbs: + - delete + - update + - patch + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - tridentoperatorpods + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml new file mode 100644 index 00000000..b70fcff9 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml @@ -0,0 +1,14 @@ +{{- if include "shouldInstallRancherRoles" . | eq "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: trident-operator-rancher +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: trident-operator-rancher +subjects: + - kind: ServiceAccount + name: trident-operator + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..e6297525 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: trident-operator + labels: + app: operator.trident.netapp.io +subjects: + - kind: ServiceAccount + name: trident-operator + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: trident-operator + apiGroup: rbac.authorization.k8s.io diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml new file mode 100644 index 00000000..c57bb587 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml @@ -0,0 +1,82 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: +{{- if .Values.deploymentAnnotations }} + annotations: +{{ toYaml .Values.deploymentAnnotations | indent 4 }} +{{- end }} + labels: + app: operator.trident.netapp.io + name: trident-operator + namespace: {{ .Release.Namespace }} +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: operator.trident.netapp.io + name: trident-operator + template: + metadata: + {{- if .Values.podAnnotations }} + annotations: +{{ toYaml .Values.podAnnotations | indent 8 }} + {{- end }} + labels: + app: operator.trident.netapp.io + name: trident-operator + {{- if and (eq .Values.cloudProvider "Azure") (ne .Values.cloudIdentity "") }} + azure.workload.identity/use: 'true' + {{- end }} + spec: + {{- if .Values.affinity }} + affinity: +{{- toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} + {{- end }} + serviceAccountName: trident-operator + containers: + - command: + - /trident-operator + {{- if or .Values.anfConfigurator.enabled .Values.ontapConfigurator.enabled }} + - -configurator-reconcile-interval={{ .Values.configuratorReconcileInterval }} + {{- end }} + {{- if .Values.operatorDebug }} + - -debug + {{- end }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: trident-operator + {{- if and (eq .Values.cloudProvider "Azure") (eq .Values.cloudIdentity "") }} + - name: AZURE_CREDENTIAL_FILE + value: /etc/kubernetes/azure.json + volumeMounts: + - name: azure-cred + mountPath: /etc/kubernetes + {{- end }} + image: {{ include "trident-operator.image" $ }} + imagePullPolicy: {{ .Values.imagePullPolicy }} + name: trident-operator + {{- if (include "trident-operator.hasResources" .Values.resources.operator) }} + resources: + {{- include "trident-operator.resources" .Values.resources.operator | indent 10 }} + {{- end }} + {{- if and (eq .Values.cloudProvider "Azure") (eq .Values.cloudIdentity "") }} + volumes: + - name: azure-cred + hostPath: + path: /etc/kubernetes + type: DirectoryOrCreate + {{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml new file mode 100644 index 00000000..a9ee84dd --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml @@ -0,0 +1,82 @@ +{{- if or .Values.cleanupCrds }} + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: post-delete-service-account + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": hook-succeeded + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: post-delete-cluster-role + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-9" + "helm.sh/hook-delete-policy": hook-succeeded +rules: +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "delete", "patch"] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: post-delete-cluster-rolebinding + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-8" + "helm.sh/hook-delete-policy": hook-succeeded +subjects: +- kind: ServiceAccount + name: post-delete-service-account + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: post-delete-cluster-role + apiGroup: rbac.authorization.k8s.io + +--- + +apiVersion: batch/v1 +kind: Job +metadata: + name: post-delete-hook + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed +spec: + template: + spec: + serviceAccountName: post-delete-service-account + containers: + - name: post-delete-container + image: {{ .Values.helmHookImage }} + command: + - sh + - -c + - | + set -x + kubectl patch crd tridentorchestrators.trident.netapp.io -p '{"metadata":{"finalizers":[]}}' --type=merge + kubectl delete crd tridentorchestrators.trident.netapp.io + kubectl patch crd tridentconfigurators.trident.netapp.io -p '{"metadata":{"finalizers":[]}}' --type=merge + kubectl delete crd tridentconfigurators.trident.netapp.io + restartPolicy: Never + backoffLimit: 4 + +{{- end }} \ No newline at end of file diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml new file mode 100644 index 00000000..103b2b15 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml @@ -0,0 +1,70 @@ +{{- if or .Values.anfConfigurator.enabled .Values.ontapConfigurator.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: trident-operator + namespace: {{ .Release.Namespace }} +spec: + selector: + app: operator.trident.netapp.io + ports: + - name: http + protocol: TCP + port: 8000 + targetPort: 8002 +--- +apiVersion: v1 +kind: Pod +metadata: + name: trident-post-install-upgrade-hook + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, hook-failed +spec: + restartPolicy: Never + {{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | nindent 4 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | nindent 4 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | nindent 4 }} + {{- end }} + initContainers: + - name: init-container-1 + image: {{ include "trident.image" $ }} + command: + - tridentctl + - --debug + - -s + - 127.0.0.1:8000 + - check + - operator + - --timeout + - "7200" # Keeping it 12 mins as AKS extension script has an upper limit of 15 mins. + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + containers: + - name: trident-post-hook + image: {{ include "trident.image" $ }} + command: + - tridentctl + - --debug + - -s + - 127.0.0.1:8000 + - check + - operator + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml new file mode 100644 index 00000000..507b38df --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml @@ -0,0 +1,41 @@ +{{- if or .Values.cleanupCrds }} + +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-delete-hook + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed +spec: + template: + spec: + serviceAccountName: trident-operator + containers: + - name: pre-delete-container + image: {{ .Values.helmHookImage }} + command: + - sh + - -c + - | + set -x + if kubectl get torc trident -n trident; then + kubectl patch torc trident -n trident --type=merge -p '{"spec":{"wipeout":["crds"],"uninstall":true, "skipCRDsToObliviate":["tridentorchestrators.trident.netapp.io", "tridentconfigurators.trident.netapp.io"]}}' + while kubectl get crds | grep '.trident.netapp.io' | grep -v -e 'tridentorchestrators.trident.netapp.io' -e 'tridentconfigurators.trident.netapp.io'; do + echo 'Waiting for CRDs to be deleted...' + sleep 5 + done + else + echo 'Trident orchestrator does not exist.' + fi + restartPolicy: Never + backoffLimit: 4 + +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml new file mode 100644 index 00000000..7a73016d --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: trident-operator + namespace: {{ .Release.Namespace }} + {{- if and (ne .Values.cloudIdentity "") (ne .Values.cloudProvider "") }} + {{- $cloudIdentity := trimPrefix "'" .Values.cloudIdentity }} + {{- $cloudIdentity = trimSuffix "'" $cloudIdentity }} + {{- $cloudIdentityPair := regexSplit ": " $cloudIdentity 2 }} + annotations: + {{ first $cloudIdentityPair }}: {{ last $cloudIdentityPair }} + {{- end }} + labels: + app: operator.trident.netapp.io +{{- if .Values.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.imagePullSecrets }} +- name: {{ . }} +{{- end }} +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml new file mode 100644 index 00000000..8496eb5e --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml @@ -0,0 +1,111 @@ +{{- if .Values.anfConfigurator.enabled }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-anf-backend-configurator +spec: + storageDriverName: azure-netapp-files + {{- if eq .Values.cloudProvider "" }} + tenantID: {{ .Values.anfConfigurator.tenantID }} + clientCredentials: {{ .Values.anfConfigurator.clientCredentials }} + {{- end }} + {{- if or (eq .Values.cloudProvider "") (and (eq .Values.cloudProvider "Azure") (ne .Values.cloudIdentity "")) }} + subscriptionID: {{ .Values.anfConfigurator.subscriptionID }} + location: {{ .Values.anfConfigurator.location }} + {{- end }} + virtualNetwork: {{ .Values.anfConfigurator.virtualNetwork }} + subnet: {{ .Values.anfConfigurator.subnet }} + capacityPools: + {{- range .Values.anfConfigurator.capacityPools }} + - {{ . }} + {{- end }} + netappAccounts: + {{- range .Values.anfConfigurator.netappAccounts }} + - {{ . }} + {{- end }} + resourceGroups: + {{- range .Values.anfConfigurator.resourceGroups }} + - {{ . }} + {{- end }} + customerEncryptionKeys: + {{- range $key, $value := .Values.anfConfigurator.customerEncryptionKeys }} + {{ $key }}: {{ $value }} + {{- end }} +{{- end }} + +--- + +{{- if .Values.ontapConfigurator.enabled }} +{{- $includeCR := false }} +{{- range .Values.ontapConfigurator.svms }} + {{- if or (has "nfs" .protocols) (has "smb" .protocols) }} + {{- $includeCR = true }} + {{- end }} +{{- end }} + +{{- if $includeCR }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-nas-backend-configurator +spec: + storageDriverName: ontap-nas + svms: + {{- range .Values.ontapConfigurator.svms }} + {{- if or (has "nfs" .protocols) (has "smb" .protocols) }} + - fsxnID: {{ .fsxnID | quote }} + protocols: + {{- $filteredProtocols := list }} + {{- range .protocols }} + {{- if or (eq . "nfs") (eq . "smb") }} + {{- $filteredProtocols = append $filteredProtocols . }} + {{- end }} + {{- end }} + {{- range $filteredProtocols }} + - {{ . | quote }} + {{- end }} + svmName: {{ .svmName | quote }} + authType: {{ .authType | default "awsarn" | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} + + +--- + +{{- if .Values.ontapConfigurator.enabled }} +{{- $includeCR := false }} +{{- range .Values.ontapConfigurator.svms }} + {{- if or (has "iscsi" .protocols) (has "nvme" .protocols) }} + {{- $includeCR = true }} + {{- end }} +{{- end }} + +{{- if $includeCR }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-san-backend-configurator +spec: + storageDriverName: ontap-san + svms: + {{- range .Values.ontapConfigurator.svms }} + {{- if or (has "iscsi" .protocols) (has "nvme" .protocols) }} + - fsxnID: {{ .fsxnID | quote }} + protocols: + {{- $filteredProtocols := list }} + {{- range .protocols }} + {{- if or (eq . "iscsi") (eq . "nvme") }} + {{- $filteredProtocols = append $filteredProtocols . }} + {{- end }} + {{- end }} + {{- range $filteredProtocols }} + - {{ . | quote }} + {{- end }} + svmName: {{ .svmName | quote }} + authType: {{ .authType | default "awsarn" | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml new file mode 100644 index 00000000..5f5038df --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml @@ -0,0 +1,108 @@ +apiVersion: trident.netapp.io/v1 +kind: TridentOrchestrator +metadata: + name: trident +spec: + namespace: {{ .Release.Namespace }} + enableForceDetach: {{ include "trident.enableForceDetach" $ }} + IPv6: {{ include "trident.IPv6" $ }} + k8sTimeout: {{ .Values.tridentK8sTimeout }} + httpRequestTimeout: {{ .Values.tridentHttpRequestTimeout }} + silenceAutosupport: {{ include "trident.silenceAutosupport" $ }} + {{- if .Values.tridentExcludeAutosupport }} + excludeAutosupport: {{ .Values.tridentExcludeAutosupport }} + {{- end }} + autosupportImage: {{ include "trident.autosupportImage" $ }} + autosupportProxy: {{ .Values.tridentAutosupportProxy }} + autosupportInsecure: {{ .Values.tridentAutosupportInsecure }} + logFormat: {{ include "trident.logFormat" $ }} + disableAuditLog: {{ include "trident.disableAuditLog" $ }} + {{- if .Values.tridentDebug }} + debug: {{ .Values.tridentDebug }} + {{- end }} + {{- if .Values.tridentLogLevel }} + logLevel: {{ .Values.tridentLogLevel }} + {{- end }} + logWorkflows: {{ include "trident.logWorkflows" $ }} + logLayers: {{ include "trident.logLayers" $ }} + probePort: {{ include "trident.probePort" $ }} + tridentImage: {{ include "trident.image" $ }} + {{- if .Values.imageRegistry }} + imageRegistry: {{ .Values.imageRegistry }} + {{- end }} + kubeletDir: {{ .Values.kubeletDir }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 2 }} + {{- end }} + {{- if .Values.tridentControllerPluginNodeSelector }} + controllerPluginNodeSelector: + {{- range $key, $value := .Values.tridentControllerPluginNodeSelector }} + {{ $key }}: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.tridentControllerPluginTolerations }} + controllerPluginTolerations: + {{- range $value := .Values.tridentControllerPluginTolerations }} + - {{- range $k, $v := $value }} + {{ $k }}: "{{ $v }}" + {{- end}} + {{- end}} + {{- end }} + {{- if .Values.tridentNodePluginNodeSelector }} + nodePluginNodeSelector: + {{- range $key, $value := .Values.tridentNodePluginNodeSelector }} + {{ $key }}: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.tridentNodePluginTolerations }} + nodePluginTolerations: + {{- range $value := .Values.tridentNodePluginTolerations }} + - {{- range $k, $v := $value }} + {{ $k }}: "{{ $v }}" + {{- end}} + {{- end}} + {{- end }} + imagePullPolicy: {{ include "imagePullPolicy" $ }} + windows: {{ .Values.windows }} + cloudProvider: {{ .Values.cloudProvider }} + cloudIdentity: {{ .Values.cloudIdentity }} + enableACP: {{ .Values.enableACP }} + acpImage: {{ .Values.acpImage }} + httpsMetrics: {{ .Values.httpsMetrics }} + enableAutoBackendConfig: {{ or .Values.ontapConfigurator.enabled .Values.anfConfigurator.enabled }} + iscsiSelfHealingInterval: {{ .Values.iscsiSelfHealingInterval }} + iscsiSelfHealingWaitTime: {{ .Values.iscsiSelfHealingWaitTime }} + {{- if .Values.k8sAPIQPS }} + k8sAPIQPS: {{ .Values.k8sAPIQPS }} + {{- end }} + {{- if .Values.fsGroupPolicy }} + fsGroupPolicy: {{ .Values.fsGroupPolicy }} + {{- end }} + {{- if .Values.nodePrep }} + nodePrep: {{- range .Values.nodePrep }} + - {{.}} {{- end }} + {{- end }} + enableConcurrency: {{ .Values.enableConcurrency }} + {{- if .Values.skipCRDsToObliviate }} + skipCRDsToObliviate: {{- range .Values.skipCRDsToObliviate }} + - {{.}} {{- end }} + {{- end }} + {{ if or (include "trident.hasControllerResources" .) (include "trident.hasNodeLinuxResources" .) (include "trident.hasNodeWindowsResources" .) -}} + resources: + {{ if include "trident.hasControllerResources" . -}} + controller: {{ include "trident.resources.controller" .Values.resources.controller | indent 6 }} + {{- end }} + {{ if or (include "trident.hasNodeLinuxResources" .) (include "trident.hasNodeWindowsResources" .) -}} + node: + {{ if include "trident.hasNodeLinuxResources" . -}} + linux: {{ include "trident.resources.node.linux" .Values.resources.node.linux | indent 8 }} + {{- end }} + {{- if include "trident.hasNodeWindowsResources" . }} + windows: {{ include "trident.resources.node.windows" .Values.resources.node.windows | indent 8 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: {{ .Values.hostNetwork }} + {{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/values.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/values.yaml new file mode 100644 index 00000000..e30cee4b --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/values.yaml @@ -0,0 +1,327 @@ +# Default values for standalone. +# This is a YAML-formatted file. + +# helmHookImage specifies the image used for Helm hook jobs +helmHookImage: "alpine/k8s:1.33.0" + +## Node labels for pod assignment +## ref: https://kubernetes.io/docs/user-guide/node-selection/ +nodeSelector: {} + +## Pod Annotations +podAnnotations: {} + +## Deployment Annotations +deploymentAnnotations: {} + +## Tolerations for pod assignment +## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +tolerations: [] + +## Affinity for pod assignment +## The following affinity configuration ensures that the Trident operator will only be scheduled on nodes with the specified architecture and OS, Hence, do not modify this section. To add custom affinity rules, please append your content to this configuration as needed +## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - arm64 + - amd64 + - key: kubernetes.io/os + operator: In + values: + - linux + + +# tridentControllerPluginNodeSelector additional nodeSelectors for the Pod running the Trident Controller CSI Plugin. +# tridentControllerPluginNodeSelector : {} + +# tridentControllerPluginTolerations overrides tolerations for the Pod running the Trident Controler CSI Plugin. +# tridentControllerPluginTolerations: [] + +# tridentNodePluginNodeSelector additional nodeSelectors for Pods running the Trident Node CSI Plugin. +# tridentNodePluginNodeSelector : {} + +# tridentNodePluginTolerations overrides tolerations for Pods running the Trident Node CSI Plugin. +# tridentNodePluginTolerations: [] + + + +# imageRegistry identifies the registry for the trident-operator, trident, and other images. Leave empty to accept the default. +imageRegistry: "" + +# imagePullPolicy sets the image pull policy for the trident-operator. +imagePullPolicy: IfNotPresent + +# imagePullSecrets sets the image pull secrets for the trident-operator, trident, and other images. +imagePullSecrets: [] + +# kubeletDir allows overriding the host location of kubelet's internal state. (default "/var/lib/kubelet"). +kubeletDir: "" + + +# operatorLogLevel allows the log level of the Trident operator to be set to one of these: +# trace, debug, info, warn, error, fatal. +# operatorLogLevel: "info" + +# operatorDebug allows the log level of the Trident operator to be set to debug +operatorDebug: true + +# operatorImage allows the complete override of the image for trident-operator. +operatorImage: "" + +# operatorImageTag allows overriding the tag of the trident-operator image. +operatorImageTag: "" + + +# tridentIPv6 allows enabling Trident to work in IPv6 clusters. +tridentIPv6: false + +# tridentK8sTimeout overrides the default 30-second timeout for most Kubernetes API operations (if non-zero, in seconds). +tridentK8sTimeout: 0 + +# tridentHttpRequestTimeout (duration) overrides the default 90-second timeout for the HTTP requests, with 0s being an +# infinite duration for the timeout. Negative values are not allowed. +tridentHttpRequestTimeout: "90s" + +# tridentSilenceAutosupport allows disabling Trident's periodic Autosupport reporting. +tridentSilenceAutosupport: false + +# tridentExcludeAutosupport allows removal of the autosupport container when installing Trident. +tridentExcludeAutosupport: false + +# tridentAutosupportImage allows the complete override of the image for Trident's Autosupport container. +tridentAutosupportImage: "" + +# tridentAutosupportImageTag allows overriding the tag of the image for Trident's Autosupport container. +tridentAutosupportImageTag: "26.02" + +# tridentAutosupportProxy allows Trident's autosupport container to phone home via an HTTP proxy. +tridentAutosupportProxy: "" + +# tridentAutosupportInsecure allows Trident's autosupport container to skip TLS verification +tridentAutosupportInsecure: false + +# tridentLogFormat sets the Trident logging format (text or json). +tridentLogFormat: "text" + +# tridentDisableAuditLog disables Trident's audit logger. +tridentDisableAuditLog: true + +# tridentLogLevel allows the log level of Trident to be set to one of these: trace, debug, info, warn, error, fatal. +#tridentLogLevel: "info" + +# tridentDebug allows the log level of Trident to be set to debug +tridentDebug: false + +# tridentLogWorkflows allows specific Trident workflows to be enabled for trace logging or log suppression. +tridentLogWorkflows: "" + +# tridentLogLayers allows specific Trident layers to be enabled for trace logging or log suppression. +tridentLogLayers: "" + +# tridentImage allows the complete override of the image for Trident. +tridentImage: "" + +# tridentImageTag allows overriding the tag of the image for Trident. +tridentImageTag: "" + +# (Deprecated) tridentEnableNodePrep attempts to automatically install required packages on nodes. +tridentEnableNodePrep: false + +# (Deprecated) tridentSkipK8sVersionCheck allows overriding the k8s version limit for Trident. +tridentSkipK8sVersionCheck: false + +# tridentProbePort allows overriding the default port used for k8s liveness/readiness probes. +tridentProbePort: "" + +# windows allows Trident to be installed on Windows worker node. +windows: false + +# enableForceDetach allows enabling the force detach feature. +enableForceDetach: false + +# cloudProvider indicates which cloud platform Trident is running on. +cloudProvider: "" + +# cloudIdentity indicates the identity that needs to be set on service account. +cloudIdentity: "" + +# enableACP allows enabling the Trident-ACP container to run. +enableACP: false + +# acpImage indicates the image the Trident-ACP container should pull. +acpImage: "" + +# httpsMetrics allows enabling the HTTPS metrics. +httpsMetrics: false + +# iscsiSelfHealingInterval is the interval at which the iSCSI self-healing job is invoked +iscsiSelfHealingInterval: "5m0s" + +# iscsiSelfHealingWaitTime is the wait time after which iSCSI self-healing attempts to fix stale sessions +iscsiSelfHealingWaitTime: "7m0s" + +# configuratorReconcileInterval is the resource refresh rate for the auto generated backends. +configuratorReconcileInterval: 30m0s + +# forceInstallRancherClusterRoles will install a Rancher specific ClusterRole and ClusterRoleBinding when set to true. +# When set to false, the ClusterRole and ClusterRoleBinding will be installed only when a Rancher cluster is detected. +forceInstallRancherClusterRoles: false + +# Auto generated ANF backend related fields consumed by the configurator controller. +anfConfigurator: + enabled: false + virtualNetwork: "" + subnet: "" + subscriptionID: "" + tenantID: "" + location: "" + clientCredentials: "" + capacityPools: [] + netappAccounts: [] + resourceGroups: [] + customerEncryptionKeys: {} + +# Auto generated ONTAP backend related fields consumed by the configurator controller. +ontapConfigurator: + enabled: false + svms: + - fsxnID: '' + svmName: '' + protocols: [] + authType: '' + +# enableConcurrency enables the concurrent core feature in Trident **TECH PREVIEW** +enableConcurrency: false + +# Resource requests and limits for Trident components (controller, node, operator). +# Configure CPU and memory for each container and sidecar to manage resource allocation in Kubernetes. +# +# IMPORTANT NOTES: +# - DO NOT change the names of any containers or fields - or, they may not work +# - DO NOT change the indentation - YAML indentation is critical for proper parsing +# - Default values for controller/node are shown in comments (e.g., # 10m) and are applied automatically if not specified +# - Default values for operator are directly specified in the config (not in comments) and will be applied +# - By default, NO limits are applied - only requests have default values +# - Container names are listed as they appear in the pod specifications +# +# STRUCTURE EXPLANATION: +# +# 1. CONTROLLER POD: +# The controller pod runs on a single operating system (Linux), so there are no OS-specific +# sub-sections. All containers within the controller pod are listed directly under 'controller'. +# +# 2. NODE POD: +# The node pod runs on multiple operating systems (Linux and Windows), so it has OS-specific +# sub-sections: 'linux' and 'windows'. Each OS section lists its specific containers. +# +# 3. OPERATOR POD: +# Unlike controller and node pods, the operator has actual default values directly specified +# (not in comments). If removed, no values will be applied. +resources: + controller: + trident-main: + requests: + cpu: # 10m + memory: # 80Mi + limits: + cpu: + memory: + # sidecars + csi-provisioner: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-attacher: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-resizer: + requests: + cpu: # 3m + memory: # 20Mi + limits: + cpu: + memory: + csi-snapshotter: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + trident-autosupport: + requests: + cpu: # 1m + memory: # 30Mi + limits: + cpu: + memory: + node: + linux: + trident-main: + requests: + cpu: # 10m + memory: # 60Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 1m + memory: # 10Mi + limits: + cpu: + memory: + windows: + trident-main: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + liveness-probe: + requests: + cpu: # 2m + memory: # 40Mi + limits: + cpu: + memory: + operator: + requests: + cpu: 10m + memory: 40Mi + limits: + cpu: + memory: + +# k8sAPIQPS sets the maximum QPS to the Kubernetes API server from the Trident operator. (default 100) +k8sAPIQPS: 0 + +# hostNetwork sets the hostNetwork field in the Trident operator deployment spec. +hostNetwork: false + +# nodePrep enables Trident to prepare the nodes of the Kubernetes cluster to manage volumes using the +# specified data storage protocol. Currently, iSCSI is the only value supported. +nodePrep: [] diff --git a/packs/trident-operator-26.0.2/logo.png b/packs/trident-operator-26.0.2/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..6a7f76663a04adbeb8ac133449f97dc67ed0c215 GIT binary patch literal 4314 zcmd6r`8Qj8_s0`KRjZBp;-)3R3n#&i1C;IrWY zwquj;f&$VD0LO~E#)>aT0eA(cC<0CF=3QTVwY+6QMh+FOv{@8!GqN!$; zCy3JbGVY|+NA4|qu$@&W*M^z@Bzswv9)7F&&6!mB((g!o&LWn0vzq?MOc~-zd1B4dBW zk)u*v!MAEVz1n%?pyww&i{b~a9-n*9hf1qrF{Im8WGDI<)?4}bzMQq6K(UydhcTa| zT^%^6wqugjNvVE$&ZBdE)i#%Ba-!Wg+ziGlWm}L|)V0y~{I_!RgQTQfepX+wp3=YP zLEZ_TS0|wHley1`QuW#r&a*}_{S0y$AL`*6aHGO5H~99a(A=As;2Wr#0=49(umhFJ zJo4(kqt1vy&YXYI_(-^5#g`8PMF73+LT*1pXDeMM5XWyBA>a8eU!s}eh??4pXpM~ zNaH3=Qzs6(x-O9azP0Km{(B7(PDD~&na=|u&&}Tnx91%V?Z8zf-Q*g{1>@AA0<~Di zQ2vfSqeJQI6ZGTBAD_sJqvQzr2n#-o4Xt@h1;Sq}Mg*#ESKgHQ@wsfA+brspt&b_Z zveix^grXmKJnfO~`$>5ex-6XnPDxK|ZTjAcFMia&S zCMLuqudVZWds_*#0cMB@jlSfe%dRWHX{ALSBgMc{&Hi4`4$-a(Nsw?bMQF+~M?5Bz zi)lh4uoQd)Y^|O7b^EIT(pQaW0Lin}!^?IEwC#e$n229Uacy}d&OPT`7m|+7A*?6% z9dAZV2I4mK8mla-{QEpJ8l9AX{)4f?DnY^Bk~Y*OtbKa8vjjtu@6c_+xvb&%utl8) zySiEJfTyA(VcmKg$|jsOwK>HbgkP9a8~-#GZfK1X^GFjV8IBrBa<6?ZExVVo{dr`F z8GCv2d__Pk<@|NpJod{zFBjqXIkn47$Y>;Q?aaOw*>hz#{u2P|4h1q7io8={ zu(EZP&y3S*2&GE7O}TQ_^6mz(tMV&H$*KcB0MT&Imtt)R<%WBec8VpXmp0F4VX*$eS z^)uH0_*5Lmi+rO~v%Cf0ee=qj8@s~1FC3Hj&!u7fWi!HdwW#tzEJCTS;%X(IbTzyYnumGEp)(imq^y@YBbMG zSHPNs#}1-u2I&o}3d3&K8!+#kqOFQD<6GGutrWZ9p@Ytg+WB(gUiJx8-wS$lZ;9wP z44&hkRgx%Yl!I!DX`3_kcQ%LjgX^mnKVQXQ*V@CIqh>26-z}?3iGtaDx+%&omI=aVnqqD|%dm=d z-HKreT8Q(X|w!%GNsr*3zqBFV$KTh<*XAB zGE&m(fTwT9=;i4#$U=v$_Uy2`jrC=Orw-`m(XAa1bherD?F-yM=tkcQk{09#RueV! z6{US%!-7X7!f*S(lF<{q_B!y+5cj`kdYt7Lxa$=WVT3VzQO6+nBK=E&E@NhTy;Q@Z z%m>M*IVR4OsY3@%7q!LYEH;!Dblrj>yK0vhdi_sdWII&xy5S2d3R!Hr`I6Iz89Hiy z#yzH-)KI-|k;-)`)gd-T0x4JXAn6`v+5l(zNn~qy6;S30hF)BI$A~XO4d^yh|9JSz z5XpXE@ah&W?j^ly@-JB|&goCuvd>)YM@X)66Xo>OVs>Y_#+-}6JXTa1BU zM^^T~roEC@DxCW4Sz*%)xgY|qq54i;gL@8z84g07&8)p$Zo9oe(@onlRXQ(}6+!?9 zt&5P5!_n8IviLZ!GMVThr+9&?$!r@goK~619ZevW-#gO@= zMb|NGhtOp5*v5&P*!H9Oz9iHNbm&Pm=#n0x%;P?-t9lDn?2$F9!eR`%V%v_k%G1gD zh%(0M4eeoV#k&a|`nj>fDUvBAX38mH#s)rjBP;jzAANhy;jH$tK?RFLB~4SjI5h%(8dp!5xfd)0mRQlrIb**T= zI?I4tZFMRRZY8LbJWLBMtU6}-2rgUOM5IUeUR1~wbL*o)U*c#0q`Eye%hDcSPt!Bkn?{P1B2RaM;#WNRq(>?Sa$7}v&{*WS8PzZ2# z=HLVOw280KD#BYH1kOSLgpDyvMNSlz04Qo8_J}XAhw1Y}`A79l837PSm;8>$Dz|u) zX`w?;52iR{a4Di&2ofYJS_}B~SFNt&L38L#I>1&qBhsajE3oYCjC>&%{VK!tulSfR zfZXRf%aw#|WkjI05_q--hG+9O)P?sl8RPazY#c0C9?uN@z~dIMi`w@<^KtGECd+UqioDNGq ztq1}8UX!%lTLp$wd=u^Qtv#o`%to3CR8&+!SdlA0vH*hIZD%``<9S~IIQlASBe;Ye z6=|dqJvNlrt0SgT-WnKu|ED>0>P>n2K^p1MNt&hudq_Iu;9-4d*2ctX|;%oAIic zgR(Ta-HGK`R&JIW10eGV@$buF`Y!*F7UkqYz!4CReTG$)t<&`eO^z<{v-~KfyA|&O zkF_zBx)kKDL>DyG`1^;b3oQa#b7A`PL0=a|OV+vlM$ zu*OnKA{3gzmBAkPN5RjFFZF06?1EyVie+A$Yh2s(vZ~$r*RHo30*Z|cSb+rqcBufH zB)O}l)^>*j7Z1z>i@n1(GrjoNBc&uuC{zqkb<9c6uRlln;W89f&(9+6Q>PknhC7#E zK6tDIYzT#3Lpi3K^ei@x|51#YbTul)8W?;5ZodX}Vz$?@!@eS{Vxpgcz-L9dkM1;R z1ZR^!O|E|KfI``TZh8yog=-GcWC8r5L-b{RR(Mk7ko{3MupV zpY=MB({DOlY({gD(L7=&i$?xX#H1I_F&@16^Q0i^1WLSwBsxH1#3p#Y8Xm z09^~CFc9`?aGx>8=>`UG+z0GafslLd9|ILUFo^_o6c TM>kIXxd53OTfr+0|9tQtU!4)S literal 0 HcmV?d00001 diff --git a/packs/trident-operator-26.0.2/pack.json b/packs/trident-operator-26.0.2/pack.json new file mode 100644 index 00000000..556e0321 --- /dev/null +++ b/packs/trident-operator-26.0.2/pack.json @@ -0,0 +1,16 @@ +{ + "annotations": { + "source": "community", + "contributor": "netapp" + }, + "cloudTypes": [ + "all" + ], + "displayName": "Trident", + "charts": [ + "charts/trident-operator-100.2602.0.tgz" + ], + "layer": "csi", + "name": "csi-trident", + "version": "26.0.2" +} \ No newline at end of file diff --git a/packs/trident-operator-26.0.2/values.yaml b/packs/trident-operator-26.0.2/values.yaml new file mode 100644 index 00000000..be45f274 --- /dev/null +++ b/packs/trident-operator-26.0.2/values.yaml @@ -0,0 +1,346 @@ +pack: + namespace: trident + content: + images: + - image: docker.io/netapp/trident-operator:26.0.2 + - image: docker.io/netapp/trident-autosupport:26.0.2 + - image: docker.io/netapp/trident:26.0.2 + + charts: + - repo: https://github.com/NetApp/trident/releases/download/v26.0.2/trident-installer-26.0.2.tar.gz + name: trident-operator + version: 26.0.2 + + # Add Pod Security Standard label to trident namespace. + namespaceLabels: + "trident": "pod-security.kubernetes.io/enforce=privileged" + +charts: + trident-operator: + # Default values for standalone. + # This is a YAML-formatted file. + + # helmHookImage specifies the image used for Helm hook jobs + helmHookImage: "alpine/k8s:1.33.0" + + ## Node labels for pod assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + nodeSelector: {} + + ## Pod Annotations + podAnnotations: {} + + ## Deployment Annotations + deploymentAnnotations: {} + + ## Tolerations for pod assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + tolerations: [] + + ## Affinity for pod assignment + ## The following affinity configuration ensures that the Trident operator will only be scheduled on nodes with the specified architecture and OS, Hence, do not modify this section. To add custom affinity rules, please append your content to this configuration as needed + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - arm64 + - amd64 + - key: kubernetes.io/os + operator: In + values: + - linux + + + # tridentControllerPluginNodeSelector additional nodeSelectors for the Pod running the Trident Controller CSI Plugin. + # tridentControllerPluginNodeSelector : {} + + # tridentControllerPluginTolerations overrides tolerations for the Pod running the Trident Controler CSI Plugin. + # tridentControllerPluginTolerations: [] + + # tridentNodePluginNodeSelector additional nodeSelectors for Pods running the Trident Node CSI Plugin. + # tridentNodePluginNodeSelector : {} + + # tridentNodePluginTolerations overrides tolerations for Pods running the Trident Node CSI Plugin. + # tridentNodePluginTolerations: [] + + + + # imageRegistry identifies the registry for the trident-operator, trident, and other images. Leave empty to accept the default. + imageRegistry: "" + + # imagePullPolicy sets the image pull policy for the trident-operator. + imagePullPolicy: IfNotPresent + + # imagePullSecrets sets the image pull secrets for the trident-operator, trident, and other images. + imagePullSecrets: [] + + # kubeletDir allows overriding the host location of kubelet's internal state. (default "/var/lib/kubelet"). + kubeletDir: "" + + + # operatorLogLevel allows the log level of the Trident operator to be set to one of these: + # trace, debug, info, warn, error, fatal. + # operatorLogLevel: "info" + + # operatorDebug allows the log level of the Trident operator to be set to debug + operatorDebug: true + + # operatorImage allows the complete override of the image for trident-operator. + operatorImage: "" + + # operatorImageTag allows overriding the tag of the trident-operator image. + operatorImageTag: "" + + + # tridentIPv6 allows enabling Trident to work in IPv6 clusters. + tridentIPv6: false + + # tridentK8sTimeout overrides the default 30-second timeout for most Kubernetes API operations (if non-zero, in seconds). + tridentK8sTimeout: 0 + + # tridentHttpRequestTimeout (duration) overrides the default 90-second timeout for the HTTP requests, with 0s being an + # infinite duration for the timeout. Negative values are not allowed. + tridentHttpRequestTimeout: "90s" + + # tridentSilenceAutosupport allows disabling Trident's periodic Autosupport reporting. + tridentSilenceAutosupport: false + + # tridentExcludeAutosupport allows removal of the autosupport container when installing Trident. + tridentExcludeAutosupport: false + + # tridentAutosupportImage allows the complete override of the image for Trident's Autosupport container. + tridentAutosupportImage: "" + + # tridentAutosupportImageTag allows overriding the tag of the image for Trident's Autosupport container. + tridentAutosupportImageTag: "26.02" + + # tridentAutosupportProxy allows Trident's autosupport container to phone home via an HTTP proxy. + tridentAutosupportProxy: "" + + # tridentAutosupportInsecure allows Trident's autosupport container to skip TLS verification + tridentAutosupportInsecure: false + + # tridentLogFormat sets the Trident logging format (text or json). + tridentLogFormat: "text" + + # tridentDisableAuditLog disables Trident's audit logger. + tridentDisableAuditLog: true + + # tridentLogLevel allows the log level of Trident to be set to one of these: trace, debug, info, warn, error, fatal. + #tridentLogLevel: "info" + + # tridentDebug allows the log level of Trident to be set to debug + tridentDebug: false + + # tridentLogWorkflows allows specific Trident workflows to be enabled for trace logging or log suppression. + tridentLogWorkflows: "" + + # tridentLogLayers allows specific Trident layers to be enabled for trace logging or log suppression. + tridentLogLayers: "" + + # tridentImage allows the complete override of the image for Trident. + tridentImage: "" + + # tridentImageTag allows overriding the tag of the image for Trident. + tridentImageTag: "" + + # (Deprecated) tridentEnableNodePrep attempts to automatically install required packages on nodes. + tridentEnableNodePrep: false + + # (Deprecated) tridentSkipK8sVersionCheck allows overriding the k8s version limit for Trident. + tridentSkipK8sVersionCheck: false + + # tridentProbePort allows overriding the default port used for k8s liveness/readiness probes. + tridentProbePort: "" + + # windows allows Trident to be installed on Windows worker node. + windows: false + + # enableForceDetach allows enabling the force detach feature. + enableForceDetach: false + + # cloudProvider indicates which cloud platform Trident is running on. + cloudProvider: "" + + # cloudIdentity indicates the identity that needs to be set on service account. + cloudIdentity: "" + + # enableACP allows enabling the Trident-ACP container to run. + enableACP: false + + # acpImage indicates the image the Trident-ACP container should pull. + acpImage: "" + + # httpsMetrics allows enabling the HTTPS metrics. + httpsMetrics: false + + # iscsiSelfHealingInterval is the interval at which the iSCSI self-healing job is invoked + iscsiSelfHealingInterval: "5m0s" + + # iscsiSelfHealingWaitTime is the wait time after which iSCSI self-healing attempts to fix stale sessions + iscsiSelfHealingWaitTime: "7m0s" + + # configuratorReconcileInterval is the resource refresh rate for the auto generated backends. + configuratorReconcileInterval: 30m0s + + # forceInstallRancherClusterRoles will install a Rancher specific ClusterRole and ClusterRoleBinding when set to true. + # When set to false, the ClusterRole and ClusterRoleBinding will be installed only when a Rancher cluster is detected. + forceInstallRancherClusterRoles: false + + # Auto generated ANF backend related fields consumed by the configurator controller. + anfConfigurator: + enabled: false + virtualNetwork: "" + subnet: "" + subscriptionID: "" + tenantID: "" + location: "" + clientCredentials: "" + capacityPools: [] + netappAccounts: [] + resourceGroups: [] + customerEncryptionKeys: {} + + # Auto generated ONTAP backend related fields consumed by the configurator controller. + ontapConfigurator: + enabled: false + svms: + - fsxnID: '' + svmName: '' + protocols: [] + authType: '' + + # enableConcurrency enables the concurrent core feature in Trident **TECH PREVIEW** + enableConcurrency: false + + # Resource requests and limits for Trident components (controller, node, operator). + # Configure CPU and memory for each container and sidecar to manage resource allocation in Kubernetes. + # + # IMPORTANT NOTES: + # - DO NOT change the names of any containers or fields - or, they may not work + # - DO NOT change the indentation - YAML indentation is critical for proper parsing + # - Default values for controller/node are shown in comments (e.g., # 10m) and are applied automatically if not specified + # - Default values for operator are directly specified in the config (not in comments) and will be applied + # - By default, NO limits are applied - only requests have default values + # - Container names are listed as they appear in the pod specifications + # + # STRUCTURE EXPLANATION: + # + # 1. CONTROLLER POD: + # The controller pod runs on a single operating system (Linux), so there are no OS-specific + # sub-sections. All containers within the controller pod are listed directly under 'controller'. + # + # 2. NODE POD: + # The node pod runs on multiple operating systems (Linux and Windows), so it has OS-specific + # sub-sections: 'linux' and 'windows'. Each OS section lists its specific containers. + # + # 3. OPERATOR POD: + # Unlike controller and node pods, the operator has actual default values directly specified + # (not in comments). If removed, no values will be applied. + resources: + controller: + trident-main: + requests: + cpu: # 10m + memory: # 80Mi + limits: + cpu: + memory: + # sidecars + csi-provisioner: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-attacher: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-resizer: + requests: + cpu: # 3m + memory: # 20Mi + limits: + cpu: + memory: + csi-snapshotter: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + trident-autosupport: + requests: + cpu: # 1m + memory: # 30Mi + limits: + cpu: + memory: + node: + linux: + trident-main: + requests: + cpu: # 10m + memory: # 60Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 1m + memory: # 10Mi + limits: + cpu: + memory: + windows: + trident-main: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + liveness-probe: + requests: + cpu: # 2m + memory: # 40Mi + limits: + cpu: + memory: + operator: + requests: + cpu: 10m + memory: 40Mi + limits: + cpu: + memory: + + # k8sAPIQPS sets the maximum QPS to the Kubernetes API server from the Trident operator. (default 100) + k8sAPIQPS: 0 + + # hostNetwork sets the hostNetwork field in the Trident operator deployment spec. + hostNetwork: false + + # nodePrep enables Trident to prepare the nodes of the Kubernetes cluster to manage volumes using the + # specified data storage protocol. Currently, iSCSI is the only value supported. + nodePrep: [] diff --git a/packs/trident-operator-addon-26.0.2/README.md b/packs/trident-operator-addon-26.0.2/README.md new file mode 100644 index 00000000..0f246c1a --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/README.md @@ -0,0 +1,24 @@ +NetApp Trident + +[![Support](https://img.shields.io/badge/support-official-0067C5.svg)](http://mysupport.netapp.com/info/web/ECMLP2619434.html) +[![Chat](https://img.shields.io/badge/chat-slack-4C9689.svg)](http://netapp.io/slack/) +[![GitHub last commit](https://img.shields.io/github/last-commit/netapp/trident.svg)](https://github.com/NetApp/trident/commits) +[![license](https://img.shields.io/github/license/netapp/trident.svg)](LICENSE) +[![Docs](https://img.shields.io/badge/docs-official-0067C5.svg)](https://docs.netapp.com/us-en/trident/index.html) +[![Go Report Card](https://goreportcard.com/badge/github.com/netapp/trident)](https://goreportcard.com/report/github.com/netapp/trident) + +Trident is a fully supported open source project maintained by [NetApp](https://www.netapp.com). It has been designed +from the ground up to help you meet your containerized applications' persistence demands using industry-standard +interfaces, such as the [Container Storage Interface (CSI)](https://kubernetes-csi.github.io/docs/introduction.html). + +Trident deploys in Kubernetes clusters as pods and provides dynamic storage orchestration services for your Kubernetes workloads. It enables your containerized applications to quickly and easily consume persistent storage from NetApp’s broad portfolio that +includes [ONTAP](https://www.netapp.com/data-management/ontap-data-management-software) (AFF/FAS/Select/Cloud), [Element](https://www.netapp.com/data-management/element-software) (HCI/SolidFire), as well as the [Azure NetApp Files](https://www.netapp.com/azure/azure-netapp-files/) +service, [Google Cloud NetApp Volumes](https://www.netapp.com/google-cloud/netapp-volumes/), and [Amazon FSx for ONTAP](https://www.netapp.com/aws/fsx-ontap/). + +Trident features also address data protection, disaster recovery, portability, and migration use cases for +Kubernetes workloads leveraging NetApp's industry-leading data management technology for snapshots, backups, +replication, and cloning. + +Detailed documentation for Trident can be found [here](https://docs.netapp.com/us-en/trident/index.html). + +See [NetApp's Support site](https://mysupport.netapp.com/site/info/version-support) for details on Trident's support policy under the [Trident's Release and Support Lifecycle](https://mysupport.netapp.com/site/info/trident-support) tab. diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz b/packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5aad9ff63eff782cf97a889adbabff8435dbf2a6 GIT binary patch literal 11642 zcmV-=Errq_iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ%avZmkAbft;Q{=QfLD3(px_J?$)AM;EI3#t%wM_MpJocVd zI8LCe(A_Yr3S|J*WLwt8zQ(@ZKFJ1dRj6w>FQVmH)(?pdB#?TWyRSyOhr4^PMt>RY9vr;h z{|k&Bje?#p=K`_6j2?`u-nc)>hcfabW}MJ;49h(aWm)la?=Tqc1tTxQJY*yjD)9*3 z;W&X%N(sy;g9v9aU6FJS=U5zN*%pT@EmLrOc?MiihUOSDMwdj^iy7pcq;n5IEN}t) z!N_0WEog$run;2S@1N z8^&}_ZCa3}bMG3jZYYcR*z-+GJl|61`C!L~=gVe!*ZC9|jN1D5?_f9BI|xSpXv<5H zq`y9{Jh95~7*LkQBt(*z-qM!e9gTv$L&fVS@Bha5U!pk2{81G^|M=fKc(uP~kFBP!7YPCx2h6pOlT^(`SWoLL)dzQ!3P0Ti$!&$M zXeZirZ@l2&9Q zKrCDkfkTlq3@DA@!{rXV!)b_jAfk{`0SS%BYz0D!CD)x8z!e1)MG)p((4?f8^oC}spV7#d%^kk5RH+_9sUW^h@$4UC z4-{{XoZkQp|C$qqqm!JGbbhHBNz(b*Jf%hQ=`9X(HA$;7x*jXnSC}Q-W&rq*AQ3K3 zZ!?BDSCUcW>HKTF8bh_MvTG_(Q1tW|&eB?zRwv_Hst<@IhX>8nB&wyhl0f;x35ZFW z-+EGQnYr(nrh?Hp#%vPjbCRAre3L>&BvVmb;in$BQgo%FV0oI#f#ME=vQ}jW>8gVb zu^Ls;1?wshy2MOEaS%1NvH^9Q5_i>5Ar?}SeOIekneP1#YpkBS9mx=J1ZyvJyX0VkPQNwtMS zsdZF6k)Fc?uY!IIgF!*lB#+|>jY+ryj)glnXL%e$rn9;TGc}i$jNxo{PQ`>_F6Rsv z%Owt(#L$L@o4orlz^h}hq9}DljKv9IfaIK2bh+);1?2)_s_kx|Gh1Sd14#vDQcSr( z0tfKYuo4EtC1S&vOos+|upM|MCe2&#MWKP-)A@V6#IYqo;*IGXVwFf|?K7mHYHGx4 z9-=8WfE4%{G??f_;?GHZqeih~v^#xRiJ1DC=RSJ;ijoJOQ+f3SI%(`CDZ#J{$ZC?VcmT}_mkg1O*3+OQjOm||r=rcynm%A&zwk(4?> z*A>7yo+Ck)*e*p7!^+@OJ%OX5NlntnF!<|;51i&*l2{szN4cOp&oat{?a+wuYL9Ml z$S@-`A|bf&49ovWIxi46D{c1k>1`P2Q5#~06S_pjU_%asG)56gF@u{0PJyIcpxC9c zAfZ`(lLRO8KEttO%TXJN1u1njcAR!(Z!}^bPK6%M%6HX4&4kh0l_jM_)7~F~Lbi~K zc|j8lOM(EUTG}&NO&b}i{vKwe9EWOkvoQtynq+YG{t}j$k(u=$bywXKiT8B=R;}C1 zS=s8dn9k?2C-k}=UJ86GfHL@n)3j70MFnFRNC>xaCu&6DqdX!K&WtczZCXS$DyQpe z<;uyV#MwWkIx4wq7TtIXt>JVhP)ly_{Mky2o-*C?tzGjIW!E!Rt*PCthr^=Qn*u`D zuVy9VQc+DTx{)$Pmy`&zwsZTiz*Lh@*=)4Jteb*ZXFm+R#!mhCPK4ch0ME)gp>C|a`QMYCL4M`(scvQ!lVXJm5{bV5JfWb_0HSkPv zrx99!-%=Lh6D&};XqbCKxxiQ`TcQAF7>S(Wz-yFs>J4L>M-xVuB$5l4G?L01bGTWM zaG`S{i;vRO+xCP>E-1IVo07#Y%i_vhu{G7)RVuLsS}tY)L{aSBx~5 z9bKu-qR{O+I-a!h!Vv4r{L19S^3?L==y>Ar0)?3#+BIrbT6dLvLGw6L%f-O6byyme z7w!iv7zueRnR05rghWFGo(u1gMtI1{C5~tBFj9^*xeAoF88I~4-$m9~M+?U@ zf1%64FLWx)kaS6}apZN?JBGol#2Bb`n4b_)W~{}1gNRTzF`$`H7NNx7g4Q+IxH!>kd}Q&Vq9ki!<^=FATT^*m@j}KfeY(hsyLYAR4z$y z1XC1V<22%d*IV}(_D9KxOB&Q5JJVzM0;S;svtzxax}dRg6320&IuRIUwKu+lgv<~AK=C?sMvp)}Us z9Do!Hlx0U+Q`tl-f`4N)&upUh^<#FLhHRzC`5v$AE=!$%AI`6iCJ*MIR8rYm9`dF2 zwfivRw~9+!TgDO1m&v)>AudufMg;mV{~gUO`J zbpyk8ssfT0bIiBjUY#DlgUQ9|k7uVpefzD~sL_$Vi*m&46}=h?%3$EG#h@%Tn&MP& zcvyd8*8K1hPM4Y@KxJ9QcY0oWRTXB+YNPcYsq# z4#UR31s^VbOO~#l=TqNoZ1Mn(;@FkX8zL4Z^IZ}g1{58Zr_v7HDj~P@AlVDx{KLs< ztxZbC+}0#{EJ)VU8g81S`q|jrx@knf0`dMvjbTge!fmPITgE)!3gA@gfe)8$$#=aY--=<-AuDv^L4t2pSR} zz}ZZ@_;4f@psk@c2m;TlF*QY$1nLRHdaM&fihW!=63VU2Fw4h!xED!Unab2RqaTP# z)}yOhu3p0Yeqj}^-eC&NG<9b6>u?V~uaQ%iKP0s#va#=d{6Ld?GJOP=gBAal1^N?e<#0+MPCartE&KCIYXteDW zNX+)(f^uP2hb3A!QCZK{=4$LHmyvO5N)0@xsIvk|tvA&!a~zjn#&9NW9bqgMZr!*} zOYQ2rTsjBml{_nMg|4TgXqTTxk%^5JPV>Ag@ z>$wQFBmoyX)smnW49ekZeQzW+daeP_GZgAVsr?mr6OARM0vCa+3`3H0A+2;ZuxVt-Y5Ld40faOI3$jbWh-USF~^?VON70j#=guD}o)>4~oAjy-}Wg30~HL1W5XY zBGDH2tXE5|{G$kvj_y>eH4SqdBhCW=&pW+ENfv9J>6UW=*HBK&bf<;2RZ~t|Gf~4lUwT!pyPS$7%)oqlf4h z{d)BOKNmR8e{r`G&`1)D@KgIXy)9_nZl4Pv*LS`h!VwK_V zq&}2u@G*Ql{QTLIP~PcnrWBxYo?5F*9R&+K1Lteyfni_|S4r3b_+_rLE#0Xl_)(uZ zl8_(lmjCY{Se}M(xUc>s$z?v9ky{w}12A<--Szpir>Q$;7zqrhz%a|>cm==aC^jbx zvP{t(ct2rXw}KZEgKPtbDGpK2F>tAB9EGl0Yn;N`$(9hIRkJ!e@X~A>oSa`uSfzI} z9Bv1matWCkM^<8-SKOSRQ)xsLJ|eYEjyNDiyrH&}u@a`rTrw+oX)_Cc8j#NXP52%2 zqMmOQ?c?t@@6eLQf(yEmhQd{JRub<>T*gQ$W-$0y?*A(v)auemHy5w=KPy7#^rjpk zHo^jN-J^C_NkOSoOg+7-pvo?-H^t?${@a9U!0*6t7E6<7@c#{9@Xx{BhY(E?nwoP~ z-4yD4O`@DU1HKq4s>gErB&iBeY&0m)D4Y4*1oOW))dr5Fm?j<-r&47e%Cew(ETlL| zS(*z@k>BChT$+1p`m#7wu&(`eg8f#S^fA!32J0~!v^T}to#R$hq(O9JeXZirI%zLM ztYZ`BR!W*3w2grFjqvJ7xAk}xTsKl3W494T6-TlGMg`ZZBdam%9TZhEm6CC4sGjzy z)lknI)=3-7E^b42h34>kU9(mPL0#nypD{(is;3qk401l zDE_qtqd9*u_=VGS&@o0!ur|S0=Pou?pT&ub9!aR4zv$C3^&=inHw~!$JLp&cnT;1; z(+g$HdT%e3U@heDzJ7IZxGC{#w0yT|S~(igPUYh(@fL;oMa9o;f5$jC~V-R&0WJlmRNQB`I&=$QV}c0bNe^+raMQ7KPzP?U$7P3}R1t7F#lb zSNMG7Z0zgsXXOw{BeO)X@!ZO9ubMbj=h9V(nRQXE2@Dq$wxpKXYVoFMhE)rzQe{_v zL%5CA9)G8Ip36KFPJ7N}Udygh6Y#_I7YQ3vdYxx5SndvBP{0r5fN(0c#fRU5KCVM% zu(hVWTcGYc5%BG>)#0~>TWYrhpw{y5R6Kl9pCg+tX)4aYkeF6E!M7?@kJiPdN^F%~ ziX@rCR21zu*Lbx9-{@`i@po0=Ai)AfNT9$KU8hlG1`EU|Eu_hMEo2`9Y_4HKRyZyHM#E@n>XDE^rLIAhbGC|tw2iva0rK0l&O5co1G7BUp_%GL4^~m5Y+V$1 zEoxh89qR{RGy&%(vF<6b*!v91P{^|3b-_@hv1nR>`rP=UZBHAXQKkw7mi{2j@>+_C zL05^oWhIdLZ9ug5vWD~X=keWv-h&l3AAv40wgHL;}6 zGW#sEUyICk7$Tvyu?h*+;YjMJM!YhD9_hmvzvNt)%dxm%xw=8H#|^eXyu9Vi9(Xf@ z!q`^}#EXpT8lf;bt@T|J=vQsh27qJd6tL}9uo{M&6)(^|>R@#1Z(~W#c6ROOYRlY| z>hI<+DS{O&{^!pUjSK1i-PO70G{WkL(o^=WI$%_7dncT>92(r)ObR+GcnUe#P!if? z;cJr*b8zjel@NRF#RFudt%_$UX_J!X98{TtinxR7Tx6!84dM`7aw>vWSX>qIzewMx z3zn+<+K3CAdIa24l^d{xmHe>Qre(%`?90!ey-f|iM>F@H%-Gw+)O!>|?}28X|6e^~ z`oGrK6aQ__F)$iq-)u+R?^%F#?|&TZ*W$nTb`N%UpX0xu;xo#i2vY3XI0@?eyzbi} zY>L7FgPXRKcD}5n(vXuu-cX;G`%7T<^m{GVtggF+)-!b9$s6UgeN z31dW(O{vg7ZjdM*WbjR3K=CueF?N1x^;TjxMIYE4P4rM7uUo1rx)5RJ%nkzk<0 z7;(OFul-T{!b_aCPdE1?@^Pp#ckqAZyt7Ha=2W1so!E>p8a-%i z7A<~&qR<*jUnP`0a2R&bPd~`dr zg+~1l)mPEwmX@zVm(A7h`!uIgvb8aN=G-IU?UB9Bb?jr&^6-9rimtlLP-vwiuc9T*b!kU444^rd z%TWsG(ZVqj52jUvqZfh*(M+zm1+7lyzb~tKsqY3tuFOLS7t{AEwfT*Zf}Du6vI+t zy4qBS>ZnroKEnx)NW1jZ^Ea!e@FH#s*HNu=Zxn|YaA9B0P?u24%)SDqPPd$(X2k2# zTio6bWNw_TS4Ua6z+5Q5RD%GS+gqTQ013Jlzk3sT6Ti&uEzwVa1YJu3$_1S>dZUig zkQQO9<#$Q00W`Zd$mEED>nyr$>$rg&n#yh}MNeW{P_JFRhhjfG&8d<&NHzQ|HkB7_r~a_l6j z*BfVf%pb|I^(b_%BWg1dTqhz;k>R9YjPBmJD#QQ4W^m$&^?irKeLQFQ7MHr-yr;wK z3FdvByGdZb%-x%;FVabEopK)s^jdB`7P*h1J@3td>Q)-furyX@!Y&*nNavPY7w^K6{#A{0aZr;p< zgW5!SHx1G=b~l-zd4|KWx;-F^Nr?Cuc0B;Kse|YC4K?*R>jf^>UiMaKovj|=c<+$B z3DLb;&5lb`zoT>;r${pzHM&Dl(BCDsVntuPfws$$OxM>r6Rkza|lt%EJ89}NI8jZ zNZm3U;pCNh{=834%7;LmMKVnilt!gQ`p~!oyDnywm7P<4AlqC)9hFyR*PnkbARICC z!FTsyeP-W2_wB3l-#Pam_P@a1awfWY=R@Zm>JCNvdiI{WaJqE4rbp=H!^uC-kA65U zGC*JI^_J0O>?DGI9mCjCjr0i;i*cc{)cyAjRQ3(mR(y}AE9xL!y26rm^gsT7ar)2W zi_??S^Q*I?_y2r*_P&L@Ar|4VyvTp3Rn0HF*iHu%?)HOz)!eDUVp2u?km0Dp!bBF( z46GsP>rHhzW$Wt$jeGIGX_PB3wbXND_l1|X*k=0tWj8I=v+>QV49ds09IOo|S%Iq) z58DJusi}5Hy(938$es!Fs_wJ5ipPR-Eg4SpvtCKDX3L3s)tIu?2X^f4(|=W-iRbSr zzMl18M!C?w_K-z7xgh4*HYRakAkBK6b2J~t$VaZo|h%=d3FnJ>g(3qWN80^3xCS3im36g)Q9lOEL59W8bL$ZtQ#;yIR+<$Wq?w20VPJicP zjjD}&o_%7vf$y`~kyF{lWvBf&I$hICl0h5miJEJu_M(=)AtLgpt7;{N#qRT9?G^Mq z$+fm@|I1{iSnUzDLF46Jzf38M4jxr(U)^17cht`rBC!-<;~}ZKsa(HF+tR*Yo}puv z-y)BJexBV;d`zD z*4Y31dx!P=pZ50lpWpv|lJAk7pnZ#l&320KvO!bbb6LOpkWprxZ*~@02$2~Lk})c1 zNaHbF9Zzf;l{502(P(5H-iXbynAqe!W$U!IdP1X~7OUCIj4s~{ue(`2o6Y?O#g6`E z5Z!&Mhqk%CL*@2vkhq&88|;l7K>a0-4Yot>xD|2-T#Y@DJMDk;A(9P0uGu-Nb1;G28U*w(N}9=~cw;PC;#}zz3f@KX&(C2cuvV?2er=p>|#tIJ|a#H=Mw- zYC#fAbK#^7Uhj=Y19$=7W1Oj1gaqvFK|)dvh{MtMmr$%gfrpG_0v3n^N+HiO%=G1> zKxeS~N|g#s<-PkEmy@I8FR-bhUsr0{tbW_rH)H+J){%c4U!R@RU*hYt{}_H0_wPFU zZ}0GR-`Gssh8!4JlQ z<#-1M{F-FP7bpCRewfB&Nsz#@z-Eq~!A@aYtZ}Ohe*XMWrsNn13R7%6Oi>U7_4Wbq z7~>3H)zTxHR-IKi=GbdPY2P4qTL=-w98xOu%YZekGjeYS)??T~J@bF{nC=5&fY;3b zySt6^Kcj<#!{_<`DZcyd?%vaHQw^EvjoWPGmH{<3T1LN4Rw+6DPLh_`S3tK09T>XG z>*AOB%ohJu}tB`UEq=xM-{O^Jm4+7mKG)rkLjwfC(5 zpX94MYdf6(HP?Pam6U5jV*$Cfv`iqnppVj-Z?1)_1WlJ7etjk0iMrtM+=+xV70igf z2I5oW$^ZJKVf?i?MX5MDsjM&RjkZAMQJt8`_AspUE{b_?*#>mCQ<<{9uu(Y&KE??M zGgbM$1QX@f9jy3`jLmey+~!J8ISt$MfrqZ z<<;Bnn)ou|jq$ob90uu(4iIS1K@$F{{ao&z-1=rlVu2Z!YEM(>b)-Oo*f_`f?-zcv-1TTmzgMfbB7cvLO$M=zEBOMdIu|E??hORWEQNBg6_#`=H% z`TfTy`R+EWd~jr;+bvwo9-H}u^{oAtvJjtOfx<<5C`<#a2#YzJEDzhu$eaS~`VGI* z0Z5gFq=Egu$kosbA+ig733X4YcMT}BU?nk5LwuAA%JWP|5w;Q7ge%Ccho0#Yr?;vG zr+{H%BfX8>uF@4njLO`z?#QG%R6)0sF=6y})keor4W@}WRX6eBHH9shbyCdVQkI|& zUKiN~sS)8)rjGK6i1&2fUaSVRrhlBn_bUFXtpN^9Z?K_;eoyD`@e;>H8`ZD2daIDt zT>(1(iL&ciOmBE6cM6E2jS?GLVb)znXBP!BMyGhvDegsfQNZN%2wF7+u5HWW0?!E- z_WkNgQu73R6}ZBr>wJo1EKUfk6f2Xn`ZM}I{ZUAnrb(^-Ufka!#C6^?R zWIa_sm1(@w^rG2CTdRidrd*JW?qYe`ns>*Z?L+YBeOe-GFgk6^+PEKkDt@{iY`Zd} z&|$UALW`N(ZYyfWq}fde$J1W{tL_1mz}DyA1g`F0YcuNTcv1l@Qq4>pW@n8sESp%` zNBjpY7zwNGa5E|>b3y+@`x>-gK$UU=54-(28|+R2s1^7nj%V*Mib*=Rm*`ZdfDWMc zDtZiX7T|RUDJBeO z&d_8y8@D)js*rlD1)o3nXa?O=$21Ld#&B9Aw2|9NUrXSdF}9l-ZB%!b-=qO@RBL}v z!$4UeUd|})H8$Jrz*23!Cux4WA?#0DF;t=b%H~iRNaEh*yOuyxi#w}U^jBF$c}q?S z+IELdnOokXbJ*(cS;x{x;*#-K9yPM5IVq19zs zca~X8u>tO+*-lRzP`$B%u%KL2_IaIz>YP#se0B>y(%10+sc365PbtHXg=0y?_Z40<%;_N9%rvn*~l`nv*yp=^Qc?UZXkYf%gKg7KDRwzHs0R z9LF$^=~Q2MO49ib=!Y4XSlvbDq@y(QUO!JLSp`d5?h1=HWyQ2lEY7W1L}$NuEY zbXZn2Md5Xxfet15HsCjz_iZpm*WR~*NaWv?k-7Kn|MXtKkBAYPb2vLW9BCrrSk!xSbR4)$Koi<>;}L9Zb&2+-wk$0qX8_`$s_&a-#zc+zkIyZ zs^RCCY85yh4oNZ(_=4a#QU|G~D4OG;Q6N5@%}7X4?2kr=ua92^d^z9NMaRQovNB+H zKO&^bkfbv@yus7q>G2QmCwqsxe?8bg2o@rVwNRxzgBbgJi$frXI>T6I_Wx?7Koh+{5RogVDE!HsjBaUhI|d5A{z3Z4wB_0h}$_i_i;WCZ0l_SfP{+YxVgD;Sg;+ynLeOC#W;lsb23kH&8Jb$1zY)Cpfo}(^3+ws zGZbRJ13V8GfVjf{vAAOZE_G-JoLNwKd3<^1u(vz{>4%&IhO30CejgIK(2H{QW~}bz zpyaN;-JJtT;rpT%`%0TS*`Lvft79OUc4cvhRw+tIXhTk%BUI|_zj@nG9p+N3aw@iW zdUM5o?M>k87%F?<*PMjc@k$Yb5hw9V7T|e;OKyvTBGrpp0RGSa`rjO;jG{!?#D5L+z~{ z9>+9~ws+v;X{t+$lM5U&M}0D8wvK>q!(hm#0<^lkk(w;;^o+mF;eEZqND6j5I9_F zs=0VVe8(8Jd84mOFM9sB-396UqhC7ueb_!o}I0 zF`nv4<3)VATsN&SV>RA0msXp)0!IZM=~`_}(msA8DsvAVZOs${jW z(i(`+^d8j73O?BKHKHu7+S;%?r}v;)RwF4^CWy6L**&POY~i->R9l-m=K3CVT5~m0 z6{upZMDBJFnc*;K#C+;|9j{E>OCD_YX0Bd-Q8`@|IhyaC;7hQ{J-wf;s3|ye@8cU2U&yKcjn^zE{ON` zCGeVlt1!P^ztK9Px(4&rB}UGlE_hAX{?UT`{5^lq-}CqU-Rb+k0RRC1|EwNJ2LKEK E0Py(_#Q*>R literal 0 HcmV?d00001 diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore b/packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml new file mode 100644 index 00000000..82160961 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +appVersion: 26.02.0 +description: A Helm chart for deploying NetApp's Trident CSI storage provisioner using + the Trident Operator. +home: https://github.com/NetApp/trident +icon: https://raw.githubusercontent.com/NetApp/trident/master/logo/trident.png +keywords: +- NetApp +- Trident +- operator +- CSI +kubeVersion: '>= 1.24.0-0' +name: trident-operator +type: application +version: 100.2602.0 diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md b/packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md new file mode 100644 index 00000000..0f246c1a --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md @@ -0,0 +1,24 @@ +NetApp Trident + +[![Support](https://img.shields.io/badge/support-official-0067C5.svg)](http://mysupport.netapp.com/info/web/ECMLP2619434.html) +[![Chat](https://img.shields.io/badge/chat-slack-4C9689.svg)](http://netapp.io/slack/) +[![GitHub last commit](https://img.shields.io/github/last-commit/netapp/trident.svg)](https://github.com/NetApp/trident/commits) +[![license](https://img.shields.io/github/license/netapp/trident.svg)](LICENSE) +[![Docs](https://img.shields.io/badge/docs-official-0067C5.svg)](https://docs.netapp.com/us-en/trident/index.html) +[![Go Report Card](https://goreportcard.com/badge/github.com/netapp/trident)](https://goreportcard.com/report/github.com/netapp/trident) + +Trident is a fully supported open source project maintained by [NetApp](https://www.netapp.com). It has been designed +from the ground up to help you meet your containerized applications' persistence demands using industry-standard +interfaces, such as the [Container Storage Interface (CSI)](https://kubernetes-csi.github.io/docs/introduction.html). + +Trident deploys in Kubernetes clusters as pods and provides dynamic storage orchestration services for your Kubernetes workloads. It enables your containerized applications to quickly and easily consume persistent storage from NetApp’s broad portfolio that +includes [ONTAP](https://www.netapp.com/data-management/ontap-data-management-software) (AFF/FAS/Select/Cloud), [Element](https://www.netapp.com/data-management/element-software) (HCI/SolidFire), as well as the [Azure NetApp Files](https://www.netapp.com/azure/azure-netapp-files/) +service, [Google Cloud NetApp Volumes](https://www.netapp.com/google-cloud/netapp-volumes/), and [Amazon FSx for ONTAP](https://www.netapp.com/aws/fsx-ontap/). + +Trident features also address data protection, disaster recovery, portability, and migration use cases for +Kubernetes workloads leveraging NetApp's industry-leading data management technology for snapshots, backups, +replication, and cloning. + +Detailed documentation for Trident can be found [here](https://docs.netapp.com/us-en/trident/index.html). + +See [NetApp's Support site](https://mysupport.netapp.com/site/info/version-support) for details on Trident's support policy under the [Trident's Release and Support Lifecycle](https://mysupport.netapp.com/site/info/trident-support) tab. diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml new file mode 100644 index 00000000..f3aa8971 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tridentconfigurators.trident.netapp.io +spec: + group: trident.netapp.io + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + x-kubernetes-preserve-unknown-fields: true + subresources: + status: {} + additionalPrinterColumns: + - name: Phase + type: string + description: The backend config phase + priority: 0 + jsonPath: .status.phase + - name: Status + type: string + description: The result of the last operation + priority: 0 + jsonPath: .status.lastOperationStatus + - name: Cloud Provider + type: string + description: The name of cloud provider + priority: 0 + jsonPath: .status.cloudProvider + - name: Storage Driver + type: string + description: The storage driver type + priority: 1 + jsonPath: .spec.storageDriverName + - name: Deletion Policy + type: string + description: The deletion policy + priority: 1 + jsonPath: .status.deletionPolicy + scope: Cluster + names: + plural: tridentconfigurators + singular: tridentconfigurator + kind: TridentConfigurator + shortNames: + - tconf + - tconfigurator + categories: + - trident + - trident-internal + - trident-external \ No newline at end of file diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml new file mode 100644 index 00000000..f16b855c --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml @@ -0,0 +1,25 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tridentorchestrators.trident.netapp.io +spec: + group: trident.netapp.io + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + x-kubernetes-preserve-unknown-fields: true + subresources: + status: {} + names: + kind: TridentOrchestrator + listKind: TridentOrchestratorList + plural: tridentorchestrators + singular: tridentorchestrator + shortNames: + - torc + - torchestrator + scope: Cluster diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt new file mode 100644 index 00000000..acb0dd88 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt @@ -0,0 +1,18 @@ + +Thank you for installing {{ .Chart.Name }}, which will deploy and manage NetApp's Trident CSI +storage provisioner for Kubernetes. + +Your release is named '{{ .Release.Name }}' and is installed into the '{{ .Release.Namespace }}' namespace. +Please note that there must be only one instance of Trident (and trident-operator) in a Kubernetes cluster. + +To configure Trident to manage storage resources, you will now need to configure at least one storage +backend and add a matching storageClass. + +Examples of backend and storageClass definitions are available at official NetApp Trident documentation. + +Further, You may find all Trident releases and source code online at {{ .Chart.Home }}. + +To learn more about the release, try: + + $ helm status {{ .Release.Name }} + $ helm get all {{ .Release.Name }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl new file mode 100644 index 00000000..bbf3dc01 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl @@ -0,0 +1,416 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "trident.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "trident.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "trident.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "trident.labels" -}} +helm.sh/chart: {{ include "trident.chart" . }} +{{ include "trident.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "trident.selectorLabels" -}} +app.kubernetes.io/name: {{ include "trident.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Trident operator level +*/}} +{{- define "trident-operator.logLevel" -}} +{{- .Values.operatorLogLevel }} +{{- end }} + +{{/* +Trident operator debug +*/}} +{{- define "trident-operator.debug" -}} +{{- .Values.operatorDebug }} +{{- end }} + +{{/* +Trident operator image +*/}} +{{- define "trident-operator.image" -}} +{{- if .Values.operatorImage }} +{{- .Values.operatorImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident-operator:{{ .Values.operatorImageTag | default .Chart.AppVersion }} +{{- else }} +{{- "" }}docker.io/netapp/trident-operator:{{ .Values.operatorImageTag | default .Chart.AppVersion }} +{{- end }} +{{- end }} + +{{/* +Trident force detach +*/}} +{{- define "trident.enableForceDetach" -}} +{{- if .Values.enableForceDetach | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident IPv6 +*/}} +{{- define "trident.IPv6" -}} +{{- if .Values.tridentIPv6 | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident SilenceAutosupport +*/}} +{{- define "trident.silenceAutosupport" -}} +{{- if .Values.tridentSilenceAutosupport | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident ExcludeAutosupport +*/}} +{{- define "trident.excludeAutosupport" -}} +{{- if .Values.tridentExcludeAutosupport | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +Trident AutoSupport image +*/}} +{{- define "trident.autosupportImage" -}} +{{- if .Values.tridentAutosupportImage }} +{{- .Values.tridentAutosupportImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident-autosupport:{{ .Values.tridentAutosupportImageTag | default .Chart.AppVersion | trunc 5}} +{{- else }} +{{- "" }}docker.io/netapp/trident-autosupport:{{ .Values.tridentAutosupportImageTag | default .Chart.AppVersion | trunc 5}} +{{- end }} +{{- end }} + +{{/* +Trident log level +*/}} +{{- define "trident.logLevel" -}} +{{- .Values.tridentLogLevel }} +{{- end }} + +{{/* +Trident debug (equivalent to debug level) +*/}} +{{- define "trident.debug" -}} +{{- .Values.tridentDebug }} +{{- end }} + +{{/* +Trident logging workflows +*/}} +{{- define "trident.logWorkflows" -}} +{{- .Values.tridentLogWorkflows }} +{{- end }} + +{{/* +Trident logging layers +*/}} +{{- define "trident.logLayers" -}} +{{- .Values.tridentLogLayers }} +{{- end }} + +{{/* +Trident log format +*/}} +{{- define "trident.logFormat" -}} +{{- if eq .Values.tridentLogFormat "json" }} +{{- .Values.tridentLogFormat }} +{{- else }} +{{- "text" }} +{{- end }} +{{- end }} + +{{/* +Trident audit log +*/}} +{{- define "trident.disableAuditLog" -}} +{{- if .Values.tridentDisableAuditLog | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident probe port +*/}} +{{- define "trident.probePort" -}} +{{- if eq .Values.tridentProbePort "json" }} +{{- .Values.tridentProbePort }} +{{- else }} +{{- 17546 }} +{{- end }} +{{- end }} + +{{/* +Trident image +*/}} +{{- define "trident.image" -}} +{{- if .Values.tridentImage }} +{{- .Values.tridentImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident:{{ .Values.tridentImageTag | default .Chart.AppVersion }} +{{- else }} +{{- "" }}docker.io/netapp/trident:{{ .Values.tridentImageTag | default .Chart.AppVersion }} +{{- end }} +{{- end }} + +{{/* +Trident image pull policy +*/}} +{{- define "imagePullPolicy" -}} +{{- if .Values.imagePullPolicy }} +{{- .Values.imagePullPolicy }} +{{- else }} +{{- "IfNotPresent" }} +{{- end }} +{{- end }} + +{{/* +Determines if rancher roles should be created by checking for the presence of the cattle-system namespace +or annotations with the prefix "cattle.io/" in the namespace where the chart is being installed. +Override auto-detection and force install the roles by setting Values.forceInstallRancherClusterRoles to 'true'. +*/}} +{{- define "shouldInstallRancherRoles" -}} +{{- $isRancher := false -}} +{{- $currentNs := .Release.Namespace -}} +{{- $currentNsObj := lookup "v1" "Namespace" "" $currentNs -}} +{{- /* Check if 'forceInstallRancherClusterRoles' is set */ -}} +{{- if .Values.forceInstallRancherClusterRoles }} + {{- $isRancher = true -}} +{{- end }} +{{- /* Check if the annotation prefix "cattle.io/" exists on the namespace */ -}} +{{- if $currentNsObj }} + {{- range $key, $value := $currentNsObj.metadata.annotations }} + {{- if hasPrefix "cattle.io/" $key }} + {{- $isRancher = true -}} + {{- end }} + {{- end }} +{{- end }} +{{- /* Check if cattle-system ns exists */ -}} +{{- $cattleNs := lookup "v1" "Namespace" "" "cattle-system" -}} +{{- if $cattleNs }} + {{- $isRancher = true -}} +{{- end }} +{{- $isRancher -}} +{{- end }} + +{{/* +Helper functions to render resource requests and limits for each container of trident from values.yaml +*/}} +{{- define "trident.resources.controller" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "trident.resources.node.linux" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "trident.resources.node.windows" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Helper functions to check if resources are actually defined (not just empty structure) +*/}} +{{- define "trident.hasControllerResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.controller -}} + {{- range $key, $val := .Values.resources.controller -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{- define "trident.hasNodeLinuxResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.node -}} + {{- if .Values.resources.node.linux -}} + {{- range $key, $val := .Values.resources.node.linux -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{- define "trident.hasNodeWindowsResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.node -}} + {{- if .Values.resources.node.windows -}} + {{- range $key, $val := .Values.resources.node.windows -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{/* +Helper function to check if operator resources are defined +*/}} +{{- define "trident-operator.hasResources" -}} + {{- $val := . -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + true + {{- end -}} +{{- end -}} + +{{/* +Helper function to render resource requests and limits for the operator +*/}} +{{- define "trident-operator.resources" }} +{{- $val := .}} +{{- if or $val.requests.cpu $val.requests.memory }} +requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} +limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml new file mode 100644 index 00000000..6300f2f2 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml @@ -0,0 +1,13 @@ +{{- if include "shouldInstallRancherRoles" . | eq "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: trident-operator-rancher +rules: + - apiGroups: + - management.cattle.io + resources: + - projects + verbs: + - updatepsa +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml new file mode 100644 index 00000000..92279962 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml @@ -0,0 +1,458 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: trident-operator + labels: + app: operator.trident.netapp.io +rules: + # Permissions same as Trident + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - apiGroups: + - "" + resources: + - persistentvolumes + - persistentvolumeclaims + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - persistentvolumeclaims/status + verbs: + - update + - patch + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - events + verbs: + - get + - list + - watch + - create + - update + - patch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - resourcequotas + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments + verbs: + - get + - list + - watch + - update + - patch + - delete + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments/status + verbs: + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots + - volumesnapshotclasses + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotclasses + verbs: + - create + - delete + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots/status + - volumesnapshotcontents/status + verbs: + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotcontents + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshots + verbs: + - list + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotclasses + verbs: + - list + - watch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents + verbs: + - get + - list + - watch + - patch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents/status + verbs: + - update + - apiGroups: + - csi.storage.k8s.io + resources: + - csidrivers + - csinodeinfos + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - storage.k8s.io + resources: + - csidrivers + - csinodes + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - trident.netapp.io + resources: + - tridentversions + - tridentbackends + - tridentstorageclasses + - tridentvolumes + - tridentvolumepublications + - tridentvolumereferences + - tridentnodes + - tridenttransactions + - tridentsnapshots + - tridentbackendconfigs + - tridentbackendconfigs/status + - tridentmirrorrelationships + - tridentmirrorrelationships/status + - tridentactionmirrorupdates + - tridentactionmirrorupdates/status + - tridentsnapshotinfos + - tridentsnapshotinfos/status + - tridentgroupsnapshots + - tridentgroupsnapshots/status + - tridentactionsnapshotrestores + - tridentactionsnapshotrestores/status + - tridentnoderemediations + - tridentnoderemediations/status + - tridentnoderemediationtemplates + - tridentnoderemediationtemplates/status + - tridentprovisioners # Required for Tprov + - tridentprovisioners/status # Required to update Tprov's status section + - tridentorchestrators # Required for torc + - tridentorchestrators/status # Required to update torc's status section + - tridentconfigurators # Required for tconf + - tridentconfigurators/status # Required to update tconf's status section + - tridentautogrowpolicies + - tridentautogrowpolicies/status + - tridentautogrowrequestinternals + - tridentautogrowrequestinternals/status + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + # Now Operator specific permissions + - apiGroups: + - "" + resources: + - namespaces + verbs: + - create + - patch + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - get + - list + - watch + - create + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - delete + - update + - patch + resourceNames: + - trident + - trident-csi + - trident-controller + - apiGroups: + - apps + resources: + - daemonsets + verbs: + - delete + - update + - patch + resourceNames: + - trident + - trident-csi + - trident-csi-windows + - trident-node-linux + - trident-node-windows + - apiGroups: + - "" + resources: + - pods/exec + - services + - serviceaccounts + verbs: + - get + - list + - create + - apiGroups: + - "" + resources: + - pods/exec + - services + verbs: + - delete + - update + - patch + resourceNames: + - trident-csi + - trident + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - delete + - update + - patch + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + - trident-csi + - trident + - apiGroups: + - authorization.openshift.io + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + - clusterroles + - clusterrolebindings + verbs: + - list + - create + - apiGroups: + - authorization.openshift.io + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + - clusterroles + - clusterrolebindings + verbs: + - get + - delete + - update + - patch + resourceNames: + - trident-node-remediation-access + - trident-controller + - trident-node-linux + - trident-node-windows + - trident-csi + - trident + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - list + - create + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tridentpods + - trident-controller + - trident-node-linux + - trident-node-windows + verbs: + - delete + - update + - patch + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - get + - list + - create + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + - trident + verbs: + - delete + - update + - patch + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - tridentoperatorpods + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml new file mode 100644 index 00000000..b70fcff9 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml @@ -0,0 +1,14 @@ +{{- if include "shouldInstallRancherRoles" . | eq "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: trident-operator-rancher +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: trident-operator-rancher +subjects: + - kind: ServiceAccount + name: trident-operator + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..e6297525 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: trident-operator + labels: + app: operator.trident.netapp.io +subjects: + - kind: ServiceAccount + name: trident-operator + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: trident-operator + apiGroup: rbac.authorization.k8s.io diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml new file mode 100644 index 00000000..c57bb587 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml @@ -0,0 +1,82 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: +{{- if .Values.deploymentAnnotations }} + annotations: +{{ toYaml .Values.deploymentAnnotations | indent 4 }} +{{- end }} + labels: + app: operator.trident.netapp.io + name: trident-operator + namespace: {{ .Release.Namespace }} +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: operator.trident.netapp.io + name: trident-operator + template: + metadata: + {{- if .Values.podAnnotations }} + annotations: +{{ toYaml .Values.podAnnotations | indent 8 }} + {{- end }} + labels: + app: operator.trident.netapp.io + name: trident-operator + {{- if and (eq .Values.cloudProvider "Azure") (ne .Values.cloudIdentity "") }} + azure.workload.identity/use: 'true' + {{- end }} + spec: + {{- if .Values.affinity }} + affinity: +{{- toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} + {{- end }} + serviceAccountName: trident-operator + containers: + - command: + - /trident-operator + {{- if or .Values.anfConfigurator.enabled .Values.ontapConfigurator.enabled }} + - -configurator-reconcile-interval={{ .Values.configuratorReconcileInterval }} + {{- end }} + {{- if .Values.operatorDebug }} + - -debug + {{- end }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: trident-operator + {{- if and (eq .Values.cloudProvider "Azure") (eq .Values.cloudIdentity "") }} + - name: AZURE_CREDENTIAL_FILE + value: /etc/kubernetes/azure.json + volumeMounts: + - name: azure-cred + mountPath: /etc/kubernetes + {{- end }} + image: {{ include "trident-operator.image" $ }} + imagePullPolicy: {{ .Values.imagePullPolicy }} + name: trident-operator + {{- if (include "trident-operator.hasResources" .Values.resources.operator) }} + resources: + {{- include "trident-operator.resources" .Values.resources.operator | indent 10 }} + {{- end }} + {{- if and (eq .Values.cloudProvider "Azure") (eq .Values.cloudIdentity "") }} + volumes: + - name: azure-cred + hostPath: + path: /etc/kubernetes + type: DirectoryOrCreate + {{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml new file mode 100644 index 00000000..a9ee84dd --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml @@ -0,0 +1,82 @@ +{{- if or .Values.cleanupCrds }} + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: post-delete-service-account + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": hook-succeeded + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: post-delete-cluster-role + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-9" + "helm.sh/hook-delete-policy": hook-succeeded +rules: +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "delete", "patch"] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: post-delete-cluster-rolebinding + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-8" + "helm.sh/hook-delete-policy": hook-succeeded +subjects: +- kind: ServiceAccount + name: post-delete-service-account + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: post-delete-cluster-role + apiGroup: rbac.authorization.k8s.io + +--- + +apiVersion: batch/v1 +kind: Job +metadata: + name: post-delete-hook + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed +spec: + template: + spec: + serviceAccountName: post-delete-service-account + containers: + - name: post-delete-container + image: {{ .Values.helmHookImage }} + command: + - sh + - -c + - | + set -x + kubectl patch crd tridentorchestrators.trident.netapp.io -p '{"metadata":{"finalizers":[]}}' --type=merge + kubectl delete crd tridentorchestrators.trident.netapp.io + kubectl patch crd tridentconfigurators.trident.netapp.io -p '{"metadata":{"finalizers":[]}}' --type=merge + kubectl delete crd tridentconfigurators.trident.netapp.io + restartPolicy: Never + backoffLimit: 4 + +{{- end }} \ No newline at end of file diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml new file mode 100644 index 00000000..103b2b15 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml @@ -0,0 +1,70 @@ +{{- if or .Values.anfConfigurator.enabled .Values.ontapConfigurator.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: trident-operator + namespace: {{ .Release.Namespace }} +spec: + selector: + app: operator.trident.netapp.io + ports: + - name: http + protocol: TCP + port: 8000 + targetPort: 8002 +--- +apiVersion: v1 +kind: Pod +metadata: + name: trident-post-install-upgrade-hook + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, hook-failed +spec: + restartPolicy: Never + {{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | nindent 4 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | nindent 4 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | nindent 4 }} + {{- end }} + initContainers: + - name: init-container-1 + image: {{ include "trident.image" $ }} + command: + - tridentctl + - --debug + - -s + - 127.0.0.1:8000 + - check + - operator + - --timeout + - "7200" # Keeping it 12 mins as AKS extension script has an upper limit of 15 mins. + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + containers: + - name: trident-post-hook + image: {{ include "trident.image" $ }} + command: + - tridentctl + - --debug + - -s + - 127.0.0.1:8000 + - check + - operator + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml new file mode 100644 index 00000000..507b38df --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml @@ -0,0 +1,41 @@ +{{- if or .Values.cleanupCrds }} + +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-delete-hook + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed +spec: + template: + spec: + serviceAccountName: trident-operator + containers: + - name: pre-delete-container + image: {{ .Values.helmHookImage }} + command: + - sh + - -c + - | + set -x + if kubectl get torc trident -n trident; then + kubectl patch torc trident -n trident --type=merge -p '{"spec":{"wipeout":["crds"],"uninstall":true, "skipCRDsToObliviate":["tridentorchestrators.trident.netapp.io", "tridentconfigurators.trident.netapp.io"]}}' + while kubectl get crds | grep '.trident.netapp.io' | grep -v -e 'tridentorchestrators.trident.netapp.io' -e 'tridentconfigurators.trident.netapp.io'; do + echo 'Waiting for CRDs to be deleted...' + sleep 5 + done + else + echo 'Trident orchestrator does not exist.' + fi + restartPolicy: Never + backoffLimit: 4 + +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml new file mode 100644 index 00000000..7a73016d --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: trident-operator + namespace: {{ .Release.Namespace }} + {{- if and (ne .Values.cloudIdentity "") (ne .Values.cloudProvider "") }} + {{- $cloudIdentity := trimPrefix "'" .Values.cloudIdentity }} + {{- $cloudIdentity = trimSuffix "'" $cloudIdentity }} + {{- $cloudIdentityPair := regexSplit ": " $cloudIdentity 2 }} + annotations: + {{ first $cloudIdentityPair }}: {{ last $cloudIdentityPair }} + {{- end }} + labels: + app: operator.trident.netapp.io +{{- if .Values.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.imagePullSecrets }} +- name: {{ . }} +{{- end }} +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml new file mode 100644 index 00000000..8496eb5e --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml @@ -0,0 +1,111 @@ +{{- if .Values.anfConfigurator.enabled }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-anf-backend-configurator +spec: + storageDriverName: azure-netapp-files + {{- if eq .Values.cloudProvider "" }} + tenantID: {{ .Values.anfConfigurator.tenantID }} + clientCredentials: {{ .Values.anfConfigurator.clientCredentials }} + {{- end }} + {{- if or (eq .Values.cloudProvider "") (and (eq .Values.cloudProvider "Azure") (ne .Values.cloudIdentity "")) }} + subscriptionID: {{ .Values.anfConfigurator.subscriptionID }} + location: {{ .Values.anfConfigurator.location }} + {{- end }} + virtualNetwork: {{ .Values.anfConfigurator.virtualNetwork }} + subnet: {{ .Values.anfConfigurator.subnet }} + capacityPools: + {{- range .Values.anfConfigurator.capacityPools }} + - {{ . }} + {{- end }} + netappAccounts: + {{- range .Values.anfConfigurator.netappAccounts }} + - {{ . }} + {{- end }} + resourceGroups: + {{- range .Values.anfConfigurator.resourceGroups }} + - {{ . }} + {{- end }} + customerEncryptionKeys: + {{- range $key, $value := .Values.anfConfigurator.customerEncryptionKeys }} + {{ $key }}: {{ $value }} + {{- end }} +{{- end }} + +--- + +{{- if .Values.ontapConfigurator.enabled }} +{{- $includeCR := false }} +{{- range .Values.ontapConfigurator.svms }} + {{- if or (has "nfs" .protocols) (has "smb" .protocols) }} + {{- $includeCR = true }} + {{- end }} +{{- end }} + +{{- if $includeCR }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-nas-backend-configurator +spec: + storageDriverName: ontap-nas + svms: + {{- range .Values.ontapConfigurator.svms }} + {{- if or (has "nfs" .protocols) (has "smb" .protocols) }} + - fsxnID: {{ .fsxnID | quote }} + protocols: + {{- $filteredProtocols := list }} + {{- range .protocols }} + {{- if or (eq . "nfs") (eq . "smb") }} + {{- $filteredProtocols = append $filteredProtocols . }} + {{- end }} + {{- end }} + {{- range $filteredProtocols }} + - {{ . | quote }} + {{- end }} + svmName: {{ .svmName | quote }} + authType: {{ .authType | default "awsarn" | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} + + +--- + +{{- if .Values.ontapConfigurator.enabled }} +{{- $includeCR := false }} +{{- range .Values.ontapConfigurator.svms }} + {{- if or (has "iscsi" .protocols) (has "nvme" .protocols) }} + {{- $includeCR = true }} + {{- end }} +{{- end }} + +{{- if $includeCR }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-san-backend-configurator +spec: + storageDriverName: ontap-san + svms: + {{- range .Values.ontapConfigurator.svms }} + {{- if or (has "iscsi" .protocols) (has "nvme" .protocols) }} + - fsxnID: {{ .fsxnID | quote }} + protocols: + {{- $filteredProtocols := list }} + {{- range .protocols }} + {{- if or (eq . "iscsi") (eq . "nvme") }} + {{- $filteredProtocols = append $filteredProtocols . }} + {{- end }} + {{- end }} + {{- range $filteredProtocols }} + - {{ . | quote }} + {{- end }} + svmName: {{ .svmName | quote }} + authType: {{ .authType | default "awsarn" | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml new file mode 100644 index 00000000..5f5038df --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml @@ -0,0 +1,108 @@ +apiVersion: trident.netapp.io/v1 +kind: TridentOrchestrator +metadata: + name: trident +spec: + namespace: {{ .Release.Namespace }} + enableForceDetach: {{ include "trident.enableForceDetach" $ }} + IPv6: {{ include "trident.IPv6" $ }} + k8sTimeout: {{ .Values.tridentK8sTimeout }} + httpRequestTimeout: {{ .Values.tridentHttpRequestTimeout }} + silenceAutosupport: {{ include "trident.silenceAutosupport" $ }} + {{- if .Values.tridentExcludeAutosupport }} + excludeAutosupport: {{ .Values.tridentExcludeAutosupport }} + {{- end }} + autosupportImage: {{ include "trident.autosupportImage" $ }} + autosupportProxy: {{ .Values.tridentAutosupportProxy }} + autosupportInsecure: {{ .Values.tridentAutosupportInsecure }} + logFormat: {{ include "trident.logFormat" $ }} + disableAuditLog: {{ include "trident.disableAuditLog" $ }} + {{- if .Values.tridentDebug }} + debug: {{ .Values.tridentDebug }} + {{- end }} + {{- if .Values.tridentLogLevel }} + logLevel: {{ .Values.tridentLogLevel }} + {{- end }} + logWorkflows: {{ include "trident.logWorkflows" $ }} + logLayers: {{ include "trident.logLayers" $ }} + probePort: {{ include "trident.probePort" $ }} + tridentImage: {{ include "trident.image" $ }} + {{- if .Values.imageRegistry }} + imageRegistry: {{ .Values.imageRegistry }} + {{- end }} + kubeletDir: {{ .Values.kubeletDir }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 2 }} + {{- end }} + {{- if .Values.tridentControllerPluginNodeSelector }} + controllerPluginNodeSelector: + {{- range $key, $value := .Values.tridentControllerPluginNodeSelector }} + {{ $key }}: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.tridentControllerPluginTolerations }} + controllerPluginTolerations: + {{- range $value := .Values.tridentControllerPluginTolerations }} + - {{- range $k, $v := $value }} + {{ $k }}: "{{ $v }}" + {{- end}} + {{- end}} + {{- end }} + {{- if .Values.tridentNodePluginNodeSelector }} + nodePluginNodeSelector: + {{- range $key, $value := .Values.tridentNodePluginNodeSelector }} + {{ $key }}: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.tridentNodePluginTolerations }} + nodePluginTolerations: + {{- range $value := .Values.tridentNodePluginTolerations }} + - {{- range $k, $v := $value }} + {{ $k }}: "{{ $v }}" + {{- end}} + {{- end}} + {{- end }} + imagePullPolicy: {{ include "imagePullPolicy" $ }} + windows: {{ .Values.windows }} + cloudProvider: {{ .Values.cloudProvider }} + cloudIdentity: {{ .Values.cloudIdentity }} + enableACP: {{ .Values.enableACP }} + acpImage: {{ .Values.acpImage }} + httpsMetrics: {{ .Values.httpsMetrics }} + enableAutoBackendConfig: {{ or .Values.ontapConfigurator.enabled .Values.anfConfigurator.enabled }} + iscsiSelfHealingInterval: {{ .Values.iscsiSelfHealingInterval }} + iscsiSelfHealingWaitTime: {{ .Values.iscsiSelfHealingWaitTime }} + {{- if .Values.k8sAPIQPS }} + k8sAPIQPS: {{ .Values.k8sAPIQPS }} + {{- end }} + {{- if .Values.fsGroupPolicy }} + fsGroupPolicy: {{ .Values.fsGroupPolicy }} + {{- end }} + {{- if .Values.nodePrep }} + nodePrep: {{- range .Values.nodePrep }} + - {{.}} {{- end }} + {{- end }} + enableConcurrency: {{ .Values.enableConcurrency }} + {{- if .Values.skipCRDsToObliviate }} + skipCRDsToObliviate: {{- range .Values.skipCRDsToObliviate }} + - {{.}} {{- end }} + {{- end }} + {{ if or (include "trident.hasControllerResources" .) (include "trident.hasNodeLinuxResources" .) (include "trident.hasNodeWindowsResources" .) -}} + resources: + {{ if include "trident.hasControllerResources" . -}} + controller: {{ include "trident.resources.controller" .Values.resources.controller | indent 6 }} + {{- end }} + {{ if or (include "trident.hasNodeLinuxResources" .) (include "trident.hasNodeWindowsResources" .) -}} + node: + {{ if include "trident.hasNodeLinuxResources" . -}} + linux: {{ include "trident.resources.node.linux" .Values.resources.node.linux | indent 8 }} + {{- end }} + {{- if include "trident.hasNodeWindowsResources" . }} + windows: {{ include "trident.resources.node.windows" .Values.resources.node.windows | indent 8 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: {{ .Values.hostNetwork }} + {{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml new file mode 100644 index 00000000..e30cee4b --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml @@ -0,0 +1,327 @@ +# Default values for standalone. +# This is a YAML-formatted file. + +# helmHookImage specifies the image used for Helm hook jobs +helmHookImage: "alpine/k8s:1.33.0" + +## Node labels for pod assignment +## ref: https://kubernetes.io/docs/user-guide/node-selection/ +nodeSelector: {} + +## Pod Annotations +podAnnotations: {} + +## Deployment Annotations +deploymentAnnotations: {} + +## Tolerations for pod assignment +## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +tolerations: [] + +## Affinity for pod assignment +## The following affinity configuration ensures that the Trident operator will only be scheduled on nodes with the specified architecture and OS, Hence, do not modify this section. To add custom affinity rules, please append your content to this configuration as needed +## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - arm64 + - amd64 + - key: kubernetes.io/os + operator: In + values: + - linux + + +# tridentControllerPluginNodeSelector additional nodeSelectors for the Pod running the Trident Controller CSI Plugin. +# tridentControllerPluginNodeSelector : {} + +# tridentControllerPluginTolerations overrides tolerations for the Pod running the Trident Controler CSI Plugin. +# tridentControllerPluginTolerations: [] + +# tridentNodePluginNodeSelector additional nodeSelectors for Pods running the Trident Node CSI Plugin. +# tridentNodePluginNodeSelector : {} + +# tridentNodePluginTolerations overrides tolerations for Pods running the Trident Node CSI Plugin. +# tridentNodePluginTolerations: [] + + + +# imageRegistry identifies the registry for the trident-operator, trident, and other images. Leave empty to accept the default. +imageRegistry: "" + +# imagePullPolicy sets the image pull policy for the trident-operator. +imagePullPolicy: IfNotPresent + +# imagePullSecrets sets the image pull secrets for the trident-operator, trident, and other images. +imagePullSecrets: [] + +# kubeletDir allows overriding the host location of kubelet's internal state. (default "/var/lib/kubelet"). +kubeletDir: "" + + +# operatorLogLevel allows the log level of the Trident operator to be set to one of these: +# trace, debug, info, warn, error, fatal. +# operatorLogLevel: "info" + +# operatorDebug allows the log level of the Trident operator to be set to debug +operatorDebug: true + +# operatorImage allows the complete override of the image for trident-operator. +operatorImage: "" + +# operatorImageTag allows overriding the tag of the trident-operator image. +operatorImageTag: "" + + +# tridentIPv6 allows enabling Trident to work in IPv6 clusters. +tridentIPv6: false + +# tridentK8sTimeout overrides the default 30-second timeout for most Kubernetes API operations (if non-zero, in seconds). +tridentK8sTimeout: 0 + +# tridentHttpRequestTimeout (duration) overrides the default 90-second timeout for the HTTP requests, with 0s being an +# infinite duration for the timeout. Negative values are not allowed. +tridentHttpRequestTimeout: "90s" + +# tridentSilenceAutosupport allows disabling Trident's periodic Autosupport reporting. +tridentSilenceAutosupport: false + +# tridentExcludeAutosupport allows removal of the autosupport container when installing Trident. +tridentExcludeAutosupport: false + +# tridentAutosupportImage allows the complete override of the image for Trident's Autosupport container. +tridentAutosupportImage: "" + +# tridentAutosupportImageTag allows overriding the tag of the image for Trident's Autosupport container. +tridentAutosupportImageTag: "26.02" + +# tridentAutosupportProxy allows Trident's autosupport container to phone home via an HTTP proxy. +tridentAutosupportProxy: "" + +# tridentAutosupportInsecure allows Trident's autosupport container to skip TLS verification +tridentAutosupportInsecure: false + +# tridentLogFormat sets the Trident logging format (text or json). +tridentLogFormat: "text" + +# tridentDisableAuditLog disables Trident's audit logger. +tridentDisableAuditLog: true + +# tridentLogLevel allows the log level of Trident to be set to one of these: trace, debug, info, warn, error, fatal. +#tridentLogLevel: "info" + +# tridentDebug allows the log level of Trident to be set to debug +tridentDebug: false + +# tridentLogWorkflows allows specific Trident workflows to be enabled for trace logging or log suppression. +tridentLogWorkflows: "" + +# tridentLogLayers allows specific Trident layers to be enabled for trace logging or log suppression. +tridentLogLayers: "" + +# tridentImage allows the complete override of the image for Trident. +tridentImage: "" + +# tridentImageTag allows overriding the tag of the image for Trident. +tridentImageTag: "" + +# (Deprecated) tridentEnableNodePrep attempts to automatically install required packages on nodes. +tridentEnableNodePrep: false + +# (Deprecated) tridentSkipK8sVersionCheck allows overriding the k8s version limit for Trident. +tridentSkipK8sVersionCheck: false + +# tridentProbePort allows overriding the default port used for k8s liveness/readiness probes. +tridentProbePort: "" + +# windows allows Trident to be installed on Windows worker node. +windows: false + +# enableForceDetach allows enabling the force detach feature. +enableForceDetach: false + +# cloudProvider indicates which cloud platform Trident is running on. +cloudProvider: "" + +# cloudIdentity indicates the identity that needs to be set on service account. +cloudIdentity: "" + +# enableACP allows enabling the Trident-ACP container to run. +enableACP: false + +# acpImage indicates the image the Trident-ACP container should pull. +acpImage: "" + +# httpsMetrics allows enabling the HTTPS metrics. +httpsMetrics: false + +# iscsiSelfHealingInterval is the interval at which the iSCSI self-healing job is invoked +iscsiSelfHealingInterval: "5m0s" + +# iscsiSelfHealingWaitTime is the wait time after which iSCSI self-healing attempts to fix stale sessions +iscsiSelfHealingWaitTime: "7m0s" + +# configuratorReconcileInterval is the resource refresh rate for the auto generated backends. +configuratorReconcileInterval: 30m0s + +# forceInstallRancherClusterRoles will install a Rancher specific ClusterRole and ClusterRoleBinding when set to true. +# When set to false, the ClusterRole and ClusterRoleBinding will be installed only when a Rancher cluster is detected. +forceInstallRancherClusterRoles: false + +# Auto generated ANF backend related fields consumed by the configurator controller. +anfConfigurator: + enabled: false + virtualNetwork: "" + subnet: "" + subscriptionID: "" + tenantID: "" + location: "" + clientCredentials: "" + capacityPools: [] + netappAccounts: [] + resourceGroups: [] + customerEncryptionKeys: {} + +# Auto generated ONTAP backend related fields consumed by the configurator controller. +ontapConfigurator: + enabled: false + svms: + - fsxnID: '' + svmName: '' + protocols: [] + authType: '' + +# enableConcurrency enables the concurrent core feature in Trident **TECH PREVIEW** +enableConcurrency: false + +# Resource requests and limits for Trident components (controller, node, operator). +# Configure CPU and memory for each container and sidecar to manage resource allocation in Kubernetes. +# +# IMPORTANT NOTES: +# - DO NOT change the names of any containers or fields - or, they may not work +# - DO NOT change the indentation - YAML indentation is critical for proper parsing +# - Default values for controller/node are shown in comments (e.g., # 10m) and are applied automatically if not specified +# - Default values for operator are directly specified in the config (not in comments) and will be applied +# - By default, NO limits are applied - only requests have default values +# - Container names are listed as they appear in the pod specifications +# +# STRUCTURE EXPLANATION: +# +# 1. CONTROLLER POD: +# The controller pod runs on a single operating system (Linux), so there are no OS-specific +# sub-sections. All containers within the controller pod are listed directly under 'controller'. +# +# 2. NODE POD: +# The node pod runs on multiple operating systems (Linux and Windows), so it has OS-specific +# sub-sections: 'linux' and 'windows'. Each OS section lists its specific containers. +# +# 3. OPERATOR POD: +# Unlike controller and node pods, the operator has actual default values directly specified +# (not in comments). If removed, no values will be applied. +resources: + controller: + trident-main: + requests: + cpu: # 10m + memory: # 80Mi + limits: + cpu: + memory: + # sidecars + csi-provisioner: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-attacher: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-resizer: + requests: + cpu: # 3m + memory: # 20Mi + limits: + cpu: + memory: + csi-snapshotter: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + trident-autosupport: + requests: + cpu: # 1m + memory: # 30Mi + limits: + cpu: + memory: + node: + linux: + trident-main: + requests: + cpu: # 10m + memory: # 60Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 1m + memory: # 10Mi + limits: + cpu: + memory: + windows: + trident-main: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + liveness-probe: + requests: + cpu: # 2m + memory: # 40Mi + limits: + cpu: + memory: + operator: + requests: + cpu: 10m + memory: 40Mi + limits: + cpu: + memory: + +# k8sAPIQPS sets the maximum QPS to the Kubernetes API server from the Trident operator. (default 100) +k8sAPIQPS: 0 + +# hostNetwork sets the hostNetwork field in the Trident operator deployment spec. +hostNetwork: false + +# nodePrep enables Trident to prepare the nodes of the Kubernetes cluster to manage volumes using the +# specified data storage protocol. Currently, iSCSI is the only value supported. +nodePrep: [] diff --git a/packs/trident-operator-addon-26.0.2/logo.png b/packs/trident-operator-addon-26.0.2/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..6a7f76663a04adbeb8ac133449f97dc67ed0c215 GIT binary patch literal 4314 zcmd6r`8Qj8_s0`KRjZBp;-)3R3n#&i1C;IrWY zwquj;f&$VD0LO~E#)>aT0eA(cC<0CF=3QTVwY+6QMh+FOv{@8!GqN!$; zCy3JbGVY|+NA4|qu$@&W*M^z@Bzswv9)7F&&6!mB((g!o&LWn0vzq?MOc~-zd1B4dBW zk)u*v!MAEVz1n%?pyww&i{b~a9-n*9hf1qrF{Im8WGDI<)?4}bzMQq6K(UydhcTa| zT^%^6wqugjNvVE$&ZBdE)i#%Ba-!Wg+ziGlWm}L|)V0y~{I_!RgQTQfepX+wp3=YP zLEZ_TS0|wHley1`QuW#r&a*}_{S0y$AL`*6aHGO5H~99a(A=As;2Wr#0=49(umhFJ zJo4(kqt1vy&YXYI_(-^5#g`8PMF73+LT*1pXDeMM5XWyBA>a8eU!s}eh??4pXpM~ zNaH3=Qzs6(x-O9azP0Km{(B7(PDD~&na=|u&&}Tnx91%V?Z8zf-Q*g{1>@AA0<~Di zQ2vfSqeJQI6ZGTBAD_sJqvQzr2n#-o4Xt@h1;Sq}Mg*#ESKgHQ@wsfA+brspt&b_Z zveix^grXmKJnfO~`$>5ex-6XnPDxK|ZTjAcFMia&S zCMLuqudVZWds_*#0cMB@jlSfe%dRWHX{ALSBgMc{&Hi4`4$-a(Nsw?bMQF+~M?5Bz zi)lh4uoQd)Y^|O7b^EIT(pQaW0Lin}!^?IEwC#e$n229Uacy}d&OPT`7m|+7A*?6% z9dAZV2I4mK8mla-{QEpJ8l9AX{)4f?DnY^Bk~Y*OtbKa8vjjtu@6c_+xvb&%utl8) zySiEJfTyA(VcmKg$|jsOwK>HbgkP9a8~-#GZfK1X^GFjV8IBrBa<6?ZExVVo{dr`F z8GCv2d__Pk<@|NpJod{zFBjqXIkn47$Y>;Q?aaOw*>hz#{u2P|4h1q7io8={ zu(EZP&y3S*2&GE7O}TQ_^6mz(tMV&H$*KcB0MT&Imtt)R<%WBec8VpXmp0F4VX*$eS z^)uH0_*5Lmi+rO~v%Cf0ee=qj8@s~1FC3Hj&!u7fWi!HdwW#tzEJCTS;%X(IbTzyYnumGEp)(imq^y@YBbMG zSHPNs#}1-u2I&o}3d3&K8!+#kqOFQD<6GGutrWZ9p@Ytg+WB(gUiJx8-wS$lZ;9wP z44&hkRgx%Yl!I!DX`3_kcQ%LjgX^mnKVQXQ*V@CIqh>26-z}?3iGtaDx+%&omI=aVnqqD|%dm=d z-HKreT8Q(X|w!%GNsr*3zqBFV$KTh<*XAB zGE&m(fTwT9=;i4#$U=v$_Uy2`jrC=Orw-`m(XAa1bherD?F-yM=tkcQk{09#RueV! z6{US%!-7X7!f*S(lF<{q_B!y+5cj`kdYt7Lxa$=WVT3VzQO6+nBK=E&E@NhTy;Q@Z z%m>M*IVR4OsY3@%7q!LYEH;!Dblrj>yK0vhdi_sdWII&xy5S2d3R!Hr`I6Iz89Hiy z#yzH-)KI-|k;-)`)gd-T0x4JXAn6`v+5l(zNn~qy6;S30hF)BI$A~XO4d^yh|9JSz z5XpXE@ah&W?j^ly@-JB|&goCuvd>)YM@X)66Xo>OVs>Y_#+-}6JXTa1BU zM^^T~roEC@DxCW4Sz*%)xgY|qq54i;gL@8z84g07&8)p$Zo9oe(@onlRXQ(}6+!?9 zt&5P5!_n8IviLZ!GMVThr+9&?$!r@goK~619ZevW-#gO@= zMb|NGhtOp5*v5&P*!H9Oz9iHNbm&Pm=#n0x%;P?-t9lDn?2$F9!eR`%V%v_k%G1gD zh%(0M4eeoV#k&a|`nj>fDUvBAX38mH#s)rjBP;jzAANhy;jH$tK?RFLB~4SjI5h%(8dp!5xfd)0mRQlrIb**T= zI?I4tZFMRRZY8LbJWLBMtU6}-2rgUOM5IUeUR1~wbL*o)U*c#0q`Eye%hDcSPt!Bkn?{P1B2RaM;#WNRq(>?Sa$7}v&{*WS8PzZ2# z=HLVOw280KD#BYH1kOSLgpDyvMNSlz04Qo8_J}XAhw1Y}`A79l837PSm;8>$Dz|u) zX`w?;52iR{a4Di&2ofYJS_}B~SFNt&L38L#I>1&qBhsajE3oYCjC>&%{VK!tulSfR zfZXRf%aw#|WkjI05_q--hG+9O)P?sl8RPazY#c0C9?uN@z~dIMi`w@<^KtGECd+UqioDNGq ztq1}8UX!%lTLp$wd=u^Qtv#o`%to3CR8&+!SdlA0vH*hIZD%``<9S~IIQlASBe;Ye z6=|dqJvNlrt0SgT-WnKu|ED>0>P>n2K^p1MNt&hudq_Iu;9-4d*2ctX|;%oAIic zgR(Ta-HGK`R&JIW10eGV@$buF`Y!*F7UkqYz!4CReTG$)t<&`eO^z<{v-~KfyA|&O zkF_zBx)kKDL>DyG`1^;b3oQa#b7A`PL0=a|OV+vlM$ zu*OnKA{3gzmBAkPN5RjFFZF06?1EyVie+A$Yh2s(vZ~$r*RHo30*Z|cSb+rqcBufH zB)O}l)^>*j7Z1z>i@n1(GrjoNBc&uuC{zqkb<9c6uRlln;W89f&(9+6Q>PknhC7#E zK6tDIYzT#3Lpi3K^ei@x|51#YbTul)8W?;5ZodX}Vz$?@!@eS{Vxpgcz-L9dkM1;R z1ZR^!O|E|KfI``TZh8yog=-GcWC8r5L-b{RR(Mk7ko{3MupV zpY=MB({DOlY({gD(L7=&i$?xX#H1I_F&@16^Q0i^1WLSwBsxH1#3p#Y8Xm z09^~CFc9`?aGx>8=>`UG+z0GafslLd9|ILUFo^_o6c TM>kIXxd53OTfr+0|9tQtU!4)S literal 0 HcmV?d00001 diff --git a/packs/trident-operator-addon-26.0.2/pack.json b/packs/trident-operator-addon-26.0.2/pack.json new file mode 100644 index 00000000..eae1740e --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/pack.json @@ -0,0 +1,17 @@ +{ + "addonType": "system app", + "annotations": { + "source": "community", + "contributor": "netapp" + }, + "cloudTypes": [ + "all" + ], + "displayName": "Trident", + "charts": [ + "charts/trident-operator-100.2602.0.tgz" + ], + "layer": "addon", + "name": "csi-trident-addon", + "version": "26.0.2" +} \ No newline at end of file diff --git a/packs/trident-operator-addon-26.0.2/values.yaml b/packs/trident-operator-addon-26.0.2/values.yaml new file mode 100644 index 00000000..9b251ac0 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/values.yaml @@ -0,0 +1,338 @@ +pack: + spectrocloud.com/display-name: trident-operator + releaseNameOverride: + trident-operator: trident-operator + namespace: trident + content: + images: + - image: docker.io/netapp/trident-operator:26.0.2 + +charts: + trident-operator: + # Default values for standalone. + # This is a YAML-formatted file. + + # helmHookImage specifies the image used for Helm hook jobs + helmHookImage: "alpine/k8s:1.33.0" + + ## Node labels for pod assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + nodeSelector: {} + + ## Pod Annotations + podAnnotations: {} + + ## Deployment Annotations + deploymentAnnotations: {} + + ## Tolerations for pod assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + tolerations: [] + + ## Affinity for pod assignment + ## The following affinity configuration ensures that the Trident operator will only be scheduled on nodes with the specified architecture and OS, Hence, do not modify this section. To add custom affinity rules, please append your content to this configuration as needed + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - arm64 + - amd64 + - key: kubernetes.io/os + operator: In + values: + - linux + + + # tridentControllerPluginNodeSelector additional nodeSelectors for the Pod running the Trident Controller CSI Plugin. + # tridentControllerPluginNodeSelector : {} + + # tridentControllerPluginTolerations overrides tolerations for the Pod running the Trident Controler CSI Plugin. + # tridentControllerPluginTolerations: [] + + # tridentNodePluginNodeSelector additional nodeSelectors for Pods running the Trident Node CSI Plugin. + # tridentNodePluginNodeSelector : {} + + # tridentNodePluginTolerations overrides tolerations for Pods running the Trident Node CSI Plugin. + # tridentNodePluginTolerations: [] + + + + # imageRegistry identifies the registry for the trident-operator, trident, and other images. Leave empty to accept the default. + imageRegistry: "" + + # imagePullPolicy sets the image pull policy for the trident-operator. + imagePullPolicy: IfNotPresent + + # imagePullSecrets sets the image pull secrets for the trident-operator, trident, and other images. + imagePullSecrets: [] + + # kubeletDir allows overriding the host location of kubelet's internal state. (default "/var/lib/kubelet"). + kubeletDir: "" + + + # operatorLogLevel allows the log level of the Trident operator to be set to one of these: + # trace, debug, info, warn, error, fatal. + # operatorLogLevel: "info" + + # operatorDebug allows the log level of the Trident operator to be set to debug + operatorDebug: true + + # operatorImage allows the complete override of the image for trident-operator. + operatorImage: "" + + # operatorImageTag allows overriding the tag of the trident-operator image. + operatorImageTag: "" + + + # tridentIPv6 allows enabling Trident to work in IPv6 clusters. + tridentIPv6: false + + # tridentK8sTimeout overrides the default 30-second timeout for most Kubernetes API operations (if non-zero, in seconds). + tridentK8sTimeout: 0 + + # tridentHttpRequestTimeout (duration) overrides the default 90-second timeout for the HTTP requests, with 0s being an + # infinite duration for the timeout. Negative values are not allowed. + tridentHttpRequestTimeout: "90s" + + # tridentSilenceAutosupport allows disabling Trident's periodic Autosupport reporting. + tridentSilenceAutosupport: false + + # tridentExcludeAutosupport allows removal of the autosupport container when installing Trident. + tridentExcludeAutosupport: false + + # tridentAutosupportImage allows the complete override of the image for Trident's Autosupport container. + tridentAutosupportImage: "" + + # tridentAutosupportImageTag allows overriding the tag of the image for Trident's Autosupport container. + tridentAutosupportImageTag: "26.02" + + # tridentAutosupportProxy allows Trident's autosupport container to phone home via an HTTP proxy. + tridentAutosupportProxy: "" + + # tridentAutosupportInsecure allows Trident's autosupport container to skip TLS verification + tridentAutosupportInsecure: false + + # tridentLogFormat sets the Trident logging format (text or json). + tridentLogFormat: "text" + + # tridentDisableAuditLog disables Trident's audit logger. + tridentDisableAuditLog: true + + # tridentLogLevel allows the log level of Trident to be set to one of these: trace, debug, info, warn, error, fatal. + #tridentLogLevel: "info" + + # tridentDebug allows the log level of Trident to be set to debug + tridentDebug: false + + # tridentLogWorkflows allows specific Trident workflows to be enabled for trace logging or log suppression. + tridentLogWorkflows: "" + + # tridentLogLayers allows specific Trident layers to be enabled for trace logging or log suppression. + tridentLogLayers: "" + + # tridentImage allows the complete override of the image for Trident. + tridentImage: "" + + # tridentImageTag allows overriding the tag of the image for Trident. + tridentImageTag: "" + + # (Deprecated) tridentEnableNodePrep attempts to automatically install required packages on nodes. + tridentEnableNodePrep: false + + # (Deprecated) tridentSkipK8sVersionCheck allows overriding the k8s version limit for Trident. + tridentSkipK8sVersionCheck: false + + # tridentProbePort allows overriding the default port used for k8s liveness/readiness probes. + tridentProbePort: "" + + # windows allows Trident to be installed on Windows worker node. + windows: false + + # enableForceDetach allows enabling the force detach feature. + enableForceDetach: false + + # cloudProvider indicates which cloud platform Trident is running on. + cloudProvider: "" + + # cloudIdentity indicates the identity that needs to be set on service account. + cloudIdentity: "" + + # enableACP allows enabling the Trident-ACP container to run. + enableACP: false + + # acpImage indicates the image the Trident-ACP container should pull. + acpImage: "" + + # httpsMetrics allows enabling the HTTPS metrics. + httpsMetrics: false + + # iscsiSelfHealingInterval is the interval at which the iSCSI self-healing job is invoked + iscsiSelfHealingInterval: "5m0s" + + # iscsiSelfHealingWaitTime is the wait time after which iSCSI self-healing attempts to fix stale sessions + iscsiSelfHealingWaitTime: "7m0s" + + # configuratorReconcileInterval is the resource refresh rate for the auto generated backends. + configuratorReconcileInterval: 30m0s + + # forceInstallRancherClusterRoles will install a Rancher specific ClusterRole and ClusterRoleBinding when set to true. + # When set to false, the ClusterRole and ClusterRoleBinding will be installed only when a Rancher cluster is detected. + forceInstallRancherClusterRoles: false + + # Auto generated ANF backend related fields consumed by the configurator controller. + anfConfigurator: + enabled: false + virtualNetwork: "" + subnet: "" + subscriptionID: "" + tenantID: "" + location: "" + clientCredentials: "" + capacityPools: [] + netappAccounts: [] + resourceGroups: [] + customerEncryptionKeys: {} + + # Auto generated ONTAP backend related fields consumed by the configurator controller. + ontapConfigurator: + enabled: false + svms: + - fsxnID: '' + svmName: '' + protocols: [] + authType: '' + + # enableConcurrency enables the concurrent core feature in Trident **TECH PREVIEW** + enableConcurrency: false + + # Resource requests and limits for Trident components (controller, node, operator). + # Configure CPU and memory for each container and sidecar to manage resource allocation in Kubernetes. + # + # IMPORTANT NOTES: + # - DO NOT change the names of any containers or fields - or, they may not work + # - DO NOT change the indentation - YAML indentation is critical for proper parsing + # - Default values for controller/node are shown in comments (e.g., # 10m) and are applied automatically if not specified + # - Default values for operator are directly specified in the config (not in comments) and will be applied + # - By default, NO limits are applied - only requests have default values + # - Container names are listed as they appear in the pod specifications + # + # STRUCTURE EXPLANATION: + # + # 1. CONTROLLER POD: + # The controller pod runs on a single operating system (Linux), so there are no OS-specific + # sub-sections. All containers within the controller pod are listed directly under 'controller'. + # + # 2. NODE POD: + # The node pod runs on multiple operating systems (Linux and Windows), so it has OS-specific + # sub-sections: 'linux' and 'windows'. Each OS section lists its specific containers. + # + # 3. OPERATOR POD: + # Unlike controller and node pods, the operator has actual default values directly specified + # (not in comments). If removed, no values will be applied. + resources: + controller: + trident-main: + requests: + cpu: # 10m + memory: # 80Mi + limits: + cpu: + memory: + # sidecars + csi-provisioner: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-attacher: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-resizer: + requests: + cpu: # 3m + memory: # 20Mi + limits: + cpu: + memory: + csi-snapshotter: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + trident-autosupport: + requests: + cpu: # 1m + memory: # 30Mi + limits: + cpu: + memory: + node: + linux: + trident-main: + requests: + cpu: # 10m + memory: # 60Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 1m + memory: # 10Mi + limits: + cpu: + memory: + windows: + trident-main: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + liveness-probe: + requests: + cpu: # 2m + memory: # 40Mi + limits: + cpu: + memory: + operator: + requests: + cpu: 10m + memory: 40Mi + limits: + cpu: + memory: + + # k8sAPIQPS sets the maximum QPS to the Kubernetes API server from the Trident operator. (default 100) + k8sAPIQPS: 0 + + # hostNetwork sets the hostNetwork field in the Trident operator deployment spec. + hostNetwork: false + + # nodePrep enables Trident to prepare the nodes of the Kubernetes cluster to manage volumes using the + # specified data storage protocol. Currently, iSCSI is the only value supported. + nodePrep: [] From e2d97499de5738182f54ccc052af632638800283 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Tue, 24 Mar 2026 09:17:34 -0500 Subject: [PATCH 03/10] renamed: packs/trident-operator-26.0.2/README.md -> packs/trident-operator-26.02.0/README.md renamed: packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz -> packs/trident-operator-26.02.0/charts/trident-operator-100.2602.0.tgz renamed: packs/trident-operator-26.0.2/charts/trident-operator/.helmignore -> packs/trident-operator-26.02.0/charts/trident-operator/.helmignore renamed: packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/Chart.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/README.md -> packs/trident-operator-26.02.0/charts/trident-operator/README.md renamed: packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt -> packs/trident-operator-26.02.0/charts/trident-operator/templates/NOTES.txt renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl -> packs/trident-operator-26.02.0/charts/trident-operator/templates/_helpers.tpl renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/deployment.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/serviceaccount.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/values.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/values.yaml renamed: packs/trident-operator-26.0.2/logo.png -> packs/trident-operator-26.02.0/logo.png renamed: packs/trident-operator-26.0.2/pack.json -> packs/trident-operator-26.02.0/pack.json renamed: packs/trident-operator-26.0.2/values.yaml -> packs/trident-operator-26.02.0/values.yaml renamed: packs/trident-operator-addon-26.0.2/README.md -> packs/trident-operator-addon-26.02.0/README.md renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz -> packs/trident-operator-addon-26.02.0/charts/trident-operator-100.2602.0.tgz renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore -> packs/trident-operator-addon-26.02.0/charts/trident-operator/.helmignore renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/Chart.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md -> packs/trident-operator-addon-26.02.0/charts/trident-operator/README.md renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/NOTES.txt renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/_helpers.tpl renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/deployment.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/serviceaccount.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/values.yaml renamed: packs/trident-operator-addon-26.0.2/logo.png -> packs/trident-operator-addon-26.02.0/logo.png renamed: packs/trident-operator-addon-26.0.2/pack.json -> packs/trident-operator-addon-26.02.0/pack.json renamed: packs/trident-operator-addon-26.0.2/values.yaml -> packs/trident-operator-addon-26.02.0/values.yaml --- .../README.md | 0 .../charts/trident-operator-100.2602.0.tgz | Bin .../charts/trident-operator/.helmignore | 0 .../charts/trident-operator/Chart.yaml | 0 .../charts/trident-operator/README.md | 0 .../trident-operator/crds/tridentconfigurators.yaml | 0 .../trident-operator/crds/tridentorchestrators.yaml | 0 .../charts/trident-operator/templates/NOTES.txt | 0 .../charts/trident-operator/templates/_helpers.tpl | 0 .../templates/clusterrole-rancher.yaml | 0 .../trident-operator/templates/clusterrole.yaml | 0 .../templates/clusterrolebinding-rancher.yaml | 0 .../templates/clusterrolebinding.yaml | 0 .../trident-operator/templates/deployment.yaml | 0 .../templates/postdeletecrdshook.yaml | 0 .../templates/postinstallupgradehook.yaml | 0 .../templates/predeletecrdshook.yaml | 0 .../trident-operator/templates/serviceaccount.yaml | 0 .../templates/tridentconfigurator.yaml | 0 .../templates/tridentorchestrator.yaml | 0 .../charts/trident-operator/values.yaml | 0 .../logo.png | Bin .../pack.json | 2 +- .../values.yaml | 10 +++++----- .../README.md | 0 .../charts/trident-operator-100.2602.0.tgz | Bin .../charts/trident-operator/.helmignore | 0 .../charts/trident-operator/Chart.yaml | 0 .../charts/trident-operator/README.md | 0 .../trident-operator/crds/tridentconfigurators.yaml | 0 .../trident-operator/crds/tridentorchestrators.yaml | 0 .../charts/trident-operator/templates/NOTES.txt | 0 .../charts/trident-operator/templates/_helpers.tpl | 0 .../templates/clusterrole-rancher.yaml | 0 .../trident-operator/templates/clusterrole.yaml | 0 .../templates/clusterrolebinding-rancher.yaml | 0 .../templates/clusterrolebinding.yaml | 0 .../trident-operator/templates/deployment.yaml | 0 .../templates/postdeletecrdshook.yaml | 0 .../templates/postinstallupgradehook.yaml | 0 .../templates/predeletecrdshook.yaml | 0 .../trident-operator/templates/serviceaccount.yaml | 0 .../templates/tridentconfigurator.yaml | 0 .../templates/tridentorchestrator.yaml | 0 .../charts/trident-operator/values.yaml | 0 .../logo.png | Bin .../pack.json | 2 +- .../values.yaml | 2 +- 48 files changed, 8 insertions(+), 8 deletions(-) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/README.md (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator-100.2602.0.tgz (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/.helmignore (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/Chart.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/README.md (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/crds/tridentconfigurators.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/crds/tridentorchestrators.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/NOTES.txt (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/_helpers.tpl (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/clusterrole-rancher.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/clusterrole.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/clusterrolebinding-rancher.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/clusterrolebinding.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/deployment.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/postdeletecrdshook.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/postinstallupgradehook.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/predeletecrdshook.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/serviceaccount.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/tridentconfigurator.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/tridentorchestrator.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/values.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/logo.png (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/pack.json (91%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/values.yaml (98%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/README.md (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator-100.2602.0.tgz (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/.helmignore (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/Chart.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/README.md (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/crds/tridentconfigurators.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/crds/tridentorchestrators.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/NOTES.txt (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/_helpers.tpl (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/clusterrole-rancher.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/clusterrole.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/clusterrolebinding-rancher.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/clusterrolebinding.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/deployment.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/postdeletecrdshook.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/postinstallupgradehook.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/predeletecrdshook.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/serviceaccount.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/tridentconfigurator.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/tridentorchestrator.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/values.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/logo.png (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/pack.json (92%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/values.yaml (99%) diff --git a/packs/trident-operator-26.0.2/README.md b/packs/trident-operator-26.02.0/README.md similarity index 100% rename from packs/trident-operator-26.0.2/README.md rename to packs/trident-operator-26.02.0/README.md diff --git a/packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz b/packs/trident-operator-26.02.0/charts/trident-operator-100.2602.0.tgz similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz rename to packs/trident-operator-26.02.0/charts/trident-operator-100.2602.0.tgz diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/.helmignore b/packs/trident-operator-26.02.0/charts/trident-operator/.helmignore similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/.helmignore rename to packs/trident-operator-26.02.0/charts/trident-operator/.helmignore diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/Chart.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/Chart.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/README.md b/packs/trident-operator-26.02.0/charts/trident-operator/README.md similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/README.md rename to packs/trident-operator-26.02.0/charts/trident-operator/README.md diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt b/packs/trident-operator-26.02.0/charts/trident-operator/templates/NOTES.txt similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/NOTES.txt diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl b/packs/trident-operator-26.02.0/charts/trident-operator/templates/_helpers.tpl similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/_helpers.tpl diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/deployment.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/deployment.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/serviceaccount.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/serviceaccount.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/values.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/values.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/values.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/values.yaml diff --git a/packs/trident-operator-26.0.2/logo.png b/packs/trident-operator-26.02.0/logo.png similarity index 100% rename from packs/trident-operator-26.0.2/logo.png rename to packs/trident-operator-26.02.0/logo.png diff --git a/packs/trident-operator-26.0.2/pack.json b/packs/trident-operator-26.02.0/pack.json similarity index 91% rename from packs/trident-operator-26.0.2/pack.json rename to packs/trident-operator-26.02.0/pack.json index 556e0321..8d55e884 100644 --- a/packs/trident-operator-26.0.2/pack.json +++ b/packs/trident-operator-26.02.0/pack.json @@ -12,5 +12,5 @@ ], "layer": "csi", "name": "csi-trident", - "version": "26.0.2" + "version": "26.02.0" } \ No newline at end of file diff --git a/packs/trident-operator-26.0.2/values.yaml b/packs/trident-operator-26.02.0/values.yaml similarity index 98% rename from packs/trident-operator-26.0.2/values.yaml rename to packs/trident-operator-26.02.0/values.yaml index be45f274..3d7ee6a3 100644 --- a/packs/trident-operator-26.0.2/values.yaml +++ b/packs/trident-operator-26.02.0/values.yaml @@ -2,14 +2,14 @@ pack: namespace: trident content: images: - - image: docker.io/netapp/trident-operator:26.0.2 - - image: docker.io/netapp/trident-autosupport:26.0.2 - - image: docker.io/netapp/trident:26.0.2 + - image: docker.io/netapp/trident-operator:26.02.0 + - image: docker.io/netapp/trident-autosupport:26.02.0 + - image: docker.io/netapp/trident:26.02.0 charts: - - repo: https://github.com/NetApp/trident/releases/download/v26.0.2/trident-installer-26.0.2.tar.gz + - repo: https://github.com/NetApp/trident/releases/download/v26.02.0/trident-installer-26.02.0.tar.gz name: trident-operator - version: 26.0.2 + version: 26.02.0 # Add Pod Security Standard label to trident namespace. namespaceLabels: diff --git a/packs/trident-operator-addon-26.0.2/README.md b/packs/trident-operator-addon-26.02.0/README.md similarity index 100% rename from packs/trident-operator-addon-26.0.2/README.md rename to packs/trident-operator-addon-26.02.0/README.md diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz b/packs/trident-operator-addon-26.02.0/charts/trident-operator-100.2602.0.tgz similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz rename to packs/trident-operator-addon-26.02.0/charts/trident-operator-100.2602.0.tgz diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore b/packs/trident-operator-addon-26.02.0/charts/trident-operator/.helmignore similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/.helmignore diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/Chart.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/Chart.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md b/packs/trident-operator-addon-26.02.0/charts/trident-operator/README.md similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/README.md diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/NOTES.txt similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/NOTES.txt diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/_helpers.tpl similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/_helpers.tpl diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/deployment.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/deployment.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/serviceaccount.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/serviceaccount.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/values.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/values.yaml diff --git a/packs/trident-operator-addon-26.0.2/logo.png b/packs/trident-operator-addon-26.02.0/logo.png similarity index 100% rename from packs/trident-operator-addon-26.0.2/logo.png rename to packs/trident-operator-addon-26.02.0/logo.png diff --git a/packs/trident-operator-addon-26.0.2/pack.json b/packs/trident-operator-addon-26.02.0/pack.json similarity index 92% rename from packs/trident-operator-addon-26.0.2/pack.json rename to packs/trident-operator-addon-26.02.0/pack.json index eae1740e..b9130116 100644 --- a/packs/trident-operator-addon-26.0.2/pack.json +++ b/packs/trident-operator-addon-26.02.0/pack.json @@ -13,5 +13,5 @@ ], "layer": "addon", "name": "csi-trident-addon", - "version": "26.0.2" + "version": "26.02.0" } \ No newline at end of file diff --git a/packs/trident-operator-addon-26.0.2/values.yaml b/packs/trident-operator-addon-26.02.0/values.yaml similarity index 99% rename from packs/trident-operator-addon-26.0.2/values.yaml rename to packs/trident-operator-addon-26.02.0/values.yaml index 9b251ac0..4e7f463f 100644 --- a/packs/trident-operator-addon-26.0.2/values.yaml +++ b/packs/trident-operator-addon-26.02.0/values.yaml @@ -5,7 +5,7 @@ pack: namespace: trident content: images: - - image: docker.io/netapp/trident-operator:26.0.2 + - image: docker.io/netapp/trident-operator:26.02.0 charts: trident-operator: From 6df0aee4e549c95e15bc22eca479d49a7e849d13 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 25 Mar 2026 08:55:01 -0500 Subject: [PATCH 04/10] modified: packs/trident-operator-26.02.0/values.yaml --- packs/trident-operator-26.02.0/values.yaml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/packs/trident-operator-26.02.0/values.yaml b/packs/trident-operator-26.02.0/values.yaml index 3d7ee6a3..66e247f4 100644 --- a/packs/trident-operator-26.02.0/values.yaml +++ b/packs/trident-operator-26.02.0/values.yaml @@ -4,12 +4,7 @@ pack: images: - image: docker.io/netapp/trident-operator:26.02.0 - image: docker.io/netapp/trident-autosupport:26.02.0 - - image: docker.io/netapp/trident:26.02.0 - - charts: - - repo: https://github.com/NetApp/trident/releases/download/v26.02.0/trident-installer-26.02.0.tar.gz - name: trident-operator - version: 26.02.0 + - image: docker.io/netapp/trident:26.02.0 # Add Pod Security Standard label to trident namespace. namespaceLabels: From 4f8cdde52e5f641d231dc14717058bf35edb109c Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 25 Mar 2026 16:07:46 -0500 Subject: [PATCH 05/10] modified: packs/trident-operator-addon-26.02.0/values.yaml --- packs/trident-operator-addon-26.02.0/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/packs/trident-operator-addon-26.02.0/values.yaml b/packs/trident-operator-addon-26.02.0/values.yaml index 4e7f463f..f35ae8e7 100644 --- a/packs/trident-operator-addon-26.02.0/values.yaml +++ b/packs/trident-operator-addon-26.02.0/values.yaml @@ -6,6 +6,8 @@ pack: content: images: - image: docker.io/netapp/trident-operator:26.02.0 + - image: docker.io/netapp/trident-autosupport:26.02.0 + - image: docker.io/netapp/trident:26.02.0 charts: trident-operator: From 9e280d6fe7cc6e91d5514d3233ea1bebb321c11c Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 29 Apr 2026 11:35:49 -0500 Subject: [PATCH 06/10] PAC-4031 - Upgrade elastic-operator pack to 3.3.2 - PAC-4032 - elastic-stack pack to 0.18.2 --- packs/elastic-operator-3.3.2/README.md | 51 + .../charts/eck-operator-3.3.2.tgz | Bin 0 -> 150538 bytes .../charts/eck-operator/.helmignore | 24 + .../charts/eck-operator/Chart.lock | 6 + .../charts/eck-operator/Chart.yaml | 26 + .../charts/eck-operator/LICENSE | 93 + .../charts/eck-operator/README.md | 20 + .../charts/eck-operator-crds/.helmignore | 23 + .../charts/eck-operator-crds/Chart.yaml | 23 + .../charts/eck-operator-crds/README.md | 16 + .../eck-operator-crds/templates/NOTES.txt | 1 + .../eck-operator-crds/templates/_helpers.tpl | 62 + .../eck-operator-crds/templates/all-crds.yaml | 11940 ++++++++++++++++ .../charts/eck-operator-crds/values.yaml | 7 + .../profile-disable-automounting-api.yaml | 29 + .../charts/eck-operator/profile-global.yaml | 6 + .../charts/eck-operator/profile-istio.yaml | 11 + .../eck-operator/profile-restricted.yaml | 12 + .../profile-soft-multi-tenancy.yaml | 18 + .../charts/eck-operator/templates/NOTES.txt | 2 + .../eck-operator/templates/_helpers.tpl | 418 + .../eck-operator/templates/cluster-roles.yaml | 133 + .../eck-operator/templates/configmap.yaml | 88 + .../templates/managed-namespaces.yaml | 13 + .../templates/managed-ns-network-policy.yaml | 228 + .../templates/metrics-service.yaml | 22 + .../templates/operator-namespace.yaml | 9 + .../templates/operator-network-policy.yaml | 59 + .../charts/eck-operator/templates/pdb.yaml | 19 + .../eck-operator/templates/podMonitor.yaml | 42 + .../eck-operator/templates/role-bindings.yaml | 98 + .../templates/service-account.yaml | 15 + .../templates/service-monitor.yaml | 34 + .../eck-operator/templates/statefulset.yaml | 166 + .../templates/validate-chart.yaml | 29 + .../eck-operator/templates/webhook.yaml | 535 + .../charts/eck-operator/values.yaml | 377 + packs/elastic-operator-3.3.2/logo.png | Bin 0 -> 5810 bytes packs/elastic-operator-3.3.2/pack.json | 39 + packs/elastic-operator-3.3.2/values.yaml | 394 + packs/elastic-stack-0.18.2/README.md | 87 + .../charts/eck-stack-0.18.2.tgz | Bin 0 -> 45047 bytes .../charts/eck-stack/.helmignore | 25 + .../charts/eck-stack/Chart.lock | 33 + .../charts/eck-stack/Chart.yaml | 47 + .../charts/eck-stack/README.md | 93 + .../eck-stack/charts/eck-agent/.helmignore | 24 + .../eck-stack/charts/eck-agent/Chart.yaml | 10 + .../charts/eck-stack/charts/eck-agent/LICENSE | 93 + .../eck-agent/examples/fleet-agents.yaml | 24 + .../examples/system-integration.yaml | 133 + .../charts/eck-agent/templates/NOTES.txt | 6 + .../charts/eck-agent/templates/_helpers.tpl | 51 + .../templates/cluster-role-binding.yaml | 33 + .../eck-agent/templates/cluster-role.yaml | 22 + .../eck-agent/templates/elastic-agent.yaml | 89 + .../eck-agent/templates/service-account.yaml | 22 + .../eck-stack/charts/eck-agent/values.yaml | 257 + .../charts/eck-apm-server/.helmignore | 24 + .../charts/eck-apm-server/Chart.yaml | 10 + .../eck-stack/charts/eck-apm-server/LICENSE | 93 + .../jaeger-with-http-configuration.yaml | 29 + .../charts/eck-apm-server/templates/NOTES.txt | 6 + .../eck-apm-server/templates/_helpers.tpl | 51 + .../eck-apm-server/templates/apmserver.yaml | 53 + .../charts/eck-apm-server/values.yaml | 108 + .../eck-autoops-agent-policy/Chart.yaml | 8 + .../charts/eck-autoops-agent-policy/LICENSE | 94 + .../examples/basic.yaml | 16 + .../templates/NOTES.txt | 7 + .../templates/_helpers.tpl | 52 + .../templates/autoopsagentpolicy.yaml | 35 + .../eck-autoops-agent-policy/values.yaml | 95 + .../eck-stack/charts/eck-beats/.helmignore | 24 + .../eck-stack/charts/eck-beats/Chart.yaml | 10 + .../charts/eck-stack/charts/eck-beats/LICENSE | 93 + .../eck-beats/examples/auditbeat_hosts.yaml | 110 + .../examples/filebeat_no_autodiscover.yaml | 52 + .../examples/heartbeat_es_kb_health.yaml | 23 + .../eck-beats/examples/metricbeat_hosts.yaml | 158 + .../examples/packetbeat_dns_http.yaml | 37 + .../charts/eck-beats/templates/NOTES.txt | 6 + .../charts/eck-beats/templates/_helpers.tpl | 51 + .../charts/eck-beats/templates/beats.yaml | 75 + .../templates/cluster-role-binding.yaml | 35 + .../eck-beats/templates/cluster-role.yaml | 22 + .../eck-beats/templates/service-account.yaml | 23 + .../eck-stack/charts/eck-beats/values.yaml | 181 + .../charts/eck-elasticsearch/.helmignore | 24 + .../charts/eck-elasticsearch/Chart.yaml | 10 + .../charts/eck-elasticsearch/LICENSE | 93 + .../examples/hot-warm-cold.yaml | 198 + .../ingress/elasticsearch-ingress-aks.yaml | 26 + .../elasticsearch-ingress-eks-alb.yaml | 37 + .../elasticsearch-ingress-eks-nlb.yaml | 27 + .../ingress/elasticsearch-ingress-gke.yaml | 36 + .../eck-elasticsearch/templates/NOTES.txt | 6 + .../eck-elasticsearch/templates/_helpers.tpl | 51 + .../templates/elasticsearch.yaml | 78 + .../eck-elasticsearch/templates/ingress.yaml | 48 + .../charts/eck-elasticsearch/values.yaml | 393 + .../charts/eck-enterprise-search/.helmignore | 24 + .../charts/eck-enterprise-search/Chart.yaml | 9 + .../examples/with-custom-configuration.yaml | 19 + .../templates/_helpers.tpl | 62 + .../templates/enterprisesearch.yaml | 62 + .../charts/eck-enterprise-search/values.yaml | 108 + .../charts/eck-fleet-server/.helmignore | 24 + .../charts/eck-fleet-server/Chart.yaml | 11 + .../eck-stack/charts/eck-fleet-server/LICENSE | 93 + .../examples/fleet-server.yaml | 17 + .../eck-fleet-server/templates/NOTES.txt | 6 + .../eck-fleet-server/templates/_helpers.tpl | 51 + .../templates/cluster-role-binding.yaml | 33 + .../templates/cluster-role.yaml | 22 + .../templates/fleet-server.yaml | 64 + .../templates/service-account.yaml | 22 + .../charts/eck-fleet-server/values.yaml | 169 + .../eck-stack/charts/eck-kibana/.helmignore | 24 + .../eck-stack/charts/eck-kibana/Chart.yaml | 10 + .../eck-stack/charts/eck-kibana/LICENSE | 93 + .../examples/http-configuration.yaml | 36 + .../examples/ingress/kibana-aks.yaml | 28 + .../examples/ingress/kibana-eks.yaml | 48 + .../examples/ingress/kibana-gke.yaml | 31 + .../charts/eck-kibana/templates/NOTES.txt | 6 + .../charts/eck-kibana/templates/_helpers.tpl | 51 + .../charts/eck-kibana/templates/ingress.yaml | 48 + .../charts/eck-kibana/templates/kibana.yaml | 66 + .../eck-stack/charts/eck-kibana/values.yaml | 194 + .../eck-stack/charts/eck-logstash/.helmignore | 24 + .../eck-stack/charts/eck-logstash/Chart.yaml | 10 + .../eck-stack/charts/eck-logstash/LICENSE | 93 + .../eck-logstash/examples/basic-eck.yaml | 44 + .../charts/eck-logstash/examples/es-role.yaml | 25 + .../eck-logstash/examples/monitored.yaml | 49 + .../charts/eck-logstash/examples/multi.yaml | 78 + .../charts/eck-logstash/examples/volumes.yaml | 107 + .../charts/eck-logstash/templates/NOTES.txt | 6 + .../eck-logstash/templates/_helpers.tpl | 51 + .../eck-logstash/templates/logstash.yaml | 58 + .../eck-stack/charts/eck-logstash/values.yaml | 115 + .../charts/eck-package-registry/.helmignore | 24 + .../charts/eck-package-registry/Chart.yaml | 9 + .../charts/eck-package-registry/LICENSE | 93 + .../eck-package-registry/templates/NOTES.txt | 6 + .../templates/_helpers.tpl | 51 + .../eck-package-registry/templates/epr.yaml | 35 + .../charts/eck-package-registry/values.yaml | 57 + .../examples/agent/fleet-agents.yaml | 122 + .../eck-stack/examples/apm-server/basic.yaml | 52 + .../jaeger-with-http-configuration.yaml | 60 + .../eck-stack/examples/autoops/basic.yaml | 30 + .../examples/beats/metricbeat_hosts.yaml | 217 + .../examples/custom-elasticsearch-kibana.yaml | 78 + .../examples/elasticsearch/hot-warm-cold.yaml | 199 + .../ingress/elasticsearch-ingress-gke.yaml | 40 + .../examples/enterprise-search/basic.yaml | 42 + .../with-custom-configuration.yaml | 52 + .../examples/kibana/http-configuration.yaml | 24 + .../examples/kibana/ingress/kibana-gke.yaml | 80 + .../examples/logstash/basic-eck.yaml | 113 + .../examples/package-registry/basic-eck.yaml | 95 + .../charts/eck-stack/lint-values.yaml | 3 + .../charts/eck-stack/templates/NOTES.txt | 10 + .../charts/eck-stack/templates/_helpers.tpl | 48 + .../charts/eck-stack/values.yaml | 60 + packs/elastic-stack-0.18.2/logo.png | Bin 0 -> 5810 bytes packs/elastic-stack-0.18.2/pack.json | 36 + packs/elastic-stack-0.18.2/presets.yaml | 260 + packs/elastic-stack-0.18.2/values.yaml | 80 + 171 files changed, 22812 insertions(+) create mode 100644 packs/elastic-operator-3.3.2/README.md create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator-3.3.2.tgz create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/.helmignore create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/Chart.lock create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/Chart.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/LICENSE create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/README.md create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/.helmignore create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/Chart.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/README.md create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/NOTES.txt create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/_helpers.tpl create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/values.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-disable-automounting-api.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-global.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-istio.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-restricted.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-soft-multi-tenancy.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/NOTES.txt create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/_helpers.tpl create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/cluster-roles.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/configmap.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-namespaces.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-ns-network-policy.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/metrics-service.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-namespace.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-network-policy.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/pdb.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/podMonitor.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/role-bindings.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-account.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-monitor.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/statefulset.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/validate-chart.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/webhook.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/values.yaml create mode 100644 packs/elastic-operator-3.3.2/logo.png create mode 100644 packs/elastic-operator-3.3.2/pack.json create mode 100644 packs/elastic-operator-3.3.2/values.yaml create mode 100644 packs/elastic-stack-0.18.2/README.md create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack-0.18.2.tgz create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/Chart.lock create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/README.md create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/fleet-agents.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/system-integration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role-binding.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/elastic-agent.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/service-account.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/apmserver.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/examples/basic.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/autoopsagentpolicy.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/beats.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role-binding.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/service-account.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/elasticsearch.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/ingress.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/examples/with-custom-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/enterprisesearch.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role-binding.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/fleet-server.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/service-account.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/http-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-aks.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-gke.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/ingress.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/kibana.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/basic-eck.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/es-role.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/monitored.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/multi.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/volumes.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/logstash.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/epr.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/agent/fleet-agents.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/basic.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/autoops/basic.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/beats/metricbeat_hosts.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/custom-elasticsearch-kibana.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/hot-warm-cold.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/basic.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/with-custom-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/http-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/ingress/kibana-gke.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/logstash/basic-eck.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/package-registry/basic-eck.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/lint-values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/values.yaml create mode 100644 packs/elastic-stack-0.18.2/logo.png create mode 100644 packs/elastic-stack-0.18.2/pack.json create mode 100644 packs/elastic-stack-0.18.2/presets.yaml create mode 100644 packs/elastic-stack-0.18.2/values.yaml diff --git a/packs/elastic-operator-3.3.2/README.md b/packs/elastic-operator-3.3.2/README.md new file mode 100644 index 00000000..37d43fa4 --- /dev/null +++ b/packs/elastic-operator-3.3.2/README.md @@ -0,0 +1,51 @@ +# Elastic Cloud on Kubernetes (ECK) + +Elastic Cloud on Kubernetes automates the deployment, provisioning, management, and orchestration of Elasticsearch, Kibana, APM Server, Enterprise Search, Beats, Elastic Agent, Elastic Maps Server, and Logstash on Kubernetes based on the operator pattern. + +Current features: + +* Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats deployments +* TLS Certificates management +* Safe Elasticsearch cluster configuration & topology changes +* Persistent volumes usage +* Custom node configuration and attributes +* Secure settings keystore updates + +## Parameters + +* Kubernetes 1.25-1.29 +* Elasticsearch, Kibana, APM Server: 6.8+, 7.1+, 8+, 9+ +* Enterprise Search: 7.7+, 8+, 9+ +* Beats: 7.0+, 8+, 9+ +* Elastic Agent: 7.10+ (standalone), 7.14+, 8+ (Fleet), 9+ +* Elastic Maps Server: 7.11+, 8+, 9+ +* Logstash 8.7+ + +Check the [Quickstart](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html) to deploy your first cluster with ECK. + +For general questions, please see the Elastic [forums](https://discuss.elastic.co/c/eck). + +# ECK Operator Helm Chart + +A Helm chart to install the ECK Operator: the official Kubernetes operator from Elastic to orchestrate Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats on Kubernetes. + +## Upgrade + +To upgrade your ECK implementation: +1. Review the specific upgrade path for your current version in the official documentation. https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html +2. Ensure compatibility with your Kubernetes cluster version (1.25-1.29). +3. For Helm-based installations, refer to the Helm install guide for specific update commands. + +## Prerequisites + +- Supported Kubernetes versions are listed in the documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html + +## Usage + +Refer to the documentation at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html + +## References + +Documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html +GitHub Repository: https://github.com/elastic/cloud-on-k8s +Community Support: https://discuss.elastic.co/c/eck \ No newline at end of file diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator-3.3.2.tgz b/packs/elastic-operator-3.3.2/charts/eck-operator-3.3.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..8209f26bd99219ea0f3671ea641f289be69f3348 GIT binary patch literal 150538 zcmV*6Ky$wziwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ{cHB1dFgSnrQ{Zc7PAq>Sb+w)JZhreIvNF+$FIvf&IloPE zVl;{F#)t$s04TY~<30Nt`+EB%dr-I#yfs@=TXtr|b7o>SK~$koHxvp5l3Yf-AOb5c zc8(WVsCbF<>`$9~c6WDopB)~;e|L9xoB!S0-8=Zx-qXEj2m8+s_jS9ygQw4){R!=E z6pNmxlnRSK?cNzyb8vr<2N(3OL`cfn1YPZqa8dX_58{J(f0UAfu#~Wb5;++~DB&!n z3K~!*70$Bb^A~c25W_i{ppc)UM5OwSAO)9Haj~4B@py#LRTG3v1T9RbCmEKCCg?ch zWr{dMKb2D=7*Rx`$0x@>Z6VkFXu&nag;Ir_?Ci{`T9nf`;rR|Ree5KTq-OVqsZYV2^NX|`zJcZ438po zboL5e5OGDsC_>*8tfX$u6cL4>lAsIsg&W<4!pY?*LT}tyF3TzLl>hp_zT1oU_u}1X z_v=xPDN~p-A^;tdW10b-|5t^+C%^4~)SiryS{7u2a8YD5!J5{i#x#6xR(yCq!_%Sv zGoD;-6vlx5-#yrU*4F>K5BmQ;o~C-ggBGWABGm-R1>S%9Y_gjkJWcn%nH}KiH;4PX z>C@!dH`8yvO{UMD?mau)CExDtK0i#qc{=+xO_Oi;zkQz0z9l%>$N1a*!{^g)Msvb6 z0wkTF@&4}qvuO7)+TDA*_s!(++sW?p`1!ZbzukNKbbs&v8b7G6TR%1VzrtBbQ4*A3h8CLMC8JDfW0&ehj3oak2?IhuLVGd#xtI%_YBJI+L;Q+}Ye9h! ze)xtQOn+WxDN3mnWnt$yK%LJ3OE-ckL84^Lj5npT84-jjXFWCa{TThs>;Mh=b~X$y zDanXM#A8r!MVO*E%a$m?r6hi3QO%K&4Ku+Zeu@K5BQ;yYHnNNw(!}Oe8@D%zLC5uPlHxsls8qplj$z+7kqri!9y(QePZV)s>g&;Hf zzG6#3=2R-Ngo%zDen`rbOCrK`97!&BYReuCwJ5XfjAu0IhpIJ80ZlZF>VpY7oxSGj zOb|(!g5DIK_jRN2Jl2fPxI(EGJCbhef8a7xKp-=%)hb&9Q+Pf>tjsd#eMSq3WI+-- zqk&M@6bZ0}o^*_UI6b>S3D1j+YDsA#r1d0K5+vn9VMS(Tc0rVR8w0?%T3DRqq?|~= zUau2DIn`FI;qpzO`&y%8E5=>=%z(oq?aK^`*x1tjw|tk_e(?4T!YADGn69UJwS; z?*!2UX^=J^HM@1{Ig~&Rr@<-iHOgqNr^cBw2S^K$?LfD2;>4Z-jpDmYW=BoYe<`b zwc=5C{}c4#V*~n2JSCY2j8hX=!WqiUi#vffoja%nPd7Ezf~WDQ-k*g6U^X%+2ctEJ z3zC$;Kv@#{0^Fr3H)XV^pmjfOxd!3Cbuj4DbjbEkqA=3fX!=;-B3V1Jxy4WkkNfo4Q5 zr6RcE3h`F#Om}kK&nb5-?cMU-+`S%b&trg2Cs?#L-Sa;O=_s6F)eKQmnYdH{s1#E`HnDmcr*2g8EuRviQk7?-dsKOt2= zngBULx%P5ae{Wj8f`+{vfdRs4k1DWj+}DX9SdnAnJ6|NcAnAEvbXqF{>t#n0ng#~y zvF+oWXWD-b{`#J>l(M{c&ns){0seL|oB?pra%) z4kojsH|*=ax6N#;xBQYY2SwIi86VSN*Wp89WSb*w0k+20VU3Y}=hew0bg_QdxQ__B z<26R8!PQJujY}Fpb(amRq`!w%uhq;=G>zNiomMTqu);Ak)NZaQ$+lZMQ|VXJsa;3A zbve9OBrh_oz_VoD15*Mgl+DfTSRwA1o};r@$Tro0T*IyzX=#E-R*~rsG0JhF$6M{n zcr^!<3FN+EjrH&;tS&=60XzU57{hb&^6292>GAJJXRm(0I6438$@%X;pT9JFOOu_Q zj3+o-aH%HW?CgGT0OkFRZPh?EE} zW#rex2usNmYWZeL)HNZjl6^x)56e5{*JQfj{IWh-9XdtR$hOr)_u+)v^mrCd@b@K4 zGat!0J9!lmmT>L-93Sa+QlY77;wIeno)DqvOs_gfjI^0|k%tt~nGK#C6QLj$1EVl3 zOoVy`FNJ=qU+P5`Os2(Vf{y3kePmU&8E_&*$}b)Ck|#hMAl17K)_MAk zd_jeSlu`lSgoy|l*|b0{9O*jLpH0wsN9D!N*Z3Zxi!d}Kh*W|ms*b8wt%*Wha~NlcPybGI6Io7ks+954oAJFIt7Ksn zt3ku5z8Y>`6`M|1jjPe(6Afww@^u6}<^`{$0{-pen^!oaDF#Fw)G0M1f>;XIeE;p? z;Q{nx*4u$<(_I96{Pw+B?SmX>IrokMRtuC8N#_h~kc(Y9VKTmC5Gv5hq>C55ESbf- z3l(U!{hFw2E-uaLM4OW{o;n%Vz+P(yoY_Wxs^gIjrNC5J{iLa{dolW%=XuF&^rX@j zm*tdza{!?SV^k&23Bs8oLJt!izdqF(RvV$emn^BicO$b3*M?ccK~#ox8>LKI4G@N; ztQ+?O6;l0;s>P4yYgDp~NQub%BBKda*-~3a4dM9c=eMVCUQf`O;0Ylq!U`>UX~MCB z%FDPOQ(9nITPP+(FfCTe0%2+BqnqVe!{Mc@!jw2kGzxkk8ON#gfm9O#hJnVTV7NhO zsWw=@czW^r!iM>J)=ZDk@q#3mK2PM*b7oBWPRbLx14Ag3+_Aotj4U%yHs48^j0&Dc z_TA1S_#-kud$>6lM5|LwwIk?JbzGP-d2HO7Chm1V<{pQjf3z-EdjJ8(lhGq&6(Cq6 zX@1aa^}T1`#`{kXoU%gd^n@hw@(m9)PhBl;6G z-XD)DY+&Up`AoekGezGLhFP*)%eV0~4V@b!b-F*4>kcDjdPL;CB1~!|gP^Ka1JWxC z-~dWoEYo3Nxj9gRjs$I2ck~Dp#?jfS@oZ1eY6=H*NOQb_5{O5QudPQiQY0feQNj`@ zrE)#$6hu&-8jFs~A_Y5ta{LqW9ikK~3`}Fvr63H>nJi5>-$4p}`IKr?HZAq6A1^Rt zBtt1-Tmcp|S=3sf#5TFc(kT64zo@x#=;(Ta#tV|=AbFO>&9-32(xX}iJVF_t|CNX- zm(2)G#^-abr806wvKakU+eg|%xc4n`!(27sO zJGATGZTlD7(2Qz_J~!E2(9-VJ%wajF2ZLGn*TI*jtCUR3c_regHrxps?~X?R;_(Yo z2$GmY4Q(Rzq|-#k#_q#bMX=pO8M@k!_YULTE!Xl)dlU6QrZ6$2_XU@se`$Nxevf{? ztN+jPk9!H*Lqgjf@GmO}6SO<3elZI<>(zW3*v|9Olrq4;2$EOYeX!vnY1yla3xb@& zULou=8f~xthLxZG@$Jitogd%6J*(K$fhR02I5q246hL#~(h!5Ve;uwz4=-;HQ^R;- zl%E+C%JC(UDCbfkNtoMUFc~NU^^K&^G>6kblzOVYJG?NjE*57+}@gx?4~@LWq95N zuRv)JDa)E5D2tFL=i1%eWr5h@XtN(bxv6qm<{EvUo}qZnyi*43-u@;GAa5 zMy&Dl49(2%Ztv@iOG&lAYj}5pPS36mxAp%&1MVJ=(PLaH9_ht!qO||z`mR`767|9; z-FA*fYYB~=f^KI}n82B)Tc`byey6g7@gJcldXfC3ip@GO*4btJS_2pdqZvb>O(~KW zu&{ysdoAoH@|-Q}QF|jAQ?3>+7-wkBj2B0kT+o?v9<*6XVk8x2DHbWZY{xjz@B+Dx z?*uSH=1=opyU1hbSWI9Ho!KyeJP=Upw1%o1gP@FkFDdt1qBrfVml-DYu^86TL^;kV zVd^c-2`>SrwAqi4*oBmR0b!JihOnoMvrMbzlytE~tM3VVwkxeR2nF*72-F377>9m1 z6SVh@!^Q{4{My+6(u~7wBkLl-rbf0z1(x!fi`3Z#&FlVa$T%(wy&5;$lkSb(+W_FU z10NVbC?jmH7Fu^3{OmRdxlml-IWb9zZRIV^Yn15sM7lf?^1i?jAatk%ySP_G=swa~ zCZ&(S(V5TRxTYzo1F%bUv%;h{b<-uk=>EE}cF7Y}6!ay*DG?_bF?$Q`QDx8o5#J)% zf(A5wq_W;s2K~M|GIhRM5S*#SHe#Gb;2rCAzEu(~@Pg%%B@4kB zFJ;(Wi|gK0?;IKvwC7mQ`NHd_-2%`3{QYU$^#;9EWPG_QZ`P(<8#T8oKNn!wo;4Q( z+$tGsCU}mX$9uc+F5>JOi;9Cfeg0Y=s$Eq8LG@>r20@(pOz>P&p_JNayBJN)2N^v= z=L8bklkStah3}&}Wz_ZCG~?5q9BVG$dBKx1C(L*dJGh{6o<1sgni~v8RfuOWkdK3S zkmFgO7GIAxk>t_``8q=Q5L>DU;(0>bx5_n(!{8?fqw$S)I|BI-LN+cHPE*;HD#{xn ztr4=X%)Ul5H>lZ7BX6kHS2I_rzWE-~lQQe}Rd4IP`KXGcuAyO&Rn*hoc{4WJQT2bl zAi_X_Lp*|H1WQuijiC&}Z2{5~WVu8;Ce|~tTBq&>`k%3~LvvB9AR7p{L#sCGb;i@& zx_j`>o6B0?&Q{_X9BqN#A(Ugd4R&Kv=(pC3O$9QxFnx=~+^0w@ftj3X@6WPEd&}rd zuaew0xq^?4t*iB9G6*e*S7yW~HcV%?9PPHZO*F&I>}}aoGr{tsi=+BF^;rZ9&bZLy zl?vxYkSrJ|n?_K$sc=A3!_w6_U`FtabX}PEww+0vy>@>}%I=stMI~zknN(WEdgC?a zVjN!B{5MN(2}+x?kTi;;nN0vN-R;FTCCq)}T&3V6kQbJaU`M?#g8#_uJ!zZk0?MEOqkA*Zm)5eyJ|6Dm*09O%N=)(V#&2yYYsm8a=lKFV>yQ;r;juiep z7Gxxu;2y9ACR*9u}0}n zvnggF{M6c$O0e6?dNf*N=Lqu zIM@#|a#|;HJ7v~8aUCKM%w)hN^|=hi?!S5Id_W+ywkXCM`nx6?a9=?4Cyc8nt2x#L z!0Tg}pm85tjIG~lRK&$4E&fUbopmlxIg*#Oun`0sE3~|R2hDRjb3$hL&c-CQ_n{5Y zw(f`Zc`ceKjyWsWptajqy}|y6_LwUN@h@-&TcVs`W-J&uyeCltr8oD5(JfdzwyY~^`i-@5QA5eU5Jo30wVjn*usa>AN zOZ4&Mf4T&I-ls?Ye_xQSAVS8fxO*w6)$+f;`}D9`|Lxh{^QRB;e;?0>4?9mrC+`av z$F3cCGZlgUMzo1$CgV?`X9w^?qA4+zXW+0(V4h8ZCcW%3&LC8%lDJko>R$$Xjko?M z&F#*|I2t3{7h$RX=Lm>#Y}Pu}7X7T$zR^EQoWU*~!bM?=(cB+pPG>&K0iF0gQscy$ z!@0^wPQXXS65*<3)(~~w8QzM*bmj@#D#&G<^uAw*=$Z8Wd<6rTe7F9rRycZ6m`+;e z1@Nr>cthk0L7AGN@t4Wq_{FW8MF(ab7T`S}L8l>kc=B<+{vvz?UPUfKqH~zC@<>ds?6T3;mv>3q?2IjMPM zuH-@&3H_ndwTRdxPlwtt>+v{Tbm~?%=QAoY%*X^a3++_`7g$k&!wwXl>w0YeF;BUflx|JmP6%oyrVay>4Y2p5ekAo6KaR5JVea6z(zne7h z?9(W6Ffe}Gs+UuGhV3NF9U8ykct_IN+6r*ep`u&RjU#bzro3XI6>Yj$?zYq5k<|dkZP#Qolm`v4F6p81W@x{8 zI^CT_E{I-mF~p5wW>65`WL~=0(SEw$jV)CLH}ve2emSzd<>=Kf?A9bk|k8fFliKmTv2i@ zM?oG$WW(HT2npvRr7Y~f-96~aPtu|L9rUny*Yvw0ljK>4Zc;iTa|{9gWe$0Fkg$VX zZgWX?cbZWd_P$n^1&3<%5h7Q_bR21hl2j_fl*zVDGE8&x%5JLJf16?lmVBD`b6l*4 zTQCy=5dgSUmG?U@K!=byM zzT}bOA|D(kE^=FRrSWGt*x=VMdA!75p0utWXnf#QLF?xl)3@J#$wZkFtOf}&h3lvM zzrx{~AHL)f;yGc%Lxff`_-Bp5%`ac_D7DwIu142wL#b~6+@Zz8w_h?Lq{7Li@x*NL z{UNF}zo10+{T|Y#>-CpRn9N=}H%JfH(2}A0GaP;J>z6!e?RD@qB*V4?L9a1E*Nd8J z=z9MpQ>4JjC7u&^2gV>}>g^p_TEAMFpq{s15JiG@LiNvtXZCnuM}VdkVSr=Ltg4F} zlsFjL%`(R>|3*`C-XA|ezl_JfwWp%06neY0uRZ43yRx_M?J?8a!N94dlAZk3v4pD5 zr;VT0PUdWUUAV^7Dh{Rp!}0_}aUg<&k^^p5`+`Cp;Rg+By`hHqf9@=g{--DZ$DKG9 zJiGgaaI5ow_V%6~HuL|U9~?g9|J}=DgV30z=rQA}3JtF)Nw$R^_XMQd_2sr)_xxyj}`xK zoM-4?$ab=C$kq3Cw-H>`QF{-fU3O+A$UY^#3aHbx8=uGV8i@wc6(!f>##Hu0#`C!# zbF4_DID9&>6-;jO9Z9LW&3AB1U+u%&^PGt%1&+|F&@DJgp*?N3C(<@CwiW#{o)b0R zMq_PQ^?$*xLYoHI{y^y<&>+%zYv`@eTo=?T?si)^ox#p7P&S@=qb72Fs^Y;Fs1D45a(y(2DiTkt(0i!P{DJmM}A z-wqXYPGZNJ|F%$9FUPx}w-(oHg8n>aOxu)Onz8=`b7Y)IJxykbTK%hvNa){SDXafs zmbdq3u{Md|9gW%sQMs$#+aM~R#58UYzq?q^O)}4&4D1FG*_aL9AWomiOm7gwjac#x zE6dFp`wb%Y3H*WEW4Ah;up@G^+12tLqZq?}Nm&5W zw-vu6>_$0#U6i^*&R|Cx{U;9|_r-r*cHCWKzkeD&|NVUT>C@)<&!@Zl5Aomoc$ylZ zl5^mISGc%SY%?gn)ORlY?z+PvN0Lim*9rPp!Ya-oAG&c zRo#38gI7>e}R%ei+2o*VoFA$v^5i?{0-SDsiMvmV{)inx{2(Ccr=DWVj83u56^^SkUa&e541-YRAB<>^k zGFo7{h!XuelJuXX!l4KI1jEsj=*kz}@0hyks({8DL8HX2l`|jYUNH41*&LX(wySGyd++DyO4$z$(Y@pjf zqovu z*LTR=TJyhuho0~E`SaezbGKY*m%e`t_RG(`Sbcal{`ACuT=|en1>PYLG*tiZ@cCXn z{-+~IG5*_^C4o&IRPv2>H~j9%`IH2JT)BTYe9w+I$} z)ebb9Kv6wbzXKO}s}6vDr{6#K#BJyql7D|QyuH5uHfmrX|My^juTlSRfA8tR-h=$# z$8%Hp|7uod+3S^cH^LzBtx9zaYnf<$HDlS=C0c}AS+C8jGjsU8J7?xATjMCIdCTKg zXnVt2O4|D*3ZD8qBkcN0C5!OFL=pI@9+q(r~`2F1^7GxOuyw`b^VcvANLq|5}*!)bA) zwl^{Xfkbq!X2*9V`}$@0LRr~63@7{%`rDVld$*RV<^(oJgC4_;Z{~LCy3oO~q^*Br zQTtSC-Qa zJ9zfIS^wqP!~XC6JhwSDboaFS&V688Exz|u(H(9Ai5mRe)8FdbLAt+L`-&I+`EBlY z=?1&T{VumXQq}g7y7Sj6XUCd>$O42b_D9APtvD`FnTNN>#yptYJkQ{x>Y{mBGiK{= z6tvEXJY+JppC0|+PGtOq`9B8-`_25HgS`j+e=m>K|Bu5%N*&j7G+y=G<-65cf@$4E zpLI@$4K#l6C2#r+%Kx3Se+K3MV0Zs{Gymt{=|ld{y*xM0|Iu#9(b?$*?0lS_Y2WX$ zui7_mz70zHRkw&W8f{gb-^r=mVCZOb2V6ICzV#+irQ5kj&&*)z(WVW>D0NpyXQ#;C z;YC%TSF`;hp0hogE~Vc<|vGjx7y9&OhwZH=r-EPCY^MXNFIT5eg4d!la-&eMP9 z)8qdY>2wp7Kg=@}|7+L(c)I`m*@ORgA5TL|7Ce37FZ}u*F8m5LX6Rm-6+z`wowYyx z@=J#}*Q#~!u!|5mWk*+-W||xZdiYCt0@10`>aXF>@%x_{ZggM!tsj8=gkIr;Rrt4l z`t(0fUvWk?huqx^46Xn7p6)g4KRtW)Q2*&(p1Uu*H(BNAzA7BGo$e6*fcXcO8|!_1 z_tz#MoKTOsKvdYDApbDP8g}t}1I8fuq8-Rpw?OOH3T>(59g^ScYSji$( zV6~W_o%)Zf5N_6#(d+)MS~4B+i&fpqMBsun3hN+L`}s})+H^5RoWk%*51F6!fb0oP zffwj+d#++UJ$`h*3%LpB@xgceQlB3GPwDt`4w#gw_(P&%+<#MF)Mj-4Bz{S+`@esad$g zJq{h^weEV4gXOaECg<%gw@TcnBDntrbI+gZZTAKX#w*?Y7Q;>_6Q9doPdG zFI56yjkoQxXJz@mhBV+(@m&9_{`*^gN$PcN8<19gr{Uiq5Z${(yr)g&RsgU$)K!7q z!3gqZwZ(w^=bP9B9NPce-)r6f{p{)CgZ$sebF1CE246S#yKc7GbW!W%6K*&)u)XP~ zQ~mSS##3MKo7jAETR5LO)NjAu^g+AZ9JM3iwvpR33J#XFH;iPmAobH{)t1n~uK7h} z((Jc{i7{VMW_bMKk`{j@g3gwZ)!yWvez{PYj5|8%VU3QKj~7_}MAig_#_b-)TU+5) zSo5{ue2$9K?Sf95R8jTSXR@j`Sn(xly$U>>WE|n>(#>V znjth2O3>U^qaW{#I}mM-!xojlA^zs8Rd~A=QF~vog6iKT_y?M~I7DqsA3yHc{l=XH z$BFQ%;;ns0lVJb)RtuiEPhZ6HD(QhZC0Gyv4w^xJ=L(A*QL-IVl3(uBMc$IgE-7~4 zy1j=T!q5El`F{#4GAlDl?zr~*({TOg!)NXD|9g86=fCdd(aXBcp6AC!Ap`HuGSbDp zWCOQXUKJl7-D%a;(0+Hm?Q}J+FK>`f)S2w_DKmnNrJ)IVeZx5vq{wK3>vuQVACIe; znbSfR_kd}@m2A$MIT>?Kpwg3C5HzDCOC=f;A-EVL#qB@ioJfi1WDKjFv59%x_g93e z*!~jq`gTEK|4MO$uQ*K+hBUm4Cd$m6hIev&;epk9PI*%1gee*OF2@P?r=K!DmpcMq zk0)sS%ZFdbYFUt9$CF>jGnx^p1i|^Q#A^doeqy$bp3c=F4yV=&kmpYQlqa_7lF9~$jn$G<^GLJ|R8efV|k8~r+- zeE9fr`@^qemi}FGrvLtRd`Xt__mZVV{4O|Gb}%15LPvsYzBLJ0m}x+AnP-$;%4*Ps z;0ckEhXAjLP^SBwr-pU{_y7h<=Zp*TdrqaKY+m(b_`~)x6FfK6)DsBbDGopUZh!gs zn;Ff9;r-qMSYy&p2G=lWZJ_R_Pc_mu$WY!4+}}R_HV&j@L6S>Z=Jp=qaZSrSE`+vD zU&U{&qKLo8lALL0dEB_Tc)SJbOD^#K(`T~Gn`w5Nenl=9@dgt&COe_^k$E7QQunViDfT+gWuj z3Ohn$+icwYJ+imXeg`Ua$K9nJw(Ho}=wY*!thQp>_x9_3bRIq@?5a5`LxDGEC+A0R z-<<#c`smfk#o5vEN#h7Q9Gm~4c5d4}V7lyXbLYD=h&VcLG;SAq3^6%-^Wyi@vyDU7 zD})jRywUl3XWg4v{_W)ZAK$$B>GzA1D`!6>YfyH!m!`J!^+(eBxkW?~rlVHv{Lh;c zzz?^t&fuO#>4Kow!A~`zy$Lv5UGcy@Rzuc~mv~fKW$4zJj++Qu8`;%`CF)4Sc80r8 z_im_n{&>Z+GA9ruZy5`4ZH($Mo^`WKi9u1nX}k~wr*Gg2Sby8`ZOIoPvDQ_=4cv&W z?7KE@!!tgxIZ$2l-i-2h(pBZf&gD0-Gk97hEb^F05)3{8$sOq0Uk!n-0AHsYb4jhJHOi zgj~?0&4v7d3aS1^)#69fe(e=q%4G9=qW@{LYe&XYpVd$`3xC}#JUp9GMpZyx_seGC zD4uCSuSb-EA8!e5WBWfn`+rwBqbXJ-f=a}9+yWfP|JvW%Yu5jHez^DiVgK(wo)0&u z|LE1(tqum7uT5!#H|>KA32f}3DM6HV9Rh+X4;np`Yy2W*5JXfWi{m%|<0{rvIM=ha zhEaUgM#0seNXd*cl5QBKW_`FOLKkg7wzQ^1&2JSC@a#gOhESOMv(9e+VDA?F1t`%;5mWFYMZ*|B}(9}{X|3kMA!~b zfI;2>eMxXi#ECY9l(Po?=de?+I(JmJ&|Yh(rZYrrZ=S9F__Y1Xxge&%3TMRa+zt)o zb1Sol=f+Qu{dcmwks5%j?f=2Er_KA{_nz(VKIH%0%d>_KZ=U?XDQx_5CdiyhCAyE9 z{ne^aHn)1;tQtzw{3f|T7N^?Uc+)2|!f=wY{Nk9npj<2EM7N6UMv6&h{yRxjl;Fse zSnab_dwaKbFfC~-w$g5jAA{hEPrC>uO9wsNbxMPpDto|@qAOO|G&JFsS7 zb|e|0YP;1fU)Gz#iz;uZ7UftkxeHZ!-+p<5=Y*-~@*C;y=Z_K|UG3qlSl~VLc7(w0 zm4bAvv)yQGEmm?!D+j-kpLWr@tz^xEJe|-uoIR|As{eK)IBudGu?+btZ^x6aQKorh zbI2S8Pu}B16V|JOb8&EWVXdd(RbA!LuQBNX{#oxU~{ z;M0Z;2S9!2wyi@I{xqBxzCJ!bIeL3y|M>arh5MtiA7Ww32hqE+=oNWe@bs^~(EEef z^@&}P*M;tLiCdAcEo^rdGshSYqP7`Pn-YZ|lLxR*xs z^t%VC>z6v9-4`Qv8k_r-JGgTCLF8^Ka@AGz<~EoPC$rh)K??h&u(iPZO!C*9vwL$q zn}ErKOnw5HG$!#uFz+CkpVK_HU!MKPD3YooA3 z9LbfMcLl#kc&#*0$EwOBgX6Jb-gUCaS^_IeUNvD|M4wu!uco52dp}d@a5x%OK zsC#o#4Y&tM+nA&ouk=COZYpk{(;dB`%x%OEeGt6cZs3=S%LHeX&3paOnv?H7c-Yrp zy*$KUoKG4|^=EfY8!N|(sUAf5#v&|}qE~dK!pWsMumQKCQ}VEsTp_lalwX?IHm7j; z1qg2!TRq6_4dpiDbE&ZGh{amrbqyXQwqIgB5x+FCb%=d-X$_Hi5YyXv$h_!}(%Scs ztp8wR*GPG_^!(BU*5dU=$ZIE0JxK0N_f`rqw5Ba^a;b-I&I>Ld>#46YS=7P>gPyX-GBlK4+C@&>CeQ_d3aUr<2 z`=gkq1n-#Ug8zLKU&(~0WM@>>(@;bz`MKx1>#52A%hThN*B2+7hA|-j&ky&T_do7G zd-hQO<6fQ<)$|Mn9jwv<}8(XXpC*I`Hy#GH6KIe8&fe%%`K#qeti{ zNk{<~`;A85FHxx*!X+t^&(t**WE(AciSS$y0=KGU8R9c&p@_&Otg#Z#%pLy{O-aVD zW9a&r7fV6s3*~SfjovN@GSIm|bAg$XrhCLVi^%&VDbrkUwN z526sHz=EKZ2zq4{;x!kS(havF2xW-iWPuVa39`3MBgIDwMwe4}Aw@rFURJF}qyOe5 z%JCAeg)aoZqA95X)Zt}nN>IS{rF^ONgWYJv!9 zG&oKYBF$AfY^lc~6=sU!3`wF8pTT%$1glaIso~5@1_h{aM%A)OmbgBUoa<>!7MRV+ zwkxc)t$RtRNXq<5duD1;P1Yq@)&YztYtUWOa~Z%8L_^Vi@~KQpL0}+tEKMh)ik1tk z5S37gnIxKk(`6Hn#!zskh}gE!wwvI*co{wehBuAWf(YFKO^6&>YI){w3@%1TOiLd@ zjfVf<|MUM!qy$b$jx{raH3yCx>4__#%oi{{w!C$Q71YOAA#8T6+X(LWfngNz6-qKp zb6H0R?-4P)+XX4Eo|i|3{#N=Y=M^rWR2DT2Q5+NFAoRfgN@*a)1F& z!kJZM#s#$Ra*aKo1+%$rpxJ@Bq3a2#sTW`kl3Hd^3nHCvCoGkS<~d0zRwP@xfz(GJ zN3u*72pjCXfi`>6Sb%y(+Mgo}oXs@u`qPo^+i>%1D?dgeOQ{fHvUGxs*;2co*9(s3 zL`k^qt5{Z45UQ!B&`j`L!x`aBw!R7mACE?M)?lKS9Yzt*aqCdZ0H)yzqFJ%fs@il~ z>7PRIoH9)ss~O;q2xD|D#~JBy{WNqekOaK}-EyvVjS+M|Whn=?rg@Pq1O22ifp4Hf zpjvP}C+`bEq|BC{11KBSDe&kKdRtxR<0%3X5fYU$bVYe)77BGbZX@6h{RuT9XE92* zM^>SW3dw7lW#%>?tZ0I>Z0YY4GGbKIOx~*L`7}1olGQO&g;r%g5~4MUc4Qhj2l|2W zkzNN_dL8Vd6fY&hGyRk9Ly&}M4*@34fZXmH%9M-*fvb}h6rEIp<3#%wT9|(1*W^l@ z7HY_9&>=MuG$1tztB!JzZ9Tb8<>1y>svZCjqs3|nYWv}7+n_o4Lqz0Qb86;A5xt~% zO2Igfo*YRu!$SKaFemt0layb}?K*2%TcIu2HuxR9R7U4vq1kSUxE6VRz z6+JWRjE<(4)*-s56z6)mi?E>D5RWv31`#+YHe+A~V&K!X9lOdLUQ(877bqihoEgOy zKLIMdAW(JMxNh3SK6&C$eewjZ9$aX3r;Ljh=l{~l+K6&CG`wv4uB_IK4S>*lI zwx-^;YDmKZ&Bp}@ET18&;?d~IlO->oJVAoYwEJhQC!#E+S2Qhgrio&422USw<_&cS zop{x6a0U$nG%}xWBgr$+a)qEoaUmD92;3n@S1#t5(SI6-^_mY1!i1a`iGX@dNkXUI>X*4V@T0d16~Ud4h6+wROK{1cst{ zCh(NCsAL%c#Zqcp0;Xr=h+)~T;MW>8j#9YQ8c`*!(+)-(q|I(;Y0u({D_FHKC2#`H z6$Y_U%;gPOsnOK>U8zpJToqWysRlPR8a8c)-1<7*Pd?#ert@neAmh>K z2W^BoIJz?~a$~meR680?%(cQIlTn0zd0}r8hSn9?8sWKlNmH^z*iMr1GL1NkF29jG zNht(jYKO9vypIKxu6B~%oh1nAz zX-M2FyAcfLBBRnQ3Sf+BIGWyIxFsr)Wxhx=tU=;)3-=mNP5&2y&uB&>8()k3^`?}~BV5p1mIEKs z|9j8(>-v9xZ}<8BgZ{sdXZ2OLGn`2>8r84Mos5QV$hDuJ_dj>a;i<0e_>!RdN zaNRiNI~E`|z4~l``p=Ql&_=DB&PM)vv1s*ocK?o~CJmr=t<~<~;i1X0svm)p9pm-s zDCB)XOrO^--$uA&6TNpKGtRV1%vz+95$1T`8t zP{Gd;O8GUr#v(mBJDv1*XFlw@-n9FY(ndZ<_-ggNsh^wkAD%z;>3@4S`9>~(SR?;q zZ@-!U@$_*2>4W~ikEeAJ(ggkT+i0}v`X8reZ3>oF2ll!M`{r|x>ET)b>6Cve73CWf z|3Udbc(&h^|AYPA2l>B`=Tpf4sNm^Q{mv9gQ<7j28_x1qrcBUSe=!~*qy*N>^SGlW z?1-JRDKA-i2AQyE{AA@fkowX3=G()=gYkoQsy&_ZFNjovYR`BhN?=g_pEvFQvxCEj z{Lg!Ny5xWC59%(ZBKdewAK3L?;*ZQcLX4yH?~jgytRQz|-Zf1LlHqlGL~f%6VF_`G zJ@wbYZG0nyx^DCH7}yZZ@%fADw=OkhUVU!be+f^g{7XJlQSGY9JL!QT`9FNt%>R7; z{NTa=zn7;|{uRM_gvZ;+{A)U_0gT-jWG0QA&A3R2Rse&}LhnH>$Q(a0NhRSyAsg`+ zljO2-0%-@BRaKYeb07XcW&X!2IHJ-w%u(|O+<)`sO-=q`A4S$SS)xRwa_9I?w?Gfc z|MR`wM*Mg8@ZtW)`*~{NyZsR^3jgOpd=T%CQX&&U3$smga{N=ZV|H9h#dGAeKrNMJ z!TlMv;Vq>RO~O4O*gpxRTE7LRj0-j&U6SQB7b!${k4nYg6mk@yGqYQW&fO8y2)%T5 z9isaF-6*mfc)A0>gExxIUY%~;+{&wZKo<%pm!rsU&y6n2De)Bh`oF&0i}&~9-Dvmg zQI087m@*;&SCV6zO%O>g|5xqIqzU)h{zvvOXj1@3YFUtp%g+T*=&C+Vx1Im>VKRh>iZYux3FGyApA!Ajn?FtOY|H0v5)BYdm*AMc456_1WJ5NR@?+cejt{qU9 z$qwugkDlzhfk))}Aw{-23|Dtis2S}bERiaxYR%^ss)h=95 z`#|n+Tt-ARCk%uY3JVcYQ_)wu@&0bS3!gZP;_AIcg{^XTNl4Ks-L*=?echqrzV7)d z)bd|wS@=^)P<}SrL+$=fr2W%NniL2GuhT{+7z7Cq%sdBGsAT|1PxEZ1a^W=SD z%8;xENo=z=ME7Q0fH05V5$JG@$u+MND#gnD zU?GMzC}pxBIi6JYDB023>0b{nYCof{!P*eAY3Wb7!aIqM&Q9Yh-(P5PR5UDES<9HO zrOVeq{VS@yL%L(93yha#u&`7lsU46nJs?OSi1Y`W;2^OrR2nzBHalQai(HvO)srhC z6cQxib4LH^`}QZj!4*)|J^^eGnF??9o^!lJfpo%1_6l4b%G=hOJFh+5nKJxWLYhYW9XCBa8H<%u+ z)!+oX?aBkq$Gi4^FYTBZUn;%V0%HZsp{tiwon(_eV0H#@YLiJ)K z%V|!Pg!9rwDm``0ZjZrOLrkL3l9DzXoHBHbbCMlvLwLV)rDsJ(dJ@)}tE*ZaO zkqMspte*DRTStdl!*5BIe*6HcND?-cCm>}I>Wv}to=T9hV0CJ0!vZm#^mUQ51Egst ziPBw4Qc28) zvrT;&TlGhCh}M_7zpjA>$`S&&8E11-p5mPWk`t!hAuiB6P!Y2-yCCY_O((73>07(j zUSrnIs@7Iv>6cTdvarGk>nv07;4+2bi!v?m4wgR1<@m-d6^?t=2IfH285-Qt#KJxnyP+MrH!<# zK?R`IaI|WNvO}0T->cC{T7na4|KpqWPnUThGU_Y`W(ZFu&q_tyXdaXI6ZCWo${3-7 zh(xas=Ah@DgH!NSns$4;f8H7b2)R2No>h*!h|bU}{QhTFk%vmOJJion15xNTOUkU$ zM*+IiB@(=3sgVnC0Z>jE%p0Gfy&-5X>@Jq^(bvK60q2 zgsq)F*!{DwXv-DOnv6662ue~_2Fztp8GWuf1lZ#-jY*8`;@ZyKYk;FyrD>UwbZcE6 zR0~2iJ1}w$eLEvCB{Oa-hw%*fLJv8|;?mgDlw_o1(a?O}hUydx1tqC6TrwyN?w~@A z6iYfFQ;gnd@2(P%0WcQ5it8Sq6P#Mjtx!g=RGLTNS9>~t%MY$5d;^eNg)xn0KoLg{ zS5?r_%#}AS1BtMe<^})>f+c5eAW)Ln7X&rgZQB|?xq_2gP#ug)lnP84Nw;oHy0Dz4 z?%4?+gQ#qAdE>FV$0X!YES_7m+cWy{?yg@|qU^ zcQ)`f>9=6ul|BTeD9;U1xS(^&YRuE5P>4HBQI^5vI1N9@XJoAr6iVHM;!(M>9HIBV9pc2)(=%>q|ZCN??RUs`O z2)b2F%YS{dpqBq^!%;2Aun$44;JH&!OAt7|)e}%Ll_0@EI@n)k`B3`Lxh=?Lc62e4cD_dE`V(p76TBi>#zOFVD;+ANTqk?JBRxaSlGC>>kcP; zslol*tDcl!4+N(A6=W3#_$=y6i+8V->T&7T&)ecMwEk>py?(uB)l6-fD+o@P+YQ{- zh!8X|_Znu#^(w&xRCNQlki<@X@7)%@|fKbz3@V0F;U4cTB+_Ybor#&0q~o z%wlB>i`;d0YSEXp1}0&tjdNQMXazYsHS0;U6SIw9Px^smVok|fYgcBhDn8(@#>4dk zf3{s0iC&Zd!SD12*TQX^)q+p>Ik|8hfp#?2;Ik$2W$D}fH!3by&(JD?^``PPX!_cw z?)2nE*?hx<3qfSTL1Xtb3Zz%L@+W@7!{*Ct{c&>qQy-rVa#?j(_qyXUS9se9ZEH}l z`$qCYEw|lK#eT(XlUePgRk+-GG`v(rxgz6gjV^|gw$}Gc`ZKzE*usFe?utLd${8cD z^;Em70wT;(@`ReY7`WeyZ?O(s=UK52*xaJ32h#n#g`GMp{;9(i67wvs(2=ogTBY~) z6rp#e$ljS7L4H1eX(AmsG4~8Lv0d4XBtp~F_T~QcJ1){(GBJhQ&=!O#nqYsV_-3FA zEaf#9sRiZ!{1l)}$#@Is_y{FhCBem%a4+B4$txSFLXUZ24pj8-RYd3=E@*T~mbSx7 zvILb9V2SWtvzqF}6zWe93?s!AiQ$SXM})^-*&5}nne$!C4!zUZSGm2q2g;!4lm5GZ z2;indU@zFRf@mpaDB=0k-ey?cRb@66>{)V+?slbHv|+bb2)u@q-`zmh&=bCoyDJLc z)!LfEoQb+#&}88&_t@)N!;Evg!S2Mi7X`1p6uSWw$H(+4}(lUEo*+bbm%> z${7F?N;00&k8j_edAwHylzRGhgS_Q@t>H{zAzHZrvy2dBlK)R^1;W+N)DNu>Q0h+b zh9#P)w3`aoH0#=BHt9L0JA3*dMlU$~TA8gImJun@yPT)wU9g6F2MBj;511iNInPMT zQUrs%WrFw*wH`WL#c&*Mq2ftU9eQEzCSZ>E6ifv0*tT2`Kyod8( zd8wqk#k=jnqAQBw)w{}hc!#jEm-@o`QLC*LF6nB|v)}LhL|*3|e9i$u9Pl?kows>2 zUvpp-H_Ghq)%;(EgSZLza8u6VMqI;ta}4jzE!?bA_=k51KZ8R!s1F95!F3hFXLba? z6gTizPT+0NK`oRj2D~1?x;hgGe`a_IHxLKDN&P5t2a=Ro2P1dsymi;embt$9K{KG| zTBpnm<->!OE+4~V@61N+D#_I>+jFjY9pq8(>CxU%tlSKG1DL!b3OgBcy;q0n0OwWl z+_z5jVE@uHy}h44MGGQ~UsrdDpt-9vM(2!+Rq6TbB_*^9dh|97>MN|%F>ZHnTEK-*Shb|@`4VWjD$0B#h=Z}+8}zmY?(I|E;Zs*b z+S*&`bXA6Zm4vlKbWPdGGOpd3mmH_x;|#Neh}S$N=02hg?mn*s(n82|#Q>08@2J=%Bd zsIHg5#GKj@WR67&aRXPn13bmGw$F_ls%Zvpt|iADFw>B$YcSWJP zC7T;>53{B9arMj9h_4C-g^!);)3Z&=iSN`&|LK|5xxy3Qi@sS5Xn(KNf}x!fI%k7v zLjtpu=h+gRP|SSiR0hQZa?GGpIK4$#Bs3w>V=PfIkiLSDxsj>v_ib%EY_$+jrk&L7 zu;geZx5g76f?-JTznM9`rjj66cBe@tfH1=}i<|t&_>iPeNyS48!OQu=CILtnNAv7v zx}_4~OzK5}mO%UMkagtf}YuMnFPF+peUwA)ae-vQrw@v>>Sg3}RUa ztQAQU@Q}soC>c~QftT_`?j)Qgq)^h`0WKp()HN5El+E35JC7{4M6{3*W@%(!M0#H7 zz$vXY{a0@+HtMQ*PO&*HE{UZQFD*jW+W6|zc6j!LhZsD7*sxlGU0T;L4M1p`ty>wU zwcSk{K)RJ-x|thg!+AF~OoJn7nynifrge08&1~JmFb!$cw%NLkVOqy?u9>YH7$#?# zhLm=v-MW!w8kE3ZyS2V$8i29dZVgzbfxg$ZTSJy<0L*%JYuGXk$=_7+78*owu)*Tdv zDEd0`7mseHHWzT%!e_wi$-m}M0ZlXG<5Zh!sc>?MPS51FHU)&jf{}}qh&9gA5UCey z(rxOwJ!EGYtkSSXfEGXCoPr!!f`8A|pmwVaGZ?L^4=tl}ex)51za?p3FVCPf@p>!v zFU9})9MR84`nC3YBKxJ{xvdu5{SYgv8+OEkZdZ6>GcK&kH&vkQZj@z~A+KF4EU^7J z(R1qVE4N!6m0uT!Ebj6(s@VPjm}-|Kw&ixDNk=w9BB?7m(>PaTk-vzUwd&O+tcj+iC7uPv|#-Z6itr}dqU7L7wcV&xHywK>jB(OV;)#=v|EzNi6c zoc=b-E~U~Xk-5oqN<%HkaQUi)&?|!U;*9y^7wd?9Ez#H^k}abdPAHp?1I7E;hu()g zqLWIIw_`3^qi%r%>vj}g@&spNlNJE%Wq8XiT!%O&Tx3#)FuKOJWEGaO%!xhkSJQyV zYd`}FDncd0%XmJsU%Eq5%~_Zdbxmw(D?50}5o9b`Rh?xhB^kXMv{kN4*hjElmF^?b zYw*l3UYc?8ZC@2E$MPQ~5qRZkl8T0|Ots0Z(3a$}Wk{4$sVSrpf%Exr*rzf*j0f1P z=ar`d3gg6EU>?)3e9$%;+a=O?TN_U4N++=tixf@C0$)+S#vydUOA{02aKNoXkzB!0 z9-A6x*%IYEHESpBOY(wee7=OagRsU>kd9zg3L-&!DpEJ)o?OgJg?4ASXvzevO$NOe zwWzy0&Y`)+ONr)0Ris0bmiO8B)N3M*`(&~=)O@Z#kZbn?-uok>&0k3dT{!*_;Rm*v>zapG zcQRbs$35$oGH_RKd@?WbvWWlZ22NAN+XU1MV+70xc3>axqz%qHrG~Ekepu`GbEwJG!{$GT1(>^Q&rhR05LSr-dKV1 zqj{~*#Us^NmuDwP#zW`A*C|G{_ zt+=tzWV?Z#zDo|nr`q^%>SY_zp$x_P-iV70d;PS|9?1He9Wa({ZJw%|W?;W$^^V8@ zfV=OPtQEz*nezAQe;Hi1x7xz3eY7qbgaMU93gPkuDmleW!?EuS zX|U2>8r#nf=cd{q2j`Ckq>XAfQ|H;^wc?Q zu$Z)~Qg;Mn+f)-)ZJi?r3o~gw3e{sSG{$kIRBgqkaqxDG9{XA|Ug>WQdWL5Z-+xi! z%=MzxQt0Gx7ErB?^Kdi4( z3yH%u5G42aRE9E$rbMsbyY4P*KBu!VmeVs!{vtPQPUA#UEw$sC5~lQ*V%y*H(xO*|j1 zLc*f}zSNv|daNn?I`qK4j(tFksQQUXJy}Bm_MWM<26G!Jp28-HDY&PWghbZBQKZsaJ>u;M6IzDuhYfNP{SBVSFZgQt37+-wK^r@-QHtN_X(2@5AmyV}{G{cR|=@*iq+ErKrw!3|4qOcwjTsmVj zj|L++nwmqjTJHq7d2msj39fj;v*E@!4{9OH41s)U^Z;I!jgzm4hI=rcn9VZHmPoai&1%|e3PuUxPr7$Sk582WD37u zuj5vn+yq@GL-AkpJV8IR$gkf#vCTp*sxRYCk6s^DNIQ?zG+pn|uX)aYIF6nj96SZP z<>d4F`Z}hVVaQrE8%uh6yl_SUXKOI5?S@s+G%{raQdD22uEW5ltFP<2W3iunjUp&s zv$Ky1p}FLe@#~DFbAtF45$2@1BJWjrdI-uYg~JuIBqAwQT)?2kEYbh_c5m+>UZ^~K zq|uC^lsaYeNPijaM|$-Y0nqj2sbc`w@@s@5^fxlS;K?OXcgOkJ;nSzL$3}kL#^&wI zi`(L{CWE|z^+6@tc7@sDH+J)nxwHchD`EZQ%Y^3zW=ja5P!%D}n2o*>b!zHMB^s$RUl`2FS4_a`sc(`-jsX8i%%w_k-r-4o~+4g{5q z{-d;-C`NySReW`|>sqiNr@WSSxiKhv!3|_jQNl(T*_TwA zAN>~u_jQqd{Wt;N`=7e95L~hsi#8Y^Nc**qsUepsF(LR^kB!SFP~~9y;b`35PPIHO z`Yx%e=nZ>P3|>-I5EtxLV57RwgXj$@K8G}KOsg}q%gmxks69Ob5TA5PBSr?x&a%Y` z4baZ*y6%~dX*)GtY<}i(*vZNQr~7MmbAI_5#q!1Fm@USxts8ZAbACBHVYBbwnEya5 z&h`1tWh9@-J|4=}&H3fQ&#s2occMu>y%PAk@Y#j6EBr-byZ4*255!wkGas?nMqr~O z%iaScyB7?PciyG%1y`F@^+*pyV2xL%!mq#j>dUX@2(9fD!V*l%zg+)t{+ADD@870X zWsew$dc+|N!t4sA?vaKLEPm7b9Q(b4mWG4DE>(`W=?#~qu@(?*&1*vMY<2gwX(u*L z$_rEM3qQP4~M?)ABXq~FtIBG65;F}MsBz43Q^QJX^EgK3<(V}7E zuPraE*VpgSKmJGqW!RX^+&b$Ln(zb~KnBs@7@HH57#T}AXA=P~pW^FX^D4U+n}`=A zp|zPi754HruX#1)YHn`}saGFVb0v7bIkQQXhx9&=)xl($1BSPCN0%GMk!u3AQNat^ zOgrbRShbRNTrM?&CqgAuFSsSu5*hPOOVwoXuLOh%7hG!$3&d-3o_+&5wumL>V@T_8@T0N-Kx_uZnh08-x40}U(=mkG%? zoB56~Pdi10TzHqs6eji);rk`*g@kiHI6ckLop@ENh1OD)XG^0HH3yAj?rgquxY)nA zoT0%7NMv*Ny(3VNNL)f~VVoKhCAkF*|1NBR(u#I1#)50uR+{}{nz#!kZ_4{Wmn-K) z>DF5r=MaFr!}=KfeRpFG@g#m;S2U$@x#P^HUt2F|=HteE&_nyPCv=KBcK*aAyxSc; z14?4mHrJ52m3Ys&kBgySQ!j;I)2D6(E-q0T+y3iDF7A=kJSKy&a=08$`hF9X^|Y*=}AeV?u2RVX!hc-(CHhnE?7+809Q8!LD^on+D!M*bwKVY8?a`! zp;~(H)I0%Osaf%oaj#v`m0=gvjNP`fz!-YBS`e(;TQKg59+37B(JBFV*@z+GSkz$0 zd!5%I#B8+5{>t~8?QT{f1rEY;HS)dIg(2+wAvyA5cws9As>?=Jk`1Q@v&Ri z1F$}XE3`=4e%@UWe=T+}fUnKO@*?E>%N3^j+syU=dOJ0@{g7r7Z53JGW$ry|DuFZM z=_g54Rf@dOj1gsp7ufHv9k-D^0*u_X#)d5K;2rbXA8&3()<@h(@W?I?!4P-ub7yXG z74s(nNvGTEDDAc-4b6R(xC`bQ3(>V|VN9ns}fKgcg>-SpiFKmn*|-_e*oWHSz(NWP3PE z*JmH17b}X%a#6Io+lbxl0`;kp>E2Kr8b)NeA3o#+H{FOj7DU<98^nnH^wrDXr8jvu z$5kF9<{aqan-AAkn3#VC0;QdxQVpM-!g1sP$!(;SlQeCgrI`nfAb6S*H1VZe^Sc4L z8;+fM#||IdfU-AgaSuuQ<{N;MtO~W6vmZnae#O;bP(Iv6*ywF6h;}6uv^@b6!+kGr zdC9NDK!8|Wefrk^ctB~w@7N>2wIHQ&Cm)S1*j8jWN==>Uz8582hUatkMwKs`5darr z{`t68x%lV-mwsHD>OStunLM6o5RAl!Y5r}p%{wfp@g+{EzsEh= z_IwN4-?4u$Eps>d;l>UO(%-CE>DsX;hx)W`mP(;MrmT%Js1IoP9YIi#!w5kqM2-z{ z)??@R)+~o~5=jcuuw_8dV}o|Va5)+K*wzJ6{eOS;&dgd3ISS1HxBo;T#Pd%jIof|( zM?iUjnEb}j5M?6+>ag^RDz5dTs&lHy{(1O{oTUV~r)PZ&IXpqwi>;*0-{>p85t?PT*rH!P(mprFU_g<8GU%JaE5%nm};H zBufN8dBeuF!ZCdBF$vRh>$d1f1DsTC%mGg;*S|dIMveSw-mbUH1B7xRmW`FnK0*-a zvjIi{5o?-Ik493n;=%ex#NH5wl@Q!I_aUJC z78@HaHc;nBEa9VBwDj*QvHZx6K4Q*rp-S-)sz(sDg<1>Dg+WCpN4wd!^N17@{KcGI zQz9(voPp{eNc;Qk{MDE9msn2XUyviyEtFH}%&Dz7jOT$iX1ALRUK*&zzf#&7&FyxHvR!Ylnv8Y79Qbm$?umtq zYy}r@_F12o^jrT<4QLNgSfFN05Q(0y>vDUnraMsdcK#PEw6*DaqpTsjYymN-7KPwi zI1LRuWx3LFhnB;%G#dJE=db23cd`^}fo_sNN^L5CC)aWy{UjK$tAU?5kxN+}OINT) zJ;dlS!$uFdrkEM8TfVrr64S#(dc(z9mDd82A>V*4wKjvTYCkS`yVuk43{$ZSS}fXH z5X0qwRS{o5*Fg!PXU2;aFcwvJAfZm{@;OZ3wJ5c059$3J-PU5|QoW1b;G9v;)iQ*S9~?5HDnZ?8<{U~j^x-HS~|n5bOV zPNg7wMuF@nQs9a=tBETv%C)6r>=OtKhgr39i|R!+NXxY>cwKC4j*=zww$ekj*o-r#lw$JO)$ot=QbCOWv&9(xD+=^NMj$=P8lj4DW<%iaY{vk<^=k zr@F%L#V(Ps--?ZuzNYmy87vPM%0Z%5Oy>?6wF2`XtukDI3m66yYO=G^nOQL>B$Nl1 zGZ{9#Wc*gEqHX+gjj80`vNkp^H*7Ya&y3nvsnV!p2N<(>+Er%y_LR$_n1?ie7k02) zu*i^14Myg*b4X8!dvJ$FfQ+RxsrP&C|^?Ctrt5aLxXRSg_=SHC|yHwR#+YwV;I>Q1lPYrwjn_l&&0 zOBh|_Hkio!-HD6odDMinYEwJ_wS9PCe1C?qBhVOQA9JfhqVbnIC30tXa;5V3U=NvJ zPob~7toKV^^P&*L>4$0Z@^ZUUn_GtG7o_k&Vi#h1T3eM!vYB4+La??P1NVJIjj$?! z9TJOEj_nYbc|{4On6Gp7ScWV*mKbi#f&9@9!p9T3JJ@QmELlY_g;ycD&=8{veHd#$ zQ6oNb*+9NEM-XxBw`s3qXcTxGP7P>)S8B>N%e&jjuAA)RcQvHXK}zPw&`o1>@&{hZ zqTuX)TKx>Rik=!9S(-mI;{GCJ^VVl0RUB0+&t4LazWMj76DFF){MbeKb$N<7OlBBa zTQ;&l4YX1@vK;f=h@GVxWu-7B$+9)-J>nesYv!a&=0^zbwR-6E6jfD9%SK>dhNooM zalqjG@MmP?mC3CbIlL;B--vZpj7DMvTlunk8@#g}ofoVWW29WIS! zy63E+vUk7jWc_TdiXil|w!AOZW0|3+cQmQoNC~;%BMNLhhai?S5OoJf=IKEd?OL1{ zT(0d5q=dMQ%HAIa$_wrJO4M5F#vE)|Ia`>wtqZs%kQdlVmufV6kN4N1L3F5Fw8OkbIo5~^AX2oy18D>dpj9mvB8OXGfWPwr->J7e z&$lnVx@!dI0w1n=(uNDSmK$zwYH&tcE$SDJl!TD!$79-YtigiYn!}MFr5JF$l62EQ z8Sk`%rF3?AVPglZ)e1l!_!*pyE3xJd@6JWga4*nYCB$(UP1h`(E-vvw)D0xd-<9%5 zSChLHf$h*Zl0?h&8>1;*^9`#77|?C$m5v$5(`_7x(7lt*{QkEPp1V-%bz912a|(x= zylop*>(g93h~iYsyUZxwvJs1>t;H#?WCooq5hZ+`|H`G2Pc$OQ^t+ekWH8$<3*cLc zRI3(HhLXM9JX>Gg)!XYE&*T7pS@ctMK~-rhz|4>=mx6GVoLyr>#wj2isioW7wNcEy zE3@fJ&im}1)30BY?3}Mfan5xlpzAZQ4G7xK%)~x@E1Z*jg~Xjj8e zI%2jFQ%f+u z)%;GJcFI+T_3K}CAK@pcLmom(fFJI?%HykZ*OYRv=rBjbjyU-M*YE}?XgJ!QjTaB2 zJ=_=*83Z&Zd-bywKTlwKU|>n(Rp6m#yDQlvW3uL4qbwtjL$i;S_iyaX3qwNF<+|jR zUa7_^X-AqqnA5b{b2xlG#%bTL?DB_mb~I=<#Y?(ahUpXt+3060dd?#NUh*hTy1PE_ zb~Z*Z#vE88Iz1R?rFgV^$zAPQQ&;$m;zRYtx7>eP>bA3TgM;(Nn|$JKx}z*INca-@ ziN8QxJM3-dLRAu%N%z*3SjM{!{Jj28(#l3BQSifg7jD*vfsBs`&3aHoh$7jm&0#Bz zweYYkAM!tH)$X3>kcb;{c6kBi+Y7Ke_``-;IP>aOKscC-qezAa^~)c?=j>K7n0-CW z(uFx6&Mq&oRcUqpfhhVEQI5$v&njLw8^p9a30h=t=?-yds?g%a!Y=?g|2hPR${ zyn_>khyoO=RMi&dQ1LWH@RpjAfF>N+6Eg?|j#f_v0M!C$qn6x)Z!i#I6STrBx)Ubs zs8liZJ%$1Z%Q^;KV8kPv;%{W#={pF@f8vgPiE%)1%)srpZWjyDaS)Phh%2yxfTbY; zue#7ot2GAb^P&*Bt(ztaF+lQ7$z$t`;dy2iruY!_LqhQ;7FWiyEf;8a%VuL0oh{`Q zF3XYfC9YmA*{y0;Hl!cHfM_wm3AFL99GvSOJdSfXN^be${*l*{PB46cRHl))(lq`A zwG>~efGjXSmT*UP$?wOJHz-?b)UnSR?qguYHx_tWdE2NpZ-`D8h)(Q<3*0^6PO|r@ zc+L`)Bz%>)4Tcr2JqE@b3mWCH+qPStev#PD8@LoQi>6uC0sx*=-SDz;@hc0V*{x_E zMW7^Z&q<2S^q(tP1j`-vK81xekJb#63qt2qOACl|5>}RQKvJnjRGNA7M%UBlJvNBfb&e zYD5}|%nr6iWKuD^VR#blJM?WryC|^F?W=?dI{Lk6_%SiUdgqd3l1Z`@@$Q$5#e_=F zifZN6>f2s6s=7B8L3_??rM1iXJYdtF?XqXPjGkw^?B~&|r0a^UuBFnl_!>wkhqlII zw|+AAL4mcy8%s$(=3n9e^MwA*$RYFDggX1DaR<0) zjYFIB9h-m$M`I>sElas>*WL^J-t=_L@K)jSt`*!)qrnHR*#zsBKub+|HNq@bwRn)K z)uhhdwiHpO8?uO2@@{2cUhs-9jG>AA7$TWEQa8M5b*HOfcnFsh=|T26+>KXC><-&e zsVU@I#^}WH+3$v&?ZV}?51ZE>d|r_0(}=o!&Hmq`|MTzvogM%0qoY5)%zpRhe?R&^ zbNI)<9slp+|F(bp`|@Uio{-7H8o!yy&4H?e zDL6>QR4Mp#@Ec6VDfptx$>o;EB;gjhd)A`91Nef)1iVE5*+EcK&vsv4y99c6&l5sE z?UU-2!e<(0A$-%WmZaBrvY2)qtS1f=Xc6y{!u#2iY_xv>U%1y7Q~}n!GUDZL=A?(+ z_;C2Wfve&+>8Z}_2Iz5Visa8Iti zcekF3G^1*^0P_((KDJgL)F3Cj*-8#OrS z`-?Rxnx0Y@7Asx?*yOSib+>ZOdMA8=IphsMEEB11s%E7uY$!;`vrxupx7o-9+E^^K zGdjpGm`ba&VcSI6z%5D1F3P3gTHY3d!c_pICf@%hK)f~88vP&SxNLO)dgKTh5lq)h zSsa72fR_tV;OU`q1P+#Jf}_Mf)DiD0XDMo;+q>Ni?*^7Dfzbz$zHx%hAC5VqVT=nn zK{#cX0#_f79OFimEenKQBUy&z$CPj4-RYbV9*AxiD+KF_;4XI$bR@xw+EYH_FlOD( z%s@PfsBddW`S^Yi>Nb4#6NmtYYg70h!EUFBiY}^m&ok!-Sk!9C{?I|xNe%u=v+*z> zQ#FWq>9URt#GS z6F+_!gPjOQ)j~;-YBK^II@;S|yDPJmf058uyetk22%3nn<|uyr+*Wl9(Tq7tu%HJ) zVdLI6{=j9yZwv8ZI7M`S(AWT={mills8U}K^p@>lZiOS$6-?tpJA*FZ5$l6@Z*|b( z14U0R>9{c4YRr4?g7e5c^IGykcOf@9YS*M>&{4cq9EO|wkrspgTf)X6qt7b^bDrxFlIU~Vh4B2cUz^ny`nUL>=advq@h%kedq4*tYu`KNr)-6O zLDP=m!8Ou5n{~q%_niSjprXZw)oob<$le=tDqC`awz{i1fHtn%qLEeMP@*sutZs)A zygcm1*SOHo7z(r43iT*-W7!}U%#BcgrBTLv7YPIscm|Oz>=@oy%5zGAtDQ}s(EMzL4sPj5U<&bzx|EP zuaF{O4r=n>|Ndg+R~?H(?{}6WeEg>nN)11z2*1YhWi0gQzYM%!(GcVvbvb<{x zUVA_Jf-${NX0y29;QR|GcA$hT&@KUOaiw(AL1@Sr~bhuadiU*F~Xp3$*gSNJ_v5`H$&E3X&_q6H2zsmdF< z7P{f)YPz16;1)P-~m2ZNj$)3oY~`Gev8-+MX#|pD9{*o1+O;$mn7bWdT~g%)Jl)bpHYH2%!0W!^1Fzc<9mJ-Yh#O2xbVvs8-X{h%ISe5&Trm~2J1M++ z$Hv7XgHyn|e-2|9hu=u7F%j`1skDT)PeXHuV#u87a>N)<+Mppamd_F!}Vl{ZLNrR+Go7q%?`Ss5oxio}A8+(0b z4)91F6i-T#Z?h#Yw3u0}Kx@qwis#uaRn!IE)uPz2C=j9>gSop1HJulArT8?CMd;6Sdmyo(17*SyTty1@J;Ub?~qP{1`Wq0kcu=qt0@3?w_^npM%% zcZviIw7cUI+gc0=G^*%{!{WXb-o8bBJ5~n{!T;Y&mbRBD{ZWD%mRuI|{(3A`Y^Qs1 z%|!iA?qki`683{zZY~*v7g`a75&brHIx6;-@Xo<{IYNWPL+f#^Mx)}k;N?BQquSad zHMq6~%|f4gShXz499nQK{F>L%lpFMwf3Q*zAKU#Vi(a z9fXe`&1T0Zh!Xn%#dTX{&WH#c`(VU0ln=I@j*7fBS`uc z$4;zW!^G(X%Q`4A``PKQXtiXr(it!FjK0XsyvhiaK%)NY4vT}TYHp?UkO8{wWwsEV zHYl&9+bNV7KT6_hpZ=-kolB_)Q>2Fev9;I1l&o%A{M&sFrrp#iON6lF!4&OD|Jd63 zU`mnQ!LhZ+!4#9I+sD>E2UCjX92{Fa98C6PiV5w(b8DxQDY^qk&#m;6DN@JuxfMB? zB4wwZTd|WVQcc>q6+f9``)~T(V%r_;p~#ZVifgpQ+YPZP9i_Z8JJ7Nls4p4D2%|DI z-eHMSw>2SicE{D9Uj7+YQdeyN2%ob5=3ne4Hdm_1A+sA1)y(8SDhR!o0ETUjY7B|J zxYQ@+C_wflq>Mg}3u&Q^v8L_SoxLfxCj$u$Is|0(2fmiD4`{%DubQZI>kei(w7N3P z9=%f!Mp1DWkM#A1INg&h_MeOX^HX>~pMZ#9`Kk`Ah#FfNvu z)@}qAoc$J@w&u&FTy$vx*3sxMain$dueu}Ebhji}4&LrUd|0QE@jQmUn97ngI!&e%e&*Q#XV6JJ*aQf*m^vA|ImtHNQRn%-BuZU(|D zP|cj)X}{3*9Z#~{Z-M)_wr*m)cp@|Exzq~oYF|Dtahvtm}9if!Ae*p-TH+qP}nwr%T)S+VWp z=C^gu-hF!X=sWHh-G8m|yn$z}^_}xG*Q8z5N&CEVJ*~{?eqVy)w?kjW3BEMbck#`< z)M~K_1@7!wG~?nUh-NZ8`fPnoFf^CtXsUbhKHB6oh58KxwcOc?yd3UERj6lz6d3V~ zpGfYxD-)~*%LbBNG5Z@6C>>%`_jvOmn@)ZnYlnKoCk*5@528DnYF8k@nl`RTAz4<$+I&*Hk=XVYSNRt2b;OlZBqRC6jfb z6LnTae-csl>JDNNU-B?lA?P?v$sFyGzmjRvmaDH;;kq&s$P1idXI^O1R~gbK-&!vd zYGK)KXEP0T1Cfer;2z1LDwQ+>lCxT3jcG9~@goYTs?vYNYNCxpJ9Mz~e2S3dk^j0= ziqAt|chg5}$0zO=IpI~n?|GT$DKJc0_e(Lm2Jh4sK<*w!^EUWq8plIk50I>*_|Qck zffVewtE^Dj`=XM&ck|mRMUKlTA_ZlZW4>HcoUa(2jR^;(!pK;;DlL|LwIM~!C3O9s z0IeRFDw$mce3H{Fq?|xms)J<2vuhsqWQxp%A6`?nh12a_!P))}c9=q~V4`zg6WY9n z4;AXbToE$#RB&#IOtM?257*b=IpIiySd^GSf4KYY7Q^5WD^$MZBx!!noP>y{1Mg!xHte_ToE9F{R9`I?d^u@7 zjMC6BNhy}l74gup@ZvO_UFvfj8%WKi-fFh-mDIo=a6gQgv?bqB|x<7=S?udD`Mf-*fMT0wtypAp3H zANN}9dXC;jiWm45ZzU7E+ByfG6J2*7+xu&3Fuv@LSYXsA3*5vv)HFrMip+9GDEOxI zrKle~P|!*9+~LB*kvUMY+n&_|19@$jh@mZHM^kZS>`&WRt=-S3cUh$y7S614m2kp@ z1%#ur6J-*2*1%w6#v3HAqJCpX1bwiNF5>(eIKV9%0Ez~0WlE68jwfE7hN5udQc+%p zr;uRyHM37wBs zb{;mNeKaepkXr`aze)At88r7TUs5=bu944z*8e%e3-KqPpBy5uY9+_M9mnci8R7Ql zBm_Ggk)56SP1J3?L_UpYz~T=s>zsERsFn?}HMR0cf-W5rR#JhqDj)-BbX_u&zs!5a zMA|I|$vLf3MBI>n===IY_e7?U6tk{YL25;czo!A^aSyj{I^HoBZT7!2?O(*SAb>xCU^~V0jaE@3^d@sv^hCh0crz+rr zrd_;nE7tjZKrc6VC$;vdMkd2eC)6Qb=^-sHqpdDJfXCuRg0F8H{sNAf8frx{O*)To zXdVt8Fq}vrYTvuch~Ze<+gP^BZT}jlaMYNLn5YvLyr*Ye;*9Cw^U$vDo^ZWN5)K~e zB+Ax^muQdUr)p>&(FP6w0T39}*dsU0%*LTE6s>RECdp&-B^kkJoNH?~&-Z(Ghx5&W zE6Xu7`g%r0uNV}eUZZtvlkYH))TJH^G&7fB7_CJ2lo3w;c3229fA)K8y7v(d*-#r8 z>quY{N>;k()Gio8AjnMl%Bb{&MHi-jwJgx|E${kmwUcR_rXCEuR8r%v4mj6?Zf=7m z?qZaV_CBWp7T~dPBD;meu*gl5QoHk_m3=cPXp-ssr%!k-!r@GD{XDf3Z^92a?Ev^G zFwj*wSmvdZfiZC%Kpv$Dl=-AYk!?nDeej5Zmct1~4Gh?T_ZbnxWeh5fd$UId@2Diae7H+3 z*nqARk&)cA?Lwtx`(kA2o*?|>f|5d?w?3WVO6|-2F8DZ5-oYK9qHL0~^^02)-f;PH z_r#cPhR8-{^MGyt^m0Dk|AEqKp#+y%l?;2^z18V#{(HIlk;2wr1Ygf-yP2_I7XG^+-IOmsfDIlpd(|t7F{<)Ub0D9q2A|I0?1B@ZBDh;%QY z&w|vdy*4s4-za<4VetqFT#%++BjDl zpU=CDD+}AKAsgH#Q3ki|wE|}?gXIa?jM=ppza47eWNM$F4hvYFCjz?u83{U2yeihj zo(sI%stMqkXRs_T3ZIg%^LnZ?6ABbS@6j^8hEsK@PH6D} zOE6Z>x-%Y|LObdHy-eq0_ufS#Wu7@uB-Opd(yP(N#hJL#0hI#G;{|d{% zy^g!EPlr>#rMxzQ(g&$jbi@{$421Bw6-X?IiUCh>(J5=RAg31z4+`yW>ZsAu?iTxe zB7#fM)n~Lnt&lVk+=fpyj4$QvUu1!r-SQ5iplHsHAjzm7%{X{{bpv#aT?~@$g8wwJ zJdg?O?3gsyl5R~~TN6B4gk02s&a$4eP}nEzoYr@|D=l(u)x}X=6URpD$eC=g?+R0< zG9BJmAaePkBzW(qu0ZqKQq57VjMU$ogg~lgTTNe;pOxXl8{uT)CsdsS_GXBox<>dx zppkdOHbdq^`nJ%4a|hDd%L(L2^w5L}wKnUjxWf5OGj(Q*TAf5lo8+p@afa-}w#&3h zR0u$poeFy|=S&*_o<^NCVgEhyo4qdt;;q6W>s*e!4V?rPk+{fqqs=B{Z2k9%)o+Zb zbF|GmC25JO=JMQ7koojtn9i2Dk4n%SMB7MLLj&*vn=BM=g&P~dPJ2Zsv%2b6ai(3U zCdB%?FgZ-Q<8SmescNWtvn4NN1K&5Lqclo;2M7aK(MF&hF0gB1$KyO6Xk$nz2tmaP z^Y?Qy*hF;;$aJ-uF%Szv3Rtn~E$2T%W|4Qeu3k1JC+q*E_lCY*+~VqHIfcQrUeU%= zNS%@OJxVUaLLYkAxTWQDU6-lARu)oDC-o4y&afX$eRUwh-^0hhV|n-pvl?%4rGbUs z5ig(*l`_=+bWs=d34z7VX~@$IuieIKN;K+DAsr$zj5!;+Biw(_9#6E-b2zPxxJ81e z{e)f`-o9+dHV+}YzHQ5+h#bc?W_@3E6JWw;JMhO_&F0BfT&TSzqutrKIQnk>N3Eo( zHE5u6zqul{`{h_aXtUYbcKZs>MF=Ya%|2RXLVcc+yaK!pKX22w zyx!B3>3lWb(Z-(-mPfqiHqU+-Zh7qeEMK79dP=Q0Aa=dKX;zv~wkTZX%mVmLSK;+* zdIoW+Mb2XU40P46&x3p}csCv{$v)p@025NDPNRJP55(Cd6hrDOqEV!X%ZV!?swwQGKpA>G={v2E0EWX#y!?L zF`w9WJVJ&Jecso-$;pwI5Nv3?!hJ%_-6_wY2^uSHynW?BmdixnoSmEAw^uC-a>tl0 z^o38%*>zSvGqEk+ff!EtjA=->d26G!iioEA>k$6pw4~Z->0B`wE|AYxy+OlN1t^8E zxaci7)bsno3di|FnsWq3rF$jb8ceQgPq*B2eS;1Ink9z2Qh$buP(4?;Ud={L3V=XQoJ=U%2$&7!cX}cWziGo*ov~}vH3`^R z7&oxPg!)6iJ@yA@Y!_k65Brg)yZK|*W_P(gx8IRo9<+?<4`hI9dfe`;!l2wv^XD|6 zD3$HhE3!x7v2*%ZorTkY)FC+S88)zz{kIZ}V!(_Mt@0>`q}H>_!+Aq-t|c6!2CDS1Yq@q-QD z0?!-<3J6?@?KmPVCY<#h1WvS$j~8{(02FhMHWF64xzT@!GOQz+tl8%USO0OY&NBX&rPNzIt5KvdAd1Izx|pR>Y4w(2(LCYagJ1jd$jdK6 z7>bav%seCwk1Mg+h=Vv-T){c$-U9>~d*LQ{d~|uZi8dtb^R?XBXvu7Z-2~$4i42C& z%8PPT{(hbl1O!%i`Em49)6Kz6Bxc0pP}uSBt*jQ0*DNbW?pxyyX06e0 zk?4vz->JM{zjrf*mw&e)fs*UZP42+fphrCi!g0L#9umkfex2Xr*RXxB=SY(Dl5ffd zHp72`*aM$%_UPBYrH_j#IwS3*@?Q$?a+tYV>&NkOB$n%Nhvwzed!!ugKwWLz%J3^N+?wuo zlz>H4f(2L0Fpl&QSK^rUKpQ1Q<)qFoZ95wcOq5Xy6FCcsUwr-%)bp~ehf+9U459nl z#7Pt4OTlSbCYM-y&X_(%8NgHnR78am-{wi$%wK?5Qsj8>xB6!CN$rHq);EatC6Mz; zK8cMIw_BO2eSREo`jB6se75D8eS67OI+0>N9D+eOt}u)AU!rEqez<$PDvwPnTaF(V zxP`l15uJB2ty`mNLn8ra4{%}SrT(=RJdMgFe53s465b-G#-H}%4D`aJp`bI<%&zV_ zb?P-xdb2M0r?2MFV5>04xNAR6e~=Ky!MtaU+Vl*1RB9oZJ7*DhL7Vs%vKyrn7#&<< zDb9la4C~ip2NAz0tvMO+&vyk23Rr=N0yJwCln+OVyL_n`ln{wPIiYk+f&09LB|92e zEez~*0$rHqMdw5rmBTW@vc&Bs-43IOylZOz<0z4Jyj~>_Dpt0WI5w(g2a^#%haOG? z!q^YielA^%cwo>X4Qq(3li+rY_JAEvDpnP})TK441a1v-$W}(SOs+qP925Qx#?HVW zWSCMVqf-*aXhYlta(Lt~1;N*G*XosFP1oZr#wqUOXBhKNZ z)c)qSlIc3vUH9?#8!l+irn!hO)(1;w9ehF9M^pF3-SSt#yC;sWbk+qgGTZ8=*(^)hffzz#!}^X?Nin(5}`%0O93k*MYp`0_f(%8`ta*M+iq zeb`AS322IM>CPDkfEGv3&amdyhKhpp?;s-ovOaCw+>aKy5r+ChL3n*{?Znb#KD%Dx zE}vJ0+T7g#IP6eV^xgYW?^P~E^=R+A{W}muL`#7R@@~faf*G%5D1&#r zOjfLuk0@Gv2`bNl$c)u#KI)i}4C065v_9eBVN2O_B7{WY*@Jl}rL6OF=g5Fx{)3*I}*jm*Q%*S5YDn@~j9* zKC2S=+Uhdh9>#ZT%%|dPpmW| zR)ZEO)~O%DI=cOnCYwX~W870@o)>E!nKmgzM~=BPPF<1s#CtN>9pJy@(QY*6Bz>?u zWch@eRDpiQz*DN5I{}b+9X+)RtjcQv)(FRs18<$yn9BnGO+kC<5Z<5O0wIenTb%xO z&MPcNYeO0gY;4I{I6i!^UB~0T4X@4^khOb$-y3I|(#$KFv_(uUbo?yy;XaUE&qSMq zc+=DzufrR5Zgm?l;+>VZ1SB`ZgVeDXT-61+n3KGA1>@Uh&?M`IakT9)m!Ya3G3m41 zdXEBq-vX97LV-slf8Pjxke`T8@_~y$3@yIB4b#KlXR7K8XIv_&NuW<9Z65IDVltMc zvyp*W?Bbkngj>nbecQB4z6N& zbdCNtvIX3^Gr9cjT)efF=ZM>&-`1?Q@`|v_L4$PyGKU#GUC91H*05Te_)K#mDE!NsYko$# zuOt;}YMa17vlf2WVM=;Jd#2IuN3Xc0(0k1%0yxu<>>f}WKNO%rfa3g5Ojw2N^mNE# zTAP&*&Q>8mnf0*7f|o6E(ITVzHmmZ!bHT{bMalZrTp6kp#CXw~Lpcz8t5{UG-ysY3 z0hzax7DSY(Wb?;J;_94EG%pjQEL1C{^g{Fci_`El`A=Q^wwfo5zQrW2{9}rDz-xUh z8{q#G-P3S-RE6LQmg!8qD!}g8+!=5&BFL}hOpnu2DJ(92JW3&L<2 zz$ca1Sn|6u+vvS1PWBe9q5MU|&$344m++3UFLD+-nMi3zVEai7IL9LWlwaw^>J!+lY>P~Dln zKX)-v_u(khjXo?)lDepxEx9ZvTsm#=!+zG=OBbvc-Sn&{Ealf(0BMsFOXwT2f3>8y z*l>fB&or|!pLPm|BmG6x)rdT{o8)?*r&HIvILihNbdvwd8sZ;a*3hKpK!Q6e%iaJN z0Hzk;hOo{6a}RD0Y%+LsRG~h6oI~H(B6rDLnejTby4AkN@ zR~&VIE%IeE_7rI(h&@$lj<#xa7)2HO>=E}DgymgXWPYK4&{uCSAS#KW@$^#vcXJoY7ND`eQE$jKgdiji6yFiExC4{)Ls zr!i;JCyx=8s0TWfM^1;gUG$ElT0%$&mogznCkzOB>VEDa3aM~^z(HoQ-6pPBL7CZ{ zx1hAkH^LEKU_&3n6$hI`sWjcTcm(1X3J?q9O?F6QMIxeQJg=-HQFoYmMmINwhZ_|3 zB$NyUp%Q7@pH{%m7xRGy_KpR14$Ipw(?uj&-;}Rh8-@9yPBGzkIn(pQ_u&2{4lYm- z&Es+4#lq2DfZF+f!1>+G=1-6kZI}E7S97dXGbf|KgJk8_@hT?xtJ4rlNNd9vga=8A z(grLFga-!|rQvOpoZwshX-_2&mrl7nlOAAEkuj1Hx;Yp=Kku)XJT=lZG9QoZo2~Zy zga!za3OSPdfV9Uy=#P@uKQ~+3k%ZULp!AVBqR=w7aG&@~ss_=k5A_=(NpuwKdGFxQ zVzIk%r5eAY=Ym=_k*&;B9hOqsTImov_If8RWrSw+9Zbb0G)pJI(S!x%yZ1vhm2hQ4 zb;naeB|liFFKTW|R5eq1>fLw|Uv<%MsC8K3R0c@D{H77HB*1Ys*Yr{|Nxu zOqSXT5vFu`@f^JX+K1-0C;njbYzPdO6xGH_J=c3+6!(flUwUAuBUcL+V}>{~w#vSl zTM*jXnX#e9lErbi;P0|vTa^dDKinIGH-2WySaW*6E2>^I`fWPY$yK7XF!{X`v$(r);K3zs*nmuDCdc!vhUIY~!mjep7|`cgBiUeyLKE`gk6JYg@E)DRYD` z#v)Yk+kO6~FG+78uKG{O9CqW>>#c&rJ=ksvm!YtiV+P^s29N*N$$NPi?{!axRdUuD$mHji;4;=biH) z9|W2tHldFckncPrR)Mu!!FBPk(}Q!5`wGO`3S&eRpeH0#o z2qG~sK2==NYBP9-bRKYLgXwjxA$t5Cq7gnhTvCrOE|^4R)-z{FAhLsM)uSK>sq4aLg@nV=kPO;=`7Y5bARBib+hmz`A(P$es51xqq9Pk1eot`&T| zX!eo$365TNH3?XgOMb~vcfd&m+6!Yi!Gt@O6`PkVV1CHKrm3k;{?*{-wn*bml9^Vh zbl+2A&3lDg@k+&yE`dv$VnBA8i?XNujV>W&PZ8*s>^(mrUwXN6k#N?`> zb^I=K^Yp7jT2i42F=)Ltf1ILjoqxKKjkI)Uz-tqc zt*-~R326^>%t?iPJBz=R}&8~83q*V%|O2k|6Yh!B*bx)`&kSE5kx7Z5-X)Pb-U8FEY%f#TayKTW~(PR(vZ_ zifivbYBye`S0Hy2NlZfwMVZU&6m(LxbZ=J@vGqh+bDmc9y5?FWcyPK>IgVvkdnK(iKGwV? zaSKRwKFA1CjY)9eMJBWK*MKC9rPI^LBYf`yUq%ZlBdbhDXlbbR+&T+JW#g7Mh}n!+ z*^FEGzk$_Ipk&$W`zqJOugU%ZY~0N1L?(>8YdWAK&5otHIdGvIp{x~|dn;q5U`)s@ zd-z1BZo)Totu22XuC7wmQt8T%b$;rZQl+v0H(4@rJ5&yO5!UKwPVxTp*T*@fAwDJe zQ*3%0hiZH*^wvM|7ERF$sjR*e|t%8Er z{7(8)@9fL`6Z$(lB`zuVeg^{#5fAijTc-~}U{~F!fU%Zeej&cl6MRS4qrxqlNYo*;Z6pEjI6x_nbx9NZlluvclmYvo8`0r z2q*De7gn|kSLvFC@2y2k_pKp=2x}|@6@CrVBftSQmCUb$%nW!G{!*|-2o#r}8dVu6 zh3eLZ8PPM1PqH<<5Z?GV_u#IYvk61{QB3JxmYq4N(b%^F2ob3l2wBLB&#PW9lar{rDAIx;xu!zr&I5$ zigdcqc^Kc2eb9YMQA-C0lXQ#<0zd4axgzzPX{udUpnA!{q7SLg;-qIn7m$8%t{y#T z-7y=*3$3>Z_kpRlC$Qlv(qikguUq;>I7;0W;^0DNGy*y|I#zV(+eOiW9sV~FO$3WF*-?nK*-iaNt zTV#cS=a^|c`{Pq*;Q(P$>kW<56LbkY{1|)tq=!!BUz=*d4bda@9m^+tpDeBQeU60+(pj+ z23mC{`R`~I_LfCXSQ;nl7;?|`*E$fK0sr?3uC&K2p8fxUux6C=Hs3o+b#MFmGyp+$ zCGKw+_*e|_(mr{}v*9yz5SaX(xax|rw%W~sj4Tfq%@76R`hI%W?$$|B{L!)~LG=Dd zQz^%Rs=6aO=dY-e>F{y4f1KmF7qgU^br+A%O>$oiY1lpsm~-Z32T@h9mpPL58yr{V zY&xj{s?LF|>|qxfICOqnQOAj?Vv^*fb@(#4;mji2UHpeMrtdEvas9zzG(ooBcRZos zjlz2K9p4KCHC13^@QM~qt8djCbd%RhBapx(0rY>XD?L*FqplRZ@du>46zO<#9Un{N ztF8pR)qX6xP)#sav`HX*R$Q(1LEAan{#<#3Nq5MPvE|XyR5$R(6hn3n7H{@+h8jr( znPNdynPFi1NrvioEO_&U|iy_vx#lqdJu5ocz9ekO-t-#n>M6(w@XV z=*icaUpj7<R2xqh`{5c zUObWnVshi{Oe}o$vI4rFNgd^81!)9t7;o`i018y1&#N_drPzI5w9-EcG7DM%Rgk&v z21Rk{FzQ&XjU98Zr%}pJ*v6o!?!`>|E%aTCqP=EGmRq zE1P#>U0dYfcZXRrxeD+x4t!U&!a*8-{0+E;o&UzEgdFoPCkMIPCfRFNL$lmVHWzMn zA6Lu&J8;v7ZLCr$r1QN6B$n0wScsD#HcRVzNXKkt^NLffO$P<&h)H#cN0!1K)Rty{kl{iYfEo>P zMjrr_X2nYSv5Sat*va?R3v{OLH{rN@-@B)}&BjO|dI#PeoBCTrrjkJL=e5ATP@LV% ziPK3My6u_1zYgSc^i`9P%2_mIMWPu`70B4v*c`{9U*-<)u{W{}gXChcg%_iXugSTZ zt9olj>e-9GSYtihvfQigeETx8VY#iW^R&&9L&)nkv4?(30BzwJMUp!#yG^^9ci{c- zc)d-&ks%%vab!>Iyb^Y(0k_z4`s3k|F2cnBPW$013}Z2@yHA@&MQ`%_wG4TGWq%Ms zTMH8Zai~%t`O}i-i3dlqBeuDY-U-%lY=cl1=Ac3OZ)Q}#CaRZ0uLsS&JEJILog;`sl=vIh$TAsFa<8Lfnkg(@rK__qq;3;07wdinctL?{) z#>G1X4g!OJ+cWa}wUhjhd&bPfZ=u{;_3ngabeKb)3fCQF2Ro6$8x8;5GYS*7pxZAi zd4Il!$7&;$syVeEzfVFqfdIV&$+@h) zl2O#UPrD^)YE{(pmnl@Q=#k3PTuSX$RL9lV#Bu4bi6iF45C*Y|*_L!FLlr%Z;MZ{j zjSJ6}{yfmv#u2txmZ}R#O1u40%b(y1v|z{WQv>b1%>fO34Huc9jo*5;Aay2>e`C( zRX^ZbSq9b1T{>+_m^?r===^tNR+98@$n4lE^Ruj5NEDrhmw?YH1&>JP?T;u7w?n-S z(p~kY)|P{nPzuEjqC>fjh1Z11m>mUqINLenOX#hlNZrb-cG=|?F{QF5@V0e*$+7}Zu}$!WlH`)@MK*4qI1 za)9vEq}{B|?-;IxfLZ@PXE<^y)7OKR%1*1!sP#AVI80fp?N@R3cVe;IhC3RRE5Cpi#** zvGsKJTg%hZ%M2ZuEb1>O3}@5oq_#U=;(&94<6wxViuHi3l&O0k1`sHhi@cc}*6<8N zteNK>p0ig`;OQTm70hNHlCqMd;wA3kya`iP={N%)vVD@2Ap7+~qFRIZ3BwOYBz}(s zO}A(L>9touqu7B;_>U{Xl0OS;wgO^ROGGla9luoJ8 z6fTH=up#$`tUEs<(e~GcE7@umDfNdc{2tiL{^Qg9m40~}DGW>xB(T}jvd}VV>ys7xb2c^SJqQ-CKlf=0F~-^26F$ z)1IK@n#DLAFdL|l+Ds=Q1;(tIsfC0~h=gv95-p)@6ywXK${U$g=HI(kPgw>bBlZR{ zS=X2HMm_ApWOd8-gM-0beyg`}L2q}Jo?_D^StEj6d{E0~pmw~fw7hC!5-3= zyVfdc1Jik%5%_ML?C^MWR$$3gE$tFe;cD2lyfyI?xcvSSktFBvY+~-{X=^sK=GTOY z2wK7HTVoxGNgnO%^e z_gh!`q%-gGBV5!f&GBn8<~SJ4Ey3FHVd(F=Nw+X9&qXT#y8*e=7b!}|V4f2*x24?o z!{5R1*~YkS+MD(8JX)*u@b48u2t3oAclGd{_is!mGmSkFMgJ6i45^V%%(lsBTS9CA>f8;qQ#=p69Ym^i&4*ik5ah{aS}92F zFYhZHiiO^-4he=&og*jeT_Z}Vi+ZIib=%JV94TyCE||j?u75!5xn?I+NlqGtRk4*< zpODTp=^p+tKiSD8=Y^6Xu9nKDAj-XpD)^<&mTkUWQe(@$;-@@eWJg^#dFfzxsbGOnOmwxJb~Unm zYXJB<6ibzn@pOGm%6JBdXQj;dcIdl<@Uf5h=|e?fq0Mn`5l{2o`lr7cM;~v6&EZ() zqIk!uIPv;)k?AETMOrGY%XT6(4->7yAl*`}^Yt~p8gTa9bHLnvj*-u(_hR#~ed32c zr_|L&F@}EP^YGZ%a}^*f!kM&h$AII*fhh<1 zim`s7R?ne)zJ7zy9Nx!84E-PEr;rD~P%-I$7v=z(%p0}}R7?(LjLp8@YXc3|1heyhf++x+d zV$~lYdB2*Q*sso>*QhbD{Kz%E2!bCELLt`lz>L^SQfdNzmGR?vpt1`1eP(2`m>`uR zr(G9EKb1!dZR);UNKo^Ae6QiL?ku?SM%C-;pwxtkSO$xeQ^ho=o;dl=@KFwAIzSAc#CM30zKRrR8;5Jt+lpy3E|~Od1o0?R5*X+acJ| zJOSmjQsmUxfVhVOE|7ghXE)Z?@hn`S_|R2obHMiYI1Ad+>)jV}640XD-99+a|Ac6~VN9xiB&EH9U}JJ<|qnD0Olj%@o>dSI=lND_R%^9htjqZ0(GjwppVGn9ZaS z7~w{c1_n6XZ}S`s}mtl9;nA|0we zup5yfxbPS!0{Tu==w>v`=AF2}k(9+h&wF00l})+k7I0>Ij`GkDL1ngCuLNkZd;4!$t9Kn0&nh)UNy)On!y%vrhtT#v$o_)*{YA>g zJL!t$3pWA|iCkim{g*r7`&Pd!5!i;7qOImtU^Dbn+}!EKHJcYxT<3XYw>>o=72dL+ zeGr`ZG(~2=pIokTgFh#6>^puW%wtAHiL>P6*62oxuCLaI2-`T)!cxc{@V-u|O*;kD}xww2q#kXDXr|}&j+w{7WojQ0Fl%kv;rBd)K=He1ckvbF^ zv3p7NbUDcHu?)eVsB*jUvxr2ET|eFd+3pGoqqq6;eBEey29I^*!g%xY`k?g|=K0lG zcMkJj-8oiu+&@_2EOk(2r#l+^$s6Y%AlqNhT-jS1upijoG&;XtbFwseM7e+Mfz;ii zyb`SZ%j5Jt_`=pJJPLBc(1;LH0Up{*2;0!CU zb7M5!#q;SD?ShApMN`WM)hr4>UpeJ-3ZxJ(ThXl}^-V1ac^A*|e7PJ064Lq%Tsm@M zn*go=@{C-Pd1tb_SIm3`cstCy08PE#LPp5CNKy4J=$Od!N^FTJ8i$rlA0G*Fw&VSM zk;?(ZW^CoS*&z>+#*CkBAnq*tqDnA4jbDWOZYXMuv@jRFMo^oD+7CbHe(K?9&)EvTv?ie& zEcR6?=sJhodVSnwxC7*+YS{sG5F(f0{SveEEY7KO>_o_mM_Cl8suY7zA6JQy+%uAI z)z6(*`Ax@^t5&nI5bUL^HE7K(Tpz!eBC!CSKQ?ZFay3E>^+}lAl;i|}4n)^ZrvnKiR21tiCmt%@EzznR1~#Xe;oL4vkQfC8QN}+t83lx=;wDg^5Gp2 z1X<%I%x%8FF-eA1!Mm)H+l$jg?9Z#XSmys~4g)weJ`y;N!#)!kq4JtbPOr|@H!)vv zn@j4W@t8|~n7J<{Wi=LVe3hcr)yfrE%kWSouU*|Qy(Wc6t-peVqKzp`@~8(r;3eaU z6{@)xa@eZjMM*8JK`W$2&ij`{8~<6US=6tNK)9vFkrrxYpVw*yAsa;49TJnTX8JCGeU4)eY<)n4V%ar3$`->1{DsnMFIrh1bo3GhepLZ zk%_jaEE;?3)T;ghKj7nUforI|qLL*)<@6|`NLg3SF3k!_n@r9S|3j2KaL_gtNARaU z*VSdTIt~$$7yDYidzMb1OJISPj3{+{sMoM%g2^v;)`_U4F}%)5#T$4hHaF8(`&zTM zLpgQGY@y$r8}^9lWYib`OldZr4eCvA0N6!679-n(M5IDhGSLg2@)%3XWN}hOatIPEb~4 zsImU;N{S0B>D=qPh1An@J;Swy6gM`?^w2;(!z|C&<&cq-wCjz;Mxe#RRN0$VFGNH= z+*}ZNJsP!-j?e%MmZpwoM({k|+Z=d?7U735t%H&y@6*}LOTCESpeQA~LA(2DO3-q@ zm_cPz@4addtYrYF9J1|sF5y_5r-wRgBkBv$=wz=an3z31=~^UiqYA_oOttNvqbSr} zbkiOU07`BTo5;WYj~nVHebFuK*`4A~z+WM1R`;edG?Nc{v#*0h!VHl?!*ei#WA88; zL&7^zHoeKe&Jr2F(1sYh6D#&qsIl^tC6Cror;K25Qr6*gEN}$uHK~!$rB%27 z*~2KILn2Y}EP^ZIcZ8lrngKPBr->j^$XW%YpMNC$=z@-c7FY0sUkfV}Gsvfn7g_L# zr6(fp%p>M4%2+z^NiirR-#KbLcSbZiK56(3aHvN@$-x2)hS6kH66%V*AfDyhqr_EP zulEgW^4;{Of~DpS$Y;sZuGX?MPUQt=K6P%*+MnN+GP!F_x?hP;MxS*bl{qAX>o{^s z9G35lDCEl{oqbe9!{!|Si?+9ZitAnUE`z(fySoJU;1Jy1U4py226wkW@JpKRLQ0WxbuHXKA|3q3WBfCa<=ID?utD(K3juu) z#KFY#A2lz*nfdB1hfc>9mUxWS*A5@sy&_AKPDn!Phzo(F4!d;RudRPFk<~n4QfGS9 zxTdF<5=Xp9gjt*M?}%jt2ztH*UZB@fvABA09+jsgL^@)UYTILRTLygEGtHN>E5M6v zwqx1qQ2CaR!IQ^36CWFjoqu$dbk)Xh`d#scet~nNn7)8J5zPokcw!3DJLHQ%58xP0 zG&|_Z%1ywbGyZ*z3B9Re-3C|vcVBm@bC-~AlhnG$-cLBVO`TM`O>`NgO~xF31JvVD zBXiFp#BX5u`q5cA<1otGaEerSTj`~?>rwo<;R29Ec=)ZPalLhDNaRp9N}u9tTJ{ce zXV%Mb(7_W2+i{I^R`LT_FA0hDa60?7xqY3stxGnEI5xeeR|&**3+T0VHx~tPoJlC%Y*q{l3&*$j?b>4EY#XW2W5b53jV`zhV1ryYD-dIyyZ?efHZge{J@Eo*q9x z{$QOtT_*W$h)6@s0$9Y5zHR2evc@yuj8?wcK$v>ljj|KMQ@)=ld;HgfU^)*`s1y|@ zWs74q(3C2GR+#Bg;`V(}3R(8&qe+a5qi)(g?4O#!0-8;Q_5JZHHkzx-Qgz$yKxTW-=Kust;uqTHHg8be!_klkM`58_#i8I@+8VDMqVzheHl=uDjV zDV$Wj)#7${0ki4WT^eztaBfBiiW~|ndGELpgwS5gsw+x3{Rq3Z_qviYl<(-h&p*Hn zDj{_qN^3X>dsSXY%qq?d_2G07us|aD@HV-4;*B*HxMZmx8Zc`snL}Uex@^78S3=CZ z(~I|X{D)bmgEz-a^N2p~J`SsAI7gxX_*i-QxEivzb;SG-t_7F#>jG}d{*s?F1K#E2 z_!CVZEHETTU9ZS2ck+6nXM{59sfNlXJkZ*2zv!>{KtR$)e=_IId_Y{b;Yg!>9eVE+ z*3|<5;xEoyXXbn334y5yOa4});-~|uD@fQ|#S%r)Qm86BkHRQDD>QD4kx|B5i9#BL zeP9*Xy^w%z1v@y^Y+gOuylIDW3Q$3F>OvNipv>en&;jXa>dAo`MZ*_e=A!Us>HLqy z7m_ba(BECbp$#I7l-82nE&v2nnnrBvvKznXSwfel_)r>*RAyl@IVZDLd1M>E!L{#e zNtC1$G@b-&;^v$Nla-e71Q9OYBFWSrji-q06M&*=8Lcw9exPQW&mKOo1=LKN*%)K$ zYJaA^B8aMC!|8{m`qdm;=A{mbrok7Hu{}iMr*}Qs56W3#M&pk=Yh;F*4eK?!l~^H| zVrGy?yVI!h>$t#~Sr5$6CA;|yZ-RE7`Ilgrdq0K*{StIo&lApT(0|wMG-P;8n^u@` zzezS(T4`4txy#f*PiCQCh44G9R4w2dc~g*LVh0fH$47S-L3+>V#WTS|LYmoJcO{BB zsowlTrXOC}q7ZDYhw2ymkXr#V61fLr`%mBQjcC}H@jHB!vAyU;QeD<2teg8#tSuWc<&-OKZh zrdbJ$07vRgThok(!xLQj?$2R%KmN>dj&;V{B*gDV-Mb$4B{Kmr$ATkF#3Fr*|rU$n#0>t zwIR&Y!tv$@6Zz3S>dZ*cdw+nIeI?FZem2u}b;)WdMXVj783Nv=wT9VD#g>@`n|H2LO4jv#U z*SvpZT50GNh3#n8i5?m}=cw{4HJ+c=UNQjsq$9sTd|;`SU>vx(#2&s_3irs^w7ZQO zvYaxMEKiy0|gGqvM8As%A^ zf~^rz`oCFzM%Btx`pll9qJ&OcwsY_=`c(+Hskv`inr@0#5{RWiZ|8Z}JnysqFdL66 zZE?3IkrRMp70d8G`xRMSQRTB#gQI0Kfh&8r?1Q4)OL>F z8@x$G<*V7$)$F5$lAS04PbrVypvv`Qo>@556piD@-Ba(`CWXeD2hc25u5s}kdu2%&8;_ih*z`= zn(I!eTPUii2?&qc{aI~b9wpgH*yGhR3|@_YSmnCQL>WnB%~cOU$JGcmZRW*)3wvG9 z(K$?6q{&3K-TV_b+8Z3a>Ylbk1CNFJS~iZ7 zzzJoMi^?O9U~{L>223aET<%Tn2;4>fs6_*p&aB|5$>Jq#v|7yYKZyc5KC{@M7uqWU z*zG4`kqvkbOKoZL!TFWqj5VJfJ;e5{FjUm?(h^znNc*mE1LjkeIh&DG-RXen{R(wJ1zkWo&Ui}H(oTqMuFE3!K8!4CNt5z$>6w-1->y|Ray}gIkCiK`G)n6a;|$<#Qg7wwarSQ#MmeqE_5TF1aic?v_7Xq{lYreQDM)w?$CX=a^`< z!_dJMGt@6r9OZlHFAp9m_}1L0uLfOTkJt?gmSdAl!Ap5IN%8K&L?hE6Q0|a4Rve?H zx81T^(#E{Ts?l!HmbaCm=it=5^R&Suiujb9T9RUN#C<(5{-5j-5bOZv=dq{yULJfi()D zw%KG1e_-u4*~$u-v024WGfcHM4P^qNNCFLuM%$oW49pf78jgg@Bf%n>iNq}0)&cS4 zjQAAVR?nhQGEZyUK>m~ZE?0}rnpsQZZV_@&81y5e;^|{rq50Lx+VwN3wO~CZ5%u0T zq4`)j<8QUAVY%+3Z*No8QmDmwWU(>_tr|Vu`psU$oY?#wd2x%#X@UKS0Vk{%M8w@_ z03G4{#DqclvUx-uLX#0M*@-fpHucAWIWt^^vc2od5Z$ylZ?Mh zmxK(z$R$;^n%?e2y*jqFD&wTbcJXj64{n$jyoxhbU71=bH=&eAHP+bWi1;XaSw9zE zf3xNhbpji%x9h*?@6f+24}5;lXz17X2k)|?RiBa|_9*%E-8JQR zAG}?Ge3Ayp2nZxg6Ve27N}+%=aR`uVekyS{mlSY}qA&DO=y0UDSm~|dEeb$SMP%vi z`e@hJ~P0&@UBP*as9UC`N$AOf9Z)EPC z@@mPt__~F7p$XWgrdBpFN}=qOut$eOlN5y6K<2pSHerR^TbEhuNX=NRxn~W& zY#?Qv_p2BYD{2)(Pc2St%E{(08-UCJdg7Xx%|c|3Zzp>`R)4!|)G<&Y?y}r*#9=Oa z!CICqajkIB?>M5vdi(T~I{ds=vOo)lUODk+@UID$sq7c5tw80zccz7EQFL{Hv&9fn zGxo*b@ERSkLAk@6Vh=BkVod%s){l$>$(SipOJ=+&IjFMD#^(HxZ34!~JM0826o90s z33%H$5jrFt;5>L4LA@IG6W){t)x=KYTBEIpXBxi+9Joq$>xnsp*o#3)I|1brD81&! z0z{bhRXbPgMq``(n_fG5R>(Kujlxp`xdFL}v3}7leioY{jYdHVAGv)UOMkm-T%4&B z%hG?lYo09{YkAfz6E~zj&v}sL4`6bE?dw4(Pmx~&vm_Ixlo8^!Cs#m&nzQDSXFl2$ zI_7}LZh@`x!4p=`$8kiIXWRZ;6>9T!F;Su&omPt+Ci5s`NTPT1kyIT<@j?1byq~>Z zxfA2=h-+kZjtTm~$u1BBp5qGflFK-3FDydcrrT*8 zKe~SoN=i6j1DtRy9jDerb)zs1zsfxi9$%&(H%<#Z9jJyr-`(I*vG9sB6`79OeQ(d< zI60=YS!$lQS$36NoYE>UDTm3`9o zw&tNR;uFtkz5{T?f;=4vFq&H==lFP;zdOz+Jt)B|Lkp%a4xX4`u_T#}efS)rFn^^w z4N3eP&6MLo)5)c@fnQnJe@d5M#4z9Q_RJ06oSy+c38visM;OEvToVGE=vTUrB~+@c#%>e)G8KYVR`Y7yQ#a$4 z#PbOaRJP5aSqK9m_D&-0N83!&roFppzMt|(CfiyFd3psvu~hN|j1mb+vVMoQoB>Ia z$`T_H-v>dRZ&_-m5+C$2+^C`ZU%a8CBmDIYRfL((>M)e~xZ%xdT7!Pm$*#asyd?46 z6@LWpba6G*6431EeyA#9_er^%%zE!boOZdheLf(kqJ|`~t#?|51YCR--oW$V2BZ&5 zY*V>m-T%{Ha|89)t{|5HNP>~x(zm=N-lmd*94!-s(V<)a>91LKqS!l$LzKAq)bImL z*S>zG$yV$@E^cCEZR<8#K2BGZPGe#AI5oK#%TlHRos;RZeP8BYVN9HArfOLzp2Qz+ zm6~g&Sx~0hZ45S}`BHsuo$tP)0PY_+2z~-DS(1ufGr zHwh4T%XK5va5J1G5=QpmPk)Wb_j^92$)7?KSceOxDo+tM@bh@z&u*+WEOj&2j@1k! zhizm?X$wiRD!)}tv`a{yE9KNfbg%eT+#IMCHg~c?A{NoY7hsP+JoJ^9eUkWTHWfIeK{oDHs1v_$$gwWY3Ld})& zwT``WGF2BBRq0OO;H81J&yBeVkMi-IO=A#qm{y){UwhVFb1~caPxwR&P zvTaU37hv;XbCtS{($o+%GL>`F0C~OL=&00s->Q`vNwaaUyJ6gpXd$iJKGzNw(bb6i zm8=>vddf4rQLiLCG1Wq~d%qCiLg^eK#3?^1A$ z0zgHVlNRTs^iW#~u8yti<%;(22wOvqU5RLQ4~s0#-w0dkwlhE0}sjnpwrrZtD z#=7Dkx%q&JM$?~3nl{_7k*KRm{6Tiz_Nnl~78&FBCJh?gWhZ;G;2?p!e^X5KH*l8d5pg@3_*znkUI7*AFD>IW62 z8|6RcCy%(9$M;WzjRDkPTUePgTxM@y7oo70C5I2R@@bI_{qP;~f6;v)$^W=*6c+G- zPTk3G%yCpeyremuBvyHNIwl6nUj8c0AGP5by|WA`$rCb`TU5IR?JN)JAP%n~O49kdA5lOq=dUR6`(L7f!oNjHOiCD>3HX8tR|b{>-hlN1sGo&b&)Gm2mSD=e}I1}%oB zCN;|CB{NxWs3)`1^+Fwkb@@M{z@j(S$)E$2AOix9_X`yJR65vc*!Iv$P)r%8k4(829RBsL)#agpyE zurk#MPxlQqt+KvBmn6-!B;EAqjaVfU`=`_vP=gIaB{YH>$C6~fj5zR~Os`O4?cwe! z_>V1{7+4oO!FWtvkzoz%;WFYGP0{I|nr@8PFN1~>!W@h@tT{EwBU4$F6OOKM>p*TBCO zwyoC}g?}n+n4BM4g+DLX%IzyYy3WcWCZB*Jwe9_OXQhemTn1<}g@uzVif)A-obHGZ zk9MQxnRBpd7*qt^y0mTQ2->G@x{XckBQuMp=Rt$?pc_6BiKa`JI(XY6Ej`h1%TFf+ zPK%GaF@N?9SB#^!5RE0lEZ!fQj$Q_edMb4PY5>t0A?z7va?di$7?L~ck8@VHPC+yF z-#%hH)C&eH!V6_U#eG-r{)${v&&6E{WS}Tf9AA-{(ozsbIH=pEMg9L%7o}rYq~_Zl zFgr=-V)rX*FdB~4zijEZ2=FG&U&xi012TQrO`K8MZB zHzPJy15b7m)V=ofPGs)Cztls*cre^>R@1#%E~R*sded5#!~KRHPy>JJH7u!72YNAS zHqcBlYfZEW3Of~nh1D|Y_2Z8(5Qx?&&S;E;XqQIsg09e9s!v+SBxiLbh>hsQO3 z3D=tAnL@2?F{F+jU(nR8{^K@;29qBAux7(p65fUZq0;h#AiuD;xsiv(2pbR_Dv*wV zns(mYW={gg_lSyK_wWLK#vwNeQf9F}d3V39RVTVHT(;w+UICe4Dj$ft%oW5@ zuyALM14@=AkoSu(C7WxaYrHmHGt^nNI2sr{>B>=S9B8wrI7!{*sjS?%Kbi&yOX+L9 z!y7-BG+w>bIIzBlEwR@wHqX6gOuAk+HpdbI14UszJ2_c;sFo&6gZqboIQU6JZKN@EZq;GOpmn}R19qY7Bv z>w)8<>aWcR-4{PXG@+#xa6ehQTc+cD$z}45Bg1WByeyqO>@0T(8^-8(G(R2Ux;GEc zn=;z7=Oof~cIB`ax9<;x#IHoFD~pSA=bAM_3eh;-(+rc`CD~c!a{fhNHc!NwQnVP; zGoO>2`S(l>H)^;0t+CH#p5ZU=r{Kxk@QKU3c8|$WP@|=`MuH2al4+;5{n|MBJ)07) zuKVMzc-8I!%}{P_3n#X=)KfDC-QB|fQL4^iTlnKdA?*pl9ht9RH)};MQj0s{h{DHw z@M-f{P(+jDSm$msBR1H?5XRjcGpKmGDkdrv#&H5 ziJOyESaxaZKl9Re9x_lk_tU`JgbjZI^75;fAFftO)&@sGK7hk+b+aKM;3mv=YXN@B zqV)J-`)Dm=^9Rmx=JN<4Pvc%os?8G1N>BF0F#U)plY{zUXm92v;d`G8*2uG^1J8{l zncLgqjBah|P)H|pRy0mKO$3fh1^sq2m#LVk&X2T1d(|5oO9+xohAKoRPgCIcR|+Zh z!cJ|}b%eZA7j@3cx%-C?8}(;yo|E%xt%=SC?N-g@gvGmAoAc`r-`9`) z>}}uor&(={aUUnwUl5(xuEB;vT^N}4T>RdJjwIViR-5G8vq*mJl?1-0@4PHaa_@wX zLb}mdElt|h5`W8Dn>3oe!$d+q_j#bx#++}g_V-(9%Uk`6K6z{CJ}lO1dL8(*IJ68d zOuk0e{23!AvM9dn-5}Bl&c=G|!+bvU#6$re54Yi9jWnG#ht5^4G-F627!W{Tf%BHL zFSu(HBw#{9igT7O6AzVm4A1TZJ5zz?HkmrrSt?7}sym9m$|}@L6SwD2IvgO@#IUy4_ejV35K_QC?lC>!A~|KFWE4s6|pIMhcAOAN&;Ta&ek|eMJ`EW zajn1a*1WM*(v63a`t`}|*QhiY(pLS{9$gdVe>CpP^Qdfe{a0BlYHx#e(a^oNr(TF7 zJE2Lpi)Y@?YrRIy*J*g^iuBVb=-{xBj>w3KcKuu|_%-8=AKZS}-#583n1`dvA!_+* zA9*MF%^V6sq1BI*k6@qJTp=Dhj2$N&Mly`B+X-7i+C{dRV=`rbMCzC4Tv7(@F6_f< zWAkYrL)_mnh+6HU=vVr&xn0dOzKdh_kw;g#;@O@TqwZ>3)gJI%*b{5p;#Y^dSm>}r zPR$Nwc2pXGHTmkI1p-dgyS77e2(3;1_$nuDbyJtRqz$c8Wm*;|b~P5mWP*a`#SkP@ zU({FT6}a|K^^r+fh8%U5Mry_o6@Cl=s))r9sF&~j^_k$RPl^q8thWwK?9O{Ik0u@w zaK!C1cQUFcnYC>=>Qr~w&si$M9xs(-2(AOq;xPP>!i!(NGCJ_8q+ary!sR?pPW=?O zQ+$Vnp4v$pHU5ST0kc4X?zkCeP@#uOTi3gpm!!5c=$A2>(~O0p4{IWa9h;#0z_@h9 z0gdO;OiaJl3|A~FmSyPRx;dHSS3wW|=F<6nmflOKZ}+MVGx$lXL_)2=4MMAo_nvP8N}hU6qP81c z$4K8EwfIW8U&(e#E?mpkC?rH$qGOw}7MvXQfXHaXkaxWVsWA*}sCH{h#@lX_o>W?7 z*pf8m>d8zV!+Rx=?q=r}tmLEJq92<5U}xY7Nw@x1+nJ};8zRZlqid;!YSvYfb4!(A zbC<|Tm)?P2|?1xdFsFKGAky|VV>{Q1`+ z%C7^G?exhr=^RL~XRmQp(;JntkAqYNn7zhxtCLv9`{H7AUV!@oDD0`Vhh~5}+^HPybqLqg`-xHHz76Wy z3e=;iRg>9L$^Ep^2syW`-e?~AMsOSn^#|-JA4ejKH^e@hvj>cQh}>Ptm~<%CL!RHe zr6*f|oF|hggf&UQ2z|vM_Ht(T&vMq2kBhOr{07Wz`%8!B#P5(lZ=$d7r2YY@-7xtm zdygM>xBOhO+6;LpZ8b1_6>5nm%|hocBoqzAU^_0lx-v1FzoK-E^4sIpDP0729}q3+ zP^wR3?_qGBFOjL4AKltCpdjBOWdV5x{CNFa?OYBvaRE*-R0a%X+~&lP4;SvnWsOAX-S=LFG29rps94_&X6V`XT}^&^?MoRZ zsUKcfQzx92OGl#KKjXRme1ow4k1w}`k(@jZtSCh=m-MW*L&IAW#p_Q>9)Hn?f%&6u zitoOuB{SzblFH zMkL+tX{a|CJTQI|f}s$h=*MdbDaPmzR1Fuim~GnK8K3e$cbcfVbSuXWuN?3M5)?9! zA0VN`*s1yLHxxEOm~hu|#UlH12#l!ht9E#wJ=DxAK&14F22P+e-M8D_uYZHDD^MN! z49UjbA7hip^rgQk&Mpn)b++xFvw-vlngQF3ozkeWH1$0j{^XA4_3P&3%tf14Z{m1ihEPlcHt zS`kG*{`TG&9Z}qL;tNIWm+OkfLo}}R_MLB3EvZ=b<}tI9GtTng5f*fh-}<7&hZh>PCGkyo<~ zRB5xebT%e z4MTGODegDLGZdK6`dcV#kZ8a=N{e~Ps)(!~OrKNx@{JET3!IP~xQaH*Pvju;SH9Fi5}F>we}e{|S=N>utQ%s!AmbP0h8UC;s^nSosS~^AMtDtQ)IF zmhh|jj2BP>ZG|=39wQ82(Duwc+aHM;^^T#@m6N_)Ayk6be@L-uBujS5FR5-&Ebvby zELVSB_?JWY@;FD}igIOZZCUUm#daSvjaC{S;bvSlD~g!IpydRLMbJr*;CD-rbX6a%%149exi#JW!;}fml0|5kbwbFo1|*p)wj|k zw%I_~nC<4$wo;4aHk$#nDP|KlGdh#GG=75{v6!f^5b{&fD%>$=D$Yd@W-fUoiO}rf z>fVjQ=j>64HtY((gOcaDn{Q*`_d<6h5XUq2IGVC3SGqnY>afUA$mU=w+g03`TF^jM zV=4o-eDzg}Ll|Uu_j}p`Jse?*#1U2}v_$0OQ>?;k>oJX-~8t zvl+0h#l+O4r`kBAn?cW2(d`Pg?jPAy--$7}Q;?=W{pEIY+ggX!2yx#W*V-MA772PC z;0?BNS(7ASIs^awgYB$qfv_F@ISZwUtt!nD4BeHKD^Fe9Y}+<)i)_b*PM%B-MtcW} z@39%uzG3MFS?`DN$|_ z96xfjd;Xt$ohB_#C?Bopq{9Yu?aSD>`u3VJ6*FMvb{8}jut;qCT(%QJjG5_NB;q26 z9PkHUS;C|5a1G`nH0p3CakJI_F-oiiCqvjktlw9s(=rH$l2PH>!S>jjI@e5&llVaA zV1-R@yw3ECbQ{q}60q#FY2rX<+B37AZ{EVN{fX62H;uHL&%#Mbc``Re;cf0eRF0dj z1mQGhtqEtvI8dM~Wh{eS5JcY?#L{VRG!4!_8vmtoeo4jt|48NVQ2(WJjFo=47g#LM z8?I}rg(adAf70$PTKGy;9@}loxGnqwrl7LUWOkz^l9%$rO+r63-8_1vg2lU!tUPS@ z9uh3Jc*IJ49IkF^4*c(Aj!oU1&;xao@{-k>{i5(VUZfQ&M#4GElWd=00n~@sy~Ry9 z!Z|JnYjrb{i?Z`d9_BT1nQ+}<2f>8 zq}L>}v>s!{s5PUdxpq!z^`OpAB_2$T-JjQox@K0E77f|wK{MLeezfo z=^u{W0{Mag@3%B|6|RCAPT|w_R0BYjusk_smLou$p#D(t78I!uxVFas8F$!T|;qZAzfB}9ucR1&EZ zmad}f(s^s0-6_&u4FJ&<5*MwN(Dp?cd#lLG8~tkW%d!L-9mWhJ<22eT)#`-~+;tvC zOObe|khR&eRt0%LSnZ#>HFKNr6jS8@9~u$vC|Q%|i?U4xrRt7yK-6mRM&%P>~AHJsGjOq6;XhfHM7>_1= z{w{bdGq#dJ<3TDp4hgYOefUh$VAth;7XAlH=jIzRC4|=Wkj^>?)3F_NR*tculIuO_ zBV+ueKd@7icA$mFI5}&1@}=TTv~hr$U-5Sl-r^|l$?o%*cTOqIA@idTt?VGY`d0Lq zySxurnG&g7wp+lU(8ujisvE>ort*?Drs3XXYYZ>x28Z4hQ))|r}wzhVB^e?=ASkmaew{o`OCp6`0 zB_U%tjTBf9mG;aZ6>RuiCcV7m>V78`ixt659&xG;3}~O|jkjiW_Y@?kBw_@s#($qN zUf~z;r%(g>3sDH>2(N^wt7iY~V1?+}9T;#@7hSOMI`4T)K(aR0Ia(Ydsz!<)YH)ZW zb46RX9IgudGpasgAyu9CIN+ZVA|SJZbhl@j?A3FlHvGfYym)M+bN?kBz5lA&&Gi)$ zd(ai??1#(XS3SygSfRHJ-0&aHzFNQ7%|kMPM{s@=OI#Nxs?jKvo2y_hnfMO}k>JmA z;ezCe$i&wyG7Wq26z}mMK1XEdf8=upP(ky$|H5;u3!lMm;Ibs+O;^KLBfQ$zl)>)b z*vuo^Um<L#c%mK4K z>Cm36W+L*KNx9Sn8RL2#j{hi-S1B^>Bww7WU#{-D+s@Nim(6Sx$64*PTF3Uy)xdNT z`V;K!DshH2mT=>xiYabAn^%nPY&-+CcRca^LNX>|djtU?g@%y%-P=(UFze8SNj73F z{{JJL69|~3U3~IL*n}d+e;CeOF%PQF?p#PRrI9X%U6Wf!V1i_9jlH0El}7y7hmpAl1( zz9)o9@iLUy#9XQi(w)--noU_TWWcgfn+@V6zM3+e*Bm(3D?@%OV7F9qdjP;>9zgyc zW#cSo%D@>?5R9?@i9#F08*(gxG$WmW`};S$rM6F5;R|LmBcq8Jc{8}TD_OrGY8y*` zPFWyoiV}w>VxG#iqPw^s#oeN9CK)qm3HzC(gSHXZ>w7qRTN@PHWUldC%0$(XM%Qvp zaZY~|G}QERWjgfVOlY}k$tg@KQ^pW^C67%hC8=skDzEgH)w)u=UhEn4_XH<&mTZdq zAUSax)u6})c?rn%X0hX_*Y`F8vV4!ON*$JLrK4>yiqO?=zv*8fyJZB0D6V{2FOFU2 z(q_bMQf;&TO`EfiKEUT=J@A$FrW=;;2w&5BX>C+g74TUX&VU>q!75mwGQ~Kew>l2} z!4VYjT%rw5Z3bwmPSpGCkBP9h!#TamrHeE}! zwTmX@zwW6#s&S~M6Kx@EcA)fKm(wWNx#SPo!f?u4{_^_y+7oA?OR8R%xbflE?S7~(5gxruH?+F zVYnVBV69e_l$l77vpm{iH!K3vXb_FmAooor4i_P*BTVcg(B}eoiN^EsQ;titlHpQ=I%3!@OysmxE-*Ajj30 zr<)tr^na3`@l=h1SI$!f`N`$l>k5_n^LTyG2aIZ}s>rNdZkTiNhr_FA*Mz{+|nl!UHCy0O6f4s78n#m3Ai?0Y&el63mHE`$&Y*?G91KC1#mnawTYK2BbUI`1|@j3|1~%r~I8uBra&q#RknK&Vc3;mFYxR(s*AO ztZo4dl3eoI43ggZxb6ph6kzym5XCSZzGmM14Oh#?c03RemI-s${ z5x6<>;sj%EeFc-^@Bd1A5;O7qpOc=0|0F$0aNJg+KuOQA28<0OxgOI#N!-=+g-nt+ z9LPstqTePD*!FY2cLVA{8%E3$0g3b@Fs6bGhmMWxk5)|FIJJ_w&|o5`y-C*gBB7;^ zAM`xbhMTgp6u9y|i6pJHja&nIK@?7Y0;8ec)!g7p>gQqw(3wV+>*=BN31whUFW1oU z-)o8b`G&+f9>#~eYFDXh)7fz~r;|fV_ZB`5s|0{44JgnS z(QcHC+nx{__WGVMS1x;BI#wU-Fllbx1SPI}7e2FFJ!P0ZRPUr3FW)HT?^!ys%EmI9 zuj{xHU5lap1sB6A4zSK+!_2vJ#|@x#3gs*i53kT@DC@ywvY~!oy6MyLd&7JC#fTJY zT+HrbTP26vM?o)BKR|yIORq2WWJlg}XlmEV(3Q6t^>qL~iFGY=AKphhThmw2%*Me1 zz9QXG?M>sx*To{49>v;kYY`^doSEa(xTuTkPvcjOl;$RHW>3*{YuB!5EQZsee?}5r z#omIoRhYEQB|#&J-v0@CO4fryo*jQfp2esor%N5!F=egj_lXt(^*e0Uzq5_LNTys> zwrq>~b6QB6zBDX_C)uQT10CpTzgA(}F`oLQWMGQ+*)_sE zy12mJgM{-|Oikbb#|Cr!dVzj$nNY-hxdgLPlMQfZ)*S-1JjDu<{?+oN{@e1jQI4$A z;Fl#?IhJt>AD&HY0dPA>7rH{Zg2%mtU-Z>eW_Kc#$jFZLsDt4_&X%wq$0_5Ua!#B- zfCpo)jX~q&dcnmXse~lJ-VmMqyXooiTLk>yO-~{8BWpFak+5U=GS+%SIMAgwGv&=w zpb!31?g?N~%(h~z5h|sW--^(s@-8>T^kdIC7@mYQadNdqEzEzAYALIvo>d_v%D%7i zKT*#(`=Mal73HiKlW^ScDPZQ93KnB8*Py+F#5OmDAznz*?>r=(-Hw7wS_<3a=h0=H z%#v4jZR>o+x!)P?dJ!+DiP`9~R-P!n-|&zKngaFU78f)VT2oJsH--mhE-RAzYEM;L zz;V*0<1Sy_m>S!WIFrgKi#|m*d)SKqnYO%W={EnkeIgNl>2I_gmhAJLa_-_~YsxR- z_K{va&i7fM2ac!vQ&;X%PUpWRdOwFUsjCj&>D=JivJu*H5LSGaG^9j3DxHkp0yHf9 zNlL!iaepVnT{D?&I+e1mrT?z|r_{TyKjt_2ThrCX_s{p}X)Jubq+nKH<+6zedUkLY zk~$|W>2<0M?&~+84-3>-u^Z2>0lHPlTxk-rqT)D*YjH(WF5ZDSImV1nmg&FBO#963 zF(cN$Ce+8n@f?TEnXqrdXOlr;@1dD71;iJ%^S$+jdCIT|zWs~UxkaDYNB-Y~b;M5p zH({Mxx)l(tL&*OB3hStaclrI;gIkfkPfCyV*^kac^eLxCgjWu+?a9T4Jbyrrb@@N$ z64@#BPE}iPw+`H3*$9Xl0)D+2^H2XXmk5e_-h-l^-n?lDEKO_V5K3=8uwR78Bs{I0 zogUa6&cL)t`ml6L?1itHBfGIFFn1Ul>pSYc;imAH|39)i=rNm@zJ*)rv<$9B-CfSW zI7S3k*JXNwhK?|g3Cn<=U0Y51-UQHTjFHPjHFO+-@D{AjbNUaH30(Iepf@_F%Q5dV)4})w~iR=2ZXt6a> zH{67tCH3y#mdLyQ;J9lQaev8B4$SNptbWRaq>MeoZvgzT$HRh%=b?R(g+JC;1l2q@ z<%$P~p~PBx-#FY2EV&0Dcv10rz%8K&f3h+6Gd#-mZ`*jW6ojE#o}OKNU8pb0U~DWJ z-ITENz&T6D&$?n7EHoB>K1NG9;+~Jh#}?PtBp8VFdpvCvE=BRm*`@!Eb##%rH_ok@ zmXQ$v4OxmuTZ%7K+~;Jbn7TGX3p3s%ILeBGFM7j6X0;>tbFW3vm0OShE?&Q@?$4cE z>ZWKzmluQ))pFQbeHn7qx@>BL2I?W3K&*l2iS46pifX6@!J^2Zl{#)`TA$597Su(c+9^m5^J_!KQBm&99mzdY21YFV(rHvHuRjmS!Uumd$_ z9M-L_V(glvmNew^QXAP3jfde~DZ~q%6=N~=@^wt!cVOEhr12RZV;o?irQKV}viV!m z(M}J&=t7KLA9{Dj9n5-@6B)v{9mtH-qrBX-r zb&80f`=pu01{pbm-BhHr=z(fGVxzDw7-AXuC#AEbMqy0x>p8w&`oNOK)aJmHI^7rBUNob?)JI zHjncX{wc{?vf}Cx>=K(Vc0|gy9Tc;-glA_v^NyHg3xfv9(p7_aFBKKh`361LU4AcX z7k*Fzn;6p@C&^j!;Z{|UKj==xQ|us1p-kN0A?GVWU}PnKtr9=cS{kBw#2%06WSZXm*PGH>_uNsZ z-C10kq=pzMhJm8yjlKvIi2aBVn(rJrM1CtWBvt{*u16VNgw|$Id}`6mL2FC6ZYIMS z_PiQuG;Pl`sqO>#wj?Q0C}RUK=6fORi2~OsV<2)=iCTyj<3GO_`GF3KrSgcr+5kPh zD4~R*gphe#+|C{2orZPU&$i!`!`T@ZM$hm72EWEqA2{3F^yiON4y&*$-FnZvXzO!T z9JV7b3!4LLh$99H9pgGYyz0+1`&PVIpSv*7lbIWPU$czjQ)ENDx0~lVa5roEv%WnC zr!;)teVxqu1;YIg5oLBoj`%Tu$Y)J|>g3~&yWlbZf~@~yv>`B*ZzF)6=h-h;E?3Hd z3}&XLhY@@vr!8mDL`P)&Mn8`kCFKuc-+WtxR%+%s;KCQqnP4y(vL|FrWqf&bfsj~% z6@J!yIP6ig|L|*C4)H8Bg`n4vSgx9Z+zErWB#OCA|-dA|zy zO{eu8d%UX@wCnGBUPZ78;Aur{-B9auOIKH~)>)I`wTB*Mqy1$+a`g?ADyL+jcZB|c zIEcnlEg+ZxGa%k)l!l(Jc|7v`h!!|I_E-b}6Wec25pM6wc}3DJb1zl3f4la)-NV|h zlMNIF&~-kbMHzixdDGRNzJ7-ddI5n#_+QWzgOtaz%QRAjCI>rd6@VSNct_;6iHl#U z6yj>&FqrE7d+0ynATn?XC5vADXvWzJYi9RvQU^>Xu$`mLU|P;Kf_*`-P}?EYH}(m@p#_MIPCdzD9_w8vBL|E$ zf}av`G>*dXGBGIMVq~a1f(s zHG(^x*0HC}ME}2tyXWTIzedmVvF#n(wr$(CxntY5ZQI#_3t+4x`^zR%FE-L0y?PCZjrr4W;qHtD#euvwU3HRsxMs25B*s! zYmWCfk8O5^8(W92#}{pC3Q`u4Fy^%B(11qX&z@Eff~#z`eTtcyF!99Xcf;dYjO@8# zO8)I@QH_e+t6WExBU&t2cS+VY(t5EJYPYp5ZU-9e{UjczIKUOSu2Sw*Y2)#7pM`s( zh6<)k%_(mB>#f@nBI6JFqHW)WP0NUx+%LOb&N;vH&6QM#GUPr*1*tb=ec^U(RxseB zjR#lmdMTHPO|&l~4Su`01A42M0&yZ#8BCWuvJGgrE;}Sa;r*_M@Hpv*wv}TcPsf2d zoV1T`oPfqwv#ixqoRb$3K`=?4S?;P}3u|D59X2+woX5lq*TGR6yhOInU22^|0(gPK z&wulbZ$l#TO1A#EP@JfG(758tS$np1DUTbDn$k~2)@5?yDYC5RVHt&=CUXw3S!rT6ar8&kGur`^!vJ6b1U2MuX(n-h0sHg9 z+RxrKtd;O5MhZ2S#ZbJgt{EBT;=C2FbWK=eqSy!AKM11`J}VNz)(ByOKG3`YSf`(kS0)*=a#Wzd5p!I;C1z-zcLxkz5pZV^p=wo^ZTkyKDY5&K~n~N)dHN<^v zUU`hl6t;P3{RqVvx`ZS#+!1DNho-*6nZs4B3>txpK}h`|pC3WMaj6d%n=>I_KhYV} z{}|*tMZ`z&N}9xBxAMShj;`slnR`28)-p7)Rq5V1@t|He&}jlY&qD*!uTn{6YGS?k z)l{$%OMx$pe|2*^llcc;lhObg`6+%7vkQIXX^n$sLzV`Byk!1dC9G03TaA{j3B&@) zPT6=Oh!}iv34<3-`{CRVjKcxgLKND|V!LFiS$3294xSn3x@+(;2!knfo=mp@ph1+W zsD!N#w}vouFfZp!?AY1mGwNQf%D%&SXEL*D>`kv{rZlOH=!IqE%6D7Ey0&v_NNAG3 zwM!t%oIO>k({=lJSHpqlp=F~&ivHH6sMZmF765-1*niKvy>#O>_qyJ{K+>VIzJ7lm zPSp|AY;LABI-Xd?0)0cSEpPgkeMbX#eClJnN7J6oF!{T#`(4R60CftqJ>@`Bb0b2h z02-i;pN9sv%gZ+}&6AV{+t(;vbxx1s4mV4SAcWwOQ(0w!=z|{DqT-}Md`oo15PFVt zaRM36_s+)5*~Xq+O8=`#MU^{^wo!sgV_c>2PIvV$(_=MQ(q)AGx!{Nx!YDZvzo#r> z8g^czMZF-zx--dDu_ZHPFdMAM`f0{PRdJWjdMZ=T(Jx_T!Aty~jrN+KHv2?%zP}HH zR;{-xmzE|VJQ^(me}oxv)K~AC4@>Dj?o#DB?o#PJ?p0v$`}n2T_d9lNEH^f`*O&Eu z0lt^->zdkHt##b!iqhscK&Zdv=1Bv=$;0|r=M>_=6da(uo_=-cvKgOK*j)t=;4g^ zaU-jrOPgSfx9D0>dSt-6y$P>&`sHzTbo_-j=3bpps%h39NJrkejHMbAvQqLUiQikX z4;ZtKB|L&&mlir>qTjC_;nhI_x8gy9T5jq+`bLKn<6h_e;!TNLxT;h3B3~g(hP}h4 zjNjIss!07b`U$`&{_k2u6|kbOi4Spvh7@WV2r&q+yl^&wfT<%?)ZITzX6-D8w#WuP z;M4+p5{{9_k%dm7I;A}2dz+@PZV>W;INoX9iowgLOWC$&3l<)^qS$gW|j zWPW#fkg=$kc$WwH6k5I4)@Ww)AHOqCt!se#u1CL#k0&+Fah)>yk4Dfi2@vFLLr)l@& zmea-X%Dl%D*vXO$RzB<;_a`P+jB2Y|ebA6eCVfn- zd7YlN*3XqPML02jtGNcJjl~^6Nod_QoO3qI)zhi#N)Szb+<#LM2`|=~i}I`51v5h4 zMSip8IiN|?{XP)CQWr$zQB(A*&a|w~YapX*jj=Vn0wRermeSph$hsAwsdyp=?jfS) z=M9yH4SOM+lT)cmf^#LVs!*y3x_W1u7p>0!+N&F~m#W?jEkq{S(Z5U3NrLWg?xFwz zy*tTRk+6~nf6**4DpUX{PHn#8^p2?qi%IvPh(xA0ykSHJb;L;K0?9?>fX+#@B%q|M z_h>xr{Y9+?v`>$3V;X^c5<6Z{EKT6WZZu5`nj@smHw;+4WS&G5{U_l$>3sjSqNIw# zN`qgUblFpS*x!gfo%qsPZah4a!^-Xq2BK8FZXmiOORw?+Qli*mt5}2AFWQe#dL81l z`*q&cesT$jvfw1ThG9{u=7!Obzp}!HhFmy5@Q>+!WvIX^SGX*4ojV#9`kGU ziNJ1zUgE^1siqt8xGxE_#V4A*)nFW$q2=jmeiDO>UqD*67VOYep`>u%5l`b${lUxs%|#j zDt$k;krUve6MZmJzOKh~n!SZcSUfFArkFizqkWVh@cr6~LU(bsQn?REo;nj%hU1&e zni6e1?p*0Lu8qR4uPL&9hVkPJZ8g|L06Z0~S5aDY)PZ@@JEQjsSoAd}XVbAFz7?6rjkRTly6YbhaVL$4Ue;Z4<->W}oWD3sIQ9K#QJsdV*f zrUg5>*HF;+pmOn`-qyIaP$cCog67AcP zU%Jw*Nv1hx2Ms?h%~`lj)R9X{mazUfz5WKlU;Tc+IA7r@RtVjK{o_Y#VF+Sa>`P;5 z>t0~9WczqHLFZC^(X8S>Rcvkq96pS6f?nH^wtdrqddx8F8wyHzWh((>`pas9Q~Brj z-$^d3cNx?Vxd>;_Pu8=F4iSn*_K*lWif%#rb!^L@REI(__ieMdys8qBdyne-Y%@mV zi?uquE1$i%lQn3c^;_kz%6Lx~X|FSKBA_cHqdKW(jW}y>uufgZRtg^nxLU5t)d}dJ z#3J*S8olM4BGHM#Y)>~S?#r_6!W^(of9N{Tg3tZkqWPGs=tQv1)FRQ66e067*b&A@o)=pzf_CXUgtBk zkS80 zW;8SxE}9)pi*W#?jfJw4hz5}i2at^Ukbtuj*9q%R#ph@+%MHsp(7|)P^t~O;*5fuj zUI}01NXj(t4a+JK*1A1XJggP}=m`oS4n=tC-CFbTqsdfhKubQz!}8}@frSn_@y8|a zN74VL2lQ`HucBozJ65izo1}HPwmNcU8N_cBjmIS>^}`SZe&<#q(N%(7OgEHZwYq&h zsNQ)sWgJ51%hgsps`6rs$w6IZCzthmXyARf>>3!HZ zeqmn8Cyd)(XCV3~^P{P%8)W12jRW()B{n_0PU}ij|vPMiaghpWDf{xSDMo23BD2 z9x3mosJRn7AW+Cd3vof13=&Z`7-Opn1I>4fWCT*wh?vv}(_9BFx-@P7 z(iqzykwvMY5H>Uck%=o$ew=^>QpWM|)S4+Mq(n2NvrAlCD=5#jq?h`}rsPc16PgWT znm;5=G?&J=v=&HRS6d{^F4`yAq*oB6p(AHQRt2qpm;~S5;JF!bM*{1q8kAhx!`_Nf z$1=)|3vJz)a*K1ZXvKu-37wL>m?t82MVNXyoj1A9I2z88vU)jMpc8SrQ8|+j{e)RQ&xcq zGR$(;uOkw(ISgpV>)5f!%V4g@TD&!n|CuUb=>6s}qLb)n!1RXgK<^CGxRGElpg$W6 zK-ZL}#%t-Sm*>vik{7eVb|t}&p`8!Z3T%(WVoO9<(IS}ujcPu3#(sMXnIMk$e;Pb- zm-I|dxU9e$f=zo{OsvtFYYP((js@Q^S%zUI*K7;ga;PGlk5ssX?yrQiZ;00+p97o} zgwwZgjNz9V3W9u}Rn^nRy~}A6y}aygV`gr3jJ&Sl6{WFUHiseE(VWwGmA!3Qj^^mb$dorNmIvb z1Nq(%g79BVwgC#~p>Cr-+PY`2s$t^Pe1f5&TH2(gU=VLC33}g&$!sLO6QmLZDEd3x zR%lpTW)2xtk5{OE3Aoj+Q0V6UkA@dFZgU-vySW-*K;Y={lhsxqf&~VCK1N`QDNyHe zUFD;;*t10aE%S6>Y*nQ;V@0*T6HPWma_R-)kocE`2e@(lF9~lAHF%-#Uld+GWminX z@R*`~k?ZdW(u+3b3td&`KhQ1??u@Wd({vdD5m}?-WxFlY1{XDz4Jf+&f7TB{(kB{f z7P;^b<{RJyZwxN50N`D4mqBi&8l9xnOJYoRieWhRh78f|z5kun-Z*e{hZ+uj2C~}N z{byFYUQ*uI48z45RJ3uMe;$Php4rTv^}nKbcl6DIIF0OOWk<4-WG{u?x<^omtq!QU z79J?bh(k@Mjx@1!#f&B5@H#Ec=th!gY%~`iyipce7$%h%(Z>I8i+5Z%7s8EuNY&IP zH2q-7t;y+H&A=?3IbR8L?~LbQ=1m-m9pwB`hSJB0MHbSDu)G_4{Zi^f>uPjx$u@EcuB4qIY zEv3akCLrMDKwlS-f#D>(00x0}>lJaSeK90pa&&HT+}h;ZQ&%g0vVM=Z?XiSM?100J z<|XO+;fVlnrG#kZ?e;JA-BiZj$!Cdc^WoI5>Ntx`(Nmpp!FjV#51aR(H6?iY$hsZuOlm>NEbe zmyE1R%wn#5~2esTa z>7LwL?>?s(pKNIf1h^C2tG|a^;@G9SUbhG9j}`xK-7c*Z$TT`F9&V!MC!1|4ir(Vh z8a`duG8p`&;(QHqLaJ~&bST@NhJs>_`ywh7m#p<4;VjC))DLe52|{5hdML|Pyk5HT zU%FZJxFC|>%E-;IfmdxQ5PX6Ej%KT-|7$eMi}oMUYy%VtNDh7FI>p~KKYaNA*|wWZ zhJr!4Q4TboL|--+fN~QXD)mtkeyiE&YF3`sauF`5AbllE3Nli8VS*zP6M&LBr%H*` zRHo8^qONhHx(Y3FfyrQ7Q@?_DfgJAuAi7j?lu>7c7*e2>uJC>JC$gk_{5D+ ztQSmfEoi`5(DkE08J#z!L5hOst-<*fHiw_ZR9KbC#JxExs6wSH#QIEzM~0B$MuKoZ zoG2NN?v2A;odl5=zYLW~*qA>UOihopY>5j}wL3~^rMsE_eT8Iw;g`2aqs{4C8 z%GtYEp#=^867>HPYK^Ny;q?Uh;;aiFh&y zf|8CHn#6Ve@3b9jH1a~X_m9yxIp@TFav<&2T6 zKI^e|)m39O96)naJg8PT`*7CQo6bdj{qMncvRajp(aRMe&uD9F(Ep=r2a53^v^`%v zT>TdkVW7GSDQ&PbeD@2-m~G(Xnu48e;}G1#W$bWQp}jl3hE3FdN<<@5Pt|-%be15q zStC5y3mrC_<-yZ1`EIRSTW+T>QSNt6`I5!WWtO*=;X(jo7r#1_aCJwk#DfX1Ra4op zIB!VMOE~~s?h+)=;CPG|;=+{a5X=QvO9IAG(h}vdvK&x4g#~vzWiWL8 zAESbd&G}WRDg3gXLDoL;<)ql~|2xhOazk?y(%g2>^2|rfgo5>;G7uGRZS+nd9Mf4m9}JeX;}GtRDy#J?Rx4`d$-{^Yj_>%rNg2bL?mA z9{GBCyml}7`;7^0IKI-#0HLjp?GvB^=`>3`<#jb`Bve+OP5WhoO4 z2N2uk&+_eP|3ldUPTT%Sc38m3XKQ0~CvSwN-$Tc)7aNX84{WWgWusGqEI)(yQyN_6 zRR3-8zU!aw`5IZS7nIk;_DpDKX!`+4Xqm`wYQV4T?y&!=**!l0quHr4f8uaKS&ZE6 zUxZDq>ebZJ$?=({fUt+eJONg z;%bIT8l6T3|5uzHQ2|ES{}aw`Z~DJ*b`X;^g#gH~wyubyQ%3uMTQigMJNZ6q(I`4P#qY zpDqzk0OsZNS4fo~>4w^!!-oh4B_sEA*)f7SxH^N`1+Mvq#nHi9r2y}_oM>@d+ofuxwQcZ z;ZCT94YN%LJ7?aiWBdO!>!L$#he*U{T&SZK^bIp_pyEC@>HsCFFgN}gw=W!Qa4-=p zf*~)oXH?qu)zh91U#xawoF)KpAACLe^ggc-aYN#(rOKFZ!)R|jwLOn=;jNhjXKLc} z94s<7JdWia*!OyfT5=>&R?-vLQ!U7K!b28nEtQ4pEs@)T($*$qX}Mqdd6C9CE1r=M z286%9U5&WQms|h$E9G=e00Sq62+s^6??$i8aIzGxZ4J6<>~m6d88J6h;}j9^3Wf+PnOc~*BtJmP&c zU9UzmJRm2~v-RTungEoG#p!5UK$wVV9#W-N%TZB)_f2R(3K6(-=o}nS+EhuWFU@3We*v4Z z*8iy`)vw7!pGZR>sQ##Yq@0c1g7Q!`rOd0QT#RwYsf`~IEIpeFneP;!sHq%Ah2Af& zoin^`EStuw=zgJMegjiMr!KMctIQ0@v)-y^UEpEHiQ^att5VoHdCHFXS+!r1`dPJ) zrt)CC$j_+D6#Zw_UKTpQ*%N%Y{RGeg9WH}*s@x~5G$U>OQ|5J7GnAvbe7`#T2PBS01WE)>mtORg*Wpk5>* z)J^i5x~@7q%s7s6+L;~G2Jp${;^vc3g~V@_ACcYZT0;dg3NrSXSV7?wU*y}v_`#0{ zwD^;Gscpf!5Hqi(OX>0W4P&v6=a4&nQ>=h45hEs*evU0=r2vuSDej$6ZRftc*LoR&H$-fUaMDEK zS`gko1m7k$hT=~LFzn$$u0P+3LW^S9M66%r^$H`9xmtziUzKotkD~N#sBJ0|wF4Ez zxx+zHgI`NwutvUC!pXl)L}>&^L>fxEk~NgJlh5+A@*zBT#AATx{{*cV?q|SGkj&u% z_3u}&{(48F|5VGyTLYSfOT;1Y`fPQn2|%s2PIu$W?-NIM^9ZQyuq6txH?pV@`J6*h8?!!&IM!Ypy6ws`7KR7?RkqlKv+O@lvx++6ixl)+1Ds5>yU0jZIr|(IwwgQVxh18?JcnW81Z*J>k$wVS9N3{o-|p@Jjob zAjSWp@;DMCQWUSWcCdRS$hl@u+E5V^(%aX21-x2Eo7Hhx!|a~EHDhB z5?B4-yq*gl&ka1?c(vJF=$4aE4ZA!D2Dnqy5ss?de%%!CS6?E1r`T4WVcbEFLG z!a~7fL&`G_S+f&m+C6&KnfE1^+AJHPR$Inq)?wFC3rs+u-{GGH{l!(@Bb^G71{6k5!E=pF`h%IK@PCG7~i)rWJM|z;do2wj##r{Og5Hd6cntvf$dwWB`u?#cysUlz4J+UXt zN>sgrVM>Ce`Nic5;-Nod)d$ykz4(4&U72E=NMzzsj_m+HIj+$(4?hP+wl+pEobiBT zK4qEj!&79V(;rMN+up6kKHg*WMfg+Y&(-W>df^#ZrzG)#u!>7|`owyX853-A>r4JgDx<})5K_S3y-N0p!>Z&IO#h(%RFX5(5!PNQ2Ho0O;Kc>JS z4aCn;O6`7IEz7sQqms*Ii>h483z9&=aFm4pt9A)^`k+y%nbj=I$lDYULRgGD_3oIY{^Jg0V; zBmk#m5qK*YTCE^Gleb2rzXhYdoZQw@>hD8iMg;zskUEoM@ zhAKqa`n&{=hA!Oc`qjVyTnX*2Dn}RNGbF6WnCswwLt_#|)euK={=qr|%zyTEv`pqu z!X^UqZD=bPT~@l~*&wPwy(gc|bhTS!N)3_rIRZEWHV!vIq43RBUt#|qolrau{Eh3D>LurPBt%+7qhmsT6 z&9T;b4yB@4gC5jf>G&3X_=YX>q2|34!mzNgd^7w$>9hJ-$yu>R*uYc-ANqDj3tFLR%PNF026?}c(2FbM%R~_SR>V4bKl2Gc}botF3ZZUGsYze zJ}yrbv7Ki7lC2|4chYCu-0c==LBur_0R-Zm$<{sZG+9mnKqw-94cv6)WtMCUXrO*> z9Cqx-&+oyvuxSIuL|BHhjYKJ{ip#`z@kHy#A+Q>k^3j#fd~%N&n#vfFx#sZ+*)+Bl zp`EKfd6`!!ARBYz;27pNab+Jhc^5=9w6k{mTl#J~$MF5as(Fb6l6(;4r*nE+lfOFk z%Qvl!$HE9(uXQWo96S>LRobVVU zc3*eia}6r>$F@tGQOo(- z*;;j1mN`~1sZASXj{;}s_X!QM$QJ_buToM58JKFyEz$YH=WC92ab^mw>Y7D8Erol1 zIBp_Xs66(h=zNwj3LEj3vE&>A9)#jtfW4@q!+{CUb5OAQsm%v^tuNp0a&r^pC; zu9b*HTTs}E@I!ydgeK%+Fp~mKAr$x<%F<+IO;kHX02(qaMb(D5N}8(dDDq1(O)Aj& zM#LV<)&-SyrGA9F3RluTHb_mnmal=$&Uk_Q(bkA+;RP8SCBr`xq;jZ)c^GsekdwGD zAqwtlE%3Gr{Kp76h$yi0WTRcq!AR6}h^y)?{j2mZF)BIRg)NNnl}X+dNm>* zzBofk^fHd{%zyuA50KFlR5T$=D&&g`o7rD-_jsl1_K(hend}Kjj@Zy1io|O7JM|d> zC**h1lj~rVh=c*!;&!oK6DHrw;>4F%jDFqH>^AC`O$p#L=53+z1Rr{2sJ;S+`;6aY zzzA7E3s{0+@Ze7)bDPT%*!GFbO=|c6nFtBr^pivt1Jn~3Bnw|~Zi{n2s8JuJ`k%S8 zQr%jX1s*peHAguDBo44zKX|(L>gsa3#GaMwiVi*V__|ygL_l6 z@j-=GW`_RFI{*G&TATLP&eG0)o_%q(J@g_mv@+cbkn)L-1x&<@lEU@5-rRyP34~%v=et&**n75}C}z3GO}~whO3atuk{Y&tv3B^$2a{m-^6z2M9%G z95I2_$Q(u2jg0ozqoe{~+iF>Jsyqg6$MYZx6}Ja$ zSG#^(+f;IMOe@n$KgW6YpukSZhEd!n0d4qsu7P|tG*Ao5+2bkePVrgj@9v_#H6}}p0+t8P(Uvth>|(AQ`G(%1 z+3bet_d`l8m#IYgakr9k!xAUZ`JQ8jTlBN!HY;z4o-5{!IUaivQ1q(Y%cBn;aq zA)Q*VIzYcSnKGoe^^q5sQE3*%i!0f~Oh5`jK}(N?yMgAM;TVgf@#&-{`e#$?FeOY< zI~TovX-IFnOF6^jYMOUn@yReMBM({ZI*IJ!8Lq6oxO#iSR5zO%+MB#`!DN(_A6LKJ zGOwynHYa;8ts)dk%w9M33wz(jqEg2~Tf3{|E}n6v8^JAaK)ol}TK4Q$X9PKSw)Y8Yp0c@F<*fg1aW^$grZ9U5ORfGWLP*Zs||f&Yzu4%roQf0;88CK_{1Y6 z0d=3n!nm&`mA-6Eb?3&Y0Tt^52A~ohRm}hs04Hk>*kmH3zi2KLV4!Pz>G@*BG#Bgy z^i@YqVIRMLJsWqk>V7IFbW$)jbTX=#=op`k@Hv?l5>W~UCB7AYeT7Cgb((&6QA&AHJ zRg&+|jPw-^j5QPz`!v?Dm3Svbkp`Oj$UaeNUytNPyK=~TF;!TE{m`d71J$AuSOh|5 z>BWfdkd+$s5$rnW&mleYv;)+DF}(^6e&6@{c^Xw#aZzMqVCf=x9{7UNb6-F5f#2Nv z$PE1Bd$-^=3A4b2a4eP~&1&S7I&1CXn&@tdzj;2IbW*vsl`O{?@WXQp#xw^2uUvo#wu1AOP;NLdzq zgOsZQ7p*TM7V^sv9=wOQeL3M#=2$6H>$VOxI)n@Yz_H-q7O<)pPy&q1^ZvoiJcp+$ zJ@ua@xQl|nS~N-&UeSB2q_dB0wMKS6z6y{PLVZZ~TQ;v551ETtP-v;9NU{S}GJTdf z)6$V*q%{?p549EsY&#kpIO#f$Y7Rz{baOx1lg`d)&{x^$ zR%R{)#r;XUE*aiq{?5pLX)yY9_ZUFp&-1$FU<9jwSL8(_)Pf|%6OK+kihfyaTM_~& zJnXUUmPU?0jIP=(J~yfOzILtE^#+W4?w$X$C@NpA6DR!5_{u%Etp=1m?3j7k)mO-A zKyBcQ;tHL<9eH$W^mWFj=i~ljzBqPeZu^%84oB<&>=o`K@X9-DxsmF{-k zkHf7YHoLz=5-pJh_?~|2ExPPGIsBdS2*Pbeb<|EzVmEu?ZR}{8TgP;Sj24N%)>l{j z^1!*h3OpONpKpUcLXu8NH6y*v2;E+h3Q-$Sa-8&^FfQlI@6o z8@Z;i?z=e7f!zb2c0Dn$+?hzrLik7z4yz)MI@W#I+ihE@((qc5r4gz!*;(^XK7 zLbq_ulB`4$?{JrR7K&w`D3!2@2wy9W@s%q0!uk=8KPR=HQMcrEvap2&N0xzQ3xx zwRGb_lA(S%G;!(bSx&Sm$LL_usVBUUfZbrc62ztJnO8{)oJlWwii;8U>ENL)IC0Xb z@5xkxyY|mfyrk>PQmUTM?IE_qMYVu>fYfX15Pa&-vuw9-)*7lpL;Q2Z(pjlSs-iCR zUshBPFOc?_7e#JVuw;Q-qZfmMiB@)ibIVx-55FtBYoixd+sMf}){xn{6^$>FQh(=e zSg(bs#aHytKr#y~>0q;DV%|J9Q;%U2z>_N)jLU4x8%7|(BKz978x-_hVST<(!bTZf zGCCnwMPdY?!%a<)#ybaeo{t)HA$qtF0zMJcZ^PCi?c8F0>I|AASE9m2u-dt?pjnC< zPFk&bA#iW#rWK4EiRL~(_WL=*_BqmH>)8I%3vXap{yCG!DH(gD9Ih%tPCbO`N6tq+ zLmx=!EADH&j8tTW{7?fK2$HE;iUCzd-hXw?o30ANmun?TVpq6$2IDSi{JH%b^%}zJ zN5k{+do!qT%@Yr?sAl&w>SKGH-BF0+V+nJJi9);8rK zG!D#y-4E9y4>qAxv0;S8gnTY&V(L-^(S^qHM);N4Uon*@NO0u{T~eVD8I3d)SVs@# zjki~DsxLFFzr84in-`KgZ3rTV&7=@A2WyJKiSr!%PU+eLz^*TKcR2t2s?vHn^iwo%1G#i}SD*?IXh=0l%{)FoqrH!M?q_LGy za*opQGMt;Wx=Z)VgGH85@l{|8a`4>pHwE{?KO}UTY^7&fouN?cJthcn&jQ&e19h)% zB2`5(&+4`4m&RK!-DRXkBSb0QxU~$cF@kdX^Lh!3C2nm`>nL4 ziW-YcJ)3twei(8E$|n87!L&*7cb%jVV?PjK7g*_}Np=lX+FZ1;^h|wXzO5r7(eP*Qto)q2Zj<$4`T6#Ih=PdIYL~OoXSXz;@XG0f@v%_ zy{MUjp3HCU{F#u+hBd1F_pv;oeQGlXQi>FYY}ftWcxW0d+}hUbRo&$jWm2DjW{u#} zJ^}RzKV9kTyhJtYD8S$-n8m2s0Yq%Kwz{{pr!)LN=kl=gEn2R}hkB8aa5sW<)O0Y| zU`ue4)Q@b*m$(lu);8}9Tg04{?(LEnPQxkz`U49r60^!s+_M)%<9Bp*e`%;&wq4fBWzGTjYo7?E3u=)ZTYzG*q#rQI}z8MR!G z&TC%CMFW53&b=%wes1f+k6yhdIx#Az*YlCxssY@JDzgP73*gH2tcv>-xl#Z~&_x6y zztao~RX=IFQfiCgwf5Wvb)9ZR!)Q*kwN;=)doL$O@aG|um=i>@<07n-f-lXl7_>89 zL(JEr0)ajXM10|`vpzuIh>-SPljUOS5hxq5X0;GtmELA$wZ0tykq1dVK_wE+W+xIz znJtd^I)97>&xSQA;=)3F>_KZ;@NtmDWGP~N&BW;VjRq~b7i<#kjty`ifjZxPx3Ab4 zU8}}Eust*q_VRi?xpnGOjHI#m#Nun_m4D(L9K9YrnLGtr9MO5&r;1tw=4%yStUbb) zn=ubOUcR7$i*Cz0zA$(#->B8e;h19rwU2-6|#4CmRh1H z>-eMFV!p^ws8G2WBJ+8m9$`m+fM7hJ<;`_>X!d((vsaU{+5sfig9!>Mu+cK6_Tsua zW&-X$7Mufik40nhYNF0r^!vQ~=03s*0NMydd6PS_rz)V;N;BW~t>M};jM)jnEy9A+C^m-yl<-~PA>iMZYX%-bC}n?YZ0d&@FQJ_XrXiLw!;LO4e?0z-0nZ=He`mVvn{nCLUaPCv zmDy0T**3jpJqF6T0%jWLq6}Jz4)2TEu9d64nAbAl-|+a;af92E&qRf#GiaD#*lER0 zOEF9w1d0L|?Q~P6v#y6+*6ZnDNK0{He8;%0`}$a$Kf1ej^pnkK5Y0QMmxeh!$3=>< z3l8?$tqQ`HF>LSIw^#!*R-gs%NKX2Go@eJgy$LdCPWSY5#($_WLpGDax!l(ce%Eia zTSK0qw=MaQL_M+o#hYh(m#y3@8haj23*a3SB_Dd$%IW_LpZx{Nhc`idW8={n(wauK z^Xst*9n9rT_t2(ggqH}P{;obCDTvhMrjo~`3Nd9Mjwy_r77%bxX7qX&U37i-I-0`N zi@heS&IVy9jZpVtAu_X4;z?9@d(pAD`}|s3;86hR#xf5_4Fkg!Rw9}K-h)h&Z7u!1 zUU;Z2Z??tHCHg5Vi=AyZ+G21z7cgk?O6SkLAcGH?7WqY`c}-_cr^ie8Z4I7W&G5^r zM>s=Xd^F^;+Z-n94Miv{;{9z3)Fpzn>+Dmd2q7?}whNWX z8)}EmpcH?me{zbH9bWoAha>&1Gx(LzBAn5koAK4iX6Q>eY;J^{O1~8D^k-I%z(68ceLBQ)&b8O!~gRA#Tf?Bf%pFG{vWu>cKC$CuMdp^s&At zSqKkTsze~0-V8F|3pjIy-7)EfLuJVd2&9%U5)i zwP&!~%FKXc5>IWra3R*RY8c(; zZ2ebLqJ}IspwTeWOSq2@MQJjR?EN)a6`BVAg3CUstu#H@L&bH{Ksw?4RYT}b^&}it zkV#l|dW;M|=s1WDa^ed1w~E-2>q)Z)lW<0$hb~6`_nV`3#wL>@Woeu)?Kk9k&s~Ii z@CC-*nz++$gUN=-p*#ZVmg|6EdR8qb{b?(dlId9Mk56(@z1bvp$G+2dOTD&J3kRSa zlR(kP+_XEo!oxICDY=Dv>dZYs(5V!?nuw6}7c+&iwkn5X^Se%*Jhz%5q62`3Wa!W& z(n4MS$RJeaBd+X?ad87^A@%Vl+u}UO z=#pd1;5H3(f@shN2c=*S8!W^6$L}`@w^!wJ=Yw-PNXyw=f$lSvw1t%c{l8|Y-gG{j&b{x_l_<8v0EV125ufq>y)H(<9GwmIINCz8LX zVK&)nI|i^fD2*AfJ7uvqp-Fw7^^`-=q%$zH_O4wt>yfEdfH&`pgZTp0dYr$>ACJn!8vWe|(l@vtBS(DVSD^qAu#pg+jj+!c*)1Gx5ce zgE@Kq;BN!0=7{q5`|R7fnXRe$%V;=+Njkb$ma-WuYu#V|++^D$ZPzd?c;O1(xex zy%?H`xO;WdfelZRZiLo3clHjCG1TfrrH zZ8Bz4fu=78x%!qM#JI0Td-_VqY*MB=PXz_5v#XG-_Nq5?pN31FDiB(d>tO>S??)%K zn#m`}T9Zm>F#83LDUyW(S_HfRyD`aSX)ztF0yqb-??z&yD~`1s za_B4K%PkqBV2n1ncJg_Gt%&`|Ld?PYxFt9wdbn;-$pUllzO#Bap_{A|pA(rPMetI+ z8!<9A1l+{O4hnA~u;ud=UKoSNb za!_BJARaDK`pF0z7hRDl(9E;Bce5Fj!7DVr0|TxZKGYtJ)=M~!;xDoo@JY1&r?eZJ zk=?|krGf3hRnz&!0m1eSKL4@OSSsG>QZ}LnC$hh7dTPh;7x}5c6hF8>r9Rdd$RQ(c zZq)hA+LxrNE%Fs$={|J=n?+a_~fRS1ZUp{D^+U} zjt)WH&taR8XC^|~d7~eW&laYuH-9EpR1nYqXt}(I)vY98NRIzBw3RmdUO7QGp+e_( zPB$Hx8Q20EkoX4yGZ-0_-uKx(qOV<~9rgE-tOvphpo24n zYYtL0!#K&`F((2*kObW=aGt_85It*`vy5P&pe~7_4C0li#8vpXIr1-_Z+JqoFW2)} z&`&{&w|%*iJW@ESIHdYm9h?%;Ya7S$iN(MJ1*TK%@XuZ9<*Pd66B3}0n~5%#12?$I z&IS8=kK#PH2aa@l#@<-On#{pOGw}c%wD%3~RgQh5kf4M)KyUy zms5j)tX6vmvJ`8Mlo)fBF*(9v#{(jSDUEDXqTcri zG6PHlPuTm}y@2y~{9ViITHB{u9HwD*@pwkj% zL0wnE!j@t;yo6ugl?TU#>I109xz$bZiqbQOMLnjxB1|$Y`IK#JDoo&81=UUDG)0&z z7p0Y;s7exfmt~d0s7g@>=cScU5hLbBantzoT8XSm*I<_mS~q{FriWTKq0Nf~)@nUy z3erI~`cEorOrbNo?K{~7`quMHNz=c#M1tkfqyAA-jlfW|19Cc8V&9Y2^v!|=m zW=>=TL0Y2XdbUuA6r)C8t;_uUqW6ycxh8RmW7{d52yl{wJrR{ga_ z&U~^?*&0b**@uR~us7&zhUMG-16LQDhLx&}AS)yh21-T3+^@NDVCpWt2!8HH(HIE z_Y?j_luf;upsQ0_xAXNKrYWTis$lDMsuZa|Iw|NID zXFd8iw`TV}1~2)uEh0gq2J47}HA>C3q7&6BM=I|l1XvtZG;p08hh9n)O8e(fO(xyO}_3(3tA;mxpReUL? z08UT#TUPsDOk0Y0|9>&f{mcMB{$KGQ=Up4F@_>9bQn5CX*>lA#P#|A}h{v^h%M zvVL>zIn&@&tZJ6AnX!H5hK+b;Sh2GkoJa__JzZ2#sA5!tR)NlwYyyn&<3^&U~ zB=I(QH!A^VCyYgqgN)0Pqg|zLCUWnu)s9HzNp5G6qB7#Qq2{2efL!)ac_hLUoR#<< zgJ9G}Ge7PA{i>0QSFub&l1FoOL%j?Nw`sqZE$!*Pn+bqLd{$aLkC(85r0TE(+3z`~ zO7I{dL0W4XBqXnzJ;}F|SZVGv4}@3_cRBt46Z%d$gh54C<3Q-< zTKf7bug`pI;cPt(Z}8Vn$U+vZveXd!k=g-Zm-1r8OyzmsY;8vpv7?tTLdKdzJGRA8 zT47uIpXeJoHFgn!_utSr#4pT6{W*4^&Vi86{|dgj7$Y>W!CM%xx{;uquJ7Lx zN+>UtQE`yJ*7!6(7U1$3WFPEj%&T(FQN5=fP|Nl(Jo@isOOVxf$6s6qWv%Ht(O%62#}I!VZ#8rbI%911wUp`=X*(AhaWFw29^%Z%d}|qy)=7IeUl<4kX#1Hnla# z%@o3!S?GZ;!T2@a)L)!Wx8K_&sN^{#p6a$wOBNqw_YOCyf_>vEcZ2&ix=NvIYekDM zv5Z}X-mZj$!#<`KW}^?zHOOE_hikDZ6ed)0s?sTOKE|-~SL7dlGX}@yv!?wlKX@AF zJQxwyozU-_%RJ^u24HM9J3e|_oXF)W{)l3uo2P{irmQbe$;&c)F-O`>0ntCMVnM8= z=C-G+No<7+3;$6(^^k>!t{U`aj4>Ut2+mu0n) zEUnuw3o#SDi8Ei#WlX)C4-C1~k#GedrHeh!!x^iQBTA#rCCTo&N!G5f=x;*Hd9 z^+^vQ@|F6wST;fwRU2~}E&x$X37wrhB{;|n?(|ESI43zD=lmaqncYW$y1wt>km-l^ zBT;Z_Pp9B=O1a7)2{16$D0Q`Z+ZJ-;5Bj?@(~-VKtktK>qTS7!MT*bZ1GO?aDB0Ad z<5@1Vu(5ST{E1)-MEX!ImraCDuQI1_;E_@+P!vQQaH-U+YPEhvu+yGp08Mu0WYOoH z6G1vLKo6ImhugGXY7EAmVi6tdeB%v#skc>TYMR*eoSvrk$bsT~#iWuo$Fdg1M-3LJ z^|&crQwjY}!tY*n`F%RFO@w6{dI~z!b*`c&lRo|dwhk1Ep`5cb`F9NdZqu#Q@Q1B) z<9w3TXPfnffd^3zbEEj(e0$OE=a+v7XbTv6UQixm8B;?;L++DO@EVbBwFRj|_>*9- zTreSx6PC`7e=x<&w`8JM{w~jlGjK0v7gNvzgZ;tCt}k0`-|tF_4IWknna-=7?Lf-L zZuWrm1KU`tOtm1c>xgITaO#wP`1-h9C}%i4GgW$*L|_3{|LD*rdrciV3V-ZEK4!h- zf&1^$a&^eFDO13x%)l5Om^}L$skI6TNB9ZfVTrgF5G`_6IpUoV_0TV;yXxq6 z^##D$fZnE#*WIH|hH*P3bR9&A^;t0JB~$|pxS)0VS0mXkRx@8PhAhlAqr-@Jy`y5h zl}T9Iic9za{OjxR%Zq;P?i3_38lO!?3XU1g@w|W|sVLQ9MK>3r&G=0~i%~&lKe=sr ziLt;tZd;>1$H?r+XYvo*zfwb?x3H`T8y#IGK30nc4Eat~c%!-wpf5_wH9KaHqRxk= zU+yE`I;ML3a(|;ghc0QyJWdWFVGki@-7k!O?~kQrAik%CMOTu?9q7O8Y<9H&>g1t& zqc1DphVxX0*Hu=F!?1GICuyG#+=ip_i8YKz*Vc|g)iuKtot-axihA>G;A;s4|y*q=rjYkB|2|3@+5Zk z3CGq!)tHr7d1JaF`C*zkj85b6!v11cJB8|bzZ_ubO~!-uV+WD7B>8H*+r6ZoMLyZ? zwJ}o<_5dDc&!MTVL&m#H&)#5!O}0wIJH)h!RE54Z=JxgCly;^n9O=NVl@My1UY=z zH2Jk39SWKW)LPvtjg3tcgqsW^8)();9T_OJ7bVo@(P6kE>I^t{Ipf{v;BB-avZh$$ zu=U|T;_eg|$meq6?HDAv`)EYB8*64D;%l)gR$-}8cj=q;%lEcBU#~uMK@K3D zAq97Al3B?%=mvX+@91)syo2>is(<(k0@G(AbTi??hjeJ6s5+eNm@aK$$dA;e*RK&a zeV6q(U&eh~rV3T)prK3KC^(PH7TbFFLce49b!r*{|IZx{PtY72AxHYWfPd_GfTHVN zLq-;{S_Mi*ld&H3vrJPsy~_*5oJ;~XLv=A7zvEA(Ig&V8T*FF@^W!n_h5hVmuO%lg zt*W9?pKZx#sk>QPq^k58Inlh{>uY--29WhoM}L=s4mb?Vr9X zRqL%ju6FrRWh0Lbcv6$e+O*A$=cGV_6Nu^r5cc|Z8Gk+6p7VEoUZ{1uzaSrf=+;Kr zPBolUoK09MK0YkPG(=q7Mr)0fv5l0cb{A%K>07QW?zEx5OGjhMMq|m|V+SH6K-~>0 ziz3{%wq}QG@V8GGL5DD_v+BGkm?&gThpUf?vvdeBv}!G8wzd|@_S~v4VD*F20jW_< zM^4c7j7orhn83JTkEqgByRSg*cSz$5*0XgbP)$SK?~wfbbN;CN$f}wsyy+Gb1Xbf& zYV*@rn|;+@-MTZvnf7lhZ2@xqU1kH8gFX=fk?n0a_>4}auYppBLov^Xt)M7Q>E?DV ziH&NU7J3tiAn3Yb&?UXYr3O4av;eFzExKjS*bzwt{s3*(imK`3s@#<}^bhisxp4!O z>7j`clc?dil*<{9vzGyvADNUaKUq`G(v)KCh9m6)s$8|GuYMG_l&;O2l$`Qt7GT4? zzIUxfcK7B~54Gttdh=>;V1k)AZv3X+_?QL`&X?}}!x!Rk!lQHtX;o-CAvKt35AGVW zqRis5bO?Spy|xjczcCq7t9I|#5E`b6)H0?C>wNxXx0{)&#@BCUH+(ti8ftB;nhOR$ z>j1o9i#f(LJ!aA6q*xBe40P*bh<%I2)oa9np-M2Py8(J8+#(d%aIv`I{<35k0NODP zGX?`1D%co^EcGE{(hkvyr?uuI%@H0Wsau8omSLYvn0DPi^jiBAT8sw})Y~%ZZ#ko4L|?fj9tI=qRt&A*{h5?M&&E1bqnFy^zZWX! zlo#Ln@7&AwyX!0yq#J5JnPLNY0&Xz+YRDrFKoZ*NDYC-`rfuPNBR%zp=sb9Xf{@48 z4^DcYj0p`?m(-PcZAR*}Z`z5S1W!6oabACYkw^V4$9K3G2!#`B|NFrag3**Z=@KN~ z#&2!_p^aLzSG0~vf6mb8VR;JyO!v$v_062OJ0pzU)6uO>rwp1~1oX;8+v*>O#E`Ij z5Mqxsy2Ti)2uF)HiABzf8T3BseTL_DRW-s=9kBpkXTDBG5?z9REqqCj4vs)b z{07a(HL>taF~Dc@-?m_%9!`A;ss7Pl#qaux#p2CJ^@5YWDO}m*10qjWE(8yzBz`F4 zNe{!MJaGuO`v+f`>8g&R>i3FjP1@(O_N~WL{$fWH=CDWeWkB}E@VFurLfV|?!Qbhy z&{n~lNrI3rmfIe1F}MD(T1VS^VZcvPq}iEB$Sb^)$y}0>$JD<#8(nv3>uW&0I9wS` zR*&aFwHM*pY1`N240kf^?i0GvT@&gZZWXlsTLL!T5a2}H-=iux@uP4dz(0QncFr2P zvLBNDjEak?v*lxdpW{}j`txA<_=4e?RqB?nvS#UWOOf?{LHy#YN8T;<`F=%_U(Z6! zPm{heyBPf^A8_dos*;O|{ z0O}xL`*HgV(J!Qi#X#Yg2(A}1zVVDrze&$sbb4?nG|yu3yFrf3)@7MUrNcs4T`q8q zGJj>*U`}C_Z3*7DNX?MHnNr(~I2tf`9-A{)H9p+K)6=!p7eB?T2?U^BMLURlII>Fp z=xYHfFu9WwxBv;eE<-OJ{@Wb#%87v#V(MqMQnjWpAq)F?CUH%nZ}6(MMITsi+@e^C z{17fm53{dMB$@n4Cj#rD`V=mU@J$e$5{Eil+ge)lRCzzYAl?DPX_DXkq4K!_ox^o^ z)=1=Q!;I+nMg_{S8=^DligP(~OKS}Sj%yIfoVv1!FdX6_+txK*Ik?F1+N=dZViG*$ zS>>&%&zDx%Nufi%MWcWxFqY?w&f2hM=Wu@@rEZB=viU|F2eI|4X2-Tl*5Ak!NV>Wa z9}~x^7<&$<>{O+W?QNH5;TX;fa-2+?i0}Fv;G}PDz?x#zz-&5M- zwtnBr2P}$|ufHR%S|MMqDQ}F0KBpDs%o>gwfU*TiqeeO&-fKGOqut$`i#qjArpr0;PQOqb_$I%G^ty!)nIi zhb1-3lQKuMV6iTaH|Ldcwgm?fd6H|#3b_b1rhFX({j|5wZ@~w!WvY*vHYlWpETf0^ zMLaKwJ!SUU{tw!}vMmF8^^pnTa<4flG`BVwWYzPU?1RtTD)*sWboDcbpL;}knH!fj zJ}t(@fiarWT53{XSrC@LHdrI7UVqRC;hs0rp9xG++2;qx$zh$#5!VJbzzu3p;ZI=I zHy{sApwq96$j35?-^Bhb7mL@z0 zV6dsmK|m23ifauo*HDAEIB7o*Tpr&oFI?&qpt5f+?-@ByRx8$w)Lz%#X)*NtNVyIo z+sQw4PEqc#X;Sxdyo?^Hs}pDAtF7QY4+F$Ddkt>=kj=9utC5)1i5yNpRz2t1q(}F+ zpuFB3i+x_{)Uj%0F@maa=r=;bZBEpV?29Z)GlTX*M508Lt7U7rzK5Y0W)ygp=;uwS zNKk>{fQwmxs@2(;oEdKY8h2 zyzzy<-4w#c?`2^^N+(vD_IGrK9Poli- z{bcC4h)vQ@Ygyuv1ds{_4?9>md`*2^=FL+zmJgKZ3W|edoy|Q``aRey!~b9aeeA#p z=n~jKiR#tetx-yyvUhYD_EZUiglT1*r{5F1Ow*w95?SUp*KI1R(GT>&83 ziljCwpRT^|mju404m~l%+D;wm;crddTo6~QF83T=tv2d-X*9CXC~c+ITCO0DFxxks zN7~vWn#Fo?U!BHCt3L*wJaqrIu83pU&cKcI2}NL+Wf<0iZOmVPc?&nZt(`YRiGL{@ zv?fGzY(g}bdHOkJyy`O0ttoAix8sgf7@L-lYx7i+Z-)ALp3Qiyf2W*9VmuAZ_#i<- z#W3%_eGMp$ksZRco*W2G4NY5;hr~BxT+y`MFpOR(RiVRoSfOTyzS10RP=b5WIP+>` zM=0*tr6LspsYpxnYpKNEY$&UD3hQUsdT)7hvd5CPs#8$j2k`U{8uEp1e%4djm7Ehw zD7!$?Qad{OeRa=$-CcbpW_(=D&GC0i`#c@_@_+COudo05@D+u>4sS_#=8{hD3hXrCLX}WQ>|xnT z^LkLWDQmI^-aI}YqK*$Q?w1<(1wJ+;uFa&-0lDCGOL>uwfMNlFKUI_5Rg=`ez34lT zdWMFuo-gO7A9DILn0t;T2hR=c;(9^?t#UddiXO{zt7Gjdsq9;9qG}BVMdJqbF%x1j zJTYa1D@bn(SP8K;@qEAa@His}sI6Nh?j0~S@Bml_#m)RR z0FN#frGv>=!bWWJ|nW^0A`b=(F-^SO+;CvMsP=&M;jS0!A4aM0*q$`X;N}-WpiYHsUVzexPlWypDQMG74GK+01z` zu;Q?=UYV4PE0f2lJjG_4FNBS3) zlGXusY?tvqhxg|mfZ7p1-ON91Gs#QgqQ(udsXvg@Q-H93u|{~WU(0Q!zWX16chmHX z^ERnDy3oMQ?sGw&#)4Kq*qiHIPsm#&e!f0G`FhQpJ$|*iec1qYIrCg{#n2*AOmziX z-|DiimCL^w7T$a?&c#FsK>X?@-=<^HD%}3ol z>Y~Kf7`(~wU#9gR?(lO1{PLth;JT&WXBPxRe#dEwFEe2ILNlX`QjiQh#G{Mj@nfkFLC$_In$;9Y0qH=y$TXKjq{cCx zNr9_wZrZA4T-sO!2lxJkPcF8!S`-{XaPzCY^u0%jAg_;mZT}!Rv+-ka%KsOV&Dodn zS`{MhV$2(i2E>h%PEI0*`A>$1_~2c&xHqBah9qW(ykRRP?ZP^fPSq zvdPd?!+6xMR4XNBCivDU&&Tn|qp_AW*4P^?^w9C$*c62u6l2Br7A#a077B7>Y3Yu& zESH(D0?W_ksIWBYuw&S;{9BfqVrfCAkiMxfix2TB{pT4L44*$y!A8Mj2xHRbV~yLQ z^_!c+=X4rh9Qxb%eM`?iwrBW*rkY35C64e_SlUy|2L8ajv%=!W#>ll)fUOp0N0(n6 z{=BoQcO8Z{YDUljG^|HGh9D(qw2pw{x_+ZFfuD1kuT98$Q~x+gH9LCVUaDWyyh>(* zXJy6zJ2VWw0zbC32TAo>?Rp@3Gu(VC)P9(MIf{%&oOX-H+DhMM`%Z+SZ?oXW2KrNN zqp`a);5Zho9p8IzC%Yzkn{2{)Bc*V$g7K}G^4R6o$#<`VMi>oy#hmY3G@}Y z(&l2@K5lxrqIUvd`!3AL{xzwJo#uJb&o}mdmU)q}V)N>k`ByJPv%)PCO(;4Xq;RBJ!eG;(0K(1p*EO|i!zBL7emPqgC9cx2#II5j z?qnQ;&5t1+T}vS+#eu)kCOQfXT1_%qv8psA;q9Mn+W2dj2IRBat^M;qyox+U==Vf_ z;`h>_kge~6T!c);=PS z)shR}&~nlyM+?*7en)a}M>mKZT*Z&T-ya;zJFL7ON~q~CI0uyDudfF&P>u*^0!Bk= zOQ4su$0HRH?)7$Y2&;jVQ2t1cEhI^zYb_U=!#_Wgb|4N9QYH@Xu#}%hnWcx3+01qz z``oN{MxZ2_ygJ2=PT{0S-0GA$CjF~PlJ=%y_4B?{EC!&Vqn>x)Qwez5s&qs(WD5t= zhKoplut7l=iDl-cG;Bk7uI#z|sQTX=8eImxPk1i58|sv0Cj1SyN|83}-5?{CRlv20 zb}`T2#LO&3$wg>aJ;FX6uRp{FhQG%WiUg4QMOSPt!PYC1cW3O=WK!6R43*H@frk>E zyG9$sS3j_QR^nTuql_t>jW6Ng(FnUk+l|cFrX>SL)TkiZ?wbCvFwX#i`vwOfSp!uv z4t?;qbQW117qQ=ja=^z3Xl;%(jbF3#A`|e16flPbGxHIc&XU_{u6LukH2DLp9m**3 z(0SIf(lOg?f`6mcvB#bKIdopNQSR&UTddd8steFW7xUAUyt+YiSwu2?+YpL@?a|p) zKc2rmTrq&57D>3XeoJ$M2aQ}?P$ zXJ}+5Hz8`tY6M2q_xF`c+_CvoUH8`>OQP53AKs2#(Z<6xsTk>mLwAkv+ug&{PzLnP zY)_@{yhXib&y{zJO+=Pj`JX_W;Plf|-)qA5;%N4v-#5}rii!%y52to3eJ&RJou-TJCXjj0mg1wIM_TXL|e5^jmbt|ygex{S38D9;GzLl z1iF*_zFfXg{2GylENW*MrYgu$IGv_XLdw}ME1ex>hdxm70%NJAZWFSfpRVj*gwQ?7 zX@TCKvA!ASFK7qSWUgzQSLk`)$DFmKdA+FYC@0>A_o@kt=^z2=Sb$hoqhgS@ zZtc6abUo!{q}{_%QwPNlff_BhvNMcO=t4`COd9_ql@j+axteDXga@AF?DPVCf!Ph~ z+%HZt>N)u7P5*NteyDtk9le(3&DHO1+>lfb3-1QkXRfWibh>EP6Op-Uy&qjEY@8B0 zOUk-=w+;*F9h)B~X0KLK-bu6x#pr(zVY`0#Z*N|Kc%B#1uF6=nzu1yVU1)tP#?bBg z1x0-kXWJhZ;?rbZ=QSDte63F#{;og&G>prqJU*P2ChaCCV9zgBzOqD$o|^q#o&MBT zWNrW6uj`oL5MuLEa+kSHzWy^ecxWaY8yb1^N#Cb$i-E8(t2$-}@ZEp!MVg4rif6M* zI49A z9-?x5fGB;))16V_AWcwiln@OufkDW-#D7dP<}*wsC=Ov0_CF>G&J_=wCRqcmau0k< zBouI6>cKqCk!MywbJz~}u&dT?p|@}&>AK*JF`L;E{>+aV=a1b|DEr6{ zX>0A!FHJ$$4+pxMm{@xvWm%yjPq;QD@VD>f`<;KLYgNkC!SX0J{48l(Wonm1*b6?z z*gPs*wHV_9A{&0PTyT1F@m$LQK-&h`r=!=U}P zbtJhGie^&y8+2H%#ZgCRaROVdlbl;v4dy_I7H1I&e|3IgYio0JS>cLKd~>eOy=QNg zWi=Q|9g6XEayi5o-HYZ_7an8Z=Hd=QeV9TYDTPQ{J4qu<={y7mySCI1Z$Tgu^MkNX z{xx+2kbj?##Ic%hhtF-xerlV zNG3`)x=qtq>Z0Et%i=bHVwcAs79EN;vOVPj^-LkBH*~HjgS>YrrqH==8|uiUiA;jh zZ8a%bR|T$O<{5ESL^rIy8){n~SeRg%3b&rm_$83`fvzAwEVN$Fcig;2#^xQ84k}ng8Ik2uP5}Fv!(%e_m;2lI78MY(js|&&;@x{( z&l|z}m-CIva)@5RFE!nla5T`-O)zwpfoV-wAG+9RrDh2zTKSjzZIb3U>yMgnzZU0` zbbdk6fdT??i0X|TN;MOM{Sna~koqLxZ0mt=uRnAM2U9KdUUfH{)L~Dyp2g9lX|cyU zhvj-q&)r4xFaH~G%dcfiy?m~jVu)U*^(0^|XI5YDX#DQ$ci5IcOV-`PZO#OD5$IVQ zkZ0e7j(dQ2k%z@iN9H+vR&)T~-p0lK#4}`~r7tF#vLvq}=qi<4Z$l!_36Tt*92_S= z$L~)#6@5wwO*z;F`e*?ogJj@C~2f{)+H0}3*1?Mfa8S{patRn-Q#(X;g|RFFid1mcIrl>AgfG^L!-uGOCs zOrih)D%JPrKSXjHj{mzN`GAXF&Crz`GmX`Z5H@vx4l_mHavR?93fw)0%vai<*Avwf zy28~zZZq7@55=jzgRib@bOjJ;cJAXZICMYE+6^7)B4MYsYfOb1KJ!^co6f&Aa!od# zPBS%*Q|)q)_`p8OZ<9P<9()<_ZIUY;K2B<*<4gz$1ttmTdXI5%Wq|&yx(2(Fzm`%KX}US|^T7vymTdKI+OUReAkix8 z^)5f*QFw5hdNv}p+8Jf(3O! zV42xgVVvK-?tW-V>{Zs+bG5^}FD+u$HESLO(&GQ!beD7U$UwVQnAgwrd46Pee>lBk zSk^2vMUV=7<6;YFiLaBt(`FrOtx#iFoG5ZrU{Kmv#5xAGO!J)|dyUT%Wm$^B^glPb z;hvGTzmG+*5ELt-b*F&uj&PJ&+tGK=8b@Lb|gS@3;jQ? zc}cl+qWW=^YO)Q<44<1pW~xudJMO%{Rb!i?uQhl|l<0WwFX$mu=*nNR7Q%HhRXMY5 z%giQ-Z@3Fel4h*-s_v>|WymY<J(`8zzxV3Q&J(HxLIv zJ4P+Yl2r$^42OvS8Bn7Edk(GI= z0JsNp-1oJ>kCk0c(~xm=+1<+~fs4o7s3O!G0t}RGI+dINKYoT@N9CBu@d+MQ(j_Q? zhAiSQ;$JN^e2eD8dO@CNlyx|fCG<Bc8Ym1kM1DOzU78|JI--}Ry1^h0mNrIe-#MJie(!cus zm1oa42=}(n+7<+T_i_|O7~-%k67?{gyuF4KrP3f8OD>TaYCuPX2Cr?X6cM>LpsYnX zOH6ZFe89)IC56xP7bUi1T)v#LBGZL)zV1*ZCPe~JN=HqEpktK%1;Wqy^pp17FCoU! zT|fI~$IEHJ1_7mf#z|V5Bl=PB<8Vgx>8*e7p+?sNGf!4j?tte=o#L@AT7sk#<6==Q zS~!bFn4Byy{J2k>x@rwNeWuMUx&(;qo$syzjvrs$Ki67gBNNNBByfhwPNz5oceIJHzq7`B>6W<@XZ`9E`oNb;{yxW4=e!&~DB6t% zyotiO5hJbh+#S|H3ljfPTay6Q{;sVNKKtZq9X>4DRMPz!be}sBJ|=FMRMqgm9^=pj z@HTt!#l7Wn+|nAd-3RJT9A@<-v29*AAXe`x1sJNHC4-Od(Tln8NMoC`yu*(P!C zq;yeN`6dcA2-eDk0HBoA6~|Gj4FvB{rM_B=c}_8FAb&fKH9^paBb3ocwHK`WrWO9q zgR>Y7#Z&hyR2A_xRQq_4pREkP z8~^mqTZwvWgnUuSb$m@Z5Vw5iZhIT@1`;gyhiB6p>0d2uqtRd#bI;+Wnz`JnY_aSmQ6RXp1;WX>=G`gV=(=r9t~`;k)0OnX zM6rQ15J^X*ecop(aBB-CWp=v1V#u48TQV>a;uL35Kiw`98VKL zYV7nM)wRt6OQ6X_XNq-uGom%b{k;O6i=$QR z)TVKmpE=DP&u|V=K{`K*0RV{Gz8B8pP}H0!yZhTzY!YyRIa>cO#`&-fZ0B;6$(>}T zHL8sUVks$O!TkT$Hy=j01r`{OJr(0L1<_5_5`c72E)U@NJ_?#tVDH^z2AY)BZZEDs zXOCozYwHy)#ztIqW!|_TJjr@L6@!!H_ML+0{Cq}1VxHJbz{07zT!6_c5-ROC;F263 z^zkp|Wm*ah=MZH0OrPy2Gs5`T{GBejV~IM%?l0?AR>17J`iq5U^v|a>vT~>&*>>BS zA!6%aVZThVbnza@n5+q-S=zg@wo(%kB@G^o#HvkL`bc%r59bp%CI*vLAz?gutro+K z$~)vaNRL;kNSapdh(G^UW0Oz8_lP`2rY|Lr0vE;KWi7po82bf7R&@D~7@N{_awaF& z4;{VG-EWJW?X63?;>(l*2d}l?b+3xPilI#qClZw)n&x$2D%6%CvAXMdR|@Ps|L*1a zdmi6?gvb(!A;ph#9=HGB9rIP#Z^xVjZc*kxf^4PkH(cevJEbna->Ac^ME!#0EjGjC zqP2Lzo_}4QEsn7wX>1N->$d3@y?*&Toi1S9IoDJ96o!^Y=V-PQhJTvey61IPgZ+%= zmIGzDE|JBQS|%9S5Gs1gbAL_iew|3w!{@_xuH*i*<{BwHgw!h71^Si4y}EAzzZ~87 z7Fx=#!-9|A`&z#O!sy)^3^ZyADEPj4(k^3VUGabL_e|vyxAl3lxbw>90er332g)|J z89r|>cfSKQyQFKP3URyw)>;g>c5*p7l#sv2-mB?;<#D}{xZQ|Yq6|Gu@KoqYbJu0Y z1H)|yPJ`m}&2(m_oh>oX$r+I|Erc8 zMuF6`)jaUU-%0l^4f}iIS^w3Z6ACM zZ+V#hfzVAjBHO5q!(%?2&%{GX+1}Zao>{;0 zWPAT5KtH*A`$#S?XUqpby7(=k&p4~~oh6$aHexU|Z^7kgUHK%0ORaqnJFJJ&t+3Tj zEa2<6j{F@INNI%-#Od1zl~%#3d^;I>qXWc?WXl< zc^~^njn`fW3vCZk$j!nfIO&Pl$T}FG-~LBnCaP`Wj&Ti6dZxOIMa}|91DhEn@5b*d z%RN?h`q6Nk$9|b=R4ncTvW+8lt)?B7g5TGUATsjK7~&H}KfJu@q?pBrK_isY91=N_ z((;1(cD8);3G@p6nJRQlZ33K;gs*#Z-B(EKWbItxn3?YR4FYuDNoj?q#6Yz9$QIjo zR2&$Z{3#{=Q<%->Dnh%m+T>2~+RD=)f;twgv(482ugm3QPx>0y=FzHo^L%kNy6lI7>ArN(P8wn5 z60sCExu_|n%8ete=A`S9vy<17NN#ji_kzY&Kg!typ@Un-DshZM(QwEjAPfvp55xAW zVDGbNb4|gBK_)ZOsD|5!z^fbDx&PX10{!-MTUFF$9!LerG^W)Cb|QyOCxBpA3KuGf zuJ9Gg*s*Zf55%R#O)%H-&-lCDh2CC6M`db@Vvz^UY^VCu6u!*eC`ruYa>8j zK@qcC`;A5vu^atm8>f75pAm*N8+9UGWSaWYuF4=O)Uq|xzBCYZ{XtSc9t=N1*@p&d84P$>FWiW^SDEmjSCHLD(I zXWw$0h6I`E5w``){$C+Jq0N0?n7nq)uihfJ)^~AV80uAthaa(c_Voelbv0;^*xTqN zPOkBeQx10WK!$`ywd$Zcd;|*jl%_Z1P0aO6J|0JkjEuDfeeeK3J{wtjBax5>r`ScU zDTXGNW0CZk+!<3Wx1kJ&AYt7g6sOKLMRyL)0hx^=eBX)(^Y|R5p0-B1LWENLD)S7=@M?~qAr`WY|XN*S+;H4wr$(CZQFL$EZeqrt<|e{W1l`9 z@keC*d6Czd-}8=l#LkQ&;(D~zzNJ2$;i}^GqhJ+s*=5oBtS zh+D6_f{!bVW;&Ml-+BsJ`#G1rw8WvAt;-|6Fim-s7!?#iLpvAA1wr6GDSoJ`( zA7d?Oxh)aaL2mTwb1}`Uy1=D!{{&EJ<00HjPLT;B1hHnYt(YjV8aZiu$zuNtf1%NdhR~erN$AK?Fxm`TrSYE zGgj!SOI8GnZXzR=qo~xl^;97{EK^l)R|kp=SahQzDia-M<)t5_W)nZ1w8@a}Kmm~S zO}t(=@0!f@Tip|^ue{k=tXX(q-uhC&;yN1Z!6@}h76R6zv&p3aYSa;XKe z8(kYqL3Z2q;eZAMKh--n8iX2`RT8M{{2^&dnoYL79r=0fkzs!8(oH&Drwt#zP<79A zEPuCyARYm}>_Z8<4hTq5z#b6qBTafa8Y5WWExhiw*2QQSw8AXMFI>SY zFoTJ$%1>XJQ=GbnIa0?KllzKbRx6oL*G(5M{S@dIzmae1>r!QDR+10Dy_n9U=L+Eg ztn3MUdb;YYIxWW;4F+9o+`!&ufSFWeH#eEpw5?!tRi^+xCNm5x*w3cP;KeQ;!|UBm zfo(tfWgv6DCAw8?pw2%db-@nkt`QQSk-)kks;K0&gV<=+Uw*x8#Cn?HIKk zQQCut^)n+MI3;h(p$fS;vxSK;$D53AWu3U)hocm7B z{uuVjJfZHy*jhV(a#EZvj|YPLX5(7Q94)7Aqs=HW6M%oy$w!$oYw;=DNNx`aClBk7;UyOrc9u5H$9;@tlz z>S_>6Fz)7abxDBVn7>&1L3y19_UzlXwTdUT&wk;YR1wO!X|HUE52tT-%XzPOD%_`^ z)X}i&9*@a)4T<5yZYuIl|qz^ z@m{Ez?3|5iPfr&K(;}-EXfh(EH*g5Q6-R(%QK0%xm zS`o0U8zRd2ovm$eyAeUp$G(T*dQ_w=KCip5?aGB5SvqXT`8H#I$lOT0L$W<5>j-He8H2*q9rfvR3Zdc8gGDQA-M+z4B?{wKF^=z2_giR?*dMVsY z+1VvHiAOmal;w>89F(Vbe>(rs+5vc}la?&$IgWx&Cc?WvgfSV+Zk}*F;AmrtT8atb zAkDI#)*Faiidgz{q6#Ans!R2>OOt_5yC!mRw{LB-FZVrrxEn_UD^hSsv_Z6Wiw7md ze)T5G^k$2v)tZ-aBkZ~1;klEI+pM6;JBq%bJ)Nx)6BHx0iSS-$-s#d-9JK8qF1qBH z{r08ti!ga0<%&spL}6k}`)k)%Yp7k<{NTN}0r;ZUaB`I*$01?7?Rq*6bv`gqB%r;o zCDoDtxj6KKr`YlT-MdZ$e`D^{{qL|?9{XAP^mvluxLz2s9Tz$E{IAdGEvu4T`d&5eGOgR>p#U( zQ`H}E!vBmCqI&G_h(rsR#VNZxb!^1;&`stEB=SE)8>nh5aQig`40rUjuH4gE$~iG859fIAPl4LWM8bwSGc?`Hw zo^FthRP)PHM!%$Og&Le)0T^eobMm0LS6xzjeV9vhDteJg1y!BtS2)(Lq!;it)gb#; zmIhOsfY%Q41p(Kiu^D=Af+-(ibMl%%pizLF&(L~3-9u3ArX?aZZDRA69}<`k)_ioA ze~Ci*8^cQpT;;Df6clyU5e8inxXUnbH8;Zee4p!GzfU8B4<)v! z)#MbaA6}Qq)x^w4k1>V(Ydyf-BHkD(ySK}oQkxO<4Shuea0=O!Q`shnNg+3btqWyY zGVh+Xx&;j2#si@5cSAp_mG+So9DV6z*-Nc8c-&*Or0J;WfFb5y6GD->1)qwIa^1)2 zVU8EBo+Lco?p^BrvnSJo3TrR#_I@h-6G@`;@?Pt)7PryA=+40MUSucX`*oG4hi;D} zz}N0yN~bZNF6bRbOk3oUFQClX%VD-TqtI21s=Wwwt1*sa5`l$YPScEcQrtn@=X~Rj z_KW6`K<-tG03wMmjnHKaHh9J93t^QZ5|Eaje|YE9sCsp2Dzgqcd3;JZIkL4FQPB*d zfjH81f)k-Sd}WF^7<8`fgYl>FsTJm@@u{n|33~tF*Qr{I?DT&$J~f%Hw}VU;`~tLc zeqy<;0*FHH==>?GPnIp7IlABg%EOEz@TgGY9^C`H$a=;}YxhL{Z>3M<1LIeV5PQPo z{8J8dRDP+Jo0j2dj|@vzS$^EL!LK4+m3ZXp2Lf-{pukg9h=7-Q{%+A;yH2`MP9S0e zdMkW4mq5R3ghZ*92vJ^vXL-lwjoYYTph+^){E#;c#}+y@r?C4x%muCqB2KJGM_mkP z)bq35MqRHB$0OF-{03echq{cgS7xJcZPO(J+#uqi@iQPT2NHafb<$}7FuiG2F`f4h zACGW=(H@e+2z?+7V&oERV|f3K;98**uQ=C_bKwjtmXh8q zD9yR!dyl98tHC|Moci(V0n-;_Eh%t_I>r4v!oe&W9PtNaYq)l;wJB#dBcPo!Q0JX& zRU+II)CyCWxdfBp?kGu9mNimr5ym@9Hy2hK5~ygXa$@))ihPVh6`BxvDp{9QG?w@i zINM)K`r719&e@M)5;OeC0p)K|PpLQ9sD$8sAbCZ!!8|yze8C8@FkRrI`{@W%a zb9~!>^gY?Sy+vYQ>X6_TI{rP9*M3la`vd-m1s|gwIzX~Y&$|m9EVu9f3*c}QtMq*8 z=`yKS78=L#L?0A>tr~J8W!x$gDGUMr!`wWefboU@p>0U5--Q0~0%2L-JRaBE8^ckT z@ZZ}ie5QU)Ub}G##bXT_*O#E0#9ro1Qm_-JUv_qLvy6#@H6n!^g%_m}Uf1xhaAO1_ zL~#ZaR!`g*x-E4~dp6nI$DW?~u8`c%pHT-ZvC~yJm%lc%CB-{W&Ueg;1R)5mDX)u- zSl|u#nGO9*2FV2$uE^^}rOr1>Ppnn~@CN`C9L6jyPsK^B9PzE$(x$3FgJo7*x!BU; zG?}jurR1X*CHshp(+eF7f365paD5UQz<>E-9*bDdouarIpFw|xMND+qNKgGp-P+yA z;oOoP__EamB^o1Qr7?j}u^oBzt&>ui$7MYHGiM7fAB=Y}9f|U;I^egpMEBsH`q>Q_ zi!!UKM%3I*2;9Kd?k!es`QtqXTo?t-(R}7j6N`hJ6`1dUSlE8OU#S#5t7fB~gjx!#KtBBnHBTUo{QE_k5&+`S#zpDUe)cN7L#zl!hn}`4Go}cPjI*aWuIfa) z3;(yg@#77FWlwOr;gx%e>MpQQbPxRiyjc+p*?ci~K{)rAslJkjn3 z;3IqU)dW(g6WXmk#1LQn4|FU7oEx8xdp45EgUp#Vs^03Jjc7>VS8I5Rzg(TB($Fv&HjkpsU+S2e=iCz`6wMU8AN zXCy7TQjn_#8bFO=M-Q`@g4Hp<$s4G8tO6tw@X?`R@x-`VPPYT33q!O(MrXbR7Ke^3 z7hdBqlwu4pjSu8fTasyp(X+!3zl2&>=~1flIPE2aH~?Sv?F?3+tujl3g8#n zZq8~Ov|-V$yn_z>$!-N<%&h3&mN?`U+z2d%QTn5e)*^sooJ;jE6MMfp=4zENl+Wi; zv=NOPm)vLQM^_Qh_DZm^dhECqKa^!5fwNoB2`L zt#d&5vO+MAqDx@yNbnkHs*9qxp;gzl%{mXm2g8;J5 zuOl=plr}=;eVXa*oR$FRU*z5CDGw1dOV0^=OA%%=|O)8U)uC%2QT-{G&`O z7YT3;A-Uf2Y@5c)sFi!_EOe*F%IV*qpRf05`$5{vKJ)`j{IUj$vHc(QFYR>eDu7u> z{)RSEJK8vi^07X(8D&&9Y2F{HI$l3V*aIR3(ajxRJ_FPm&jJ%BFx`DfK{wwIHCMUC!|q2%Uq(z*9eh!nRF9ebl-@KbWbZ9X$(M0{RQxq1dKLy@cgCbd<;7{YYEKm5(` zqG|*RymvoaaM>=8yC$h zWl3p%AR8qhWeH^v^c@L3zmb%y@C94Gi@tznlA1Auu;BRvg4ff2AK+GvE3nx$A8@{n za|LIK{<`=mVTx2cgijq6eN!jleC!Y@{xD)fs~tU!gYoRd-JYF;xB%W}(gz>agrlun z@&Kugw6xxdOUyquA+J+n!Fbw{<~d*g-a*Fc{IUeSwdsbLrjUo{hzNJkIQi z45r2qg}u1{&EYYa>XagZd63?3y0l$OWGV#A^IaQ?GTQa`L1!OrTeBZ|xLLoq#=^Rq z*8s-nEfs8_UIBxGN#z7OzaiWqKUzKcjpHLBy(1o4MnXP1=-5sJxX=u7SMwIJ7D|g{ zLao1HWb=*YF5mJIvDPIcbB&F8HR^Ryw|?V#W=G+;fO?M0blii+wVM2@;of3;sXCT30SNb+bmHIYzA+^x%GsIgL!&pc#KN92J^j?7Dz z&DAB6c;t5hl(-AxJs2#893|;-r%SZ4cu{F{tK2J4wtJpm%jTQtYcLm|k<3=}&eI3{ zo#618rq83h86MPF`?-I07BH1iBa{q>6I$e;78I4EBA8}>edIqG3YI}M>TSLCQZV>y zVetj?XFEVAi_@;k*S$r*GC&zr9#m_da*^YkfKUPTr8gp6dy9&tIG+PsuE2_0J=1E4 zfyy}!%Zd#TqLfYtlH3FT%#RPM!Q_xuG5(2+)*Ra!BnX>FnT2G!!m5WJnP0!~!k1F! z2dfs3nACIF3WX)&in?zP@Wl^nuJ4MF_6HFO=?XjKob|#hJZb}y@0$aLq|%~6inn3e z_cO`{6AIDwQ-dR6E1b0`D z+nt|DhoNm*LGA;Ou2tLVwLgi8m+>O&n&&E9KP01}sy2$?trC&}J7C!Iv77 zgBl;=@7K$1ZLj-_wYoUEoP=;|X_(8F`3%m&gAE&C^Q4W#47!9R+xX*|FJljPK2-b7 z!h7`_40C#Hb4Kh^W)hu7!bz+Yl+B2BY;NEJ@8*mV1einfxyDlwN}WTkHhNHuaLXfn*8d z*$IiDZEl5S4_n%YVjV-I0+_5ENtFajSRseJl8md4fMkkMqx|%g1Wl=eqV6HK9`%q` zbhv-^hqwm4i1d(RSdn-HtiZXd`dPo$qo^|BOA4EM#qEpQLzDv?Bt{My!YaP*h3A7K zMu>DL#kstvC0IoH1%czh&4NriLF;2M5*8Y{Hf;&J*Xi{2j$0z$8U?J=H_`W#Qxnp) zZ&_Npvyu(9tEC`%SFV^M=F*qlkC^|UTvRvWnSaG8*3!~cS?}^+PA^u+e_LIem%5vPBv+yo0%Z} z1cI^D`MA&2FHJAdFRl;$?c)|8^261!dUVJRffneYKylA;dSh zzy(wd9xb8zv=aJQ_1B*@RBnkoYu}0883X&lQiC=Y(ytlo{2W>;_rkXp$-#}7mRO%i zwPaGMwVg(yP;*crKEa-6Rz0#l5#SGaRR<8+YIa9q?J%T2X<>a9KH%^TIGvJY7an|7ep~pQ)j2ZEC#*ZUoWm-1#pd9%jJ7B zxfDF_z0X3!UQGmLmpyV7_f2Hk;I8=^q$2HUB{vda?sE}AVvziwJjYTTw**}Fn;5TK z4=wt9a2Btz)VBEhyWOD0C4S194CFQ&oGI0`G)}e#Ro#p7CZ3LI^t2FRu8+r$EY;Gk z(DM{z20#`SY`{pS+KtZ|gAAN?Bf4?xk-ZLCvQ)f0?3C-z5J#V{ln>0**B)~8sjY)L z(Ll|Cx&Y~wZ@5S5n?CdT-04d+ssc+lRN}D$>2Q>REy3bvO;rRvfQFqs|D5LH5Yj(;G1I=~{@O9D4*IM@c zD+Li86YMHSkFl?4yNlkgnCtGQXAqWaE8=PWY4?NoZm(p{)t>=NyW_Y?ZDFKYISI1y zjbszmWO=M?s>pCg5*yiy2Ceu<^DWt43e{?hDHUc19da_`xytt|ax_CBEcKO2@2De= z2a4h71@$e)A}^JV0Jq;++iwUps=doe$x(!I&ve7uy9hg2Mg zF6+BV9Ea9Or$8!4U!H7qH#$7NmZ;H|EEoW9PsW>{!SLtD&YYK3B>TN}ari$-5UF@8{k?UD@MWpSp>+YIuS$y*?DVR}p zA8@YChG{_^dDLcwV`fw+U5+;4H}?{cf(%=3ls9PM9+S6a`IgYXq2DKCe>POTCJEH% zu-bRo)4J#o>TxvBkssIJ&hzqJWZan@*4l%u@K1?$*M7+#U z2>=)oME((;t1TM*)VJhCbeUMx_!xs((_WITZH_SiZIK!+)AK}B;5l~N@-o?)J2wYgAJqi0o_$~h0qi}K(k~2#143>&Dk?QapG{j zbkKzN?sZCiLO4t5B6`UrdlTQFuoii#{w?BIk!#X6LIOw$qn0ap zCvZ(9Ipkf-mbkiROS%TQ2)S2u7IYK0N$cG}IUxe0!OU5E<#D!x;BNNKc&w=gWkbc# zem=}G(i{A4rW|Q(}5ycp(-kCBHp`F&|ydfFza#g+aP*xJaPXs8&Y)zX) z1U8e6Zdy@y0*5bY4n5lP#E=tULj&22jYMHsTLgtp9o3yh=RQ1(-Y)p#d{R8pgym3x zk3Ft{XA~i^hJIYl#b}8eX={L)1C`=UrSj(uPT7&8=9!&U=wlhT6qvG6#7_F1EzIL7 zW7=iqIkfn0i^2rqs~2UqIM+cUMt#Yv#fUxKQDRx$Qs&P2&Y%Z{Q?KPIxn=UTw}UG* zJ$e6iGE@QWt9e4kKrOQY@2Uxa#3ar>?5J(YVK6JW2$KogPrS)7af*B1Q z{miC?Q38p6J6gk~T;UMQ+6q%1q{-YwAupJW6DS)um8p$mTw#!Dv`L3P8OdB{(c`p1lg8k5rVKN z2KiY*+GUg%YZ_20!gyfSU*kF&9N{p1ss!Lil%D3g5-$!oHJgmf`$C5JPl^X zaTRhHmlH%E-*e#zYZ>1A(9FA4??50&t6FRi4OpoEUc7vGECH8sR)=$$*0(u%pP`G- zNiDv@Y+dH8zEPZPFOj%xa~jng45%EIhwa=V&-h+F*`d}spGM26-w`%m+>3-(zu#6% zIC-5Zt-#|*bm7Vwz$`uoHhD@#NC9t3Mr!XdnuE_tg~14(azTG=s5U*?tP8W#<4&L8 z<1{TQ@4|62pD-!>tVKKIYRKrWw~GbeAWy|gw8B0$o)Qk`Bz;qrhi@+=#^6gGD;@d) z>*fIZy^0^A% zuA?5micYUW+g<$3^U-EG=J*7Jh*OwJ#uaw4V$N_{LKie&+h@|)AXP0mP&cKeH%&L{ z=j3)Lp0@Jovd(~0bioOo8pS`ClBkUphUe@}Mo}>Z@EQp%DLog8EmC$zS`sJCrm>>x)v*Ul*%ad_y6I%2QGa@$o5;-4<-Ig2!#mm*4rL$N zf`7s=So3$?5FWhjI#JZ-F?)?A`0Q%$SdH|RzIX3^t0Ks26z}1M!DhBMo?c$+f*=O0^q=VJ6AQ@Hy5736bzFqe(F z0+OXp1CjLF|Wbzk(OoXajw!8e)jDIf~xu~R{nl)TtomvJ_G2Wsa=ssy z`2jK`$KGLH0FZ+_RV4n7y}=!1<@|BirM^}Jo`nY-& z`vN0xl;(+%*Yc$J!ZPFyFm0+2)5hDJdc>Z)1vt6vY4fNupAgtR@-g9AFZ8);->)z& z4Lqlx?@j-rQTYM!;cI{b87RCS1}B6e!vipRn{W*3w$vD)evb>OYx1xYD~Zt-E1KZ^ zY(XQ5?Xmdf0tJ(p)&$sOlceSGRagb&Jf>Dxun0_!AwF}g(*3&MJiHwZ(7%8fF9IHOH^ zDrYUs7AM)Wowl%A;lIE{(53Ay;eV^y8!3;%2&TE@nu|=h3(5*JDNxj4wyD>ddjeh5 zL7lVYyseiMC=9T9xj_svJekgL?sNS$pgiq2C0d1d23KI$7Bf=41=E9TO(H%NU$*b| z>q@`?{X^~A1$0)XHaY%j59vb*f!cii7jjlAem)|^%E_CRa`x{+6rn@$MiEgsb=hpE zqU!Og8F@HgsquQG_{LslF3Y1M+!2Ox72gq9o0`E9%P!FF!~usH7TBiU(1gaK+SD2c z#N}}1=9qs{%XPzzY>3=d_7Nv2&<$*5Fwuv-NI_E#E58iqrzr=_ohF*v{u~{rkA-H%`!7wg;xkXOst{R*#IIrL+eywya zNpk&!_pdEOh6XfDPOY7XEdx=T`Cp>+LhQ0Me+h9Wu~X5XD}Fk*e@Zi0YXI)Kgw66f zrkC**^zUD2DK6WY>EAw1^@lMN1r_^nM@PvjG{%GwfJFbazAY!>{r|8&i~nnV&~Zcm zVSN-U|JC})$^QSXkKX$KwLahNlmF5B9%uiX_5Hg0hxO6m=lmDzR^9?JTP!+9r5kshe!uWAcQ?xPcrAMX~Rn6QLGjKH*Y=^%q9%us7)5>8w>a z$#cEAi!WSLa(rz%?ibd&pVCqKD?KJk4HxvOiE+q#iMWWnY=N-I5|k;O$kBTdghrKc zrsSv~_o&7aBiyEnjR*IWOEIgigX83GE<>>u$OM!dl23Ae6AKI)yEha!Sq#M%$&SVm zsx~dZopudVz=kw%(JfGTAFVe<=?xB_K(*xKsE9vc|2bRWm8bj9+6QmjuPmu3P28J+ z0B(Ut(Jjrz)=iTDwFtPMwWx@r*uG`{_ccrWWni2lPOLLR0d?8Z(CA#;F-Sil7K6PLZHvvt1$5!>|~2`9zg z4b_X21P_E|$}$)Y!lF4{-e|K)sZP1eD0rW=Syr$Nz_cCuW)z!}6N%zGBAz(fb0Z@ctL?+pYeez3=Ahzj_}ik%e4c@z#!7(s}vKvpjp?F$)2O z07}ft(4}k$23f=e%fTOK2JH>QI@4M0)8+z^UF;Nm*w;>Tbo3V;5gdh}3dKfe``N@s zLJ48eWM2@e*yJdt3p(L3$;Wp-f_9GZ+s5jZKH$5XB?Yd8sXJsdqRgsb zHN)lQ>djrXuT&!lQLCRFLqE%4z~ipGV{s2PALTntbPAO0S8-eh1))V2d!}fMEPHn(a*j zSnd@>+`D;M0Ubmf6sdnk_%HSwtjYhs>_WViYMvL6>Jye=%YlU#O_prQ4DX1~7O z|HOVk|6)JT?o|jWoFEx>b!7#q z&Q#qrF`|HvCez)*nzr_o2VPU<>_m6b%&BJ8Yos{F@O(yvw(V1uRH{Qwmb&v(l}z97 z@At>Fx#_n$lXTE39o2L_KaYrfQsOOfdoD8pdOiz{_5TRilr(aic-SBLILk<(#rqk@ zYvf8lcUcIDCc5|ifO+HdXsQZcBVv8Z!OLGh^q*xyWSRNT-Z!`K5AP%R_;>H4Z2KR* zkC#VvA9(#qoo$iJ&zXS0l={WSLLzMV055k)A}`W1wLy9C%*k#w?s^hxb`}SnYv+(? zVI$6=CmbdZ1rNN-J8f#n+Zpu_w}3?uGF3cMYel3!Y{#qpFAUGhdVj!Mx0AWM(R1!M zm3DVvIX3P>lU!Hy;YXv#{Q@{n#3F+NS!aJN>_{FG%fUD=wXC2yA30kcthJRWB#5f- zHd5$w0cZU=_kG|?ugm4dorcU*1kcQ&VG|_LxeV`C#w%-C+L(y$i8G2*y_xX7i8H7@ z|4+!pdRQ(|chOt+LU#jUtyB$TI3eNdS47{JgJHnE26qUnTS4GL2bXHja)T|YDbfs? zPPl+ZD!TR_l9hxB(%%zkDIJdV3{J+2bB_o1j^e_2TdCi?RMU?3UTLGG_A;_Y=kE4y zwp&GJj3yi@9&&ZBZ6$y-3JdVBeNEo^jFV@E*lgyqw9sE=zX z$2~&*H}R97hBIgct!zex$s5q<>S2j7*e}LTGmh!M5m$~gps3_gu^El8W>6ErMmmWs z-*8&=H0^D_evpM*~nVG2Nm%%mDj98 zCozs;HuW}10kiJOS^1jHi3*#j zqY1LeI^hocqUS>2OvG9U5R1L!T=S4bN3$00Ugu5228T6qiqL$2yY zr8tu2NLx@42)BB`ELEnajMc5dSVe8L#-XR87=rcm4x?`04tDG&@-5S2sTaMsFgYil z4`1Dnssew+Qdg2B%`##Cu6edNnYnORO^Pr&@^}muUJR1N{OKR?d(z@ zU_hkDO^ULaiN0=A#OfkC*0K$@NYOIEsz*|>`+FwmbL#2ApX#7p?6_%%aZ#Ub(U?uv zLbBUbD3z6l(j9uQ;~ggQZOs~2fG)8@XrUOd$}@>nkr4H63zl{c8h)X@f^L~fRJHpA zBtTFInpa8uVb4Hkg7rJ^nSFMbUIP6t=Hm38>`Ym*X$5K@=Pr5hDpiHd{)~sJNO>)>r8Ds`HNVX(Rik6P;C@cmjs-Yq~>EGFvS7(pVczY;>SfAO3 zjcFIK+MGLjpzVhf%DQvDbQpP$LeWHH1f@W+3JjD_W#o0(AK)0<}un+6Mh%pz^R%nq=JRIVj?7)?nJ z{!sh@cEmEloQg#D4M)twv+oQ3L+t^;`&tjOX7H5iMvGc3hM{iwOs%(l2TGdyEbIq2 z2O$Gb*-D~*0kxVzvsPYB*hpR2_i700mlVLNAL0-K+;!nM-D5>-Bei8BLvOX3c@>Q~ zN1H;oE0(@Mf0(f(&e7{@;#1GA88!;$H`>}RLlhG(ly>#CU!F6|L52fI9O4U06J7bP zfyTpeR=F>Z?6K}yA=9BuxJ`j0 zg6}!+uQi(M$^ssWo9|@+r>p{U)Nc*JKTflc_-kj*ujp3X^$N43eDB(9OhI2uEt(4I z3~GB)pvQ%zi9*rLtvb7%v|E~Dn|DFigH~x7a*;+gBmTGhDemW&U7Ix zDzl{sS}hn}geBj-&ndbC(VTk(ZGvT20UB&Q)bG7W&TOudl{DuvI1Y0oi{FO73eO=M zhAOUF=k^wW^0s%rFg$7+@b>($AuQN{j+wFB2xtb%zKeEk(zgN8ElZ~7A3nV1>j)vy zjJm2nge+aqW+h;y;FI@ejRfD05tB1>jWNXrfRNhPbfZ>fXmdWfd`1UgRFt4n8%)A& zwq$VV>Axc(#@*o)%|BqEMs~T_n!@C+g3LVP^>CT|ckK9QvuR)Br#()rJDrbkT0Bu- zzoV#Z2qd;WK_7psG+odaT&dL-A!|+)qk(Zz1AZR(L;*o57!s`*lND7)@muVhy@W5? z!}&Dg#G?wNRAh+`2}793jR$~U;ilYKb|0Z|8th%5dV3k8#5c%Ls&AoMslK}JZhcmsW@bU zAODDx(Lw;{*7~R0TA~3p)(tzF=;3SM<7ev5f_)}#YE(gC z;u8QbCotzneuJ=g|wy$+Kmd$PD`?e_u)}Qtx zYbVU&jj6_R>&$~=YUWWczuB_|v~WD%V6mJ1^=sUSmh}Gx0WX^&6)witSUaZ(kjofe z$`0cQQN#^a?L3>1piFpySa}v*y8QPLD7OS!)ur;!^<|bRS2HCS^H{;TllN{bJNB)6dp+YrxjWz=YbHWk!WILLy?P? z#W*bx6Xkvc11Xp?jF~uItzvklJ`E4siB}n>hL9YJ(KLSR%Lq>TBdIuz6y-=-N%Q?o zgxc$9Mtczqw?b(z`I3e+?-2}$+&YP2wBv*Se&00b=Z^w8l1I1Z++FhY8cK#kQN|R? zIk`AOR@p=q-ow~hm7xCiHAbVwUKlogM^OW5{1`4l7_qcC|CzgQj z<)^DT?lwN<70b4A4 z8M{)`rfPTZy_lw|Hl}-6%EHHBl?N)Me${c0`O)_7yu&KaBtZQ>tk7XKhB+j{W}X6D zou^#=!*)FdD#&@FEGJ->fRuf@(bd$=t=+7>Alec`l9E(e&HD~%Z7XDu9!g&G66z+> z6ZDE3a1#02lnutyU5eAMTh6)S>+E8xcvKOal)%^uJ8d>|N(2dekj_)KY{!u;TlK-aIV`A)6(Q?%E4=zTZB{3)xN8D>-lkq8`eo&f5 zKUm$0Y#f6^A@v#f#HlFNSoaW_zunXAQe#z-4QM5Ri*~X-wR0uk+o*JlIwbL`ec!l- ziuW9crN-yxgcvW`hmNeJuNUTs_9#*z7x%Dp&l3-1ZMAGgYFtYK9)ZIe*=i9%=08#p zFr=1kZ@IZ=KPiYU3c$JYPk);x+VKS>)>Dnr5su4p4E0t}EHaRKfn-;+yo6 z_gtGzRXUIb5Q`B!=B5l&kB*?9ECjt}RKc@jmJ62MGh9iK_!1aETSR(G(=iMGlXJ)}B6iE9VY z7hOhIZoZ+FaQJDiz4|?1$>bAm_@H{BwBi}+LxoP;v;It*p(;i!C5zYUpnT7DmPXF} zX4ieUoSy)vb>vqTwFUGqHW;?f1tWkYLjn1byY`0;e&}-(sbYXl4i0QMN0U1P~~t4X6w)_7JPk+}iihrwSV|#LMV!J2IyZ z$&Zh|LFy-Mcb!B0@rI6JQ`SQ)fr|@OYT=ak#jq#FXeIex-&YWOhwDw~K(mg>L#qn5 z#=fxSAWjk+I?hdJvE>Rk0m@?OF?%hG?((#EaX>PYhAX6qR(#6!*>>Yci_TtC`*7&q zrMqnM%Z_zi$uG>u`PwS@+hDL{?II(AW2z5BuYKsX_D3+k5-rbF?Uv&dMOy6ydfb`1 z4TtaQwAzHezZI0q(R}R|+x|K(+XEy6tX1axU#~Sak@84)9Ar~WagXk&^@Y%PK1s-S z2BVEu7CSnmb0Qk&8W#u|dBrga#4Yb(Mz{aWJUAAeC^T`bYpiCeO}uDa5PwygsPhp; z!^GgIPcrK;6rI|mFs}{s>N*5Fc%nSKd<2`lVZ+O{=}MeQM{3gBdAr?CM3_C;)hJ_- zZokiTf-}IaY(iC@sL-5-f6t5XJt@F58hS7a5U*5M&e`j6aLcX5WP&X+n?+M>2Iz=^N8S0 zdpX#(Y&=+2NIDv-pvMkfiOATBmWA_PYeVO8%#4kKW(%K5b9;INWr%zI$O?_1cyMJ} zrSlBp6^e&$=ZvgIYm3DHL)$w=S+*|dwqY~FR)%dm!?tbPwr$(CZQHi3%;1f+_O3d6 zpQ_vHqMeudFy7~wW6b{b{&%#~YCE1n{k|JA{=z?Pz37d9ZB$}ZB}Fro!r zCdP>f9Fg0H@KD%zD<1=`@wlgfWbPryuQG-}KIaRwIN^Z7V^WfxQ}wQ!+KkdupTW?O zrdx1#ygfh7Wh8kRmU6zGq7i(ke0?LXq}fw=9iDsgLVbdGsk6|j3y+GbQmzvg8$79& zGqw%T_F#0>ynwz2r5-?xr-!9{aby1*oy*1|asOsU_wcArkfpdnIbCed*Iol{o1lIUS)wZMEB=QNy3XUFSS zYmMBxt0bJ8fE5IA1qYtwvV~L6rc4xJWjS5-bW3H3>OQ?AxDit<)p%LiYWM+)g6cpo z>?Q3uD=Rl<6jgLzb{i!UI-;7`xt$4wTp;94GNKr#RDazFixBavB|(989hHs4zuWSL zI=rro#}@Ka#+UgDFp0BbF{Z|H+Mr$j4c1~NHV9Mj&6m&u@TCur70-pwf_Mxzz~1)v z2C~cLVgZkH(GMyvCtvrFyB$_$lory#@qCQcDR0ZU+F8>dE>l4>wK04@C*6rT?9||% zqrr2x#)+301#Av+I5Cg{k!|Vpg(VxA&yce4ty7sPabko?OHw<1z^9s2j3kQ*jB^PV zW_belDt?+_Q)5TxatjgJW1~#)vPTiVn_OVtwNP&Ju~jq)6kWH^AlHLF@&{R44vv?{ z<@m-rpzzyAilO;X3BHdDk!}D7WSUrq&Nhfvf)muh$2k z=S7mUC(vwQPNv$Mx(qhs_NK}sJ7rjL2htyjP9tt$_NHQ+h$CKUcQc1F65H%bcPGuH z{qVXx(SV#zH04aODPmK|&*17#I+iSZYss;RyMlDS-JqTlmuS?qo$3Qq0@d5pzT%sz zF6n8mDTEs6lYl7${|m5NhBul}eSKW|ARG+4Ktt3_f95!R4Zrcxjk2t1jb}Meq z;s>~Ep+B=0#m<)*jCIwmu#TgrkFpRIJ)>K{Q9HSXw)H*J^Ni5vAI8d@j=1dv-KJ{E zRX@4u`Azp6IWj9sciR06TF>Mn5aEO7c##pE8aP&i*HGn z4iRtSqpDE$z1SF)NrWBd$2wdv3v7=BHikec$s(bJmBu;l=nlnZ{68<;JHUDl_3*B#K}W14x1PvDreHw%+@&oy>~$$VvIF-)h*;A zTb*McMO%bW!BH?K6*41AfoUrZC@6n)pb|J?^?28j?jYc)L@$z=^mFc2;X4NOpsTXAt6zueeZo@8~NG* zX(+itC}B3g|~OQVwjovFwypr!qp|f1-Eo!To3? z)9W+gIQE6BdBmY)MN@5xUmVWr;rgj=IZOrfsM$!1#o5z+TmzNNqnr4w7bx;{G)xfc za-mPrWf=d4-gD3YLhsfbA%&aVQ!WA*cd(KqsNVclN@PU0fox0C!NVY`G$$_&j*S zXJc&>AGlBiV$?&K%+&@RXu43K^^IzEFb9GIzS?F#X?}i=6%Iyp z!(}Ur2kP5U)48h~3x+|f>DoAz{sv5UmWdNGSKkp%J=B8thk^D>lQ6dMtumY!2Hy`( zSld+B{T&#!5s-i}rgVTi_wz_}3RzP=UrbzN99a`+?hv7~k+~P=QB}viL3`zt(Lo14 zuC=xE?RfG1t0IBgM-x{I$0eM^((Oo}WdB0y2qR_xR0|w)$0EhEb*JqKLf;7o!ayJ8 z`_6dNtS>-ST?A*NYv2^nq}vwE>xljg7qbJPRFyMhE1KyA#MjhbaDZ_wF-(uXPwhX@UCBPT-&9{}#;yup2M6 zviUt{%j>>~0{kKdTC6 z|Hb78Bx-MZ)E3s8^hf2%4n+|w)h#|M)v=2}s^JMXfElayO{%pv(1k4{t8FRQ?TUWQ z^cC>H{sbMk-UBNMRT5nj=xMVTN~CPo&$p)l%noEzeUrU&I`6x4N>j{*L%%63KF^(h zQa+fzQS8T4Rt}Tg52RIL)_8rtyM>F#GJbsN&fLFtpog|%=X8c-CvA^Bg=HKuH2_%& zhqUru%Voy;v1+A>1afjKGd8Ox*droMPJ8{^90Yv(_18#|X135y^cc9G6l2C7Xn*>Y zW7Xe2uKD*_YPVt3$Z`|_>DTIja}D(cvOt`e9s%eJc90hTrsMi01Rl7pR#pxxi1m4f z;@~2+Rbxk4&BEwMyc7=CE>~9qjK|`qMnvU^aIu(Z0Z0W*IoPgj-m|R(Z)FK$gh-!}}w#EU8x`VpN?K%#8{hCxizX zsY3q4%MEt|Q~NhBS6AMj}Fbo8IuG@BIinTS%%7y?1Dr#>c+mp-kbW~`jP!^X;b%! zJfjv-et)tu}7*(pRzHi+oC5?74U zqb%oCuo{Y~q*W3`LplmCU2&N6Fzs%<$gA27n)9W>DA4>rlys9#u6fK11wEnS`%D<2 zHF<`YI|?iIldXOz$41VfW>a#Fu6GtzcoiQ%Nlh*7cP*+!DrY#PD7uMWJXG^QprQDd z|Bt*L2!Otd#YEs7=rc)9uOEB`a|ozD?Cul1XqqdiHodwyeQNnB@r+2w+jhu6{fu=W zSn@=Xk)i7q^uBs2BDgVqxndd2>qrS*)x zh(6L3?dd$JjOd{y*+ z@=^4*TPshs0Y+{yzSV{;u3%j~UiBu|tK45yhh13O`DnPsPAYnpX0f%NbC6(R z;i$gliKjy&$-2gclpjY(&W%4Gn5{}@BN4IuMJhn0$B0jVzJ^kAw4XjpKQeurs+(*g zy&!BIEH)g(n&t&;ldN*X93;Dv=4Gp=j+BRgs+=GntweFjQPz zdcGvO)fxyBsfYyB0~Jp!^AR6VV9LhO43t=l(PdGH(q@Q$b5F(w3myFA%Tw(z0NB7$ zsB*ynCs@6t{Dx?Er@}?2x#{Jo zQTQTCk;HN@t{Ve}@L~U-NPZVeEM2)pjuN-c1V#0!RF=K0u!5I?&-_#1+P;#@rsi+T%P^hZjpH*BSL~NAEa`4%FcRya0ozj#)1}k{Cm8jh(cfCH_dm7X8@-M;0Bv(o z_u7|`YQk@=7d_X@{gcN`MOT0oiwg1W?5LsV1l}!mt6Y4~{#o*F>aDDR_&5iVTkVEl zJ}QTQj;#~Cn1z14i_A)fVKM*=flC@}{ef6#-VJ^&YGu0fAbF-=vnTF|`sZ0j%`?8% zjaqF|Wi_>?jXpriRR#^77GmV~$#}7$THFfkI4)1-#Ra7i_2+vH$Xiy z>9(0Q>5c~Otr`9(3grrH10NH2O2fofK#GArhU!h@X3Y0e(>JD#AySb(ua!V2OWZE6 zuoL>mjdbZUPLfV(1$sXbV7YD!Q)eN%xHhwd6EqE(xpAo3c`ik>@4c#OEeMHUA&Ds~ z;16*Axy@Q}t&uO8O(*0u)LHzb>l78-a`^cWZq;;f%Eo(uLTC^GcnkDM!$&@%;vI2~ znSza`YPQ*?(~fg{3+E0B>hEaB%`NVNn_(qP#u4+I!5^C}>*087$LiYhUAH15G=Ji& zAwU7Qj;m9TwgjWA{Gc35rs24hUptHhGkbXJqlns!A89`8!r{mHVVaEXLzou(c~zm)w>Yf z+~o6DP-hXYC-G&E#;daNe9z8E<(56n`Fb7KL>)yZc9}8jQlCBfU18ssyx2vnBAKb9 z{eG{H>9whb7NxwO5j>}X@2U8JrHy5`LZUK-s1Cf4s|?$5U|+S_1!Y9h;hRvwdNu~G z5M`qC4^248Q|dIlL1sNPQNHxvwKC;lK%ui;v8g%+Yd(KfG0or>Av z({J36PBArMN8ZDrU!b<@Mzm7#jJCBRs!Eevm_B7hS%fy&4e7Io;ckNE9}@}nXz+OV z?E#)vpF0U&*p|9_qt!!NDT9_>p=nO8Fk7wbcp6ogGO+?}>&*QqZ*Q-7#JqMwCxnLE z4y#;|*wcuyrk!W>*!rxA?;qu@8ACT4az*rxg2wS`6dL20%6Y@wkhSwM;ib2Vd416F zYKn+;dG&lV3sUd>q)GF#>JWLE%7zO##?C|U*j%*eHWXhtqR1ZR%H|VdzQF3@WVTjt ziRS&>{_$|yP&LJlF!UnWXo;)y>>Tmzn(#0Iz4NQ56H)ej%YQoghwiYcm?+uH>KRra zc*x;7iYpQsED)$+4Z(D*@N#Kyg5wA#>=~>B;BM(^v&;LkB4ZJEWzc}}I#{yWJggbI zsiy^EV~E_|mfhoTsS{1kPo?oAd+OHhOhC$gRtst@C*?X$m z3W$WL+F_;kF$4|HegFM~4`gWF`;7jIR(!E0%h3Z}P4d39apq(J6OdI;VQ0~>-Nb9m z+?Gn8k#de`!L4iuvDDP9W`7ky`J!Z$<#;FepVSQI>)qf5N^>JAWYWkaP&*>p-43Gzpqj++grnLIgO_YpMun}*d&P}Qe_ z+8Mecc%MJA65dQOSUtg&;IPwM7KmLt9TvFs2o2Y_rToDx=uRKZs&^inhGi*>i@Q>`NSLrZHcG75nw_J5{sS1~nQ6`jp-5q`m>*3KoNBsT;0u%S}y z#3EWpaMBh;S|@9E8t7Xa?wr6gVqVuoqf|Y5c(l04%2H=h_$iM7Pc^&YKE8dx{VGAsf0bL;GfRVOzFI z9;%P7l8tH@a&2Kcmi+iFp0eecTUdA|^63oTp@EH~i{H9KonmyvNx{bx_Qt2xJ;cy= z{oHtK?%GNiL&{{#QsY|2r5<1aXAD;BBB<>*F>I&3V7t0p(Y2AnTJ>g*%v=)u7ckPH z8*AnD{gq5IFu0uW+d88^m+(!~bct!=_x4F{p^FIgfxduFVV#Elmt?yToAp6rAG0~! z$q2Rf*IXnn!x(>P$m_=6+ovuMsE^&aWcXxzw}BuD{yEp+{9QdjHJE&2&Tjm%Zr4K? zj=c?6uDn|*BZcrug)00=s9>eF*s zTc036dYN~VQbji~?}Ls56IjA^T{mu1x9}h)rAH(XgmmDq^8U%Cu0!JMx@sW00>Y4r z0LK7X7GdUkz@?5TIel}N4>}|B7IcvC;7_u!hCRqOit8{>bCuamx`$-49t-B!`;}|- zs>HSKpxsNc6pzhuaJXZ$C>|$mtg;3gd6yD+wsQu3xYw$MA=jpFoobAetWApD#}e0s zzp0!H8MQBEV-gd*FQhW)8apNo*=}NMQ*!($q_rrtu=<)g2?oq*;*>LHr3E0JZfq^@ zG!dk%08NmiH;^j_Lo~1&fW5H8Cu}>2?sjQ26QAV zi)}YyBY0gvQGD^_2`~4+Ev#Z=BI9(pe4;tF+^wTskdxQz|Rct(e>jzPpt z>sGi<2MvhnN)axFUdz>5mkwo9qZA3PjUx&&Lg&MPG=)YxETERUn+w*@t|bPmYJ0ix5HRfC3zjSV7V^k_ zG>B{J1X9ExuTh2o)$al6Fv&0v7Hd^C+rkDpCo;W8s3rwMt#=V%gO|R(W1N>)lM3cM zL{}lvm9tIB66J1U7w%tsB#7rjEXee_6~E|65Rre2vRbfUCPXlCbnUgWP71E@0hY#r zZawy)Aie^Z{Zv4$DA|tPZjAnYM@io-yC{rbYO&l%gW&SZUx~AOZ8fHkL?~g)7t_aH z{INfjquZ?IRd^4S_;(_{z2%h!6z7O?bjLDh-{d&E*&LP5FpV2Y!sW>@6;AVd1Vg5XiAiygGrMh^eB1;%aj7=Dd`A}Kir}+iau2V=RikeF>IOVZ?WQ@B$6|GWf!*zjHHx zO)D0^rxkrsVrVZc6222dLqf^OK%Q?nQqRB@zAN*!rOF-k`0e!gX+1qz&>3#kIOJ_7 zl*(=6u}Uo#5l~zZoi7i5`Z)N&9>(^zh%-4E(II7B_L6SVfsdU+as5cb8B9&*_sza8 zM+`NFcv{EL_{YqAicSdX@Os*UL9`aZxZ|A+#tTN)0ck3@Rxzm?z^N+f+t!RNA#^od zW1RZdz^N$*+GhFN6I)<*HIbZc2^~icHHNfrZ5sX_#2Pb4*5ubomt-*=MQtjt!q+F( zh92<%zt^*^Bqr<)^-8s2mTM?%*<6P}p9ZsWH?|oT@!?bjc1a8bs<4a;lDH54+?ad? zs77`hP{ryVyxm(Ly5ebK@!-U_$2tj-sm;rHwrThCx28;E$wX5QEcYGD(9kTE>7hgh z08wOwGh^gVuRs?^u9s+rHarM&PV0$<8U65l;?}ZnMRVT!&Km?=H^E?|YixwKwK%w$ zfMDTOTJ>ye3b3DPO7xx((SNwHtV$y%#w9?#X;7y?=9;BM+=BpV&OYKoT9asnagaG& z#(mx178?2VMuF9+m_4uNS!j$%QX)nV7~I%aYupId7c6@OQ0qN%9w&cKFE-mYd=qnV zMK|_li}zf{1b;y+1*&VR!|Wc1YidS+Gr%HEnj-v5B&}-mh|NuKn2hT|LDdXq)$i0n zVOt@g&g~yo-X|HvT-@d>DogJIe^Ipta1@my5VCz@#(WYLiKG!Ctm2g@fYPH@d41nP zkICT&`aEAcR=00gO{4U4Q<2o*o~NqILvH--U@)ulhEMr*3~X0ke!^qfH_+o><`<~! zmv^gimefX7!@#QDbsSl}ydJNqjARJaUQweg(j7({-K;Rhnmg;)(qWf7s9U+An zSJL1%Qz*y?kPR*}b8 z?jn#-%i}RVlxvG`%CymiHv+TdCSVkPYS)7@tuUs4c!?l+$DtR9wQOevam<2A6QR|o z9}DAuaV!|kJaYyN)0d!NqD29NV6PIPkK~x5JD5jJ#Z|1!z77Z_=#;ZQhJX`noyE@` za|-stZ2Xo1Y~=7*PA+vDark*jpq01V#cNdIEVou)W&4t&iY^-u)kk7`rPV`(^A{ra zDNz`6B^e{}zQtSbkLXo$l?A%Zt&Ay1q{cQ~UGlKcP{T%7g>BsMy9w8dI-{H2p+=?3RuX7lUOUEhFXa`?pT2(xh? zz_x*iv#KEGF0JKLVp7tNj#_yy9I)rb)d(j+^OX&JS({Z?)LF4tgagJq#Kk`Leq|<( zE%3BsRKekRWqtCb2?Gd@jCy$jEMH}4^L8_s`Ur=CYDjXUaqYK3Ge2O)MY4+k=^4&T zB&;Zrj&PMT^0S@H&j|MAf=Vs=nr_S}qGK{nZ`zz4T^!jwcq-0OTaB*~8C^3;liWr3 zlD*N9OW6I3n6M#Nj*>_sj*>#wCsuF$nWzRikM^X49E|-?zdxCnB+Dc<0jwrHEhKA0 z1fA?@&4+oHeT<<}zQf1+xL0T+$53flaGibfh$Uhe6iIW?$kM<}T9dd>Eh$h734-fE z#QCdi_QWHqlhKhIPBRF0ysQoGofk5LCtGRfmc|}{(0b3gMrQSQ)}PoS@V1IF-w3-E z+`N3rRSR>1yg2>BD!lNSWO+UMXPQ7#cp1hMn<&)))AQf8gtv6mZ01Zu(d3j}JJ-Kr z2_vypvP|)WsvXO(>-t!6zw$VNSn{uTB|CnnS*)>y(32HVZpJ$sn(aB=j>-V9^@oDn zHY^NM6?)~p=(JIYqiE2}u^$1={KD?{ZVeT93JvYIe3b={beC6fvc>SK06xK>+=Hh) z_yy+PpHh)d&An>oN;?KyQIz@usB6uO)-dbbXfWa_g%Qp!6*P}U^h&sm#(EFE+Fo{B zr-9%;$ZHgcfJMP;FYaSEqC(UPw4A_6b97Jj>MY3vVVSvh$qub)vUfW-rHNuOl&<$f z0psTi<`lM6aFy#>+O`~72ToKMV)R+7K+;-$W1G)Nvih;Rcw=R+)4-jkrLwX|d7&;( zAwo=qrb_fDi>W2Q5_uP_Fh@&RE193aEiH>T&E09{6A%+>b!Ab0JzVkc%3`tc<-waW z8Z=)L+KlAK0}R1;l)=wj@u)F3x^WRFODVItZ|SCmD%EZ+8mt%!EHi}o3{#nTQwRl=V!W*tMS(|Lr<8MJ>b&E z_f=T5GY~llgLBoP77wrMdnqt3&u)d)H%muMBHm_Q8a1O$xr|}DmjD&;)3PICy8rQ~ z3*-c;R@#P-Yr;X~;KuUuXCu^Yd9gc5#u53vG@BVLqXLkY3Gzp>7EdRe7`UMc$>~qte!1+fcX> zV5+XQNan)5qBz!0lgZ9YVZE4g?OIp{Rog;XOxPd7RL@oFBAN);&=iDnSb1k9o5d}c z&!(?lS8X#1Lqy4L$4(t+7-JPDH8}*;9FyIX&pKkM*As7^R50m<995$0{$ru1(GXpW0 znKb17qNZo(Jm0uFcGkb&2z@MdEg`1q^4HS01h5V{SIdzuWfx|E!Po&!gj--c%#vJ( zb@p9AyO+WAPj%eCb~hlrqP|w<*lXzgjp~`{HEN>yol{tEW1P0t<&BA8nY^UJz>7t3 zNL|Ai6n$Ix9%t~x?ad9H#FocnxanDEvE!QxvXQ z>XYex04p2jZi9WF0CDJU|7URUZQnk{Tcmh8m$N-vGg^A=bO7rCFO)G|x|%itL+u*U zyjV+yCMR&kY<)6q`ovk$()-$P^wcA~FJtSI#N!=)tN#TxB{xhQy92^WV{YZOPNiPn zIS&Yz{V@CYXXdEskrfW#?SDUaAuA`=wJWh?BuP|T^+xHZ*X}GgIy;}*D*J$8 zf%L7H9xY-(H-I5x7`M#^SweA{b(Ios$h32`dqBkxUtW&mW=u9a7Kd#=jVWEPv)v*3>(b zJRN?90h905$y+*>6xHhOxzB~ynysV!VSOejJ3Xy{P@&W^%k)=CLHw)nhf}gq#y?96 zhNTA99M8Q?43Eu0zG_uiWLY#OhC`|gB-1BSbb)t&eb*H3{!vpHXCwLKtDg zBHgaRg!Cs#)ac6%#Q&H>0fUAk618PFQXq&jW5iYMw9wt05Zc9T*|YOe*BYtBiYLbT z)wx{zW|`8UFK$OZZ6aJa4<7Si{WK04NcH_9C0iC4?qG1=H{fDF*i?5wun0%iMetoy z@BbYOkx|UtNuUBT6t%cX$T*qVnv06eaf6l<1MCF=XXz+Uf{@RB+WFW#>%NO9OgWl5 zA&Q>`yM01n{d+z;5c`0iN#SKcL~2^v_Wm@0o9WpXVJbzk`U&~RLH$P)Jfnr9#|5&g z?6X48cXvy)ZR^{$`n#oG5t)x4rVV7$`d?e>O8;o7m)M4iI}iO;Q+TB6S@^Cg)a`No zT~m1atEMnEhSYD;isI0U<526Iepim-zuijZe;#dN zyr+?LNUn0Lw>4uRFb--9Oa9U2^e0NY&NPN9LHH~xss^dh8;mIm zf5+67*r9JvP3f8=751Z7LpLkkqSPQh4|UI8c5i^_GnwY^Bug^a;y`IhPu zC098*Z47XYkXdKJ$~To5CzxH0r>=TRg&m=5ZuynQdUzlC2~y}j-`mpDzI#YR0v`L;?IHU*xT`)64}EaSVZa1je83xhvt6{Fl}=i41?2&gx%If>*q z2>M5L-frzQ23-^p)~O0jSb06xAZ0UsmICVg1=?K1VPuzx3@tID)7W}#m<5R@wFrc9 zn+&JvhD`ky(a{+Kxq~UO)&mZV{4zTrAEe%$B}lhr4A^?S@n)quSjII=LERriSTEqZ z|H?cIR(Y_WtmOmOcayrZHJ{aK{RmU)Pt=FpN`lEm(zi2EG>S<5k^C~V`L_5$2Y>pg zI*|9>TgQiU@Rt6tfi+otkLJg+6RJA<8rkk}X0_JvIPkiX@jG~TuslhvH?cS4{30!x zc#>4FF(lD`{^=EWmcaM(XI?QxFu;}ELgvgT)g`PifDmFVwM_iNoVwNUk1)<>udnB| z3Xqam{Lb--W?QtT4J$IoN;lt@pE2JDA8}#fF$A8E{X}O{Ey7fw{kkeC@!2%q-AJDe zcePvhE93ETvJ#8_G~shzpS$nhGnw%Hsl8)RSwIYqXI0A?lj_olW&lbYgfB}o{! zf3yPve<1Yy{=7E>Xt@^*7{K60EKc3Ky8-Mxc}KMK+XfylR~L@ohF{3NPO}*$eleZJ zaSWjB*t(A;Zgj;Mj6Y%9eKpCoi@t@|J0s=siZyA%eA|I#V6SfhaSm;wmJ3Tp zohG9#8q}i`FaZOCZ;{C75A#+kwIT%c$;oy67y~`hun7o$mQW->4|=0EfI2=_Vv67; zmEkUdmq>_8vx48P7la?#-v?F#nI$34A$R5%Wd~2y=%UO1$4VmiM3uGTC zl_ZB}=tOrIK&6bs<#X~JoHS)bZsP)XG0>M8d~6-e))mOfW73}d6*a?OpU z2Rngi?Ha<_B4e;LorySxcfGoOD8RNfJZ`Cs3uqxveQf!im^GoIPlJ*a@st+{bD*4f z6`z%oNUPIeRJAtZ`_26>Y{1tcmnzg_lqr%wR8p4(GJO`wBjRBsXs{ zuM5YN$tO31D5!NcwX$v$3j_S)v+|Jtg}MA4NB z(A2|onV5`69ct(AP425l-wqJojiS)6rA)DQ>#FL-F(tNu!!|Ai1f#Uo9T-v04g7Jv z(px~E7q|SrAtmCb3rA$RcX{8B>tYcU1OxIOjq>Xly19_%Y=wMa@j);w^oR2l=2osr zXs1z>|LT?-=n`ff+KGa%K{fV%7xgWJa+toDN}=8^s0C$>5sc#|S2N(lduGMh6kacj z4HH-shaZG4k5!WCp;#Vh1Jc+DhSfc&3YCi0fVAlpW2$D5uEfMXFxn7D`F+&rK5OT? zX@dCH;rG2VmSty%j<6*~8MVjV?qhvuYu_7dMBfBB?52JjQhO>@?9D!iO^aT+$6A(C z%l_zkmW}Datp|VLScI0sUOJ_ctHk~ng~wqRc#LE*>+N<&k6}2f;#^3!uSLYU-8&nU!+a*B@#=W>sxc+;g)j`%%I*eAevy&9f#gA-&K5&&~Q3~}( zoEGXEYi?Kp92jDc`w9Y-m*BL8Mw~fhm!=G@2weF}CA-90ggiJxi^{5)Q8l4e4X?8D zwz>LhO7)2#S>;pq#N&vtHI|9D{*e)AuOJ*PZx3lWaHa4&Wg6o=8N`N$58WIZLD+{P zu3tkm6v8#RWlL<)o|X@JbJs#-Wvf|TSk-J%N`F#y1k6fn?kFEwBS^fIt8DqRJ+Q2N z4Nis=Z7Op|KJ{!3P9?*cM~LRQzo!`o3c&(Ip9f}FgnXj6`-67bP4CxtNpv09ow&up zFYfl_G8w`x&@*gRe{?YCgtc5YhI6vDwD~%gJ6J<_EBltq2uv+6^3~&WH$Ixde_VDb zK$XkEyW+1feO%rHi6GzHKnFn3z+}_ggjW_vsp|=>+0kKQNp&^M?$U$KdHYw@t>@Y_ zY_zU-U>ZSjsL_q*m8Oc|8i_A^fn9LF@)d?VqIUEwIl8Xah`1a^UR0!mg%)@iL(~#gE4q3Xs})Lkmw7`=*IqU34gtOO zb~W0L2u|Ze->oWzXs9FPLnAu zu1ppht0+Q^!gwJDv9F0ygA<8PwUdOeyo9L-P{rU-lFFj|cj5&<9#P5*hJ(|t9m*7Y zGXnGb9iBUM9f?2opCZ3^--|m5;N`B`eEeK+bwTdcn!Dsxe6K?-um>D(akk?D|MBFA zy{Vl_b2cSToERC>$eX5$<}y^+fOo<#tbJrY-eOW{bC`h`$t?irVG`b3{Eg7IT3P|pXy$^G!P%ae@te37)uib zd#2CsO*`5a!CX}R(a<#p2l23;LegNQ0>&5}tpM&66Mv;~*88cJI=K#9G9Isty1E8= znA}JjGQxdLB6Bkwp>uifhqYEbTJcE^sQ-aIv=peu5RdJehK_5| zDz7I2164>&fgICK9_`-do5c$Xjo&GRy5u_PkT>AuE7L}tC9c7DZSvUV$@Z;ojYCo7 zN@(ohHulTA<^R>e$bQsb1@@qI@f|Ig6DIe*cjf6`dorre4^7)7j? zBq5|k$?0tqPJMsWaqmC4Pdth$z(1D4rG0elt*ad-TeH#MX$^U&u27_^z)ke^ay#Yo zLCN{Lu(#(@vWEBdsS{#DavKv9{pt8f`!?c(gM)+X{c<$X)7kBL=i>cXb5ri@7Vtgf zyXAb|zX^-N#`!q=ih#TFLr>jcsHxGd(L#ZAsFPCU&=ROkPxVvYp}^Ce)?Cgyx%(c) zlKScmGptxG2aR9BWKImvcJkhS!GV8{3rjvlckUS(i0~+Nf>RGY4HN~O3$e+#1OoE3 z-PU7F8a>L=u5Pp+va1}8BmK_b@<@UQ$y+K`ryg!T5l%PAME8J3Rl=UM`SdO!xfKSa z^58QAD+Cb?2PFDlsxebWwlHgAIFuk5J36ww>Y{Hv(=@u%8Task6sg9ptS`ROhR7`x zqo$;JKidA*-xw@hbJ_9DbbdZ}dl%m#rDlfQxvXR*^6?~jT=@I}gur%y)uu<;*vH>w zjwD)zCw9q>$SOZHv&h+_kBJ1*ipweyGg*U69u4Xo+CL*F4~ z-fo77njH3TgX$9caKU73FhxN9LNqHY{;#f|pfqDbL903LVm~_UL4gX-M%BSMXQpIj zjJt%8s9pj%nQ{ENfqnXZ`o$kt*1Bac0@V}yZta#8Gy)}B{S2+Cn93EFsM zEF-r$49r9vt8g3h--#4jupr5kpxeE8aFCFgdXuv^CS$$WezTvWZ_|J)c?f-<; zxWXgdV}Jc+{FTqpO#}>NLgw4A+b>g;Pg1=buI9`Dw(& zDKIja)u?&tOjC`{OLHWZ-Madx+&%;JW|Tt`8Ww1^kGA3kS_2@2>SNqyI5b+zTb(eX zI9N?*mi!mm;rb(kQZ1+Rq1Svp%-at%@%Ol$Km@9Tk)C}L!Jx8vbgMsTk-?7jSkCw@lcayF4J9?AA;^Qkn8WE9 zr%V#dG|>fIbz*=+Opqqeh&$XLi~+@0%pkOeS2AUy$-Lrdk!}~XDoRFp#LSm?YJwHt z-?+^nyuyDBVM~enxw|2BQqeGa$ zVKM7an^C;Rea^_ayMI@3S}&^0M$8)~?Lh!Erl|Z5QXHOlpDsy78$jrg{GXO1Z3M3A zK3W3AMzXr36&|Jav3@~$$%=cAQ!A}AXhL_mK6s#(tf-cWZb49rW}LRk9imn>dC}<}!xS+-uXNes8 z003GNU`J~+DJwROw&;sgZ>lq&VnR1gFxD5xlY(QM8f~?ru$`gk3c1Cv&p@Mil2DCY+ zv5mI-UYq;3)#l9lM}%NgPYcqKjhnHg&D>^bc&0$Np(A+o_;CPWAXXw)t>wUPDlR)< zFceem$r)|*$5tqMY(nHeO<2E-dUZ5$2Md2n+6J*u{F67;#cZfaUkur@X-z5Dx*S{?%5gBZmI)5GICgnA2Ir47>B|x4 z4V{Wsp@|8W?luY?lo*6rQmHN*F=elLJORHq#o%3s7@+@s2XKi~T>faI-ie6^9NQWV znmT8?v*;UJM49Rtp*2zu=AKIuHV~|fL2bmjCajBcP1yoCTGBGkG>9$*w(|?G+LB30 z=i4rodCRWPqFvG|YZxt{wukvOVU0|bnkE(IE}7e+_rhDj_#$mF<%UriFKU0Ej0SAk z6gjB)k1aC+VqGN|s{h@nW3r_Af>(wqpvtV*&cyP8SU3ln5VdyQaKZ>o1z0?!2Xbv4 zHGSsFs8^EgTk^S&Jz68B&#Mx8-Av{!Dc|V^jz{)%pY1o$ganvl-9_{ScRwYu;vAg~ zuN!>?zM!RK$K)H7(oBHst+~mu%xG0)MuY7#EY~AfGGN`=?UR!ap8d}= z#onsVfmwa{^i<3~e0o~n=Gk#47Z?-!adwECb@buW^ADe%+UU4lZgfiZ{`+jRtxngk zzO&U9|KfYZ)Q3+`mH6=K>4#5$kDiKaMH|J651;;ik{yprF~>I5R(|;O)DYhfpPmBw z-Q6ChW#nY$swL`E>1!FB~y;;mh5qvO8dzXR!v3~k0 zfuB|}971lx@W8+n$!<2mU2O$+ELT3S68*NZ=^!e7QxJCa6hzMOdd&5%*81goG$81scJBfdXUJW_InTOXUO2oQ# zBNr+uXeiobX5;w5Cv9W;2Z~&8dsy+4yFxygSp+eDiO9y^0JkRH3Qi%BS)3Jt%1?) zd_NbAmTIxy;>emUMa7lSKdi0LZ+!b-Zl2kF_r6=KT^s{T82*Bw;_=GAgSyVwYpvMX zErmp)_Z_+R*wB7Q!T=BFokQ z(wel+v&#!pl5?;#&>`nV$in{5NwDr891(U~Q*_MjerK{MBrBRx8NQC7TscA#Yl9kW!Tw;VzSka{vcUoz% zU9Ar$eT_EB1%r57gZFstOFW~V@7ow1{cqao8g{VEY3WI45UO`=MsZ2i;u*0K*K1?b zt7EIu+ed4bPjb;#-9Yi}{&U!5z>W6&=bw?Ee%{NnY|ks`OlZy7Tg4y{NLu{s+b4Sf zqHd!1Y{1cTEe4?{&o33bRv5LrfZ3c?lbd$RrY$cE))X@G)6>Z*ys}{Bav~Qe zb}h47lssQOBR7oIdtnVxTGx}%Xlx1HGjj0LPh@h%N=7A{fS&R5&j%acLKwv&o348A zX+p;Hu~z}S9bPg?=wzSeHOh%e#}WVIWQZ%iVM-GSKT-=!fL!(l2`M#q|Mqq z_Vi^H`qn!bbgd0q@}}F#0x=1Sgr95usB*phLy9WAgDAL}%ZD2fe6>cyvYw1(RRqYX zvbT7>pHP(u`tx60XGXpLdh6X&rPlimf5#5P?*?Y*HRH-b11yV)8<2`F>!8Wb9gfWv zHf787_=J}Af@0D*)^xW-SJbRJyS(`J z5gzc*FH$FegJiK@PGo$09<%=aBUQbR*18|7aQ_R{ zwcoH?!!_(T*@4z-X^+u|>zd_cA<9DfmjB$pRWCe7*L~I~$gpCz*<^%n?}+Swa1Kv- zBka?+07V)Kjtpu0-X<>EDWp^w{(WM&XJ*;w$+Q&HlO^Sq@yt)UdM2x7d9aQ8+;j5U zqFtFWl4n@KZZHlN`yQ;G7T1o>?aN(+A`M}Cs8>?iqw&`)Z(Wnu@IwE)dotKIaSe`DIgPu zS&T*(d<`Rc$rN=KH){=Z2O7pa<`a2s?|{CpT~R2gY+BgNEV$LEe3I#kyg2_79=B22 zn3FLQG>{fDu%?!8eDEGnw&^a#wCJK4uV~5t$(l&dNyy7v4lWkcR3-od{~FdXUQsTw z$Hby9T{Qf6|JjePffU>LwuKfwQhy^&Bd{dKSvOlAx zWc#+nv{8sjDQJ;RO-DW;Sh*t6SZ%ik6X#OUlV?q*+qm+#-Fh8PZ5bHIt{KPYG2r?~ z$3y{6wQJa}dc!2zSC2`<=CmnFCZ$ugK}e0o!FuKR^qN6>pINws-EpiU(#upYI-^am z%r}<~CKp6oSEO@QM@r7&O`Zx-GCH}-qxSY+Txy!zxW#u@AJbMPX=Mww zsHwyx%t!|ftqQR$v77;|T;oBl=_Re8(PKm&$r?z6Jfr}l7wNzNnFiwB(XkyZ;+c|G zGN^Cl?zp?R3Gks#p8Nm3T1M8w)?X#)VMcj5>7U0+#BRC=wX7D6Xy*%;Jla-pAKY|h?^=+c?gW6$C>&sF%;w=zzZdr$^FGk4MP)gg?%SjNwBssT)<=C+dyp$nF zyqNV6jNDE}dV%@lB?LS!r}xb8g7^pRxVx>r>zQ7{}Tc z?$vOxtgEbRzdQNBoR*B&67x9lhfMD)j|7}1%CC-D>{L{9C#6^1tGiy9{SMs51=ySE znOav7NCC3OwLHF*%9tWO^x4+E7*n#iY1{<&VockKQO1D1En|w#q|dgtW=tuxJ78P) zU`#QJy3V%l! zn>4-^=S;EtH_o@n`UC;fr#sDtX2m61h-?8HRMGjP{!R9_Bby6R7Emk-ix=z7zY~O25LQ7B3(cxAV(j8l z9&1*B&|*Y11#6DtM4CyhteI(dA%~VT7@}dA0I$EGOAhzIEcl;A1bfkE_sF!mHuN2x zi(4(IxB?XB=hYs6GF~NE|yDCIY3Y-oooU*0z+M_3x|-WXJ6As+57CdOHs@mziGeG z^BvEPy59l!9jk6*JlC{d^@7V>Q@9mbGA$@_xs)j!uVJcfDyV!^5n6I8*UmOMWRv-X zQ1blMH93EE_VNV;0yV|aguIGr*G?F6Uajg@l(!)7yfo!JDdNI`bb9s0dG_SV(~rqQ zNL9s|-JvDKN{CWUI8(EUXyzviwJcAXS+3hU0)F5G^B?rK{$Q*{`@S5pzmp0Pc8gx) z^+X2q80RABz$?kV5O;>y6%ZFWZB?gNS)!p9(HfoxS&wMttONcwg4ls1`*tAZDx1+9 zkWf0pd+1E>F^T9!N66Q0E}EhqfdFeg3SWtwmRKhekC&-uXB5|X6_Rc-AYSi|nySoH zN-R9C{|G1`aTE~yQuKzAJg&xznR(MjhV*w~%G4c$I#v)^uO}}BVbriI?5$uWzm4)L z+a&lAj8vuD$g~b#I_0HrCqD*uAX?3?b-RHswC_y37t`^Z%V~*TGh0Pd1`2qpK{DnG12A7uzu_2qRoC6V@OAx`-iQ9m%mW zSel~`s+S5iYL?h!=ZRi4tvWdeJzQU|wzKr4+~r{pMI}fnsySw496Kg}|A5BWU80z40r9{A!u~wKAnGGc_WP!CPV#gh5 z+8sp}sc3nl|GP=Bu>+D?dxA?wk;K*_YNG>j!^&)SE&9OOJ-KQ!AezJ+sfmJ1Of-q< zNQr`rCz|Ynmv#oYogV8;XV&W*eP;FtBoY^wx1SvA|Nrc0%^#OWR|AqZ5KGcyB2y|c zD>}`%6h`>k`t^f$$@}}AJCC3T&cg~^E8yQQd8}s|iydCi#%c$vx#*n){?KFC8$5nn zsA|J}hRY6j5cXi%Dm|BHdH^__m^dyPh}y&&;0;@fTVz9$>6U4;az|^0qOo7Wl157~ z5|3E{@#D*&&7N94P{U(iALJOekKPUa;Ai`jfZ>UrPwCo5l^OSr?_Wv`yIa@M@f%na z-4&>x&K0-sBH6a!(+`PZcr3?$08I%--xvhJNlI314(ywm^$X%tN4%pl5vkn zq=Se1OOmX(+v1NJ^1lWte{o674~P1?=(`M*-%tyy`)FDe?L$FPjK;gml0jc`kYDWdsUyms}+~r5$+xGnQwy(QpS*6##V^pH?YsaUA1vpB2F$*vn zQ7g467{?YMe~sqE3T?sxx#rcpWY>Dcla8nw9K?O^*L`wGA@RIq9nn9EN`{wU-+$iH z(zc?>k}u?l%3HP0`suvJl0@pi5wboo-70=(+ck}0#K!&=Zbdh)nCQ9nsE<8KL9=_f z!7*axQ#RjkZnjpEg4L{Y6-x0Wgu&Xoim#LRj;~9k0;R`z0r_s1w{)#>hgu7N7+EDS ziT4V41$U54nbzNja*g|+i1m;QfkX!LJkYP1UPIriC?E#|z!HMb^qe0IBd3S}1~4fIC~p!wEfx zl^ysJ*ulgZ#0)g8(?s=V#SH8lw$d=nW1>U>P7=hwRjb-)JcX#33$epvBHF^z*apoY z20tn`hSt@7M;Q_X^J?Yh5suAT7eLeC(pVA-aBzhoL1! z^CMh|2|4q|_<(MWVJlcadDN@Vm@^HEW=z)Z9lJ=UUmNQhY?JOb z49|>3hjrxCgB>&8q^dWR&f%JV^1X6$3kOGG4o6v0%_n={BQB;T)GB*4c9{ zZi0dTSMU6Cnlh~99OPW zRO^zenP`@#dJLSchUvlQ%Cl?tc$Pb62?A1=xaegALi=8%yBnnOlV4oQL24JC`KZ>P zej{R{d0H@|qVh(b&^%{SW;(>WlO2vyVUi6fu0v{k*%on{ZlDh+0I)5|p5@7cql=j-qC5JFRX_Z7JNzq-EfI1&%Y*PtJCSKDZqn@h28D7T)}-Ex(SWlgJ9uOz$e zKIN)!QS&SX`~*MuCD9$Qm5uB10^LHlac8S~{_6Vsug?Db;;S^uc2<@~9x!b?EgW!9 zpj}7^!ZL}tEfcI!WNXT&)gB}PS|ElUxz3CL4c&p!10Fumy&YKhYrKxP{k$-pTqbj| zudM}-&(K;SDi+8I+#;hG!*05qM7BOwNx^{lx$n_}(gO}75#09$(s6-cf5cQDaXP4@Y z9(AT~nLZQ=y{AV2;wQacJTVH(*0jYD4Uo?5x$dcsX*V^UY(DZjY^7y^(ft{DeSZ0f zWclK9lP*TCtr>Oy_4(!gG1>p-x&9Bt;#{AI+T|2NZvqTb8-b06Eb9lZMIp`dc>FH?F1X&TsAuFr1lD+> zJN)d^Pe1;20i6{M|E)xlCK>A zgb5d1s}&2#CdT{kL7h1YVKiMu6`Qr?HB$$Y{MCZTbkc8v4VliVV&wYjTgZ>b%xG+% zE2$}|bopC#+i2Mg?EQ>2UD9^ShypX`lr7Ma{_wQW0pwob`bfWFK~IA2JluoLjI|YQdJ0mAA~nC``!N9O48G^d8nx zMT>y9CUyymZb(s=cIN}^)=e}Umo29ik#xpTNyfw#Kxaae`EFn{H&+GoKaYwtyd536 z5`&3D0;MaU6KLGmWEYO5vDv#onxupbTosT(5KRhm-iQe!Jr47_y?`KrwzAPhCtiZ1 zEf9zB9q7LIQu8c;ly~$%0*k|CVmb85mM~9SMTJ~=&SVoN_6ybM{7-N`2H)>I)(}tP=XFI> z8fRPXY`WVzH#;9!=7Sm9*B&q_GqLjr9^vhL^n@tBWTI8qkhqoT=e&=Jq2E(4gA~m-2mx|{%D`+H5Nkjnd{Y+NPNuHek!SwVoS%|iY=e6KxTZ`egHp4Bo#^{4agn4eWq6f>Z z`kyVMe%71E5DaOtXu9;H+Mzt560s0>c6gCqxS!Tt__3y5!tzBg7$g8K097f{i;FG6 z%t#CU*mEW zCPYXJ|7yJm^kTPyo|PFD8ZDNAc1%r-a7>HvjIPs_N$&=wST$|#m!Ru3TC64*)%ioU z7vDmoZ%}o?V)_QSx+w_C*4=6|-9yuXF-O^eHGK`m%zLJx3D`<%K`TPNaYavtJyiPy zN)v-?z?~KZ>-G+ebI}9R9wJ&L;4W)2#9XaRxbfcPWe71F9kPG&{b4)LDx|Q$A?@~=NSA|#e%sppSB`_vDoRdUFrN{$nQ=zQTf&JCBt8HXi zfTp`v+2GY2p3&d^_4Vrw=OeBppYcYjpmj^Hysx0Eht>m& zRmHTQ9aYD)pPf}$W994`g1gSQz7f|$?^?tc|H6(-^m+)H2{7}wr!(Ih0m&A#f9RGK zT+(S7b5I6TeQsXqd%_HO)h*Xrd|V)O8$3K?=XG{N+>ryJg(GlQ`Ze&A=6&tn)cj5H zTLvwJI7`=OucD3>L3ovyZQ(9rx4Tf`RMT{CDRvDbGCYr&1_Y%YDWw{IwhG7L1GQ`;qZ}>M_9(;LX#~N;grJch z`I62D=x(@n`Wd@?8!H$;7x@k3?dxv`-PN1Q8jmb$EsEEsrf+1Bm)(;#XtR8tASUX*kD52X0BmSyBem2ydfc6Ab%!}D9b6$Z!9_X62qUv@mR8I;3nR` z^7Soi0iV1K{0GGHHl-o zE#^(FH5sdaMczFF3b;y4WgTzBQjBJKzB9C!S(#yDaXlV$X zkkgV)aQ!D&X7r=AouDvz4rZZl1>A0RmEbLV(j62V%aT8!C_Df>$I8OPLv}1=$@)C0YDQCws}(Y>)^ z%7&jXG?F4vN*9akY;hY!f}kGu=*j);ldVqf=E$VJqKKAlb4*NTul=?)@ewnQwpHNA zTb=7P<}!GgJ&t3rcJrG~!Z7B|Qp+BdR`4d|IqI~gOVZZ!hC-!=Wm_s}baD!>ELgdm$i<0W!wd@@JR>)Z)q7^`O!Ks^C!s~y@}y_v z;HRI++0X+x#lz&caJpecxyKO=c}IS>67i~|lvYg3D|GO1zKSOFc$;F;N zaeB$;jcDujHrAdee%id&{pX@_l37NWC*I-l0$@Z83_`F=_^sqpeL4L5S6t$muFJNe z<>0*VIxa-xTXixba||PwyqdQqZ3gDEr?0HgcOTxYX$}ymmTu{mvLK!myrJi!Y?qbm zr>CR1h**c;Xzt`cq^QCh3t_y>G^wu=jdm^Cn;O zC6kIS>!882dDxtmDh9@*Db^k1^F=tLzxiLS^HF^0_6aTP1$}~>mM_?nT2d-%R-Ij5 zeEacr@O7WN_76|btTphn;ckIwA2=zD|E*&%!}^CuU^i<>Yiw6f$=rNjPcp|(D@rh3 zms9ViLp^8quo#Ylo%FmNx2yq?RLme}x%H!r~Lk~eoV z+=c}iy$cDk4Ys4m1lA^TzV@Owk@VsFQ-F(W-~3*gH#e8cO7hk`XlvaHfrs@XVWWrF zY2fv>ZQpjK;Mo02R_U=X*qljq$!k_>0Wj%?1#bjvt$!iiPjOy?-JjIvm0yCyV3fy8 ztp=q`|Jr*Tq9Z%~%=~6piz%nLVeV5#mbwkF8X6fmWXQwDHxhHZZyM|{bR(ULR(Vs{ zc!;H)n(&8i2F}(7zKO#m_}-yyQ0PW3YcR`~_6<_7N+_eo)cOl0988mq=NW00c#$98 z6ggzh4$pL?wIttoTG-O2pe294>yb-v4o9b}&uHqNK5V9m4*Shs|A*f3wqaXH&DX&T zqxan0t4-IDDry$ktEizwc-apmq~I#C2`+ovD~}k@POYan4x=KvVragpVdM5*k4C|z z+-Os=Dfxg$QXgKJ0#G$(OvOO}Vl-FS-Legs$Ugm##ak8XW{qZ|)rv0k3elei7%@t2iM3QfaBgo`c9m>-!y;M6Lo>84GCi9$ z2VY8HDA_JLs*W(cfl(%(DB6_uQ@T(O19ym9|} zIXYLXD^aqS6e_|d^Yz|qo(7}8Chq&V`eH|M(uk6Mzr+`R5hbRgwOj~wAM4Tergy!C zvCl+pNS8x4B>9WlknGxAv06y3#AaD!a9RAxa!^4jz2>W6PQqRts@B2`)xtVlskdTfz?jviB9l84kp`5QueA`Qilv&NvW` zvsceqF(GG_0o&`12Hw$Jy(~MRh%-{P<&bfI!^@R$?`|m*_J^DxN3G2=NNVhj(45WX z7;V61?w<3O?Sb;s2vuD>7TyR<6p#HSOgYEErDJ4{m_Y?Kaxuhm+=dTCn{~{ngK&I^ zNEYFV!HV2;+|WTub}6}T$_7($oUV@Ymn1T8S8Z3)q}zoclJADC4y0k2qLK??ZS?aA|H-vnHrq$t$TCEhYzR zt!*SZk7qyHY&(hxDG{4dDi3?7wxV}zCwf;lq6n*c9NW;n>_TZap{PA*=eD3kP9C=b zZD;@4we9Df+I^DNEN<@^xAi30d16vX+`h9j+fHOj#ug)D&q?5-Lo0xJSVQd4)CN1f zhw%k7xqR4DM1JCke%4k0gaj)no#)blU3j~xq~tIWt%YW2Y5&US3)Yy)SRqBx8{H|( zS%GM|KECSd?jQ-az{1!}-3q2C9};R)1=@7McQ6$Zlids+$5Irmls3a#f8(lvxpd6+ z&rCE>VYEwf>N(5qjXsE(+=IDu8z(jnKp3N>KwnNKVOX1!nhRcS78G>BtXY54a1HfJ4@NsE7~gaJ8y2z$$+B_uw%3sbjY~P>D{0z6(Q9Z( zsgm8}$aVLU>SAI;nnah%Nq;G6ZWl~5g=NMW=BN~xl+G2G;L==Iap^5pc1sZxqH`Gg}QZ86ol6fhnt`zHWXQc;2diOo8 zioFj=#pWpU9@Y(;@wcqN0=jsIhABVp;nf|jmf&aH(EaoTr|LmXgwmRt=n$rBHt&vsjeKe7G_1;I5 zDZSbIXrh+--=g93y^sE9?*sBJZMbM9xp@9U?oEtCYHz{|Mo;kZM*L%Maw~IDu#?{c zrAfR0S1-<|9A5F02uYxHs0a<>bWF;W#y6p z>f+wscmMI-S)=%j=8F9Fn?L{k&|+Tk<$NL+5a2rD;>03x{i$ur&+RkRyt!zn`k5&$ z=Io@giAbvxle~Y_wc2~blAaUIf9&Jy=ksW9?+ix`C)j`?C|Z^vqj*4d2;AueC(=Q8 zN^*F9_57%-JZSKL{pERvF-%032JR|z7Te8Dj4DwJ@Kjg)#!&MsdX zptEE00*j?{$;h>Nj8+BtGouPBbah>tSTCF~h-NJ<%N3!m5=*Lh4u6?t=%({su-)BG zKVS=vkY99NwbEj~*(!=w1(=X41}JVQ@_%REL5@&}ymbW=1.21.0-0' +maintainers: +- email: eck@elastic.co + name: Elastic +name: eck-operator +type: application +version: 3.3.2 diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/LICENSE b/packs/elastic-operator-3.3.2/charts/eck-operator/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/README.md b/packs/elastic-operator-3.3.2/charts/eck-operator/README.md new file mode 100644 index 00000000..86452e3d --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/README.md @@ -0,0 +1,20 @@ +# ECK Operator Helm Chart + +[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/elastic)](https://artifacthub.io/packages/helm/elastic/eck-operator) + +A Helm chart to install the ECK Operator: the official Kubernetes operator from Elastic to orchestrate Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats on Kubernetes. + +For more information about the ECK Operator, see: +- [Documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html) +- [GitHub repo](https://github.com/elastic/cloud-on-k8s) + + +## Requirements + +- Supported Kubernetes versions are listed in the documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html +- Helm >= 3.2.0 + + +## Usage + +Refer to the documentation at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/.helmignore b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/Chart.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/Chart.yaml new file mode 100644 index 00000000..269835c7 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +appVersion: 3.3.2 +description: ECK operator Custom Resource Definitions +home: https://github.com/elastic/cloud-on-k8s +icon: https://helm.elastic.co/icons/eck.png +keywords: +- AutoOps +- Package Registry +- Logstash +- Elasticsearch +- Kibana +- APM Server +- Beats +- Enterprise Search +- Elastic Stack +- Operator +kubeVersion: '>=1.21.0-0' +maintainers: +- email: eck@elastic.co + name: Elastic +name: eck-operator-crds +type: application +version: 3.3.2 diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/README.md b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/README.md new file mode 100644 index 00000000..698d6dd4 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/README.md @@ -0,0 +1,16 @@ +# ECK Operator CRDs Helm Chart + +[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/elastic)](https://artifacthub.io/packages/helm/elastic/eck-operator-crds) + +A Helm chart to install the Kubernetes Custom Resource Definitions (CRD) required by the ECK Operator: the official Kubernetes operator from Elastic to orchestrate Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats on Kubernetes. This chart is usually automatically installed by the [ECK Operator Helm Chart](https://artifacthub.io/packages/helm/elastic/eck-operator) when installed using the default settings. Refer to the [installation documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html) for more information. + + +## Requirements + +- Supported Kubernetes versions are listed in the documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html +- Helm >= 3.2.0 + + +## Usage + +Refer to the documentation at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/NOTES.txt b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/NOTES.txt new file mode 100644 index 00000000..1478c82b --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/NOTES.txt @@ -0,0 +1 @@ +ECK Custom Resource Definitions installed. diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/_helpers.tpl b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/_helpers.tpl new file mode 100644 index 00000000..548f1bc6 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "eck-operator-crds.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "eck-operator-crds.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "eck-operator-crds.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "eck-operator-crds.labels" -}} +helm.sh/chart: {{ include "eck-operator-crds.chart" . }} +{{ include "eck-operator-crds.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "eck-operator-crds.selectorLabels" -}} +app.kubernetes.io/name: {{ include "eck-operator-crds.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Determine effective Kubernetes version +*/}} +{{- define "eck-operator-crds.effectiveKubeVersion" -}} +{{- if .Values.global.manifestGen -}} +{{- semver .Values.global.kubeVersion -}} +{{- else -}} +{{- .Capabilities.KubeVersion.Version -}} +{{- end -}} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml new file mode 100644 index 00000000..f04176eb --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml @@ -0,0 +1,11940 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: agents.agent.k8s.elastic.co +spec: + group: agent.k8s.elastic.co + names: + categories: + - elastic + kind: Agent + listKind: AgentList + plural: agents + shortNames: + - agent + singular: agent + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: available + type: integer + - description: Expected nodes + jsonPath: .status.expectedNodes + name: expected + type: integer + - description: Agent version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: Agent is the Schema for the Agents API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AgentSpec defines the desired state of the Agent + properties: + config: + description: Config holds the Agent configuration. At most one of + [`Config`, `ConfigRef`] can be specified. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Agent configuration. + Agent settings must be specified as yaml, under a single "agent.yml" entry. At most one of [`Config`, `ConfigRef`] + can be specified. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + daemonSet: + description: |- + DaemonSet specifies the Agent should be deployed as a DaemonSet, and allows providing its spec. + Cannot be used along with `deployment` or `statefulSet`. + properties: + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + updateStrategy: + description: DaemonSetUpdateStrategy is a struct used to control + the update strategy for a DaemonSet. + properties: + rollingUpdate: + description: Rolling update config params. Present only if + type = "RollingUpdate". + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of nodes with an existing available DaemonSet pod that + can have an updated DaemonSet pod during during an update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up to a minimum of 1. + Default value is 0. + Example: when this is set to 30%, at most 30% of the total number of nodes + that should be running the daemon pod (i.e. status.desiredNumberScheduled) + can have their a new pod created before the old pod is marked as deleted. + The update starts by launching new pods on 30% of nodes. Once an updated + pod is available (Ready for at least minReadySeconds) the old DaemonSet pod + on that node is marked deleted. If the old pod becomes unavailable for any + reason (Ready transitions to false, is evicted, or is drained) an updated + pod is immediately created on that node without considering surge limits. + Allowing surge implies the possibility that the resources consumed by the + daemonset on any given node can double if the readiness check fails, and + so resource intensive daemonsets should take into account that they may + cause evictions during disruption. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of DaemonSet pods that can be unavailable during the + update. Value can be an absolute number (ex: 5) or a percentage of total + number of DaemonSet pods at the start of the update (ex: 10%). Absolute + number is calculated from percentage by rounding up. + This cannot be 0 if MaxSurge is 0 + Default value is 1. + Example: when this is set to 30%, at most 30% of the total number of nodes + that should be running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. The update + starts by stopping at most 30% of those DaemonSet pods and then brings + up new DaemonSet pods in their place. Once the new pods are available, + it then proceeds onto other DaemonSet pods, thus ensuring that at least + 70% of original number of DaemonSet pods are available at all times during + the update. + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + type: object + deployment: + description: |- + Deployment specifies the Agent should be deployed as a Deployment, and allows providing its spec. + Cannot be used along with `daemonSet` or `statefulSet`. + properties: + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + replicas: + format: int32 + type: integer + strategy: + description: DeploymentStrategy describes how to replace existing + pods with new ones. + properties: + rollingUpdate: + description: |- + Rolling update config params. Present only if DeploymentStrategyType = + RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. + x-kubernetes-int-or-string: true + type: object + type: + description: Type of deployment. Can be "Recreate" or "RollingUpdate". + Default is RollingUpdate. + type: string + type: object + type: object + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single ES cluster is currently supported. + items: + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + outputName: + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + fleetServerEnabled: + description: FleetServerEnabled determines whether this Agent will + launch Fleet Server. Don't set unless `mode` is set to `fleet`. + type: boolean + fleetServerRef: + description: |- + FleetServerRef is a reference to Fleet Server that this Agent should connect to to obtain it's configuration. + Don't set unless `mode` is set to `fleet`. + References to Fleet servers running outside the Kubernetes cluster via the `secretName` attribute are not supported. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for the Agent + in Fleet mode with Fleet Server enabled. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Agent Docker image to deploy. Version has + to match the Agent in the image. + type: string + kibanaRef: + description: |- + KibanaRef is a reference to Kibana where Fleet should be set up and this Agent should be enrolled. Don't set + unless `mode` is set to `fleet`. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + mode: + description: |- + Mode specifies the runtime mode for the Agent. The configuration can be specified locally through + `config` or `configRef` (`standalone` mode), or come from Fleet during runtime (`fleet` mode). Starting with + version 8.13.0 Fleet-managed agents support advanced configuration via a local configuration file. + See https://www.elastic.co/docs/reference/fleet/advanced-kubernetes-managed-by-fleet + Defaults to `standalone` mode. + enum: + - standalone + - fleet + type: string + policyID: + description: |- + PolicyID determines into which Agent Policy this Agent will be enrolled. + This field will become mandatory in a future release, default policies are deprecated since 8.1.0. + type: string + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying DaemonSet or Deployment or StatefulSet. + format: int32 + type: integer + secureSettings: + description: |- + SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for the Agent. + Secrets data can be then referenced in the Agent config using the Secret's keys or as specified in `Entries` field of + each SecureSetting. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to an Elasticsearch resource in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + statefulSet: + description: |- + StatefulSet specifies the Agent should be deployed as a StatefulSet, and allows providing its spec. + Cannot be used along with `daemonSet` or `deployment`. + properties: + podManagementPolicy: + default: Parallel + description: |- + PodManagementPolicy controls how pods are created during initial scale up, + when replacing pods on nodes, or when scaling down. The default policy is + `Parallel`, where pods are created in parallel to match the desired scale + without waiting, and on scale down will delete all pods at once. + The alternative policy is `OrderedReady`, the default for vanilla kubernetes + StatefulSets, where pods are created in increasing order in increasing order + (pod-0, then pod-1, etc.) and the controller will wait until each pod is ready before + continuing. When scaling down, the pods are removed in the opposite order. + enum: + - OrderedReady + - Parallel + type: string + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + replicas: + format: int32 + type: integer + serviceName: + type: string + volumeClaimTemplates: + description: |- + VolumeClaimTemplates is a list of persistent volume claims to be used by each Pod. + Every claim in this list must have a matching volumeMount in one of the containers defined in the PodTemplate. + Items defined here take precedence over any default claims added by the operator with the same name. + items: + description: PersistentVolumeClaim is a user's request for and + claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + Users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string or nil value indicates that no + VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, + this field can be reset to its previous value (including nil) to cancel the modification. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + type: object + type: array + type: object + version: + description: Version of the Agent. + type: string + required: + - version + type: object + status: + description: AgentStatus defines the observed state of the Agent + properties: + availableNodes: + format: int32 + type: integer + elasticsearchAssociationsStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: |- + AssociationStatusMap is the map of association's namespaced name string to its AssociationStatus. For resources that + have a single Association of a given type (for ex. single ES reference), this map contains a single entry. + type: object + expectedNodes: + format: int32 + type: integer + fleetServerAssociationStatus: + description: AssociationStatus is the status of an association resource. + type: string + health: + type: string + kibanaAssociationStatus: + description: AssociationStatus is the status of an association resource. + type: string + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Elastic Agent. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Elastic + Agent controller has not yet processed the changes contained in the Elastic Agent specification. + format: int64 + type: integer + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: apmservers.apm.k8s.elastic.co +spec: + group: apm.k8s.elastic.co + names: + categories: + - elastic + kind: ApmServer + listKind: ApmServerList + plural: apmservers + shortNames: + - apm + singular: apmserver + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: APM version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1 + schema: + openAPIV3Schema: + description: ApmServer represents an APM Server resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ApmServerSpec holds the specification of an APM Server. + properties: + config: + description: 'Config holds the APM Server configuration. See: https://www.elastic.co/guide/en/apm/server/current/configuring-howto-apm-server.html' + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: Count of APM Server instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to the output Elasticsearch + cluster running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for the APM Server + resource. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the APM Server Docker image to deploy. + type: string + kibanaRef: + description: |- + KibanaRef is a reference to a Kibana instance running in the same Kubernetes cluster. + It allows APM agent central configuration management in Kibana. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the APM Server + pods. + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for APM Server. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of the APM Server. + type: string + required: + - version + type: object + status: + description: ApmServerStatus defines the observed state of ApmServer + properties: + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + elasticsearchAssociationStatus: + description: ElasticsearchAssociationStatus is the status of any auto-linking + to Elasticsearch clusters. + type: string + health: + description: Health of the deployment. + type: string + kibanaAssociationStatus: + description: KibanaAssociationStatus is the status of any auto-linking + to Kibana. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the status is based upon. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the APM Server + controller has not yet processed the changes contained in the APM Server specification. + format: int64 + type: integer + secretTokenSecret: + description: SecretTokenSecretName is the name of the Secret that + contains the secret token + type: string + selector: + description: Selector is the label selector used to find all pods. + type: string + service: + description: ExternalService is the name of the service the agents + should connect to. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: APM version + jsonPath: .spec.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: ApmServer represents an APM Server resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ApmServerSpec holds the specification of an APM Server. + properties: + config: + description: 'Config holds the APM Server configuration. See: https://www.elastic.co/guide/en/apm/server/current/configuring-howto-apm-server.html' + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: Count of APM Server instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to the output Elasticsearch + cluster running in the same Kubernetes cluster. + properties: + name: + description: Name of the Kubernetes object. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + required: + - name + type: object + http: + description: HTTP holds the HTTP layer configuration for the APM Server + resource. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certifcate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the APM Server Docker image to deploy. + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the APM Server + pods. + type: object + x-kubernetes-preserve-unknown-fields: true + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for APM Server. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + version: + description: Version of the APM Server. + type: string + type: object + status: + description: ApmServerStatus defines the observed state of ApmServer + properties: + associationStatus: + description: Association is the status of any auto-linking to Elasticsearch + clusters. + type: string + availableNodes: + format: int32 + type: integer + health: + description: ApmServerHealth expresses the status of the Apm Server + instances. + type: string + secretTokenSecret: + description: SecretTokenSecretName is the name of the Secret that + contains the secret token + type: string + service: + description: ExternalService is the name of the service the agents + should connect to. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: to not break compatibility when upgrading from previous versions + of the CRD + type: object + served: false + storage: false +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: autoopsagentpolicies.autoops.k8s.elastic.co +spec: + group: autoops.k8s.elastic.co + names: + categories: + - elastic + kind: AutoOpsAgentPolicy + listKind: AutoOpsAgentPolicyList + plural: autoopsagentpolicies + shortNames: + - aop + singular: autoopsagentpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Ready resources + jsonPath: .status.ready + name: Ready + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: AutoOpsAgentPolicy represents an Elastic AutoOps Policy resource + in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + autoOpsRef: + description: AutoOpsRef defines a reference to a secret containing + connection details for AutoOps via Cloud Connect. + properties: + secretName: + description: |- + SecretName references a Secret containing connection details for external AutoOps. + Required when connecting via Cloud Connect. The secret must contain: + - `cloud-connected-mode-api-key`: Cloud Connected Mode API key + - `autoops-otel-url`: AutoOps OpenTelemetry endpoint URL + - `autoops-token`: AutoOps authentication token + - `cloud-connected-mode-api-url`: (optional) Cloud Connected Mode API URL + This field cannot be used in combination with `name`. + type: string + type: object + image: + description: Image is the AutoOps Agent Docker image to deploy. + type: string + namespaceSelector: + description: |- + NamespaceSelector is a namespace selector for the resources to be configured. + Any Elasticsearch instances that belong to the selected namespaces will be configured to send data to AutoOps. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Agent pods + type: object + x-kubernetes-preserve-unknown-fields: true + resourceSelector: + description: |- + ResourceSelector is a label selector for the resources to be configured. + Any Elasticsearch instances that match the selector will be configured to send data to AutoOps. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + serviceAccountName: + description: |- + ServiceAccountName is used to check access to Elasticsearch resources in different namespaces. + Can only be used if ECK is enforcing RBAC on references (--enforce-rbac-on-refs flag). + The service account must have "get" permission on elasticsearch.k8s.elastic.co/elasticsearches + in the target namespaces. + type: string + version: + description: Version of the AutoOpsAgentPolicy. + type: string + required: + - version + type: object + status: + properties: + errors: + description: Errors is the number of resources that are in an error + state. + type: integer + observedGeneration: + description: ObservedGeneration is the most recent generation observed + for this AutoOpsAgentPolicy. + format: int64 + type: integer + phase: + description: Phase is the phase of the AutoOpsAgentPolicy. + type: string + ready: + description: Ready is the number of resources that are in a ready + state. + type: integer + resources: + description: Resources is the number of resources that match the ResourceSelector. + type: integer + required: + - errors + - ready + - resources + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: beats.beat.k8s.elastic.co +spec: + group: beat.k8s.elastic.co + names: + categories: + - elastic + kind: Beat + listKind: BeatList + plural: beats + shortNames: + - beat + singular: beat + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: available + type: integer + - description: Expected nodes + jsonPath: .status.expectedNodes + name: expected + type: integer + - description: Beat type + jsonPath: .spec.type + name: type + type: string + - description: Beat version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Beat is the Schema for the Beats API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BeatSpec defines the desired state of a Beat. + properties: + config: + description: Config holds the Beat configuration. At most one of [`Config`, + `ConfigRef`] can be specified. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Beat configuration. + Beat settings must be specified as yaml, under a single "beat.yml" entry. At most one of [`Config`, `ConfigRef`] + can be specified. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + daemonSet: + description: |- + DaemonSet specifies the Beat should be deployed as a DaemonSet, and allows providing its spec. + Cannot be used along with `deployment`. If both are absent a default for the Type is used. + properties: + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + updateStrategy: + description: DaemonSetUpdateStrategy is a struct used to control + the update strategy for a DaemonSet. + properties: + rollingUpdate: + description: Rolling update config params. Present only if + type = "RollingUpdate". + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of nodes with an existing available DaemonSet pod that + can have an updated DaemonSet pod during during an update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up to a minimum of 1. + Default value is 0. + Example: when this is set to 30%, at most 30% of the total number of nodes + that should be running the daemon pod (i.e. status.desiredNumberScheduled) + can have their a new pod created before the old pod is marked as deleted. + The update starts by launching new pods on 30% of nodes. Once an updated + pod is available (Ready for at least minReadySeconds) the old DaemonSet pod + on that node is marked deleted. If the old pod becomes unavailable for any + reason (Ready transitions to false, is evicted, or is drained) an updated + pod is immediately created on that node without considering surge limits. + Allowing surge implies the possibility that the resources consumed by the + daemonset on any given node can double if the readiness check fails, and + so resource intensive daemonsets should take into account that they may + cause evictions during disruption. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of DaemonSet pods that can be unavailable during the + update. Value can be an absolute number (ex: 5) or a percentage of total + number of DaemonSet pods at the start of the update (ex: 10%). Absolute + number is calculated from percentage by rounding up. + This cannot be 0 if MaxSurge is 0 + Default value is 1. + Example: when this is set to 30%, at most 30% of the total number of nodes + that should be running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. The update + starts by stopping at most 30% of those DaemonSet pods and then brings + up new DaemonSet pods in their place. Once the new pods are available, + it then proceeds onto other DaemonSet pods, thus ensuring that at least + 70% of original number of DaemonSet pods are available at all times during + the update. + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + type: object + deployment: + description: |- + Deployment specifies the Beat should be deployed as a Deployment, and allows providing its spec. + Cannot be used along with `daemonSet`. If both are absent a default for the Type is used. + properties: + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + replicas: + format: int32 + type: integer + strategy: + description: DeploymentStrategy describes how to replace existing + pods with new ones. + properties: + rollingUpdate: + description: |- + Rolling update config params. Present only if DeploymentStrategyType = + RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. + x-kubernetes-int-or-string: true + type: object + type: + description: Type of deployment. Can be "Recreate" or "RollingUpdate". + Default is RollingUpdate. + type: string + type: object + type: object + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + image: + description: Image is the Beat Docker image to deploy. Version and + Type have to match the Beat in the image. + type: string + kibanaRef: + description: |- + KibanaRef is a reference to a Kibana instance running in the same Kubernetes cluster. + It allows automatic setup of dashboards and visualizations. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + monitoring: + description: |- + Monitoring enables you to collect and ship logs and metrics for this Beat. + Metricbeat and/or Filebeat sidecars are configured and send monitoring data to an + Elasticsearch monitoring cluster running in the same Kubernetes cluster. + properties: + logs: + description: Logs holds references to Elasticsearch clusters which + receive log data from an associated resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + metrics: + description: Metrics holds references to Elasticsearch clusters + which receive monitoring data from this resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + type: object + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying DaemonSet or Deployment. + format: int32 + type: integer + secureSettings: + description: |- + SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for the Beat. + Secrets data can be then referenced in the Beat config using the Secret's keys or as specified in `Entries` field of + each SecureSetting. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to Elasticsearch resource in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + type: + description: |- + Type is the type of the Beat to deploy (filebeat, metricbeat, heartbeat, auditbeat, journalbeat, packetbeat, and so on). + Any string can be used, but well-known types will have the image field defaulted and have the appropriate + Elasticsearch roles created automatically. It also allows for dashboard setup when combined with a `KibanaRef`. + maxLength: 20 + pattern: '[a-zA-Z0-9-]+' + type: string + version: + description: Version of the Beat. + type: string + required: + - type + - version + type: object + status: + description: BeatStatus defines the observed state of a Beat. + properties: + availableNodes: + format: int32 + type: integer + elasticsearchAssociationStatus: + description: AssociationStatus is the status of an association resource. + type: string + expectedNodes: + format: int32 + type: integer + health: + type: string + kibanaAssociationStatus: + description: AssociationStatus is the status of an association resource. + type: string + monitoringAssociationStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: |- + AssociationStatusMap is the map of association's namespaced name string to its AssociationStatus. For resources that + have a single Association of a given type (for ex. single ES reference), this map contains a single entry. + type: object + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the status is based upon. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Beats + controller has not yet processed the changes contained in the Beats specification. + format: int64 + type: integer + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: elasticmapsservers.maps.k8s.elastic.co +spec: + group: maps.k8s.elastic.co + names: + categories: + - elastic + kind: ElasticMapsServer + listKind: ElasticMapsServerList + plural: elasticmapsservers + shortNames: + - ems + singular: elasticmapsserver + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: ElasticMapsServer version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: ElasticMapsServer represents an Elastic Map Server resource in + a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MapsSpec holds the specification of an Elastic Maps Server + instance. + properties: + config: + description: 'Config holds the ElasticMapsServer configuration. See: + https://www.elastic.co/guide/en/kibana/current/maps-connect-to-ems.html#elastic-maps-server-configuration' + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Elastic Maps Server configuration. + Configuration settings are merged and have precedence over settings specified in `config`. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + description: Count of Elastic Maps Server instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for Elastic Maps + Server. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Elastic Maps Server Docker image to deploy. + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Elastic Maps + Server pods + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of Elastic Maps Server. + type: string + required: + - version + type: object + status: + description: MapsStatus defines the observed state of Elastic Maps Server + properties: + associationStatus: + description: AssociationStatus is the status of an association resource. + type: string + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + health: + description: Health of the deployment. + type: string + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Elastic Maps Server. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Elastic + Maps controller has not yet processed the changes contained in the Elastic Maps specification. + format: int64 + type: integer + selector: + description: Selector is the label selector used to find all pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: elasticsearchautoscalers.autoscaling.k8s.elastic.co +spec: + group: autoscaling.k8s.elastic.co + names: + categories: + - elastic + kind: ElasticsearchAutoscaler + listKind: ElasticsearchAutoscalerList + plural: elasticsearchautoscalers + shortNames: + - esa + singular: elasticsearchautoscaler + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.elasticsearchRef.name + name: Target + type: string + - jsonPath: .status.conditions[?(@.type=='Active')].status + name: Active + type: string + - jsonPath: .status.conditions[?(@.type=='Healthy')].status + name: Healthy + type: string + - jsonPath: .status.conditions[?(@.type=='Limited')].status + name: Limited + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ElasticsearchAutoscaler represents an ElasticsearchAutoscaler + resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ElasticsearchAutoscalerSpec holds the specification of an + Elasticsearch autoscaler resource. + properties: + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + that exists in the same namespace. + properties: + name: + description: Name is the name of the Elasticsearch resource to + scale automatically. + minLength: 1 + type: string + type: object + policies: + items: + description: AutoscalingPolicySpec holds a named autoscaling policy + and the associated resources limits (cpu, memory, storage). + properties: + deciders: + additionalProperties: + additionalProperties: + type: string + description: |- + DeciderSettings allow the user to tweak autoscaling deciders. + The map data structure complies with the format expected by Elasticsearch. + type: object + description: Deciders allow the user to override default settings + for autoscaling deciders. + type: object + name: + description: Name identifies the autoscaling policy in the autoscaling + specification. + type: string + resources: + description: |- + AutoscalingResources model the limits, submitted by the user, for the supported resources in an autoscaling policy. + Only the node count range is mandatory. For other resources, a limit range is required only + if the Elasticsearch autoscaling capacity API returns a requirement for a given resource. + For example, the memory limit range is only required if the autoscaling API response contains a memory requirement. + If there is no limit range for a resource, and if that resource is not mandatory, then the resources in the NodeSets + managed by the autoscaling policy are left untouched. + properties: + cpu: + description: QuantityRange models a resource limit range + for resources which can be expressed with resource.Quantity. + properties: + max: + anyOf: + - type: integer + - type: string + description: Max represents the upper limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + min: + anyOf: + - type: integer + - type: string + description: Min represents the lower limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + requestsToLimitsRatio: + anyOf: + - type: integer + - type: string + description: RequestsToLimitsRatio allows to customize + Kubernetes resource Limit based on the Request. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + required: + - max + - min + type: object + memory: + description: QuantityRange models a resource limit range + for resources which can be expressed with resource.Quantity. + properties: + max: + anyOf: + - type: integer + - type: string + description: Max represents the upper limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + min: + anyOf: + - type: integer + - type: string + description: Min represents the lower limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + requestsToLimitsRatio: + anyOf: + - type: integer + - type: string + description: RequestsToLimitsRatio allows to customize + Kubernetes resource Limit based on the Request. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + required: + - max + - min + type: object + nodeCount: + description: NodeCountRange is used to model the minimum + and the maximum number of nodes over all the NodeSets + managed by the same autoscaling policy. + properties: + max: + description: Max represents the maximum number of nodes + in a tier. + format: int32 + type: integer + min: + description: Min represents the minimum number of nodes + in a tier. + format: int32 + type: integer + required: + - max + - min + type: object + storage: + description: QuantityRange models a resource limit range + for resources which can be expressed with resource.Quantity. + properties: + max: + anyOf: + - type: integer + - type: string + description: Max represents the upper limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + min: + anyOf: + - type: integer + - type: string + description: Min represents the lower limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + requestsToLimitsRatio: + anyOf: + - type: integer + - type: string + description: RequestsToLimitsRatio allows to customize + Kubernetes resource Limit based on the Request. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + required: + - max + - min + type: object + required: + - nodeCount + type: object + roles: + description: An autoscaling policy must target a unique set + of roles. + items: + type: string + type: array + required: + - resources + type: object + type: array + pollingPeriod: + description: PollingPeriod is the period at which to synchronize with + the Elasticsearch autoscaling API. + type: string + required: + - elasticsearchRef + - policies + type: object + status: + properties: + conditions: + description: Conditions holds the current service state of the autoscaling + controller. + items: + description: |- + Condition represents Elasticsearch resource's condition. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + status: + type: string + type: + description: ConditionType defines the condition of an Elasticsearch + resource. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last observed generation by + the controller. + format: int64 + type: integer + policies: + description: AutoscalingPolicyStatuses is used to expose state messages + to user or external system. + items: + properties: + lastModificationTime: + description: LastModificationTime is the last time the resources + have been updated, used by the cooldown algorithm. + format: date-time + type: string + name: + description: Name is the name of the autoscaling policy + type: string + nodeSets: + description: NodeSetNodeCount holds the number of nodes for + each nodeSet. + items: + description: NodeSetNodeCount models the number of nodes expected + in a given NodeSet. + properties: + name: + description: Name of the Nodeset. + type: string + nodeCount: + description: NodeCount is the number of nodes, as computed + by the autoscaler, expected in this NodeSet. + format: int32 + type: integer + required: + - name + - nodeCount + type: object + type: array + resources: + description: |- + ResourcesSpecification holds the resource values common to all the nodeSets managed by a same autoscaling policy. + Only the resources managed by the autoscaling controller are saved in the Status. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: ResourceList is a set of (resource name, quantity) + pairs. + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: ResourceList is a set of (resource name, quantity) + pairs. + type: object + type: object + state: + description: PolicyStates may contain various messages regarding + the current state of this autoscaling policy. + items: + properties: + messages: + items: + type: string + type: array + type: + type: string + required: + - messages + - type + type: object + type: array + required: + - name + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: elasticsearches.elasticsearch.k8s.elastic.co +spec: + group: elasticsearch.k8s.elastic.co + names: + categories: + - elastic + kind: Elasticsearch + listKind: ElasticsearchList + plural: elasticsearches + shortNames: + - es + singular: elasticsearch + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Elasticsearch version + jsonPath: .status.version + name: version + type: string + - jsonPath: .status.phase + name: phase + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Elasticsearch represents an Elasticsearch resource in a Kubernetes + cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ElasticsearchSpec holds the specification of an Elasticsearch + cluster. + properties: + auth: + description: Auth contains user authentication and authorization security + settings for Elasticsearch. + properties: + disableElasticUser: + description: DisableElasticUser disables the default elastic user + that is created by ECK. + type: boolean + fileRealm: + description: FileRealm to propagate to the Elasticsearch cluster. + items: + description: FileRealmSource references users to create in the + Elasticsearch cluster. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + type: array + roles: + description: Roles to propagate to the Elasticsearch cluster. + items: + description: RoleSource references roles to create in the Elasticsearch + cluster. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + type: array + type: object + http: + description: HTTP holds HTTP layer settings for Elasticsearch. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Elasticsearch Docker image to deploy. + type: string + monitoring: + description: |- + Monitoring enables you to collect and ship log and monitoring data of this Elasticsearch cluster. + See https://www.elastic.co/guide/en/elasticsearch/reference/current/monitor-elasticsearch-cluster.html. + Metricbeat and Filebeat are deployed in the same Pod as sidecars and each one sends data to one or two different + Elasticsearch monitoring clusters running in the same Kubernetes cluster. + properties: + logs: + description: Logs holds references to Elasticsearch clusters which + receive log data from an associated resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + metrics: + description: Metrics holds references to Elasticsearch clusters + which receive monitoring data from this resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + type: object + nodeSets: + description: NodeSets allow specifying groups of Elasticsearch nodes + sharing the same configuration and Pod templates. + items: + description: NodeSet is the specification for a group of Elasticsearch + nodes sharing the same configuration and a Pod template. + properties: + config: + description: Config holds the Elasticsearch configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: |- + Count of Elasticsearch nodes to deploy. + If the node set is managed by an autoscaling policy the initial value is automatically set by the autoscaling controller. + format: int32 + type: integer + name: + description: Name of this set of nodes. Becomes a part of the + Elasticsearch node.name setting. + maxLength: 23 + pattern: '[a-zA-Z0-9-]+' + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, + annotations, affinity rules, resource requests, and so on) + for the Pods belonging to this NodeSet. + type: object + x-kubernetes-preserve-unknown-fields: true + volumeClaimTemplates: + description: |- + VolumeClaimTemplates is a list of persistent volume claims to be used by each Pod in this NodeSet. + Every claim in this list must have a matching volumeMount in one of the containers defined in the PodTemplate. + Items defined here take precedence over any default claims added by the operator with the same name. + items: + description: PersistentVolumeClaim is a user's request for + and claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + Users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string or nil value indicates that no + VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, + this field can be reset to its previous value (including nil) to cancel the modification. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + type: object + type: array + required: + - name + type: object + minItems: 1 + type: array + podDisruptionBudget: + description: |- + PodDisruptionBudget provides access to the default Pod disruption budget(s) for the Elasticsearch cluster. + The behavior depends on the license level. + With a Basic license or if podDisruptionBudget.spec is not empty: + The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`. + In all other cases the default podDisruptionBudget sets `minAvailable` equal to the total number of nodes minus 1. + With an Enterprise license and if podDisruptionBudget.spec is empty: + The default budget is split into multiple budgets, each targeting a specific node role type allowing additional disruptions + for certain roles according to the health status of the cluster. + Example: + All data roles (excluding frozen): allows disruptions only when the cluster is green. + All other roles: allows disruptions only when the cluster is yellow or green. + To disable, set `podDisruptionBudget` to the empty value (`{}` in YAML). + properties: + metadata: + description: |- + ObjectMeta is the metadata of the PDB. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the PDB. + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selector: + description: |- + Label query over pods whose evictions are managed by the disruption + budget. + A null selector will match no pods, while an empty ({}) selector will select + all pods within the namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + unhealthyPodEvictionPolicy: + description: |- + UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods + should be considered for eviction. Current implementation considers healthy pods, + as pods that have status.conditions item with type="Ready",status="True". + + Valid policies are IfHealthyBudget and AlwaysAllow. + If no policy is specified, the default behavior will be used, + which corresponds to the IfHealthyBudget policy. + + IfHealthyBudget policy means that running pods (status.phase="Running"), + but not yet healthy can be evicted only if the guarded application is not + disrupted (status.currentHealthy is at least equal to status.desiredHealthy). + Healthy pods will be subject to the PDB for eviction. + + AlwaysAllow policy means that all running pods (status.phase="Running"), + but not yet healthy are considered disrupted and can be evicted regardless + of whether the criteria in a PDB is met. This means perspective running + pods of a disrupted application might not get a chance to become healthy. + Healthy pods will be subject to the PDB for eviction. + + Additional policies may be added in the future. + Clients making eviction decisions should disallow eviction of unhealthy pods + if they encounter an unrecognized policy in this field. + type: string + type: object + type: object + remoteClusterServer: + description: |- + RemoteClusterServer specifies if the remote cluster server should be enabled. + This must be enabled if this cluster is a remote cluster which is expected to be accessed using API key authentication. + properties: + enabled: + type: boolean + service: + description: Service defines the template for the remote cluster + server Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + type: object + remoteClusters: + description: RemoteClusters enables you to establish uni-directional + connections to a remote Elasticsearch cluster. + items: + description: RemoteCluster declares a remote Elasticsearch cluster + connection. + properties: + apiKey: + description: 'APIKey can be used to enable remote cluster access + using Cross-Cluster API keys: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-cross-cluster-api-key.html' + properties: + access: + description: Access is the name of the API Key. It is automatically + generated if not set or empty. + properties: + replication: + properties: + names: + items: + type: string + type: array + required: + - names + type: object + search: + properties: + allow_restricted_indices: + type: boolean + field_security: + properties: + except: + items: + type: string + type: array + grant: + items: + type: string + type: array + required: + - except + - grant + type: object + names: + items: + type: string + type: array + query: + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - names + type: object + type: object + required: + - access + type: object + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch + cluster running within the same k8s cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, + defaults to the current namespace. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + name: + description: |- + Name is the name of the remote cluster as it is set in the Elasticsearch settings. + The name is expected to be unique for each remote clusters. + minLength: 1 + type: string + required: + - name + type: object + type: array + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying StatefulSets. + format: int32 + type: integer + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for Elasticsearch. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + transport: + description: Transport holds transport layer settings for Elasticsearch. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS on the transport + layer. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the CA certificate + and private key for generating node certificates. + The referenced secret should contain the following: + + - `ca.crt`: The CA certificate in PEM format. + - `ca.key`: The private key for the CA certificate in PEM format. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + certificateAuthorities: + description: |- + CertificateAuthorities is a reference to a config map that contains one or more x509 certificates for + trusted authorities in PEM format. The certificates need to be in a file called `ca.crt`. + properties: + configMapName: + type: string + type: object + otherNameSuffix: + description: |- + OtherNameSuffix when defined will be prefixed with the Pod name and used as the common name, + and the first DNSName, as well as an OtherName required by Elasticsearch in the Subject Alternative Name + extension of each Elasticsearch node's transport TLS certificate. + Example: if set to "node.cluster.local", the generated certificate will have its otherName set to ".node.cluster.local". + type: string + selfSignedCertificates: + description: SelfSignedCertificates allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that provisioning of the + self-signed certificates should be disabled. + type: boolean + type: object + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs to + include in the generated node transport TLS certificates. + items: + description: SubjectAlternativeName represents a SAN entry + in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + updateStrategy: + description: UpdateStrategy specifies how updates to the cluster should + be performed. + properties: + changeBudget: + description: ChangeBudget defines the constraints to consider + when applying changes to the Elasticsearch cluster. + properties: + maxSurge: + description: |- + MaxSurge is the maximum number of new Pods that can be created exceeding the original number of Pods defined in + the specification. MaxSurge is only taken into consideration when scaling up. Setting a negative value will + disable the restriction. Defaults to unbounded if not specified. + format: int32 + type: integer + maxUnavailable: + description: |- + MaxUnavailable is the maximum number of Pods that can be unavailable (not ready) during the update due to + circumstances under the control of the operator. Setting a negative value will disable this restriction. + Defaults to 1 if not specified. + format: int32 + type: integer + type: object + type: object + version: + description: Version of Elasticsearch. + type: string + volumeClaimDeletePolicy: + description: |- + VolumeClaimDeletePolicy sets the policy for handling deletion of PersistentVolumeClaims for all NodeSets. + Possible values are DeleteOnScaledownOnly and DeleteOnScaledownAndClusterDeletion. Defaults to DeleteOnScaledownAndClusterDeletion. + enum: + - DeleteOnScaledownOnly + - DeleteOnScaledownAndClusterDeletion + type: string + required: + - nodeSets + - version + type: object + status: + description: ElasticsearchStatus represents the observed state of Elasticsearch. + properties: + availableNodes: + description: AvailableNodes is the number of available instances. + format: int32 + type: integer + conditions: + description: |- + Conditions holds the current service state of an Elasticsearch cluster. + **This API is in technical preview and may be changed or removed in a future release.** + items: + description: |- + Condition represents Elasticsearch resource's condition. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + status: + type: string + type: + description: ConditionType defines the condition of an Elasticsearch + resource. + type: string + required: + - status + - type + type: object + type: array + health: + description: ElasticsearchHealth is the health of the cluster as returned + by the health API. + type: string + inProgressOperations: + description: |- + InProgressOperations represents changes being applied by the operator to the Elasticsearch cluster. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + downscale: + description: |- + DownscaleOperation provides details about in progress downscale operations. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastUpdatedTime: + format: date-time + type: string + nodes: + description: Nodes which are scheduled to be removed from + the cluster. + items: + description: |- + DownscaledNode provides an overview of in progress changes applied by the operator to remove Elasticsearch nodes from the cluster. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + explanation: + description: |- + Explanation provides details about an in progress node shutdown. It is only available for clusters managed with the + Elasticsearch shutdown API. + type: string + name: + description: Name of the Elasticsearch node that should + be removed. + type: string + shutdownStatus: + description: |- + Shutdown status as returned by the Elasticsearch shutdown API. + If the Elasticsearch shutdown API is not available, the shutdown status is then inferred from the remaining + shards on the nodes, as observed by the operator. + type: string + required: + - name + - shutdownStatus + type: object + type: array + stalled: + description: |- + Stalled represents a state where no progress can be made. + It is only available for clusters managed with the Elasticsearch shutdown API. + type: boolean + type: object + upgrade: + description: |- + UpgradeOperation provides an overview of the pending or in progress changes applied by the operator to update the Elasticsearch nodes in the cluster. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastUpdatedTime: + format: date-time + type: string + nodes: + description: Nodes that must be restarted for upgrade. + items: + description: |- + UpgradedNode provides details about the status of nodes which are expected to be updated. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + message: + description: Optional message to explain why a node + may not be immediately restarted for upgrade. + type: string + name: + description: Name of the Elasticsearch node that should + be upgraded. + type: string + predicate: + description: Predicate is the name of the predicate + currently preventing this node from being deleted + for an upgrade. + type: string + status: + description: |- + Status states if the node is either in the process of being deleted for an upgrade, + or blocked by a predicate or another condition stated in the message field. + type: string + required: + - name + - status + type: object + type: array + type: object + upscale: + description: |- + UpscaleOperation provides an overview of in progress changes applied by the operator to add Elasticsearch nodes to the cluster. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastUpdatedTime: + format: date-time + type: string + nodes: + description: Nodes expected to be added by the operator. + items: + properties: + message: + description: Optional message to explain why a node + may not be immediately added. + type: string + name: + description: Name of the Elasticsearch node that should + be added to the cluster. + type: string + status: + description: NewNodeStatus states if a new node is being + created, or if the upscale is delayed. + type: string + required: + - name + - status + type: object + type: array + type: object + required: + - downscale + - upgrade + - upscale + type: object + monitoringAssociationStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: |- + AssociationStatusMap is the map of association's namespaced name string to its AssociationStatus. For resources that + have a single Association of a given type (for ex. single ES reference), this map contains a single entry. + type: object + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Elasticsearch cluster. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Elasticsearch + controller has not yet processed the changes contained in the Elasticsearch specification. + format: int64 + type: integer + phase: + description: ElasticsearchOrchestrationPhase is the phase Elasticsearch + is in from the controller point of view. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Elasticsearch version + jsonPath: .spec.version + name: version + type: string + - jsonPath: .status.phase + name: phase + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Elasticsearch represents an Elasticsearch resource in a Kubernetes + cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ElasticsearchSpec holds the specification of an Elasticsearch + cluster. + properties: + http: + description: HTTP holds HTTP layer settings for Elasticsearch. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certifcate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Elasticsearch Docker image to deploy. + type: string + nodeSets: + description: NodeSets allow specifying groups of Elasticsearch nodes + sharing the same configuration and Pod templates. + items: + description: NodeSet is the specification for a group of Elasticsearch + nodes sharing the same configuration and a Pod template. + properties: + config: + description: Config holds the Elasticsearch configuration. + type: object + count: + description: Count of Elasticsearch nodes to deploy. + format: int32 + minimum: 1 + type: integer + name: + description: Name of this set of nodes. Becomes a part of the + Elasticsearch node.name setting. + maxLength: 23 + pattern: '[a-zA-Z0-9-]+' + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, + annotations, affinity rules, resource requests, and so on) + for the Pods belonging to this NodeSet. + type: object + volumeClaimTemplates: + description: |- + VolumeClaimTemplates is a list of persistent volume claims to be used by each Pod in this NodeSet. + Every claim in this list must have a matching volumeMount in one of the containers defined in the PodTemplate. + Items defined here take precedence over any default claims added by the operator with the same name. + items: + description: PersistentVolumeClaim is a user's request for + and claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + Users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string or nil value indicates that no + VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, + this field can be reset to its previous value (including nil) to cancel the modification. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + type: object + type: array + required: + - count + - name + type: object + minItems: 1 + type: array + podDisruptionBudget: + description: |- + PodDisruptionBudget provides access to the default pod disruption budget for the Elasticsearch cluster. + The default budget selects all cluster pods and sets `maxUnavailable` to 1. To disable, set `PodDisruptionBudget` + to the empty value (`{}` in YAML). + properties: + metadata: + description: |- + ObjectMeta is the metadata of the PDB. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the PDB. + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selector: + description: |- + Label query over pods whose evictions are managed by the disruption + budget. + A null selector selects no pods. + An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods. + In policy/v1, an empty selector will select all pods in the namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + unhealthyPodEvictionPolicy: + description: |- + UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods + should be considered for eviction. Current implementation considers healthy pods, + as pods that have status.conditions item with type="Ready",status="True". + + Valid policies are IfHealthyBudget and AlwaysAllow. + If no policy is specified, the default behavior will be used, + which corresponds to the IfHealthyBudget policy. + + IfHealthyBudget policy means that running pods (status.phase="Running"), + but not yet healthy can be evicted only if the guarded application is not + disrupted (status.currentHealthy is at least equal to status.desiredHealthy). + Healthy pods will be subject to the PDB for eviction. + + AlwaysAllow policy means that all running pods (status.phase="Running"), + but not yet healthy are considered disrupted and can be evicted regardless + of whether the criteria in a PDB is met. This means perspective running + pods of a disrupted application might not get a chance to become healthy. + Healthy pods will be subject to the PDB for eviction. + + Additional policies may be added in the future. + Clients making eviction decisions should disallow eviction of unhealthy pods + if they encounter an unrecognized policy in this field. + type: string + type: object + type: object + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for Elasticsearch. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + updateStrategy: + description: UpdateStrategy specifies how updates to the cluster should + be performed. + properties: + changeBudget: + description: ChangeBudget defines the constraints to consider + when applying changes to the Elasticsearch cluster. + properties: + maxSurge: + description: |- + MaxSurge is the maximum number of new pods that can be created exceeding the original number of pods defined in + the specification. MaxSurge is only taken into consideration when scaling up. Setting a negative value will + disable the restriction. Defaults to unbounded if not specified. + format: int32 + type: integer + maxUnavailable: + description: |- + MaxUnavailable is the maximum number of pods that can be unavailable (not ready) during the update due to + circumstances under the control of the operator. Setting a negative value will disable this restriction. + Defaults to 1 if not specified. + format: int32 + type: integer + type: object + type: object + version: + description: Version of Elasticsearch. + type: string + required: + - nodeSets + type: object + status: + description: ElasticsearchStatus defines the observed state of Elasticsearch + properties: + availableNodes: + format: int32 + type: integer + health: + description: ElasticsearchHealth is the health of the cluster as returned + by the health API. + type: string + phase: + description: ElasticsearchOrchestrationPhase is the phase Elasticsearch + is in from the controller point of view. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: to not break compatibility when upgrading from previous versions + of the CRD + type: object + served: false + storage: false +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: enterprisesearches.enterprisesearch.k8s.elastic.co +spec: + group: enterprisesearch.k8s.elastic.co + names: + categories: + - elastic + kind: EnterpriseSearch + listKind: EnterpriseSearchList + plural: enterprisesearches + shortNames: + - ent + singular: enterprisesearch + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Enterprise Search version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1 + schema: + openAPIV3Schema: + description: EnterpriseSearch is a Kubernetes CRD to represent Enterprise + Search. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EnterpriseSearchSpec holds the specification of an Enterprise + Search resource. + properties: + config: + description: Config holds the Enterprise Search configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Enterprise Search configuration. + Configuration settings are merged and have precedence over settings specified in `config`. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + description: Count of Enterprise Search instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to the Elasticsearch + cluster running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for Enterprise + Search resource. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Enterprise Search Docker image to deploy. + type: string + podTemplate: + description: |- + PodTemplate provides customisation options (labels, annotations, affinity rules, resource requests, and so on) + for the Enterprise Search pods. + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of Enterprise Search. + type: string + type: object + status: + description: EnterpriseSearchStatus defines the observed state of EnterpriseSearch + properties: + associationStatus: + description: Association is the status of any auto-linking to Elasticsearch + clusters. + type: string + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + health: + description: Health of the deployment. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the status is based upon. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Enterprise Search + controller has not yet processed the changes contained in the Enterprise Search specification. + format: int64 + type: integer + selector: + description: Selector is the label selector used to find all pods. + type: string + service: + description: ExternalService is the name of the service associated + to the Enterprise Search Pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Enterprise Search version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: EnterpriseSearch is a Kubernetes CRD to represent Enterprise + Search. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EnterpriseSearchSpec holds the specification of an Enterprise + Search resource. + properties: + config: + description: Config holds the Enterprise Search configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Enterprise Search configuration. + Configuration settings are merged and have precedence over settings specified in `config`. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + description: Count of Enterprise Search instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to the Elasticsearch + cluster running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for Enterprise + Search resource. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Enterprise Search Docker image to deploy. + type: string + podTemplate: + description: |- + PodTemplate provides customisation options (labels, annotations, affinity rules, resource requests, and so on) + for the Enterprise Search pods. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of Enterprise Search. + type: string + type: object + status: + description: EnterpriseSearchStatus defines the observed state of EnterpriseSearch + properties: + associationStatus: + description: Association is the status of any auto-linking to Elasticsearch + clusters. + type: string + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + health: + description: Health of the deployment. + type: string + selector: + description: Selector is the label selector used to find all pods. + type: string + service: + description: ExternalService is the name of the service associated + to the Enterprise Search Pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: kibanas.kibana.k8s.elastic.co +spec: + group: kibana.k8s.elastic.co + names: + categories: + - elastic + kind: Kibana + listKind: KibanaList + plural: kibanas + shortNames: + - kb + singular: kibana + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Kibana version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Kibana represents a Kibana resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: KibanaSpec holds the specification of a Kibana instance. + properties: + config: + description: 'Config holds the Kibana configuration. See: https://www.elastic.co/guide/en/kibana/current/settings.html' + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: Count of Kibana instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + enterpriseSearchRef: + description: |- + EnterpriseSearchRef is a reference to an EnterpriseSearch running in the same Kubernetes cluster. + Kibana provides the default Enterprise Search UI starting version 7.14. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for Kibana. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Kibana Docker image to deploy. + type: string + monitoring: + description: |- + Monitoring enables you to collect and ship log and monitoring data of this Kibana. + See https://www.elastic.co/guide/en/kibana/current/xpack-monitoring.html. + Metricbeat and Filebeat are deployed in the same Pod as sidecars and each one sends data to one or two different + Elasticsearch monitoring clusters running in the same Kubernetes cluster. + properties: + logs: + description: Logs holds references to Elasticsearch clusters which + receive log data from an associated resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + metrics: + description: Metrics holds references to Elasticsearch clusters + which receive monitoring data from this resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + type: object + packageRegistryRef: + description: PackageRegistryRef is a reference to an Elastic Package + Registry running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Kibana pods + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for Kibana. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of Kibana. + type: string + required: + - version + type: object + status: + description: KibanaStatus defines the observed state of Kibana + properties: + associationStatus: + description: |- + AssociationStatus is the status of any auto-linking to Elasticsearch clusters. + This field is deprecated and will be removed in a future release. Use ElasticsearchAssociationStatus instead. + type: string + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + elasticsearchAssociationStatus: + description: ElasticsearchAssociationStatus is the status of any auto-linking + to Elasticsearch clusters. + type: string + enterpriseSearchAssociationStatus: + description: EnterpriseSearchAssociationStatus is the status of any + auto-linking to Enterprise Search. + type: string + health: + description: Health of the deployment. + type: string + monitoringAssociationStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: MonitoringAssociationStatus is the status of any auto-linking + to monitoring Elasticsearch clusters. + type: object + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Kibana instance. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Kibana + controller has not yet processed the changes contained in the Kibana specification. + format: int64 + type: integer + packageRegistryAssociationStatus: + description: PackageRegistryAssociationStatus is the status of any + auto-linking to Elastic Package Registry. + type: string + selector: + description: Selector is the label selector used to find all pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Kibana version + jsonPath: .spec.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Kibana represents a Kibana resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: KibanaSpec holds the specification of a Kibana instance. + properties: + config: + description: 'Config holds the Kibana configuration. See: https://www.elastic.co/guide/en/kibana/current/settings.html' + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: Count of Kibana instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + running in the same Kubernetes cluster. + properties: + name: + description: Name of the Kubernetes object. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + required: + - name + type: object + http: + description: HTTP holds the HTTP layer configuration for Kibana. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certifcate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Kibana Docker image to deploy. + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Kibana pods + type: object + x-kubernetes-preserve-unknown-fields: true + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for Kibana. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + version: + description: Version of Kibana. + type: string + type: object + status: + description: KibanaStatus defines the observed state of Kibana + properties: + associationStatus: + description: AssociationStatus is the status of an association resource. + type: string + availableNodes: + format: int32 + type: integer + health: + description: KibanaHealth expresses the status of the Kibana instances. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: to not break compatibility when upgrading from previous versions + of the CRD + type: object + served: false + storage: false +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: logstashes.logstash.k8s.elastic.co +spec: + group: logstash.k8s.elastic.co + names: + categories: + - elastic + kind: Logstash + listKind: LogstashList + plural: logstashes + shortNames: + - ls + singular: logstash + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Health + jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: available + type: integer + - description: Expected nodes + jsonPath: .status.expectedNodes + name: expected + type: integer + - jsonPath: .metadata.creationTimestamp + name: age + type: date + - description: Logstash version + jsonPath: .status.version + name: version + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: Logstash is the Schema for the logstashes API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: LogstashSpec defines the desired state of Logstash + properties: + config: + description: Config holds the Logstash configuration. At most one + of [`Config`, `ConfigRef`] can be specified. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Logstash configuration. + Logstash settings must be specified as yaml, under a single "logstash.yml" entry. At most one of [`Config`, `ConfigRef`] + can be specified. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + format: int32 + type: integer + elasticsearchRefs: + description: ElasticsearchRefs are references to Elasticsearch clusters + running in the same Kubernetes cluster. + items: + description: ElasticsearchCluster is a named reference to an Elasticsearch + cluster which can be used in a Logstash pipeline. + properties: + clusterName: + description: |- + ClusterName is an alias for the cluster to be used to refer to the Elasticsearch cluster in Logstash + configuration files, and will be used to identify "named clusters" in Logstash + minLength: 1 + type: string + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + required: + - clusterName + type: object + type: array + image: + description: Image is the Logstash Docker image to deploy. Version + and Type have to match the Logstash in the image. + type: string + monitoring: + description: |- + Monitoring enables you to collect and ship log and monitoring data of this Logstash. + Metricbeat and Filebeat are deployed in the same Pod as sidecars and each one sends data to one or two different + Elasticsearch monitoring clusters running in the same Kubernetes cluster. + properties: + logs: + description: Logs holds references to Elasticsearch clusters which + receive log data from an associated resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + metrics: + description: Metrics holds references to Elasticsearch clusters + which receive monitoring data from this resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + type: object + pipelines: + description: Pipelines holds the Logstash Pipelines. At most one of + [`Pipelines`, `PipelinesRef`] can be specified. + items: + type: object + type: array + x-kubernetes-preserve-unknown-fields: true + pipelinesRef: + description: |- + PipelinesRef contains a reference to an existing Kubernetes Secret holding the Logstash Pipelines. + Logstash pipelines must be specified as yaml, under a single "pipelines.yml" entry. At most one of [`Pipelines`, `PipelinesRef`] + can be specified. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + podTemplate: + description: PodTemplate provides customisation options for the Logstash + pods. + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying StatefulSet. + format: int32 + type: integer + secureSettings: + description: |- + SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for the Logstash. + Secrets data can be then referenced in the Logstash config using the Secret's keys or as specified in `Entries` field of + each SecureSetting. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to Elasticsearch resource in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + services: + description: |- + Services contains details of services that Logstash should expose - similar to the HTTP layer configuration for the + rest of the stack, but also applicable for more use cases than the metrics API, as logstash may need to + be opened up for other services: Beats, TCP, UDP, etc, inputs. + items: + properties: + name: + type: string + service: + description: Service defines the template for the associated + Kubernetes Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + type: array + updateStrategy: + description: UpdateStrategy is a StatefulSetUpdateStrategy. The default + type is "RollingUpdate". + properties: + rollingUpdate: + description: RollingUpdate is used to communicate parameters when + Type is RollingUpdateStatefulSetStrategyType. + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding up. This can not be 0. + Defaults to 1. This field is beta-level and is enabled by default. The field applies to all pods in the range 0 to + Replicas-1. That means if there is any unavailable pod in the range 0 to Replicas-1, it + will be counted towards MaxUnavailable. + This setting might not be effective for the OrderedReady podManagementPolicy. That policy ensures pods are created and become ready one at a time. + x-kubernetes-int-or-string: true + partition: + description: |- + Partition indicates the ordinal at which the StatefulSet should be partitioned + for updates. During a rolling update, all pods from ordinal Replicas-1 to + Partition are updated. All pods from ordinal Partition-1 to 0 remain untouched. + This is helpful in being able to do a canary based deployment. The default value is 0. + format: int32 + type: integer + type: object + type: + description: |- + Type indicates the type of the StatefulSetUpdateStrategy. + Default is RollingUpdate. + type: string + type: object + version: + description: Version of the Logstash. + type: string + volumeClaimTemplates: + description: |- + VolumeClaimTemplates is a list of persistent volume claims to be used by each Pod. + Every claim in this list must have a matching volumeMount in one of the containers defined in the PodTemplate. + Items defined here take precedence over any default claims added by the operator with the same name. + items: + description: PersistentVolumeClaim is a user's request for and claim + to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + Users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to consider + for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string or nil value indicates that no + VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, + this field can be reset to its previous value (including nil) to cancel the modification. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status of + resource being resized for the given PVC.\nKey names follow + standard Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus + can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with a + terminal error.\n\t- NodeResizePending:\n\t\tState set + when resize controller has finished resizing the volume + but further resizing of\n\t\tvolume is needed on the node.\n\t- + NodeResizeInProgress:\n\t\tState set when kubelet starts + resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, it + means that no resize operation is in progress for the + given PVC.\n\nA controller that receives PVC update with + previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources allocated + to a PVC including its capacity.\nKey names follow standard + Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nCapacity + reported here may be larger than the actual capacity when + a volume expansion operation\nis requested.\nFor storage + quota, the larger value from allocatedResources and PVC.spec.resources + is used.\nIf allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and if + the actual volume capacity\nis equal or lower than the + requested capacity.\n\nA controller that receives PVC + update with previously unknown resourceName\nshould ignore + the update for the purpose it was designed. For example + - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources of + the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains details + about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed the + condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the condition + transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible indicates + that the request has been rejected as invalid by the + CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can be + added in the future. Consumers should check for unknown + statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: array + required: + - version + type: object + status: + description: LogstashStatus defines the observed state of Logstash + properties: + availableNodes: + format: int32 + type: integer + elasticsearchAssociationsStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: ElasticsearchAssociationStatus is the status of any auto-linking + to Elasticsearch clusters. + type: object + expectedNodes: + format: int32 + type: integer + health: + type: string + monitoringAssociationStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: MonitoringAssociationStatus is the status of any auto-linking + to monitoring Elasticsearch clusters. + type: object + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Logstash instance. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Logstash + controller has not yet processed the changes contained in the Logstash specification. + format: int64 + type: integer + selector: + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + required: + - selector + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.expectedNodes + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: packageregistries.packageregistry.k8s.elastic.co +spec: + group: packageregistry.k8s.elastic.co + names: + categories: + - elastic + kind: PackageRegistry + listKind: PackageRegistryList + plural: packageregistries + shortNames: + - epr + singular: packageregistry + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: PackageRegistry version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: PackageRegistry represents an Elastic Package Registry resource + in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: PackageRegistrySpec holds the specification of an Elastic + Package Registry instance. + properties: + config: + description: 'Config holds the PackageRegistry configuration. See: + https://github.com/elastic/package-registry/blob/main/config.reference.yml' + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Elastic Package Registry configuration. + Configuration settings are merged and have precedence over settings specified in `config`. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + description: Count of Elastic Package Registry instances to deploy. + format: int32 + type: integer + http: + description: HTTP holds the HTTP layer configuration for Elastic Package + Registry. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Elastic Package Registry Docker image to + deploy. + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Elastic Package + Registry pods + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + version: + description: Version of Elastic Package Registry. + type: string + required: + - version + type: object + status: + description: PackageRegistryStatus defines the observed state of Elastic + Package Registry + properties: + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + health: + description: Health of the deployment. + type: string + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Elastic Package Registry. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Elastic Package Registry + controller has not yet processed the changes contained in the Elastic Package Registry specification. + format: int64 + type: integer + selector: + description: Selector is the label selector used to find all pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: stackconfigpolicies.stackconfigpolicy.k8s.elastic.co +spec: + group: stackconfigpolicy.k8s.elastic.co + names: + categories: + - elastic + kind: StackConfigPolicy + listKind: StackConfigPolicyList + plural: stackconfigpolicies + shortNames: + - scp + singular: stackconfigpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Resources configured + jsonPath: .status.readyCount + name: Ready + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.weight + name: Weight + type: integer + name: v1alpha1 + schema: + openAPIV3Schema: + description: StackConfigPolicy represents a StackConfigPolicy resource in + a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + elasticsearch: + properties: + clusterSettings: + description: ClusterSettings holds the Elasticsearch cluster settings + (/_cluster/settings) + type: object + x-kubernetes-preserve-unknown-fields: true + config: + description: Config holds the settings that go into elasticsearch.yml. + type: object + x-kubernetes-preserve-unknown-fields: true + indexLifecyclePolicies: + description: IndexLifecyclePolicies holds the Index Lifecycle + policies settings (/_ilm/policy) + type: object + x-kubernetes-preserve-unknown-fields: true + indexTemplates: + description: IndexTemplates holds the Index and Component Templates + settings + properties: + componentTemplates: + description: ComponentTemplates holds the Component Templates + settings (/_component_template) + type: object + x-kubernetes-preserve-unknown-fields: true + composableIndexTemplates: + description: ComposableIndexTemplates holds the Index Templates + settings (/_index_template) + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + x-kubernetes-preserve-unknown-fields: true + ingestPipelines: + description: IngestPipelines holds the Ingest Pipelines settings + (/_ingest/pipeline) + type: object + x-kubernetes-preserve-unknown-fields: true + secretMounts: + description: SecretMounts are additional Secrets that need to + be mounted into the Elasticsearch pods. + items: + description: SecretMount contains information about additional + secrets to be mounted to the elasticsearch pods + properties: + mountPath: + description: MountPath denotes the path to which the secret + should be mounted to inside the elasticsearch pod + type: string + secretName: + description: SecretName denotes the name of the secret that + needs to be mounted to the elasticsearch pod + type: string + type: object + type: array + x-kubernetes-preserve-unknown-fields: true + secureSettings: + description: SecureSettings are additional Secrets that contain + data to be configured to Elasticsearch's keystore. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + x-kubernetes-preserve-unknown-fields: true + securityRoleMappings: + description: SecurityRoleMappings holds the Role Mappings settings + (/_security/role_mapping) + type: object + x-kubernetes-preserve-unknown-fields: true + snapshotLifecyclePolicies: + description: SnapshotLifecyclePolicies holds the Snapshot Lifecycle + Policies settings (/_slm/policy) + type: object + x-kubernetes-preserve-unknown-fields: true + snapshotRepositories: + description: SnapshotRepositories holds the Snapshot Repositories + settings (/_snapshot) + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + kibana: + properties: + config: + description: Config holds the settings that go into kibana.yml. + type: object + x-kubernetes-preserve-unknown-fields: true + secureSettings: + description: SecureSettings are additional Secrets that contain + data to be configured to Kibana's keystore. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + x-kubernetes-preserve-unknown-fields: true + type: object + resourceSelector: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + secureSettings: + description: 'Deprecated: SecureSettings only applies to Elasticsearch + and is deprecated. It must be set per application instead.' + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + weight: + default: 0 + description: |- + Weight determines the priority of this policy when multiple policies target the same resource. + Higher weight values take precedence. Defaults to 0. + format: int32 + type: integer + type: object + status: + properties: + details: + additionalProperties: + additionalProperties: + description: ResourcePolicyStatus models the status of the policy + for one resource to be configured. + properties: + currentVersion: + description: |- + CurrentVersion denotes the current version of filesettings applied to the Elasticsearch cluster + This field does not apply to Kibana resources + format: int64 + type: integer + error: + properties: + message: + type: string + version: + format: int64 + type: integer + type: object + expectedVersion: + description: |- + ExpectedVersion denotes the expected version of filesettings that should be applied to the Elasticsearch cluster + This field does not apply to Kibana resources + format: int64 + type: integer + phase: + type: string + type: object + type: object + description: Details holds the status details for each resource to + be configured. + type: object + errors: + description: Errors is the number of resources which have an incorrect + configuration + type: integer + observedGeneration: + description: ObservedGeneration is the most recent generation observed + for this StackConfigPolicy. + format: int64 + type: integer + phase: + description: Phase is the phase of the StackConfigPolicy. + type: string + ready: + description: Ready is the number of resources successfully configured. + type: integer + readyCount: + description: ReadyCount is a human representation of the number of + resources successfully configured. + type: string + resources: + description: Resources is the number of resources to be configured. + type: integer + resourcesStatuses: + additionalProperties: + description: ResourcePolicyStatus models the status of the policy + for one resource to be configured. + properties: + currentVersion: + description: |- + CurrentVersion denotes the current version of filesettings applied to the Elasticsearch cluster + This field does not apply to Kibana resources + format: int64 + type: integer + error: + properties: + message: + type: string + version: + format: int64 + type: integer + type: object + expectedVersion: + description: |- + ExpectedVersion denotes the expected version of filesettings that should be applied to the Elasticsearch cluster + This field does not apply to Kibana resources + format: int64 + type: integer + phase: + type: string + type: object + description: |- + ResourcesStatuses holds the status for each resource to be configured. + + Deprecated: Details is used to store the status of resources from ECK 2.11 + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/values.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/values.yaml new file mode 100644 index 00000000..f3fd8bd5 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/values.yaml @@ -0,0 +1,7 @@ +# Globals meant for internal use only +global: + # manifestGen specifies whether the chart is running under manifest generator. + # This is used for tasks specific to generating the all-in-one.yaml file. + manifestGen: false + # kubeVersion is the effective Kubernetes version we target when generating the all-in-one.yaml. + kubeVersion: 1.21.0 diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-disable-automounting-api.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-disable-automounting-api.yaml new file mode 100644 index 00000000..50f97157 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-disable-automounting-api.yaml @@ -0,0 +1,29 @@ +automountServiceAccountToken: false + +serviceAccount: + automountServiceAccountToken: false + +volumeMounts: +- mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: serviceaccount-token + readOnly: true + +volumes: +- name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: 3607 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-global.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-global.yaml new file mode 100644 index 00000000..286f8c9e --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-global.yaml @@ -0,0 +1,6 @@ +managedNamespaces: [] + +createClusterScopedResources: true + +webhook: + enabled: true diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-istio.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-istio.yaml new file mode 100644 index 00000000..c968ba02 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-istio.yaml @@ -0,0 +1,11 @@ +managedNamespaces: [] + +createClusterScopedResources: true + +webhook: + enabled: true + +podAnnotations: + sidecar.istio.io/inject: "true" + traffic.sidecar.istio.io/includeInboundPorts: "*" + traffic.sidecar.istio.io/excludeInboundPorts: "9443" diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-restricted.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-restricted.yaml new file mode 100644 index 00000000..640d00f3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-restricted.yaml @@ -0,0 +1,12 @@ +managedNamespaces: ["elastic-system"] + +createClusterScopedResources: false + +config: + # no RBAC access to cluster-wide storage classes, hence disable storage class validation + validateStorageClass: false + +installCRDs: false + +webhook: + enabled: false diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-soft-multi-tenancy.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-soft-multi-tenancy.yaml new file mode 100644 index 00000000..8ac79514 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-soft-multi-tenancy.yaml @@ -0,0 +1,18 @@ +managedNamespaces: ["team-a", "team-b"] + +createClusterScopedResources: true + +refs: + enforceRBAC: true + +webhook: + enabled: true + namespaceSelector: + matchExpressions: + - key: "eck.k8s.elastic.co/tenant" + operator: In + values: ["team-a", "team-b"] + + +softMultiTenancy: + enabled: true diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/NOTES.txt b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/NOTES.txt new file mode 100644 index 00000000..e25ea9ea --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/NOTES.txt @@ -0,0 +1,2 @@ +1. Inspect the operator logs by running the following command: + kubectl logs -n {{ .Release.Namespace }} sts/{{ .Release.Name }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/_helpers.tpl b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/_helpers.tpl new file mode 100644 index 00000000..893cb31f --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/_helpers.tpl @@ -0,0 +1,418 @@ +{{/* +Expand the name of the chart. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "eck-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "eck-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "eck-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "eck-operator.labels" -}} +{{- include "eck-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +helm.sh/chart: {{ include "eck-operator.chart" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "eck-operator.selectorLabels" -}} +{{- if .Values.global.manifestGen -}} +control-plane: elastic-operator +{{- else -}} +app.kubernetes.io/name: {{ include "eck-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "eck-operator.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "eck-operator.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Determine effective Kubernetes version +*/}} +{{- define "eck-operator.effectiveKubeVersion" -}} +{{- if .Values.global.manifestGen -}} +{{- semver .Values.global.kubeVersion -}} +{{- else -}} +{{- .Capabilities.KubeVersion.Version -}} +{{- end -}} +{{- end -}} + +{{/* +Determine the name for the webhook +*/}} +{{- define "eck-operator.webhookName" -}} +{{- if .Values.global.manifestGen -}} +elastic-webhook.k8s.elastic.co +{{- else -}} +{{- $name := include "eck-operator.name" . -}} +{{ printf "%s.%s.k8s.elastic.co" $name .Release.Namespace }} +{{- end -}} +{{- end -}} + +{{/* +Determine the name for the webhook secret +*/}} +{{- define "eck-operator.webhookSecretName" -}} +{{- if .Values.global.manifestGen -}} +elastic-webhook-server-cert +{{- else if .Values.webhook.certsSecret -}} +{{- .Values.webhook.certsSecret }} +{{- else -}} +{{- $name := include "eck-operator.name" . -}} +{{ printf "%s-webhook-cert" $name | trunc 63 }} +{{- end -}} +{{- end -}} + +{{/* +Determine the name for the webhook service +*/}} +{{- define "eck-operator.webhookServiceName" -}} +{{- if .Values.global.manifestGen -}} +elastic-webhook-server +{{- else -}} +{{- $name := include "eck-operator.name" . -}} +{{ printf "%s-webhook" $name | trunc 63 }} +{{- end -}} +{{- end -}} + +{{/* +Determine the metrics port +*/}} +{{- define "eck-operator.metrics.port" -}} +{{- if .Values.config.metrics.port -}} +{{- .Values.config.metrics.port -}} +{{- else if .Values.config.metricsPort -}} +{{- .Values.config.metricsPort -}} +{{- else -}} +0 +{{- end -}} +{{- end -}} + + + +{{/* +RBAC permissions +NOTE - any changes made to RBAC permissions below require +updating docs/operating-eck/eck-permissions.asciidoc file. +*/}} +{{- define "eck-operator.rbacRules" -}} +- apiGroups: + - "authorization.k8s.io" + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + resourceNames: + - elastic-operator-leader + verbs: + - get + - watch + - update +- apiGroups: + - "" + resources: + - endpoints + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - pods + - events + - persistentvolumeclaims + - secrets + - services + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - apps + resources: + - deployments + - statefulsets + - daemonsets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - elasticsearch.k8s.elastic.co + resources: + - elasticsearches + - elasticsearches/status + - elasticsearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - autoscaling.k8s.elastic.co + resources: + - elasticsearchautoscalers + - elasticsearchautoscalers/status + - elasticsearchautoscalers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - kibana.k8s.elastic.co + resources: + - kibanas + - kibanas/status + - kibanas/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - apm.k8s.elastic.co + resources: + - apmservers + - apmservers/status + - apmservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - enterprisesearch.k8s.elastic.co + resources: + - enterprisesearches + - enterprisesearches/status + - enterprisesearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - beat.k8s.elastic.co + resources: + - beats + - beats/status + - beats/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - agent.k8s.elastic.co + resources: + - agents + - agents/status + - agents/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - maps.k8s.elastic.co + resources: + - elasticmapsservers + - elasticmapsservers/status + - elasticmapsservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - stackconfigpolicy.k8s.elastic.co + resources: + - stackconfigpolicies + - stackconfigpolicies/status + - stackconfigpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - logstash.k8s.elastic.co + resources: + - logstashes + - logstashes/status + - logstashes/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - autoops.k8s.elastic.co + resources: + - autoopsagentpolicies + - autoopsagentpolicies/status + - autoopsagentpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - packageregistry.k8s.elastic.co + resources: + - packageregistries + - packageregistries/status + - packageregistries/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - deletecollection +{{- end -}} + +{{/* +RBAC permissions on non-namespaced resources +*/}} +{{- define "eck-operator.clusterWideRbacRules" -}} +- apiGroups: [""] + resources: + - namespaces + verbs: + - get + - list + - watch +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +{{- end -}} + +{{/* +RBAC permissions to read node labels +*/}} +{{- define "eck-operator.readNodeLabelsRbacRule" -}} +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/cluster-roles.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/cluster-roles.yaml new file mode 100644 index 00000000..1dccae8c --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/cluster-roles.yaml @@ -0,0 +1,133 @@ +{{- if and (not .Values.createClusterScopedResources) (.Values.config.metrics.secureMode.enabled) -}} +{{ fail "createClusterScopedResources is required to set config.metrics.secureMode.enabled to true" }} +{{- end }} +{{- if .Values.createClusterScopedResources -}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "eck-operator.fullname" . }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +rules: +{{ template "eck-operator.rbacRules" . | toYaml | indent 2 }} +{{ template "eck-operator.clusterWideRbacRules" . | toYaml | indent 2 }} +{{ if .Values.config.exposedNodeLabels }} +{{ template "eck-operator.readNodeLabelsRbacRule" . | toYaml | indent 2 }} +{{ end -}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: "{{ include "eck-operator.name" . }}-view" + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" + {{- include "eck-operator.labels" . | nindent 4 }} +rules: + - apiGroups: ["elasticsearch.k8s.elastic.co"] + resources: ["elasticsearches"] + verbs: ["get", "list", "watch"] + - apiGroups: ["autoscaling.k8s.elastic.co"] + resources: ["elasticsearchautoscalers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["apm.k8s.elastic.co"] + resources: ["apmservers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["kibana.k8s.elastic.co"] + resources: ["kibanas"] + verbs: ["get", "list", "watch"] + - apiGroups: ["enterprisesearch.k8s.elastic.co"] + resources: ["enterprisesearches"] + verbs: ["get", "list", "watch"] + - apiGroups: ["beat.k8s.elastic.co"] + resources: ["beats"] + verbs: ["get", "list", "watch"] + - apiGroups: ["agent.k8s.elastic.co"] + resources: ["agents"] + verbs: ["get", "list", "watch"] + - apiGroups: ["maps.k8s.elastic.co"] + resources: ["elasticmapsservers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["stackconfigpolicy.k8s.elastic.co"] + resources: ["stackconfigpolicies"] + verbs: ["get", "list", "watch"] + - apiGroups: ["logstash.k8s.elastic.co"] + resources: ["logstashes"] + verbs: ["get", "list", "watch"] + - apiGroups: ["autoops.k8s.elastic.co"] + resources: ["autoopsagentpolicies"] + verbs: ["get", "list", "watch"] + - apiGroups: ["packageregistry.k8s.elastic.co"] + resources: ["packageregistries"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: "{{ include "eck-operator.name" . }}-edit" + labels: + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" + {{- include "eck-operator.labels" . | nindent 4 }} +rules: + - apiGroups: ["elasticsearch.k8s.elastic.co"] + resources: ["elasticsearches"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["autoscaling.k8s.elastic.co"] + resources: ["elasticsearchautoscalers"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["apm.k8s.elastic.co"] + resources: ["apmservers"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["kibana.k8s.elastic.co"] + resources: ["kibanas"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["enterprisesearch.k8s.elastic.co"] + resources: ["enterprisesearches"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["beat.k8s.elastic.co"] + resources: ["beats"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["agent.k8s.elastic.co"] + resources: ["agents"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["maps.k8s.elastic.co"] + resources: ["elasticmapsservers"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["stackconfigpolicy.k8s.elastic.co"] + resources: ["stackconfigpolicies"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["logstash.k8s.elastic.co"] + resources: ["logstashes"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["autoops.k8s.elastic.co"] + resources: ["autoopsagentpolicies"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["packageregistry.k8s.elastic.co"] + resources: ["packageregistries"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] +{{- if .Values.config.metrics.secureMode.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "eck-operator.labels" . | nindent 4 }} + name: "{{ include "eck-operator.fullname" . }}-metrics-auth-role" +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +{{- end }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/configmap.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/configmap.yaml new file mode 100644 index 00000000..7582f8e6 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/configmap.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +data: + eck.yaml: |- + {{- $metricsPort := int (include "eck-operator.metrics.port" .)}} + log-verbosity: {{ int .Values.config.logVerbosity }} + {{- if and .Values.config.metrics.secureMode.enabled (eq $metricsPort 0) }} + {{- fail "config.metrics.port must be greater than 0 when config.metrics.secureMode.enabled is true" }} + {{- end }} + metrics-port: {{ $metricsPort }} + metrics-secure: {{ .Values.config.metrics.secureMode.enabled }} + container-registry: {{ .Values.config.containerRegistry }} + {{- with .Values.config.containerSuffix }} + container-suffix: {{ . }} + {{- end }} + {{- with .Values.config.containerRepository }} + container-repository: {{ . }} + {{- end }} + max-concurrent-reconciles: {{ int .Values.config.maxConcurrentReconciles }} + {{- with .Values.config.passwordHashCacheSize }} + password-hash-cache-size: {{ int . }} + {{- end }} + ca-cert-validity: {{ .Values.config.caValidity }} + ca-cert-rotate-before: {{ .Values.config.caRotateBefore }} + {{- with .Values.config.caDir }} + ca-dir: {{ . }} + {{- end }} + cert-validity: {{ .Values.config.certificatesValidity }} + cert-rotate-before: {{ .Values.config.certificatesRotateBefore }} + disable-config-watch: {{ .Values.config.disableConfigWatch }} + {{- with .Values.config.exposedNodeLabels }} + exposed-node-labels: [{{ join "," . }}] + {{- end }} + {{- with .Values.config.ipFamily }} + ip-family: {{ . }} + {{- end }} + set-default-security-context: {{ .Values.config.setDefaultSecurityContext }} + kube-client-timeout: {{ .Values.config.kubeClientTimeout }} + {{- with .Values.config.kubeClientQPS }} + kube-client-qps: {{ int . }} + {{- end }} + elasticsearch-client-timeout: {{ .Values.config.elasticsearchClientTimeout }} + disable-telemetry: {{ .Values.telemetry.disabled }} + distribution-channel: {{ .Values.telemetry.distributionChannel }} + {{- with .Values.telemetry.interval }} + telemetry-interval: {{ . }} + {{- end }} + validate-storage-class: {{ .Values.config.validateStorageClass }} + {{- if .Values.tracing.enabled }} + enable-tracing: true + {{- end }} + {{- if .Values.refs.enforceRBAC }} + enforce-rbac-on-refs: true + {{- end }} + enable-webhook: {{ .Values.webhook.enabled }} + {{- if .Values.webhook.enabled }} + webhook-name: {{ include "eck-operator.webhookName" . }} + {{- if not .Values.webhook.manageCerts }} + manage-webhook-certs: false + webhook-cert-dir: {{ .Values.webhook.certsDir }} + {{- end }} + webhook-port: {{ .Values.webhook.port }} + {{- end }} + {{- with .Values.managedNamespaces }} + namespaces: [{{ join "," . }}] + {{- end }} + operator-namespace: {{ .Release.Namespace }} + enable-leader-election: {{ .Values.config.enableLeaderElection }} + elasticsearch-observation-interval: {{ .Values.config.elasticsearchObservationInterval }} + {{- if not .Values.config.containerSuffix }} + ubi-only: {{ .Values.config.ubiOnly }} + {{- end }} + {{- with .Values.webhook.certsSecret }} + webhook-secret: {{ . }} + {{- end }} + {{- $passwordLength := int (dig "policies" "passwords" "length" 0 .Values.config) }} + {{- with $passwordLength }} + {{- if or (lt $passwordLength 6) (gt $passwordLength 72) }} + {{- fail "config.policies.passwords.length must be >= 6 and <= 72" }} + {{- end }} + password-length: {{ $passwordLength }} + {{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-namespaces.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-namespaces.yaml new file mode 100644 index 00000000..91deaf21 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-namespaces.yaml @@ -0,0 +1,13 @@ +{{- if .Values.softMultiTenancy.enabled -}} +{{- range .Values.managedNamespaces }} +{{- $namespace := . }} +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} + eck.k8s.elastic.co/tenant: {{ $namespace }} +{{- end -}} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-ns-network-policy.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-ns-network-policy.yaml new file mode 100644 index 00000000..23fc1e3a --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-ns-network-policy.yaml @@ -0,0 +1,228 @@ +{{- if .Values.softMultiTenancy.enabled -}} +{{- $fullName := include "eck-operator.fullname" . -}} +{{- $name := include "eck-operator.name" . -}} +{{- range .Values.managedNamespaces -}} +{{- $namespace := . }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-elasticsearch" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + egress: + # Transport port + - ports: + - port: 9300 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + ingress: + # HTTP Port + - ports: + - port: 9200 + from: + # Operator + - namespaceSelector: + matchLabels: + name: "{{ $.Release.Namespace }}" + podSelector: + matchLabels: + {{- include "eck-operator.selectorLabels" $ | nindent 14 }} + # Within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + # Transport port + - ports: + - port: 9300 + from: + # Within namespace (from other Elasticsearch nodes) + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-kibana" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "kibana" + egress: + # Elasticsearch HTTP port + - ports: + - port: 9200 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + ingress: + # HTTP Port + - ports: + - port: 5601 + from: + # Within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-apm-server" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "apm-server" + egress: + # Elasticsearch HTTP port + - ports: + - port: 9200 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # Kibana HTTP port + - ports: + - port: 5601 + to: + # Kibana within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "kibana" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + ingress: + # HTTP Port + - ports: + - port: 8200 + from: + # Within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-enterprise-search" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "enterprise-search" + egress: + # Elasticsearch HTTP port + - ports: + - port: 9200 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + ingress: + # HTTP Port + - ports: + - port: 3002 + from: + # Within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-beats" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "beat" + egress: + # Elasticsearch HTTP port + - ports: + - port: 9200 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # Kibana HTTP port + - ports: + - port: 5601 + to: + # Kibana within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "kibana" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] +{{- end }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/metrics-service.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/metrics-service.yaml new file mode 100644 index 00000000..53bdc02b --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/metrics-service.yaml @@ -0,0 +1,22 @@ +{{- if .Values.config.metrics.secureMode.enabled }} +{{- $metricsPort := int (include "eck-operator.metrics.port" .)}} +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: {{ include "eck-operator.name" . }}-metrics-service + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} + helm.sh/chart: {{ include "eck-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + name: "{{ include "eck-operator.fullname" . }}-metrics" + namespace: {{ .Release.Namespace }} +spec: + ports: + - name: https + port: {{ $metricsPort }} + protocol: TCP + targetPort: metrics + selector: + {{- include "eck-operator.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-namespace.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-namespace.yaml new file mode 100644 index 00000000..07123b70 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-namespace.yaml @@ -0,0 +1,9 @@ +{{- if (and .Values.global.manifestGen .Values.global.createOperatorNamespace) -}} +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Release.Namespace }} + labels: + name: {{ .Release.Namespace }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-network-policy.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-network-policy.yaml new file mode 100644 index 00000000..ad74156d --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-network-policy.yaml @@ -0,0 +1,59 @@ +{{- if .Values.softMultiTenancy.enabled -}} +{{- $kubeAPIServerIP := (required "kubeAPIServerIP is required" .Values.kubeAPIServerIP) -}} +{{- $metricsPort := int (include "eck-operator.metrics.port" .)}} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ .Release.Namespace}} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +spec: + podSelector: + matchLabels: + {{- include "eck-operator.selectorLabels" . | nindent 6 }} + egress: + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + # API server + - ports: + - port: 443 + to: + - ipBlock: + cidr: "{{ $kubeAPIServerIP }}/32" + # Elasticsearch + - ports: + - port: 9200 + to: + - namespaceSelector: + matchExpressions: + - key: "eck.k8s.elastic.co/tenant" + operator: In + values: + {{- range .Values.managedNamespaces }} + - {{ . }} + {{- end }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" +{{- if or .Values.webhook.enabled (gt $metricsPort 0) }} + ingress: +{{- if .Values.webhook.enabled }} + - ports: + - port: {{ .Values.webhook.port }} + from: + - ipBlock: + cidr: "{{ $kubeAPIServerIP }}/32" +{{- end }} +{{- if gt $metricsPort 0 }} + # Metrics + - ports: + - port: {{ $metricsPort }} + from: [] +{{- end }} +{{- end }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/pdb.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/pdb.yaml new file mode 100644 index 00000000..42b494a3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/pdb.yaml @@ -0,0 +1,19 @@ +{{- if .Values.podDisruptionBudget.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +spec: + {{- with .Values.podDisruptionBudget.minAvailable }} + minAvailable: {{ . }} + {{- end }} + {{- with .Values.podDisruptionBudget.maxUnavailable }} + maxUnavailable: {{ . }} + {{- end }} + selector: + matchLabels: + {{- include "eck-operator.selectorLabels" . | nindent 6 }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/podMonitor.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/podMonitor.yaml new file mode 100644 index 00000000..8e073cd3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/podMonitor.yaml @@ -0,0 +1,42 @@ +{{- $metricsPort := int (include "eck-operator.metrics.port" .)}} +{{- if and .Values.config.metrics.secureMode.enabled (eq $metricsPort 0) }} +{{- fail "config.metrics.port must be greater than 0 when config.metrics.secureMode.enabled is true" }} +{{- end }} +{{- if and .Values.podMonitor.enabled (gt $metricsPort 0) }} +{{- if and .Values.podMonitor.enabled .Values.config.metrics.secureMode.enabled }} +{{- fail "podMonitor and config.metrics.secureMode are mutually exclusive" }} +{{- end }} +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ ternary .Values.podMonitor.namespace .Release.Namespace (not (and (.Values.podMonitor) (empty .Values.podMonitor.namespace))) }} + labels: {{- include "eck-operator.labels" . | nindent 4 }} + {{- with .Values.podMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.podMonitor.annotations }} + annotations: {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.podMonitor.podTargetLabels }} + podTargetLabels: {{- toYaml . | nindent 4 }} + {{- end }} + podMetricsEndpoints: + - port: metrics + path: /metrics + {{- with .Values.podMonitor.interval }} + interval: {{ . }} + {{- end }} + {{- with .Values.podMonitor.scrapeTimeout }} + scrapeTimeout: {{ . }} + {{- end }} + {{- with .Values.podMonitor.podMetricsEndpointConfig }} + {{- toYaml . | nindent 6 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: {{- include "eck-operator.selectorLabels" . | nindent 6 }} +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/role-bindings.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/role-bindings.yaml new file mode 100644 index 00000000..0db9f278 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/role-bindings.yaml @@ -0,0 +1,98 @@ +{{- $operatorNSIsManaged := has .Release.Namespace .Values.managedNamespaces -}} +{{- $fullName := include "eck-operator.fullname" . -}} +{{- $svcAccount := include "eck-operator.serviceAccountName" . }} +{{- $enableSecureMetrics := .Values.config.metrics.secureMode.enabled -}} + +{{- if not .Values.createClusterScopedResources }} +{{- range .Values.managedNamespaces }} +{{- $namespace := . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: "{{ $fullName }}" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +rules: +{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ $fullName }}" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ $fullName }}" +subjects: +- kind: ServiceAccount + name: {{ $svcAccount }} + namespace: {{ $.Release.Namespace }} +{{- end }} {{- /* end of range over managed namespaces */}} +{{- /* If createClusterScopedResources is false and operator namespace is not in the managed namespaces list, create additional role binding */}} +{{- if not $operatorNSIsManaged }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ $fullName }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +rules: +{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ $fullName }}" + namespace: {{ $.Release.Namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ $fullName }}" +subjects: +- kind: ServiceAccount + name: {{ $svcAccount }} + namespace: {{ $.Release.Namespace }} +{{- end }} {{- /* end of operator role binding if operator namespace is not managed */}} +{{- else }} {{- /* we can create cluster-scoped resources so just create a cluster role binding */}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ $fullName }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ $fullName }} +subjects: +- kind: ServiceAccount + name: {{ $svcAccount }} + namespace: {{ $.Release.Namespace }} +{{- if $enableSecureMetrics }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} + name: "{{ include "eck-operator.fullname" . }}-metrics-auth-rolebinding" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: "{{ include "eck-operator.fullname" . }}-metrics-auth-role" +subjects: +- kind: ServiceAccount + name: {{ $svcAccount }} + namespace: {{ $.Release.Namespace }} +{{- end }} +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-account.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-account.yaml new file mode 100644 index 00000000..f91acdcc --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-account.yaml @@ -0,0 +1,15 @@ +{{- if .Values.serviceAccount.create }} +--- +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +metadata: + name: {{ include "eck-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +{{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-monitor.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-monitor.yaml new file mode 100644 index 00000000..0d4a3d9c --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-monitor.yaml @@ -0,0 +1,34 @@ +{{- if and .Values.config.metrics.secureMode.enabled .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ ternary .Values.serviceMonitor.namespace .Release.Namespace (not (and (.Values.serviceMonitor) (empty .Values.serviceMonitor.namespace))) }} + labels: {{- include "eck-operator.labels" . | nindent 4 }} +spec: + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: + app.kubernetes.io/name: {{ include "eck-operator.name" . }}-metrics-service + app.kubernetes.io/instance: {{ .Release.Name }} + endpoints: + - port: https + path: /metrics + scheme: https + interval: 30s + tlsConfig: + {{- $insecureSkipVerify := (ternary .Values.config.metrics.secureMode.tls.insecureSkipVerify .Values.serviceMonitor.insecureSkipVerify (hasKey .Values.config.metrics.secureMode.tls "insecureSkipVerify")) }} + insecureSkipVerify: {{ $insecureSkipVerify }} + {{- if (not $insecureSkipVerify) }} + {{- $caMountDirectory := or (.Values.config.metrics.secureMode.tls.caMountDirectory) (.Values.serviceMonitor.caMountDirectory) -}} + {{- $leading_path := trimSuffix "/" $caMountDirectory }} + {{- $caSecret := or (.Values.config.metrics.secureMode.tls.caSecret) (.Values.serviceMonitor.caSecret) -}} + {{- with $caSecret }} + caFile: "{{ $leading_path }}/{{ . }}/ca.crt" + {{- end }} + serverName: "{{ include "eck-operator.fullname" . }}-metrics.{{ .Release.Namespace }}.svc" + {{- end }} + bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/statefulset.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/statefulset.yaml new file mode 100644 index 00000000..3fcc1575 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/statefulset.yaml @@ -0,0 +1,166 @@ +--- +{{- $metricsPort := int (include "eck-operator.metrics.port" .)}} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.statefulsetAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} + {{- with .Values.statefulsetLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "eck-operator.selectorLabels" . | nindent 6 }} + serviceName: {{ include "eck-operator.fullname" . }} + replicas: {{ .Values.replicaCount }} + template: + metadata: + annotations: + # Rename the fields "error" to "error.message" and "source" to "event.source" + # This is to avoid a conflict with the ECS "error" and "source" documents. + "co.elastic.logs/raw": "[{\"type\":\"filestream\",\"enabled\":true,\"id\":\"eck-container-logs-${data.kubernetes.container.id}\",\"paths\":[\"/var/log/containers/*${data.kubernetes.container.id}.log\"],\"parsers\":[{\"container\":{}},{\"ndjson\":{\"keys_under_root\":true}}],\"prospector.scanner.symlinks\":true,\"processors\":[{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"error\",\"to\":\"_error\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_error\",\"to\":\"error.message\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"source\",\"to\":\"_source\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_source\",\"to\":\"event.source\"}]}}]}]" + "checksum/config": {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- if .Values.global.manifestGen }} + {{- include "eck-operator.selectorLabels" . | nindent 8 }} + {{- else }} + {{- include "eck-operator.labels" . | nindent 8 }} + {{- end }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + terminationGracePeriodSeconds: 10 + serviceAccountName: {{ include "eck-operator.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.automountServiceAccountToken }} + {{- with .Values.priorityClassName }} + priorityClassName: {{ . }} + {{- end }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - image: "{{ .Values.image.repository }}{{- if .Values.config.ubiOnly -}}-ubi{{- end -}}{{- if .Values.image.fips -}}-fips{{- end -}}:{{ default .Chart.AppVersion .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: manager + args: + - "manager" + - "--config=/conf/eck.yaml" + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + env: + - name: OPERATOR_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + {{- if .Values.webhook.enabled }} + - name: WEBHOOK_SECRET + value: {{ include "eck-operator.webhookSecretName" . }} + {{- end }} + {{- with .Values.env }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if .Values.tracing.enabled -}} + {{- range $name, $value := .Values.tracing.config }} + - name: {{ $name }} + value: {{ $value }} + {{- end }} + {{- end }} + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if or .Values.webhook.enabled (gt $metricsPort 0) }} + ports: + {{- if (gt $metricsPort 0) }} + - containerPort: {{ $metricsPort }} + name: metrics + protocol: TCP + {{- end }} + {{- if .Values.webhook.enabled }} + - containerPort: {{ .Values.webhook.port }} + name: https-webhook + protocol: TCP + {{- end }} + {{- end }} + volumeMounts: + - mountPath: "/conf" + name: conf + readOnly: true + {{- if .Values.webhook.enabled }} + - mountPath: {{ .Values.webhook.certsDir }} + name: cert + readOnly: true + {{- end }} + {{- if .Values.config.metrics.secureMode.tls.certificateSecret }} + - mountPath: "/tmp/k8s-metrics-server/serving-certs" + name: tls-certificate + readOnly: true + {{- end }} + {{- with .Values.volumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + volumes: + - name: conf + configMap: + name: {{ include "eck-operator.fullname" . }} + {{- if .Values.webhook.enabled }} + - name: cert + secret: + defaultMode: 420 + secretName: {{ include "eck-operator.webhookSecretName" . }} + {{- end }} + {{- if .Values.config.metrics.secureMode.tls.certificateSecret }} + - name: tls-certificate + secret: + defaultMode: 420 + secretName: {{ .Values.config.metrics.secureMode.tls.certificateSecret }} + {{- end }} + {{- with .Values.volumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: true + {{- end }} + {{- if .Values.dnsPolicy }} + dnsPolicy: {{ .Values.dnsPolicy }} + {{- else if .Values.hostNetwork }} + dnsPolicy: ClusterFirstWithHostNet + {{- end }} + {{- with .Values.dnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/validate-chart.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/validate-chart.yaml new file mode 100644 index 00000000..326b70bc --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/validate-chart.yaml @@ -0,0 +1,29 @@ +{{- if .Values.softMultiTenancy.enabled -}} + {{- if has .Release.Namespace .Values.managedNamespaces -}} + {{- fail "Operator namespace cannot be in managed namespaces when soft multi-tenancy is enabled" -}} + {{- end -}} + + {{- if empty .Values.managedNamespaces -}} + {{- fail "Managed namespaces must be defined when soft multi-tenancy is enabled" -}} + {{- end -}} + + {{- if empty .Values.kubeAPIServerIP -}} + {{- fail "Soft multi-tenancy requires kubeAPIServerIP to be defined" -}} + {{- end -}} +{{- end -}} + +{{- if (not .Values.createClusterScopedResources) -}} + {{- if .Values.webhook.enabled -}} + {{- fail "Webhook cannot be enabled when cluster-scoped resource creation is disabled" -}} + {{- end -}} + + {{- if .Values.config.validateStorageClass -}} + {{- fail "Storage class validation cannot be enabled when cluster-scoped resource creation is disabled" -}} + {{- end -}} +{{- end -}} + +{{- if (not .Values.config.enableLeaderElection) -}} + {{- if gt (int .Values.replicaCount) 1 -}} + {{- fail "Leader election must be enabled with more than one replica" -}} + {{- end -}} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/webhook.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/webhook.yaml new file mode 100644 index 00000000..55a859ce --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/webhook.yaml @@ -0,0 +1,535 @@ +{{- if .Values.webhook.enabled -}} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: {{ include "eck-operator.webhookName" . }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +{{- with .Values.webhook.certManagerCert }} + annotations: + cert-manager.io/inject-ca-from: "{{ $.Release.Namespace }}/{{ . }}" +{{- end }} +webhooks: +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-agent-k8s-elastic-co-v1alpha1-agent + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-agent-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - agent.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - agents +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-apm-k8s-elastic-co-v1-apmserver + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-apm-validation-v1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - apm.k8s.elastic.co + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - apmservers +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-apm-k8s-elastic-co-v1beta1-apmserver + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-apm-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - apm.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - apmservers +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-beat-k8s-elastic-co-v1beta1-beat + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-beat-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - beat.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - beats +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-enterprisesearch-k8s-elastic-co-v1-enterprisesearch + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-ent-validation-v1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - enterprisesearch.k8s.elastic.co + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - enterprisesearches +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-enterprisesearch-k8s-elastic-co-v1beta1-enterprisesearch + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-ent-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - enterprisesearch.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - enterprisesearches +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-elasticsearch-k8s-elastic-co-v1-elasticsearch + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-es-validation-v1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - elasticsearch.k8s.elastic.co + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - elasticsearches +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-es-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - elasticsearch.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - elasticsearches +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-ems-k8s-elastic-co-v1alpha1-mapsservers + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-ems-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - maps.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - mapsservers +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-kibana-k8s-elastic-co-v1-kibana + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-kb-validation-v1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - kibana.k8s.elastic.co + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - kibanas +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-kibana-k8s-elastic-co-v1beta1-kibana + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-kb-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - kibana.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - kibanas +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-esa-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - autoscaling.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - elasticsearchautoscalers +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-scp-k8s-elastic-co-v1alpha1-stackconfigpolicies + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-scp-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - stackconfigpolicy.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - stackconfigpolicies +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-logstash-k8s-elastic-co-v1alpha1-logstash + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-logstash-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - logstash.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - logstashes +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-autoops-k8s-elastic-co-v1alpha1-autoopsagentpolicies + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-autoops-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - autoops.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - autoopsagentpolicies +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-epr-k8s-elastic-co-v1alpha1-elasticpackageregistry + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-epr-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1,v1beta1] + sideEffects: None + rules: + - apiGroups: + - packageregistry.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - packageregistries +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +spec: + ports: + - name: https + port: 443 + targetPort: {{ .Values.webhook.port }} + selector: + {{- include "eck-operator.selectorLabels" . | nindent 4 }} +{{- if .Values.webhook.manageCerts }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "eck-operator.webhookSecretName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +{{- end }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/values.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/values.yaml new file mode 100644 index 00000000..adc48be3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/values.yaml @@ -0,0 +1,377 @@ +# nameOverride is the short name for the deployment. Leave empty to let Helm generate a name using chart values. +nameOverride: "elastic-operator" + +# fullnameOverride is the full name for the deployment. Leave empty to let Helm generate a name using chart values. +fullnameOverride: "elastic-operator" + +# managedNamespaces is the set of namespaces that the operator manages. Leave empty to manage all namespaces. +managedNamespaces: [] + +# installCRDs determines whether Custom Resource Definitions (CRD) are installed by the chart. +# Note that CRDs are global resources and require cluster admin privileges to install. +# If you are sharing a cluster with other users who may want to install ECK on their own namespaces, setting this to true can have unintended consequences. +# 1. Upgrades will overwrite the global CRDs and could disrupt the other users of ECK who may be running a different version. +# 2. Uninstalling the chart will delete the CRDs and potentially cause Elastic resources deployed by other users to be removed as well. +installCRDs: true + +# replicaCount is the number of operator pods to run. +replicaCount: 1 + +image: + # repository is the container image prefixed by the registry name. + repository: docker.elastic.co/eck/eck-operator + # pullPolicy is the container image pull policy. + pullPolicy: IfNotPresent + # tag is the container image tag. If not defined, defaults to chart appVersion. + tag: null + # fips specifies whether the operator will use a FIPS compliant container image for its own StatefulSet image. + # This setting does not apply to Elastic Stack applications images. + # Can be combined with config.ubiOnly. + fips: false + +# priorityClassName defines the PriorityClass to be used by the operator pods. +priorityClassName: "" + +# imagePullSecrets defines the secrets to use when pulling the operator container image. +imagePullSecrets: [] + +# resources define the container resource limits for the operator. +resources: + limits: + cpu: 1 + memory: 1Gi + requests: + cpu: 100m + memory: 150Mi + +# statefulsetAnnotations define the annotations that should be added to the operator StatefulSet. +statefulsetAnnotations: {} + +# statefulsetLabels define additional labels that should be added to the operator StatefulSet. +statefulsetLabels: {} + +# podAnnotations define the annotations that should be added to the operator pod. +podAnnotations: {} + +## podLabels define additional labels that should be added to the operator pod. +podLabels: {} + +# podSecurityContext defines the pod security context for the operator pod. +podSecurityContext: + runAsNonRoot: true + +# securityContext defines the security context of the operator container. +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + +# nodeSelector defines the node selector for the operator pod. +nodeSelector: {} + +# tolerations defines the node tolerations for the operator pod. +tolerations: [] + +# affinity defines the node affinity rules for the operator pod. +affinity: {} + +# podDisruptionBudget configures the minimum or the maxium available pods for voluntary disruptions, +# set to either an integer (e.g. 1) or a percentage value (e.g. 25%). +podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 3 + +# additional environment variables for the operator container. +env: [] + +# additional volume mounts for the operator container. +volumeMounts: [] + +# additional volumes to add to the operator pod. +volumes: [] + +# createClusterScopedResources determines whether cluster-scoped resources (ClusterRoles, ClusterRoleBindings) should be created. +createClusterScopedResources: true + +# Automount API credentials for the Service Account into the pod. +automountServiceAccountToken: true + +serviceAccount: + # create specifies whether a service account should be created for the operator. + create: true + # Specifies whether a service account should automount API credentials. + automountServiceAccountToken: true + # annotations to add to the service account + annotations: {} + # name of the service account to use. If not set and create is true, a name is generated using the fullname template. + name: "" + +tracing: + # enabled specifies whether APM tracing is enabled for the operator. + enabled: false + # config is a map of APM Server configuration variables that should be set in the environment. + config: + ELASTIC_APM_SERVER_URL: http://localhost:8200 + ELASTIC_APM_SERVER_TIMEOUT: 30s + +refs: + # enforceRBAC specifies whether RBAC should be enforced for cross-namespace associations between resources. + enforceRBAC: false + +webhook: + # enabled determines whether the webhook is installed. + enabled: true + # caBundle is the PEM-encoded CA trust bundle for the webhook certificate. Only required if manageCerts is false and certManagerCert is null. + caBundle: Cg== + # certManagerCert is the name of the cert-manager certificate to use with the webhook. + certManagerCert: null + # certsDir is the directory to mount the certificates. + certsDir: "/tmp/k8s-webhook-server/serving-certs" + # failurePolicy of the webhook. + failurePolicy: Ignore + # manageCerts determines whether the operator manages the webhook certificates automatically. + manageCerts: true + # namespaceSelector corresponds to the namespaceSelector property of the webhook. + # Setting this restricts the webhook to act only on objects submitted to namespaces that match the selector. + namespaceSelector: {} + # objectSelector corresponds to the objectSelector property of the webhook. + # Setting this restricts the webhook to act only on objects that match the selector. + objectSelector: {} + # port is the port that the validating webhook binds to. + port: 9443 + # secret specifies the Kubernetes secret to be mounted into the path designated by the certsDir value to be used for webhook certificates. + certsSecret: "" + +# hostNetwork allows a Pod to use the Node network namespace. +# This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled. +# If hostNetwork is enabled, dnsPolicy defaults to ClusterFirstWithHostNet unless explicitly set. +# CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host. +hostNetwork: false + +# dnsPolicy defines the DNS policy for the operator pod. +# Check https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy for more details. +dnsPolicy: "" + +# dnsConfig defines the DNS configuration for the operator pod. +# Check https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config for more details. +# dnsConfig: +# nameservers: +# - 169.254.20.10 +# searches: +# - svc.cluster.local +# options: +# - name: ndots +# value: "2" +dnsConfig: {} + +softMultiTenancy: + # enabled determines whether the operator is installed with soft multi-tenancy extensions. + # This requires network policies to be enabled on the Kubernetes cluster. + enabled: false + +# kubeAPIServerIP is required when softMultiTenancy is enabled. +kubeAPIServerIP: null + +telemetry: + # disabled determines whether the operator periodically updates ECK telemetry data for Kibana to consume. + disabled: false + # distributionChannel denotes which distribution channel was used to install the operator. + distributionChannel: "helm" + +# config values for the operator. +config: + # logVerbosity defines the logging level. Valid values are as follows: + # -2: Errors only + # -1: Errors and warnings + # 0: Errors, warnings, and information + # number greater than 0: Errors, warnings, information, and debug details. + logVerbosity: "0" + + # (Deprecated: use metrics.port: will be removed in v2.14.0) metricsPort defines the port to expose operator metrics. Set to 0 to disable metrics reporting. + metricsPort: 0 + + metrics: + # port defines the port to expose operator metrics. Set to 0 to disable metrics reporting. + port: "0" + # secureMode contains the options for enabling and configuring RBAC and TLS/HTTPs for the metrics endpoint. + secureMode: + # secureMode.enabled specifies whether to enable RBAC and TLS/HTTPs for the metrics endpoint. + # * This option makes most sense when using a ServiceMonitor to scrape the metrics and is therefore mutually exclusive with the podMonitor.enabled option. + # * This option also requires using cluster scoped resources (ClusterRole, ClusterRoleBinding) to + # grant access to the /metrics endpoint. (createClusterScopedResources: true is required) + # + enabled: false + tls: + # certificateSecret is the name of the tls secret containing the custom TLS certificate and key for the secure metrics endpoint. + # + # * This is an optional setting and is only required if you are using a custom TLS certificate. A self-signed certificate will be generated by default. + # * TLS secret key must be named tls.crt. + # * TLS key's secret key must be named tls.key. + # * It is assumed to be in the same namespace as the ServiceMonitor. + # + # example: kubectl create secret tls eck-metrics-tls-certificate -n elastic-system \ + # --cert=/path/to/tls.crt --key=/path/to/tls.key + certificateSecret: "" + + # containerRegistry to use for pulling Elasticsearch and other application container images. + containerRegistry: docker.elastic.co + + # containerRepository to use for pulling Elasticsearch and other application container images. + # containerRepository: "" + + # containerSuffix suffix to be appended to container images by default. Cannot be combined with -ubiOnly flag + # containerSuffix: "" + + # maxConcurrentReconciles is the number of concurrent reconciliation operations to perform per controller. + maxConcurrentReconciles: "3" + + # caValidity defines the validity period of the CA certificates generated by the operator. + caValidity: 8760h + + # caRotateBefore defines when to rotate a CA certificate that is due to expire. + caRotateBefore: 24h + + # caDir defines the directory containing a CA certificate (tls.crt) and its associated private key (tls.key) to be used for all managed resources. + # Setting this makes caRotateBefore and caValidity values ineffective. + caDir: "" + + # certificatesValidity defines the validity period of certificates generated by the operator. + certificatesValidity: 8760h + + # certificatesRotateBefore defines when to rotate a certificate that is due to expire. + certificatesRotateBefore: 24h + + # disableConfigWatch specifies whether the operator watches the configuration file for changes. + disableConfigWatch: false + + # exposedNodeLabels is an array of regular expressions of node labels which are allowed to be copied as annotations on Elasticsearch Pods. + exposedNodeLabels: + ["topology.kubernetes.io/.*", "failure-domain.beta.kubernetes.io/.*"] + + # ipFamily specifies the IP family to use. Possible values: IPv4, IPv6 and "" (auto-detect) + ipFamily: "" + + # setDefaultSecurityContext determines whether a default security context is set on application containers created by the operator. + # *note* that the default option now is "auto-detect" to attempt to set this properly automatically when both running + # in an openshift cluster, and a standard kubernetes cluster. Valid values are as follows: + # "auto-detect" : auto detect + # "true" : set pod security context when creating resources. + # "false" : do not set pod security context when creating resources. + setDefaultSecurityContext: "auto-detect" + + # kubeClientTimeout sets the request timeout for Kubernetes API calls made by the operator. + kubeClientTimeout: 60s + + # elasticsearchClientTimeout sets the request timeout for Elasticsearch API calls made by the operator. + elasticsearchClientTimeout: 180s + + # policies contains policies for the operator, currently only password generation policies are supported. + policies: {} + # passwords: + # length: 24 + + # validateStorageClass specifies whether storage classes volume expansion support should be verified. + # Can be disabled if cluster-wide storage class RBAC access is not available. + validateStorageClass: true + + # enableLeaderElection specifies whether leader election should be enabled + enableLeaderElection: true + + # Interval between observations of Elasticsearch health, non-positive values disable asynchronous observation. + elasticsearchObservationInterval: 10s + + # ubiOnly specifies whether the operator will use only UBI container images to deploy Elastic Stack applications as well as for its own StatefulSet image. UBI images are only available from 7.10.0 onward. + # Cannot be combined with the containerSuffix value. + ubiOnly: false + +# Prometheus PodMonitor configuration +# Reference: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#podmonitor +podMonitor: + # enabled determines whether a podMonitor should deployed to scrape the eck metrics. + # This requires the prometheus operator and the config.metrics.port not to be 0 + enabled: false + + # labels adds additional labels to the podMonitor + labels: {} + + # annotations adds additional annotations to the podMonitor + annotations: {} + + # namespace determines in which namespace the podMonitor will be deployed. + # If not set the podMonitor will be created in the namespace where the Helm release is installed into + # namespace: monitoring + + # interval specifies the interval at which metrics should be scraped + interval: 5m + + # scrapeTimeout specifies the timeout after which the scrape is ended + scrapeTimeout: 30s + + # podTargetLabels transfers labels on the Kubernetes Pod onto the target. + podTargetLabels: [] + + # podMetricsEndpointConfig allows to add an extended configuration to the podMonitor + podMetricsEndpointConfig: {} + # honorTimestamps: true + +# Prometheus ServiceMonitor configuration +# Only used when config.enableSecureMetrics is true +# Reference: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#servicemonitor +serviceMonitor: + # This option requires the following settings within Prometheus to function: + # 1. RBAC settings for the Prometheus instance to access the metrics endpoint. + # + # - nonResourceURLs: + # - /metrics + # verbs: + # - get + # + # 2. If using the Prometheus Operator and your Prometheus instance is not in the same namespace as the operator you will need + # the Prometheus Operator configured with the following Helm values: + # + # prometheus: + # prometheusSpec: + # serviceMonitorNamespaceSelector: {} + # serviceMonitorSelectorNilUsesHelmValues: false + # + # allows to disable the serviceMonitor, enabled by default for backwards compatibility + enabled: true + # namespace determines in which namespace the serviceMonitor will be deployed. + # If not set the serviceMonitor will be created in the namespace where the Helm release is installed into + # namespace: monitoring + # caSecret is the name of the secret containing the custom CA certificate used to generate the custom TLS certificate for the secure metrics endpoint. + # + # * This *must* be the name of the secret containing the CA certificate used to sign the custom TLS certificate for the metrics endpoint. + # * This secret *must* be in the same namespace as the Prometheus instance that will scrape the metrics. + # * If using the Prometheus operator this secret must be within the `spec.secrets` field of the `Prometheus` custom resource such that it is mounted into the Prometheus pod at `caMountDirectory`, which defaults to /etc/prometheus/secrets/{secret-name}. + # * This is an optional setting and is only required if you are using a custom TLS certificate. + # * Key must be named ca.crt. + # + # example: kubectl create secret generic eck-metrics-tls-ca -n monitoring \ + # --from-file=ca.crt=/path/to/ca.pem + caSecret: "" + # caMountDirectory is the directory at which the CA certificate is mounted within the Prometheus pod. + # + # * You should only need to adjust this if you are *not* using the Prometheus operator. + caMountDirectory: "/etc/prometheus/secrets/" + # insecureSkipVerify specifies whether to skip verification of the TLS certificate for the secure metrics endpoint. + # + # * If this setting is set to false, then the following settings are required: + # - certificateSecret + # - caSecret + insecureSkipVerify: true + +# Globals meant for internal use only +global: + # manifestGen specifies whether the chart is running under manifest generator. + # This is used for tasks specific to generating the all-in-one.yaml file. + manifestGen: false + # createOperatorNamespace defines whether the operator namespace manifest should be generated when in manifestGen mode. + # Usually we do want that to happen (e.g. all-in-one.yaml) but, sometimes we don't (e.g. E2E tests). + createOperatorNamespace: true + # kubeVersion is the effective Kubernetes version we target when generating the all-in-one.yaml. + kubeVersion: 1.21.0 diff --git a/packs/elastic-operator-3.3.2/logo.png b/packs/elastic-operator-3.3.2/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..fa70b78daa45585ec0f802dfe637e4ce2172d6f8 GIT binary patch literal 5810 zcmV;j7ES4iP)) zEw)vQ)`8Z7U<(>65YRj(4Mo6Nreakf33Yf32_SRsaMt@Hh#~jfCBW^ant1RI-2$F+Ls!$`IZMeGSXJF1;$Zc-LF^Xx0Xx8|Z+YmWN0# zFa&7fqWH}y&!gsf>35{eMY*ohEDb<6ruRVYNvMnm+IX!F^fj=4BUwjY_gGiGX;ucH z8`FDW>r~(}z$Cr{tih6e>0P-j;ku*HEDS)`(2~~v$-rdX9p)R#EBLHirPtwqC%Yp} z-T-uci}S&L7RXF?Uuv)))qA9G@R?+GqRAS7D#C{JiJ-p+e97)lRD}721J_GG_9jPt z6GT6vEtUS6z~#yAON?wr`vWUk>z3c3|N1A^r@I9BinrIFoc8>H3y_pDQ2{Qn_vcTFMsK_yJg;sgpdN?#*?F z;#zfV@IQd^%Q(83ifra^puY@YpO;EJHGsV%rk`nxJp&;t4ly?H%MOJ%KO~6OtUS8T zUkX@p=txywl&ruQFBN!Z02L#jzEOlHfOI$Hsq#Oa7EUrx zxft0HQ6`+_x}H=+IRRhjVXwryY5)}@o*IDgsGBmsLdCZ(vecaEg|3uCxklIf&hw`C=P3mIIJ+6y%Lx}j(#u9q~ zW&KeH128m~;lDb=byMrEZVGhk6X2<{Le<_FS!$a83Lp|6;m}w&1;%Xv+lS3=4GeUl zFVP4eZc+Kq$YO0CD}b7)UhAf~xD6mJ{XlQP??PXq@yRJK{p@h{f}<0_|MF00D$~!+ z&p_M;AVNqeKq>&3gj)H5$xtLrmNT(Ein1_JD(@ z&IQyExdYfdJ%EuItF0?y+z=wL!VNhQ*pZt+&C~-JiRuY%h;d~GZ~SS$3I#%MgANoS z8>NpMvMn5fK+r}Q^X~=f%CUA=4B%)i|BFZe*gkA_Yk%v*{jkG>P{~FZ2-MeK5Z<4D zXjAoqsu)0eyV2(+KtzCSLrBQE0KKxn+I?i_>BjiZQe_aL*}!+}cuDoGb)57KJ|C}`gq)g{m-52ErlWte0d`$B{XeX*_6G)mW&>w){GP%$9>CfV z3A!OBJ_Aq{9ze*KdM^XJ%)9CTfJI0D*m>oXZTvy&9JMuDMFxuUR>VVM&U9(yYy1d@ z>uwZ_mA)HF)Uh4p4Mdk)Mwac!%P6hq^8o0^wEo!gZbP1Jf~=FQfGf-4x(%SX z*w<-C=A)u|TTJcirUbMYF~z7UE+2d97qL8~>(al2=!Z1TGl2C#R^zYCl{2VtMOtl@ zoeMu|%b^x?KreMeSrkfu)X!aG#QmB21R7;H0Q8KYwO}b00>I z00nAw4wuaXMmAKai@aVwHuJdfC*9P#E1}?4pjDFklt?O3#!25mLDUvgW}av>c;-eMwR1n3;zHkH(P`2gp4e4%te^#bX2a68Hq$?8x7*^SycwY_}n-seUd zkrlv+3WHRnz?^nyqwl_%Lt|BP+z8O=g{^0cnm0+UnRa3M*vwJY3v?~*G5!*~JdKoG zNb-mb30r1LL}^;!F;M6Kq{fP}fM8%q)R%wzBiANvjlfV_ypF@t-_s;5MwLM`uP~WqGZETT3 z>)z)a=XD04lf5mMXnFfm14}J)XGCec%BO%&BbzrW6nH?gf|Dc<=h^$uXJ;C8l`7c{ z)Ztfnfho^LY^NIlvGukF3Qio#kE)zgUn7|uLG{XHjo0#{2`AU|r0DKpPDVf#(s z^f-03G$Jo^?~LP;YMHJDo4X(kj#GFdNJm0Hizp2RXMj8dL}n37Z7NVZN3sGhL~Bre zndgp5?IvQTS1&Q4kS~YSTJ}Xp%}s4*eb%XZk@P1hS(OtA2TlbZ0Ev5xGy#+%WJ}-B zs%QPvC(1v{xcsxcQ)=A_lhde_ ztl(_=1ilM05=cna?HE~tKX8HcKDfiNHh*RdbMLGdQ2B39d!d|Rbxt1(Rg=I}yGy4g zs>gdl%mci>Vvo&Ap0Q~uV$3dj;5FF_r; z5kNZ6Dcy(Q$}uAk2q1EO`IwBq)vV}QRCI!!c0fvo=EZzESvRHkBxK(XawE{v)t=U( z7I?7Mnf}jbXPU5GMEo=TdSQ#{EuH6<1i|Ao{taWF8vF8!t9mT2S&>ovYF7yci-6OB z86wsrB|}HVdIkqM zkxR&>L%I{PP-bFyQnfIH`#;Oqoq&i zAJH0ElV|0s(K#e(Yg^zA=`^>rR3IZ69f-nKvBDSa%Ig_%`EvJV3wo=v7^v-R{A!ek zONZsY5^H#R)r}+Rmw?_6oYTO5SEmfaaOoZRSF{G^zUOX5nMQJ#;76qM+_HC5DCh3m zJ}We0d){fgYF2bxTsXuST>!*(DpuKm;gOCVcFcXh|4lKUqS1A}Y{X0kE}>yTup7X- zM6wP$ZfW!Y6k!H|z|GPh z=g}tr*^XAgH(xci-0t$N7q<P*#br0Lg#-U*yiy^0iF=EZ{aEZUsD_e^ri(-91-y;pbe-v;xN*2nGrElP`Q6EU^GOum~p!3|a=fT|^v~_S$ zY{}boO-518ik?M9>0w`RHfW+eVgTz99_!|7H)n;zXUGXvgnza?S$ZFi8jq0dWnL@@ z96R^7GC?|bV4F+Iuj%%F&5B;d1#J!m)8>K19M$SFWeU$22|QCD52F()vdpWKW6PY* zb4oWMb!P2|m(513i+7GWb!*LvYTmt6h)diDJQuXA-+p$%h^R-^97(ZdUR@kBfG%@O zu2AG94|Tn31;dx_7}ql*;4zAKFBJ#?FNO_M|D7}H!#Z2%&un2TWfqCs(21Ml935Te zmM&2k=7Ex>+N$!3^4!xScEV!x?j@U}u4bK9k~1n|Z{isF&vrDGzEWa!RwbX3)3`O^6ajzWtTX<{H60RP*_cBzkC3L>ZNM4EOW_%H9eNhcg|Imf5UFz@x*p5 z4n!9pX8^me?zTyhpSmU=9xfk~aif!ir`ys6qZN4tO}UMz+7Z5QBQwa)cXUkI>7mEK z+Y6uF!q{eh#6O~9Y{rua)14lu2Vr2suCbYs2Rf+o?iu(y4RP(J0z#k6fmv5O)-|3{ z;KR_=aj!XAak)7(QD9jE1s_E0QRQPZpK+?pSh`@c3QywEy~T+`e$}(6$T3fWovx1n zG4DGh13~`)qRuZNuUBA~b?8zcdLV-{yNxjymXGQ2N<>XTfz^HKf~P%j?Iw$EwiUR= zu_k}~Uf_?3?M}Ve89vhbuTa~sFt1mjd`!l*AipQJ6z`* z=Onp;!+-IgrOlwe>bso~o7k`}f^iQ`YL6+zI5xss{l%c>VP zIPYK2qRr`BF76p{io0th-aR)7TeivCa?!|55jFWU+nY)$1==URTgOlly*~WV_~&X? zGZRvv1 zrfTWfI2}B3V%u{5wu^F$qc)f_qq}8Hw!$E)&iZ@3`+7u_>%&ujG&foU*9^e5*uBQh zJEcQ&2gIB${r*|swp0hHG6={9vT!ec;8R=ma;A>2^_+w&29U9&aEypXwX)`fqW#K- zjgGwSEEevX-5QI2Ms$#hW(y3W{+ZBhglBEP?{4z1t#bw9&XF)<4@DDl`%J2%b|7tA zgP;EWxP!nd8&&}iYkskhKxrSNCL4~85>e+?BCHIHxszXydoNa%uDrF(WeZlKoa=_H zM$Wd<{ijxTS)J%2gLGG>s9WD5*Z=!M84TkJ>q_4vqJR_eel z1NaE#Ki!bk$XQrAY*cQ|!l&NI?hy2u3ab9U_kq3xvRW{!+8$xm_#rDAp57+E*hhYB zfvirr^9j(@je1Qi;&_8<(2_Ix`p0$xNDh#r*z9XTXxf`USg+`6R92agy<+0vHzJP4 zMJ0}x5ALNPNyX#k2}i`~rgK2dS+(q^`9RMSI1ABFV{T|Y<+8OiBpBZ znQ{JnYkoE=r@b}!?H0a+IXCrxKdu-~x12TyU6RvyQ8tpFACbf8sW-AasQX!1(@_Q= zs%#VYv3|DHT6LI?MZc;n07=RHgBAr{aLdEg>?`vgyHUT_J+>>ut44`D# zh|NGVo(G8I_OIF=4*vi`%*ipM;ac#9K=eqMCXYt(0D2q{tJHmDy$)P60J|y(v{|CI zZged7asmh_vLap?t{Fh6ZD1iOdJ@KC_Lf~VD&q5(fC*sO3Wr{eSBPr{@Y%q;!yqra zC9m-y>z!f%y`BInEWJH@^%wEVaW#O`sLpUxUZX&rJ%C@ya(yCuwZ11KFfdMQ3m8CE<%ZkOSy}3qKu->Fh%f<&D^{&BAn&AaQ< zR!&9D#Xwmc8bT<4@|m>nP8_guX&iED#q;xAnac`qL-h%-^&}F357Q3IfRA%?Yu$~T z{@z(>heNGKipovE`NVeca|g&A+ZX=hPtRWE`3Rbj1AQ4w3ZD`=J~c@rW{((qKuOMJ zpVa4}hgS`1+rpUdshD#F{kA|SMLU6f3G5Q&Ut(mcxf(`71bk)hj$<~qmzHBu6m z%wfy$;gy{_?id9;pD3L!vIE<`psBrlNZ<%?3{~mAY~fTz?@o&TdZMr5MZ@xSvk#4^u=W+$^BH4*q6k%=Wk zbLS6kwtN~Q#q(zHbrKg9o z1vy`p!3bv%d+yysDC;q-1>O#b{p#mAmsNP!-9|;DFaReqmlvK$NWX)Tt|Hn-(Kezc w4beTet$PsNgQo2$`||K+^70bqTW@UqKfDL0=G%K elastic/eck-stack + +## Usage + +The chart currently supports the deployment of the following resources: + +- Elasticsearch & Kibana: Enabled by default for immediate cluster setup. +- Agents & Servers: Optional deployment of Elastic Agent, Fleet Server, Beats, Logstash, and APM Server. +- Security: Features include automated TLS Certificates management and secure settings via keystore updates. +- Persistence: Utilizes Persistent Volumes for data storage across cluster changes. + +## Prerequisites + +- Kubernetes 1.27+ +- Elastic ECK Operator + +## Parameters + +The following table lists the configurable parameters of the eck-stack chart and their default values. + +| Parameter | Description | Default | +| --------- | ----------- | ------- | +| `eck-elasticsearch.enabled` | If `true`, create an Elasticsearch resource (using the eck-elasticsearch Chart) | `true` | +| `eck-kibana.enabled` | If `true`, create a Kibana resource (using the eck-kibana Chart) | `true` | +| `eck-agent.enabled` | If `true`, create an Elastic Agent resource (using the eck-agent Chart) | `false` | +| `eck-fleet-server.enabled` | If `true`, create a Fleet Server resource (using the eck-fleet-server Chart) | `false` | +| `eck-logstash.enabled` | If `true`, create a Logstash resource (using the eck-logstash Chart) | `false` | +| `eck-apm-server.enabled` | If `true`, create a standalone Elastic APM Server resource (using the eck-apm-server Chart) | `false` | + +## References + +Quickstart Guide: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html +Official Documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html +Community Support: https://discuss.elastic.co/c/eck + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack-0.18.2.tgz b/packs/elastic-stack-0.18.2/charts/eck-stack-0.18.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..afc46c4bc9d6de35939ba3033351fb06b823ac9d GIT binary patch literal 45047 zcma%?Lv&?d)a~P>f{JZbY}>YNJE1(ksmZCJWp8WZ zXzr!1;v^t#VebHT*?aMmfNPQD{j0uWU@h0l!bN8VTeY-&?oNC@byQP3y|tJh-IbsP zqZ@u3sRfT3l3LY42LA)^!~27RDzOved=cAFex1#LjkKl4S%xBTTAYlDqBpi|=*$9S zA0H;0?wJG{6A%g+G)?43@+ z-TA7t^guIbKwoyqM+kpsVF0

g?#LErvxY2|YP|nRt8&PFb#n`k+>?s&sr=aTSGj z=|d7UzRx70`!w9>s~TE=v<$S{t3RsAj z2V<3204zOH2y@|$=*W;84?<07Sq@Oxrt z+=3lOE;o~yg~pIo(5!xmE8z68Cv6JQ75o6rd3k&7`q}S+hKGk$VnD=%*RLQkeueM= zDn)-jML#-CU+f<~bd275L|#5X53BND#P;X$(-E_g>Sh!G&&MNA`FzC)C0I3nf$Z3P zf{G9-8XkUL#R7t|;ctTe_eW4xQWShyh)UlJ6kB3re@J--QlYcr@hebKNiD=O&lE^= zO7<=oyAdGA9}M1Z-_9LUy@Mw9@9u6-kIt4VKt@huZtdQ*?*U;C$>X~RV4Xog;$QQi z;r$fCuYgFZ_(N-C0dh6{6ZkBSz;b={djqtqA`e$u)HJw~fL!1$YyQus0of!(1sla= z>J2fb@^RT(*wgG29$HH9s^$?{HLzx(ZTMJ(AOZ0~Bl+%QI!a8w@W2pIF#swBV zZx~vtOqfoXU8R=T69ypJ{*o!xqPzUL;hm3{Yc~g-K(kL`mjuDx{T<2I`Wa@#X(28p zzuVjUtdE1wHO+Csh|=Btsj`A$n8yk#ukXzS)3S!s5nNc#^CI}Liz#$gYkt6ztz%Fk z0_Sg6x02k55%yxOV?tQ`Mh93ijnuEA!#J9doo-eIdv^S@z(YCLRiRO}iGXPOXaYL2 zj|RhjAOHMH2|pfVzcY~cxtJbFCzzR#?yw;=~}0WhcX2#F1)Vo9NaB*=9T ze7ITE`~Vh-tbyhybsttHMPq3#I-ivPGj7qKfuo~ z@9zQy&CQ%_c9NjU7dyZL%N5H=Fzu@qBba%mf}Wf>xl8xRC|lnB3KYXLfk0+n9PPsc z@7N9U`RTj$7o-#)FV*t}LYW&&`1(41ix`^N-8Y$lU;g--D=0}IHe>KolT>ct#XDaV zz|h(iVeJTod^Wx3D$#^X;5|(d^lHQ)Bpxbob1_t`c!WG35is8*qYv>zyv_R-j4AT> z1?&;#OZ6aEk!Avg5k8PV3aBW*scd*g^hnLVF58qYN@0ZZ*jqti`CCo)UY?8|Zt^Vn zJcJ?lXQjB&`c#rt!>qfGA8j(U3^CP03=LZNd8VZ5EJpcs)ckEcEjdU&5-W%`^a*u? zSaz*=H4mBYaj|O5^5OQhvHkvo6KAf>37`b_^?Gqt(HgvPILN+8HUnmLb&M252W4R! z?G2(l1SR)M>Xk2DVQaq>v{_(JSL{$~j#UBBPL>%_)M&@hlN<81sI?SqU71PqFFs$; z(MrcTlrFzsh|Ucj9sA;5O$W1rRO&+(QkjKkW%{I#ej__4aAcIz&rH?YDMy{P*Mw5= z$Y5eKIV>r+&a7Oene*$!+d%{gW-g?>U}%R{oPGjH4j(!abd?58j(1Gs<96 z4*r@^{=TAi2NIuS&tqX67kFvX0XnUNV&fBjeS%2y1s-AOB%o5VkF(CC)?A0?OG~}V z-|__P10oLgc-*k=BW@&N=t;-`Zd&w#XY>9r4(Z@Wakh75|1Zcpq zmJv&bw>rlGA6$YBTYRIqL$dKG)KP+dPD-Ou&doB-Vq#Nlh^5DVU0o7bsE<=;sjNf< zAib)vzG*z}8@-qcUR(rhDS3^&Ylxxe8m2>6He0k7j9-v#DE)Y4-B4N<1aJv(IccG4aa)PfWYk2N_1zmTLEpi* zhG)UtWSOKXQBTQXCBYN`p*lW3mR8`Mb zt|cK0k%!(}l{@HU--`EQnJJOypK{Ax8FZwO>`DrT&|ii6yAN63T`;b$id@AqrB}gD z>z0JY7kat`mjFEdtEF{@({!|Z6vliL8Sy(w^dc%4Yd6)!e|I|6iDOsUqwO}{sX4tL zsh@SPslU6;s<>t2`Y;n%%YU8?h7{fjF=)_4^7%=->X&Hxn1o6SkKv0zy_JabEZp|PGOxwC|p z6&SRWs*WI;}X#G zuChiEJ!@^OqCciIR?Z#AOyt?5h!cKX7oDxqBgfJ$li3NvWSP2o&;fT?irRE8o)U6f z`;Z-qFSeU)n)}G`tTCeWV`!;s96p}Oi%4GV0Hecn*GdWA{aHKY9jvYE()B4hd*eCh zX9Y-Q@lmyfCTw=veB0ztc}6%TSL{}$$k&(4-zx;4#x9@!)$YyWce!gYJ`vZsqg+pf z6w)YKgwTZ&BYrF*juQ#98ke=}&O`EkayQ}x|OY9oE6RkKgXfKF#Pf-@{+t<0HIXb$MT%CVk+*` z2Yl3xSd}^LtLc}1tjSkdu1x-BRMQpA!(uLU$j{y{wLa}rN|NzlBb%&2hB^(_uvGps z?JjhsGImz20-jsWuhnOVTbI%G)LB^*`WpODseKtmWyLa94mB<9e#XWDgyP7=o%b?F zy8T$jO6$ZjifF+iu6o}0(0mQaquVJAAcmi4laKPP$18$tuhAL*J&~U%Q~7Bx8l_i2 zplZ#Tfdy)4U$wN&W+YVlq}k&HrQf9Yk|?BL|OUjb3O?0-|0AyLha4 zx~atPB*hQGrEcBgP!$ihOwhHTegtyG^OQRNNSh}WkRX82E;+rWFad{)AF=A!iws8I zNi-acZL+VI@yxj}q{-zx#iIg)09@_;qZ0qVR@=5ilq=~g<_x=6)Bac$`FGztj;8;EUI_$<07Zf`N;u)GEsQBAnC#ayDTT= z%12L8{BaBzsB>g3mY0&Lol3mhq_JLyMLXD2Hx2L+$pe;5Ed!2&YV*j(uo+tld&7YtTS=7zJ4-L ziUULcBD6^O#{%hSrn5Z)Z=ckjuduGje=}L zG?&rv0{5OGSo-vF(D3YbF7+c)W{ff2CU=_t7xK}1H6yZ`IT=we_`yGR!X?Mv$4}fM zw`*>|7GeilgKt51)liWPX{`x66F`o-(s)Pc+v}FzFz9w1V#3@IK5F2u~ zQ-km$a{TotnilL1!}qcqyP4ihm~K8pS{b%}sO*y4OqS}wb9uI4I^rlCQe53z`I03( zy)#2W3}eEgE;Z9GHL;ArvShPIwYjUL4M66&c7U|)9>qN^A;^mz=MmUdjsEIla=f5P zT=Z&>WUlpi@5X+9K4Q?E_2vS#K)rnF|2V7R>{@CI?I46b8{(+;=FF~#(NN#DhT%wh zg)~=nM~ApsO(?|;X%YG&y@Wi&OZc(X$8Pn4*B~4@i6DpnTPwsLD_3O%+M)$Ps^~HU z=L|g()I=gXzx>sn;-az)GauLMX)S~|pyk`l5dVeHYD=b1{N#GT%OBk7PW=Wh9y%*Lt)ANlL`E#Yk0Hh&?s37atupRxNu(y5XWwRK zFy*hP^o2{*8GD5fa^S=PycHZvZKj3RUd-CnVp`5SEE721Z7-{(8-k{L6Hq3Zb)0`G zrdFxnUgq`I{)$}Vug`|Ep?6hOLvb(+Tdr(pMO_qsz*NyKt*#RZW&N>>;{j2z2c*MP z{mQF;^C(Ydik2I}?yh*y?Z0`YG>Oxsl#vrzQAG$k3V~mXqh7E2R6%2r^j@#`C~zTD z(9=B&bNB9+FAHSf{sy6fdW3`IlrZ~Uv=fuevArC>cgw9vlEKpaxSYvvXkFkUzy6_r zE#`?zd+~9WaWLnyKO!V$^bPcSWDWq`k<49x_Va;2z*&&WIM#)7ogll$1srx7^E!W3 zt?OxRpiqd{!P2`x@cyy)`}9f(euP2I@aYfTn8~uc^6W^3X&t8T4}-Gk+r=<{oi&9B z@7=D1)fdY~PtV4uUfxx-rz5@9{N5MM?O(R;b>=_;qvkN>BDUY(W4V!>N;)tRIqyIv zCc_|CH_xA~OCX`~mO~I9u>TPBG7b{6)-k|0ErP$qL-bRyES63wm$bDQoT2;vQYwxDq=u6+{7<#ue)Tx!xWJv(BZ3fBj3NT zAHIS{_ZZV@P0(>iZvtdgMQZb#0eCD-J}9K~%6Nbh8`>bX%)3E1@c~W3p6?}fWoV83 z5Nk>^1%s4YF6R6KYmv0ZipK|A%H`wouX>~WV0B1;Gtk1q`BY9lXyEY?)9s6oKKvA!{V9)q&A6NsNgp|c ztLeGbInl6rdy19^fJa=Y^xwm+%46I?%l$G?mN0B-?IwP%$8F0oxtEhEt?m_*Muwdm z$3cP(ajF8fMktbMmglEXGKJAaEE33}>y^{uFE@|Oy3vsH9`lcQ+3)UNJNuRRStAhz z=UMCOG(i`6hMn*EUh>`W;%iMWBQUoEk&vso+AduQJ&5hMi{Z~yJ*4I69~c05J3)M;#@B7@FiO#&sX$C_!Tb6cb6BFminxy>i-&54G87m5-J>5c7v>FNo`aRv>haVb?v$E4w=7X&)h|Z&@W73~gM4*ndcFxmylG^;q z+{+|%QwNz8&O!>pg~K<#nZ2X^rh!^Js{T3=O^<>8ZoBzH`fP8XjW7~}pec1>?v;df zj3Z#v$H5#%Y(MP&GwaeRu4DuTLqs{wdmBfgOkJD9Wbf%X`J17BBAt`WA<@j>g%kTi zeiE|814FZN$8HH&eSL#>Q>wfHMy_r5lhB9JMA>KREEH3W65f^)Zr8iG`nycbXu(fj zug{eN!6)L5`Bjsw)wbWO^j2mzc#h;#ox_WV`y}d43UFBB`qch1f5V8*aGn|(Ph*mw zW)}3HFM?ufo4@1Z7Yi;w&d6j%NOzMBk6#YlOdYkh7}Qilf&n4cZ< z>CN-Lga0s*tF6+4< z2p*nMqDCE^SxAwe*d3ZtaeL3Wv(I}f{MGO?E>GR9Zo>)`0cqS~Aq9Je26ZmJnu0Ca zu`O(#YfxM645T(&Bvc*iFf@ha8hdf0vFD+KhxNJGG~khPSUW<)tB5iPglVsp<*p4zaa7r33y% zd4-Lpvzv=dIZ;5CS(w?`=oVWX%~*Apn~w4AYc-e-cO3)@ypkINMzPZ5G0FAkoj8gi zNoxRq+E;C+ZbK)BwsPvV8Unwxgb?zffv_osWm!h6EaOeUF%C^ZCnFe%clUr0i3K@4Kz3(M;#MBG@APnzDOHF98u_V^T<8H_q$?*N^?k zceSmcw~$KTi03iIW1oK7U1ql>MZm``?`~f7OP|JXM>5S$Y0Y#whRw2*Xvmrn3-A`R z7#Pyl)<{DW-pZo6yYg6ZoaHdvO|i+{%J^&SZ3_Xww~^B!%N(9d>@b&-7q780B%r&pV$Gl^7B*-9}^rbP(-G(;v0& zpRAo9TeZj$371VVdxgiVv?9Q}8i#2oS@0;_!{|%#wAaU}y%x8pzsl9F6G66o)j|N; zzEM-u3jR5Ngf}NoU*F|c5YcyJkLO+F``T1c_YspTGCkLX5ed@i5^AV4bDI5lNS^aE zAI9vpcv{Z$Aig!gyZFTobHY{VW&X^qI%BvwU=ky)=}UuVoa1BV7T$0~(1!v+#94Cv zQsn{)josi@o-7xhk&=wKaw5nkwjfxw?X23U#GF6vE43vR10GoEYw@lv%WLK`*rKf@ z9WWO}WR^a{O)y-d|~`B&Kp*peCj63>Ke9ELWfkMa<>3HkM}==%D3ZcnT96&nEd z5hSk=-M=x*b@vVdZotV%2qe6y`m#}b6`8<->nHU`v_0m}X!PS-geXc0xkCnc-FKb% zg;46>WLi?SW##eNa9wa?W{<({Sk7lCC%>oJ*hx8EtEY&>Y4y~$BLpj*!8>??r^4!m zY4sf2Z>w9U9&tQH2lqLL&%aVQq9GN=svLQrvk$iYzXd|4?YmVWC?`SzD5tNun*gpIkQ(RGW(BImZeN^LhIxy^z>kkP6E@(~ z>4Y;j=*omhp=jt5K|NTiQbBRB!cMhG2W81PV8LxZ+p%*9R^kZ1$d49V^{>cI6CVfP_&F6A9^0^(+ z*lY?PZ3z`Jmc<2Q>usD`rTWi=Q$lJin;6V-QbQ))*vJ2%(Y zfOwk@?L`2^-N1xBIn+iahR&P$Za(@pjZ^)En-#ZEk|4mxCcuVYKwKAL;KJtvR&+i6 z90l1tisO3Vjb=>J%v1hGhnlU7nRSvY#cLUqyrckfbCEI%uT zsY3ETUr^>4fj99o+u<@_CwBo(shJJDuUdaDes7YON^IMgPMlmgJO?&}%y#U+UR^t} zuKMhP^cDglL5|y^PN?AikYB_|1?+PmDXEbE^%AV4Kpu|)QlNh3uLdcPhj;eS7>ISk z^tpN+!1nDA{1-i(`uJtex_Db=GLgDd=4Pv#I;~ zZP%BI5KxZ5-+sTojFXnLPY-rp$9$0DKUL9$XbdDa_i)AEf0O%qK6=)@Ah(wkenXp# zD>6VaQLm~VveU6sQg(Psr@ULjW2vK98dVFku+dmt6@J9x_CPL|*E)D#b~dsF)tQgj zp7`S#cb11dG6n`tSJ@^T_0nB+N-411cW&gZCAig+4eW_AdT{N@*}1lY{1W2jb$ky%&i~gS z0+8?R`#=sb#9o0uMw^E>mqTmUF?zd?JBQ$SMMAeLEbt{st&NX2eoekP2)lW##|icF zE*H-UKMy}PX#?!{su`5f>(}uMemGW}!2?<*3E}?KNg6A`tGsquql9 zrd>;3m3mU;>NoQs=Nt$8#yGJG~NG#Ld8=+*;Bh3?k$SxJ`*P`7hZsD@Nm@?a)dM#BPO-L74T z?g8VFQdJ+12@n=N4r@BrCp#NqxW{qQR2HPyTZsxKDNA0EoC#TzEMaKr{%E+DqCxdQ zv9jZrtct?_>BdvgYq_3&zLsZPN)xgaJHR!pE>@4as5*$h$^ONE94do9c04y$+ zP(jYQ$8yK`pT7;&tM_`|6bR1^`R7p7ZTkC(CbAdhiQ4wgHpqmJgoo(=h5d;7ge5M^PcHD) z@?u2%)OE2wvVKAA@A-9peBmVYBIxlPIUnn+%f8WOYqY(nbaE2_3~iAo-T|)Hq_Ok- zwWIXG54WVEzig_)p4gscYJ*VWq}__F3yzyU9pWmLLiuo5_l4=a79BJB;l023@Xmsu6`Ag0{{&B0s+)RQ2@HfkfKmpHmzzO2 z*PlYfM=k)+NvVe%QjzXUTvgD{2A&?Zr@`SS)ywYj`tEizf9%BB&Eu*Gk~kfgF}8Bp zDa6RN_nIhVrfmc;M1qY~Y^k{IP)lo$Pe{_mF&0L!HfB464@fz81Wo(b%0 zIx^P2+&>!aC|sy%lwi@g)naOP*CVZXG37YPmi{!HQu{2f^Nj{Lq};Lt>nIGKCl9sR zan_E{sF%exY)juj__u7u3KUgjDK^Y|cTu^-BD&X600Ndquk?ig&bEI>Yj% zfgOnGDo!%HhgKhGpBF^-Pp?C%7`$sCcR&(VH`I<+USfdpXpdKwR7_v9asid(hs-IC zN~quqb3GrJxJS-t`ZqI#1ES)izz)7w)+{^+-bZksm4XOmBO1SN^>Vs*&9<(%eCZv7 zU1!$Sr49)1C_QCf(ZXFDKgDw~8S!7}qv!D)3NT%$*ScLi^tVEF`}7^D<$-=qs@oq( zZQu2EyxDVukitW#;y!ju7E(&K-)=~WNP5Z+ekZ1T;a9UgvldXX{BZwG>LoDqZu(H( zK~5U5Rk5_VvU{0#=HXEelk*H(_$SMFc>1#P?p%Q)Je@^ACr}$TDygVh@bF1QW2a>X zFyndLRB|PeJRds|g0a@sG2O#~g6d%#;9qUsG>Y(?F|EQ^J-+`pSHR+Ne4u4~#DI9< zP}jAV@rZ=~#KkBKgtW6}`iq>rzjWlkbou32@bm%l{}Y7t0W#+%V87}QAB*_U4pkx; zTOjhbtP`E_4PmkA{GMFd%{+QaTp{#3wnCr2QI#TO^OYj{IZ?o45R)}mGY>etltdeF zMf7fYHroU%Nhhwr-P%C`TUPD}USGt){0><=7h*kkE{DkDjS>7t9ra9>vbT~4zQ8f# z`e&P|BI9QwcmUf;Juv0kRS{~zKqg-Ecuhcf4P}|*_%a$!xl!=_bs?xgSgk+^mbOfa zVQ;ij%kO#+aDv+o4hq$imI$OQ;eDWHy&)?(2s;Op1BjE{gICZRkBIv)0sYFM2TW1@gdDtGM zb!;jcnolcIU&*fELJ>KXssV)lC#6DFWGE)-HpfO1Y#GjBYMSew0K_LwfMsfbIv4o> zV174G7VjP6!$E^F7cYFYnAlSpKNtt4Aw5>%MrZgNq2~%)de)V^m(a6Jw`C;O_E=4s zs<$%Z_;NquZLe=&4PQz7Qy<|0f3|8~SJUVJ5_vzpZ$GfGKkl&K5ASOp8eXixI*tfeV2MDT#mdu=;|{@_lvZw^FVap23De)Am35{$*6EAjECh_P+e%^~u$(n(emi~G@9*%WbD1o5yG@3nn#go_a z;D58Mc@3=#sE!)vae{q!7F-a=RIQzI$Di>F^_;5 z1Bi?IWXHYdF1hq%>D1Vun@&``QYKwC2>c%!-^VJ>}c?vWGJuX+| z;QpPbAL&NM2WFWcoH7gATdou%s_{|@#wyyhhyE+ma@%rr|1QK;trV{J7PViBi>fF} z`}@x6YE`kB*oykh_?C0hRuIUwfy^@htm`-dOE&*k^h|(Z^D0Z=L)lzY58&6F_g8|_ z=E9o%1-}aMGQ<1dN)TcD0f>n3`VvHR6czrBHzcJU+op7=Iu%tk0OBx0{n%Pk-JSaV z6;&nu#6ps`1~|}3Em9yu1m~Ke5pBO9_A& zzCskSt)!7G*}5O}=K6SNX0L=fc*25DRWBHV#>3JPZXBESIkQEw?3P`Sh(;;5a7X$n zgAF)#lNBm7L@bZ$W*A~6!35jE{gW&9_oa~Q3hf_FL4c8tLZ$YSC>}sn?m*q(hU|@k zrVz<VBV!nA#YrSmInr*I=UWjHHN!z9d?Mx%2yCVm(DD{ zEOH`Jx~Q->U#;_>j2-|*Wd=h&mdHCxIj4%f6S=O?{qI$#+52A^xNUI*OqqWFm#Xpbu> zfDr=Z61mCdNp=c&GpsrtAQDRt(Xa2%?lrR4XCqX9sHfo6PRG?9!z9SgEYSCI%R^;Y zCHHzyK7x7-r6_}c$q$#umQY^B&v^9U=9x71-+sO}-K$*ZX;$Emu|W`@CUm{bq_q9)|ne90^~Ui&&}clfmpo?X1%5t4Vc zVdMt?*(nNII9%z}b&6N8~f()reO$L0m?nq#-v)3#%^M&-6**|ek9%ismC?Fz@7fxDgTog{)$_BQZ3 z|LNYSSP2Y6_2+I;g2MYQl~VRIh-$dR;1dAr^*oPXi-9^yG%nxflAD{#9-)6UD>SDE zzTtU|Ho-ID%0Bh>XKO=+lTSGK2!}BR9&v5@TEJ4LH3BCqYpSdP9&Y)xSOEw)+!O6# zCMgPrGiQ8HwgO-Sq7l$=`|W4vcV}l+B*S8paW(v2*8+(tQ;Z~tf$mHvEq%bTuT-sC zBM$b#GYg%}O3?*>vW6IIp{%_rYatbcFD`61tSeB1HS!k{!lYc3A-@k}Nh!*wRdO|T z5$>R$n*MD;$&qY1KlxWBuOJOs+NXf(f8)V%Obei4wqUm@LE*VyswDjjWZd}x@=6>t zJS)jK=?s;eAc^+({rGuY*3F}(!s+_ssY$>_Vqu4fS3ylRkdZvPPe<1Wof&>l%{>m9 zM_A5~j2}HzyG5+RK~tQ*6n$F3*VCq$lXCtMmnl7X_GEGpPr|qcR;W{$EhsCw-0Kf_ zOs}~|Ae7O8KEq)Z$q|@=Ym(I(J2`9;BNeGHlL?yA&!1o#X#?_#QDAzOe1iB#K(Mmk z+C+u1vXrN#>PKJ#7N2w9^wuTC;lscAQ*?HI=tC3E<<4($?D zyC5`;&Q?jJ zThd11WOrq?X)>b_1a?vyqf-rQvAH)Vl#{Duf;gfxxP5s zMVl}-3c11@tvYkRO#8NDh>bzZCfJ}l?$ttzdeQuCd3Br=i z@_%{QsBJRMVP@lzMX2j~H72596d9i#^TO2ka=1Ni0cwl+3LQ*wrjcOpgzRV_ zMlcgKBr*&eD{~36{8~MCi;q4Z5*`AzNJCKj@0He3dp98q+z1N=Y>7U^)0A+i^Gcpo z{E!QtH)S|7i@ry?z~;*Mpk9H;_(*7r(fwJI(p04H61d&P{2iLs9Q;Hi+JxQk9D1{& zsf6O`g)#8boqlx|ufdw^V3znR)F}X4Z$Tub7HjvIDu^0WVwx>*JCSm5S7BnDgh!r% zgA36m#;UqK*Xb|$*XZMA6)aYp6AUY)Q`h%$lU8*e*db9ct*N$Xcux#gT z2T0o(th<+~Yw>gkc2-kjYJT(A+&b+stJlI5o)8mtAmxVei~oVRNX!1Hi!@Yq((DbO zUBE!VXOn9oK1?>fs{UGR{4MHQ4_RP^WKD$Sz0QETrnj?rHOVol)O;6tAp5VG@Rpa{ zmDxl((hQ@>;F^eVkjHygWlJ~0Bn=oto02TGLia=y8mgw-pi)z@<>C*eUqWK#C(&3e zM>}SZT;K31zr5rr5tvLyN~@983L9L(at(d?t+h1ZOwxeE2TqbPHMG+_1yPE1GZp&k z4}>49iEE%qe0<0mUfc+((Lqs0Bk)v6kbLL){gY)l7HErATj4u^Qm#)>NXAsgV+RGzpp~DK8@v|`mH!Ji zX*5$x_Q?TWK#N$dM96u!4xdz$!x^o$-%0NBrUZI0yT^zPLM({hH?6d`LpEQmLOb{c zqcMM+beORx*vM|4d$MwV5kX@S{%WArq+|V7K)1Q`0A7(n{#$M^GcNdZeO0Z;phL6Z9U7?9fB2Ac zfZaL>$>Y5s!ZQ}s@${kCg(8lX?SmKX;7IflT-pl9Htg9C*FmOh*iQ$c>^{1Bjp(P1 zP}@se`y5@kF_XA)6}XYN-)azP@v^H)a;1rLwF$jY5444y-{JIq-q>5832Gg(Z1|qt z>pp(T0AaaHqW|0rGgTi>9OlxzsnWc5GGTy8+=EHzV_|>Umeiy*HsU{D`B!f-fXr<0 zLC-R9TO1_i@NqMkVgRgw^}3b?g}C4K9DzsrlF+=LHt&J4&>%=)mqt*liR#$|7-B2^ah$blxlVNiWO!?92f!7JASh^XzL zKOy{I8Ni!=RZa%%cU#K@rtz82TFEHZOAAV-DtLv?Gf~pWn2xI!UC2l@kC)mh?wK)I zwB2;QQbywm#+U$KEOniveuVIkp6H~d@EInt@j(?TVBs@C53bv#GmSA=07g$*e%E}R zY+AzFgs!Vsfb^{)A;gmSiJ|Y^z3Fb7)}CH$e<`cbKMszxinfcEca-OmfI$!n;trH8t-Rle;4@|?HXv3g+zU82dk(Y9mQ z{G>pwKc@_X>$}hzM;vm5buLM#A;H0)s%Sb^Y^pBc`#9ktPG@+=TeJZr*7?42C3%*Q zyJv-qG$1juMju&VYaHlhqVWvGgLirT?;lMk12pj#o{f>VNfi_<&4w}pr9VajqC5Vo z8SZPcy;k}uQLe+8$*1P5Hh(A;UX)%Yust`g}Y(&3sIdg3OJNAHTc1qaK0u zIx>=Ma*hD|SIE*HW zCelR`nxc~TrtEo882v4yjw_)Q#|oRi^Om(IL(xwAW!Pi@TK$HU8#H~1%cOw6fF%mm zDT%l^kg`h@!g_I)!t_*_<$jp08t(ciV4l1xU!WMJ9z_KnTaw$7^%O@t04<-0XmDr& z2krTGDq(JR(LCL0kW<9n;e{_V>V?1-ys|Zj;Ah~2QnT`H0B@PcyQ~U@mo19$zHFT; zEXFPb`Wx@!AM@a)DLZ;ro8NO7ZHAFP)~dDyMPy^sM`OW>V0BfE*Uw9;X%N=91g6dbe{M3tO4`#MqVF)f zm^rcBvm_5_&7>|-!SHKjFN?V@)?b=ZXs&EsU6f}y5m|F@G`P(2Aw=r)*TP03`e|!e zjf4+kEQh-n5pwFM8K|9EEb^fuY{dAhoi}q?k~eaNC7D^Y zYJDu1q$kvD^$%F=5ChCltQ1SBG^FPikM_dBGy&BAYQ!5mi$~C*Lw#@rE z%X#7M?qSb4B14<%@OX&gnz*yrb0Fn9P9kl>N&$#3pc6 zjSi8?5o`k0DT>bhXJc@^t7K929z#5oc8Pq6-o%s~L%q1jg{ysfTH0Xn1jPiHZwnjx z=7Tl$x3(p7oEwvZeD98KO%;y3F%SJ;_A7)N;)}xw4?|TAPAreocPCo7_VjGO>bPe$ z$)tuL_M{X7ch$e*3|k?8in(WT8S!?YX!Vb*^VB?|Avx=CSGdJsi_f^H2H?O!li1wW z+#+AdxPFv@L@y_PfkJ0xsh;I{!EX51y39%i--rq_r}P{YZ*7BLRBglLjeIBT&Evf3 zbo2Z7waf*hQAcByJW>9R9WGoJR9=!Eye4q{t$KHSjnrw0eK?jBs4j&5g{jZpGt}-T zzS`}wt}UMg92Q?Q)x1+XYpw!dWabTCOK&Py&0UYj%}yZ!QI zEEit9V7orDW;hJSJ(t*N)Nzc}zHP|x@qc-Mp1(W7q^^-QOhQ9Yb5~@}3Sr)x|KeK1 z=7Z}zDzGM+rf>;&i1BwQFvDsZ3HAY&yaw*m2WpRMnr-=StKUiLldsMSy5qFADx``Q z%gQ)0P6lo@dn-HC8D6SVDU-fZN)`$NoYaH>$$xAW58&||aS=u84e_G&TV~b~7+;?+ z1@x>-S^ziqv8Se%o(8gonYGv?BbAsRRs)Ql{^_?c{@kCK+C)0C=BR9pBV_Zo*>0@ZXC%+ry3fj8? z5SR5J$`K%P6@xz_WvcYWONHrnxZ69I?9y^kn%D6+!#en>c9orEx-3opo{B|tt*W`x z9lW7i{0PaC|Mo8$;v>EOX`GVQe%tIlWUsGiCv2)ZyPUMdDR`H5Vz zSLa`fYD06eqbwj#iZwc5W0Z`UoD=mJJ5K54qGIcnjQJwbi?Gpf5&uN z+XU(=INIGj0y(~e5S0{RdOrJ+@73S>FRW59*E>xtmQ_D>VC*q&J0>9vZ(jRUgYW}6 zkHL)~zxrX_*KPk<@NX|zcL9pwGp|k|hk2mgVg8N@kijN<55e9`E~GEC%*HV|=nw$j zpm24=h3$zn&F~Q9fmD}<{#)}jAs5^CO1OOnX-7noSWxIy^K;kMu=dv|^^M~mc4H6- zIUzp#tsgm}=QRNNq16?+V`c51q&maCPsfq*MVCSLyAJk75$oFic#RVJrc^pWH?3eZ zwqoP_)Y7ZhPt%ZbzMxw*tm7fP11;HynHRqkNq&F+dP6hhIZHBcmQXdv=c@39^y4aH|8p zQx=KX-^1xfUK>O*7k36?_#EV101Ynu<2Ev=dR}*tA8JcL9#o%v(V&l#*OTyCO+rIx zhghINlB)GExg7wON>{WB{=lJ8rG8R7&Qrwr*>QtuP z58J#;)=$xEFY1sI9EVELV2iTsQ?$V77WLx(_1eVRcAD2bx)Q#G3k`!S@Q8_hTGK$l zFWF>`ASem!^?B$d0|eY-C0Kv9*;vLOznDjz*A?Y6{q?z=`b*Z9&^AgZwxLk>k(@UJ zYc%`}$u^-t2qn?uUFqkqZwAP;IHeoa2&@^q4vU!T{kCyeS4dONbG~vJ_J-k}4Hts1 z%v`-e&z02(%aS<)_NIDRYGx8T>}(Y5F)wNicad%vu-kLP=ji+C3UnpFA1r4YPV03r~|0}+kjCS-qoS9y;2 z_~LLFNzcJ+2}Z!pH{@BZZ_t@5?tqU~L;FY>!MZg@vFtcf!0&+x6P04=+2zsLI;Q) z%{yf$t^$QjNUKgCeKLgnFrWF)P~Fk}3oO3IEAo}z`_HkH^M`zmj#J-ybyPPie^G|R zX19b&SD>tj#|mAgffxI>DTRAQbRrVFAdaH4$6)82%dakRs6DrUaLt}Pn)V?H1l*#k z2eWw^f$yYOpN=f({@%wcsthQ7kNcP4`E|1(EE5(^oSrHe;}YPD%)_S;9^v<2fPdzv zF4e*N$*C&1kA%}Oxmim6%e99HpWhvJH|gg~Q3S|w4)48STBfg%Z4|mokN6*9U%-9_ zx_!0oYytTvS|RtkxGZ8wS+*-^$I8gKGJ~j{y}yAQ7?4Qg%PWxaPUk=t?aVf+0gi_QczRkd0=Ntrs2q?8!k8#hW(xA#B)$d=Vh1M=X z8UMiwyaE0%f}EG2loFMHfc?bjt7iv@_`rn=gK5U%8y;l{_50n`RND8V6V0&ZtbWYa z7kZV}jtIr2RE!_5YL7FEk`lpS5x&*+O(d|^6LO(e!6+AlH?{wO4TLi{23(G2giv|; z!ZS8Qdg#2Fv=ENyotbZ}y{C|i z``MhEDS1ml1*@#_ZTct`4$jJM%nI@wVPPuv6lAJO6;xhoG(jPB9|daP5IfiZFmg^o zng#8eE!*s}tIM`++qP}nT{gRH+qP|Y+2%KO{);m+apqzo@@hxyh<&v)^Ld}OWCi*d z1z~BAkP(@B(wPS=O8oNnX3=FM!idBk^4`7ISrz^)h zNGH7@6Jik*_jM1Qu^tVBeVqbdMM{bZ$&;<%r4}Vr_7@X<4l1I>LgR}sBtOikurk`y+;;|vM#}yDb)IkcF zi3og5>sZPKuk$c;uLrglTtJs4U}|8~{jH4zwXx(j%n)&@C&U_#I+A9Oe}^(L`CIVo zw3FMm1&qjo#Zy!(m&7?+p7pZB%4CzR@-1bX-%LDJiDzwSr!cvQdR`xrLR7D5aQ@%%>uuLS@d0d=jgP1)FvDh8kPw@9rV4=qi7ZwLq8ledB0f1qeB0T4NMZcyPV4L;-5%*zRHyuZ3$g%$`mENU5O>2vU~CD1uO zJVL_&f^p%q!&|aGwhQknPl{!D09HR6KS z{>%*>XIH)fI?`UK=id?|UMxKn=2R-hV0Lcs<|xExcTn}cJ$sb5hInvM6i$zz$`8MIgo7ay7PWS6=b921C`O--&=_WDmS?uMzQyy2*MV z5WLsj3cEIR7vwjTvA>mxB#r=dh;4??8Od8PpY>7GoMu$u0Prli(|RPQMSG`%gL(hnBiF@ zg2oc(iHCit#~y;=L`cZ;P!(2UTaFn7f*GN7)>5{i3TPg1-}D%JxROc0&8w=FX(=+h9^V<7Ra0IXpB;OUAjD*I23 zqA>Hxf@I!_SKT-bU6gw*NAmZ36vcGRsG-_Uj3g@fnm6263QYO8-0~;4@-PONrqYXI zuf5+WJ#=OB8cbZ&r7~>Hd$If0&Bc1y_v8;|jSM+2VLt-S_U_N}1Sp)pJ2esi+3(tk zzSx%<)r-kafeoP}x@yqPmVi)99)#93u=+UIknVAc`_^+Us%MZ0602B?iUei0Ca+!Y zn_CXysBxPXbD(;}1V1{YzEpWUq{M;?dnh#H_4CY(T^=7Pv1D=)4h9bg3q3eUlU~m( zZdv@C?jL8v<;DF+7D-Sv_G0HLgdmteZ-baC+UguN`%B4V_U(655_Qsb77STbzK(pz ztwn9Sga8OiPMd4lK(~3}zd1;`@sy@xVV+NIqNZ~Iu%iJD- z9ITLMLj4Y!8VmoM`qBxl2_ka#cQ3h|@jdUW_DIQ3$~-7-`1kg3X^f69G1XU5Xooy! zj!z;S=AYj8#nSJ?X^SK!LsydIP*%Hunz{|%LYT~N+4*GW>}@bf!M7_#G?k9=3H^9* z%*iYP^~!o)pJpre!1#=$5m|vM^>zFauWs`AF<*H?9st@ZezSob%?~DKG-(I^GxPu@Q&sed3@Rr$LfR{ zVa?hS-lRqwaw|LdT!z1z=k2mBG^{@DFbucHqJ__J1r&y@}vXKwRb7^VI{q8&C)AEIKe>Hbuxb&fs* z6`&}jJj|BAgmkbWc6V8Xpns%Q3!{7CgQ+@w68O5V1)I##Q^SyWD}vw0imob#$sh_5 zul-nSon@|l{d11Je;BV!*>UUYP{}dGIaUiE<(ZlYAmIUV0{#wQj+555irX^qtzSd1)s`36E1IngQN}^P5R+`2Se+@Mmu_Ao>;!Ox9832lyH1H0EyhjHp z50-N-FWWkEPt3FwFsLiQHduQINF6K%_%3e*#f-lth!g{w8N#gDewB?2sl*PHJhb%o z1etykX{H=(igkF~EUcNiz+l~}6b~#)Kf*PJq4>b)AlfaI=m_-Ox9(==63qk^c|o}A zs+*9@R!5@Sz$y5InM?;wd0coj$^AJ!H19Lq+i2DOntPdJbAp)3X~ufUa0J>%dgKbU z=_6A%W^p-_35MA;HLJ0RkeuyOZK2emc~1px*HNxvpD?@2)~Ci#EEPL9VwT8zQ$QTc zY@d2_5;8+?~zi_^>appI$lqW}&pmk6H%v|4*}S5imQ`he;I(9ADMTPNE= z!)B3+PT&U-N>8cSKzg%%3Y`cCaZv8l9C{E0^b|tC=jF#x$uMGF4ku9m-#!qFDuON3 z{Wa4odQm&(XTa-oaU@Mh^|}bNXm71i(!-_~pL%Z&!PlnNc=$Si+1$FVLNo2(F589Q zPV+k2?{bBf`9|erl!BOMzF*Y6p5LHMNufPXl0*dB$x4<^()nm(4%_KwjP)&ZDUXJ5 zIJR6cgKNRd)VTc~;Nv7)C^ko`tcwJwSfxQGU^cKsg%$c0M$3NR_){`eoLJZD2!8^9fdoLpfFDVkBR8Y$JL}D`=|VWiB&o76u^Mn7zvet;`T@ zg>|rvnbHO5K_ zW6UGA#D1$30OQfyzI``pcx1|+y8k;(?WH;Q>IHC>)MvW}C_GFu`)=J&`k7_6LVDUI z0ch8_Ixp>CvcIa6Xs(=kzwVrS!BIaxrav)&+D&&_pX;GihFVNA?yx*dSBwQAAtRzshwf2+IM)%>E$7BE(UC+p+??^VY5Xyd4MtG z*%_4bE9CeGQnn>m5+BO~SDV9(!=jQs?2HIGnz=bFpOpD1;q>-~?B7y%NMPS%VGlbz z&ep9`!=h42R_I{E)!z2A+JfWzRvubA-|DB~(F^@<4V)H>^%5cV^F`MAtG{=Dq$A9RKv z@$MI37N_lYd&Ie_BgOcMAz_$Us31ID(_~x*&61jGEXv54Zu!>}1oWpp4-Ymk*5mc0 zX*ot<<8}4XH8?0_jaM1xP2lpr|MI?X^T11mp6;JEMLdWt&0U}Me3$DjKy$(lFW6AY zm%q!_J%A7E`m&ecXr1^wc$>l<{!2kyWfL;6?55)*4pdS93=mdN*s=z2M*yz(0}$l$ zU?F6E6AT`1f6WH-SRe8)wO(!u2~-_*ykLRke#p1x(|v9#@FEUx7e`FY}jO4h9dk^Ti<}_;Dn0&_1q<2wCF-SSFIIER=AJ`Aa>n4`9cB zNj4C0p9Pu8K)fg&*J$q$rzr*Iqok_*oOs0o89cA00HYPtJeP(`F5bT>W8dVNp--;% zkuS>j!F$_Piw*N-1wZ5%wJHi!E`Qi-gA`BuFYIX1nah}z`$Fgv-)pqGHl^EH{6;U= zTkLbY)7@SnE^P#|D{Kjrbbo=uLJGwh9y$z`jUvb_>D>n~rWX-BqS@F+2qSc`S;qjT zC~);zt7TZZvi4QOBu;o>=)=nzDrliIr(Z3|`#=7YqGot#ffIGtt!eVoKn8d5&g{tAgqL)VnN zUg2O!r2|*F#*U=IZ!wv&)>A(}G9q?0lDUOB1)U9y_E3*Ps+-(C5Ob@fm4so<)+i>? zQ@EvIqLH9M6^Ncei-*iqJA0)q9|tG1o4h_{q5_l|!k?XHBsOwd=k-AHkS4(rWh`GHQGsn(-VGqsIuK=QYZ4-aI@I?GSY3yedsALGw5 zt3Hu-j5UggdTgdmKdBG!mC0PAb7$*9i-?QW@H>(+-G01m10#_tT^@s};?oX`FfaD> zc=dc4^sUejC<|lUZ*q93VP;|bD!1DOlvP1!gK$h^c`z3PhSa_~L0B*g8UOo`X4K^_ z=12rN31n>em5_}Q)h3VA42z~nCanqWG?q_9LNpyFlW9}-Ay%Dd5e%{H3WtttnPxKA zs-AGnV#2U^6j{ z@q5L8WAedQP-qsJ2G14U;V}xK=ir^YCO8r<6B-;1rc|B4H-hxn1tiwA0>EHZUl>s{ z^(-8*pM!z25U;C-nvvjtznBWndDAj?R@=9M#ai+&+p|zMXgUlklQ?bam zRC~nO+6yoRW!vFhnr|P7l9}8}C{^{YzmR)BM~fBbGpK%z-HaV z0FfpNRcH*n9XQ_lug~T5Ow(f7!m(k~8AozNByeq`axn8BD;t<3aM9Ey<%E(TZgJO= zHR%gsOP?}sY@GODA<1UBnImVvx)~X%7jy#H%H^<8Agl_LWODGW-J+9dD883XB7Zt% zpxgfL%ylKG?qqRYM!pOxA4$zGTC$Mr%9bfCOt3H8GRaQslP(g8gBVglHkf>A$`ayS2|2yk_#r_|op`z~!?_ra zGLihaY**_#UenZB3q)}BWuShf$Y*zyn5RuWYo=x(EvH~8Y)z|p%bNOMz0brS_Q?~|&j z1430Uq$Qe&1g9314uV*vQ3*XRzEpl@mXy`&=V)uZ&Wa#&1d_M}iu9HL%Ktr3Gtw{5 zzO-Xhjx(R)-EYpl{*U`}9rn&)1XHve%FBAVgUTw95ih^Nx=ju$*>Hi@SLVBzR7sUc zBo?SQKZb4sd;r!wHhDu&v{Jq9;rZ$mbSNm3TiVyG%7C-XRVD=$%ivmIqv6Eq@J^V| zB1CyQ2!!|qp1N8n{MuCzJu(iLHtok?d=qOM`~LQ>GygwT@raEhG(Wl0kOCrbIuM#M7cD~wy0 zS;{@TB|BAKdwaR2I+*Z6HI|*nS_Q@n`n?e!e{x{`1lD<0w{_!2$6YX0UEJ64xsfl; zR1oqT22UtQm&q?D$>!h9`nZdflJPcNj|M}Koq~3xhPCq33unC@1(B+tvkjWAMl`fm z{68IVNi}2{tS%B9jBV_b8AklW;K<`k{@^yLcBkb)7ZD3rQnY)E-zxb zv_{G7xYDYEi()y+DGS;lFAEuW$}WuFk3#|%4#E{kuMVz;(&YG`sw?EX06gYiupM^u==hxjZGmC)!nIFO6 zL52}b1=<`j%U-eaDp&yI7?8YT>?`O{+q|actIV1WNj!##OnV*jCQh68a7M0VX_1B8 z?w{859&=#pfb@f01ZxC)g@1N;mrZJ^XtY4GO#4=LFLSWl16fS7x->?&u>y20uTj57 z7SIur&s0OKK&c$M|FU3vO?BLGfVj$#TUIKug8Wf za-~4uEu713Iaw^D>Sw@1IwyJGFY1wa#jU_jM~=?+tCqScsw-Qu<;S;+Fs)}kNAFPr zE?98@^whKKK#I=xM2Xlq)g92}`>-cYFXz3_{);iHR$D8q)|x7e(B7%S3DCft($cMs z`WW@kL~ZiR0~YFc@-i)_aj@pe0^X=7B@4PShrSe*ac1f%KvQ>G?pM@dB%jRkIV*&9 z^hV~rTA^F?tExjAvpcI?xV5X>wV(Lvy%%_;VxCec2Pjis0$7gwl1_TRK&1ErHag2@ z29k;{7Kc5R#eGDv-J!SfBh(nFoRncDWT?2?ryD7=|78@VDU zT_s{rLuqG$K=Pp+JDkuoI~aM^ZT34bmOl=Y6FG9^(uc#qG$7seDYH&AWCtULJ0Bex z94*_NCck#bcHwtaO@QahYH964%&ZG8Ixr&Gy&StM^!TE%4u5k=3P!i!)M{2Qr)-8BhtBc}n zq=RExDp0;I&BJ|r>VR~Wj+pcA?*7R7v$~tndEffr^GHD^cVD3ld@ggWsYTY3lqbjF zP@D=)Prg|&Ip}nmcE$3E<1g*6JNTnaUiRrf^ZNpB%9&9;6uGGLOxnYu3G}*1IRXpN zkIS3;ZdYOp)l>|e)%gw@@Ou?SuyeG}0YEUhNnvjFBlgtzc5)%cOWwoPQpqX=)XT;< zZ;(_ekEky*6%4bmzGmE&$>V`N7BjWTV)0^H^ipj^C&xB5G2lrx5e`%wLp6-k1u^sv zWa&hZiBI_MpYu)NX$h+yXG+I1gdqXZ(7J)i`HMU+x=lnYI(v`H%nR{S)0*3gC={kD z-wqC~W|M9cfm~hgY5M$M%rR@PJq>M@7;>ils`|?grB^q>_(A%$L(&pX*~#`YWS4q% zm>K!dO;gs?<^G*`1#NxI3$480fXnVTC!EoR-|zgnf5VpG(hQ9c$w>xY^fC|b6eUv8 z|9$vzIdc85b>TE#=(k$+d$q;FTLvQ1a z3*}9(J(_4&Vm?xWPu`z8qW!CvzdVFjVf|396jf(v2FfxyCcT(w&1Xs)xu|_*2zy`a z@o9>fO#ki3OE~n*m2ETcJzt{y&MnVKb)n|6moMeERD*4fAsZHW#>KNk2K;t+U#NcbQm=-s0Q5G5# zK~3XbvQZ0^_90AgnRe@(ELlJlHzn1OGZ^jn=sPmM}uOpiE)Zj}o??rwkcM(dw%VNb0pUe-z*?3h=NJ zS)qEBIKH$O-n{iN+dusZHcPe|iKdyReSD5#+L8{`ju3^Ch@QjG*d6A`5d=WJG4kap z*knz3mK|!Xtl4KZ=BL_UFmAP8a20Q22a!0RyT~q228zOcG&w*!SA1&-jLP3fm&LI= zx-!A(lZ%D4M%BP5lU{gwV;AesmS$@H{s!`L=|6|q0CL$@Sl?}*<4T`IVh{A*0Q!a1 zSaG&6M*MRwibn?%!_mqmt;YP9w(W&(Ggg!td{yPoNs<96Z*cp1`vBZ&0RU zN-kf{=}8WUl+TtWe1X`G>^cs5EAg?|T?@AR!%AujgdgJPec{k3sJ{G}Tct}HBeRr( zCml$r{d~K=)py0!{_5U~-f|gb3#IVP$3M+^E~r+1Yf&2|Ls%M(H6AQ6dgK z>8MDi4!X925_vc@0VV=zpD$koA*wwEX!oeF2u?->kUh$zUn7r041J{vz%q6h=+Ji^sc5p8)<-mL_<`^IGV1@`P%C$}N zVjHg{CJh!iNYEw~DW#HvZ3TD}1?knjjUnClq`8XKvrlColJy=x4;T2U)n}U1_w0^j zZ@>TA#PPj9odBpt{GX&qp@}>rxc=b#0JWcQusR2>u+=0Y zG`+60W+S_JO0USmXpPFYreV5}yy=s=+6uIx-vf%=)g}PT{Ct-8{`MzSCjgxa`c0X9 za9v+fwz=Yt$Hb8QCz{jBS!gXd)tw_^CWk602&4@y_2Pb*aI)fS7#xL1nyM4x{7A$@{H<{~gT>tAoBNDkqG9c)CPm z02!b5YXxNPzm7vSHGd^bH_U!ZZkUu}fSH`^8N5lWE+ITcnu7gWt80u{n+qnJ8+-C@ zcDY2(UFE4*>1kCS48@;Yy^E;xPy7lgmMdJv7lACY-dUXPj2EHATL5v;X;d;gup*=T zrT?NLiNid5Vd?ufW`tD$+s~hJc%ExIeX9li2!051LG>&L3SYkcosiGh5c;;`4@!?g z-At5dnpo@Hls!ZALz9^Tb07@i$cZY)`< z>XMTxD$F8%%;YLZg=!tJ35!2qg05xiy{_`K={VWzc*5T?IYDU{zxHc&6T%Tu5 z8NG96oaV9dA`$ujOPqja}n zM%2qld|2yL2>5}jM6XfJQ~L;Wtuw4>TTYoejX?nXn0tD9u>tp|nras7k-zsqB4q~> zZ&jS?2_WSY@MTxKn+>o%wz>zfzX8;%0IT%$wL3ccyj^kV7ro>FfM@IGDL}hD^AjNZ z4Il^jCjolL0lP;4`~SR<_5XMbxX`y=^LI(kI+baIySC(m7s?gE!3Cjj1w77lY$r7U z%x{jm>H#)~FhTj`+7SP~k)j(-fd~nUP_g3mWh>%$c?hS;6U4||USNMO+;+#UgtoH( z)^9$&blp36y4}P!>#ViELP^3da88)uV1P!$olwP+kUZHL!&2oM*8{g)#(=92#Ga1! z4N=F6DB_k+Jgjo zDD!D$5)9?+bQ;6LZrLiY)!-9iTwplzEJ9bGV+2cTtg6||^qy=mlsUK~9k~ohABYQR zElaCEgXVxl!|f9zsVh|o3%Kag)1Nub$lRm1t!-)Mw z@`vn$6MnjE*&&I`!!Nd*jj;Qr{t%bJ%1+@H53#Sb0ql`Fw-aVB3hccn#S^uMlv_n{ zXWd3ayjVnCob9K_2#cdxW@>m-CHE_rWuOi@ESAA0WM7>UZkf%W#Io$?LaayfmC$dWqn_NrHCC&-rv7TCjYG`Cv=bqW#u# zg+!#ob3q7QNy)!rWSBO2f$8)b(Y6{E8QVxSRntGezCK!4$;r`GX#zf5_M1hqYV_e6 zvZe9wO$6NXLvoas-d*_mc3sEo zS{U>VKpXp?kBK%Q-}`9RJ1$a5wdB%o@yfWvRg+9|-SeCBI! zwT^xOK%et_cVl^7vF}Omv=0Y094tnV5uB-MJ$fYtlLc!98jMx&V!d(0$SBb=M}_v6 zA{n-unoru05K}YjO!2SyZhd~s8a@tA&hLlTZghQmRG7)0Bo+c@=uJUUC$mJdp4J@y zyLU*JyzUO46*l{UN?VX z7TC3ti)`7QH1C0sXwZhy?_(SZ^W6sTt&JVx@U{~^(n5{SGt9Db5lI0ZY08@ekStlk zgZezTkez4&+SERp)V|`1^R1`N+2%ba9UWvRW6CSE3LTz1o_o;DQqYFN@8TCDfx$Ba zauBglIIrNEPKX`$oc;B)_?+CApp!2@b`Gp3&08Ma=b#%ouicz%{5-MQ*;$;}viXRf zY_Z4Hj$Ac>G{IlMllSkhsBd?#jZ^>4HooX@%zB!AXCdGl@Y|gzE8KPehxhQ{3a&M^ z_h?n{1(k+^RiW9j5XTo`g+-Z|1x=2HmTqadUVeO1j(>4qlk z{7Mio)pZY@d4WjKYO7U^_ev#PSDqyQM?=%1aR!RA7{}+jpqNx0r9=WX4b`{d5GT<} zE|kyA#jzs>TQGN$wyX=wn$je|q4qPwhd-c5dj{aP!+pbc?~k*(a>XBi?85utFX~ni zo8S4S=^pvbcefwp*Z(#M34i>3e+8*rM)+X?%{>3krha=&jnh~qvL6WXCoo&sV2^Pd zx72S}s}xa)YF$H_4L`nHUafurAK+|{wVilz*Kc!FTVsW?lvzKTgbaV2U(Ca(tfa5l;|8m@|Hyd`;`k6X>#MTCMOWl!{8!Q7mu67>W z0Qw=eRqfyN!5VC zKjK80s(8WX5RC9RLJk5(iJ*Z6$D)dg#L=xq_kM8e)JZ%dw`9I{=M75@JPAVs%Is3n zTHRhZp5SU3rKhw7yR#_10xiC;?M+qA4;Ez>7-@atHw|QA!CvSB#8F-&N0(}nBz}Uo zLleBG*QnFn?lYe+(^UZ4pQBlR(3gI_&^F+8$3O0Sj$~=p3ExDk$?wpXcwFhydR8>K zP$6NIUup2M8&F|P8PuT~CNyBU{cg09WEI+-L!>mvg;wwyBM)vj+_TJB{ktKgiyX)8 z(hXr^nNLpi1wOsk$9cao*m?9;@g*&`3;BLp3PY+ISnX?kW1YfHl{5fCQI=Zh&+BB>R~+jEt|V)7P=Y4GagcIfXGxB z$7ioKH-px?Umq>zRfNFK^7Se*e%ENHxk7uFbU;H&Iv>UlJQIV71FMF`KF){5pSy<| zM37Y8msQ{4$^NpNub6VG@v`d{tdP=SRtoK4d@pdIt}96smydu!7HoD(hrvu#Xcjm; zvpIiDC3F`^nafs>*Wc-eaC@M_UqCY~sb4fijKo@YlaI+x;fW*o^BPHVO zdr^acjxsFon$NL^YRfo|yhu9Zfif4mw?uL*c1MWo-2NV<=!58QZM`+exsqB@2DMkS z;^Dm*P-$FeT{c-F^g;F0Xa2f00=fp9da0jhRZz-~i!EnoFr#1|Gk9PsEJVG%#MsuE zsy33sS=LLH_V|Z2a)H%l?;uN5|RF6CelB}P#H3);Yso=SSMU8`=m5_xGpod+abU>ADLtxHW;g%CdisfPNH}!#EbG84> z#Vq|5)$X%|$MBO^Bx0)DA()tY1Xt)0DzjeX>{Bu~z<8wvORwrOK{(b+( zHx=P_QCFDMcTT$?*KLV}N(FJPTSw7ycLar|ly$q=YV;*&!Y3{4h2SRoVbDsh{( zb8DxTRrem3re+iRnix2_cmX5^=M0XVKHcIrYcBbv$O;OhoNLOPAO(3OXuD4Rlo1+vbS74sQwt+jO-+ zXLqXx;t0=UMUHHLQE(DAS5k=k+_pfoH6{Rr|W0bFC7F*sOIQ zvq3h4Et7WZ4wP;_RWso{7-fBuX|fNidW>GWIjc?USd)4>v;vn;GmhV3jyZU$6Ci}MS)-EWS zz*tJi;ZLMIbe6r)(YIvju5(-MWy~WRpeiR5XRk{+s7Wi{4H~2x`|**hsR4hIc?5*G z!vz}ekfGkt@GLZ3M8cRQ!HgIGDqBjJayXW*5~nh6^V40O(q?s{MH`Hge{fl(i-yb| z1#+LN-3(BJP%ZULEy~P{C!1Yi5QXC*{bqaUeRs+`F(LR)SGbFsmIWP;W3{=&jrV<) zUm*K{mhMKF`-6ypFxK+{w6g{jzq?O^a$`*0=OCk8eau&3U3ebZVlp%IuI6tYFAdVUU==_E`7>(>FAx> z11)8Mb)_v{$?R@doa%RPX=y1sp!X00U`>rl>XAw_s!WS(7?bvE<^W89kQsYtfzb<> zDDH>`v<;P*oJMktV_!IAI-qHpQ<`DhQ|x%CQ+^TZAaK-UqAgF*Bo5l>jULkW-Z^th z5XDpiWn7~MuV;h4#=eFO@;9dK-`CbjYn0)3i{{b#%f4O-ze?Uu-kZMOe4)hY|A#J-H76i{=}VF_IO_cHJZsp{Uw~!=Iy*EnGe}&EcF952IEWqE7SoEcG|Q z{P*uz06>kdw3;UYbp_M0e`5<+dif+S+%gr}_WGLIJ7Z}&Va^u z+Z;jLPqOuZ@~wUI*|b^(sMfg{0({EKLOQ`O0>@P=IWek9n`r);(<^dz zwI)$*qVsPS5U*RP1kr1~Mtf!KRgTWtE~K7kN9Aks`r@a0gsefo;~zEuU3&cF@8`8p z1+dkTKJ@?eyd9g%13`R~QRL@qm+hO43dq|4_H59|!yYe)s+YO#d}a*0s*1wXRG0%D z5XVSXK^0V@eo;6`35wj%V@X)Rwb#6cjUg&jLOY)8Yx%s5?=sMwVVOC@p*xIE7!<|} zO+3Ctc+TvYeUypwC0a``2wL4-lelWl$RwzkFLzVHAEuP8^X3Z0&st!?XC&H8wJ*vh<-udt89S}a zY>e1iY?nvwqbs8<)pcBm2Wl?7YRA$gS5M~@ z*}#)=*f0?z8}e_eQldVe2;Tn25`TXmBIS-j&ZykWghTmDv>~MAl!)ipy^4!w#MPJF zoYO&oV|iZrCg;JkRgyRW3Kx4BUBEzdepGJ&ZlDkwj2l@DurK>-pvd8N--SMuwv zI^&kud_lDq0vn9PVFnO*1*KsF8!YG&kZ@;kd#qaUdjig2)paw!+4{kk<6n!KjYRRY zY_O2k+ug_=;f465&6a!$B|Bm7_sWLrdQvW7$vcKAO_NG1!H3Am<&Djt+}$wTwo;4<&JD^m_=AlW6irC{fG6^IZ|p zi&}3{q}B#Z*e2tP1JKc%wM)9Nl>=4+zrVk~v=iqzC!>kl+~^g`1ig2BO+lu?vEOJ} z?otW;=X9Vp8Bi&UATG3&#>E+_1LG_JvsIf@r$+T7Z+(W@>eG4*cy%Eg$I#{^|0_1z#!O(u(w;m%ljP zC4*IM-XvJ_(K^N=7fK;xn&?jrK&P{tC*tV%G$ZgDmGWeg#mHn#r9h<~08xabgcUQ~3KJJX2{j1N;0=dHAA!I_PY*KheXECLwjlN#69BhJ-du7q+l=gqe5>tyVQQqd(EUq`cN z8-T~dS-^Dob4PoPZ?^a_uhP>-da+*L1NAu$-e?#jX=Uw&&y8~G+mfT00%#iE<+<0M zA^tq>y3-JB$dAaJ_gy! zC|tc^dn0IZYWA{qf?iVxpBAOeV`i1lOW0hG4`otRP6o=NdVRu-i-@}ZB$c366lp{K zdYDzK)YrBjDHL@T_PXe!gxIC0$^w%Ngiif>RE6HHT@R~0PJeFH&8h-GhWHIO8-2aZ zdYczN?cTU%{rt&w5F-I}RcYjxACZGSm=1;H8y}m0p6TGOR&kDW37x0ct~*Lpg*ssA zm&Kg;Ic7GrG3cgl7JuVFD?QlU#n;9x>TSfk4mMh^of;Q5u%7_3#{9dtm$a3dSgH;& zTZFz}p4p}j$oR_b)0!VHbMZH zD@TiWfTTsK&lATVRX|rx<lsHba z1Wy1&qrISfUsaht58(${Ha_Ss({Tdli7oOc!9^Pt+1!#6Jk|Uu!*It~9F_G+J`8^F z3u5-8K;JLdO=mH<-&WQN!4QpV+o}^66y@F*`66mhIj#{)y}6#bY9_Z|N{QX-7Z$WU z&s;Yd4|Lk9!QPEEAb>OA^88=r7$4K~a{_u#l}G`fJ$vmZ=&iV4qlt>AGOK<>DxKEk z-U%8XQ@zn`{5|a1nqfJE8$89F(j<7sL4ERkvL8S9>7xJ>&RLDzDd@FlnZPKyR_53P zg+zWhW{ohV!^|634bMl+#{hn|XGPOKpO+!oteg3!uBXhI@E4%ll}t9FkmOaKFK;rY zrF$i6WN1Bj)>*6hxS=o)kx9yi1X6sm9p2ZSXg1G*%vk1T_4>|Y#`KuZC(sTrV$*-< zvHS#4vdvu;T;cMy=kKFgK^`fR6wbv#t82hE8i+np)_L|23eUx?{9Qlt0@pRd?oxXIhzkPx znto%FK=gZFe*_&hIcdKIt zQ0A%y4cV7l>+<{Y_C@GEy@l$}_;#3e-fczA+C5DtglMu)y?puIP|gg*sF^$liZAhn z#XP+@HqLp(1*+hVErlkJI7W0#d5WeKS#m?+k!<##Cr_?~uyy5=-vHFgj5E`WB^5Y^ zJR$q~C__f%YaCue_N*oGNk4`8WyID4PvrGs1YYx!w-MWr&?$qV_-*-=C6yQrBreG| zU(WDBL`H^)1PqW@wl<%orY9dqVQilnlnt9%qaCdJ;Grgvk%&^5l394a>zTR zML`)rw8WmUN`{rZRV#-W?$g#UYL!nnK4K*<2=%F&GdFN63FQhO&Hs?cE$EEN=g3?K zzyr!pAjJBHZty$>F3Ib|>C`nO#5ft(9|>)Db()1GVEPY{?#9LE@NsO%AC%^d%e6O# z!(`gA#hQ+Uc8$d!vO^s4XG+}TLp%>4E>fqX(VJX6DlXiY^PFoD;MWG62f~TLG{%}# zBH|ov+k2J_STtwIV2ho>o=z!PL&+15#XDLGom|~K_j!V$|IiCs_`^^L{w?;Nl>1gX z+&Cfz*C15#x&wUH0%#+qEQd-|WX0nDF&t`H?IG17kn=7(U(lw|q!_ImE!y%9%;{T* zLFgwi6x^wxNy1xhH0a-E!)cC{T45kCcFgi6;bN>HXUuVnm9QwWmO%!QjU(?DB2SJ- zoX`p`>qL}FQ3fi8BHp$_@M^Vh7-*zbu?1rnl`lGWnkCyhfxuyxoOP*Q15>&BO=K_# z#yE0K9IBAG$#|N8ej0kFKV}Zxg0Q!79sgd9c%rrwbL2;(EA{RqesImmly>I=SV(sslx9Wn357B3~d(P zQU8W)`9l@g*ne;iD}h4lvm83SCD|x{Lg|S3LG3+DJ>cnFxJ|f>zl$gW?T%F{ri8l_ExcVbV0kO zA!cS~=9ul6nVIdF9Wygy98=896f<*TW@e@sVrFK0_w4WdI-}8Obgt%NOG~ZpzSvT) zT2=2;Z=v>4rN-+c5G{NnFnB}v-Gw0bMr7=T8L#c>}fJI6!!PNSNG0`G^u^eWz zyIWYX7I=KdV1x&e{-92(!}pMADFN@nO(&mF2{R!>opzypcI`ZE6%i4MN`*YDo+Eu@ zNIYc?wPv1RIeX7-B9TZSN|E+JHPvfc5Py9~Md=Oom36|L)`ykW<*-7c)YwP3wBk|5 zJqPVmf8>!2wSpzo6X8~jJ|lF{BKt#dtbCoxt4AwZV3k zi4RBxH?pi7`zmxV*|mI(lm>d2zippB15K`=9?+T(7SNPh^?lU9o%4ph-ZqJk;Hj;p zzHC`KukvPA7nxnpxzw3$_u^F$S$GM4p_XLXxZ4n|@mK+EE!n8$jI84dfkR}c#q~qy zqG#lT78Jy^()f->xZtUm7Qv^hX9QKw2SsyN=;l!fK$ zbc;RMXXg&uXksPk>b%oWT?nvw4{CK~nF0!QF84S@tXXd}U4_Y`lv*Qj)=1^Ut~Gr~ zjWQ9`lh?#_UZ5H&Q?TfmXR-@k&_KMpygJ{hEbq?IFE_IM(TyESVINEe1W}YrSB@;L zIXIa|C!G;46FjFkx-jBzGqowvOV>V$@9Eg z<-_I3cT$(qeqUU?-m2N43CVe{@PEF5_IpA+x_hWu3F^>-soDfHj{Hz`uJE zvc&Ge3khPmFL%21#pJs$hlsdj>T3v>7O6BTerjh5nT23FmhYhnpL_IQ(6oDq=F zsux*fDP;}&r^9<41oFt8m>zH)0@`G=@b~oExRNaw`sha?GNpm4@FP1COMz~Uab= zY5s=akjF5dz@l!yzk^QEg$h3Ambtqm<>L??smQK}T7?Pw+Jg#0Ka%LkB8^yg=*_*P zY?*T5pUeWnJpnEITI#QC}}3&#htLWET~Dj?$97(@1te?qQE(4 zNlivu#W?hwzP!_IB%9QbsQNrvrR}qG{sLmS13Z&c>+%|`TP}-CY|HnA@@*@A zw{J8*4{iJiBlz+BsS~TYGNMqm*gTJGj%S&XT!l3PAf-A9Mowhd5L%%z7kSirvA#1x zOHGd`+qIQAA(IES4Wr}FN!H_5AA5Mt+O{8uIQt>D=q$&4Qq`Ff=c&p&_?_6)L*+|iYf;l4J7p!mme9*Rwx z&DI`O8kC#*Wc0h3HOC<6^GBK*KgQ5|N>VWv>QHIa&$2JqvJUr$1a?Hw+}96XZRq^X zN0Gj0sHc^a<}m z=*1x?PN~e(6GsSgwirp9cWb~UrIv{CO#ly5AX2;=fm<8vcUgc$P2sq^jYYs{Tr*Rk zp-d$MO4PbwpJQXfODXYUT@eqWl~z*)S~&*R=fJ9PwZ5HY__av`QQJ&vugOV6!{0Qy zVSvY5l%M`wfm`Y3(4U++YSoKbMB5mXpsY=z(-8=k;}B0z8#=*XQJ$EpUA*KZ#JNv( zb=-*cs``YwzwrFSrd3FKH=(gNY~mvG<2DWoBu?PhL5A+!Pi)PF&m1H%mC!5#r0L0VfSCeXE*I-Z)K3;fD-}v7TQ0 zoD^7U_@=C1QISPtt^B0R`l!a3~hc33A#x4vD85K3(chD2#Xw zTrFAkUj=!ZXX@aw*CzDWv1u^UC6+VA#JFj>064y(88LkXwSNP89NTVywdsRf06(=r z_zhJ#3TiOFm0X1WB%ZTXSgxH+X}nTWqy-yjc@G$0@jU|yGlQ=68$fSXBM0vyfA98; z{>#yXsDXGRX{Ez_y6JZfQx&D@d?%5kc+$l>-i>%#=P5yvp+ilM_v4XmSI2x9C0*Vs zl@NYMk^Gs`72n%!d|0wW#7=ooeon6DJ}@Rn1+=-OE~gV%n-6ompJp~_G0v$5t_iz| z1`1fuaZL;l;q$$T(l~wRp{;?yty|emCx=dZ-Vi_UfI=*?S>L08nxJtEM*e-f5E1s8 zNnQ>ksn68&<9KKzefqKPdAZ*SF*5e-K1y-(XV_D7F1_;)eKs_;6Z7WSvqxA_0{j{> z$?&73a)o;(Htw3*w^1Df+h|?k)UXZH&xssJ;%N$|@yDm@CPAyj+jb9_)m9I0EU8$! zGtR<0EL(A~&pfR+ufh)vL38q#2eZ<}FJ&r5O0QIR9C`lbyv)G$7XJKoTFG3&L7Y00 zn*X7Gn3&+5Z_BmAu$vxpYyx&?C+z-x^#;?P35coRq?QhdZQ2>24ACA1lJ^#j^g#KK zgfBg*RmhhHPI65ggcqJ0cyrs*-DnO=)l>Is;|IICE=TB*VnodcH0w*kt6EOF~kW0pR{Fjx+*Q>*Q!X}R`k)VW7pSFfsp zgVeEDe9Zjk!QD?Zu8`#D9ZXulk1Kc8;Ux8Z_M5m^Txx6jHxbq`4(A;QJq=d&IXK)n z@|(+a4Mau;{`u&M5}t{Jz|p~If8tctByH2mGu)N_dlB;rcP+N#luCt;Z8i@TBp(h$ zE%H7OeDC2#e;1@m(!0RR?^zL2uMO6d)v9}b#+1a{f!^w$?zNdFojMEY z_`J95JRh*-@LMyk`tF+8sOzpTPv3E9o}UJE;~oN(9N)*L`~h_7b;m^gTevLqQ?}LN?Pt zt1I{O6$?sye zhy1jUaI@_<(uD|m10Ql*a*=L~SH9o-!$Z(fbl74EifWFG?73)9yq%B!l%bBpcea{+ z6bYad2w(7+SvZ&xIa4J@TD{kT7$K}4OdWmb_#}9k@;-|^Wmbh-zjVGKPcn2=giP@( zY=Q#5%VKvd_F<%-ag`DY{k4ui7P%g-SxZ7`ec@a{Of(>Pf(H^GcB)7`yyX2k3(b&dWN+Ld!Vu#(dHp1L9{U-hun- zF`zxwu5I5NR-SK;Dt?vg+qt#*9Ty^`t9=Vzkqu4~95Mj}Lg6kW4yWTq60cE#DZ;Q) zms)t?^7F@8lat0KR^t`anWqsieA$ocKfxd#asgZ+F*s!#JI%pMPyLqP1___S?O~fW zjwnt*vFp+JkvD>5%>%1%rGOM;Y$fsS=R8z{DuoaU|@HJfwS(PAH?$-Hiie(`t z5zd^9kiF;GV8N9Pv_GeK^rmI|IA3znuDwXU#KCQt5ifY1`Yw^Tp1XSzX4aqj!UI++ z6F|I*%EZm~$HLt(;K#I*_6%qZ0A$mE4M(;4H5UP^NgHL(XVH4@=d!*?M(v)ae;w4g zNhOecPspQNb@^QBq+pW+;ALYgx-Oml<=eJgR(vM1GgSkYm4LMWnw$q159ER|H0-{e zmY+P~(emr#qr^*>f+&dba)O^JL{sRQ%!GNF(ye*T2 z!aTFoGmD;N(9g z6v`wnx3ft^Zb#tTpJA{QwA}w+h@eQvkL24(L(Y?LV{R|F%~N};MVbAXmx@JU`C_wL zR6e{8Dkme^3{#FfRKcdP3%W*x=uK1sTvW~_idL?$R1RJC=&F}a-f_57pBV;(W}KEp z5usJ-ET$J+IM}F`hHNqh#IlMGwNcc~5URoBM^Ey>1fn&LsvC>xeH_LTo&$x?^t!XR zJ7@0v&q?(@^uSBV=S_`D3*25eBKkgt>|6i1>mI%-f8b4@5P5nnJ?(MnjN*0sIZfyU z1XSk$Rofy$4!1#$2kX%wxa*|YR~^f}7HK1qX3YE2#`QJ}C!o)gStMAH)3G>~rF*ME?* zKhe?QJ}$NlEL;-nfVcKY#`kdhUv!{0W3V`WT5gE8D)`>YXc2Mcx1@Gd5T@;O(pgU$ zU>6UNuV6UDPk!nM1-w*zKV09RZsZ1lHdmGjz}A1jL!Z*@4wGd9zC$~D<@S@`twmib zVpenA!+%lTCDQ~9i-UaHLILMxhkrf)E8o@6g9E?KK+fsWN4>w1+3B{gb`-9|nm&(_ z-CoZkp`pYtmTy_G$nIR(>Fmd6sf13$&AG3n<~dBy=PU2Z4Z9^)I}nCCJ7;wvi9)h~?;(bUAuRv^^C9E1<+U(#PD9=5WuV#`uxvRlRS zd}a^JV+f#$g&LOt`5sJQ#F_5H^22G*7ar81&xZ2+h85O>m#G@|4!WS~slxd1HQmPX zururSL#cr1uCm(ZSob6OI1}#@5Pp8x>tt)^Nd+pWva=v{a)G=&FQ!+(#~j!g*BTBo zEEL#&uuf7c4+&$*Ow``#Up`(_5H$^eeVC%`XKi+N_<@0hEdtB_5c0eHz$qWq?e?UQ zMugLSAB##n@WjKZ_Td@WOMuW>3u1f@3i!Qr4X}Jg0U3t@ZD7?K6~TGvwXP2k5V5%h z9FAF1{!gE>q4drBryukoA_!}p`q35*EDP{EE(6-NB{w1- zcRPvfqAh|4oG?&JiQAH}HIc~rUqn@KNHulF!pN=gaGHIZr;CypF$9DmAVp~gp^#a_ zdt*QAaDLx|tlX}V!v1#r2gwWe-|lBw9vo?gBZ*#WtK-q1Q?fii5$46cQ|G!Rn`!T-^ zk9If81r(E&dD5aGZB+dZYH~8w>a$l}Y(<|zsH~wrmh2$>9ZD|n+=)>YL9_jT7Yg-t z27#ZtGtpBxx+=a+XDTb3u9F( zQkr!8e5Aas=g8q1bD=uB;<4&Ah@eWUP)DP@Tx|u1(%BmxQ#7N9V<*#^$h{~qdn=~( zH`3pPs^JT4BAOQ#1&^2=C%)3mv8Z*uqLKTI%A2q9r{A|XtlAiQMg)>JD%5RS9Dn|k z^x{e_fxK=TW3m*#2xiW~e#0k&P419N{O4tFaZ_xFdjPq%)`u_H!fZMeO~|7gYszF6 z`@8y=wji#Eng(?$?!_p_nc~UUQX$`F$CNZ~C3ggktO|}g0t3QUD^zo_Wz$I`?_qi& z)Sfd^8M=|OqnS6lxtlQt^AE?i?K86YqB-l){wrS+$*5vEx(<>7t}}R)_vFEobMrD; z9lP{*uae`iAovM5Jz<3<{lIKa2=NyhEjOwUBJbrk&)DLO!(29sU!1jP`>zEvtuZf~ z6|e!g*$#ny>Igoej$M61D$+L)lH;hiSC!dm6bu3G8QU@98QVqmT{GxMzb#X!Jb8xs zab++~4hydPW_%$XzO2HibQs3y#o3c{>6-O#QVa&C;ka|ZrL6M!)>%c{jS?N=DMN0@FjZ^z=>&17-DY|iervR29%Z|+ zV=jor$}{;i`zo$-VZWz=AsPfa=1!dBz=%uiN}_0zZzdVo28wdn@uGi|jO^A6B6dCD zxMcHa-9qWJkq{-C9#}owPH5~HOJq4SRUt?C8X$y>*d^{?R(oO?)`&R&$Xx0Q3tD%u z(EJ4Aw&pHYWvx2AM9W0d;=F4$hrKOoLmGbrgerD=?q{a6o@Z*lvVuB1_j<^Q4O9}u-6Oi6>UFQz$Eix( zX@=J4M1?F=r2ErJgW3FrEIynFp}YT+yp_ivxAzukL3RQw690OpIPA=N^Z8&q$9uB) zuAM|sH-Db45Ft6zf8`|YTr7}R{Oto`83|{z9cXXZl_GsveZHP4D-o0gosC>;k|DAR z;TX{X9Y+W6@m7CnK~4fX{Gg4=jRTi$eM2}0lGF#B!tIBwm&WTW4i$a6PyQW!e{DW$ z4ZNk{;J`)R2#~+yk@Y>vH*4~L!L1bc;68C+ee(aHK%O)do#x2 zNtqx@&};TKX4>8Z#ZmSQX*s~SrH%3N>^k1= z$uP7Fc#EHcMKY<(9)zsD1-_i6-vIF)A9ur`rdXssfD}9H;k&7-6jQg;0Ivqd71&R+ zwv89mauzgNjvWu47GuctAu{n2(Y=SXAdl zqbgQVV|rrvE~wJ|PgV z@aO^wj0y^Cd>27q{eE8uf5L{^r!jPm_iG?5^ofbap0vf7p@{Y?@IU-i!jc`;XMVv& z$TPj^ONd2-1-9ys%PZ#0(?686u+i*WSkl7fd2hkB1D_q-M>K@QS_0r7PgcjQMVGpV zoju{u+$VN|mEL+KeTniWDTWm`bfjJ6vFM`rFtCiSea7X$A6~1Tg-MoL<%v-48+Grc z0ZOx{k1~}YYM*Du0CVh>WA!sbv8$Orvd3Qo#J|Y>-dxAL15(&dMfb$x2E^UvrKv0@ffI~fH+%wsMv2;y?E`x+)6++sY;ndD; z-PfPzD)Ny`QHGGHBZctjsf49Rb>sR5=H{Q>`mI@a*}lY>y)zZ>vJ8j-VKcWWw5M0w z>j(B#CCT?U%yGIAB`^;qSY|;Uj`>I?PGT-qT!{-7E5ZZlC%rj?Retpe+sK;NuSbJBZs5(70PK%g9Vj4ZS5Z$e|DBj|DGn&Y>P{5lh6o=Lz0-9 zi2TMJJG)ryW#XDfg25O?sfT&!w7J!wR#;*(^)T%i0%AdqgxoO6kX&|1#Hnld$HAw0 z)e`*0(6XU)K5FnAA$!NrtdpJu8ul0pE8}8l>oAZeHFQa4=~;*0v?4V?S5eF;`)b#1 z!Ye#ODYcs10*`bx9!|QbEseW9u&PG-Kvii~LaMAXPz7B$c}+3R6l-{M@1-4|Tc^Oq ze|*+AW3cUK=b<@8MFz2$rX6$T0u1WrkDrr`k?R@pMS1lJJKBG^kXQ$ZfW;>!&+Q3Wo$8XRp5yTybueze(b`Z#_;y2KT>GI`=z|~RMECz> z)88>ZQ%HTns7IN()tzSZVO*0r+4J0Qx)*<^)D8Th?z9-q~_HASgKMWGOQ&lx-C6+Aqg8pj~q%L&h<7TCjB0zkkynM*ucDB+-ryYPsY)rgW$f*TXI*e!=vYwlj>Qc0mzh|$xnqGP9S}@mQV|L63E``SZ5xw7H8g9KLyF{o5Y|wM(Twz;H`)aI z4JDN&9PaNB|9HQtTXV|KE$HA`I9L?I1yBi#42=2ohf?4$BhEH_nRTQFcR0N|TeN8* z4}_NdQHb_KXP(aB5FGgBvrvsua|-iFD*NRVyzdCsqr}gRn*;NTTn1`3B}l8&7I~E% zGr?|nJ^8zg7?$gshj#AjW?#9LS57Yce`lv!7luFi)FAtM$IQwKq8mWYiR~;KtZHXD zdKka#ZlxVfxrI-jF{l2Kxd~6eQj^Ws*Kqme5gC_m92Jq=%{M>COhs_hLH!(OHnqH0 z>S6rR({xAV=}EA`N`8*odGWv&J7+aS-0!z0AjlyCKAgCR|IFkH+R`9UooPjnAjXCY*q4(HnZQsAaLSh-+{w+J|6ZyIk-xLs_VZD5BiN%bPtfyOH>d344rtjI zc?}U-#c&RP7ZDOZ)43*7CVU^M`TFg>>`UxxEw9DAnFs?+Ak4Z(?r_(q(~91Rkb18e+^>Hp#EPh8bm+49vDTF zRny2Rx5x&7+U=E4z*MRK9y(@=kdVU8c4@^_}?90U-muaxotw*2L6!Vfx$u`^G(er zI=I?yn471JR=U1S{Zmvp!qhej^T8SLQ9DdMS9ca^cqU&TxgnOHeY#UCY#MY8k!JH4 z*PHLGtoUoPvwJZA8Yl0kh^f})^=j2@4+4$1%#Mnl&yCd`1uj@flzRjJLQPJWRIfLu4SWg1pKzCth5Uul) ztvvjOPhnlzp)K+MH^ik!ld4sMfX^0a)Ix4u#HjX*_n4h?BG92uBzg5q$I@uGq1<)eHd-Ta2?& zglk*jWC7B_O9OI7Git?{;gnww)5&O z2;(*Knnsoy#(}5%`{qz!!S1%l@c=5)OL9LUXUEzc%2xJ;w9Gtd?m8_l6B=s1o+LC9 zK>?FP`59g80-{ye3ZYbBlwJ}q>y0ZGoS=U*M^0Ryapj2?X@nB6di;leC%&6c!nixxB^a9#I@oxp2R`R`a4^R9k}>%7<7{RI79eeSMyZ~luipMBm)O* z;NO3s+h2=d8;)Ks0+TG{&q}Zvw9tylkfmb~3;+9aC-Ue2;aj3UMri#TWZQUclYje= zuOhz9tjX1#19MloTrc3_T*;S-XwqGd$hPSe6S9?X$lp0AQmYH0Bi()oPHj1O?JQlf zk;=}>xYpifkgMOE{%JP4#Lb#~VxD;AVj(BtW{@f3{JAinn>lKC8U2c9=g1iqVqqd1 zy^5k6snp{41~~a&i){P@t)y7>2yJk-0Sg~%FZtlV@+tpgj=$HB^4AGUDlfz_Cpkwx zyO&5=(q9Ya9t>vUgay_Y1`uSP@`+6OtMp(`6Xc1<-(m!uWFpa8(gfq7?~j3Y6!nUH z6H@*o_9V3eg>6*1UbN8%v5!bE#o@XU9s8$LNLJ;EJ2kWadJ~J|NxzHXA?(S{0 z8D&{#rBxZ+tp=+1czMjt{+cwFtMtWZq=r%5sPYv1EIF~q6Rs};6oN{JaCTZFoN1)t z{KdDUl5b?O=f zii|W$>D>yfq6a#N-y6Ojx|CxJJ#etIEW-4XhRvw!xl4G@IO*9ce42&JqxYCXo0S}l zz#R5QPVj<9D1U4W79c3wf8-AZHN^jTMAWusQK#Q(-y5^Hef}ZA%ymBO$&resgL?ZL z^5pl*WCUko-Am03u=!**RVU@JbQWl6Qc?S9KwZcG!ibaXu!(CHAB#DDnSm<5BsYsq z(f$xg)zL>7;FlSMi#KK%+QLu4NF-I3ywl4%9Rqs>Rq_0>wEtF10p0fY-W-HXc$0E8 zIa%6Tv0zt1Q#{}L*KBXnuqB|A>!NvK5|_Xgqg>}J1=ICw4IinX6IomQUoXDIAay%M zZ?2_zW%%mJHXK`o^DJvZhEi%;KN$-)_@$n6stl((;N$gUNrlbP2=sh-(1&fF4!tnj}-@#k9mku7= z<0;w4-rtEQ9i%)%(EH&>N4{}KnFnV zRE@PJzm|{xhe3W|tE$yJy5FQZtYP_C%VjvY0@tc~pEg0=sznZ;f$>R~kBp)u^4Zba zUZ>qQ;f*)EZI3Hku8Y9+0Wp*FOU>HD_FQN3b%Vi5k=v^Bvu;lo5>pQJh$!s7 z$c@kR60HoK1&uFKtx^4?DR!B88nnKS!O=IC8y)t1S{GlY&JF9T$XTO}$LQYZvq%3J zUQh0hzK17=DqfjasT0)wz)73YtwzDaIc_AMO3%2Fzcp89xJ){plJe!V>mm(I+pcO!g6z zgFxu){MpY0TDd{j0zH&RMUeP+$uEYIT=ciHuKi-Me@?QjQ_Fb*WeL?+&aPiR&riM~ z)OzgqO!;^X3{G8KTlQO1(w&h(S4RUUxg_a(fJ%GpM-USpE2=>M17fgWXB6y?Md!y> zK_&KJCo-o4O#bI)wX2Vy^SA>yS4QV6oA+thqu>-*fHu#pV0sJxgPEQOU2sq1H`QUh9~p-bt(Q zA31p*egZu$(UE%m&}E|RMA@XOg)`ixVFx7dhx@j%75{}!D=A{1#HLG33N>f{CMoH; zTBT!%Ukw&~yFWa_)8Tbu4QzKMGd1R8-o~{Ze@s{x(UHo|qQK=*gPuPlL|OR8;Cdgi zHVMjgCR`)a;5m5NWT^k0-PrTM)A;@-Jz1(@+q2+h2w1Po6OA=xFJ86ozSB-xLc8jB zMri)tXcslUaU!c-LRz57-8oOZOhcb{yp8s=^rsm2@r3@P{%*OcqN~r9b!0y&Y&qm7 zxuDyvAShosa}Rq$yH}qH00M7jtRVOi{`_x2^q4^8>R&R&A3^k}FEW^DXgixdi$Wz8 zn!IYb$}-sh9BROFUT}Q(ur&3X;agA1s1g+xp_<3uqO(p-1wni`Kx)3g(}I1$ACYVU zeG5llpb@4Q*=yooC*B$=#DQLnc z%1Trp0VztaJ$|s9U_~2ALaDxnXpQH_M0Z6}w*iUejSk+8s8%0J_+(Qq9OdCa2a4mTRZ(^d7${h6P4M4Q-F*hn1-^(Z--}jxq1BckewyQ zQ}y8{DIS9@AD_XBh$_&GGZomm2BRu0cQpbjgIS!B|_Et zMyRyTrj`=wZ0v&N-R+X$NZtBuY`f`O@&U=qYW9QSB=rJ*SAuro z3&`ia0XF_LCp1x2KLJ~@Ea!lsgM;j%fO=9H3Hy*LEV`0`H{HaaeF_ys?S0t}CTNba z;CEl&pVRu5D^+^1zxDrM3BD~#cO%SL=^ONvOd?8&T#+Uo{bhZx0)fCEAxN9r<(DS= zzAHx_hj6mI$~-piqrbuCN_EwUR>}lh&w-u+yOF>5xspxsu0x=IXUK?==+@V+o= 1.21.0-0' +name: eck-stack +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/README.md b/packs/elastic-stack-0.18.2/charts/eck-stack/README.md new file mode 100644 index 00000000..f301bd12 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/README.md @@ -0,0 +1,93 @@ +# ECK-Stack + +ECK Stack is a Helm chart to assist in the deployment of Elastic Stack components, which are +managed by the [ECK Operator](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html) + +## Supported Elastic Stack Resources + +The following Elastic Stack resources are currently supported. + +- Elasticsearch +- Kibana +- Elastic Agent +- Fleet Server +- Beats +- Logstash +- APM Server + +Additional resources will be supported in future releases of this Helm Chart. + +## Prerequisites + +- Kubernetes 1.21+ +- Elastic ECK Operator + +## Installing the Chart + +### Installing the ECK Operator + +Before using this chart, the Elastic ECK Operator is required to be installed within the Kubernetes cluster. +Full installation instructions can be found within [our documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-installing-eck.html) + +To install the ECK Operator using Helm. + +```sh +# Add the Elastic Helm Repository +helm repo add elastic https://helm.elastic.co && helm repo update + +# Install the ECK Operator cluster-wide +helm install elastic-operator elastic/eck-operator -n elastic-system --create-namespace +``` + +Additional ECK Operator Helm installation options can be found within [our documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html) + +### Installing the ECK Stack Chart + +The following will install the ECK-Stack chart using the default values, which will deploy an Elasticsearch [Quickstart Cluster](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-elasticsearch.html), and a Kibana [Quickstart Instance](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-kibana.html) + +```sh +# Add the Elastic Helm Repository +helm repo add elastic https://helm.elastic.co && helm repo update + +# Install the ECK-Stack helm chart +# This will setup a 'quickstart' Elasticsearch and Kibana resource in the 'elastic-stack' namespace +helm install my-release elastic/eck-stack -n elastic-stack --create-namespace +``` + +More information on the different ways to use the ECK Stack chart to deploy Elastic Stack resources +can be found in [our documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html). + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment from the 'elastic-stack' namespace: + +```console +helm delete my-release -n elastic-stack +``` + +The command removes all the Elastic Stack resources associated with the chart and deletes the release. + +## Configuration + +The following table lists the configurable parameters of the eck-stack chart and their default values. + +| Parameter | Description | Default | +| --------- | ----------- | ------- | +| `eck-elasticsearch.enabled` | If `true`, create an Elasticsearch resource (using the eck-elasticsearch Chart) | `true` | +| `eck-kibana.enabled` | If `true`, create a Kibana resource (using the eck-kibana Chart) | `true` | +| `eck-agent.enabled` | If `true`, create an Elastic Agent resource (using the eck-agent Chart) | `false` | +| `eck-fleet-server.enabled` | If `true`, create a Fleet Server resource (using the eck-fleet-server Chart) | `false` | +| `eck-logstash.enabled` | If `true`, create a Logstash resource (using the eck-logstash Chart) | `false` | +| `eck-apm-server.enabled` | If `true`, create a standalone Elastic APM Server resource (using the eck-apm-server Chart) | `false` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +helm install my-release -f values.yaml . +``` + +## Contributing + +This chart is maintained at [github.com/elastic/cloud-on-k8s](https://github.com/elastic/cloud-on-k8s/tree/main/deploy/eck-stack). diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/Chart.yaml new file mode 100644 index 00000000..839cb5bf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Elastic Agent managed by the ECK operator +icon: https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt77c2da6e0198746e/620ac24e6662ca0a6f617114/icon-agent-32-color.svg +kubeVersion: '>= 1.21.0-0' +name: eck-agent +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/elastic-agent +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/fleet-agents.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/fleet-agents.yaml new file mode 100644 index 00000000..252ff850 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/fleet-agents.yaml @@ -0,0 +1,24 @@ +# The following example should only be used in conjunction with the 'eck-fleet-server' Helm Chart, +# and shows how the Agents can be deployed as a daemonset, and controlled by Fleet Server. +# +version: 9.3.0 + +# This must match the name of an Agent policy. +policyID: eck-agent +# This must match the name of the fleet server installed from eck-fleet-server chart. +fleetServerRef: + name: eck-fleet-server +kibanaRef: + name: eck-kibana +mode: fleet +# elasticsearchRefs must be empty when fleet mode is enabled. +elasticsearchRefs: [] +daemonSet: + podTemplate: + spec: + serviceAccountName: elastic-agent + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + automountServiceAccountToken: true + securityContext: + runAsUser: 0 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/system-integration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/system-integration.yaml new file mode 100644 index 00000000..a08dd175 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/system-integration.yaml @@ -0,0 +1,133 @@ +# The following example should only be used in Agent "standalone" mode, +# and should not be used when Agent is used with Fleet Server. +# +version: 9.3.0 +elasticsearchRefs: +- name: eck-elasticsearch +daemonSet: + podTemplate: + spec: + containers: + - name: agent + securityContext: + runAsUser: 0 + volumeMounts: + - name: agent-data + mountPath: /usr/share/elastic-agent/data/elastic-agent-08e204/run +config: + id: 488e0b80-3634-11eb-8208-57893829af4e + revision: 2 + agent: + monitoring: + enabled: true + use_output: default + logs: true + metrics: true + inputs: + - id: 4917ade0-3634-11eb-8208-57893829af4e + name: system-1 + revision: 1 + type: system/metrics + use_output: default + meta: + package: + name: system + version: 9.3.0 + data_stream: + namespace: default + streams: + - id: system/metrics-system.cpu + data_stream: + dataset: system.cpu + type: metrics + metricsets: + - cpu + cpu.metrics: + - percentages + - normalized_percentages + period: 10s + - id: system/metrics-system.diskio + data_stream: + dataset: system.diskio + type: metrics + metricsets: + - diskio + diskio.include_devices: null + period: 10s + - id: system/metrics-system.filesystem + data_stream: + dataset: system.filesystem + type: metrics + metricsets: + - filesystem + period: 1m + processors: + - drop_event.when.regexp: + system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/) + - id: system/metrics-system.fsstat + data_stream: + dataset: system.fsstat + type: metrics + metricsets: + - fsstat + period: 1m + processors: + - drop_event.when.regexp: + system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/) + - id: system/metrics-system.load + data_stream: + dataset: system.load + type: metrics + metricsets: + - load + period: 10s + - id: system/metrics-system.memory + data_stream: + dataset: system.memory + type: metrics + metricsets: + - memory + period: 10s + - id: system/metrics-system.network + data_stream: + dataset: system.network + type: metrics + metricsets: + - network + period: 10s + network.interfaces: null + - id: system/metrics-system.process + data_stream: + dataset: system.process + type: metrics + metricsets: + - process + period: 10s + process.include_top_n.by_cpu: 5 + process.include_top_n.by_memory: 5 + process.cmdline.cache.enabled: true + process.cgroups.enabled: false + process.include_cpu_ticks: false + processes: + - .* + - id: system/metrics-system.process_summary + data_stream: + dataset: system.process_summary + type: metrics + metricsets: + - process_summary + period: 10s + - id: system/metrics-system.socket_summary + data_stream: + dataset: system.socket_summary + type: metrics + metricsets: + - socket_summary + period: 10s + - id: system/metrics-system.uptime + data_stream: + dataset: system.uptime + type: metrics + metricsets: + - uptime + period: 10s diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/NOTES.txt new file mode 100644 index 00000000..cfd41883 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Elastic Agent status + $ kubectl get agent {{ include "elasticagent.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Elastic Agent pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l agent.k8s.elastic.co/name={{ include "elasticagent.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/_helpers.tpl new file mode 100644 index 00000000..748ca7dd --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "elasticagent.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "elasticagent.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "elasticagent.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "elasticagent.labels" -}} +helm.sh/chart: {{ include "elasticagent.chart" . }} +{{ include "elasticagent.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "elasticagent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "elasticagent.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role-binding.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role-binding.yaml new file mode 100644 index 00000000..762a59dc --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role-binding.yaml @@ -0,0 +1,33 @@ +{{- with .Values.clusterRoleBinding }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .name }} + labels: + {{- include "elasticagent.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- with .subjects }} +subjects: +{{- range . }} + - kind: {{ .kind }} + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} +{{- end }} +{{- end }} +roleRef: + kind: {{ .roleRef.kind }} + name: {{ .roleRef.name }} + apiGroup: {{ .roleRef.apiGroup }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role.yaml new file mode 100644 index 00000000..5d97ec7a --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role.yaml @@ -0,0 +1,22 @@ +{{- with .Values.clusterRole }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .name }} + labels: + {{- include "elasticagent.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +rules: {{- toYaml .rules | nindent 2 }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/elastic-agent.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/elastic-agent.yaml new file mode 100644 index 00000000..9017e5bb --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/elastic-agent.yaml @@ -0,0 +1,89 @@ +--- +apiVersion: agent.k8s.elastic.co/v1alpha1 +kind: Agent +metadata: + name: {{ include "elasticagent.fullname" . }} + labels: + {{- include "elasticagent.labels" $ | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "An Elastic Agent version is required" (or ((.Values.spec).version) (.Values.version)) }} + {{- $daemonSet := (or (hasKey (.Values.spec) "daemonSet") (hasKey .Values "daemonSet")) }} + {{- $deployment := (or (hasKey (.Values.spec) "deployment") (hasKey .Values "deployment")) }} + {{- $statefulSet := (or (hasKey (.Values.spec) "statefulSet") (hasKey .Values "statefulSet")) }} + {{- if and (not $daemonSet) (not $deployment) (not $statefulSet) }} + {{ fail "At least one of daemonSet, deployment or statefulSet is required" }} + {{- end }} + {{- if $daemonSet }} + {{- $ds := or ((.Values.spec).daemonSet) (.Values.daemonSet) }} + daemonSet: + {{- /* This is required to render the empty daemonset ( {} ) properly */}} + {{- $ds | default dict | toYaml | nindent 4 }} + {{- end }} + {{- if $deployment }} + {{- $deploy := or ((.Values.spec).deployment) (.Values.deployment) }} + deployment: + {{- /* This is required to render the empty deployment ( {} ) properly */}} + {{- $deploy | default dict | toYaml | nindent 4 }} + {{- end }} + {{- if $statefulSet }} + {{- $sts := or ((.Values.spec).statefulSet) (.Values.statefulSet) }} + statefulSet: + {{- /* This is required to render the empty statefulSet ( {} ) properly */}} + {{- $sts | default dict | toYaml | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).image) (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with or ((.Values.spec).elasticsearchRefs) (.Values.elasticsearchRefs) }} + elasticsearchRefs: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).kibanaRef) (.Values.kibanaRef) }} + kibanaRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).fleetServerRef) (.Values.fleetServerRef) }} + fleetServerRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- $config := or ((.Values.spec).config) (.Values.config) }} + {{- $configRef := or ((.Values.spec).configRef) (.Values.configRef) }} + {{- if and $config $configRef }} + {{ fail "Only one of config and configRef can be specified" }} + {{- end }} + {{- with $config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $configRef }} + configRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).mode) (.Values.mode) }} + mode: {{ . }} + {{- end }} + {{- with or ((.Values.spec).fleetServerEnabled) (.Values.fleetServerEnabled) }} + fleetServerEnabled: {{ . }} + {{- end }} + {{- with or ((.Values.spec).http) (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).policyID) (.Values.policyID) }} + policyID: {{ . }} + {{- end }} + {{- with or ((.Values.spec).secureSettings) (.Values.secureSettings) }} + secureSettings: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).revisionHistoryLimit) (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with or (((.Values.spec).serviceAccount).name) ((.Values.serviceAccount).name) }} + serviceAccountName: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/service-account.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/service-account.yaml new file mode 100644 index 00000000..e8bdf0b5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/service-account.yaml @@ -0,0 +1,22 @@ +{{- with .Values.serviceAccount }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} + labels: + {{- include "elasticagent.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/values.yaml new file mode 100644 index 00000000..6e3fb400 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/values.yaml @@ -0,0 +1,257 @@ +--- +# Default values for eck-agent. +# This is a YAML-formatted file. + +# Overridable names of the Elastic Agent resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-agent'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Fleet Agent resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Elastic Agent. +# +version: 9.3.0 + +# Labels that will be applied to Elastic Agent. +# +labels: {} + +# Annotations that will be applied to Elastic Agent. +# +annotations: {} + +# Elastic Agent image to deploy. +# +# image: docker.elastic.co/beats/elastic-agent:9.3.0 + +# ** Deprecation Notice ** +# The previous versions of this Helm Chart simply used the `spec` field here +# and allowed the user to specify any fields below `spec` that were templated directly +# into the final Kibana manifest. This is no longer the preferred way to specify these +# fields and each field that is supported underneath `spec` is now directly specified +# in this values file. Currently both patterns are supported for backwards compatibility +# but we plan to remove the `spec` field in the future. +# spec: {} + +# Referenced resources are below and depending on the setup, at least one is required for a functional Agent. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-setting-referenced-resources +# +# Reference to ECK-managed Kibana instance. +# +# kibanaRef: +# name: quickstart + # Optional namespace reference to Kibana instance. + # If not specified, then the namespace of the Agent instance + # will be assumed. + # + # namespace: default + +# Reference to ECK-managed Elasticsearch instance. +# +elasticsearchRefs: +- name: eck-elasticsearch + # Optional namespace reference to Elasticsearch instance. + # If not specified, then the namespace of the Agent instance + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating an Agent instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Reference to ECK-managed Fleet Server instance. +# +# fleetServerRef: +# name: eck-fleet-server + # Optional namespace reference to Fleet Server instance. + # If not specified, then the namespace of the Agent instance + # will be assumed. + # + # namespace: default + +# The Elastic Agent configuration, the ECK equivalent to agent.yml +# NOTE: The `config` and `configRef` fields are mutually exclusive. Only one of them should be defined at a time, +# as using both may cause conflicts. +# +# Configuration of Agent, specifically used in Agent standalone mode. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-configuration.html +# +config: null + +# Reference a configuration in a Secret. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-configuration.html +# +# configRef: +# secretName: "" + +# The mode of Agent to use. Only set to "fleet" when Fleet Server is enabled. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-fleet-mode-and-fleet-server +# +# mode: "fleet" + +# fleetServerEnabled determines whether the Agent will be run as the Fleet Server. +# +# NOTE: Both `mode: fleet` and `fleetServerEnabled: true` need to be set for Fleet Server to be enabled. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-fleet-mode-and-fleet-server +# +fleetServerEnabled: false + +# The HTTP layer configuration for the Fleet Server Service. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-customize-fleet-server-service +# +# http: + +# policyID determines into which Agent Policy this Agent will be enrolled. +# policyID: eck-agent + +# DaemonSet, StatefulSet, or Deployment specification for Agent. +# At least one is required of [daemonSet, deployment, statefulSet]. +# No default is currently set, refer to https://github.com/elastic/cloud-on-k8s/issues/7429. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-chose-the-deployment-model +# +# deployment: +# podTemplate: +# spec: +# containers: +# - name: agent +# securityContext: +# runAsUser: 0 +# daemonSet: +# podTemplate: +# spec: +# containers: +# - name: agent +# securityContext: +# runAsUser: 0 +# statefulSet: +# podTemplate: +# spec: +# containers: +# - name: agent +# securityContext: +# runAsUser: 0 + +# SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for Elastic Agent. +secureSettings: [] +# - secretName: my-secret-with-secure-settings + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# ServiceAccount to be used by Elastic Agent. Some Elastic Agent features, such as the Kubernetes integration, +# require that Agent Pods interact with Kubernetes APIs. This functionality requires specific permissions +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +serviceAccount: + name: elastic-agent + # { .Release.Namespace } is used here by default, but can be specified. + # namespace: optional-namespace + +# ClusterRoleBinding to be used by Elastic Agent. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +clusterRoleBinding: + name: elastic-agent + subjects: + - kind: ServiceAccount + name: elastic-agent + # { .Release.Namespace } is used here by default, but can be specified. + # namespace: default + roleRef: + kind: ClusterRole + name: elastic-agent + apiGroup: rbac.authorization.k8s.io + +# ClusterRole to be used by Elastic Agent. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +clusterRole: + name: elastic-agent + rules: + - apiGroups: [""] + resources: + - pods + - nodes + - namespaces + - events + - services + - configmaps + verbs: + - get + - watch + - list + - apiGroups: ["coordination.k8s.io"] + resources: + - leases + verbs: + - get + - create + - update + - nonResourceURLs: + - "/metrics" + verbs: + - get + - apiGroups: ["extensions"] + resources: + - replicasets + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "apps" + resources: + - statefulsets + - deployments + - replicasets + - daemonsets + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "" + resources: + - nodes/stats + verbs: + - get + - nonResourceURLs: + - "/metrics" + verbs: + - get + - apiGroups: + - "batch" + resources: + - jobs + - cronjobs + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "storage.k8s.io" + resources: + - storageclasses + verbs: + - "get" + - "list" + - "watch" diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/Chart.yaml new file mode 100644 index 00000000..a9123a5d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Elastic APM Server managed by the ECK operator +icon: https://helm.elastic.co/icons/apm.png +kubeVersion: '>= 1.21.0-0' +name: eck-apm-server +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/apm-server +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml new file mode 100644 index 00000000..6ecab18e --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml @@ -0,0 +1,29 @@ +--- +# Version of APM Server. +# +version: 9.3.0 + +# Count of APM Server replicas to create. +# +count: 1 + +config: + name: elastic-apm + apm-server.jaeger.grpc.enabled: true + apm-server.jaeger.grpc.host: "0.0.0.0:14250" + +# Reference to ECK-managed Elasticsearch resource. +# +elasticsearchRef: + name: eck-elasticsearch +http: + service: + spec: + ports: + - name: http + port: 8200 + targetPort: 8200 + - name: grpc + port: 14250 + targetPort: 14250 + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/NOTES.txt new file mode 100644 index 00000000..42ab52cb --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check APM Server status + $ kubectl get apmserver {{ include "apm-server.fullname" . }} -n {{ .Release.Namespace }} + +2. Check APM Server pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l apm.k8s.elastic.co/name={{ include "apm-server.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/_helpers.tpl new file mode 100644 index 00000000..d06ca3f4 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "apm-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "apm-server.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "apm-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "apm-server.labels" -}} +helm.sh/chart: {{ include "apm-server.chart" . }} +{{ include "apm-server.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "apm-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "apm-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/apmserver.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/apmserver.yaml new file mode 100644 index 00000000..f3dd5ba9 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/apmserver.yaml @@ -0,0 +1,53 @@ +--- +apiVersion: apm.k8s.elastic.co/v1 +kind: ApmServer +metadata: + name: {{ include "apm-server.fullname" . }} + labels: + {{- include "apm-server.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "An APM Server version is required" .Values.version }} + count: {{ required "A pod count is required" .Values.count }} + {{- with .Values.image }} + image: {{ . }} + {{- end }} + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} + + {{- with .Values.config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.http }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.elasticsearchRef }} + elasticsearchRef: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.kibanaRef }} + kibanaRef: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.podTemplate }} + podTemplate: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.secureSettings }} + secureSettings: + {{- toYaml . | nindent 2 }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/values.yaml new file mode 100644 index 00000000..7443da53 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/values.yaml @@ -0,0 +1,108 @@ +--- +# Default values for eck-apm-server. +# This is a YAML-formatted file. + +# Overridable names of the APM Server resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-apm-server'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the APM Server resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of APM Server. +# +version: 9.3.0 + +# APM Server Docker image to deploy +# +# image: + +# Used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# +# serviceAccountName: "" + +# Labels that will be applied to APM Server. +# +labels: {} + +# Annotations that will be applied to APM Server. +# +annotations: {} + +# Count of APM Server replicas to create. +# +count: 1 + +# The APM Server configuration, the ECK equivalent to apm-server.yml +# ref: https://www.elastic.co/guide/en/apm/server/current/configuring-howto-apm-server.html +# +config: {} + +# Settings to control how APM Server will be accessed. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html +# +http: {} + # service: + # metadata: + # labels: + # my-custom: label + # spec: + # ports: + # - name: http + # port: 8200 + # targetPort: 8200 + +# Reference to ECK-managed Elasticsearch resource. +# +elasticsearchRef: {} + # name: eck-elasticsearch + # Optional namespace reference to Elasticsearch resource. + # If not specified, then the namespace of the APM Server resource + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating an APM Server instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Optional reference to ECK-managed Kibana resource which allows ECK to +# automatically configure the Kibana endpoint as described in +# https://www.elastic.co/guide/en/apm/server/current/setup-kibana-endpoint.html +# +# kibanaRef: +# name: eck-kibana +# # Optional namespace reference to Kibana resource. +# # If not specified, then the namespace of the APM Server resource +# # will be assumed. +# # +# # namespace: default + +# Set podTemplate to customize the pod used by APM Server +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-customize-pods.html +# +podTemplate: {} + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for APM Server. +secureSettings: [] +# - secretName: my-secret-with-secure-settings diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/Chart.yaml new file mode 100644 index 00000000..70f0fbc2 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v2 +description: AutoOps Agent Policy managed by the ECK operator +kubeVersion: '>= 1.21.0-0' +name: eck-autoops-agent-policy +sources: +- https://github.com/elastic/cloud-on-k8s +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/LICENSE new file mode 100644 index 00000000..7be32fc6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/LICENSE @@ -0,0 +1,94 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor's trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/examples/basic.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/examples/basic.yaml new file mode 100644 index 00000000..b41bd6e0 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/examples/basic.yaml @@ -0,0 +1,16 @@ +--- +# Version of AutoOps Agent Policy. +# +version: 9.3.0 + +# Reference an existing Kubernetes secret holding the AutoOps configuration. +autoOpsRef: + secretName: autoops-secret + +# ResourceSelector is a label selector for the resources to be configured. +# Any Elasticsearch instances that match the selector will be configured to send data to AutoOps. +# +resourceSelector: + matchLabels: + autoops: enabled + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/NOTES.txt new file mode 100644 index 00000000..a2eaeece --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/NOTES.txt @@ -0,0 +1,7 @@ + +1. Check AutoOps Agent Policy status + $ kubectl get autoops {{ include "autoops.fullname" . }} -n {{ .Release.Namespace }} + +2. Check AutoOps Agent Policy details + $ kubectl describe autoops {{ include "autoops.fullname" . }} -n {{ .Release.Namespace }} + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/_helpers.tpl new file mode 100644 index 00000000..c19efe59 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/_helpers.tpl @@ -0,0 +1,52 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "autoops.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "autoops.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "autoops.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "autoops.labels" -}} +helm.sh/chart: {{ include "autoops.chart" . }} +{{ include "autoops.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "autoops.selectorLabels" -}} +app.kubernetes.io/name: {{ include "autoops.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/autoopsagentpolicy.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/autoopsagentpolicy.yaml new file mode 100644 index 00000000..81a67b55 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/autoopsagentpolicy.yaml @@ -0,0 +1,35 @@ +--- +apiVersion: autoops.k8s.elastic.co/v1alpha1 +kind: AutoOpsAgentPolicy +metadata: + name: {{ include "autoops.fullname" . }} + labels: + {{- include "autoops.labels" . | nindent 4 }} + annotations: + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "An AutoOps Agent Policy version is required" .Values.version }} + {{- with .Values.image }} + image: {{ . }} + {{- end }} + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + {{- with .Values.podTemplate }} + podTemplate: + {{- toYaml . | nindent 4 }} + {{- end }} + autoOpsRef: + secretName: {{ required "autoOpsRef.secretName is required to reference the AutoOps configuration secret" .Values.autoOpsRef.secretName }} + resourceSelector: + {{- required "resourceSelector is required" .Values.resourceSelector | toYaml | nindent 4 }} + {{- with .Values.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} + {{- end }} + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/values.yaml new file mode 100644 index 00000000..6a48ddf5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/values.yaml @@ -0,0 +1,95 @@ +--- +# Default values for eck-autoops-agent-policy. +# This is a YAML-formatted file. + +# Overridable names of the AutoOps Agent Policy resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-autoops-agent-policy'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the AutoOps Agent Policy resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of AutoOps Agent Policy. +# +version: 9.3.0 + +# Labels that will be applied to AutoOps Agent Policy. +# +labels: {} + +# Annotations that will be applied to AutoOps Agent Policy. +# +annotations: {} + +# Reference an existing Kubernetes secret holding the AutoOps configuration. +# +# All of the following items can be obtained the Elastic Cloud Console (https://cloud.elastic.co/connect-cluster-services-portal) +# by selecting the ECK connect wizard and following the instructions. +# +# The referenced secret must contain the following: +# - `cloud-connected-mode-api-key`: the Cloud Connected Mode API key. This is used to register the Agent with Elastic Cloud AutoOps. +# - `autoops-otel-url`: the URL of the AutoOps OTel endpoint. This is used to send Agent data to the AutoOps platform and is region specific. +# Example: "https://otel-auto-ops.us-east-2.aws.svc.elastic.cloud" +# - `autoops-token`: the token to authenticate against the AutoOps platform and is how AutoOps knows how to connect Agent data to the +# relevant Elastic Cloud organization +# - `cloud-connected-mode-api-url`: the URL of the Cloud Connected Mode API (optional) +# +autoOpsRef: {} + # secretName: "" + +# Config holds the AutoOps Agent configuration for Elasticsearch monitoring. +# This configuration is intended to override parts of the autoops_es.yml configmap. +# See: https://github.com/elastic/elastic-agent/blob/c6eaa3c903d4357824d345ee2002123fdffbec91/internal/pkg/otel/samples/linux/autoops_es.yml +# +kubebuilder:pruning:PreserveUnknownFields +# config: {} + +# Image is the AutoOps Agent Docker image to deploy. +# image: "docker.elastic.co/elastic-agent/elastic-otel-collector-wolfi:9.3.0" + +# RevisionHistoryLimit is the number of revisions to retain to allow rollback in the underlying Deployment. +# revisionHistoryLimit: 2 + +# PodTemplate provides customisation options (labels, annotations, affinity rules, resource requests, and so on) for the Agent pods +# +kubebuilder:validation:Optional +# +kubebuilder:pruning:PreserveUnknownFields +# podTemplate: +# spec: +# containers: +# - name: autoops-agent +# resources: +# limits: +# memory: 400Mi +# cpu: 200m +# requests: +# memory: 400Mi +# cpu: 200m + +# ResourceSelector is a label selector for the resources to be configured. +# Any Elasticsearch instances that match the selector will be configured to send data to AutoOps. +# +resourceSelector: + matchLabels: + autoops: enabled + +# NamespaceSelector is a namespace selector for the resources to be configured. +# Any Elasticsearch instances belonging to the selected namespaces will be configured to send data to AutoOps. +# If not specified, all namespaces are selected. +# +# namespaceSelector: +# matchLabels: +# kubernetes.io/metadata.name: team-a + +# ServiceAccountName is used for RBAC checks when accessing Elasticsearch clusters +# in different namespaces. The policy can only target Elasticsearch clusters that +# the specified service account has permission to access (via 'get' verb). +# Defaults to "default" if not specified. Only enforced if operator is running with --enforce-rbac-on-refs. +# +# serviceAccountName: "" + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/Chart.yaml new file mode 100644 index 00000000..1809956f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Elastic Beats managed by the ECK operator +icon: https://helm.elastic.co/icons/beats.png +kubeVersion: '>= 1.20.0-0' +name: eck-beats +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/beats +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml new file mode 100644 index 00000000..0b1438b5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml @@ -0,0 +1,110 @@ +name: auditbeat +version: 9.3.0 +type: auditbeat +elasticsearchRef: + name: eck-elasticsearch +kibanaRef: + name: eck-kibana +config: + auditbeat.modules: + - module: file_integrity + paths: + - /hostfs/bin + - /hostfs/usr/bin + - /hostfs/sbin + - /hostfs/usr/sbin + - /hostfs/etc + exclude_files: + - '(?i)\.sw[nop]$' + - '~$' + - '/\.git($|/)' + scan_at_start: true + scan_rate_per_sec: 50 MiB + max_file_size: 100 MiB + hash_types: [sha1] + recursive: true + - module: auditd + audit_rules: | + # Executions + -a always,exit -F arch=b64 -S execve,execveat -k exec + + # Unauthorized access attempts (amd64 only) + -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access + -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access + + processors: + - add_cloud_metadata: {} + - add_host_metadata: {} + - add_process_metadata: + match_pids: ['process.pid'] +daemonSet: + podTemplate: + spec: + hostPID: true # Required by auditd module + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true # Allows to provide richer host metadata + automountServiceAccountToken: true # some older Beat versions are depending on this settings presence in k8s context + securityContext: + runAsUser: 0 + volumes: + - name: bin + hostPath: + path: /bin + - name: usrbin + hostPath: + path: /usr/bin + - name: sbin + hostPath: + path: /sbin + - name: usrsbin + hostPath: + path: /usr/sbin + - name: etc + hostPath: + path: /etc + - name: run-containerd + hostPath: + path: /run/containerd + type: DirectoryOrCreate + # Uncomment the below when running on GKE. See https://github.com/elastic/beats/issues/8523 for more context. + #- name: run + # hostPath: + # path: /run + #initContainers: + #- name: cos-init + # image: docker.elastic.co/beats/auditbeat:8.3.3 + # volumeMounts: + # - name: run + # mountPath: /run + # command: ['sh', '-c', 'export SYSTEMD_IGNORE_CHROOT=1 && systemctl stop systemd-journald-audit.socket && systemctl mask systemd-journald-audit.socket && systemctl restart systemd-journald'] + containers: + - name: auditbeat + securityContext: + capabilities: + add: + # Capabilities needed for auditd module + - 'AUDIT_READ' + - 'AUDIT_WRITE' + - 'AUDIT_CONTROL' + volumeMounts: + - name: bin + mountPath: /hostfs/bin + readOnly: true + - name: sbin + mountPath: /hostfs/sbin + readOnly: true + - name: usrbin + mountPath: /hostfs/usr/bin + readOnly: true + - name: usrsbin + mountPath: /hostfs/usr/sbin + readOnly: true + - name: etc + mountPath: /hostfs/etc + readOnly: true + # Directory with root filesystems of containers executed with containerd, this can be + # different with other runtimes. This volume is needed to monitor the file integrity + # of files in containers. + - name: run-containerd + mountPath: /run/containerd + readOnly: true diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml new file mode 100644 index 00000000..c46960da --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml @@ -0,0 +1,52 @@ +name: filebeat +version: 9.3.0 +type: filebeat +elasticsearchRef: + name: eck-elasticsearch +kibanaRef: + name: eck-kibana +config: + filebeat.inputs: + - type: filestream + paths: + - /var/log/containers/*.log + parsers: + - container: ~ + prospector: + scanner: + fingerprint.enabled: true + symlinks: true + file_identity.fingerprint: ~ + processors: + - add_host_metadata: {} + - add_cloud_metadata: {} +daemonSet: + podTemplate: + spec: + automountServiceAccountToken: true + terminationGracePeriodSeconds: 30 + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true # Allows to provide richer host metadata + containers: + - name: filebeat + securityContext: + runAsUser: 0 + # If using Red Hat OpenShift uncomment this: + #privileged: true + volumeMounts: + - name: varlogcontainers + mountPath: /var/log/containers + - name: varlogpods + mountPath: /var/log/pods + - name: varlibdockercontainers + mountPath: /var/lib/docker/containers + volumes: + - name: varlogcontainers + hostPath: + path: /var/log/containers + - name: varlogpods + hostPath: + path: /var/log/pods + - name: varlibdockercontainers + hostPath: + path: /var/lib/docker/containers diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml new file mode 100644 index 00000000..2521232f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml @@ -0,0 +1,23 @@ +name: heartbeat +version: 9.3.0 +type: heartbeat +elasticsearchRef: + name: eck-elasticsearch +config: + heartbeat.monitors: + - type: tcp + schedule: '@every 5s' + # This should directly match the name of the Elasticsearch instance + # with "-es-http" appended to the name. + hosts: ["elasticsearch-es-http.default.svc:9200"] + - type: tcp + schedule: '@every 5s' + # This should directly match the names of the Kibana instance + # with "-kb-http" appended to the name. + hosts: ["eck-kibana-kb-http.default.svc:5601"] +deployment: + replicas: 1 + podTemplate: + spec: + securityContext: + runAsUser: 0 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml new file mode 100644 index 00000000..ea2058b3 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml @@ -0,0 +1,158 @@ +name: metricbeat +type: metricbeat +version: 9.3.0 +elasticsearchRef: + name: eck-elasticsearch +kibanaRef: + name: eck-kibana +config: + metricbeat: + autodiscover: + providers: + - hints: + default_config: {} + enabled: "true" + node: ${NODE_NAME} + type: kubernetes + modules: + - module: system + period: 10s + metricsets: + - cpu + - load + - memory + - network + - process + - process_summary + process: + include_top_n: + by_cpu: 5 + by_memory: 5 + processes: + - .* + - module: system + period: 1m + metricsets: + - filesystem + - fsstat + processors: + - drop_event: + when: + regexp: + system: + filesystem: + mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib)($|/) + - module: kubernetes + period: 10s + node: ${NODE_NAME} + hosts: + - https://${NODE_NAME}:10250 + bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token + ssl: + verification_mode: none + metricsets: + - node + - system + - pod + - container + - volume + processors: + - add_cloud_metadata: {} + - add_host_metadata: {} +daemonSet: + podTemplate: + spec: + serviceAccountName: metricbeat + automountServiceAccountToken: true # some older Beat versions are depending on this settings presence in k8s context + containers: + - args: + - -e + - -c + - /etc/beat.yml + - --system.hostfs=/hostfs + name: metricbeat + volumeMounts: + - mountPath: /hostfs/sys/fs/cgroup + name: cgroup + - mountPath: /var/run/docker.sock + name: dockersock + - mountPath: /hostfs/proc + name: proc + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true # Allows to provide richer host metadata + securityContext: + runAsUser: 0 + terminationGracePeriodSeconds: 30 + volumes: + - hostPath: + path: /sys/fs/cgroup + name: cgroup + - hostPath: + path: /var/run/docker.sock + name: dockersock + - hostPath: + path: /proc + name: proc + +clusterRole: + # permissions needed for metricbeat + # source: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-kubernetes.html + name: metricbeat + rules: + - apiGroups: + - "" + resources: + - nodes + - namespaces + - events + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "extensions" + resources: + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - apps + resources: + - statefulsets + - deployments + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes/stats + verbs: + - get + - nonResourceURLs: + - /metrics + verbs: + - get + +serviceAccount: + name: metricbeat + +clusterRoleBinding: + name: metricbeat + subjects: + - kind: ServiceAccount + name: metricbeat + roleRef: + kind: ClusterRole + name: metricbeat + apiGroup: rbac.authorization.k8s.io diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml new file mode 100644 index 00000000..4db8df62 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml @@ -0,0 +1,37 @@ +name: packetbeat +type: packetbeat +version: 9.3.0 +elasticsearchRef: + name: eck-elasticsearch +kibanaRef: + name: eck-kibana +config: + packetbeat.interfaces.device: any + packetbeat.protocols: + - type: dns + ports: [53] + include_authorities: true + include_additionals: true + - type: http + ports: [80, 8000, 8080, 9200] + packetbeat.flows: + timeout: 30s + period: 10s + processors: + - add_cloud_metadata: {} + - add_host_metadata: {} +daemonSet: + podTemplate: + spec: + terminationGracePeriodSeconds: 30 + hostNetwork: true + automountServiceAccountToken: true # some older Beat versions are depending on this settings presence in k8s context + dnsPolicy: ClusterFirstWithHostNet + containers: + - name: packetbeat + securityContext: + runAsUser: 0 + capabilities: + add: + - NET_ADMIN + volumes: [] diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/NOTES.txt new file mode 100644 index 00000000..10d2dac5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Beat status + $ kubectl get beat {{ include "beat.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Beat pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l beat.k8s.elastic.co/name={{ include "beat.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/_helpers.tpl new file mode 100644 index 00000000..5e20af14 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "beat.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "beat.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "beat.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "beat.labels" -}} +helm.sh/chart: {{ include "beat.chart" . }} +{{ include "beat.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "beat.selectorLabels" -}} +app.kubernetes.io/name: {{ include "beat.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/beats.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/beats.yaml new file mode 100644 index 00000000..a70ac9a6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/beats.yaml @@ -0,0 +1,75 @@ +--- +apiVersion: beat.k8s.elastic.co/v1beta1 +kind: Beat +metadata: + name: {{ include "beat.fullname" . }} + labels: + {{- include "beat.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Beat version is required" (or ((.Values.spec).version) (.Values.version)) }} + {{- $daemonSet := (or (hasKey (.Values.spec) "daemonSet") (hasKey .Values "daemonSet")) }} + {{- $deployment := (or (hasKey (.Values.spec) "deployment") (hasKey .Values "deployment")) }} + {{- if and (not $daemonSet) (not $deployment) }} + {{ fail "At least one of daemonSet or deployment is required for a functional Beat" }} + {{- end }} + {{- if not (or ((.Values.spec).type) (.Values.type)) }}{{ fail "A Beat type is required" }}{{- end }} + type: {{ or ((.Values.spec).type) (.Values.type) }} + {{- if $daemonSet }} + {{- $ds := or ((.Values.spec).daemonSet) (.Values.daemonSet) }} + daemonSet: + {{- /* This is required to render the empty daemonset ( {} ) properly */}} + {{- $ds | default dict | toYaml | nindent 4 }} + {{- end }} + {{- if $deployment }} + {{- $deploy := or ((.Values.spec).deployment) (.Values.deployment) }} + deployment: + {{- /* This is required to render the empty deployment ( {} ) properly */}} + {{- $deploy | default dict | toYaml | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).image) (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with or ((.Values.spec).elasticsearchRef) (.Values.elasticsearchRef) }} + elasticsearchRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).kibanaRef) (.Values.kibanaRef) }} + kibanaRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- $config := or ((.Values.spec).config) (.Values.config) }} + {{- $configRef := or ((.Values.spec).configRef) (.Values.configRef) }} + {{- if and $config $configRef }} + {{ fail "Only one of config and configRef can be specified" }} + {{- end }} + {{- with $config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $configRef }} + configRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).http) (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).monitoring) (.Values.monitoring) }} + monitoring: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).secureSettings) (.Values.secureSettings) }} + secureSettings: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).revisionHistoryLimit) (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with or (((.Values.spec).serviceAccount).name) ((.Values.serviceAccount).name) }} + serviceAccountName: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role-binding.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role-binding.yaml new file mode 100644 index 00000000..d8fca15f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role-binding.yaml @@ -0,0 +1,35 @@ +{{- with .Values.clusterRoleBinding }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .name }} + labels: + {{- include "beat.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- with .subjects }} +subjects: +{{- range . }} + - kind: {{ .kind }} + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} +{{- end }} +{{- end }} +{{- with .roleRef }} +roleRef: + kind: {{ .kind }} + name: {{ .name }} + apiGroup: {{ .apiGroup }} +{{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role.yaml new file mode 100644 index 00000000..66406f63 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role.yaml @@ -0,0 +1,22 @@ +{{- with .Values.clusterRole }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .name }} + labels: + {{- include "beat.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +rules: {{- toYaml .rules | nindent 2 }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/service-account.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/service-account.yaml new file mode 100644 index 00000000..08f21f7e --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/service-account.yaml @@ -0,0 +1,23 @@ + +{{- with .Values.serviceAccount }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} + labels: + {{- include "beat.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/values.yaml new file mode 100644 index 00000000..20415276 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/values.yaml @@ -0,0 +1,181 @@ +--- +# Default values for eck-beats. +# This is a YAML-formatted file. + +# Overridable names of the Beats resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-beats'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Beats resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Elastic Beats. +# +version: 9.3.0 + +# Labels that will be applied to Elastic Beats. +# +labels: {} + +# Annotations that will be applied to Elastic Beats. +# +annotations: {} + +# ** Deprecation Notice ** +# The previous versions of this Helm Chart simply used the `spec` field here +# and allowed the user to specify any fields below spec that were templated directly +# into the final Beats manifest. This is no longer the preferred way to specify these +# fields and each field that is supported underneath `spec` is now directly specified +# in this values file. Currently both patterns are supported for backwards compatibility +# but we plan to remove the `spec` field in the future. +# spec: {} + +# Type of Elastic Beats. Standard types of Beat are [filebeat,metricbeat,heartbeat,auditbeat,packetbeat,journalbeat]. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-deploy-elastic-beat +# +# Note: This is required to be set, or the release install will fail. +# +type: "" + +# Beats image to deploy. +# +# image: docker.elastic.co/beats/metricbeat:9.3.0 + +# Referenced resources are below and depending on the setup, at least elasticsearchRef is required for a functional Beat. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-connect-es +# +# Reference to ECK-managed Kibana instance. +# +# kibanaRef: +# name: quickstart + # Optional namespace reference to Kibana instance. + # If not specified, then the namespace of the Beats instance + # will be assumed. + # + # namespace: default + +# Reference to ECK-managed Elasticsearch instance. +# *Note* If Beat's output is intended to go to Elasticsearch and not something like Logstash, +# this elasticsearchRef must be updated to the name of the Elasticsearch instance. +# +elasticsearchRef: {} + # name: elasticsearch + # Optional namespace reference to Elasticsearch instance. + # If not specified, then the namespace of the Beats instance + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating a Beat instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Daemonset, or Deployment specification for the type of Beat specified. +# At least one is required of [daemonSet, deployment]. +# No default is currently set, refer to https://github.com/elastic/cloud-on-k8s/issues/7429. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-chose-the-deployment-model +# +# deployment: +# podTemplate: +# spec: +# securityContext: +# runAsUser: 0 +# daemonSet: +# podTemplate: +# spec: +# securityContext: +# runAsUser: 0 + +# Configuration of Beat, which is dependent on the `type` of Beat specified. +# NOTE: The `config` and `configRef` fields are mutually exclusive. Only one of them should be defined at a time, +# as using both may cause conflicts. +# +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-custom-configuration +# +config: {} + +# Reference a configuration in a Secret. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-custom-configuration +# +# configRef: +# secretName: "" + +# The HTTP layer configuration for the Beats Service. +# +# http: + +# Settings for configuring stack monitoring. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-stack-monitoring.html +# +# monitoring: {} + # metrics: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + # logs: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + +# SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for Elastic Beats. +secureSettings: [] +# - secretName: my-secret-with-secure-settings + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# ServiceAccount to be used by Elastic Beats. Some Beats features (such as autodiscover or Kubernetes module metricsets) +# require that Beat Pods interact with Kubernetes APIs. This functionality requires specific permissions +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-role-based-access-control-for-beats +# +serviceAccount: {} +# name: elastic-beat-filebeat-quickstart +# namespace: optional-namespace + +# ClusterRoleBinding to be used by Elastic Beats. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-role-based-access-control-for-beats +# +clusterRoleBinding: {} +# name: elastic-beat-autodiscover-binding +# subjects: +# - kind: ServiceAccount +# name: elastic-beat-filebeat-quickstart +# namespace: default +# roleRef: +# kind: ClusterRole +# name: elastic-beat-autodiscover +# apiGroup: rbac.authorization.k8s.io + +# ClusterRole to be used by Elastic Beats. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-role-based-access-control-for-beats +# +clusterRole: {} +# name: elastic-beat-autodiscover +# rules: +# - apiGroups: [""] +# resources: +# - events +# - pods +# - namespaces +# - nodes +# verbs: +# - get +# - watch +# - list diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/Chart.yaml new file mode 100644 index 00000000..d4cbc925 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Elasticsearch managed by the ECK operator +icon: https://helm.elastic.co/icons/elasticsearch.png +kubeVersion: '>= 1.21.0-0' +name: eck-elasticsearch +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/elasticsearch/ +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml new file mode 100644 index 00000000..4eb99e60 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml @@ -0,0 +1,198 @@ +--- +nodeSets: +- name: masters + count: 1 + config: + node.roles: ["master"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 8Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highio + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Ti + # Adjust to your storage class name + # + # storageClassName: local-storage +- name: hot + count: 1 + config: + node.roles: ["data_hot", "data_content", "ingest"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 16Gi + cpu: 4 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highio + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Ti + # Adjust to your storage class name + # + # storageClassName: local-storage +- name: warm + count: 1 + config: + node.roles: ["data_warm"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 16Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highstorage + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Ti + # Adjust to your storage class name + # + # storageClassName: local-storage +- name: cold + count: 1 + config: + node.roles: ["data_cold"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 8Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highstorage + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Ti + # Adjust to your storage class name + # + # storageClassName: local-storage diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml new file mode 100644 index 00000000..0ca310c3 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml @@ -0,0 +1,26 @@ +--- +# The following is an example of an Elasticsearch resource that is configured to use an Ingress resource in an AKS cluster. +# +ingress: + enabled: true + className: webapprouting.kubernetes.azure.com + annotations: + # This is required for AKS Loadbalancing to understand that it's communicating with + # an HTTPS backend. + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml new file mode 100644 index 00000000..d3cc4041 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml @@ -0,0 +1,37 @@ +--- +# The following is an example of an Elasticsearch resource that is configured to use an Ingress resource in an EKS cluster +# which provisions an application load balancer. +# +ingress: + enabled: true + className: alb + annotations: + alb.ingress.kubernetes.io/scheme: "internet-facing" + alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' + alb.ingress.kubernetes.io/backend-protocol: "HTTPS" + alb.ingress.kubernetes.io/target-type: "ip" + # To use an ALB with ECK, you must provide a valid ACM certificate ARN or use certificate discovery. + # There are 2 options for EKS: + # 1. Create a valid ACM certificate, and uncomment the following annotation and update it to the correct ARN. + # 2. Create a valid ACM certificate and ensure that the hosts[0].host matches the certificate's Common Name (CN) and + # certificate discovery *should* find the certificate automatically and use it. + # + # ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/guide/ingress/cert_discovery/ + # + # alb.ingress.kubernetes.io/certificate-arn: "arn:aws:acm:us-east-1:00000000000:certificate/b65be571-8220-4f2e-8cb1-94194535d877" + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml new file mode 100644 index 00000000..3809e871 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml @@ -0,0 +1,27 @@ +--- +# The following is an example of an Elasticsearch resource that is configured to deploy a +# network load balancer (NLB) in an EKS cluster. To provision an NLB "ingress" for the +# Elasticsearch cluster, you are required to set annotations on the service, +# and not an Ingress resource. +ingress: + enabled: false +http: + service: + metadata: + annotations: + service.beta.kubernetes.io/aws-load-balancer-type: external + service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip + service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing + service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl + spec: + type: LoadBalancer +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml new file mode 100644 index 00000000..3adbd29c --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml @@ -0,0 +1,36 @@ +--- +# The following is an example of an Elasticsearch resource that is configured to use an Ingress resource in a GKE cluster. +# +ingress: + enabled: true + annotations: + my: annotation + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" +http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + # This is required to enable the GKE Ingress Controller to use HTTPS as the backend protocol. + cloud.google.com/app-protocols: '{"https":"HTTPS"}' +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + # Enable anonymous access to allow GCLB health probes to succeed + xpack.security.authc: + anonymous: + username: anon + roles: monitoring_user diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/NOTES.txt new file mode 100644 index 00000000..f6ab0020 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Elasticsearch resource status + $ kubectl get es {{ include "elasticsearch.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Elasticsearch pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l elasticsearch.k8s.elastic.co/cluster-name={{ include "elasticsearch.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/_helpers.tpl new file mode 100644 index 00000000..8fbf57b3 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "elasticsearch.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "elasticsearch.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "elasticsearch.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "elasticsearch.labels" -}} +helm.sh/chart: {{ include "elasticsearch.chart" . }} +{{ include "elasticsearch.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "elasticsearch.selectorLabels" -}} +app.kubernetes.io/name: {{ include "elasticsearch.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/elasticsearch.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/elasticsearch.yaml new file mode 100644 index 00000000..4a4d7465 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/elasticsearch.yaml @@ -0,0 +1,78 @@ +--- +apiVersion: elasticsearch.k8s.elastic.co/v1 +kind: Elasticsearch +metadata: + name: {{ include "elasticsearch.fullname" . }} + labels: + {{- include "elasticsearch.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.auth }} + auth: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.updateStrategy }} + updateStrategy: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.secureSettings }} + secureSettings: + {{- toYaml . | nindent 2 }} + {{- end }} + {{- with .Values.transport }} + transport: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.http }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + version: {{ required "An Elasticsearch version is required" .Values.version }} + {{- with .Values.monitoring }} + monitoring: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.remoteClusters }} + remoteClusters: + {{- toYaml . | nindent 2 }} + {{- end }} + {{- with .Values.remoteClusterServer }} + remoteClusterServer: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.volumeClaimDeletePolicy }} + volumeClaimDeletePolicy: + {{- if and (not (eq . "DeleteOnScaledownOnly")) (not (eq . "DeleteOnScaledownAndClusterDeletion")) }} + {{ fail "volumeClaimDeletePolicy can only be one of 'DeleteOnScaledownOnly' or 'DeleteOnScaledownAndClusterDeletion'" }} + {{- end }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if eq (len .Values.nodeSets) 0 }} + {{ fail "At least one nodeSet is required" }} + {{- end }} + nodeSets: + {{ toYaml .Values.nodeSets | nindent 4 }} + {{- with .Values.image }} + image: {{ . }} + {{- end }} + {{- with .Values.podDisruptionBudget }} + {{- if .disabled }} + podDisruptionBudget: {} + {{- else }} + {{- with .spec }} + podDisruptionBudget: + spec: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- end }} + {{- end }} + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/ingress.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/ingress.yaml new file mode 100644 index 00000000..99aa1813 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/ingress.yaml @@ -0,0 +1,48 @@ +{{- if .Values.ingress.enabled -}} +{{- $pathType := .Values.ingress.pathType | default "Prefix" -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "elasticsearch.fullname" . }} + labels: + {{- include "elasticsearch.labels" . | nindent 4 }} + {{- with .Values.ingress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if .Values.ingress.annotations }} + annotations: + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +spec: + {{- if .Values.ingress.className }} + ingressClassName: {{ .Values.ingress.className | quote }} + {{- end }} + {{- if .Values.ingress.tls.enabled }} + tls: + - hosts: + {{- range .Values.ingress.hosts }} + - {{ .host | quote }} + {{- end }} + {{- if .Values.ingress.tls.secretName }} + secretName: {{ .Values.ingress.tls.secretName }} + {{- else }} + secretName: {{ include "elasticsearch.fullname" . }}-es-http-certs-internal + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + {{- $hostPath := .path | default "/" }} + - host: {{ .host | quote }} + http: + paths: + - path: {{ $hostPath }} + pathType: {{ $pathType }} + backend: + service: + name: {{ include "elasticsearch.fullname" $ }}-es-http + port: + number: 9200 + {{- end }} +{{ end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/values.yaml new file mode 100644 index 00000000..19abaf35 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/values.yaml @@ -0,0 +1,393 @@ +--- +# Default values for eck-elasticsearch. +# This is a YAML-formatted file. + +# Overridable names of the Elasticsearch resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-elasticsearch'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Elasticsearch resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Elasticsearch. +# +version: 9.3.0 + +# Elasticsearch Docker image to deploy +# +# image: + +# Labels that will be applied to Elasticsearch. +# +labels: {} + +# Annotations that will be applied to Elasticsearch. +# +annotations: {} + +# Settings for configuring Elasticsearch users and roles. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html +# +auth: {} + +# Settings for configuring stack monitoring. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-stack-monitoring.html +# +monitoring: {} + # metrics: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + # logs: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + +# Control the Elasticsearch transport module used for internal communication between nodes. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-transport-settings.html +# +transport: {} + # service: + # metadata: + # labels: + # my-custom: label + # spec: + # type: LoadBalancer + # tls: + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: hulk.example.com + # certificate: + # secretName: custom-ca + +# Settings to control how Elasticsearch will be accessed. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html +# +http: {} + # service: + # metadata: + # labels: + # my-custom: label + # spec: + # type: LoadBalancer + # tls: + # selfSignedCertificate: + # # To fully disable TLS for the HTTP layer of Elasticsearch, simply + # # set the below field to 'true', removing all other fields. + # disabled: false + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: hulk.example.com + # certificate: + # secretName: custom-ca + +# Control Elasticsearch Secure Settings. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-es-secure-settings.html#k8s-es-secure-settings +# +secureSettings: [] + # - secretName: one-secure-settings-secret + # Projection of secret keys to specific paths + # - secretName: gcs-secure-settings + # entries: + # - key: gcs.client.default.credentials_file + # - key: gcs_client_1 + # path: gcs.client.client_1.credentials_file + # - key: gcs_client_2 + # path: gcs.client.client_2.credentials_file + +# Settings for limiting the number of simultaneous changes to an Elasticsearch resource. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-update-strategy.html +# +updateStrategy: {} + # changeBudget: + # maxSurge: 3 + # maxUnavailable: 1 + +# Controlling of connectivity between remote clusters within the same kubernetes cluster. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-remote-clusters.html +# +remoteClusters: {} + # - name: cluster-two + # elasticsearchRef: + # name: cluster-two + # namespace: ns-two + +# RemoteClusterServer specifies if the remote cluster server should be enabled. +# This must be enabled if this cluster is a remote cluster which is expected to be accessed using API key authentication. +# +remoteClusterServer: {} +# enabled: true + +# VolumeClaimDeletePolicy sets the policy for handling deletion of PersistentVolumeClaims for all NodeSets. +# Possible values are DeleteOnScaledownOnly and DeleteOnScaledownAndClusterDeletion. +# By default, if not set or empty, the operator sets DeleteOnScaledownAndClusterDeletion. +# +volumeClaimDeletePolicy: "" + +# Settings to limit the disruption when pods need to be rescheduled for some reason such as upgrades or routine maintenance. +# By default, if not set, the operator sets a budget that doesn't allow any pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`. +# In all other cases the default PodDisruptionBudget sets `minAvailable` equal to the total number of nodes minus 1. +# To completely disable the pod disruption budget set `disabled` to true. +# +# podDisruptionBudget: +# spec: +# minAvailable: 2 +# selector: +# matchLabels: +# elasticsearch.k8s.elastic.co/cluster-name: quickstart +# disabled: true + +# Used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# +# serviceAccountName: "" + +# Number of revisions to retain to allow rollback in the underlying StatefulSets. +# By default, if not set, Kubernetes sets 10. +# +# revisionHistoryLimit: 2 + +# Node configuration settings. +# The node roles which can be configured here are: +# - "master" +# - "data_hot" +# - "data_cold" +# - "data_frozen" +# - "data_content" +# - "ml" +# - "ingest" +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-node-configuration.html +# +nodeSets: +- name: default + count: 1 + config: + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + # The following spec is exactly the Kubernetes Core V1 PodTemplateSpec. Any fields within the PodTemplateSpec + # are supported within the 'spec' field below. Please see below documentation for the exhaustive list of fields. + # + # https://v1-24.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#podtemplatespec-v1-core + # + # Only the commonly overridden/used fields will be noted below. + # + spec: + + # If specified, the pod's scheduling constraints + # https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html + # https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: topology.kubernetes.io/zone + # operator: In + # values: + # - antarctica-east1 + # - antarctica-west1 + + # Containers array. Should only be used to customize the 'elasticsearch' container using the following fields. + containers: + - name: elasticsearch + + # List of environment variables to set in the 'elasticsearch' container. + # https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/ + # env: + # - name: "my-env-var" + # value: "my-value" + + # Compute Resources required by this container. + resources: + # Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, + # it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. + # + # Defaults used by the ECK Operator, if not specified, are below + limits: + # cpu: 1 + memory: 2Gi + requests: + # cpu: 1 + memory: 2Gi + + # Example increasing both the requests and limits values: + # limits: + # cpu: 4 + # memory: 8Gi + # requests: + # cpu: 1 + # memory: 8Gi + + # SecurityContext defines the security options the container should be run with. + # If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + # + # These typically are set automatically by the ECK Operator, and should only be adjusted + # with the full knowledge of the effects of each field. + # + # securityContext: + + # Whether this container has a read-only root filesystem. Default is false. + # readOnlyRootFilesystem: false + + # The GID to run the entrypoint of the container process. Uses runtime default if unset. + # runAsGroup: 1000 + + # Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure + # that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. + # runAsNonRoot: true + + # The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. + # runAsUser: 1000 + + # ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + # https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + # imagePullSecrets: + # - name: "image-pull-secret" + + # List of initialization containers belonging to the pod. + # + # Common initContainers include setting sysctl, or in 7.x versions of Elasticsearch, + # installing Elasticsearch plugins. + # + # https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + # initContainers: + # - command: + # - sh + # - "-c" + # - sysctl -w vm.max_map_count=262144 + # name: sysctl + # securityContext: + # privileged: true + # - command: + # - sh + # - "-c" + # - bin/elasticsearch-plugin remove --purge analysis-icu ; bin/elasticsearch-plugin install --batch analysis-icu + # name: install-plugins + # securityContext: + # privileged: true + + + # NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. + # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + # https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html + # nodeSelector: + # diskType: ssd + # environment: production + + # If specified, indicates the pod's priority. "system-node-critical" and "system-cluster-critical" are two special keywords which indicate the highest priorities with the former being the highest priority. + # Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority will be default or zero if there is no default. + # https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/ + # priorityClassName: "" + + # SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty. See type description for default values of each field. + # See previously defined 'securityContext' within 'podTemplate' for all available fields. + # securityContext: {} + + # ServiceAccountName is the name of the ServiceAccount to use to run this pod. + # https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + # serviceAccountName: "" + + # Optional duration in seconds to wait for the Elasticsearch pod to terminate gracefully. + # terminationGracePeriodSeconds: 30s + + # If specified, the pod's tolerations that will apply to all containers within the pod. + # https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + # tolerations: + # - key: "node-role.kubernetes.io/elasticsearch" + # effect: "NoSchedule" + # operator: "Exists" + + # TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. + # Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. + # + # These settings are generally applied within each `nodeSets[].podTemplate` field to apply to a specific Elasticsearch nodeset. + # + # https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html + # topologySpreadConstraints: {} + + # List of volumes that can be mounted by containers belonging to the pod. + # https://kubernetes.io/docs/concepts/storage/volumes + # volumes: [] + +# Settings for controlling Elasticsearch ingress. Enabling ingress will expose your Elasticsearch instance +# to the public internet, and as such is disabled by default. +# +# Each Cloud Service Provider has different requirements for setting up Ingress. Some links to common documentation are: +# - AWS: https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html +# - GCP: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress +# - Azure: https://learn.microsoft.com/en-us/azure/aks/app-routing +# - Nginx: https://kubernetes.github.io/ingress-nginx/ +# +ingress: + enabled: false + + # Annotations that will be applied to the Ingress resource. Note that some ingress controllers are controlled via annotations. + # + # Nginx Annotations: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/ + # + # Common annotations: + # kubernetes.io/ingress.class: gce # Configures the Ingress resource to use the GCE ingress controller and create an external Application Load Balancer. + # kubernetes.io/ingress.class: gce-internal # Configures the Ingress resource to use the GCE ingress controller and create an internal Application Load Balancer. + # kubernetes.io/ingress.class: nginx # Configures the Ingress resource to use the NGINX ingress controller. + # + annotations: {} + + # Labels that will be applied to the Ingress resource. + # + labels: {} + + # Some ingress controllers require the use of a specific class name to route traffic to the correct controller, notably AKS and EKS, which + # replaces the use of the 'kubernetes.io/ingress.class' annotation. + # + # className: webapprouting.kubernetes.azure.com | alb + + # Ingress paths are required to have a corresponding path type. Defaults to 'Prefix'. + # + # There are 3 supported path types: + # - ImplementationSpecific + # - Prefix + # - Exact + # + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types + # + pathType: Prefix + + # Hosts are a list of hosts included in the Ingress definition, with a corresponding path at which the default Elasticsearch service + # will be exposed. Each host in the list should be a fully qualified DNS name that will resolve to the exposed Ingress object. + # + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#name-based-virtual-hosting + # + hosts: + - host: chart-example.local + path: / + + # TLS defines whether TLS will be enabled on the Ingress resource. + # + # *NOTE* Many Cloud Service Providers handle TLS in a custom manner, and as such, it is recommended to consult their documentation. + # Notably GKE and Nginx Ingress Controllers seems to respect the Ingress TLS settings, AKS and EKS ignore it. + # + # - AKS: https://learn.microsoft.com/en-us/azure/aks/app-routing-dns-ssl + # - GKE: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress#options_for_providing_ssl_certificates + # - EKS: https://aws.amazon.com/blogs/containers/serve-distinct-domains-with-tls-powered-by-acm-on-amazon-eks/ + # - Nginx: https://kubernetes.github.io/ingress-nginx/user-guide/tls/ + # + # Kubernetes ingress TLS documentation: + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + # + tls: + enabled: false + # Optional Kubernetes secret name that contains a base64 encoded PEM certificate and private key that corresponds to the above 'hosts' definitions. + # If tls is enabled, but this field is not set, the self-signed certificate and key created by the ECK operator will be used. + # secretName: chart-example-tls diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/Chart.yaml new file mode 100644 index 00000000..0f4240b7 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +description: Elastic Enterprise Search managed by the ECK operator +icon: https://github.com/elastic/ent-search/blob/main/public/app-search-favicon-196x196.png +kubeVersion: '>= 1.21.0-0' +name: eck-enterprise-search +sources: +- https://github.com/elastic/cloud-on-k8s +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/examples/with-custom-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/examples/with-custom-configuration.yaml new file mode 100644 index 00000000..4216a112 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/examples/with-custom-configuration.yaml @@ -0,0 +1,19 @@ +config: + # define the exposed URL at which users will reach Enterprise Search + ent_search.external_url: https://my-custom-domain:3002 + # define the exposed URL at which users will reach Kibana + kibana.host: https://kibana.my-custom-domain:5601 + # configure app search document size limit + app_search.engine.document_size.limit: 100kb + +http: + service: + metadata: + labels: + my-custom: label + tls: + certificate: + secretName: my-cert + +elasticsearchRef: + name: eck-elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/_helpers.tpl new file mode 100644 index 00000000..21025dc7 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "eck-enterprise-search.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "eck-enterprise-search.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "eck-enterprise-search.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "eck-enterprise-search.labels" -}} +helm.sh/chart: {{ include "eck-enterprise-search.chart" . }} +{{ include "eck-enterprise-search.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "eck-enterprise-search.selectorLabels" -}} +app.kubernetes.io/name: {{ include "eck-enterprise-search.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "eck-enterprise-search.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "eck-enterprise-search.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/enterprisesearch.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/enterprisesearch.yaml new file mode 100644 index 00000000..af224e35 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/enterprisesearch.yaml @@ -0,0 +1,62 @@ +--- +apiVersion: enterprisesearch.k8s.elastic.co/v1 +kind: EnterpriseSearch +metadata: + name: {{ include "eck-enterprise-search.fullname" . }} + labels: + {{- include "eck-enterprise-search.labels" . | nindent 4 }} + {{- with .Values.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "An Enterprise Search version is required" .Values.version }} + count: {{ required "A pod count is required" .Values.count }} + + {{- /* + This is complicated, but seems required to catch both the situations where the key does not exist (commented out), and the key exists but is an empty map. + */ -}} + {{- if and (or (and (hasKey .Values "configRef") (eq 0 (len .Values.configRef))) (not (hasKey .Values "configRef"))) (or (and (hasKey .Values "elasticsearchRef") (eq 0 (len .Values.elasticsearchRef))) (not (hasKey .Values "elasticsearchRef"))) }} + {{ fail "At least one of configRef or elasticsearchRef is required" }} + {{- end }} + + {{- with .Values.image }} + image: {{ . }} + {{- end }} + + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} + + {{- with .Values.config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.http }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.elasticsearchRef }} + elasticsearchRef: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.podTemplate }} + podTemplate: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.configRef }} + configRef: + {{- toYaml . | nindent 2 }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/values.yaml new file mode 100644 index 00000000..24162c68 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/values.yaml @@ -0,0 +1,108 @@ +--- +# Default values for eck-enterprise-search. +# This is a YAML-formatted file. + +# Overridable names of the Enterprise Search resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-enterprise-search'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Enterprise Search resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Enterprise Search. +# +# 8.19 should be the last minor version in the 8 line. +version: 8.19.0 + +# Enterprise Search Docker image to deploy +# +# image: + +# Used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-restrict-cross-namespace-associations.html +# +# serviceAccountName: "" + +# Labels that will be applied to Enterprise Search. +# +labels: {} + +# Annotations that will be applied to Enterprise Search. +# +annotations: {} + +# Count of Enterprise Search replicas to create. +# +count: 1 + +# The Enterprise Search configuration, the ECK equivalent to enterprise-search.yml +# ref: https://www.elastic.co/guide/en/enterprise-search/current/configuration.html#configuration-configure +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-enterprise-search-configuration.html +# +# At a minimum, you must specify the external URL and Kibana host. +# +config: {} + # define the exposed URL at which users will reach Enterprise Search + # ent_search.external_url: https://my-custom-domain:3002 + # define the exposed URL at which users will reach Kibana + # kibana.host: https://kibana.my-custom-domain:5601 + +# Settings to control how Enterprise Search will be accessed. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html +# +http: {} + # tls: + # certificate: + # secretName: my-cert + # service: + # metadata: + # labels: + # my-custom: label + +# Reference to ECK-managed Elasticsearch resource. +# +elasticsearchRef: {} + # name: eck-elasticsearch + # Optional namespace reference to Elasticsearch resource. + # If not specified, then the namespace of the Enterprise Search resource + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating an Enterprise Search instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Set podTemplate to customize the pod used by Enterprise Search +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-customize-pods.html +# +podTemplate: {} + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# If you would prefer your sensitive data to be stored in a Secret, you can specify the name of the Secret reference. +# In addition, if you do not want to use the `elasticsearchRef` mechanism or if you want to connect to an Elasticsearch +# cluster not managed by ECK, you can manually configure Enterprise Search to access any available Elasticsearch cluster: +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-enterprise-search-configuration.html#k8s-enterprise-search-secret-configuration +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-enterprise-search-configuration.html#k8s-enterprise-search-connect-non-eck-es +# +configRef: {} + # secretName: enterprise-search-config diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/Chart.yaml new file mode 100644 index 00000000..31a8412a --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +description: Elastic Fleet Server as an Agent managed by the ECK operator +kubeVersion: '>= 1.21.0-0' +name: eck-fleet-server +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/elastic-agent +- https://github.com/elastic/fleet-server +- https://www.elastic.co/guide/en/fleet/current/fleet-overview.html +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml new file mode 100644 index 00000000..2a87a639 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml @@ -0,0 +1,17 @@ +version: 9.3.0 +deployment: + replicas: 1 + podTemplate: + spec: + serviceAccountName: fleet-server + automountServiceAccountToken: true +elasticsearchRefs: +- name: eck-elasticsearch +kibanaRef: + name: eck-kibana +http: + service: + spec: + type: ClusterIP +serviceAccount: + name: fleet-server diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/NOTES.txt new file mode 100644 index 00000000..eb3c879d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Fleet Server status + $ kubectl get agent {{ include "fleet-server.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Fleet Server pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l fleet-server.k8s.elastic.co/name={{ include "fleet-server.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/_helpers.tpl new file mode 100644 index 00000000..173f5089 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "fleet-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "fleet-server.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "fleet-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "fleet-server.labels" -}} +helm.sh/chart: {{ include "fleet-server.chart" . }} +{{ include "fleet-server.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "fleet-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "fleet-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role-binding.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role-binding.yaml new file mode 100644 index 00000000..e5fee457 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role-binding.yaml @@ -0,0 +1,33 @@ +{{- with .Values.clusterRoleBinding }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .name }} + labels: + {{- include "fleet-server.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- with .subjects }} +subjects: +{{- range . }} + - kind: {{ .kind }} + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} +{{- end }} +{{- end }} +roleRef: + kind: {{ .roleRef.kind }} + name: {{ .roleRef.name }} + apiGroup: {{ .roleRef.apiGroup }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role.yaml new file mode 100644 index 00000000..f067b628 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role.yaml @@ -0,0 +1,22 @@ +{{- with .Values.clusterRole }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .name }} + labels: + {{- include "fleet-server.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +rules: {{- toYaml .rules | nindent 2 }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/fleet-server.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/fleet-server.yaml new file mode 100644 index 00000000..2eb3b0d3 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/fleet-server.yaml @@ -0,0 +1,64 @@ +--- +apiVersion: agent.k8s.elastic.co/v1alpha1 +kind: Agent +metadata: + name: {{ include "fleet-server.fullname" . }} + labels: + {{- include "fleet-server.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Fleet Server version is required" (or ((.Values.spec).version) (.Values.version)) }} + mode: fleet + fleetServerEnabled: true + {{- if (or (hasKey (.Values.spec) "mode") (hasKey .Values "mode")) }} + {{- fail "mode cannot be changed" }} + {{- end }} + {{- if (or (hasKey (.Values.spec) "fleetServerEnabled") (hasKey .Values "fleetServerEnabled"))}} + {{- fail "fleetServerEnabled cannot be changed" }} + {{- end }} + + {{- $statefulSet := (or (hasKey (.Values.spec) "statefulSet") (hasKey .Values "statefulSet")) }} + {{- $deployment := (or (hasKey (.Values.spec) "deployment") (hasKey .Values "deployment")) }} + {{- if and (not $statefulSet) (not $deployment) }} + {{ fail "At least one of statefulSet or deployment is required" }} + {{- end }} + {{- if $statefulSet }} + {{- $ss := or ((.Values.spec).statefulSet) (.Values.statefulSet) }} + statefulSet: + {{- /* This is required to render the empty statefulSet ( {} ) properly */}} + {{- $ss | default dict | toYaml | nindent 4 }} + {{- end }} + {{- if $deployment }} + {{- $deploy := or ((.Values.spec).deployment) (.Values.deployment) }} + deployment: + {{- /* This is required to render the empty deployment ( {} ) properly */}} + {{- $deploy | default dict | toYaml | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).image) (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with or ((.Values.spec).elasticsearchRefs) (.Values.elasticsearchRefs) }} + elasticsearchRefs: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).kibanaRef) (.Values.kibanaRef) }} + kibanaRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).policyID) (.Values.policyID) }} + policyID: {{ . }} + {{- end }} + {{- with or ((.Values.spec).http) (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).revisionHistoryLimit) (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with or (((.Values.spec).serviceAccount).name) ((.Values.serviceAccount).name) }} + serviceAccountName: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/service-account.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/service-account.yaml new file mode 100644 index 00000000..0f8901d9 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/service-account.yaml @@ -0,0 +1,22 @@ +{{- with .Values.serviceAccount }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} + labels: + {{- include "fleet-server.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/values.yaml new file mode 100644 index 00000000..f7aaf62d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/values.yaml @@ -0,0 +1,169 @@ +--- +# Default values for eck-fleet-server. +# This is a YAML-formatted file. + +# Overridable names of the Fleet Server resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-fleet-server'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Fleet Server resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Elastic Fleet Server. +# +version: 9.3.0 + +# Labels that will be applied to Elastic Fleet Server. +# +labels: {} + +# Annotations that will be applied to Elastic Fleet Server. +# +annotations: {} + +# Elastic Fleet Server Agent image to deploy. +# +# image: docker.elastic.co/beats/elastic-agent:9.3.0 + +# ** Deprecation Notice ** +# The previous versions of this Helm Chart simply used the `spec` field here +# and allowed the user to specify any fields below `spec` that were templated directly +# into the final Agent/Fleet Server manifest. This is no longer the preferred way to specify these +# fields and each field that is supported underneath `spec` is now directly specified +# in this values file. Currently both patterns are supported for backwards compatibility +# but we plan to remove the `spec` field in the future. +# spec: {} + +# Referenced resources are below and both elasticsearchRefs and kibanaRef are required for a functional Fleet Server. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-setting-referenced-resources +# +# Reference to ECK-managed Kibana instance. +# This is required for Fleet Server. +# +# kibanaRef: +# name: quickstart + # Optional namespace reference to Kibana instance. + # If not specified, then the namespace of the Fleet Server resource + # will be assumed. + # + # namespace: default + +# Reference to ECK-managed Elasticsearch instance. +# This is required for Fleet Server. +# +elasticsearchRefs: [] +# - name: eck-elasticsearch + # Optional namespace reference to Elasticsearch instance. + # If not specified, then the namespace of the Fleet Server resource + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating a Fleet Server instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# policyID determines into which Agent Policy this Fleet Server will be enrolled. +policyID: eck-fleet-server + +# The HTTP layer configuration for the Fleet Server Service. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-customize-fleet-server-service +# +# http: + +# Deployment or StatefulSet specification for Fleet Server. +# At least one is required of [deployment, statefulSet]. +# No default is currently set, refer to https://github.com/elastic/cloud-on-k8s/issues/7429. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-chose-the-deployment-model +# +# deployment: +# replicas: 1 +# podTemplate: +# spec: +# serviceAccountName: fleet-server +# automountServiceAccountToken: true +# +# statefulSet: +# podTemplate: +# spec: +# serviceAccountName: fleet-server +# automountServiceAccountToken: true + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# ServiceAccount to be used by Elastic Fleet Server. Some Fleet Server features (such as autodiscover or Kubernetes module metricsets) +# require that Fleet Server Pods interact with Kubernetes APIs. This functionality requires specific permissions +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +serviceAccount: + name: fleet-server + # namespace: optional-namespace + +# ClusterRoleBinding to be used by Elastic Fleet Server. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +clusterRoleBinding: + name: fleet-server + subjects: + - kind: ServiceAccount + name: fleet-server + # namespace: default + roleRef: + kind: ClusterRole + name: fleet-server + apiGroup: rbac.authorization.k8s.io + +# ClusterRole to be used by Elastic Fleet Server. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +clusterRole: + name: fleet-server + rules: + - apiGroups: [""] + resources: + - pods + - namespaces + - nodes + verbs: + - get + - watch + - list + - apiGroups: ["apps"] + resources: + - replicasets + verbs: + - get + - watch + - list + - apiGroups: ["batch"] + resources: + - jobs + verbs: + - get + - watch + - list + - apiGroups: ["coordination.k8s.io"] + resources: + - leases + verbs: + - get + - create + - update diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/Chart.yaml new file mode 100644 index 00000000..434e6589 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Kibana managed by the ECK operator +icon: https://helm.elastic.co/icons/kibana.png +kubeVersion: '>= 1.21.0-0' +name: eck-kibana +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/kibana +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/http-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/http-configuration.yaml new file mode 100644 index 00000000..644d8ea7 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/http-configuration.yaml @@ -0,0 +1,36 @@ +--- +# Version of Kibana. +# +version: 9.3.0 + +# Labels that will be applied to Kibana. +# +labels: {} + # key: value + +# Annotations that will be applied to Kibana. +# +annotations: {} + # key: value + +# Count of Kibana replicas to create. +# +count: 1 + +# Reference to ECK-managed Elasticsearch resource, ideally from {{ "elasticsearch.fullname" }} +# +elasticsearchRef: + name: eck-elasticsearch + # namespace: default +http: + service: + spec: + # Type of service to deploy for Kibana. + # This deploys a load balancer in a cloud service provider, where supported. + # + type: LoadBalancer + # tls: + # selfSignedCertificate: + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: kibana.example.com diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-aks.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-aks.yaml new file mode 100644 index 00000000..b7363dd0 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-aks.yaml @@ -0,0 +1,28 @@ +# The following is an example of a Kibana resource that is configured to use an Ingress resource in an AKS cluster. +# + +# Name of the Kibana instance. +# +fullnameOverride: kibana + +# Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} +# +elasticsearchRef: + name: elasticsearch +config: + server: + publicBaseUrl: "https://kibana.company.dev" + +ingress: + enabled: true + className: webapprouting.kubernetes.azure.com + annotations: + # This is required for AKS Loadbalancing to understand that it's communicating with + # an HTTPS backend. + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + labels: + my: label + pathType: Prefix + hosts: + - host: "kibana.company.dev" + path: "/" diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml new file mode 100644 index 00000000..c5f2f43b --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml @@ -0,0 +1,48 @@ +# The following is an example of a Kibana resource that is configured to use an Ingress resource in an EKS cluster. +# + +# Name of the Kibana instance. +# +fullnameOverride: kibana + +# Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} +# +elasticsearchRef: + name: elasticsearch +config: + server: + publicBaseUrl: "https://kibana.company.dev" + +ingress: + enabled: true + className: alb + annotations: + alb.ingress.kubernetes.io/scheme: "internet-facing" + alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' + alb.ingress.kubernetes.io/backend-protocol: "HTTPS" + alb.ingress.kubernetes.io/target-type: "ip" + # To use an ALB with ECK, you must provide a valid ACM certificate ARN or use certificate discovery. + # There are 2 options for EKS: + # 1. Create a valid ACM certificate, and uncomment the following annotation and update it to the correct ARN. + # 2. Create a valid ACM certificate and ensure that the hosts[0].host matches the certificate's Common Name (CN) and + # certificate discovery *should* find the certificate automatically and use it. + # + # ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/guide/ingress/cert_discovery/ + # + # alb.ingress.kubernetes.io/certificate-arn: "arn:aws:acm:us-east-1:00000000000:certificate/b65be571-8220-4f2e-8cb1-94194535d877" + labels: + my: label + pathType: Prefix + hosts: + - host: "kibana.company.dev" + path: "/" +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-gke.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-gke.yaml new file mode 100644 index 00000000..61427581 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-gke.yaml @@ -0,0 +1,31 @@ +# The following is an example of a Kibana resource that is configured to use an Ingress resource in a GKE cluster. +# + +# Name of the Kibana instance. +# +fullnameOverride: kibana + +# Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} +# +elasticsearchRef: + name: elasticsearch +config: + server: + publicBaseUrl: "https://kibana.company.dev" +http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + # This is required to enable the GKE Ingress Controller to use HTTPS as the backend protocol. + cloud.google.com/app-protocols: '{"https":"HTTPS"}' + +ingress: + enabled: true + pathType: Prefix + hosts: + - host: "kibana.company.dev" + path: "/" + tls: + enabled: true diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/NOTES.txt new file mode 100644 index 00000000..9652161c --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Kibana status + $ kubectl get kibana {{ include "kibana.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Kibana pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l kibana.k8s.elastic.co/name={{ include "kibana.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/_helpers.tpl new file mode 100644 index 00000000..eba5497d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "kibana.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "kibana.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "kibana.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "kibana.labels" -}} +helm.sh/chart: {{ include "kibana.chart" . }} +{{ include "kibana.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "kibana.selectorLabels" -}} +app.kubernetes.io/name: {{ include "kibana.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/ingress.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/ingress.yaml new file mode 100644 index 00000000..171463c0 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/ingress.yaml @@ -0,0 +1,48 @@ +{{- if .Values.ingress.enabled -}} +{{- $pathType := .Values.ingress.pathType | default "Prefix" -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "kibana.fullname" . }} + labels: + {{- include "kibana.labels" . | nindent 4 }} + {{- with .Values.ingress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if .Values.ingress.annotations }} + annotations: + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +spec: + {{- if .Values.ingress.className }} + ingressClassName: {{ .Values.ingress.className | quote }} + {{- end }} + {{- if .Values.ingress.tls.enabled }} + tls: + - hosts: + {{- range .Values.ingress.hosts }} + - {{ .host | quote }} + {{- end }} + {{- if .Values.ingress.tls.secretName }} + secretName: {{ .Values.ingress.tls.secretName }} + {{- else }} + secretName: {{ include "kibana.fullname" . }}-kb-http-certs-internal + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + {{- $hostPath := .path | default "/" }} + - host: {{ .host | quote }} + http: + paths: + - path: {{ $hostPath }} + pathType: {{ $pathType }} + backend: + service: + name: {{ include "kibana.fullname" $ }}-kb-http + port: + number: 5601 + {{- end }} +{{ end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/kibana.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/kibana.yaml new file mode 100644 index 00000000..81a6293f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/kibana.yaml @@ -0,0 +1,66 @@ +--- +apiVersion: kibana.k8s.elastic.co/v1 +kind: Kibana +metadata: + name: {{ include "kibana.fullname" . }} + labels: + {{- include "kibana.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Kibana version is required" .Values.version }} + {{- /* + The following templates with 'or' are to allow both .spec.field and .field to be set for backwards + compatibility purposes. See https://github.com/elastic/cloud-on-k8s/pull/8192 for details. + */ -}} + {{- with or ((.Values.spec).image) (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with or ((.Values.spec).count) (.Values.count) }} + count: {{ . }} + {{- end }} + {{- $esRef := or ((.Values.spec).elasticsearchRef) (.Values.elasticsearchRef) }} +{{- if not (or ($esRef).name ($esRef).secretName) }} + {{ fail "An elasticsearchRef name or secretName is required" }} + {{- end }} + elasticsearchRef: + {{- toYaml $esRef | nindent 4 }} + {{- $entsearchRef := or ((.Values.spec).enterpriseSearchRef) (.Values.enterpriseSearchRef) }} + {{- if $entsearchRef }} + enterpriseSearchRef: + {{- toYaml $entsearchRef | nindent 4 }} + {{- end }} + {{- $eprRef := or ((.Values.spec).packageRegistryRef) (.Values.packageRegistryRef) }} + {{- if $eprRef }} + packageRegistryRef: + {{- toYaml $eprRef | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).config) (.Values.config) }} + config: + {{ toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).http) (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).podTemplate) (.Values.podTemplate) }} + podTemplate: + {{ toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).revisionHistoryLimit) (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with or ((.Values.spec).secureSettings) (.Values.secureSettings) }} + secureSettings: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).serviceAccountName) (.Values.serviceAccountName) }} + serviceAccountName: {{ . }} + {{- end }} + {{- with or ((.Values.spec).monitoring) (.Values.monitoring) }} + monitoring: + {{- toYaml . | nindent 4 }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/values.yaml new file mode 100644 index 00000000..f25c7055 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/values.yaml @@ -0,0 +1,194 @@ +--- +# Default values for eck-kibana. +# This is a YAML-formatted file. + +# Overridable names of the Kibana resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-kibana'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Kibana resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Kibana. +# +version: 9.3.0 + +# Kibana Docker image to deploy +# +# image: docker.elastic.co/kibana/kibana:9.3.0 + +# Labels that will be applied to Kibana. +# +labels: {} + +# Annotations that will be applied to Kibana. +# +annotations: {} + +# ** Deprecation Notice ** +# The previous versions of this Helm Chart simply used the `spec` field here +# and allowed the user to specify any fields below spec that were templated directly +# into the final Kibana manifest. This is no long the preferred way to specify these +# fields and each field that is supported underneath `spec` is now directly specified +# in this values file. Currently both patterns are supported for backwards compatibility +# but we plan to remove the `spec` field in the future. +# spec: {} + +# Count of Kibana replicas to create. +# +count: 1 + +# Reference to ECK-managed Elasticsearch resource. +# +elasticsearchRef: {} + # name: eck-elasticsearch + # Optional namespace reference to Elasticsearch resource. + # If not specified, then the namespace of the Kibana resource + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating a Kibana instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Reference to an EnterpriseSearch running in the same Kubernetes cluster +# +# enterpriseSearchRef: + +# Reference to an PackageRegistry running in the same Kubernetes cluster +# +# packageRegistryRef: + +# The Kibana configuration (kibana.yml) +# ref: https://www.elastic.co/guide/en/kibana/current/settings.html +# +config: null + +# The HTTP layer configuration for Kibana. +# +# http: + +# PodTemplate provides customisation options (labels, annotations, affinity rules, +# resource requests, and so on) for the Kibana pods +# +# podTemplate: + +# Number of revisions to retain to allow rollback in the underlying deployment. +# By default, if not set, Kubernetes sets 10. +# +# revisionHistoryLimit: 2 + +# Control Kibana Secure Settings. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-kibana-secure-settings.html +# +secureSettings: [] + +# Used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# +# serviceAccountName: "" + +# Settings for configuring stack monitoring. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-stack-monitoring.html +# +monitoring: {} + # metrics: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + # logs: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + +# Settings for controlling Kibana ingress. Enabling ingress will expose your Kibana instance +# to the public internet, and as such is disabled by default. +# +# *NOTE* when configuring Kibana Ingress, ensure that `config.server.publicBaseUrl` setting for +# Kibana is also set, as it is required when exposing Kibana behind a load balancer/ingress. +# Also of note are `server.basePath`, and `server.rewriteBasePath` settings in the Kibana configuration. +# +# ref: https://www.elastic.co/guide/en/kibana/current/settings.html +# +# Each Cloud Service Provider has different requirements for setting up Ingress. Some links to common documentation are: +# - AWS: https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html +# - GCP: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress +# - Azure: https://learn.microsoft.com/en-us/azure/aks/app-routing +# - Nginx: https://kubernetes.github.io/ingress-nginx/ +# +ingress: + enabled: false + + # Annotations that will be applied to the Ingress resource. Note that some ingress controllers are controlled via annotations. + # + # Nginx Annotations: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/ + # + # Common annotations: + # kubernetes.io/ingress.class: gce # Configures the Ingress resource to use the GCE ingress controller and create an external Application Load Balancer. + # kubernetes.io/ingress.class: gce-internal # Configures the Ingress resource to use the GCE ingress controller and create an internal Application Load Balancer. + # kubernetes.io/ingress.class: nginx # Configures the Ingress resource to use the NGINX ingress controller. + # + annotations: {} + + # Labels that will be applied to the Ingress resource. + # + labels: {} + + # Some ingress controllers require the use of a specific class name to route traffic to the correct controller, notably AKS and EKS, which + # replaces the use of the 'kubernetes.io/ingress.class' annotation. + # + # className: webapprouting.kubernetes.azure.com | alb + + # Ingress paths are required to have a corresponding path type. Defaults to 'Prefix'. + # + # There are 3 supported path types: + # - ImplementationSpecific + # - Prefix + # - Exact + # + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types + # + pathType: Prefix + + # Hosts are a list of hosts included in the Ingress definition, with a corresponding path at which the Kibana service + # will be exposed. Each host in the list should be a fully qualified DNS name that will resolve to the exposed Ingress object. + # + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#name-based-virtual-hosting + # + hosts: + - host: chart-example.local + path: / + + # TLS defines whether TLS will be enabled on the Ingress resource. + # + # *NOTE* Many Cloud Service Providers handle TLS in a custom manner, and as such, it is recommended to consult their documentation. + # Notably GKE and Nginx Ingress Controllers seems to respect the Ingress TLS settings, AKS and EKS ignore it. + # + # - AKS: https://learn.microsoft.com/en-us/azure/aks/app-routing-dns-ssl + # - GKE: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress#options_for_providing_ssl_certificates + # - EKS: https://aws.amazon.com/blogs/containers/serve-distinct-domains-with-tls-powered-by-acm-on-amazon-eks/ + # - Nginx: https://kubernetes.github.io/ingress-nginx/user-guide/tls/ + # + # Kubernetes ingress TLS documentation: + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + # + tls: + enabled: false + # Optional Kubernetes secret name that contains a base64 encoded PEM certificate and private key that corresponds to the above 'hosts' definitions. + # If tls is enabled, but this field is not set, the self-signed certificate and key created by the ECK operator will be used. + # secretName: chart-example-tls diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/Chart.yaml new file mode 100644 index 00000000..1f848b4d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Logstash managed by the ECK operator +icon: https://helm.elastic.co/icons/logstash.png +kubeVersion: '>= 1.21.0-0' +name: eck-logstash +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/logstash +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/basic-eck.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/basic-eck.yaml new file mode 100644 index 00000000..3809ee61 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/basic-eck.yaml @@ -0,0 +1,44 @@ +--- +# values corresponding to config/recipes/logstash/logstash-eck.yaml +version: 9.3.0 + +elasticsearchRefs: + - clusterName: eck + name: elasticsearch + +pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + +services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/es-role.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/es-role.yaml new file mode 100644 index 00000000..151a0a79 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/es-role.yaml @@ -0,0 +1,25 @@ +--- +# values corresponding to config/recipes/logstash/logstash-es-role.yaml +version: 9.3.0 + +elasticsearchRefs: + - clusterName: eck + name: elasticsearch + +pipelines: + - pipeline.id: main + config.string: | + input { exec { command => "uptime" interval => 10 } } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + ssl_enabled => true + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + index => "my-index" + data_stream => false + ilm_enabled => false + manage_template => false + } + } diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/monitored.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/monitored.yaml new file mode 100644 index 00000000..2082558e --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/monitored.yaml @@ -0,0 +1,49 @@ +--- +# values corresponding to config/recipes/logstash/logstash-monitored.yaml +version: 9.3.0 + +monitoring: + metrics: + elasticsearchRefs: + - name: elasticsearch-monitoring + +pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + +elasticsearchRefs: + - clusterName: eck + name: elasticsearch + +services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/multi.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/multi.yaml new file mode 100644 index 00000000..82011d9a --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/multi.yaml @@ -0,0 +1,78 @@ +--- +# values corresponding to config/recipes/logstash/logstash-multi.yaml +version: 9.3.0 + +pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + pipeline { + send_to => 'prod' + } + pipeline { + send_to => 'qa' + } + } + - pipeline.id: production + config.string: | + input { + pipeline { + address => 'prod' + } + } + output { + elasticsearch { + hosts => [ "${PROD_ES_ES_HOSTS}" ] + user => "${PROD_ES_ES_USER}" + password => "${PROD_ES_ES_PASSWORD}" + ssl_certificate_authorities => "${PROD_ES_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + - pipeline.id: qa + config.string: | + input { + pipeline { + address => 'qa' + } + } + output { + elasticsearch { + hosts => [ "${QA_ES_ES_HOSTS}" ] + user => "${QA_ES_ES_USER}" + password => "${QA_ES_ES_PASSWORD}" + ssl_certificate_authorities => "${QA_ES_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + +elasticsearchRefs: + - clusterName: prod-es + name: production + - clusterName: qa-es + name: qa + namespace: qa + +services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/volumes.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/volumes.yaml new file mode 100644 index 00000000..ab6c1911 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/volumes.yaml @@ -0,0 +1,107 @@ +--- +# values corresponding to config/recipes/logstash/logstash-volumes.yaml +version: 9.3.0 + +config: + log.level: info + queue.type: persisted + path.queue: /usr/share/logstash/pq + +podTemplate: + spec: + containers: + - name: logstash + volumeMounts: + - mountPath: /usr/share/logstash/pq + name: pq + readOnly: false + - mountPath: /usr/share/logstash/dlq + name: dlq + readOnly: false + +pipelines: + - pipeline.id: dlq_read + dead_letter_queue.enable: false + config.string: | + input { + dead_letter_queue { + path => "/usr/share/logstash/dlq" + commit_offsets => true + pipeline_id => "beats" + clean_consumed => true + } + } + filter { + mutate { + remove_field => "[geoip][location]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + - pipeline.id: beats + dead_letter_queue.enable: true + path.dead_letter_queue: /usr/share/logstash/dlq + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + +volumeClaimTemplates: + - metadata: + name: pq + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Gi + - metadata: + name: dlq + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 5Gi + + +elasticsearchRefs: + - clusterName: eck + name: elasticsearch + +services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/NOTES.txt new file mode 100644 index 00000000..c2f255af --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Logstash status + $ kubectl get logstash {{ include "logstash.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Logstash pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l logstash.k8s.elastic.co/name={{ include "logstash.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/_helpers.tpl new file mode 100644 index 00000000..7efd669f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "logstash.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "logstash.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "logstash.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "logstash.labels" -}} +helm.sh/chart: {{ include "logstash.chart" . }} +{{ include "logstash.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "logstash.selectorLabels" -}} +app.kubernetes.io/name: {{ include "logstash.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/logstash.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/logstash.yaml new file mode 100644 index 00000000..8ba52ef6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/logstash.yaml @@ -0,0 +1,58 @@ +--- +apiVersion: logstash.k8s.elastic.co/v1alpha1 +kind: Logstash +metadata: + name: {{ include "logstash.fullname" . }} + labels: + {{- include "logstash.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Logstash version is required" .Values.version }} + count: {{ required "A pod count is required" .Values.count }} + {{- with .Values.image }} + image: {{ . }} + {{- end }} + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} + + {{- if and .Values.config .Values.configRef }} + {{- fail "config and configRef are mutually exclusive!" }} + {{- end }} + {{- with .Values.config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.configRef }} + configRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.podTemplate }} + podTemplate: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.monitoring }} + monitoring: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if and .Values.pipelines .Values.pipelinesRef }} + {{- fail "pipelines and pipelinesRef are mutually exclusive!" }} + {{- end }} + {{- with .Values.pipelinesRef }} + pipelinesRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if .Values.pipelines }} + pipelines: {{ toYaml .Values.pipelines | nindent 4 }} + {{- end }} + volumeClaimTemplates: {{ toYaml .Values.volumeClaimTemplates | nindent 4 }} + elasticsearchRefs: {{ toYaml .Values.elasticsearchRefs | nindent 4 }} + services: {{ toYaml .Values.services | nindent 4 }} + secureSettings: {{ toYaml .Values.secureSettings | nindent 4 }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/values.yaml new file mode 100644 index 00000000..db949b46 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/values.yaml @@ -0,0 +1,115 @@ +--- +# Default values for eck-logstash. +# This is a YAML-formatted file. + +# Overridable names of the Logstash resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-logstash'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Logstash resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Logstash. +# +version: 9.3.0 + +# Logstash Docker image to deploy +# +# image: + +# Used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# +# serviceAccountName: "" + +# Labels that will be applied to Logstash. +# +labels: {} + +# Annotations that will be applied to Logstash. +# +annotations: {} + +# Number of revisions to retain to allow rollback in the underlying StatefulSets. +# By default, if not set, Kubernetes sets 10. +# +# revisionHistoryLimit: 2 + +# Controlling the number of pods. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-scaling-logstash.html +# +count: 1 + +# The logstash configuration, the ECK equivalent to logstash.yml +# +# NOTE: The `config` and `configRef` fields are mutually exclusive. Only one of them should be defined at a time, +# as using both may cause conflicts. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-configuring-logstash +# +config: {} + +# Reference a configuration in a Secret. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-configuring-logstash +# +# configRef: +# secretName: '' + +# Set podTemplate to customize the pod used by Logstash +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-customize-pods.html +# +podTemplate: {} + +# Settings for configuring stack monitoring. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-stack-monitoring.html +# +monitoring: {} + # metrics: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + # logs: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + +# The Logstash pipelines, the ECK equivalent to pipelines.yml +# +# NOTE: The `pipelines` and `pipelinesRef` fields are mutually exclusive. Only one of them should be defined at a time, +# as using both may cause conflicts. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-pipelines +# +pipelines: [] + +# Reference a pipelines configuration in a Secret. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-pipelines +# +# pipelinesRef: +# secretName: '' + +# volumeClaimTemplates +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-volume-claim-settings +# +volumeClaimTemplates: [] + +# ElasticsearchRefs are references to Elasticsearch clusters running in the same Kubernetes cluster. +# Ensure that the 'clusterName' field matches what is referenced in the pipeline. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-pipelines-es +# +elasticsearchRefs: [] +# - namespace: '' +# name: '' +# clusterName: '' +# serviceName: '' +# secretName: '' + +services: [] + +# SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for the Logstash +secureSettings: [] diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/Chart.yaml new file mode 100644 index 00000000..d22d653a --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +description: Elastic Package Registry managed by the ECK operator +kubeVersion: '>= 1.21.0-0' +name: eck-package-registry +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/package-registry +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/NOTES.txt new file mode 100644 index 00000000..51943d84 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Package Registry status + $ kubectl get epr {{ include "epr.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Package Registry pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l packageregistry.k8s.elastic.co/name={{ include "epr.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/_helpers.tpl new file mode 100644 index 00000000..1bb771b1 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "epr.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "epr.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "epr.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "epr.labels" -}} +helm.sh/chart: {{ include "epr.chart" . }} +{{ include "epr.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "epr.selectorLabels" -}} +app.kubernetes.io/name: {{ include "epr.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/epr.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/epr.yaml new file mode 100644 index 00000000..2cfb90c1 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/epr.yaml @@ -0,0 +1,35 @@ +--- +apiVersion: packageregistry.k8s.elastic.co/v1alpha1 +kind: PackageRegistry +metadata: + name: {{ include "epr.fullname" . }} + labels: + {{- include "epr.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Elastic Package Registry version is required" .Values.version }} + {{- with (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with (.Values.count) }} + count: {{ . }} + {{- end }} + {{- with (.Values.config) }} + config: + {{ toYaml . | nindent 4 }} + {{- end }} + {{- with (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with (.Values.podTemplate) }} + podTemplate: + {{ toYaml . | nindent 4 }} + {{- end }} + {{- with (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/values.yaml new file mode 100644 index 00000000..48da0948 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/values.yaml @@ -0,0 +1,57 @@ +--- +# Default values for eck-package-registry. +# This is a YAML-formatted file. + +# Overridable names of the PackageRegistry resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-epr'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the PackageRegistry resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Package Registry. +# +version: 9.2.2 + +# Elastic Package Registry Docker image to deploy +# +# image: docker.elastic.co/package-registry/distribution:lite-9.2.2 + +# Labels that will be applied to Package Registry. +# +labels: {} + +# Annotations that will be applied to Package Registry. +# +annotations: {} + + +# Count of Package Registry replicas to create. +# +count: 1 + +# The Package Registry configuration (config.yml) +# ref: https://github.com/elastic/package-registry/blob/main/config.reference.yml +# +config: null + +# The HTTP layer configuration for Package Registry. +# +# http: + +# PodTemplate provides customisation options (labels, annotations, affinity rules, +# resource requests, and so on) for the EPR pods +# +# podTemplate: + +# Number of revisions to retain to allow rollback in the underlying deployment. +# By default, if not set, Kubernetes sets 10. +# +# revisionHistoryLimit: 2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/agent/fleet-agents.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/agent/fleet-agents.yaml new file mode 100644 index 00000000..4358b6f6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/agent/fleet-agents.yaml @@ -0,0 +1,122 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + # Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: elasticsearch + + config: + # Note that these are specific to the namespace into which this example is installed, and are + # using `elastic-stack` as configured here and detailed in the README when installing: + # + # `helm install es-kb-quickstart elastic/eck-stack -n elastic-stack` + # + # If installed outside of the `elastic-stack` namespace, the following 2 lines need modification. + xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-es-http.elastic-stack.svc:9200"] + xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.elastic-stack.svc:8220"] + xpack.fleet.packages: + - name: system + version: latest + - name: elastic_agent + version: latest + - name: fleet_server + version: latest + - name: kubernetes + version: latest + xpack.fleet.agentPolicies: + - name: Fleet Server on ECK policy + id: eck-fleet-server + namespace: default + is_managed: true + monitoring_enabled: + - logs + - metrics + package_policies: + - name: fleet_server-1 + id: fleet_server-1 + package: + name: fleet_server + - name: Elastic Agent on ECK policy + id: eck-agent + namespace: default + is_managed: true + monitoring_enabled: + - logs + - metrics + unenroll_timeout: 900 + package_policies: + - package: + name: system + name: system-1 + - package: + name: kubernetes + name: kubernetes-1 + +eck-agent: + enabled: true + + # Agent policy to be used. + policyID: eck-agent + # Reference to ECK-managed Kibana instance. + # + kibanaRef: + name: kibana + elasticsearchRefs: [] + # Reference to ECK-managed Fleet instance. + # + fleetServerRef: + name: fleet-server + + mode: fleet + daemonSet: + podTemplate: + spec: + serviceAccountName: elastic-agent + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + automountServiceAccountToken: true + securityContext: + runAsUser: 0 + +eck-fleet-server: + enabled: true + + fullnameOverride: "fleet-server" + + deployment: + replicas: 1 + podTemplate: + spec: + serviceAccountName: fleet-server + automountServiceAccountToken: true + + # Agent policy to be used. + policyID: eck-fleet-server + kibanaRef: + name: kibana + elasticsearchRefs: + - name: elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/basic.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/basic.yaml new file mode 100644 index 00000000..227b5825 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/basic.yaml @@ -0,0 +1,52 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + spec: + config: + xpack.fleet.packages: + - name: apm + version: latest + +eck-apm-server: + enabled: true + + # Count of APM Server replicas to create. + # + count: 1 + + # Reference to ECK-managed Elasticsearch resource. + # + elasticsearchRef: + name: elasticsearch + kibanaRef: + name: kibana + http: + service: + spec: + ports: + - name: http + port: 8200 + targetPort: 8200 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml new file mode 100644 index 00000000..b694955f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml @@ -0,0 +1,60 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + spec: + config: + xpack.fleet.packages: + - name: apm + version: latest + +eck-apm-server: + enabled: true + + # Count of APM Server replicas to create. + # + count: 1 + + config: + name: elastic-apm + apm-server.jaeger.grpc.enabled: true + apm-server.jaeger.grpc.host: "0.0.0.0:14250" + + # Reference to ECK-managed Elasticsearch resource. + # + elasticsearchRef: + name: elasticsearch + kibanaRef: + name: kibana + http: + service: + spec: + ports: + - name: http + port: 8200 + targetPort: 8200 + - name: grpc + port: 14250 + targetPort: 14250 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/autoops/basic.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/autoops/basic.yaml new file mode 100644 index 00000000..cea15ba1 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/autoops/basic.yaml @@ -0,0 +1,30 @@ +--- +eck-autoops-agent-policy: + enabled: true + autoOpsRef: + secretName: "autoops-secret" + resourceSelector: + matchLabels: + autoops: enabled + +eck-elasticsearch: + enabled: true + + # This label is used to select the Elasticsearch instance for AutoOps integration. + labels: + autoops: enabled + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 1 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/beats/metricbeat_hosts.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/beats/metricbeat_hosts.yaml new file mode 100644 index 00000000..ed071837 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/beats/metricbeat_hosts.yaml @@ -0,0 +1,217 @@ +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch resource. + # + fullnameOverride: quickstart + + # Version of Elasticsearch. + # + version: 9.3.0 + + nodeSets: + - name: default + count: 3 + config: + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + node.store.allow_mmap: false + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100Gi + # Adjust to your storage class name + # + # storageClassName: local-storage + +eck-kibana: + enabled: true + + # Name of the Kibana resource. + # + fullnameOverride: quickstart + + # Version of Kibana. + # + version: 9.3.0 + + spec: + # Count of Kibana replicas to create. + # + count: 1 + + # Reference to ECK-managed Elasticsearch resource, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: quickstart + +eck-beats: + enabled: true + name: metricbeat + type: metricbeat + version: 9.3.0 + elasticsearchRef: + name: quickstart + kibanaRef: + name: quickstart + config: + # Since filebeat is used in the default values, this needs to be removed with an empty list. + filebeat.inputs: [] + metricbeat: + autodiscover: + providers: + - hints: + default_config: {} + enabled: "true" + node: ${NODE_NAME} + type: kubernetes + modules: + - module: system + period: 10s + metricsets: + - cpu + - load + - memory + - network + - process + - process_summary + process: + include_top_n: + by_cpu: 5 + by_memory: 5 + processes: + - .* + - module: system + period: 1m + metricsets: + - filesystem + - fsstat + processors: + - drop_event: + when: + regexp: + system: + filesystem: + mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib)($|/) + - module: kubernetes + period: 10s + node: ${NODE_NAME} + hosts: + - https://${NODE_NAME}:10250 + bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token + ssl: + verification_mode: none + metricsets: + - node + - system + - pod + - container + - volume + processors: + - add_cloud_metadata: {} + - add_host_metadata: {} + daemonSet: + podTemplate: + spec: + serviceAccountName: metricbeat + automountServiceAccountToken: true # some older Beat versions are depending on this settings presence in k8s context + containers: + - args: + - -e + - -c + - /etc/beat.yml + - --system.hostfs=/hostfs + name: metricbeat + volumeMounts: + - mountPath: /hostfs/sys/fs/cgroup + name: cgroup + - mountPath: /var/run/docker.sock + name: dockersock + - mountPath: /hostfs/proc + name: proc + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true # Allows to provide richer host metadata + securityContext: + runAsUser: 0 + terminationGracePeriodSeconds: 30 + volumes: + - hostPath: + path: /sys/fs/cgroup + name: cgroup + - hostPath: + path: /var/run/docker.sock + name: dockersock + - hostPath: + path: /proc + name: proc + + clusterRole: + # permissions needed for metricbeat + # source: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-kubernetes.html + name: metricbeat + rules: + - apiGroups: + - "" + resources: + - nodes + - namespaces + - events + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "extensions" + resources: + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - apps + resources: + - statefulsets + - deployments + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes/stats + verbs: + - get + - nonResourceURLs: + - /metrics + verbs: + - get + + serviceAccount: + name: metricbeat + + clusterRoleBinding: + name: metricbeat + subjects: + - kind: ServiceAccount + name: metricbeat + roleRef: + kind: ClusterRole + name: metricbeat + apiGroup: rbac.authorization.k8s.io diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/custom-elasticsearch-kibana.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/custom-elasticsearch-kibana.yaml new file mode 100644 index 00000000..6e58df07 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/custom-elasticsearch-kibana.yaml @@ -0,0 +1,78 @@ +--- +eck-elasticsearch: + # Name of the Elasticsearch resource. + # + fullnameOverride: quickstart + + # Version of Elasticsearch. + # + version: 9.3.0 + + nodeSets: + - name: default + count: 1 + config: + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100Gi + # Adjust to your storage class name + # + # storageClassName: local-storage + +eck-kibana: + # Name of the Kibana resource. + # + fullnameOverride: quickstart + + # Version of Kibana. + # + version: 9.3.0 + + spec: + # Count of Kibana replicas to create. + # + count: 1 + + # Reference to ECK-managed Elasticsearch resource, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: quickstart + # namespace: default + http: + service: + spec: + # Type of service to deploy for Kibana. + # This deploys a load balancer in a cloud service provider, where supported. + # + type: LoadBalancer + # tls: + # selfSignedCertificate: + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: kibana.example.com + podTemplate: + spec: + containers: + - name: kibana + env: + - name: NODE_OPTIONS + value: "--max-old-space-size=2048" + resources: + requests: + memory: 1Gi + cpu: 0.5 + limits: + memory: 2.5Gi + cpu: 2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/hot-warm-cold.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/hot-warm-cold.yaml new file mode 100644 index 00000000..919cb4c7 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/hot-warm-cold.yaml @@ -0,0 +1,199 @@ +--- +eck-elasticsearch: + nodeSets: + - name: masters + count: 1 + config: + node.roles: ["master"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 8Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highio + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Ti + # Adjust to your storage class name + # + # storageClassName: local-storage + - name: hot + count: 1 + config: + node.roles: ["data_hot", "data_content", "ingest"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 16Gi + cpu: 4 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highio + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Ti + # Adjust to your storage class name + # + # storageClassName: local-storage + - name: warm + count: 1 + config: + node.roles: ["data_warm"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 16Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highstorage + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Ti + # Adjust to your storage class name + # + # storageClassName: local-storage + - name: cold + count: 1 + config: + node.roles: ["data_cold"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 8Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highstorage + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Ti + # Adjust to your storage class name + # + # storageClassName: local-storage diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml new file mode 100644 index 00000000..0ca2e8a5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml @@ -0,0 +1,40 @@ +# The following is an example of an Elasticsearch resource that is configured to use an Ingress resource in a GKE cluster. +# Additional examples of exposing Elasticsearch with Ingress resources can be found in the following location: +# https://github.com/elastic/cloud-on-k8s/tree/main/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress +# +eck-elasticsearch: + enabled: true + + ingress: + enabled: true + annotations: + my: annotation + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" + http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + # This is required to enable the GKE Ingress Controller to use HTTPS as the backend protocol. + cloud.google.com/app-protocols: '{"https":"HTTPS"}' + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + # Enable anonymous access to allow GCLB health probes to succeed + xpack.security.authc: + anonymous: + username: anon + roles: monitoring_user diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/basic.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/basic.yaml new file mode 100644 index 00000000..aeb61b06 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/basic.yaml @@ -0,0 +1,42 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + elasticsearchRef: + name: elasticsearch + + spec: + enterpriseSearchRef: + name: enterprise-search + +eck-enterprise-search: + enabled: true + + # Name of the Enterprise Search instance. + # + fullnameOverride: enterprise-search + + elasticsearchRef: + name: elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/with-custom-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/with-custom-configuration.yaml new file mode 100644 index 00000000..a7c3ad49 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/with-custom-configuration.yaml @@ -0,0 +1,52 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + elasticsearchRef: + name: elasticsearch + + spec: + enterpriseSearchRef: + name: enterprise-search + +eck-enterprise-search: + enabled: true + + # Name of the Enterprise Search instance. + # + fullnameOverride: enterprise-search + + config: + # configure app search document size limit + app_search.engine.document_size.limit: 100kb + + http: + service: + metadata: + labels: + my-custom: label + + elasticsearchRef: + name: elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/http-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/http-configuration.yaml new file mode 100644 index 00000000..e3798a28 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/http-configuration.yaml @@ -0,0 +1,24 @@ +--- +eck-kibana: + # Count of Kibana replicas to create. + # + count: 1 + + # Reference to ECK-managed Elasticsearch resource, ideally from {{ "elasticsearch.fullname" }} + # Leave commented when using eck-stack with Elasticsearch enabled (chart handles this automatically) + # Uncomment only when deploying eck-kibana standalone or eck-stack without Elasticsearch + # elasticsearchRef: + # name: + # namespace: default + http: + service: + spec: + # Type of service to deploy for Kibana. + # This deploys a load balancer in a cloud service provider, where supported. + # + type: LoadBalancer + # tls: + # selfSignedCertificate: + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: kibana.example.com diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/ingress/kibana-gke.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/ingress/kibana-gke.yaml new file mode 100644 index 00000000..4aa1dc06 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/ingress/kibana-gke.yaml @@ -0,0 +1,80 @@ +# The following is an example of a Kibana resource that is configured to use an Ingress resource in a GKE cluster. +# Additional examples of exposing Kibana with Ingress resources can be found in the following location: +# https://github.com/elastic/cloud-on-k8s/tree/main/deploy/eck-stack/charts/eck-kibana/examples/ingress +# +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + ingress: + enabled: true + annotations: + my: annotation + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" + tls: + enabled: true + + http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + cloud.google.com/app-protocols: '{"https":"HTTPS"}' + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + # Enable anonymous access to allow GCLB health probes to succeed + xpack.security.authc: + anonymous: + username: anon + roles: monitoring_user + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + # Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: elasticsearch + + config: + server: + publicBaseUrl: "https://kibana.company.dev" + + http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + cloud.google.com/app-protocols: '{"https":"HTTPS"}' + + ingress: + enabled: true + pathType: Prefix + hosts: + - host: "kibana.company.dev" + path: "/" + tls: + enabled: true diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/logstash/basic-eck.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/logstash/basic-eck.yaml new file mode 100644 index 00000000..8c2afa22 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/logstash/basic-eck.yaml @@ -0,0 +1,113 @@ +--- +eck-elasticsearch: + nodeSets: + - name: default + count: 3 + config: + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 2Gi + requests: + memory: 2Gi +eck-kibana: + enabled: true + spec: + count: 1 + elasticsearchRef: + name: elasticsearch +eck-beats: + enabled: true + deployment: + podTemplate: + spec: + automountServiceAccountToken: true + initContainers: + - name: download-tutorial + image: curlimages/curl + command: ["/bin/sh"] + args: ["-c", "curl -L https://download.elastic.co/demos/logstash/gettingstarted/logstash-tutorial.log.gz | gunzip -c > /data/logstash-tutorial.log"] + volumeMounts: + - name: data + mountPath: /data + containers: + - name: filebeat + securityContext: + runAsUser: 1000 + volumeMounts: + - name: data + mountPath: /data + - name: beat-data + mountPath: /usr/share/filebeat/data + volumes: + - name: data + emptydir: {} + - name: beat-data + emptydir: {} + type: filebeat + config: + filebeat.inputs: + - type: filestream + id: logstash-tutorial + paths: + - /data/logstash-tutorial.log + processors: + - add_host_metadata: {} + - add_cloud_metadata: {} + output.logstash: + # This needs to be {{logstash-name}}-ls-beats:5044 + hosts: ["logstash-ls-beats-ls-beats:5044"] +eck-logstash: + enabled: true + # This is required to be able to set the logstash + # output of beats in a consistent manner. + fullnameOverride: "logstash-ls-beats" + elasticsearchRefs: + # This clusterName is required to match the environment variables + # used in the below config.string output section. + - clusterName: eck + name: elasticsearch + pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/package-registry/basic-eck.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/package-registry/basic-eck.yaml new file mode 100644 index 00000000..c9ffd8e6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/package-registry/basic-eck.yaml @@ -0,0 +1,95 @@ +--- +eck-package-registry: + enabled: true + # Name of the Package Registry instance. + # + fullnameOverride: registry + +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 1 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + # Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: elasticsearch + + # Reference to ECK-managed Package Registry instance, ideally from {{ "epr.fullname" }} + # + packageRegistryRef: + name: registry + + config: + # Note that these are specific to the namespace into which this example is installed, and are + # using `elastic-stack` as configured here and detailed in the README when installing: + # + # `helm install es-kb-quickstart elastic/eck-stack -n elastic-stack` + # + # If installed outside of the `elastic-stack` namespace, the following 2 lines need modification. + xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-es-http.elastic-stack.svc:9200"] + xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.elastic-stack.svc:8220"] + xpack.fleet.packages: + - name: system + version: latest + - name: elastic_agent + version: latest + - name: fleet_server + version: latest + - name: kubernetes + version: latest + xpack.fleet.agentPolicies: + - name: Fleet Server on ECK policy + id: eck-fleet-server + namespace: default + is_managed: true + monitoring_enabled: + - logs + - metrics + package_policies: + - name: fleet_server-1 + id: fleet_server-1 + package: + name: fleet_server + +eck-agent: + enabled: false + +eck-fleet-server: + enabled: true + + fullnameOverride: "fleet-server" + + deployment: + replicas: 1 + podTemplate: + spec: + serviceAccountName: fleet-server + automountServiceAccountToken: true + + # Agent policy to be used. + policyID: eck-fleet-server + kibanaRef: + name: kibana + elasticsearchRefs: + - name: elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/lint-values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/lint-values.yaml new file mode 100644 index 00000000..88136bd5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/lint-values.yaml @@ -0,0 +1,3 @@ +eck-autoops-agent-policy: + configRef: + secretName: "test-secret" diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/templates/NOTES.txt new file mode 100644 index 00000000..65cdae60 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/templates/NOTES.txt @@ -0,0 +1,10 @@ +Elasticsearch ECK-Stack {{ .Chart.Version }} has been deployed successfully! + +To see status of all resources, run + +kubectl get elastic -n {{ .Release.Namespace }} -l "app.kubernetes.io/instance"={{ .Release.Name }} + +More information on the Elastic ECK Operator, and its Helm chart can be found +within our documentation. + +https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/templates/_helpers.tpl new file mode 100644 index 00000000..cef61bdb --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/templates/_helpers.tpl @@ -0,0 +1,48 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "eck-stack.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "eck-stack.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "eck-stack.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "eck-stack.labels" -}} +helm.sh/chart: {{ include "eck-stack.chart" . }} +{{ include "eck-stack.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "eck-stack.selectorLabels" -}} +app.kubernetes.io/name: {{ include "eck-stack.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/values.yaml new file mode 100644 index 00000000..66941316 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/values.yaml @@ -0,0 +1,60 @@ +--- +# Default values for eck-stack. +# This is a YAML-formatted file. + +# If enabled, will use the eck-elasticsearch chart and deploy an Elasticsearch resource. +# +eck-elasticsearch: + enabled: true + # This is adjusting the full name of the elasticsearch resource so that both the eck-elasticsearch + # and the eck-kibana chart work together by default in the eck-stack chart. + fullnameOverride: elasticsearch + +# If enabled, will use the eck-kibana chart and deploy a Kibana resource. +# +eck-kibana: + enabled: true + # This is also adjusting the kibana reference to the elasticsearch resource named previously so that + # both the eck-elasticsearch and the eck-kibana chart work together by default in the eck-stack chart. + elasticsearchRef: + name: elasticsearch + +# If enabled, will use the eck-agent chart and deploy an Elastic Agent instance. +# +eck-agent: + enabled: false + +# If enabled, will use the eck-fleet-server chart and deploy a Fleet Server resource. +# +eck-fleet-server: + enabled: false + +# If enabled, will use the eck-beats chart and deploy a Beats resource. +# +eck-beats: + enabled: false + +# If enabled, will use the eck-logstash chart and deploy a Logstash resource. +# +eck-logstash: + enabled: false + +# If enabled, will use the eck-apm-server chart and deploy a standalone APM Server resource. +# +eck-apm-server: + enabled: false + +# If enabled, will use the eck-enterprise-search chart and deploy a Enterprise Search resource. +# +eck-enterprise-search: + enabled: false + +# If enabled, will use the eck-autoops-agent-policy chart and deploy an AutoOps Agent. +# +eck-autoops-agent-policy: + enabled: false + +# If enabled, will use the eck-package-registry chart and deploy a Package Registry resource. +# +eck-package-registry: + enabled: false diff --git a/packs/elastic-stack-0.18.2/logo.png b/packs/elastic-stack-0.18.2/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..fa70b78daa45585ec0f802dfe637e4ce2172d6f8 GIT binary patch literal 5810 zcmV;j7ES4iP)) zEw)vQ)`8Z7U<(>65YRj(4Mo6Nreakf33Yf32_SRsaMt@Hh#~jfCBW^ant1RI-2$F+Ls!$`IZMeGSXJF1;$Zc-LF^Xx0Xx8|Z+YmWN0# zFa&7fqWH}y&!gsf>35{eMY*ohEDb<6ruRVYNvMnm+IX!F^fj=4BUwjY_gGiGX;ucH z8`FDW>r~(}z$Cr{tih6e>0P-j;ku*HEDS)`(2~~v$-rdX9p)R#EBLHirPtwqC%Yp} z-T-uci}S&L7RXF?Uuv)))qA9G@R?+GqRAS7D#C{JiJ-p+e97)lRD}721J_GG_9jPt z6GT6vEtUS6z~#yAON?wr`vWUk>z3c3|N1A^r@I9BinrIFoc8>H3y_pDQ2{Qn_vcTFMsK_yJg;sgpdN?#*?F z;#zfV@IQd^%Q(83ifra^puY@YpO;EJHGsV%rk`nxJp&;t4ly?H%MOJ%KO~6OtUS8T zUkX@p=txywl&ruQFBN!Z02L#jzEOlHfOI$Hsq#Oa7EUrx zxft0HQ6`+_x}H=+IRRhjVXwryY5)}@o*IDgsGBmsLdCZ(vecaEg|3uCxklIf&hw`C=P3mIIJ+6y%Lx}j(#u9q~ zW&KeH128m~;lDb=byMrEZVGhk6X2<{Le<_FS!$a83Lp|6;m}w&1;%Xv+lS3=4GeUl zFVP4eZc+Kq$YO0CD}b7)UhAf~xD6mJ{XlQP??PXq@yRJK{p@h{f}<0_|MF00D$~!+ z&p_M;AVNqeKq>&3gj)H5$xtLrmNT(Ein1_JD(@ z&IQyExdYfdJ%EuItF0?y+z=wL!VNhQ*pZt+&C~-JiRuY%h;d~GZ~SS$3I#%MgANoS z8>NpMvMn5fK+r}Q^X~=f%CUA=4B%)i|BFZe*gkA_Yk%v*{jkG>P{~FZ2-MeK5Z<4D zXjAoqsu)0eyV2(+KtzCSLrBQE0KKxn+I?i_>BjiZQe_aL*}!+}cuDoGb)57KJ|C}`gq)g{m-52ErlWte0d`$B{XeX*_6G)mW&>w){GP%$9>CfV z3A!OBJ_Aq{9ze*KdM^XJ%)9CTfJI0D*m>oXZTvy&9JMuDMFxuUR>VVM&U9(yYy1d@ z>uwZ_mA)HF)Uh4p4Mdk)Mwac!%P6hq^8o0^wEo!gZbP1Jf~=FQfGf-4x(%SX z*w<-C=A)u|TTJcirUbMYF~z7UE+2d97qL8~>(al2=!Z1TGl2C#R^zYCl{2VtMOtl@ zoeMu|%b^x?KreMeSrkfu)X!aG#QmB21R7;H0Q8KYwO}b00>I z00nAw4wuaXMmAKai@aVwHuJdfC*9P#E1}?4pjDFklt?O3#!25mLDUvgW}av>c;-eMwR1n3;zHkH(P`2gp4e4%te^#bX2a68Hq$?8x7*^SycwY_}n-seUd zkrlv+3WHRnz?^nyqwl_%Lt|BP+z8O=g{^0cnm0+UnRa3M*vwJY3v?~*G5!*~JdKoG zNb-mb30r1LL}^;!F;M6Kq{fP}fM8%q)R%wzBiANvjlfV_ypF@t-_s;5MwLM`uP~WqGZETT3 z>)z)a=XD04lf5mMXnFfm14}J)XGCec%BO%&BbzrW6nH?gf|Dc<=h^$uXJ;C8l`7c{ z)Ztfnfho^LY^NIlvGukF3Qio#kE)zgUn7|uLG{XHjo0#{2`AU|r0DKpPDVf#(s z^f-03G$Jo^?~LP;YMHJDo4X(kj#GFdNJm0Hizp2RXMj8dL}n37Z7NVZN3sGhL~Bre zndgp5?IvQTS1&Q4kS~YSTJ}Xp%}s4*eb%XZk@P1hS(OtA2TlbZ0Ev5xGy#+%WJ}-B zs%QPvC(1v{xcsxcQ)=A_lhde_ ztl(_=1ilM05=cna?HE~tKX8HcKDfiNHh*RdbMLGdQ2B39d!d|Rbxt1(Rg=I}yGy4g zs>gdl%mci>Vvo&Ap0Q~uV$3dj;5FF_r; z5kNZ6Dcy(Q$}uAk2q1EO`IwBq)vV}QRCI!!c0fvo=EZzESvRHkBxK(XawE{v)t=U( z7I?7Mnf}jbXPU5GMEo=TdSQ#{EuH6<1i|Ao{taWF8vF8!t9mT2S&>ovYF7yci-6OB z86wsrB|}HVdIkqM zkxR&>L%I{PP-bFyQnfIH`#;Oqoq&i zAJH0ElV|0s(K#e(Yg^zA=`^>rR3IZ69f-nKvBDSa%Ig_%`EvJV3wo=v7^v-R{A!ek zONZsY5^H#R)r}+Rmw?_6oYTO5SEmfaaOoZRSF{G^zUOX5nMQJ#;76qM+_HC5DCh3m zJ}We0d){fgYF2bxTsXuST>!*(DpuKm;gOCVcFcXh|4lKUqS1A}Y{X0kE}>yTup7X- zM6wP$ZfW!Y6k!H|z|GPh z=g}tr*^XAgH(xci-0t$N7q<P*#br0Lg#-U*yiy^0iF=EZ{aEZUsD_e^ri(-91-y;pbe-v;xN*2nGrElP`Q6EU^GOum~p!3|a=fT|^v~_S$ zY{}boO-518ik?M9>0w`RHfW+eVgTz99_!|7H)n;zXUGXvgnza?S$ZFi8jq0dWnL@@ z96R^7GC?|bV4F+Iuj%%F&5B;d1#J!m)8>K19M$SFWeU$22|QCD52F()vdpWKW6PY* zb4oWMb!P2|m(513i+7GWb!*LvYTmt6h)diDJQuXA-+p$%h^R-^97(ZdUR@kBfG%@O zu2AG94|Tn31;dx_7}ql*;4zAKFBJ#?FNO_M|D7}H!#Z2%&un2TWfqCs(21Ml935Te zmM&2k=7Ex>+N$!3^4!xScEV!x?j@U}u4bK9k~1n|Z{isF&vrDGzEWa!RwbX3)3`O^6ajzWtTX<{H60RP*_cBzkC3L>ZNM4EOW_%H9eNhcg|Imf5UFz@x*p5 z4n!9pX8^me?zTyhpSmU=9xfk~aif!ir`ys6qZN4tO}UMz+7Z5QBQwa)cXUkI>7mEK z+Y6uF!q{eh#6O~9Y{rua)14lu2Vr2suCbYs2Rf+o?iu(y4RP(J0z#k6fmv5O)-|3{ z;KR_=aj!XAak)7(QD9jE1s_E0QRQPZpK+?pSh`@c3QywEy~T+`e$}(6$T3fWovx1n zG4DGh13~`)qRuZNuUBA~b?8zcdLV-{yNxjymXGQ2N<>XTfz^HKf~P%j?Iw$EwiUR= zu_k}~Uf_?3?M}Ve89vhbuTa~sFt1mjd`!l*AipQJ6z`* z=Onp;!+-IgrOlwe>bso~o7k`}f^iQ`YL6+zI5xss{l%c>VP zIPYK2qRr`BF76p{io0th-aR)7TeivCa?!|55jFWU+nY)$1==URTgOlly*~WV_~&X? zGZRvv1 zrfTWfI2}B3V%u{5wu^F$qc)f_qq}8Hw!$E)&iZ@3`+7u_>%&ujG&foU*9^e5*uBQh zJEcQ&2gIB${r*|swp0hHG6={9vT!ec;8R=ma;A>2^_+w&29U9&aEypXwX)`fqW#K- zjgGwSEEevX-5QI2Ms$#hW(y3W{+ZBhglBEP?{4z1t#bw9&XF)<4@DDl`%J2%b|7tA zgP;EWxP!nd8&&}iYkskhKxrSNCL4~85>e+?BCHIHxszXydoNa%uDrF(WeZlKoa=_H zM$Wd<{ijxTS)J%2gLGG>s9WD5*Z=!M84TkJ>q_4vqJR_eel z1NaE#Ki!bk$XQrAY*cQ|!l&NI?hy2u3ab9U_kq3xvRW{!+8$xm_#rDAp57+E*hhYB zfvirr^9j(@je1Qi;&_8<(2_Ix`p0$xNDh#r*z9XTXxf`USg+`6R92agy<+0vHzJP4 zMJ0}x5ALNPNyX#k2}i`~rgK2dS+(q^`9RMSI1ABFV{T|Y<+8OiBpBZ znQ{JnYkoE=r@b}!?H0a+IXCrxKdu-~x12TyU6RvyQ8tpFACbf8sW-AasQX!1(@_Q= zs%#VYv3|DHT6LI?MZc;n07=RHgBAr{aLdEg>?`vgyHUT_J+>>ut44`D# zh|NGVo(G8I_OIF=4*vi`%*ipM;ac#9K=eqMCXYt(0D2q{tJHmDy$)P60J|y(v{|CI zZged7asmh_vLap?t{Fh6ZD1iOdJ@KC_Lf~VD&q5(fC*sO3Wr{eSBPr{@Y%q;!yqra zC9m-y>z!f%y`BInEWJH@^%wEVaW#O`sLpUxUZX&rJ%C@ya(yCuwZ11KFfdMQ3m8CE<%ZkOSy}3qKu->Fh%f<&D^{&BAn&AaQ< zR!&9D#Xwmc8bT<4@|m>nP8_guX&iED#q;xAnac`qL-h%-^&}F357Q3IfRA%?Yu$~T z{@z(>heNGKipovE`NVeca|g&A+ZX=hPtRWE`3Rbj1AQ4w3ZD`=J~c@rW{((qKuOMJ zpVa4}hgS`1+rpUdshD#F{kA|SMLU6f3G5Q&Ut(mcxf(`71bk)hj$<~qmzHBu6m z%wfy$;gy{_?id9;pD3L!vIE<`psBrlNZ<%?3{~mAY~fTz?@o&TdZMr5MZ@xSvk#4^u=W+$^BH4*q6k%=Wk zbLS6kwtN~Q#q(zHbrKg9o z1vy`p!3bv%d+yysDC;q-1>O#b{p#mAmsNP!-9|;DFaReqmlvK$NWX)Tt|Hn-(Kezc w4beTet$PsNgQo2$`||K+^70bqTW@UqKfDL0=G%K /data/logstash-tutorial.log"] + volumeMounts: + - name: data + mountPath: /data + containers: + - name: filebeat + securityContext: + runAsUser: 1000 + volumeMounts: + - name: data + mountPath: /data + - name: beat-data + mountPath: /usr/share/filebeat/data + volumes: + - name: data + emptydir: {} + - name: beat-data + emptydir: {} + eck-logstash: + enabled: true + # This is required to be able to set the logstash + # output of beats in a consistent manner. + fullnameOverride: "logstash-ls-beats" + elasticsearchRefs: + # This clusterName is required to match the environment variables + # used in the below config.string output section. + - clusterName: eck + name: elasticsearch + pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/values.yaml b/packs/elastic-stack-0.18.2/values.yaml new file mode 100644 index 00000000..1356e345 --- /dev/null +++ b/packs/elastic-stack-0.18.2/values.yaml @@ -0,0 +1,80 @@ +# Default values for eck-elastic-operator +# This is a YAML-formatted file +pack: + content: + images: + - image: docker.elastic.co/kibana/kibana:9.3.0 + - image: docker.elastic.co/elasticsearch/elasticsearch:9.3.0 + - image: docker.elastic.co/logstash/logstash:9.3.0 + - image: docker.elastic.co/beats/filebeat:9.3.0 + - image: docker.io/curlimages/curl:8.19.0 + + charts: + - repo: https://helm.elastic.co/ + name: eck-stack + version: 0.18.2 + #The namespace (on the target cluster) to install this chart + #When not found, a new namespace will be created + namespace: "elastic-stack" + +charts: + eck-stack: + # Default values for eck-stack. + # This is a YAML-formatted file. + + # If enabled, will use the eck-elasticsearch chart and deploy an Elasticsearch resource. + # + eck-elasticsearch: + enabled: true + # This is adjusting the full name of the elasticsearch resource so that both the eck-elasticsearch + # and the eck-kibana chart work together by default in the eck-stack chart. + fullnameOverride: elasticsearch + + # If enabled, will use the eck-kibana chart and deploy a Kibana resource. + # + eck-kibana: + enabled: true + # This is also adjusting the kibana reference to the elasticsearch resource named previously so that + # both the eck-elasticsearch and the eck-kibana chart work together by default in the eck-stack chart. + elasticsearchRef: + name: elasticsearch + + # If enabled, will use the eck-agent chart and deploy an Elastic Agent instance. + # + eck-agent: + enabled: false + + # If enabled, will use the eck-fleet-server chart and deploy a Fleet Server resource. + # + eck-fleet-server: + enabled: false + + # If enabled, will use the eck-beats chart and deploy a Beats resource. + # + eck-beats: + enabled: false + + # If enabled, will use the eck-logstash chart and deploy a Logstash resource. + # + eck-logstash: + enabled: false + + # If enabled, will use the eck-apm-server chart and deploy a standalone APM Server resource. + # + eck-apm-server: + enabled: false + + # If enabled, will use the eck-enterprise-search chart and deploy a Enterprise Search resource. + # + eck-enterprise-search: + enabled: false + + # If enabled, will use the eck-autoops-agent-policy chart and deploy an AutoOps Agent. + # + eck-autoops-agent-policy: + enabled: false + + # If enabled, will use the eck-package-registry chart and deploy a Package Registry resource. + # + eck-package-registry: + enabled: false From e16631a09bd646d452c4651217a56bac9d7a14a5 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 24 Jun 2026 16:19:55 -0500 Subject: [PATCH 07/10] new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes-2604.4.0.tgz new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/.helmignore new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/Chart.lock new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/Chart.yaml new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/charts/collectord-2604.4.0.tgz new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml new file: packs/outcold-26.04.4/logo.png new file: packs/outcold-26.04.4/pack.json new file: packs/outcold-26.04.4/readme.md new file: packs/outcold-26.04.4/values.yaml --- .../collectord-splunk-kubernetes-2604.4.0.tgz | Bin 0 -> 23532 bytes .../collectord-splunk-kubernetes/.helmignore | 2 + .../collectord-splunk-kubernetes/Chart.lock | 6 + .../collectord-splunk-kubernetes/Chart.yaml | 23 + .../collectord-splunk-kubernetes/LICENSE | 2 + .../collectord-splunk-kubernetes/README.md | 227 ++++++ .../artifacthub-repo.yml | 6 + .../charts/collectord-2604.4.0.tgz | Bin 0 -> 16849 bytes .../collectord-splunk-kubernetes/values.yaml | 690 +++++++++++++++++ packs/outcold-26.04.4/logo.png | Bin 0 -> 8716 bytes packs/outcold-26.04.4/pack.json | 30 + packs/outcold-26.04.4/readme.md | 227 ++++++ packs/outcold-26.04.4/values.yaml | 698 ++++++++++++++++++ 13 files changed, 1911 insertions(+) create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes-2604.4.0.tgz create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/.helmignore create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/Chart.lock create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/Chart.yaml create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/charts/collectord-2604.4.0.tgz create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml create mode 100644 packs/outcold-26.04.4/logo.png create mode 100644 packs/outcold-26.04.4/pack.json create mode 100644 packs/outcold-26.04.4/readme.md create mode 100644 packs/outcold-26.04.4/values.yaml diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes-2604.4.0.tgz b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes-2604.4.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..aad6b5008c4e2c21572b313ae7cf45c4c298d771 GIT binary patch literal 23532 zcmV)eK&HPRiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POvFcN96&C=Sox^(l0Uehzlyti>1uHBHYo#xzVD>}#9p_qjkD zRi>&+i@B4lw)Ldkd(h%C<2v*0Wr z5}p!CM0a_cr_6_wV29_wN3!*T3KE z_x^@@H)?gsUoIr(f9u`2t?J;ulON9LzX%tUr2}-n*}_@oJ~y{Jy{*nxDzeRLF=%jH4GURc+C9jDB~>ifD?C0fW(ADhbax6$Ifl zGN~p*9sV{h_v9xpKy)%C6uik6&aWPos%#WcjKW~;ugUmMd`zoy?3 z^gm|d*^Sy*K>vGp@7=4>|K8?`{(p(zmnQCXOoSXDF~OVnwg(UI-@n_7@YePy+Q$9< z!+Q_={n6;|!|49qyLU$q@7~`WJ>1?T+Zgxm_P4h%d3Yah-RnKve9*(;gK*dylaz2Q zNi;z1&EDpA(Ay6B_fGm-gRS0R^I>Q6LBD^uAM~~cy z+wc)`f+ZOs$#bGx%wt7^)Sm&u8U2m3JQD-;jb7g-my)E4nuyzPp^WOHU^x$oE0eKE zkTB;|PBRu$Mblj2bHazFpe~#XQiJpoCkoo@+Zm_lG$vybL75gpx6nR4Cn*u4%L$IC z`U_>84T%7zR89!$P6&?W=q$2kXfu%qd8touk}c7fJZy<@2Mn5L0p=I@{)ZO_hHN6)FAO_;a{rcDs3aV0j( za;UmGFbisiZ$A+Xa8OKyOV6;J4BWyM$&9Pw{Ra;om^7MFNpbvy#CUp4LY78C!Rwjq zjBv^#m$7ZrB~1v+rOUWy(npxaIVUF*PQ--8(E!~w+s@$DjfSI9@5-Z@F_`|nYYoP& z(+jM~z-qO=?bRY#%%%xRue7bc(*^lZrSP^GM>VY3b zlA)i~q5ZR|sw?g5Is-Jqu^=WZwu$Dj1?HYaA|eR59X0ix-Mc`H{s zBnGJM_R#>A%GPhsK0MkUmocLtpu!U6jIyR(9%p0GEaPlcDOi--XXA2~Br#FYrxwCM zgH@|)=FzTfr{KR_tzsT^*(*UYIaL_Cr-z(fPG9lZTg7_*V=QR6lf%N=Qi|-ASUyE% zMmUeVCte8>N21v3 z1yg!z_|XAs2evc`H(wBm6(SDMhmRJc)09crj^a2UMl8WJ^#&m)JkN4@NVwkOeimZ~ zakO_%QYp&GFUdtM8RwE6pV92M_cVJ-757`hza)<(WiVA8ET(DLUXWi*TU(JSOQ(t{ zD5ga*Y&0aVj`qF&Ae6EQnBY>PWM?GRo3?w7d6(yDSCEhsDY^x0B_0^4I1E{y$}UuN zU_!#>b)bZ}6LMMfMpM@Ty4y=!VqzBY$1ruWbfl4iOV?`Sca2gf|U?+`@G*(8$e_@B)7|1ILk!$ zyx%R(-AVyZrA(PBSvn_fm)m`wWHHcleTbk9a$|VFQ_= zDF}U)qbJ1rkaxvGT%ko-ovvlgq%5Nu`6r{P?NdYr$T{T}6MXqRm4u(;7@8S3jJX?c20N*S>s>6j>F1l-~{jaU*~P&o-W%hM>}Y)DhDJnZ`l*ydG&$)M@U z{;|98DAh{v<;=X$G7{y)8u>yf1dQ5s^rs>7cQS3r8*%cVoTTA&fbIz|eW>=FUcvj@ z4}SM@h@tWKdR}4!rlHx`rhhm*tJlzp)#btA*V?$D`WW&=mPbztu zP@ZN?NZsJ6$dk^`b4uxbehM7Q!oo`MBhe`k6Cta8^-Cri2~QJzc^c#Ksn9ay=`at^ zh@9Jqh3@Js>J?XbLd2=rB~h)yFvj5-tY7JnQTTZ15CxdnAfh5<=Y&s-gVf~jH|$h(_{UQrNrHsL(t;6?bgWVuhU-xT ztqiJCkZ{ado>kKo3$r^mdT`5EiK*z0L|4}+6+PrEEXrk^g$2K_I##eJ{_tV$YaR60 z0xF-LZ=R~Gc0;cl3+v44>eU-+1lX>w&K2wVm>LoxN^7NNX4XnItiTPXwTjZAo1Pob zi$QXYiYNBiEcgC;bBEA`Mr4PNYw*k;DUn}c`cfi4-R#{6tJL_JBFHCd&|hH|pz%|w z8v9B!fsjclkykST`;48{iJAE$QAg&I=yRo+N%UE)s?0kwYSg~v`f&C+x~1S=qgSq9 zPJG^H<7+W>F&leL8>zUe2hmr&g{&^RMU{|KcGysjjk_6({E``qW15bOsoA_&h`|V5 z;P|YR?Fm)qgb$f;e0+IO_4)cYqv;{$lH%B^)k>HsB&XR4;R#J~yeC4Okz*~(ks9=Q zWvx8E_U5ubeDnHE^r63T_v6~%%^&MOC+mN$y}9h&hkyFRw{N05Yj4DxX#F35fBmP* zczefWcYf9|eqS$?Hv%V_nz2K|Lz2n?3i`FY-^p|ls?56J24yo{Q0qH(blMA8F2ZBvo$l-GB0MSfNI4m3ZYtlRXy~r zqDq1{@G z19t}I|LbprDy*mF)LxPP3WrK1Gh|7|Qj*GFU;jCH^ZM;D*_ zwa%UOpO)FDWt6OJ(6&oxE@d`o`=2;Po5=3X#d*Ll z-qbbD;mTY4MyKVc-q>re-(0*2I&bg1Q77kG=k=TDP4M>4`ajnHTGP_R`udNx%WuB9 z=I^O5v5WqzH&B@={Wr^bisNWG{f)ovGQtHF66UPBe+<;FkDe^XlE$Pc%=5Il@PdsX zB9aZY)5EW^`yq29e>5bnjAMrWq~q43$+x z@i=8dmTuKbmvSLa!D60EL`PsngE$#7CJ`0(8Zts_c^a}LA*n=?p=>^@;(?rcfAI7(<5jB^^1 z?&Kmk&*QWUnAG7ydO&y5XnCMJkDqrX5t63ku9%9E2qJP$Lm~owj}nAg?qG*m4$Tsd zhcu>=`i4x^c@b05HL$uGRyWM@Zl!*=d7eC6c8gzJMEPsKhr;kN41sY)?5w>^dC}ucX_tyux=8j_;k^zF&I=`giSA+sZ!GnxNXoS;%)fq-I}~l)+D^glXK>7KhIdH^2xl0E-XkY%s(zPD3IZ`@AOB z2Vf8-3CA&db+o@G)=_{`=D&D$9oEk}$R&jhRf4$a7b~t>ofUzckkoW=gyVRK!!tx9 z$`TK0&>s_$mSq?rqaF1aAl1`^f_@|bYM308kAtY!Ilf-ss89K}R< zQ;Ckvx_YqM4n%NHadFq(E+gCm1=X!N492acufPHI;H}cY>sLA7qx;*vN?msWUeBs* z7(m!!c7#kJ)Yzgb4n*LAml`tbX!$9qRF_fGbXPhTE9*?YP3 zV(+8REIYihy>I3fN{BHNV+wq!^6b_C-k%$=Xtmrysi((#NB?@hyLbBR;P~X@pfT(4 z;OOLI7iYA4-tQ_dNpzbB+XeDvG3Rzu`-5)Rdq2?IymxPIaZxMZyBhe$;yxN*!=k!$ zFKOw$_x(%0{&2~P2t@MUWY$v7T+GjQ_>Ae=KU zP9>8#zS`U`sL6?try9u$OSV~sGcB#1hFR`LvZyR4f<_8@LK4QO#;$O7`E$x;j^jne z8~T0KS=LV!jA={f&h;l}*d+XVXG(xGy5PjBY~XL{!1BiMWzVg4{UF%h+PZ5AdwW*# z>m73qP*=yrXFM)&t^^;cjowdlL3m-O+fdrxBfHK1W7DV`QJz9P`7Vi0gLL&}=?yTD z59iXE8o$~9as=cDBnEEDPst`ZHD5FxFU@he`a}I(`RWzDMzMYGvMiKuh~|7Y@Xe&g zX(@SNnB?!1<}{4sYZ9OPS0g@~E8=ql;`0sd-jqe;)M@-q-?NmQ3i_TbSyX#nSX?+y zb;;=|Xmw6$3iX%R??i^t_qoHN=U;12Z{EGXke^t#(1V4n#w@|Z+|&^ndi%edol%t( zEhB2o0pU3GKmiMM)n*7_(hsBO z867o{J@bhF1+cu4wd3<>Y0Q4|K7X1UGx9kzqj)L z{3U)w+ewLT3v)?FIFyro7;uuY&h&<1Usk{G;5T>w??2z&dwINf(>50E|Nd4r{=;_f zet)(9zr^q0)yeL`{u6Y3u>b1h`N7L$bbRpix%hAVTB>rAo@3dOCZlOa?;3zQh&&-kPOwB% zmZJ$iCw7=5y2?N|U~X-c2Q&C*Cntvp6h_5TqP1sxyXzfPnfTW0=Eef_Tz3cByV*oi z4^nsCTiA%f6m(jxBkeog^LYN+x;%G>))JkV#lpFa^DVX$S(Rb6ZqU$0PE}+YB=U zLC7OldW6a-Zqlz19<4i%^FqJQ=q)s+*YTt{s$gfSLv{lK2`x2$w(jSizRx^UdM<7$ zHpU|tt(MPJhyqO`55?Zml)iIlm|)pK7FS199S!=}B56o80aMeJF(K$MCKac>pMnE$ zttnoh$~|GVoC3D3WGKvqWC?w*c^!66IH!?1;hCuRtkZf0Bd*b8tT-{di#7nV8hQcR z(CY%0YFXq|YFdyI5{cRg54B!*{Lpc4*Gix3X47jrQEmX<^w}9Ub=2zKLV6I!Y^c@J z=PSCv`oI#Bae@R(YU@H%giW;#G@@K+7D#m-Ceof>x=3+Q8RP)G*wCy~?YTFO(1^37 zgPt;u3~k>)bfkE$a?ji;uLcOjTy@N}sW5P(rTeC8Dym%V7hq{)=K$n8cmVtkxgcq} ztlEs|UBA~4%*m;Xb$}Gml(t@*^tUZb*&m_$f!S)kHsoAyzqc(tghyzZ^GNT|S7zH$ zVa7rTcf?CI z@kBdmf^n(i9S*0Oped3rLT&DY z7>@`?Lo!liR!9GWl}kFUU(s_#{6lp-u~8wP2=uO3C5f7f)+pr$49x6Pnl_ZsopdL# zSG3lKImxsi6wIfVW!AxvN-T?s=q(V0_{n0&UYng$a4H1@j#DM9QMHsfE|*tRr}EM< z!YCydiZa*(eKuL~kG0PurF}HW_D`nA_7pmAH9#`@Q>n5ANN69PHlh_k*q7 z`*k%pz0a@5*6}bje3% z?FMR)@2cCv+XsbcSlS*F#k+zl7tkY)7{9c{-Ry&2Tc3dJ9p_MdI%*8RDI=&QChw_3o zFOt{*$1rBpsy7jqShdltq{S&yLxGX9tA)*fTon8atQc85KgIb@R zrmZwjbGfX_no=WjeKqC8Jbd{qEL1_~YO-Dh!L5GG-x?OdL-kR@?G1DRq{KnhiXkd| zBKmHI7Z(8cPK&1nZLc!1#wblwLhJL#Jl5Gj8K;aZiX6sR2%{d<*o-(+BCdr4E1q$3 zPFe1Eud~$dG!5_Qb~W1DSmK4%UPahxh)!<%yQ{i;9WX)2siYx9wQi1gew}VDLwp*; zQ{MJ4*EkV~Hgh_l?Yo=%id`HV_6;U2>+*hYr-x9$pQ^5z<~i4 z7+~wr7qk6Zt=CsEwze-+1E*J;E%3Yz2MfP9!x9^wjKQ=eFwpR9E zU*uOZVBc)vEOVdQf#X&yA|m88(+-4vB{*D645#QoBPTkx*x8ye>)CA{0=H;5^2>YSEt+xX7AC4o;L8GrRW`kl?KPA}-)ZmEOVgwIjEf*bUKr7-`eaSAL; zP@h9{J}#WZs#>?DUlVxt8?EzVN!5yWdM&s9SKR*|>0Tbk7TAB?+q%D9-T(J{o2&i* zC4RS%iPLITmx^8Rc3SHef~!a>%)Nb}ubsg31TG&GgfPaOpmWSA9>zqgI*2-Bg`_eE z1$b)hO6-**-0Y!UmLx1iF~rmMwGxU4vG15fD}-V;>NW&wcRoG`@IlgZ%2}F#8|#d- zCVd zpk+9e5#t3hQuPayr=)}{N-NydaCrPJ&6T;lNnwat;zR^nG4$A>JY;dFp@;tM<#YU&Lej0_*# zstbEw5N|790oUHTg$}I*3L;&rCg9DgiZt#+#3u7o;Eo>e>=sy15$UGdUBG!t-4r3zPNspS37vlnmbM4z zua@;*{GnC&F>arcX?uX$uv%@Gp@_lEMl`K(*)PCd_KZSKCThxW-9rBYM}0bgp(d2O zJK)#=WGyh7Oe3UKnlMu>?b`1JR2cYE(^T8yj5*M8;AfiALfav7^#D!Jwa1^rX_){ z&@dpK(bdJu&AKk?@0X46+$x(_kCj!oscxAe0q6$%Hwo1#rPoWZEsoA{8j`4@mJ=aK zF{ez?7gJ5+MR|cMi^-B9O-ZzH><(tjcl9ia@dr)o=4+NzX1|m}B}qiNu!3_&rnbDc zDyupS*M67{#B!0Kwk|~%bk6c!$gmKKk)P4N&F;ucdEGTu&{{Ct5Jc#NCYHWI;t@Fi z*bzqrM^(qoioLN~mxddN3&zg~htLh8RrIZPIH|Gi({qv%A-ejSnh2rzl%YX4MMb;X z9nO28BT#JmzHsY;);!_MoTPWarT;Comt=CPWHF;=`@665(QG_8Wrv$_bfkkt2q@&@ z$ty_%X;%)`#2a9r(~4@kV-%9wANw)XFp4a62Nh}7sk`Xtap@63k7F|zhiU>0{dLn) zBtrXtFn$Iu^J8*O;?kX*nkU0Lu6ev;v10aoU2m1trl!TpeudMjP>hv*Q*m-`!uPlP zZLO+}eRi|~mW$s7j=jv%wN0j^3R~NSfZEohJ!BCQ#8}bWvE@Qrdh75@nhn+#WV+yb z%fxXI#MW^aecDpoC!iAQB4klObtdqjwE>QC(?CWe5~{_0$;?~;UM*8zPZDXj792M^+DrAgF-PC( z&{-WiGY%aSCg_Jgd-M=jXV2Boo?Fh1kNBoeB7?O*_JO2Ngat=YWhTD#iBvq$svk)> zidfq61g>xV7&@5{-Dkw}R3J9e0na8(NMwA|Z6Lt_GL^2IxzLyUiU2%6L~AL7Gv_xV zJF2P_vOLK-f>4> z%EfIg^#9YZ-v4g(H&^~YzR0iSe8YHz=(NBP)7UL+z@vQ}N|b|n_&jrluRWU8@2bCR z@Bh;Yi8I1QM`nvmK^ED6)cpT#-s`RQ|CjlF_|W~iwRf4p!{mv!TeU%eVfj0)pSvGF zwmy6a6n{-q;<0m4M-^|QpeO*QBpq!g_)@{@Xh)<_^1wcm`%8%iX^6J(!k;ub&POA9 ziP}LM8CWEZ)SoTrpmQ=}TNvevmHSVQV{HI|vkbc4Y5hSoY$z{P3u+hw4M~U<6A$la zJl8WYU~TDKJj1aU+f<;n;S?t0$;)F^7G9xeBwX*bo{tbG+PoBi0GXtzFotpZt)g^X zC@`?_=w5Z+^mg9ds$%8&r6V_;Hq%Y1DKayEnJJHjgYy$~fADDeH7)w+CPD-09O+ro zb!|UOiC64g#%U@?sQo`8_#e@(z|xH_k73P!mhjG7P_<7CgR2%37S&*gE(PrR{Dp;r z#i~|E<4?5y+gKZ-zYr%`j6;IjciO0Z+P?ZmTF%^RUhj2X-TeuPla83^gJOU_d~oh! z8phkvJ!&jc7QI|qjq-XDcAROd%Bzc3PVD&bp`prO=s!7=q%tXWC_3s+6bz>tkVP$P zm}Kh16BfG-eB(4TM#=scCvh>1SqOGq5p%6J#1fV@4co5Jg;58H^|?z_oz0+esQS8o z#)4?V(`lY0;1tu4l&8qw-lahnn(>NMKX(vCO#G(dTm_Goxw5P+>a6CkxWL8O^)1cy zra;&Iyc1#c=d&lGu@hIFjzT+irHLpMQ=fGXwDP7t1+$vJ;^=>~F0jsPmSouN?YR@- z8ixlvO6Q0bjBGPPOOBF^Py4oCd1K~};dQe>$wuU9i9u25gOM(OHH(pZ;laKyh)@cN?DVOdLnO!?}}>EtRgsTt;)i)GixYPAwonFqg& zUKQM&g`bOo%*E4%xVive7vgLKW?n6cj?e^)-^sLLLE0?S#`|r*mQ9?o95#DS+a-Er z0Qdx{Y!*EO0n83su=-7u>hBTwOPVthsTHb$STyJJ}y#^eptO-D} zYOAM>1Fzfs>3INb!raNM)r#mj6^vIandEux&8RthPMZ=x z?>=uPsQ!b$6Yw+YQP)~#v79)MD6vYZIp8|Bpx-lcnNfZFul@6gg-~iWd~n5%oddz& z$IEeTCH`a?u5D3;MQZS`eLJ=KeeU12?|;pESg?9r;0|Dc{m15Jf2(@`dw+9#b^rS% zewAxQ@0D}McpuW22gM1_hdAuuTuvA_fh{^`5A+R8zoo-odJc|S36VI$5*LrAKYVCx z&RpBM`^M_Ef-^ZRNMeJ|H+H(-zfh{A%2c8)Roy+yu06^QZ1~Io+;W;fhggOa^S5(j zYcprgf#nCO2-!K|Q$M+4(iT{2UhvHfFFH&oV#1}qhvGIZJR*FW4)KsGR`ii^}%ogu1CD?nG`iq#wI#0#wLtua^!W$ zy8J4MRqo69zVaH#6m|+pQmNI2VT@@~wC;t&bu(JfFP-E)st?fE_{9!TOojdP!k|P0 z29?}`Hm|lOuf}??q%yG1>aX05l%>{Y^3~D4t5sU7MtDX4?eo~8yE7%VnlpP;pX(WWutWa?8*(96p?EmshZKy;LENZVPv&7%JSh7yih5acy%hZOU9*W z>-G0P99;>{7CQr*yZ`&!{oZ!J%KzWJyW0O>nRR35WYW6cMb;m$*K!BXEc5RP&$+)GphwVnRXudV2cH8JYh2=oe__S5s?8Ks-X@w8*-~7es<*cTf(~6uB@$ zF0h1Qvn$O$**V!c+&Ovn$do@lwNM`I4&J;GEFo{+WLQq#yipmQXy{gr3Y1}v6Cw$R zJ`71cs#ieL^T5vA26U5x>wE%F1cijSlaeXyDlN$26onIm`pPSc7>i!8bu?z8AY%*IH+ ze_PX?B#}jU%pu@GNH$PJhWU5{(R9Q%&;{n{22w02-#{ZQal8(|Vm96fNV+liSv2;% z$@_p7I*oq<`$iM3*>|by#yPruzPe`KsID8B`kiQ}a04K~Su{%kWtQkq720)rlx3Wa=Jp3lEYX`XB;RVTAW`;Nsr7s45s*sz`>c+PDy@JgNlerX zOu@M(mu`D6b#mFt0L*>a(U_*|>E3Y6DG*Lbc;?#H6jWzbfK^lLpbRCI6VCGS1QqH* zbAmTBTrBmx)YtqVyFkUq#Vp@~&{UOHd7h>a5iAWdP7*4J*nnsI$C5DOZjlIRKV*!jRZwOjwLXXmjR-%jq1 z^?4=g$Z|%eKHM@4ul!yEr;C32{ng{WqnCRpd&j3Q51#BPX4Xwv;R*sg{S%pIaE>Vf z!~lIIEYmb3v5pAf_-z|K0lD(Fvfa@3v*_fLQrKfyFRg3e(6OJ?$?0olZ>iR)WpM^Z zISj=ja-QaK>~++n_~SC6p>!-l8z71k9YGJ+E&oDTN0_tBS1GMNgke4!5sn0Xuf3F- z_>)<#X@mNFuD%{axnosK18&MGz`wwkG|3YUmyIA$R7_Lim`C8P40EskEVs5#Q}O~| zHZ|vG`8=MM8?}>A`@&B$gr!uBhoY_LgirN4DW1}aIT|IrTo)MKI2Ey>uuM~Ms(?Ri z5=SVRo_fOBqllb$&{N&Ijy@_5ygq;fv zLC%Ume-Md{!dRS;S-c+do;JQ@krOV_-^~y_*tBP*u!x1CgD*q}C-^ZOG zVtaB$QZsnv6|z+8l1wx_Vxj=9S@u|MsFX>o;BvgcsEC1O_nu-0-x=_SglmH%^a$PS zZ~i`fXTnnhQG(aY2SA!|^)u*9wZQYtpM(+WK&Tqpck#O+CSt|yE|DV=H6_G_?)gTa73cCPV z|4h(yp`Y8R22U@!WHQY~L@MTG{GMi+i7ufTCviqIt;SdzV$Bnqz@64CL$^CtJX@X& z2^V@ZsaB59X!hHCnt>;GyR&QQ9-pGlv%v6iSWMFpW%)3sVnWk#2mPUjY8+LfHN#7- zZ`f()EZ5Eh478M`K~&-m^~N_K!6U#l4JVwX5R_CaN-zYbQcMWrU|VcaPWLKeL}(A| zF;k+OZaN}D($pxhwG(<9X%wo%L2cr=>v5Gu;#z*&o0Z2ErV!|}o*c#JyO}`!UT?jF zc7}rSq0n(kl?Z``ITz9~BQT4gd^Oyrbw8oozbz2ENYQ_ClIz&05TbOH$FZAe%q=Ug zFkj&dO%f7OEJ-{C@r&hVf~=A>qZv^g=Zxv7^0TuirYJc}bFqXj*$6tjAYnOcibl!n z7SaN@IsUAO1UC!CZg_Tba)>U-&`5k62p;t*S*37M;K%JY0wER^Q4yNVo#2~ur|-Vy zNwl7waPgpQB*HxLB}jhgK&LJy#G!u6ljxKy)|`V2((=>YET zAW$s3pm$pO^?*Xb5NCxp+I;vh;L>WuiA$S*UzWDrFA4^5O(T+EPLTT3)1KG0*)y*{4<=K>d&I=M3L-~B&n9zpy}pzA@Ll?4wKEN#}E^z zPFOSQ0d*Q^UBE`62@u6SR7tegsK9*DpOs~PMdU{I?Og}8;g9yZw;oo$G;%K#Fx^*m z%5+j!_i(}5_7^Rb;;g|nkdU0Ht#TIj#B4Co++wlul#z%M#v%DIGVz;FIsg2LDI?=UwId=ijjix@ zMpEydy7)F&q<8=?-+k7#sFEgx8BH);5^*9jmI@;DRjVdfG#z)roVU1Gib$pqo*Dkw zz|lOb1!{U{zKX`5u?rM4t)Fw3#vu+T#B(eZf*)rb$Dlzh)&Z?aX7mSIh(c^+$^kBT zC#f}W7a*o)EHd(zRgs;XSlsnfihgo3CYP%95ly4Qa$NnfJLW7`LYX8SJwktW*IxhG zeIwr9>8}5*utJqtd(#1{_Vs^s*Vb%eu>OxV5Hi$G_-janB%=}Ia@{Mv{tpH1?a%8O zi`HKEf`>R5z5Q@^^W$IU<4th-_QT!nk6xvpnmb)6nUr{KwNe^MT-G-?nC_a6-52~7 za?0Sp!JCUa!TLWOfbFf1s(i>Yvi^^?H{H%1Zw{==(!a~+jLE{vNwK5m>e6CKO<|z* z7)d6lPbhbG4j|BHIu4gPDXBp3)O2(|WGo73^s#H)kCX|-{~url5#`+vx&Q>G{@4Zc zqV79r!PGorOg^F9pl2nqz)-8>GM5DS?w2CY&Y9 zEUBrceLr1eHEpwMHBHlBW+BTRpTCCXvR7QbQf0@}m#6Kji>41q&=yZrivq2ATVdVO zU#2auOH!<^I+JxZHyNc;@G+~CjTacR#En~3rKhnA)Vec4$0>-ao;NRzS?(FWM{`~$EaIC`IAoN1k6ceq0&9w;sl=)$FMQ0xC29l z3q19Q=BkXXU#YF$-GZTEDKHtHfr4jHZ>Dw$Q~RH47R9DZJ28mYlAdeFwIq(!h`bKs zp<+i-GkvmcEel5cs*;_DaSmnK0}9l5r+k$YMKDJruYo z8BP)^*I(PTr+wcmtie@^+DmShNt)32My(B(R*52?1&eCeV(s6#P*p@uz__3w8>+l1 zW!vApe)}=zW75=qhQ~Bj=x?=sT3M^FqircLkcB=L{nJoI5wOF0m|ZU@Qe`DH`_hy% zSO2kCw^tksJGo?6(d(6KdV+T`P#tfhpxqlr3@xf!DTBHg8fJoo$6!N9V#Q0si%+01 zhb%%bwUw$B#0ooHT}~By#)K@DGm6Bb1E)BbtfocuI;irC_q}ddpIn)^QqFxx%DG0p zuZJ{O)BIYd-&zVxNSqZn-I7rbJmW3Xzhe1Nnl|B`RXs2G*5A%IeTA_Qip)Yarc8#Cw?c>M`vW( zH!W3O5t6Cmq#qN^2}e&44i+8O<%=7GOl6o?I;0otN~;}#ZZr~cdsS?f*=;|w?R2&# zndT}~m(<%f)s3LGS$?%u27_WSYCl5H-j>djD&MaNK;|}3#VPBdpk#=hh8{EeqSB!TONE!P)5Tu5}`a(^dE&-p9RiV(dfk2i}@^|KT@NL zSn?NVc^U~9Bp(i}~tF{UY>?UT6FQMtl{&B@QUpdie`I`#P0*Wsi zfR+*s(58YjfQI<6WWsT1^whgMYAVWB8~*)GsoG4~FH5E!);vTqZJ#nVa9{e?AXRU} zO>lu9+x4!HP@!W7ZI@=)e1n)ZI&wiy*NrZv1jV%92zqWmekarU-B1VltmbWHzx4{h z8I6xXO_YYyqTxMf;H7;q5$}z4;y)r#-05(t3xU}d*a}KKRm6^_&fW_~k-{ZKI(A$m z7;YL6t{0G3^vOIlsP=KjSc;C=J8+j^4WKFoW&k425EB_=qJ&Co!c{09OtH0|dC4-t z0;To}&lrVOOY2o5zVTS`MpFYp;b!aabI6Ed~RZ2>{cxDpq!(A?`tO9&fU$6KjMMWHk?_U$+=s=1IP>623Vk#B5Y!epZ^GTs& zKt}wpH&fD4c$Hjp6)3aVvuazmnt6dh1j5jiA(;wg+^t1|Bkg9Pcr;?6Oo&sQ7l1DCAHrzWQ8HP zop1-FqA3{@a7S6lNbssnY@iF`E->*qqY?Oi7}A)^sXAD!jkVo6aqIw#4HtF~l=BdK z&zv`~A!r&h&b5)G)n3jRgnPZ%oI4*CTsu(sF`3|VTKGo3RXi56?=g?eqMa~f(6fP_ zaF%VLBlqTd227`io73PdPK+fs%DnSfq5C&}Pc!6YTUQw=^AepxZUgl@oz6qUp;dtz zCT&Jrv-Z+N;jMQR6^w;j5qk(36`!rLrp*{QxJEJT0=%slvU7sA-1~*%p^@&mt?%Cb z_#K$v&7FA6IF*y6=&!ZQ!Y*q_8{%Ky|XcExgc~rk>)Yg z-%+i}N97U?`QCVHJ)Ol8>MQi8rMHu}X4x0OKFc^MJxn!b4y89tC9s~|<7vjCQ<|Yi zI)p#+wTaDrDML~t)CZJT|4K)b5i|BKvzUfdR_WN|(o<+TA)J^8b(U_q3vj~;CqxK5 zCZ(51f~1isl*_5z5ZEA zh1vHJ)%RWc`M05@sv$dOVy4Z!t@=A^nofUpX5_1NY|L6H<0~=kg`V<#l8$|rzH*~p z!C@D?)hw9zlnriP&6B(S3w4&o8uS|6N&vJe%Q-wAQX-;x|G9Z@`}cJ-5sh7Yg!(V6 z9-=ANs3T^MX|d`CHV0tM^Cun}KV`far!}95^hVWB>+D@np3?v11igdhKc&$-%lkrt z8Cwz@-}Sb92UV%yC!x;_x0Fo!1{iIbdvWJM#H&!aKr2I-fqzB8rHMKRPgWw@-#=;zj6Os^ZcA*ZqL&o(oL8Zc*$`Va1r3TRjYd3a~ zTvB`x(HlJ6?Da|o`lSN>dV$SSfz6`83?aVMZw=y;+=eMo3$DYSLDSd05L?}00h1eS z1=_SCYsSS39wC`Mli!pqND%P)BpWogjCYIV(QXzuO(g65X)=b_Q|Iwjfc z60_Q_f|#}8z!t?LK{$%22_I(is&t@y##I2A&qi~PYwGg8{Pp1cOEZZfKcoKLQ=u+!ptAj3=v7I~CGg3UKi`OBqe@#9gX zh)4m`j8gld@+1ON&amL+T348RJt>U4xpqO&Y^;h}#tSSY;Witf^m?0tSFscu!aW(8 z6Bz=0YQiC)fs2m+Tw}glijY(0#mx$qab;1e)9qHgSnM7>*H-7Rz4Afvenp9^s@JL< z+Btl_p&tJKaTpZlcxxswISbp~H zv;64FYf!KGx}Il!bsgm?FeD~O1xrzvGbTr(%k#AB!CKR^AuPwZPt*JoMN~*mhv42> zpMqQi^f-M##dOHM7_@u1993nB8C?7}OiYC&$+5)pY962bdY(TPaE{=47B+9Obm>!} ziq{@u=}f}{K@limUs`oMy<$1dH0u&g>y@G=)pPO*2?C9Tb8(o1 z=#)|;rKHdE5XtY8pJF;?l1jZQr+vB&rLg1b+o`BkY$m|7+E!AjGd7Y&%o*Eg_WQ+8 zhR*=#Q(|-F4J9fbF@G5pg#m%jQca?qSn2s)GFgRK1a=Gdpg1QS^?N<@$~y5JqX?oW z2t`c4%`ZI&WJ95*NLyrC9l@n_w+nt#wfBK24~g;nt9`J0b`BZg@X9d_U5*wu47ZaD zJSIg9DwIf9WM!{AOzB3onDx4W%Px1K@NEk4d6_?Q0zF(d*4CvcL*ICL)zpFMx_ zWbfta&e3njYcF5Dc)WLHRP!_5)ZcK)0y&3_L!VRQ{}*C2 zQApCBBy=2|;(W$BpqZfK6t0Zocxp~tZCqHmYi0`zld4%Vc>7y8!!yD^ z6*^F&QDhs^1of^b+0G_Uja0_#;b){XD<36|qx?2~lzdia9?g4oiCq^_aaP@QDot;$ z>c;D;v$*T>OPfojuJ+byZ~f?dYt95N<9y$!pZD3=-*OO0&E0FeQe9xdw9i%>GzfGY z{>FoZ2FLq;WS=GXTiKT^8`*1xn2o)5Z<&~S-18VqQ?(D%2!lgHsN}`KMju>voO4Ccbs)j_>c(~`i-W}Vg~{Z zve8Hov*%1v^O#9DP)=JB?;o6a8*(ACm`Y(Wl5` zLD0XMeyWoo$;Jc%GkH2;ti!}X*pni{Bo<)bTs-bkKn^jN6vri#{dzj`eXBW3Z+I8w zIW0FKhuz~NtxYC8p(gAK;}BI#2a+Np#2G1sq- zj6-70uuOzY?TOU@vGE72B^Twy^R`}Sy}^GnD#!GL4g_`-f$nwSdi}^fcY}f_rraJB zJGP}92REmPL+~ST{aly_KrJmxm*=wVTvte%xk;Kaxkrk8Po&HS-EM-@`yIx|-I%8N zrTPpqwQTCIt!~It!D4b6LcGr{2vDhC2r*6|Siaf;R&Oko$VW_LAm0qa1KO-7{CRl*6 zB8iH;wW2xgx4S^86eq;SWzDcc%@n;mBhz=~?)*-sm9G2__BdbCYhn?5(Z%$b8GTZ} zj41JAo;GO7P?P=52cII;WYG)BG|XCn$yMOTuNV07+G4yH;-Mm0?0CT+_N^pfBnO;j zrwVQ62oJT`5hm`ibvSVinF26Ypfv!kt(TOT1AMf}Q*>&5!#pi7a<%^!b(RUm1{S?^ zXb$oLOQ8z153L)k9rfo7rr5ZKx89=hIi@kpgo#jLn4L7N>KXhbPXivap(bR&{To`Q zu&69aK{=y?R)4O2|{XBR?V{UR+G~zh4X@6*-Hx`diE`!nnb3xcQ653t|4L01wFUx zUwoHAeN%FT*RKNp=Mg2mraqTA;WcqJljxOL@jZwYrAVE@hS*cAlSf7c^$sG#^?evC@4#{*w1A+W=_trz|f^I;O^Os*YiZXsGt9 zer^pObVFj^Xj_kWnwfa_f~Dx6I7OSNe{ay+8uad=pm)F5Lobd`&}Of<{jM?wZ)rN! z)bc2HBJg1vfe9fUp@gM!(v2|O5T&;zFqJg*V@5iF$3(tR#j6dubo=VY%XosP4aHUJ ztTifvu$m*$PR?*@dbM6|W#3k)wByn%4=KK`{8R18SCoPLu6%COkE_Z;pjj{nC1-i| z<)t9qI5m$vwQ=jG5QLB)S@Zi4hL-N~S6BO+UV1mv1OnVSrIX#k;EPKyHtc+OWGbe~ zki|9aN`qRZ(%$13hi5SrQU~UW(8YvGViPR&uqrm22fp0?)Vum8+j9%4o>|BmzIQfP z!LbAdh=p$2ntcNJ;9X}O_@et)1b+qp1SMf+t|;|ymh%+HQB^>)>9tFlD~dp~#GmpF z#B4DT1R>iu@Rz?RI9gR9TSyh~=zN6i&^F5AMV80$)dUI4*=stg-SAomw$_-#&99@2 zLo%jmO4IR%cXq%FzBnR6nr%i^r(+$@76xdH!-D?SL>(=`-Ckn;6=-eJO}gF-esg}Q zE&7zR zYHvHTFVEunbGlM+e{1~Qm*nLvALlvbx6$RT!fP_k2tUh*hQ6$+VLpHP^uXQtt$!{q zZHDWnPsXNI>Fx`5PS8K?-hk0^9mZBNgpnW_h5-5IDLF(Z%D7$7%SG%50N>|cJaSdI8TDyl%N_Wpm z?Y`MMtg~k#c+u02*I+AKfNQ1QtTr;>5bWl4%RW~v0oNA1Qj8{*iw zKp=?cF)4f`Xf)VRdnlYhMetPt2Xdk|hajn-z}qT5%s*BDUxsAFAWoMtycR?=)z*_5 zI+=hsW@yyJ?9w)3S_fE)KBWD*mJo6Sxfd;#39nh0DJfKs!`dl7PmNYGjJwHFL!xXU2f zGu6QohUs2h6}@I&R(ictdG2%e`F4#9XD{r0{mOaaWph#c>Nn0_%l5iHA(GQ@S+PMV3!oA$r?$|DQ79fOgzV&Dh$wB&B7p zi`H2#;~KIQ@^PjoNK@z0qetkEXM0C`0|;xOsA4F=NCEg{l131A=QySz*|0t{Hk6!h zv)07Af@0v6Dxj{dF+jg4I`wPk7w1gz*A6;RVzP6q0Roev|Kl+yW5t+-aV{j`!3B*- z$H%yGD;Dv}sYb*qrOgy(0F8B59XR`K*3Nv*1z}sOb*a*u<)Dl&iFM{m3XD zRy;fSW1#)DtZ6SK>uS|i!b_Zx4V1;X&{ikfYrVF+F^FJB0@a<~S$$YFFkdhSww+RK zFF=9&oWG>Hdu~Pbr&&<_F~1j8y?KLSQGNDwD0;=Xw0C^J?gR9gU`{ytX)VN37dymq zvfehz2=nbU5%$|xnN@>MXa>pqh6ojfv07LOtl))Iuqv{8lm=~9Mb zoyqG&Tri#e6md8VC~He(h-}3ZU`fAa+zRG`jPh7Vhskl`-AacRZ_Cu#sJDZo2|S z5GiRoZjNo!bX(Uv@t)i7nh)^h{CwXn{Co$ADd4&LzOgt^AsSUlU?m8w1c8+xuo473 zL7-@$^Acs802d(4#cPOTwIYFHU;>DdgGM-xhd4Y#G@>k72@@+}VkJy`H^RhH^1@0$ zSP2MUUqEn=sv4w&)qASdOQzLJrj=3R>Lt^U^OETcz8G3Pj;wDk7K@x$0|2w zDnBzze1(9Hl@DLFOR|_v6Ozh`R(C7FQN+@cD%a5tGr3SgSowzMDVXeGj^mibnk~g+ zhrm!8Jwnbo2pwoDc(*=c!QakaHtuqnB(T!64CUbTiI| zM4;}3;8;%H19o*4qd9$Vw^?eUQ9!td01asxpSnq{7>PKjlpK5}F>MZI1> z@In`k)-|1}kLHmDJ?QrzJa{mVBU${^=*;;$E^jL%LKNAjdc(f;H(lWq4m6DLo}lob z>`|iS#D`BCJ*<&|{5of#4*5k;f>S&O|JA@=yMreo51n{RxUKk8?C2ajS2wOiA^DQ7&wk$^e*a>lio%rp zCncJuaJBVQ$WlpCSwF{L;H-n=cqfXe!a5v31$ow5XE+$><447wt0W8SFQ8(nL|eAq z>vzGKc6>7((KaYwy*o~B`s6)Pe+C~v{%!U9k$y!0g+Q|iK|wmZ;RJIjx<#3;BuN%y zl~*&an&KpGZll-h^|rUR;NM=aSNXT!+wN`st$%N`zkUDyy?*cR-+G(d+jsB%4fVdn z1mr?u{A0 zjz~I34l4D86(}5G*2IxrN6uyE2ErbNo zUDjpb%5&cv-|P`q`)mR2H;jB+ch!;x)0T$`RwP}34NFa4#-g3-a)Yp3UGh0|`=F>+ z;gQPA|EVU(Yj3#`?w2rRxslYyVzEX2GENz%a=II1Azr$rFg+;c>bH4+Iq7gM<202c z)czk4gq%tm;<#O2#r2{WQ7R5uOvC8_?P~kCr<4o%2bGg&OvsnU53V*ue5rMzgF^M{ zY|eJVkmaeYb+w#b?Q0dcmPIN&8qt)>sfSJ``>?I2( zn7s>KLo~tT@{~hLhm(v6Dj8RkG^k}uJgz}G%;VT1L#;yQGOx5bVtP(eBE%tQ!&1LX z8O6NKoVk8)&emC~D>_(WQ(wwCpQ1Bh=B0M1V$?6C50dBUj(8;qAE2I>oN;mHA#knL!-FTMpR6gTY)Sp5w2$l;5HF@a?52YbqK|vc zz=g4HqU+RSi-2fRZw3^d+4Zr5;OHQYrxhgdB+Htbx6ky zM<>&av{Ac48QQ3=HLq{*fXc?)|FOw_S(*AqG_RPt9b=-;S@!FTZ@?jgs3D*>BI=o8JP}h z_sJzHss}Nrhy$`&yw#cwW={#W z?JFHZi;o~(#m7;d@^Wsy#$L^)jGu-mZkN@oUsL~cbN$~O#h>{t(*NDbyHWOiUuwS3sNh?u4EgqSdY?j@x6Q@6%m5%Of>*)SVlxZt9noGEe8tn=Sw3Sif4Sv_x z{}nIv7AXMd>;HQ9H@ELs^?&!adn^6lm-sDwcey|T=*ll?`v>nLZ=eS(`uD9X0*jvB zSQE$zxQZ78)W4CoujtZewCA%cyl7Uw8Li)Pv$8<#R~py%tM~gHYP%mpndNQguc*x` zdhw&Hv;2{+^jRx?*0-$B`q9)zZts1sdZU%v=aZ>@e1|KIAZ8T!!PPzU-&uan9{*VS zo+U}mO5yXFe%IFjSfL{Xp<}KJXo3Exx3%4`zW?03zqQi;e2HJ>h%AeeGgLq#oRBDw zX*%wlJrEtr3VqO_Uw?*5=+jEAH`3ey#hKG9=LX~3FxLDGziaP*qYA)A6)=wgEZ+Zj ztNVYex7z<-0^qj$ajAG|zu!=!TGIlyCnQcfV$!`JbUcym0cr;id+jF5 za%C;mGRo*5lmc9F|98|XK!9(ud>f1QfA4P9{(E!#?#llAi~NiSRncu>F6jt|a*_`N zPBPY+E->p~{eFPo75D%C^WD9d$9q?6W6}QaZ{4fx|Ngz+{nh^e62F62C%XsxPtftf z{;QMc2QQD&@xjxRKX#7xkXdWA^V`wh-iy7LC#{K;nHY4t7Z(>DmdlXEkzjGI-Oq(A z=|(IR-I#_X6(qo8PKXliyI*^dtKZDu75D$q-p-R3dz~b@N*fFIe}Aj?{;Pj~dvmq_ zzr^nr+I6doo{=~~yRhi3)?+LP0t^68w?(m5>((vwO5ibRwF2~%arAMJ_gUUXzl+V;Ry5fnQH*W zYBLY1-F3jNeSLtmTCcBiI=x+6cs#{qjN^v$Y5i;O!mszcBK;3}B)Vmf-V2}qE~Njx z?aiwFUw?bW|9z2P*|d+6OG#1z8>Xt--OYt$$&oR}ctYTL9c5{QmbZi;YU??T4`t4% z4MLv`P&pF-IBlsxF_mB*WLmwIt`$=u zf7k2ePyW7jH=o5h$8mLOw4oVI$9ar-B@^<_>L9;1#;$&!@^>BjuM28d@Jo>YMf88O zzg4sU?r*O6|1a|UEcD+;kpFJ-KMRcd+7vzp88>#+arWR=c^0r<^6nHH(vSV~rD8Z|taupT`jP#S`5?y$AD` z12r1MTwyK{82enkE=$Ql%?ecEz738rK(E_+Qr|99s+eOaZ@30`nH9}q9JK7LLx0rx rhSHX0P00960=1.24.0-0" +home: https://www.outcoldsolutions.com +icon: https://www.outcoldsolutions.com/images/collectord.svg +keywords: + - kubernetes + - monitoring + - logs + - metrics + - splunk +dependencies: + - name: collectord + version: 2604.4.0 + repository: "oci://registry-1.docker.io/outcoldsolutions" +maintainers: + - name: Outcold Solutions + url: https://www.outcoldsolutions.com + email: support@outcoldsolutions.com \ No newline at end of file diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE new file mode 100644 index 00000000..3b5b96d9 --- /dev/null +++ b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE @@ -0,0 +1,2 @@ +OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT +https://www.outcoldsolutions.com/docs/license-agreement/ \ No newline at end of file diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md new file mode 100644 index 00000000..c1eeaee5 --- /dev/null +++ b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md @@ -0,0 +1,227 @@ +# Collectord Helm Charts for Monitoring Kubernetes in Splunk Enterprise and Splunk Cloud + +This helm chart provides a way to deploy Collectord in Kubernetes clusters for monitoring Kubernetes in Splunk Enterprise and Splunk Cloud. +Please refer to the documentation on how to install Monitoring Kubernetes application in Splunk [here](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/). + +## Prerequisites + +- Kubernetes 1.24+ +- Helm 3.8+ + +## Getting Started + +At this point we assume that you have installed Monitoring Kubernetes application in Splunk, and enabled Splunk HTTP Event Collector (HEC). Please refer to +[Monitoring Kubernetes - Installation](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/installation/) on how to do that. + +Review and accept [license agreement](https://www.outcoldsolutions.com/legal/license-agreement/). If your organization has not purchased a license, +request an evaluation license key with [this automated form](https://www.outcoldsolutions.com/trial/request/). License key will be sent to your email address immediately on request. + +Create a file named `my_values.yaml` with the content similar to: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true +``` + +Where you will agree to the license agreement, include your license key, and configure Splunk default output. + +You can generate a YAML file for deployment using the following command: + +```bash +helm template collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + --include-crds \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes > collectorforkubernetes.yaml +``` + +To install the chart, run the following command: + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +## Configuration + +Collectord is configured using the `ini` file format. You can find a reference with all possible configurations [here](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/reference/). +This helm chart allows you to customize and override those configurations. +Using `my_values.yaml` as a template, you can customize the configuration to suit your needs. Please refer to the [./values.yaml](./values.yaml) for default configuration and possible values. + +### Using secrets + +If you want to store some configurations in a secret, first you need to create a secret with the `ini` format, that Collectord can read from. For example, if we want to store license, and token in secret file, +first we will create a secret file with the `ini` format and `.conf` extension with name `101-general.conf`. + +```ini +[general] +license = + +[output.splunk] +token = B5A79AAD-D822-46CC-80D1-819F80D7BFB0 +``` + +Using this file we can create a secret using the `ini` file: + +```bash +kubectl create namespace collectorforkubernetes +kubectl create secret generic collectord-secret \ + --from-file=101-general.conf=101-general.conf \ + -n collectorforkubernetes +``` + +After that we can remove values that we provided in the secret file in the `my_values.yaml` file. + +```yaml +collectord: + secrets: + - name: collectord-secret + + configuration: + general: + acceptLicense: true + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + insecure: true +``` + +And install it using the following command (don't need to create namespace as we already created it): + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +> NOTE: Collectord reads all files with `.conf` extension from the `/config` directory and subdirectories. It will sort them by name in ascending order before reading them. +> In a case of file names `001-general.conf` and `101-general.conf`, all values in `101-general.conf` will override values in `001-general.conf`. + +### Secondary Splunk Output + +Collectord supports multiple Splunk outputs. You can configure an additional Splunk output by adding a new section to the `my_values.yaml` file. For example: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true + apps: + url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' + token: '107E857B-C311-4C72-97E4-FBE601A6B39E' + insecure: true +``` + +After that you can reference this output in annotations like `collectord.io/output=splunk::apps` + +### Secondary Collectord deployment + +Collectord has ability to forward logs to multiple Splunk outputs simultaneously. In the example above, you can use annotations like `collectord.io/output=splunk,splunk::apps` +to forward logs to both outputs. But there are limitations about if you want to apply some transofrmation logic using the annotations, as this logic will be applied to both outputs at the same time. + +Say we will have two Collectord deployments, one forwarding data to Splunk Enterprise and another to Splunk Cloud. First we will deploy configuration for Splunk Enterprise `splunkenterprise_values.yaml`. +For example: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true +``` + +And we will deploy it with + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + -f splunkenterprise_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +Secondary we will create a configuration file for Splunk Cloud `splunkcloud_values.yaml`, where we will call this deployment +`collectorforkubernetes-cloud`, and reference already created objects like service account, priority class, and cluster role, +created with previous deployment. +For example: + +```yaml +collectord: + serviceAccount: + create: false + name: collectorforkubernetes + + priorityClass: + create: false + name: collectorforkubernetes-critical + + clusterRole: + create: false + name: collectorforkubernetes + + configuration: + general: + annotationsSubdomain: 'splunkcloud' + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' + token: '107E857B-C311-4C72-97E4-FBE601A6B39E' + insecure: true +``` + +To deploy it, you will run command, where we reference the same namespace (and ClusterRole, ClusterRoleBinding, ServiceAccount), but create separate DaemonSet, StatefulSets and Deployments specifically for the Splunk Cloud deployment. + +```bash +helm install collectorforkubernetes-cloud \ + --namespace collectorforkubernetes \ + -f splunkcloud_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +## Support + +Please refer to [How to submit a support request?](https://www.outcoldsolutions.com/docs/faq/#how-to-submit-a-support-request) + +## License + +[OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT](https://www.outcoldsolutions.com/legal/license-agreement/) \ No newline at end of file diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml new file mode 100644 index 00000000..38587428 --- /dev/null +++ b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml @@ -0,0 +1,6 @@ +repositoryID: b6cbcd8f-34b6-40dd-ba51-f0cf09a8c7eb +owners: + - name: Denis Gladkikh + email: denis@outcoldsolutions.com + - name: Outcold Solutions LLC + email: contact@outcoldsolutions.com diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/charts/collectord-2604.4.0.tgz b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/charts/collectord-2604.4.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..81b5d2bf1401279b6e3bc8f3bf4da3ab7960d092 GIT binary patch literal 16849 zcmV)MK)AmjiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYccigrSDDJ=YDRAWUL`tfbURt-nf0%AwgUlodmCwY!1K(tYmkcl&$Yy^WNJgws+&;-RA#lqh;ZqZvA>WWur( zowKY`rNqXRs?=8cbP6DY>{rl@(r3OkjskoXpSdD^gO9{#noivlFY6d zPsMPfgD$HP;RTUIY;+JSNg<|mEH^qRX9bmv(_*sGK^dE<{G3Qm6ZMxUv#Pk<=pd3| zA!#BA=E>B8upeS3GN$VPkK+{c4b_+%q_6+>aM0b|>-IbSuQzf`3yEn#IABF`OtT>p zRar7F|G(BDK&ZfKteRtpP{p$q22t1dgR>!LB^e@ImKja3Dz|avr&P^ox4+@$KUn`) zIID;N(IYa(RVI<1el%u0Ag1odU34*} z0#Si5`uD-JLOVP6VrXLc~S_#g3uW5WRl0fzVxa^a|%? zMuzY~iYv-lk&{9WQOQ|aB|!TsPZFFDk!n>T4@n6VvXhWP5ZFF)-psXOD+lTQr4@lO3$dqjC*FJ>i^*Q)XD$?)}|m_FjNVG z&Ym0{qeH?a9jo!u7^|ss815iZl7x}OJJ=l4n-lBMG7Fri>62~w^IAH_8$L`D@dD&mA| zER*Tidc_rEI(df6pl>#5*zC?-bdaW0%`VPh#oN`5(^RiiIVB!wb77{KjGdcaw+EYxfsIo0nv^IYgT87-+VVH09TE^(WL8fj*8O{pDJFo{M?PU9|BLbAN0E3|Y-XY_QjxLJpy{(jyH&&~1>{q#$7 z)@`brW=H_O!Tw7UwM*&w(sPT`D_kTbH65%t$Wlloq`;gq#a~P{O&9S5*CvzYBU+Gj zY2O`8+kMX+bpJbT^A^kxoQl;BKGe*-=O z#b&=DQlurLisNhr%9q(m|GeGRRF{`>rgX7XOLKn#c;}$sXhlsZcCS+NE;=Lst0-5T zd`gsLMz~_`O4C4U!zCP%LJ4wuPOd19d)}Rpf^eLnEmh?lYJ5+Nlok{8XXMk4EaqL^ zFWn=+I5T5$ss_ODUpFj15!(Ne@ym?iw3Cr5k|A6aOadO7-x|?zE07)ijM@Eldjo|P zO^dbl3cHn~oUWH&l&HhW71c`A=0NQ|suQ6&+5#(KdC3YO!c8X_ZJJC;6}4`91$9&R z_LQYa5M9>wtrAMyW*p^e8`okmqJ=BCt!2Y05yaNHrdbBtbR}7iB~5Ua%|ZcN2^k0r zbWJj~uq~+LC7r@$SsR(4n|e9SEm>kNJ8T?jtG3gt&u+<5r$nfZmn=P4Wok>#aw4as z0$fDGvC@+_)dJmYEuyscA=><||6SkAc*)Xb z<^_bImW#>N02PNjh*ETul#}#PrReuOnUb{1Xfb&@DVR$>dPNdY4s0zA>)epr1>w2y zSshK`N3Tjwgn;?nXzUoOeuuM+GzhVfoMoLd!v)z0w-QzojwRzm^oSAhoXMkCRLBjZ zQDuZ1ifbJR=?f@iIsvpzfFtxAlku1&YI2`5GZsKstCZJ+L^d~;Y&SVpOZaK7lhM|W|(_uPE%xr@%6q3u)Ji44_#*&CAH5teL4wUPMHJCb8hEn5;! zQ&wyQ3fCvT4P8u$#u@Rd5QvS(P<+aSLPBDO|r)aBSu;=`P z$gZlo4QTiKdmVt?RpW$4v`7W&cj3R`VDRm?-+q8?$WPWMxDUbTe9_yGUJvVC=)Lbk zgO*+B{$O{}CbZkEv9ETmjfkzODn{5eouoxsN!w#qN%!@!Pw(FS7o7jPgSp=GlZ&JC zu6!kLr;TO)AA`aEox%P7gZumay}^V2o&Ml{|6YH6{`(<*!L~{ZA#s+Gw7aqKm~rd3 zu%kA8i4%z`fv{ZY&hW8&v;N)m*Sh{+PDxf0F1oV34Oft5{vZ8&YW*t>V!yw)_du=x z2fJ(kj}P*D{kr$f#?h-%Ng7JNEpSc{(=sv0&fSe~dT-urynfwL@-;0;AkL*-ReTe5 zd;xGJ>1tQP=L%N$U)rrml{~p3oYRz`-<4`mBxwI0{7LikYCNW|&}L^78Cax9)t?)H z;2|g!2)h=>l@jItSK&-MK;W_j)Vmu$5)B*5OVxtvhCm~dU?s#0mXp8_Lw9&gNv1?W zPPC+954Nd5Tca5a#-r!wsw^!g;8?NU-FP}ioMZ$GGitylX(5bb9Hdd{q)-rGu|OD* zH`p#3TU9I`UpjWfX*1oBnj&-aR~hn5I5=Mc`oo8-&#A}J4TJ{LJ=3G4>smac#2X@4 za$3kS+WeE~{7G!qVChCzr?B=vBf1MFRIL*u;Ht@lNi`IrOM$q)cw(WTpVfMA!hzO* z8*fAOJL06wa6-`LpEuFw%gviFq}AN57GbaJYV@Zh%e!LQgB}gh>(_`DNmiw;{q1Uu zT8qT0mn*ADUJt^7b4^uwP1VY&9j{-vRQVnKuVRwa2Birl#|55{v@@D%K$f(uW0I+V zP36=rgU~t6^ii^Z<2>`-m`7meH8s~-Lo8$2(y;9eT^nTgGcz{lZQ-<5z2UZbC<^99cFdbzbu~oM7K~eM<9oL!j%v z-+?gp^Z5hOio{Ka!&|3rG!Wh}^(>SZ zun(0JIXU@km#E7aMsG5W*P709E^NMXlpl<-wxVhW9$(s~q2HY-BY9P4RKXa8Ze1-y zQTO^8LgmIKHK_l z$nRMIIY??B*Ood_YfkD9SOfSL8qVN65M!^A~q!KkY%{@GT}QsNObX zH=7c$WuB37T*RghBR3RCJ&nQJl3kY>Lz>fE*WV%5(z zh8O-W*d-}K?%K%o(}}B;5^I!N0Iq8bhM198CDo_@=Okf8DwaZN)Cj@(6}tdJxQ&k9|6|{=M&C>-n#_>k1x?w-63siT}s$?qKiE;Qns^-rj?IyMw`< z{$PK9ckTc2L4LJk#o(56S9@`q!vnvA^AS$ExRO)G>2KOK|MFXX0yEgSq(wSJhaSpC zP9#pT#QxIs>({N#nPWS5-dI0Ya4v_QCAQdnGiU4l9TiHeEF{`f)!nu1#-;3zzQ(O{ zN@4ySVVO+L-{h4fg)mV$RKnabu<{@k3A-YE7ADtR+B(*oSN*APbQmNu!lgck;x;Ye ztoSb**-vMacL~lyZBv}w*7Y#Uyqk z>Uo?_3NF=m(1b|yS4M^X^V*O^3k3xfIB&Lfuo>e$7?})=-{H;CC|F^ACSRN#yIRp) zwZilG+v~9&U7fOkFThFywxAcHJN}qk)-T0fQ*SM8d?LSP`~OH^v3e&lU}^lX`~7(T z-|Y|Xul>J1$nSmc|K^I`95LXw_jr~OqvBf*w*cP_gqq^YI|?bH8YzX#2pSsvd8GS6 z&l+vS`r!()5b}F=b0{HsHQw63{$X3nad|tzz!t9m!TzAXKXCE?9^Bhk^8fBS{@;iB z)z`l>h|gL5evP|`KdUb7RS5PS8GuEj-yd|$6%OcbnNQSycq$o^}+GQ-a1Bo*)SD0#1T9`c}rY-0Pfb;~R7|BcdC@|2L~pf(yi~W2Hhy z)ilTEm7v8Wyi60sUGvC5kT#UjOJcwxba--nd~|qma`y7&Uk{%D`}x7MqrW};s~~U* z=Wj1x{`Hc~{`T;%(9GXVtpkB@frtrOG&86PB9R(uFb>lK{bWY;7i6FzBWBl{eRObf zaC&g@!=%^DS`#2n{D5)L?w{7{nA3`&O- zR~LjjU-7e!DCL44Z|O7rj}$%q<(83fnl(k<_mb}m~PfVnT*8`E?%J?M_v1(GRAE?wK2gX*jruzG3} zl;Nau%2_p;B5xivJ9xXm#fog^Hl9WtWMp@%b3e*=(PPHzt@5fU)F82i6*gJl355hh7puMYLRr&S3kV?{^;!a(Z$jE%jYMLj+8L# zhRlb8P%B0dS(UJlDFws;eIcySG$I+hR^^<$ttEGwAXna2whP*RdL(TSWo_Pt`O>!b z9f&#(J7;K>y{lTMR>T<^<1iFU$yHH7JOYcTNeTN!#~_TStoT}@Yg|B2IY}ueiI&a7 z1K|^ml@Y$8v}PAZ)p$%e67)A6rBn%a`UX4{RG&}P*Y{BFTou!R+j2bkXZRJ(t6aln zW5fz2WfjB;k04ta;a>e2w{}bm@(jOfYc9+RWjw7n>L8)^hM!~zOQ{48#apikpXqs0 zGNn^6_v!(-iC~5D%MVDavOr1Lf>tO0K%-v2GnSU?irjQsuDJ zX#D3V-1+U7pI+k5Z~e}9zkKtR0sB3XO4+%_GgZndJ4jBkRJ5*W+bWs<_E2!O@i|MK za*6(8hM*hchaM{OvSX$+X$21yRc-dNq^6|sGQ*mSNM;cgF%U$XZ?5dM#frld!b-HyHM)Ujrc?o{TPW!&d_ zE=OvGSf!gJyB4MH>y!w}N%|77c&P{gdRXxcoJ91p#i`fgY*3953Q2ZfT0CCT6g@;1 zSA|qZm2r2nIy7AdLC#9D7=|jbY#syfcAlc1-*84nHA-2Isn5`>l$KQq9 z363ujM6b7xFzkQ<#4y)xbVk?f>V*+Ba_%rN%5qzlN7ygONybJvQ({l0SZWEkyb@Mu zThf^EYs?k;uoG-q@mMXWf=O%Oa5)djpd2Qxif%!!m!Lac zgrf&G01Mr?awaax*mH7S$IvHv43!uO8$ax|VmSOi+7{(s7J*sYLDy4Kz$!pCJ`*(U z?Q=WPyD_+kLo%7>QX-Y`GWm^`rFmUK3r^yamfDQ5HNsjZ*5(lBmZ967D4DIwM}!N# zm{cq0m$dxHZ?uF+?sjE2(gQg~?Pnb$$6+xm5>!^BjEX5OCSCNS>Z%D;iMEU^wY_79 zowG^@4=~UQR&>%xHq;B>fP{zuvm%*tRFD&T!P_+4%$GOU|=gtYAwviq0WuSk9ZGRr9)w zw8Cw+KdU0a$%0=EPcAM_(KQ(vjc*6Rr9P#r_z(rbDzpkA7By87nyj4STXARaz8h$? zfv#)m0T2jajB4uPC{zZG~;PKAvkCY)#sn|w&ZhPnp}4jW9?)~ zDBBpIAtY1IiWlzFvp#1Ra6++>pJC@zfBLdh#j?ke6k210rrX>IVx3Dx|CMmXTK1^qp*1+ce-3l%j^y zbb!91k*>DDCf@?zBV@|Cgtvg-{<#8&u}A(szC$p}=JhM8qp1W%aH&H^{?x4Q*oljB zWE^$Si?idpxn(O@l3%?J43y_bXa9P7c=Yng$@#^bVQbdu$=Ssly<$xZssTfHKH;{l zq6JII^Vlj12Xab;QX-mCJ`18XZ^s9z@nJG`4VLb+so`Kd=r~D;&Olg+Z9cl9?dCLK8?9bD3m(tA6&Q?fKrwNoN7&8+fv zNs8c{+J74=QZhi0?>?JWR7rEfj3pQji8v7@D+Cexs8zEoT1t`sqKt zpT#eK?rndgs6v(5`nd~U?c0CvZEe}a&i3E8K*>-m;r9^{l8ncU%k7}__TLq>U%uHc zS-SO8zw;gLjDLB3Z}-jb=Huti%U@pK+kX>O`l=miZ)8&HwY5rVB5_%tTxWV)`t82X z?+K?2{@?le`p=#1zdHc?dv8?vgq39b?^{3jx_=JFz?v+>vwY5&^j=O%95qLmmP#51 z18v91OF4T)x$|=Xg}&79aG9Nw3iPWQj^68%r5&2S>6!2&F@yNO0IQQy-g~VJbimNs z1NWlduh4?2dB&K0M7bf)TB4^=YvVG91(7LIAnYi8$9NujpDP0ZS-V~kn7RA;ULd6uHBSzHf^(NHcitXW+G$67tdi__J-3JRdzCcJZv|eG`&HBwRoyp6lg10 z3fq?dGVOUCX|cNMT+!8>WJIOlV;+*N2N?6zjk|TDr|}EawlhH|1xZ8Sb8Q6USZ%Dt zk)zwWPgyEz-T>Ey+NFbj-}QE19lI&DqZ71a%q?L2DQ0pC?xdMe>49x=im!+h*qAlk zfuq7To`qd=RVFsB)L#Fd7id@kLPp@A5IEGEpC&WSQzw zfFK?zF{w5R<^(mzg+8uu+LRg3`e}!Wg>^lp$<&sK{37*9pqoFCnW$7^to#* z(Wz6agTa^stcU1o&~x8)!mS^|H9%PkY__rTfm}eqPt~$lI!5Hetk+A)nPdse>_GKV z$Gwu_G@-cu)~?;{2SH&Cu2$3@aoc?Ca+Hh!?%+rmL5*-h+vam_&S_8rylZFt_jW7JSz)oK~ky`f`2 zY)rK~m}QW`Xu`uarSo?DQClZ8O9BrA$X9>Cpaq5tE!l^Pl-dLWiF?qAkobYj9$u2! zz_e7mMM!2!lK!4xPB?mea>ANR`;woZA6rv?-B)3W-^85$<+QjsKCcDmixZ8Nzpdarp!ih_ z&?wOWZ7VnjXo6287mib7r#?JTLlJvzgy%O=wYjjLN3I>#Jw!6?pE5IWpNHNc^=QLw za6ukB433bHx3Pn@OABnFL(CQ(yGKs9jV&dDV%l#7y%3Kd$ZRnhY9pW5ysaFzUIRF% z@iCZ*ie%;+K5`CTItCL7?pWvHB?2X#j%K}cWqy`UEb98we$CpCiO zrUBuwfIN?rxoA+waZX=6BK8d2C0GZjT7fx$h;zh5#+fLm(z^dXq1Pm{* zvu$;|-8Rt+Czr+>CKcXjV*K6BD_s^}xMIn|iPlOe zo@ETD-S;m>*XG_1;B5%gUZlXu<&kz}4ulGwVr(FO02HBHR7@pL%Qj&tJzsbm12XD= zvzf?75ma)`)u7B1&+2X2YUTz45eP$5hGi;}aiG3FK#ITz8K z>>ylNw|09gPwWH{1SZBAL;HlF5ld%FTs&5p&y=JfC#2e|_>}Ock=gGqvdR#gPPh$H z@syGYIHUAB65MJNJLsCY15A9yXbQ0(Ml_>xrZyJqV{MmCmN~#;$343T#(8*q&+Ip_ zAZU>=&b5=IwO-EYguA`ip1YV7Tsu(sdosmW)W=4?>o1Gh`$`hDAp(oh zJjf=DQ#s8&zSb`byQ~qB*95L1XvkD(#S`?-9W<(>J8IYG&c?0fn$XEqn#)vwL5(IK z#wA+vgZ?xyohK6NBlO47-O0Q2{0m^6m7GKuQ;nNLbcZPd8~8oGELr-Jmgu2=!XJg! z#CBX_NUDc=g9_^3XlpWR#?h-XqY0IDKK6Zd6Y@dl4HgmV?FQ{!e!`YdWuja8eYpIT})U;=M$d5@e2}SzaiF%EO-Q%rh z!h)-8aPn%d+zp`G#qFSn zXpA#qEkL!b;IzmlE}m4ljTLIIim6)GudixF*TeKS5S^%Cq?~U#(kRpY|d3nl7LPcbM ze!{L%j*A&e>4Zw*%$REZCp5>IzqkeNxG*#pp3>Yq-)+bH6ZoXuLt8n`GOBk&=d*BV z*abuT04b*lXQoV}$amW6fs3fbUrn7;dd4>{)mR3TQ*{7 zH}YV9^>>?7E#%y~y}}NQ!$2mbQY@;pgan&!uJXsF=gH$~s+fp}X?m&SPz4%+DQ86R zxYiBEUJnZ6ZmiuSX!fm&M#eKNB;ht2p!EB@ouFd$HiWw}vfyP1h^YyifCetQ;dPD0 zVJQ+$S@3RFXO&PEQJr3|7RBQ5?5XxT|0yWn@%LAhx~i~N<{x+j*N24dAjj+$%S7X)VOTI|escOc<+=zP*;8-gpk0HGgX6*;rj? zRRIEtd8C3BsK*(TW6|SP(FCq5YVmzir^$Mj_NKQu(-dXR0TmuXw{V>HK1zZ)iILX!MkVtKQOPhq_v9t#9V2qFucyI8vPOQDK4E@J6SBLYDYC}3|| zbpyL%oMxJJiKg{hQIi@3`Gf?4#=?a-&^s%Z(?gSI#M&Um*DpCsnl(>Vs;>s0OD+=` z%zT&Oucz@{qBw2Yt+Q~j{I?k>NQee0ObMYJm#RPQLSV}5&&O*|JIcFKozrT2E^bCM*lbUOHD3QO!{9#BG zIs`FGHH&g;We|7CWO=m+{1)s+aYZ;9^!w(Pbshvp5kwCVN}0Z!A6*D!BcX;!dt_M~ z!7CeX7viSs=mTk$5EJ)T$6ycq97@9BmSd5)9Ib2^X{Qo+Li`(6Mxi!i1U)^6&Rs+* zTWi**yQ~dbPvF%pKB?gGukZ$9LIgaVz)6|m#N9A_^7PT8qvtOV&i-+}_58)N?~l%m zX`ZI!fKTjbxX+b@-<7#YLFCPuh^ypzh!y+&sx)k*AaV{DDd4rC8?q0uaoz?GiCe!V z7E%xCxZdF2VS`gt25QCykjqU8G^pA_rdof25Lpdsg}j%L_eUVwMj+BZCe<3W^tacP zVGou`2~3Raz%*tDY04EN&zU6ZZ#ZOuoKwaD=fcGQg}0d~BlkAyLM#bE))UeRlMMu7^e`S!#mbm}PaWv5J1%7j0Im{z-W7oyCl6qZu1^$SI0*1UPt?+p6=%f|7Y0TYF8yo;_0`Y+R0b#f%xguug0flV0e zXX4=56aT^_7U19PFZU=Qra$a-X;Xjg^%7PHmXVhU zy!W{W4^-+KLW~o5EMKhvYqwg|G3d?;1E9+V@{bO8ZAGBYAm}P&?V#O0>gbu>?f=Oh zBmlejmlWJncjhGwRh1T#Q^FJCo}sR%*04}xe@Qg`OtAoGMUwiwE#I7u+wDoJz&Ww+ zvX)qpW`TaaB(q;*bbcVS8Y(}4KhB4Yn&{tNbZ>gheSK2jjELm1z#6pTQcY|vm=68Xp6^pcLK@di-0sk3(Ra;W?avN>I8Hr@*8k;*CL4=N_ zjsB=AwKfPjjm8XI@Oo*37x;#^<*cRLwUoP-a=#=gw}Ii*zMI#4&&55X2U~thM8at) z!8lS9Em8r$H#DPf0!lO@I@7%TKO>fBL$G?iH=O?KP@mP)vA;1%1V}? zF=FSkA3bI7uhBGb&s4!pC##X@gAh1CT;)6idH2(X{s9KEDy7mxnsdU?D$OsH-otib zo3ASYW)cMYM=WmLl>>Diy+VbpL6ESC?SN)FqgxWk5TP(otsIu#5bp zQP7lS(?V#q#2Wg#|55ZS+W=VdXRL}f9aCd8Q`<1SXsFh!zHSW>bQ5CkXxoT)TA29t z87t5~ae;Qx;Qp|`H|*a>o&JM2%h&YL6u2&>r=?cj`N2CMD3 zm1A3>){aZBU8MN9`cEB`kEjEMsJw62kDKa3U|BF5C1+Ln;k6*$I5n3%wR7ujC_*TF zS@ZKyhE_)TqnrH=mchw1fd}rK(aEl0h{dHR8&*DCG8MCY#IlBUrNyjLYw!CECzlx& zQa{Xk5)hZyd_pPz9Q&{=_E`^VL95ge-0lFMrwNXmx|E z*DB!B`54)*?ZoOuS!LPH6bUQYYd)&O@Y(>j)|tbNuj7j&GNDC5i^)!~cfbw4EG0sk zWkwa!nSRd}I%u53I)lBb+FCmI`nma6psi^y?*%vb&Hkm9=wr_EGZHwY`lR()#Fwfx zd>WEko0RtcEz-3ERj`pM@NOZh#mNaQw}1oblC?EoOZ-I5-nM5SUc?K>bZy}N)a1Dj zDa%_OW$>DXPlItlkX?ivij>Xi(Q?#+I62^H|N|M$@C{g0;;^-B; zf}folD27qCWxbW3Pf1JiPezMiCp@Jk9O8n1t2JfDZvWbmMoX6p0=TO-1WT2u`s&ZN zmy4A*I!h?^xJoAEK`Y5qKXLaQ;F*GnK947vuBV zgpYD(V@uAtRwOQuu@_S)_ul;6-F|)VjrsW66dG5BJz$98u0mu_6oL_jX)JC^UULsC1MF0u z`<%bOy~TlZ@a%l^$a(2uv#)*g6X&31dt9Fr$!W5x&AM`uSvc-BI3#YBRW0?5gvNa5L?^Nc2B$HvUqQF^+~+7jCeih&nZKs{Syi2kbh z)Ze;)b-@(>)3K~OsM`? zj78mU-r`u)96kLMy%JnD55lx_8y~#dz6=1bl$=fD|Ci!E1su zH6tA*z;xh^95lvRHp0mzqA6whTA5fY6KiGSvr#5i(iheW!dgN2_zHr%RMny#tnX8; zZ!)cKGOe8w*EgBIoSRG^@W#;ka*S=lssNWg%yE{HOpB#>;s_W@qld@^hg|r^fPMFG zDrKqPKKPy%5R)NzDRD{+R9+QAi9;@on0>uu2MGp=)}mW-HX;J`rUYkl`WsMJPYIf{ z-|R9g%xe_z+(QSAXpy3R7yd)=2*H*Wo~%uYm0&({Y_>rC{-6^)T{zy>e5To(hZgj3 zF!=V{Zx=}<%dZ+;x_HO&vN9@!&wi;F>@VS>^D*JT!U*>XeEj5q6RoB`-0tgPtpeo7 z*#q^HUj*g2z!QjH4dS)icyc1K^L;agpXsuZbl#fPdTR3yDyN^pA48X}Ml=sMiJiG5 z1FxejRX{rp4fMv8b8c>H$?zdmr+n#0TC5e@c;s?2=0s>+@OsKJ0ulZIp3SoEkoqfZ z5tsB|I+(C26eO5(m(_WTVE3AF-_SRdB&UE-uxFVHi>_8+vyuPS2B2c ze|P;rqk@O5>vo7sSLXpqcE3RnHDEEtyZ84O6t^SVh4@XtSp`(rt;USG8+G1{X9P8{ zlUWl@d{)26Ior;@8Sv38U_Zctz39q#Xt*ulnJg3G+tm>b2|3{PA!GZG`{;kw5V_~o z+1hfSgYDn_$L{uaUHXpScV8@jul~Y*JM_ik_dC4bzuc+9yK;Y}RMP^Ew!TVOAxR;d z`}i|lc5#*+q$yQYhqK3^&sy&c2Lru%qr`KSWMTadT&$32&$j#aC^*-SPX-a~gYwbQ zaeC9OW1{}-ym@nH{ri%B{sD!aBzc)(Nkp&VI5oq0_V#V``~Cj@-X8qh@Aqr}4*L83 zy*q>ZyMw*{?t=&S_wMuu5AN^v@1Xu|c68pa5)$(}{daDw-nq}@SGT*gyVNP+*J~d` zgv(O&t_B-Q=@_C%Q0bh=4J(%nH?$Hm1YzQgWCRP+HSP+As5SyUrCBaeR}_kojiHWY zAOz_eLBh~&g_8Xn=Namv-%$~=x!Ohv?}`M~?3veQ@YIMdv)Kk~1$1@ou=sq`BIK0f zp%Bw2hUb!FNhY(QQ{0B=OrI3KfC3u`38GQfW#Gv3IOyN}9@cTTfR0;wzOPZW?8CGb zP=ZxSmr%n>gIBWjpg!H8EZ3)e!PtK5tJP$rc=~T^fP(f`>)~-kA*=PI(HBcC>Q{2g zIF+-*3=8qxO@+ZA%GG!Ces|j8R>^50$7u6UqLXkcX@axOcow%k7HJ_)Sw@rD5FKj& zx5tzV`6HFnCrrraCJwH4M0~Dop+j$abv|bYNy4f^Hc*YT>$uiwYgMAc<1sC$oCV}$ zQr?M{mbNQdMtGf)gT$q+?=NWGzrAF^bmp%@*AUI|Bpz}|>2gvsK_%mAkcN$Hi6;#x zr&X3&VrWz-UFMAzM@FwmL4-KvY!u-gW%zNMJ92~mf~B((D*Ca+HeBMI+du}~ywnO+ zg8C~Ng5*_kAYKT8Dsuhrr#s1xtw{;6|&bCy!p< zT2s#0QiM(E7}?L@y_jaV+cr9QeLQFe4vcjZJ!c+U21KiRbD-$VUPv7Trzb@=s}Vt< zSvKtTf+U>CX!i*aGIsf*#x^26d@+~UwxL*b|0Fg;u-h@*1wE)O5{o5gOpe8zA<~)c zLliJ6sB#8n55$=%(bi$kN<1;nt!jt6V276P#xle>hJDNuoL$g(6m1W{8(h+S9<>me z^xDd-K34O@nvkkD(N;!$7DcKiNlo-$ftH>xca z`~Fh6MoT>sSD5!QI_k9mfi)FQv=)&cQ4W2bo$y0YZZ;ND&w{o$ZZx~|=XOC8Z4=#? z%^R=_XDABWS}qhIL?y|i9ixLT$!yp-PmZ{#?!v{k8q?L;U91|K5w`?-opcpN+Ba^D^_jM+4td zW5}mx)4L68-rA1$0quAn-h#Kb-K}oB`y{M(e;9k++ETZ+)U7RbYfD|Il&)=bYa89i zw$c4TjA?5#noD>WGujOdXltj$clfp2|NQN{+b{qww*U1X?CwAC_P_nXo&I2dZ-211 z|9yzx(tDRn41liuioSnvFY+DifF8e3-4N(8eP>G`ClD%L4AJ17tbHD(_vp`OXL#AD zd@@$Q)kbBB*)QtX=WF+SA7;BR!qQ7=B%)%YkSt(p7kl)v%WO5kz0G8 ztKDdA_PI5)PZ)5e6~vqZU%0tv@jc7;iSd_Z?^%)6tPMWz>DOxiu?j^33dK8{fR@;Q z`g{9>JA?bX{d;>4?(Gf+clv_|gZ=%r{pUmcYFlKiO3pC>iDXLBDx<}ud-<*CQs(VJ zr(yj$CZXHaTHncX0~}`oRxS+2r{S#m9)7Ls->CW6sQK^80G6-+d-e6d`(VBPKgh4P z{%Z!FISjxp_w%TDwBFy*qS~+mZca&-cg3`KP3UAQH-~7m^Id;L|Ke{b+Wt^eJ%PN_$ zEEO!PbojZ1<-L?8qL*$!I9UrUlm#uEMx2QmGyV>GNNs99+ z9m|y)WF;wtsxhZMm*3W0(7`QSq`vuW)&5Z!Xm%bNQ8d~*4pHXK5rD6StwZlxoAx<3 zY!}X`&ml4`+WP;`aEkf%+&O?^jgg1c-Zs$IvED#7Hh#Lv?)1yn((NfD6P&f|Pum}R z6@I*5!2c7Tie4P8`&O?1F6ICI{oNY>-|w&e|2_eV0d@Y&FLv#t}{oy^gY?#mXBIky?7r;zOBpYJ;awhA7U22cv|y`q=ZUt3lwPRC6j3l5y}A z3e(^{E`O?}Slhwr(|_GNuVvVyV;xvI@?c>l;gZIlDzRJE5)eqgE@6%bPd&i+^j`hO zj3=ZW?1-_9;9^5{im3#1A=BEebghgE`GcOPaPW_9xcM@xIL_)*qaDp?F{v`lYnhOD z*#!BqDR%w4&0n4WYY|9?dA}w0zl{Iy4)z{2`2S!n|9_C*d*S~f5&f~*|2#12SMjWw zXrT$IgzlDX{qn;QRh%|*?R&8E!TQalmdh?l@fO&mL?oP+`c~!UX@+T`VQscI@tCvx zyy0;YH`Y3k&Bo6B`*{rEP(9HNG%;8_9jMhA<_2Sdz}e^Kby-198eX7^_U+>cL-f<8 z9@Jk}Ddoo)${VS{9cHET1P84<>!&{&aznJFYhpu~7f1~uypPT1*1z>{{agRmzuNEr Q1pom5|5>_A;Q*Kc0344l#{d8T literal 0 HcmV?d00001 diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml new file mode 100644 index 00000000..3fcf75cb --- /dev/null +++ b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml @@ -0,0 +1,690 @@ +collectord: + image: + repository: docker.io/outcoldsolutions/collectorforkubernetes + + clusterRole: + name: "" + create: true + rules: + - apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: ['privileged'] + + # Liveness/readiness probes for the /healthz and /readyz endpoints (26.04.4+). + # DaemonSets run on the host network, so the kubelet probes them on the loopback + # bind via httpGet.host 127.0.0.1; the addon runs off the host network and is + # probed on the pod IP. Requires the http server enabled in configuration.general + # below (httpServerBinding + httpServerEndpoints.health/ready). + daemonset: + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + host: 127.0.0.1 + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + daemonsetMaster: + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + host: 127.0.0.1 + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + deployment: + livenessProbe: + httpGet: + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + + configuration: + general: + # IMPORTANT: Please review license https://www.outcoldsolutions.com/legal/license-agreement/ + # and accept license by changing the value to *true* + acceptLicense: false + license: "" + dataPath: "./data/" + logLevel: info + httpServerBinding: "127.0.0.1:11888" + "httpServerEndpoints.health": true + "httpServerEndpoints.ready": true + "httpServerEndpoints.metrics": false + "httpServerEndpoints.pprof": false + httpServerLog: false + telemetryEndpoint: "https://license.outcold.solutions/telemetry/" + licenseEndpoint: "https://license.outcold.solutions/license/" + licenseServerProxyUrl: "" + licenseServerProxyBasicAuth: "" + hostname: "" + defaultOutput: "splunk" + fileInputBufferSize: "256b" + fileInputLineMaxSize: "1mb" + fields: + kubernetes_cluster: "-" + ec2Metadata: {} + annotationsSubdomain: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + autoSkipGzipFiles: true + "multioutput.async": true + "multioutput.asyncBufferSize": 100 + kubernetes: + serviceURL: "" + nodeName: "" + tokenPath: /var/run/secrets/kubernetes.io/serviceaccount/token + certPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + timeout: 30m + metadataTTL: 30s + volumesRootDir: /rootfs/var/lib/kubelet/ + includeAnnotations: [] + excludeLabels: [] + watch: + - 'v1/namespace' + - 'apps/v1/deployment' + - 'collectord.io/v1/configuration' + watchImplementation: 2 + crio: + url: unix:///rootfs/var/run/crio/crio.sock + timeout: 1m + containerd: + runtimePath: /rootfs/var/run/containerd + namespace: k8s.io + licenseClient: + url: "" + basicAuth: "" + insecure: false + capath: "" + caname: "" + proxyUrl: "" + proxyBasicAuth: "" + pipeJoin: + disabled: false + maxInterval: 100ms + maxWait: 1s + maxSize: 1MB + patternRegex: '^[^\s]' + pipeReplace: [] + pipeHash: [] + + outputs: + splunk: + default: + url: "" + urls: [] + urlSelection: random-with-round-robin + token: "" + insecure: false + minTLSVersion: "" + maxTLSVersion: "" + caPath: "" + caName: "" + clientCertPath: "" + clientKeyPath: "" + frequency: 5s + batchSize: 768K + events: 50 + proxyUrl: "" + proxyBasicAuth: "" + ackUrl: "" + ackUrls: [] + ackEnabled: false + ackTimeout: 3m + timeout: 30s + dedicatedClientPerIndex: true + incorrectIndexBehavior: RedirectToDefault + compressionLevel: default + threads: 2 + threadsAlgorithm: + excludeFields: [] + requireExplicitIndex: false + maximumMessageLength: "" + includeEventID: false + queueSize: 1024 + timestampPrecision: + + # Input configurations + inputs: + # Collectord internal metrics + collectordMetrics: + disabled: false + type: "kubernetes_prometheus" + interval: 1m + output: "" + index: "" + whitelist: + - "^file_input_open$" + - "^file_input_read_bytes$" + - "^kubernetes_handlers$" + - "^pipe$" + - "^pipelines_num$" + - "^splunk_post_bytes_sum.*$" + - "^splunk_post_events_count_sum.*$" + - "^splunk_post_failed_requests$" + - "^splunk_post_message_max_lag_seconds_bucket.*$" + - "^splunk_post_requests_seconds_sum.*$" + - "^splunk_post_retries_required_sum.*$" + blacklist: [] + + # Prometheus auto-discovery + prometheusAuto: + disabled: false + type: "kubernetes_prometheus" + index: "" + interval: 60s + includeHelp: true + timeout: 30s + output: "" + authorization: [] + + # System stats + systemStats: + disabled: + host: false + cgroup: false + pathCgroups: /rootfs/sys/fs/cgroup + pathProc: /rootfs/proc + statsInterval: 30s + type: + host: "kubernetes_stats_v2_host" + cgroup: "kubernetes_stats_v2_cgroup" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + + # Process stats + procStats: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_proc_stats_v2" + index: + host: "" + cgroup: "" + includeSystemThreads: false + output: + host: "" + cgroup: "" + hideArgs: false + + netStats: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_net_stats_v2" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + + netSocketTable: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_net_socket_table" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + group: true + disableLookup: false + + mountStats: + disabled: false + statsInterval: 30s + type: "kubernetes_mount_stats" + index: "" + output: "" + + diskStats: + disabled: false + statsInterval: 30s + type: "kubernetes_disk_stats" + index: "" + output: "" + + containerLogs: + disabled: false + type: "kubernetes_logs" + path: "/rootfs/var/lib/docker/containers/" + crioPath: "/rootfs/var/log/pods/" + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + index: "" + joinPartialEvents: true + stripTerminalEscapeSequences: false + stripTerminalEscapeSequencesRegex: '(\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)' + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + + applicationLogs: + disabled: false + root: /rootfs/ + syncInterval: 5s + glob: "*.log*" + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_logs" + index: "" + eventPatternRegex: '^[^\s]' + eventPatternMaxInterval: 100ms + eventPatternMaxWait: 1s + eventPatternMaxSize: 1MB + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + maxHoldAfterClose: 1800s + + hostLogs: + "audit-logs": + disabled: false + controlPlaneOnly: true + path: '/rootfs/var/log/kube-apiserver/' + glob: 'audit*.log' + match: "" + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '(?P.*"stageTimestamp":"(?P[^"]+)".*)' + extractionMessageField: 'message' + timestampField: 'timestamp' + timestampFormat: '2006-01-02T15:04:05.999999999Z07:00' + timestampLocation: "" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: "" + blacklist: [] + whitelist: [] + "syslog": + disabled: false + controlPlaneOnly: false + path: '/rootfs/var/log/' + glob: "" + match: '^(syslog|messages)(.\d+)?$' + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '^(?P[A-Za-z]+\s+\d+\s\d+:\d+:\d+)\s(?P[^\s]+)\s(?P[^:\[]+)(\[(?P\d+)\])?: (.+)$' + extractionMessageField: "" + timestampField: "timestamp" + timestampFormat: "Jan 2 15:04:05" + timestampSetMonth: false + timestampSetDay: false + timestampLocation: "Local" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + "logs": + disabled: false + controlPlaneOnly: false + path: '/rootfs/var/log/' + glob: "" + match: '^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$' + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '' + extractionMessageField: "" + timestampField: "" + timestampFormat: "" + timestampSetMonth: false + timestampSetDay: false + timestampLocation: "" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + + + journald: + disabled: false + path: + persistent: /rootfs/var/log/journal/ + volatile: /rootfs/run/log/journal/ + pollingInterval: 250ms + startFromRel: "" + type: "kubernetes_host_logs" + index: "" + samplingPercent: -1 + samplingKey: "" + reopenInterval: 1h + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + spawnExternalProcess: false + + diagnostics: + # Collectord can report if node reboot is required (uncomment to use it) + node-reboot-required: + path: /rootfs/var/run/reboot-required* + interval: "1h" + # See https://www.kernel.org/doc/Documentation/admin-guide/hw-vuln/index.rst + # And https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-system-cpu + cpu-vulnerabilities: + path: /rootfs/sys/devices/system/cpu/vulnerabilities/* + interval: 1h + + prometheus: + # Each entry below renders a [input.prometheus::] stanza in + # 002-daemonset.conf (controlPlaneOnly: false) or 003-daemonset-master.conf + # (controlPlaneOnly: true). + # + # The "WHERE" of the scrape is controlled by exactly one of three keys + # (since 26.04.2 - legacy endpoint-http://:/path syntax was + # removed and now fails fast at config load): + # endpointSlice: . - per-pod fan-out via discovery.k8s.io/v1.EndpointSlice + # service: . - hit the ClusterIP, kube-proxy load-balances + # endpoint(s): literal URL(s) - no Kubernetes discovery; the existing + # localhost-then-proxy fallback idiom. + # When endpointSlice or service is used, set port (number) or portName + # (matches EndpointSlice port name), plus scheme (http/https) and path. + # + # Example - scheduler reached through a headless discovery Service: + # "scheduler-via-discovery": + # controlPlaneOnly: true + # disabled: false + # type: "kubernetes_prometheus" + # source: "scheduler" + # interval: "60s" + # timeout: "60s" + # endpointSlice: kube-scheduler-collectorforkubernetes-discovery.kube-system + # port: 10251 + # scheme: http + # path: /metrics + # tokenPath: "" + # certPath: "" + # clientCertPath: "" + # insecure: false + # includeHelp: true + "kubelet": + controlPlaneOnly: false + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "kubelet" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - 'https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/${KUBERNETES_NODENAME}/proxy/metrics' + - 'http://127.0.0.1:10255/metrics' + - 'https://127.0.0.1:10250/metrics' + - 'http://127.0.0.1:10250/metrics' + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^kubelet_runtime_operations_duration_seconds_sum$' + - '^kubelet_docker_operations_duration_seconds_sum$' + - '^kubelet_network_plugin_operations_duration_seconds_sum$' + - '^kubelet_cgroup_manager_duration_seconds_sum$' + - '^storage_operation_duration_seconds_sum$' + - '^kubelet_docker_operations_errors_total$' + - '^kubelet_runtime_operations_errors_total$' + - '^rest_client_requests_total$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^rest_client_request_duration_seconds_sum$' + - '^kubelet_volume_stats_.+$' + - '^rest_client_requests_total$' + backlist: [] + "kubernetes-api": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "kubernetes-api" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://127.0.0.1:6443/metrics" + - "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^authenticated_user_requests$' + - '^apiserver_request_total$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^rest_client_request_duration_seconds_sum$' + - '^rest_client_requests_total$' + backlist: [] + "scheduler": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "scheduler" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:10259/metrics" + - "http://127.0.0.1:10251/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^scheduler_e2e_scheduling_duration_seconds_sum$' + - '^scheduler_binding_duration_seconds_sum$' + - '^scheduler_scheduling_algorithm_duration_seconds_sum$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + backlist: [] + "controller-manager": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "controller-manager" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:10257/metrics" + - "http://127.0.0.1:10252/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^node_collector_zone_size$' + - '^node_collector_zone_health$' + - '^node_collector_unhealthy_nodes_in_zone$' + backlist: [] + "etcd": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "etcd" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:2379/metrics" + - "http://:2379/metrics" + - "http://:2381/metrics" + tokenPath: "" + certPath: "/rootfs/etc/kubernetes/pki/etcd/ca.crt" + clientCertPath: "/rootfs/etc/kubernetes/pki/apiserver-etcd-client.crt" + clientKeyPath: "/rootfs/etc/kubernetes/pki/apiserver-etcd-client.key" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^etcd_server_leader_changes_seen_total$' + - '^etcd_server_has_leader$' + - '^etcd_server_proposals_committed_total$' + - '^etcd_server_proposals_applied_total$' + - '^etcd_server_proposals_committed_total$' + - '^etcd_server_proposals_pending$' + - '^etcd_server_proposals_failed_total$' + - '^etcd_disk_wal_fsync_duration_seconds_sum$' + - '^etcd_disk_wal_fsync_duration_seconds_count$' + - '^etcd_disk_backend_commit_duration_seconds_sum$' + - '^etcd_disk_backend_commit_duration_seconds_count$' + - '^etcd_network_client_grpc_.*$' + - '^grpc_server_handled_total$' + - '^etcd_network_peer_round_trip_time_seconds_bucket$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^process_open_fds$' + - '^process_max_fds$' + - '^etcd_disk_backend_commit_duration_seconds_bucket$' + - '^etcd_disk_wal_fsync_duration_seconds_bucket$' + backlist: [] + kubernetesEvents: + disabled: false + type: "kubernetes_events" + index: "" + output: "" + excludeManagedFields: true + kubernetesWatch: + "pods": + disabled: false + refresh: 10m + apiVersion: v1 + kind: Pod + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true + "resourcequota": + disabled: false + refresh: 10m + apiVersion: v1 + kind: ResourceQuota + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true + "nodes": + disabled: false + refresh: 10m + apiVersion: v1 + kind: Node + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true \ No newline at end of file diff --git a/packs/outcold-26.04.4/logo.png b/packs/outcold-26.04.4/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..de0588e3eefc9cbc6bd339de5d3745b8251c6e47 GIT binary patch literal 8716 zcmV+nBJ004R>004l5008;`004mK004C`008P>0026e000+ooVrmw00002 zVoOIv0RM-N%)bBt00(qQO+^Rd0}uoR4|6+BF8}}`6iGxuRCr$Poq4!kMV0PVw5_T&5HN%DNV_TKf@TD8`yRl_#oe+F!$ z0{_3@Z$$pu@HZlVZTKHUBxzKjWe8FH0~ib#Q&}h?q3pWJx!yX=!1)nH8C$DLikPgv ziY7-50yS@K4g*9)iZ-iW>|C+(wJlpVZrt7#O#5C8#8I#*geJ>AejD0W&ntEH}R$y*St9I<@HNn@v*#s9n>*t=eO-KxdZSC58wOX z!WTkmfsuPnIby%*qado!a_Kjb7!zRmArpzh+$nWj!Xtu2YYG=fQ;yAG=uq z#uyAp$_lvY2cL4xXb6rzp?^f89Bi03`;U)r0I*g!o-VYvb2z`=De~2hL!knMpzW~5mMU=@RYil6;HzQ|^jS)zKGE1ch7+VyI zu>`P(UvS2dzDY%WMex!~R~-bH#2Uc5q>fi|&H}bZ5#yWztrLv;m4G0chKQ*J-t0&4 z;`x^VW1}!uk^R1OM(g_3S0ce}`S)4tNn!+RqJSMbChWKOxLtQCR8>K1o?rIB{DrT8 zCE~(6ZW>i6y}sp{`S(2eY>|sKfp=fIcgyIR+Br*nf*c@M-FOZ-F(lKeZd+0B0F=snnW!^^J(vuOKmC9kBaH zZe5oBoQB?dmm&tAMoCLA?|_8ikC)dn2JaK#TB=UJOB_H>h=Oy`O z+b*WkeG?e@Xs+HwAEo>Mu16>rbSlj$mXAIWkv{~BVfe>ikfLv)-4wd?^za>CuF=-f zN9m^>V8L3BS*5PrayjS=k*ICEU<^a%NNH|2%Uay{t zvEXpOYLZFIM1rK>ojx1`xWw_kM%AiDYD92XmBdm1tAMJnAsCG%F+z%J+CzOYNu)<*aB z6{((@KmrNxYN8)DO(dpTdv<2uoq@xzTPI1OS)bk)qMP?JH9K7z>U)HaBut%@Ofh z{{e7d3}dhCe1m96N_8;~5-w>ZlBS5Hnzv_nNP61KtqytmgQ)bdEQpxfKqSo&@w#UW z1t4L>4R4$@BuQRRCKw#=Y+$(>6N#yAE|7pV9P+ecA404CAk}3g7~3dNYGGep2`Cjfi+%Q4FYex?kZ9 zR;vtA@4(?WrmoLwKqS?FU<@Sev!tM*HC#OsNXS%mP8*WQe7-ixhMFj!{Q zsYRVQKe)B;-Izp@aMUk`wwj3@P{hIifWz{eda3G~6r=QR3g9?!-J2^9c|B6V7)H#i zU6I-niG1m|Ns0@*{c5y-GvxtR2Oox0vgz?UWoljU?zfi_u%Z3-N$J4P#%?HXb7lS^WjhDalCif3XQq*gcF<>69 z8O+y^NVLDa(F78I{H1>l%T)|R55RyH)s#qnE#sUPowgGVgUk5$66#3 z_}UT|fp6_L00ygt)LAV=4n!ChP^(#UiG<|2ZzGa;`dP8R1}lc3vh^B$f?-4wjMyqy zqgir^7{0kBiPn$2qMxl91J*g)f1w(7+yMidH`XeVM#nz zXv6$)AV&H@>-HsCc1Xz?Vh!T!0AsvV@CjLxQmxFV!MAoc&@itxvo%HqVM%Ca>vZ z;2=rw!eaSanWw8%tuCFN*`0)|6&k!NsPjaU-zj8?;!>Z~wn%ztPssHX2JY;mJS2JD zKtjR^Wxc)H{63rjI6l|VqD1KfB>YlAsV*<&VHmtbHx4SJRszQd`XLXm`J*tFiHk~^ zR1^8L1sumVUac5(5e3Jm)fF^5IjyXDv}795t{UTI_a&=U zH&4Vm&MgVpN{OWUEDp!V8;x>AN~uRs>qelfp~cs(%;<2Yb*1J#P!G^ro9 zw+sfZkQ9BIX4~c#y`RrDYRI=?!C;>$sc4C&iDEpGyP4z_&gf zyS!YIB+d~1v|B$|u^qk=kyEi4xN3Urt!PPSusnr998hPOgmE%N`yjT#+nR(8M}H#P zHt^Yy*jk@lzqr03iS}(oW5eMWm#Rg{ErvA+v13iOky&xKi84GeP&O;@*zU)CTc197oRI@@m|e~ItvHfT~kH99vgnAI<@8C0qg4-3j2Nh&ry;> z>SLp|tl1hzWBGlp5n?69;gW!w5(9;WB7CLsU`j3qqy;OOyVNA9)%p8K}B`a>+k zAvZ?EyqP71dWp!yO#nmNtM2TEVG)J&(%Jj;9_C;%l8RO8`KwhZ80XCT^>8P4k3-&l za81> ztpiBh@*8eA_49|-I%L2wF-d`qv4%t%zMgamf`|)&WWW92K6UiYV;bI+hm5MDZRpsN zUpFjUx8$LDk92w3yKcYp!mkeXHDbPrV^~GSV*3%kwpndU=71o)gTh3GjWEqw-l#0UpGYW zr7NM0_NVf->s?rIr5ngfZIm4gqH`_zhF4{gp} z`Pk^E0~a75D*);2R=| z|9o0#kF)YzbS8_ke$o41F$#lWGx_+{ra`>#us1@lG8p)JdnZ3%l(T8X1KHtE-6$h6 z6@YcQs^#Ksbn?;0-hbd==vL%0687%3c(o^_07CuTM6A2WyyvR%Bc@SUxs1xEg>?wV4y&bF<95Wr zh7IIl1CgD3D5}0obak^Vq5dLs>$-0?9EM?eg|3SYtHCg)^eLs2<6(HmlO~$wFHOyB z?bq-_dlD=%ci*z1W_MBh(H|UDd!JlzD{gqQcJ3@rI_Dr|R}H%pSy)NLtk{kW!^$d9 z62NrnW4IdgRbC%}vGa>pysn}?_N={;-s`Rj4eq|acyrL*SkA8q{(@#3u$)}_W2slL zOhUjbxi;27EQ&n1$1b5zN6(FY{yh)8CI2v!=pH#S*1H*(UU1ZuqD|Toq>@)!bD^}+D_7T`#`_b6H8-AACs)o7P2Hr?)>@Kqf%eac_7#3noWMXZJ44Huu zTOX(Q`Czv4ID(@{t+&p?(R(+8P6!*YbWWgV;Z-qj&;JyjSt+idT?f*IjE85r+~n{5enf zyN(u5Z9#zJxcwSM!G__(F(`&C%iaw!rJ-WRwo|ZxEK3OOqsng(OBN%;go!nYz|=9( zip49dh!{p5gI)b+1Q+bAtnoe13mn);Eeo8xM>K%!ikFDfrd1MI z6`Ty?%eF|CJ<~F6cZ|%U`PE7hID!IqWlERCnde38Ol??k7M8>=d-zX(e$FSR+Xq=r z-8pTmcV{8pyA;*+l`C(a^`WUi^2u%8jT7{^faY3fd|zl?!l3o3{Ny^93LFUq@46_G~< zV+=#HVOn8;jJ51gL9lvB`B5a@ zb}K5L@co|hUQdspz{!o)C6poPUn#CKa~!X7b*PJ=X9t0OsN!|0ZpV>Sog`G*M^ash z#n7=;lGnfSc<+OPPQp2^Yhg9G*Kc}00bwk^XkH{S=oAXPz3O-UFC3OHR7k3lNYtt< z-*~;!s8yrP6Dm>KpJ6P+o^QCot{YLCCinVW%f8JEvr9j~7WnrH>QP&=(;ptFkW`h` ziaMVJ$AMky)TI>4L>u0UaU8m(S?%(=xHK!^xU$(cNcHRx9HT2It%B|X4AUw%5?2xN znga&Mwep>ZVDBucboV}iGt?XtueoLOqL$H%o4xb318|O+mBhPrE)K^dNI}JQ*c;@K36UHzbm@+%7^3-@me?> zi(&lUBph5e$?Ns}a4aMoG_QerrFx~KQXt^iYg2uhgrJ3okU&x$_eL#fgX%z1xkQxe zTO?q>7{<&mt8c37aDZd*EY&<*HhM2D-iw@3WWwQV>l`%iy>#s;927XF>S~uhfx~iS z^^JK%6m=>ISPKa^mN!e#IV6CC8TTt^nmPubN{T<9n8yPWrp%G#bN0SOAEYNw0SAs9 z7gvfrX!#^83D;LELoSh^wR@9&w8C*tdAADMek2KC9OjJsf~4rv)cfp<4_TqkC$2uM zd_8Xo9LYI<%#JUJA-mIiU;LuM6aO?AYrs;dJ{s5SN(xvyUahu$xkTjkVh1D^4CA+{ z3_&a3lC`x14!>%C#WOcPc*8#)IuvTJxU#^0=id0pYpTGqAD%oUd#r_%qedrsM*&{jxdSJ(EXPdxkh`r;)Q_`yF^rSsFmtWVhpgBNsE4g0DGRz-Me z?#;(wahzA#G^v(MFY15q7Tl7Jli7D_>Y}tr+t882+D-9i1CY>mbG1Bz)_34YI6u#+ z)*_-1rQc(XW!lQh8&j=3vbW~eCE5FpOA_0{rWj*gl5`ihN%y`O>)82^Ii}s~s}wM_ zKapqmYZ6iH(yMR5;rMA)>!jNH59O0Y#RN#}D9N5=NZ_=kIsGH(rI8q1g^TV+Z6Z=v zG4y{=^>8RiH|~(PE4rUB4tBgc*VTG`7zYe`HaA?WM8Pz!(xfnIBNpBO=9vu{b`K7gTuZcPBvK6eV|n{`UoNK+_3YWj6ArrcV~oLZRIT(yebq{JAr8a1b@}&4A9Pz% zD;8-1)^LGTv4K8l4w)TJ_2@7xmbS<9o3s&;sD$glCd{yeIXslG9 ztE%XAHe98&OREl|00}$S*|FMyh`i3n zf$5n~kQ6HthFy;G}F&d_cq6*Ybu&1rrL4| z`A3J;MFK}XotGsG>N=P<4&8kF(cr+sf7CKqlA0hAv~{0Mxo*!IBx)fSR&_cr%{dxc zIwaFNnDAYnSHB>gPQlP|1Xu$J%&Py*mWD)>>TV2JMlDj8q@erQtzy(DDR_k+PRRm| zreG3iyLee{fEc6;vewI@xdg6j@a>t#MCA2}EIQchRi#qUT*rUssH>MYUpbYgxEN<) z$TJP7M z0_^mud8&3ElH{fHuvs=L8!F6PUB_N!Xo85m=8eFDBahg-A?eE2!-t5JU-!{kvO3e{bs-KhP7k9l!>eP9-S{ovQm-LtG zP8|b)OKf($nK8!N?(fwW4*l}nP#IYDAk_;8;0y-#8Ht^G-aWCI&ulbBL|)&;T5#~` zRnjfAvEy^Kthx`9mjCjTN9|fA5Ey;X-+zBzkZOG(Cj`yji3E)0TrK?F+-+(?9BTR# zX~BK%U$GGz*?Hz!BaU8DNT>d3e697DQ4V0q(iQVwT(@cc`fc77MvNUXa?(E2#!VXn zwLg~a6TWjvns^L4|N8(aHkZ$6#56+;nw1Sa9M~f#ViKmWsM7;u&#{c5YtyP_E7oo6 z7D1g4j0UeY?}MV~r4Va;6*dP=5>fQJby)8gXblvYQvXAkG5Ct3F{7{hsaG%EwMX}7 zroNu%@9UshB9hl*2NZpTEvC`N&2FX}DqC{ds8k5r{HZKpOKAI1tKVL0o`_O)T{apL zXNrm4g!b#2nYn5PF_rGx0~{E~TUz`&uv#J_FTH%>r0&jT!NNJ4`*yZpIii;qpOuNj z!KrInZ=P0&D0*q>^&i|LVcf|U2iCIRef<}Tm$qF#raP=^zp5`!Y>7xlMV(JSxKh6w z(rv^pSy#(P*Yp;ph+c{}P4BUZ`#jWQH_y-_ksf~>G=F-xfthmcww#$OW%L>`NhST_ zNQz$;htF+qILn%gmWfDG3{k1pp3EOevFyBxc8a5Oni{S&yUH5WX8c^ z_c!OqtI;PSlB87nW_#vYEKL9MQ&Eya_Eq*MNn7tc_H8R`6N%nSo349%am?Xh)D@k5 zHXVH@q98qZ06k8!aO7ow_)AY~u6yj}3wGn!4YkxgJJ(^s|JkiLKz0_+S=3i?sOeZM z7Ya%Gjc>e$3*Z!iNs~wJG`>A-ux(laJpvufs3u4EsNbJoPzyHx>a zG8Q&Q*yY62j~dkU2(SSLhzKA>XSm^9r-(5aBdPdsV=NL97-NV6c0cTt<41$<--JXj z295}se>nfTOn0Dk(U|~)F(wEYwC~Z!9XPJ};dnC`P$D41cfP&?$l5;RBIpqgJ9SJy z=HTgoHv`9l0Vjem%YS|MvoBO{&@+X}yX}1Fo|C3JAjZ}+_w_N*M8GGIzPNP5%9UHU zccu~J3hjf2PTFzQ&Xcnfaze|8xHf}=f@}MX?a4QVT@H!9yx@}aq)grTF_3!B) zUMC`NJO;SSy?OW>k-s+ljmTdc{>Kpce?1~n_-mu?t^fc4C3HntbYx+4WjbSWWnpw> z05UK!I4v+UEipD!Ff=+aG&(UgD=;uRFfikrxD)^Y03~!qSaf7zbY(hiZ)9m^c>ppn qF*q$SGc7STR4_C;Ff=+bH7hVMIxsMj#sH`Q0000' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true +``` + +Where you will agree to the license agreement, include your license key, and configure Splunk default output. + +You can generate a YAML file for deployment using the following command: + +```bash +helm template collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + --include-crds \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes > collectorforkubernetes.yaml +``` + +To install the chart, run the following command: + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +## Configuration + +Collectord is configured using the `ini` file format. You can find a reference with all possible configurations [here](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/reference/). +This helm chart allows you to customize and override those configurations. +Using `my_values.yaml` as a template, you can customize the configuration to suit your needs. Please refer to the [./values.yaml](./values.yaml) for default configuration and possible values. + +### Using secrets + +If you want to store some configurations in a secret, first you need to create a secret with the `ini` format, that Collectord can read from. For example, if we want to store license, and token in secret file, +first we will create a secret file with the `ini` format and `.conf` extension with name `101-general.conf`. + +```ini +[general] +license = + +[output.splunk] +token = B5A79AAD-D822-46CC-80D1-819F80D7BFB0 +``` + +Using this file we can create a secret using the `ini` file: + +```bash +kubectl create namespace collectorforkubernetes +kubectl create secret generic collectord-secret \ + --from-file=101-general.conf=101-general.conf \ + -n collectorforkubernetes +``` + +After that we can remove values that we provided in the secret file in the `my_values.yaml` file. + +```yaml +collectord: + secrets: + - name: collectord-secret + + configuration: + general: + acceptLicense: true + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + insecure: true +``` + +And install it using the following command (don't need to create namespace as we already created it): + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +> NOTE: Collectord reads all files with `.conf` extension from the `/config` directory and subdirectories. It will sort them by name in ascending order before reading them. +> In a case of file names `001-general.conf` and `101-general.conf`, all values in `101-general.conf` will override values in `001-general.conf`. + +### Secondary Splunk Output + +Collectord supports multiple Splunk outputs. You can configure an additional Splunk output by adding a new section to the `my_values.yaml` file. For example: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true + apps: + url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' + token: '107E857B-C311-4C72-97E4-FBE601A6B39E' + insecure: true +``` + +After that you can reference this output in annotations like `collectord.io/output=splunk::apps` + +### Secondary Collectord deployment + +Collectord has ability to forward logs to multiple Splunk outputs simultaneously. In the example above, you can use annotations like `collectord.io/output=splunk,splunk::apps` +to forward logs to both outputs. But there are limitations about if you want to apply some transofrmation logic using the annotations, as this logic will be applied to both outputs at the same time. + +Say we will have two Collectord deployments, one forwarding data to Splunk Enterprise and another to Splunk Cloud. First we will deploy configuration for Splunk Enterprise `splunkenterprise_values.yaml`. +For example: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true +``` + +And we will deploy it with + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + -f splunkenterprise_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +Secondary we will create a configuration file for Splunk Cloud `splunkcloud_values.yaml`, where we will call this deployment +`collectorforkubernetes-cloud`, and reference already created objects like service account, priority class, and cluster role, +created with previous deployment. +For example: + +```yaml +collectord: + serviceAccount: + create: false + name: collectorforkubernetes + + priorityClass: + create: false + name: collectorforkubernetes-critical + + clusterRole: + create: false + name: collectorforkubernetes + + configuration: + general: + annotationsSubdomain: 'splunkcloud' + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' + token: '107E857B-C311-4C72-97E4-FBE601A6B39E' + insecure: true +``` + +To deploy it, you will run command, where we reference the same namespace (and ClusterRole, ClusterRoleBinding, ServiceAccount), but create separate DaemonSet, StatefulSets and Deployments specifically for the Splunk Cloud deployment. + +```bash +helm install collectorforkubernetes-cloud \ + --namespace collectorforkubernetes \ + -f splunkcloud_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +## Support + +Please refer to [How to submit a support request?](https://www.outcoldsolutions.com/docs/faq/#how-to-submit-a-support-request) + +## License + +[OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT](https://www.outcoldsolutions.com/legal/license-agreement/) \ No newline at end of file diff --git a/packs/outcold-26.04.4/values.yaml b/packs/outcold-26.04.4/values.yaml new file mode 100644 index 00000000..9ec2c3a1 --- /dev/null +++ b/packs/outcold-26.04.4/values.yaml @@ -0,0 +1,698 @@ +pack: + content: + images: + - image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4 + namespace: collectorforkubernetes + namespaceLabels: + "collectorforkubernetes": "pod-security.kubernetes.io/enforce=privileged" + +charts: + collectord-splunk-kubernetes: + collectord: + image: + repository: docker.io/outcoldsolutions/collectorforkubernetes + tag: 26.04.4 + + clusterRole: + name: "" + create: true + rules: + - apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: ['privileged'] + + # Liveness/readiness probes for the /healthz and /readyz endpoints (26.04.4+). + # DaemonSets run on the host network, so the kubelet probes them on the loopback + # bind via httpGet.host 127.0.0.1; the addon runs off the host network and is + # probed on the pod IP. Requires the http server enabled in configuration.general + # below (httpServerBinding + httpServerEndpoints.health/ready). + daemonset: + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + host: 127.0.0.1 + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + daemonsetMaster: + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + host: 127.0.0.1 + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + deployment: + livenessProbe: + httpGet: + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + + configuration: + general: + # IMPORTANT: Please review license https://www.outcoldsolutions.com/legal/license-agreement/ + # and accept license by changing the value to *true* + acceptLicense: false + license: "" + dataPath: "./data/" + logLevel: info + httpServerBinding: "127.0.0.1:11888" + "httpServerEndpoints.health": true + "httpServerEndpoints.ready": true + "httpServerEndpoints.metrics": false + "httpServerEndpoints.pprof": false + httpServerLog: false + telemetryEndpoint: "https://license.outcold.solutions/telemetry/" + licenseEndpoint: "https://license.outcold.solutions/license/" + licenseServerProxyUrl: "" + licenseServerProxyBasicAuth: "" + hostname: "" + defaultOutput: "splunk" + fileInputBufferSize: "256b" + fileInputLineMaxSize: "1mb" + fields: + kubernetes_cluster: "-" + ec2Metadata: {} + annotationsSubdomain: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + autoSkipGzipFiles: true + "multioutput.async": true + "multioutput.asyncBufferSize": 100 + kubernetes: + serviceURL: "" + nodeName: "" + tokenPath: /var/run/secrets/kubernetes.io/serviceaccount/token + certPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + timeout: 30m + metadataTTL: 30s + volumesRootDir: /rootfs/var/lib/kubelet/ + includeAnnotations: [] + excludeLabels: [] + watch: + - 'v1/namespace' + - 'apps/v1/deployment' + - 'collectord.io/v1/configuration' + watchImplementation: 2 + crio: + url: unix:///rootfs/var/run/crio/crio.sock + timeout: 1m + containerd: + runtimePath: /rootfs/var/run/containerd + namespace: k8s.io + licenseClient: + url: "" + basicAuth: "" + insecure: false + capath: "" + caname: "" + proxyUrl: "" + proxyBasicAuth: "" + pipeJoin: + disabled: false + maxInterval: 100ms + maxWait: 1s + maxSize: 1MB + patternRegex: '^[^\s]' + pipeReplace: [] + pipeHash: [] + + outputs: + splunk: + default: + url: "" + urls: [] + urlSelection: random-with-round-robin + token: "" + insecure: false + minTLSVersion: "" + maxTLSVersion: "" + caPath: "" + caName: "" + clientCertPath: "" + clientKeyPath: "" + frequency: 5s + batchSize: 768K + events: 50 + proxyUrl: "" + proxyBasicAuth: "" + ackUrl: "" + ackUrls: [] + ackEnabled: false + ackTimeout: 3m + timeout: 30s + dedicatedClientPerIndex: true + incorrectIndexBehavior: RedirectToDefault + compressionLevel: default + threads: 2 + threadsAlgorithm: + excludeFields: [] + requireExplicitIndex: false + maximumMessageLength: "" + includeEventID: false + queueSize: 1024 + timestampPrecision: + + # Input configurations + inputs: + # Collectord internal metrics + collectordMetrics: + disabled: false + type: "kubernetes_prometheus" + interval: 1m + output: "" + index: "" + whitelist: + - "^file_input_open$" + - "^file_input_read_bytes$" + - "^kubernetes_handlers$" + - "^pipe$" + - "^pipelines_num$" + - "^splunk_post_bytes_sum.*$" + - "^splunk_post_events_count_sum.*$" + - "^splunk_post_failed_requests$" + - "^splunk_post_message_max_lag_seconds_bucket.*$" + - "^splunk_post_requests_seconds_sum.*$" + - "^splunk_post_retries_required_sum.*$" + blacklist: [] + + # Prometheus auto-discovery + prometheusAuto: + disabled: false + type: "kubernetes_prometheus" + index: "" + interval: 60s + includeHelp: true + timeout: 30s + output: "" + authorization: [] + + # System stats + systemStats: + disabled: + host: false + cgroup: false + pathCgroups: /rootfs/sys/fs/cgroup + pathProc: /rootfs/proc + statsInterval: 30s + type: + host: "kubernetes_stats_v2_host" + cgroup: "kubernetes_stats_v2_cgroup" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + + # Process stats + procStats: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_proc_stats_v2" + index: + host: "" + cgroup: "" + includeSystemThreads: false + output: + host: "" + cgroup: "" + hideArgs: false + + netStats: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_net_stats_v2" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + + netSocketTable: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_net_socket_table" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + group: true + disableLookup: false + + mountStats: + disabled: false + statsInterval: 30s + type: "kubernetes_mount_stats" + index: "" + output: "" + + diskStats: + disabled: false + statsInterval: 30s + type: "kubernetes_disk_stats" + index: "" + output: "" + + containerLogs: + disabled: false + type: "kubernetes_logs" + path: "/rootfs/var/lib/docker/containers/" + crioPath: "/rootfs/var/log/pods/" + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + index: "" + joinPartialEvents: true + stripTerminalEscapeSequences: false + stripTerminalEscapeSequencesRegex: '(\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)' + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + + applicationLogs: + disabled: false + root: /rootfs/ + syncInterval: 5s + glob: "*.log*" + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_logs" + index: "" + eventPatternRegex: '^[^\s]' + eventPatternMaxInterval: 100ms + eventPatternMaxWait: 1s + eventPatternMaxSize: 1MB + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + maxHoldAfterClose: 1800s + + hostLogs: + "audit-logs": + disabled: false + controlPlaneOnly: true + path: '/rootfs/var/log/kube-apiserver/' + glob: 'audit*.log' + match: "" + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '(?P.*"stageTimestamp":"(?P[^"]+)".*)' + extractionMessageField: 'message' + timestampField: 'timestamp' + timestampFormat: '2006-01-02T15:04:05.999999999Z07:00' + timestampLocation: "" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: "" + blacklist: [] + whitelist: [] + "syslog": + disabled: false + controlPlaneOnly: false + path: '/rootfs/var/log/' + glob: "" + match: '^(syslog|messages)(.\d+)?$' + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '^(?P[A-Za-z]+\s+\d+\s\d+:\d+:\d+)\s(?P[^\s]+)\s(?P[^:\[]+)(\[(?P\d+)\])?: (.+)$' + extractionMessageField: "" + timestampField: "timestamp" + timestampFormat: "Jan 2 15:04:05" + timestampSetMonth: false + timestampSetDay: false + timestampLocation: "Local" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + "logs": + disabled: false + controlPlaneOnly: false + path: '/rootfs/var/log/' + glob: "" + match: '^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$' + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '' + extractionMessageField: "" + timestampField: "" + timestampFormat: "" + timestampSetMonth: false + timestampSetDay: false + timestampLocation: "" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + + + journald: + disabled: false + path: + persistent: /rootfs/var/log/journal/ + volatile: /rootfs/run/log/journal/ + pollingInterval: 250ms + startFromRel: "" + type: "kubernetes_host_logs" + index: "" + samplingPercent: -1 + samplingKey: "" + reopenInterval: 1h + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + spawnExternalProcess: false + + diagnostics: + # Collectord can report if node reboot is required (uncomment to use it) + node-reboot-required: + path: /rootfs/var/run/reboot-required* + interval: "1h" + # See https://www.kernel.org/doc/Documentation/admin-guide/hw-vuln/index.rst + # And https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-system-cpu + cpu-vulnerabilities: + path: /rootfs/sys/devices/system/cpu/vulnerabilities/* + interval: 1h + + prometheus: + # Each entry below renders a [input.prometheus::] stanza in + # 002-daemonset.conf (controlPlaneOnly: false) or 003-daemonset-master.conf + # (controlPlaneOnly: true). + # + # The "WHERE" of the scrape is controlled by exactly one of three keys + # (since 26.04.2 - legacy endpoint-http://:/path syntax was + # removed and now fails fast at config load): + # endpointSlice: . - per-pod fan-out via discovery.k8s.io/v1.EndpointSlice + # service: . - hit the ClusterIP, kube-proxy load-balances + # endpoint(s): literal URL(s) - no Kubernetes discovery; the existing + # localhost-then-proxy fallback idiom. + # When endpointSlice or service is used, set port (number) or portName + # (matches EndpointSlice port name), plus scheme (http/https) and path. + # + # Example - scheduler reached through a headless discovery Service: + # "scheduler-via-discovery": + # controlPlaneOnly: true + # disabled: false + # type: "kubernetes_prometheus" + # source: "scheduler" + # interval: "60s" + # timeout: "60s" + # endpointSlice: kube-scheduler-collectorforkubernetes-discovery.kube-system + # port: 10251 + # scheme: http + # path: /metrics + # tokenPath: "" + # certPath: "" + # clientCertPath: "" + # insecure: false + # includeHelp: true + "kubelet": + controlPlaneOnly: false + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "kubelet" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - 'https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/${KUBERNETES_NODENAME}/proxy/metrics' + - 'http://127.0.0.1:10255/metrics' + - 'https://127.0.0.1:10250/metrics' + - 'http://127.0.0.1:10250/metrics' + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^kubelet_runtime_operations_duration_seconds_sum$' + - '^kubelet_docker_operations_duration_seconds_sum$' + - '^kubelet_network_plugin_operations_duration_seconds_sum$' + - '^kubelet_cgroup_manager_duration_seconds_sum$' + - '^storage_operation_duration_seconds_sum$' + - '^kubelet_docker_operations_errors_total$' + - '^kubelet_runtime_operations_errors_total$' + - '^rest_client_requests_total$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^rest_client_request_duration_seconds_sum$' + - '^kubelet_volume_stats_.+$' + - '^rest_client_requests_total$' + backlist: [] + "kubernetes-api": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "kubernetes-api" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://127.0.0.1:6443/metrics" + - "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^authenticated_user_requests$' + - '^apiserver_request_total$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^rest_client_request_duration_seconds_sum$' + - '^rest_client_requests_total$' + backlist: [] + "scheduler": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "scheduler" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:10259/metrics" + - "http://127.0.0.1:10251/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^scheduler_e2e_scheduling_duration_seconds_sum$' + - '^scheduler_binding_duration_seconds_sum$' + - '^scheduler_scheduling_algorithm_duration_seconds_sum$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + backlist: [] + "controller-manager": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "controller-manager" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:10257/metrics" + - "http://127.0.0.1:10252/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^node_collector_zone_size$' + - '^node_collector_zone_health$' + - '^node_collector_unhealthy_nodes_in_zone$' + backlist: [] + "etcd": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "etcd" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:2379/metrics" + - "http://:2379/metrics" + - "http://:2381/metrics" + tokenPath: "" + certPath: "/rootfs/etc/kubernetes/pki/etcd/ca.crt" + clientCertPath: "/rootfs/etc/kubernetes/pki/apiserver-etcd-client.crt" + clientKeyPath: "/rootfs/etc/kubernetes/pki/apiserver-etcd-client.key" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^etcd_server_leader_changes_seen_total$' + - '^etcd_server_has_leader$' + - '^etcd_server_proposals_committed_total$' + - '^etcd_server_proposals_applied_total$' + - '^etcd_server_proposals_pending$' + - '^etcd_server_proposals_failed_total$' + - '^etcd_disk_wal_fsync_duration_seconds_sum$' + - '^etcd_disk_wal_fsync_duration_seconds_count$' + - '^etcd_disk_backend_commit_duration_seconds_sum$' + - '^etcd_disk_backend_commit_duration_seconds_count$' + - '^etcd_network_client_grpc_.*$' + - '^grpc_server_handled_total$' + - '^etcd_network_peer_round_trip_time_seconds_bucket$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^process_open_fds$' + - '^process_max_fds$' + - '^etcd_disk_backend_commit_duration_seconds_bucket$' + - '^etcd_disk_wal_fsync_duration_seconds_bucket$' + backlist: [] + kubernetesEvents: + disabled: false + type: "kubernetes_events" + index: "" + output: "" + excludeManagedFields: true + kubernetesWatch: + "pods": + disabled: false + refresh: 10m + apiVersion: v1 + kind: Pod + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true + "resourcequota": + disabled: false + refresh: 10m + apiVersion: v1 + kind: ResourceQuota + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true + "nodes": + disabled: false + refresh: 10m + apiVersion: v1 + kind: Node + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true \ No newline at end of file From 9598a232c9fafa6b12cb30de44369dd4ec9430e3 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 24 Jun 2026 16:28:01 -0500 Subject: [PATCH 08/10] Rename readme.md to README.md Rename readme.md to README.md --- packs/outcold-26.04.4/{readme.md => README.md} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename packs/outcold-26.04.4/{readme.md => README.md} (99%) diff --git a/packs/outcold-26.04.4/readme.md b/packs/outcold-26.04.4/README.md similarity index 99% rename from packs/outcold-26.04.4/readme.md rename to packs/outcold-26.04.4/README.md index 4c615a93..d3df84f6 100644 --- a/packs/outcold-26.04.4/readme.md +++ b/packs/outcold-26.04.4/README.md @@ -224,4 +224,4 @@ Please refer to [How to submit a support request?](https://www.outcoldsolutions. ## License -[OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT](https://www.outcoldsolutions.com/legal/license-agreement/) \ No newline at end of file +[OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT](https://www.outcoldsolutions.com/legal/license-agreement/) From cc50cc47d276ddbc150e40d283c19a5f361733ff Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Tue, 11 Aug 2026 15:50:02 -0500 Subject: [PATCH 09/10] new file: packs/tekton-pipelines-1.15.1/README.md new file: packs/tekton-pipelines-1.15.1/logo.png new file: packs/tekton-pipelines-1.15.1/manifests/release.yaml new file: packs/tekton-pipelines-1.15.1/pack.json new file: packs/tekton-pipelines-1.15.1/schema.yaml new file: packs/tekton-pipelines-1.15.1/values.yaml --- packs/tekton-pipelines-1.15.1/README.md | 83 + packs/tekton-pipelines-1.15.1/logo.png | Bin 0 -> 10170 bytes .../manifests/release.yaml | 28206 ++++++++++++++++ packs/tekton-pipelines-1.15.1/pack.json | 30 + packs/tekton-pipelines-1.15.1/schema.yaml | 2 + packs/tekton-pipelines-1.15.1/values.yaml | 8 + 6 files changed, 28329 insertions(+) create mode 100644 packs/tekton-pipelines-1.15.1/README.md create mode 100644 packs/tekton-pipelines-1.15.1/logo.png create mode 100644 packs/tekton-pipelines-1.15.1/manifests/release.yaml create mode 100644 packs/tekton-pipelines-1.15.1/pack.json create mode 100644 packs/tekton-pipelines-1.15.1/schema.yaml create mode 100644 packs/tekton-pipelines-1.15.1/values.yaml diff --git a/packs/tekton-pipelines-1.15.1/README.md b/packs/tekton-pipelines-1.15.1/README.md new file mode 100644 index 00000000..74e53923 --- /dev/null +++ b/packs/tekton-pipelines-1.15.1/README.md @@ -0,0 +1,83 @@ +# Tekton Pipelines + +Tekton Pipelines is a Kubernetes-native extension that installs and runs on your cluster, providing a set of Kubernetes Custom Resources (Tasks, Pipelines, PipelineRuns, and TaskRuns). These act as building blocks to assemble robust, cloud-native continuous integration and continuous delivery (CI/CD) workflows. + +## Prerequisites + +- **Kubernetes:** Version 1.29+ (e.g., AWS EKS, OpenShift, or generic clusters). +- **Helm:** Version 3.0.0+ installed and configured. +- **Storage:** A default `StorageClass` configured in your cluster (such as the EBS CSI driver) if utilizing Tekton Workspaces for pipeline artifacts. + +## Parameters + +The following tables lists the configurable parameters of the Tekton Pipelines chart and their default values. + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| `replicaCount` | int | `1` | Number of replicas for the Tekton controller | +| `image.repository` | string | `"gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/controller"` | Image repository for the controller | +| `image.tag` | string | `"v1.12.0"` | Image tag (defaults to chart appVersion) | +| `webhook.enabled` | bool | `true` | Enable the mutating/validating webhook | +| `featureFlags.enable-api-fields` | string | `"stable"` | Setting to `alpha` enables experimental features | +| `resources.requests.cpu` | string | `"100m"` | CPU requests for the controller pods | +| `resources.requests.memory` | string | `"100Mi"` | Memory requests for the controller pods | +| `serviceMonitor.enabled` | bool | `true` | Enable Prometheus ServiceMonitor for cloud-native observability | + +## Upgrade + +To upgrade an existing installation of the Tekton Pipelines chart: + +```bash +helm repo update +helm upgrade tekton-pipelines /tekton-pipelines \ + --namespace tekton-pipelines \ + --values overrides.yaml +``` + +**Note:** Before upgrading, particularly across major versions, it is recommended to ensure no critical `PipelineRuns` or `TaskRuns` are actively executing. You may also want to use tools like `yq` or `jq` to audit your custom configuration overrides against the newly released default `values.yaml` to ensure compatibility. + +## Usage + +To install the chart with the release name `tekton-pipelines`: + +```bash +# Add the Helm repository +helm repo add tekton-charts +helm repo update + +# Install the chart +helm install tekton-pipelines tekton-charts/tekton-pipelines \ + --namespace tekton-pipelines \ + --create-namespace +``` + +Once deployed, you can verify that the controllers are running: + +```bash +kubectl get pods -n tekton-pipelines +``` + +You are now ready to deploy Tekton resources. For instance, to test your setup with a simple Task: + +```bash +cat <`s?^<1Z z)vBugvv)_SD$5`t;3I&6fg#DsN~(Wa!OtlU2lM$xTx=fvG~hsW8F8?hX~N^rMVN(- zoTZWy82u-P1A_)f2ZQ{F^7(*)#s3KthF!bs;G5(q0U|Bi1pK7``nmTSe zN{akuP7cf_=1!&-%w7)8|3rZadhvfk2Mae7QZEO4Ml%YU^$Lk0iw@~gPoSbS#wM_-st@ITD| z&-ZU0L6(1#|3Ah2PpAL!ezq!%AjtCHZ4*YoGu(v*1EaE)lN8gmhHmzSHP+NxyXWwy zPFD0GgN7h;6F&;W7LA4oiQHLpH<;+CwlkVAHGy_F_!VN{A_j#RNe-tDMZiRv7)B|| zf84ED+IlN;i2V3;-Vt)~Kr%L&>pLU#(A902y3;p<Vs>1=6o(fSk4S%EJo^w&(gH%lS0TGzO(?{tp?jT z9Q#OJA zkuC{VdE8My#ll7EDz&wVsOrGJUz3LNvA^OIgv(^dHyH#u$A3K>_%i?oL<;PKL?X#~ zupvWs5=L%Du7jFn&AK~s@g(=Kri4jQkobMYc~q!G8AU*^E>W}q$^7o*AS0u|u#xKS z+~nD}z5w}S6gJl|E-{idjEbf|F$oFL&E$f4%U ziu2u;CnA9`Z2l&B<-?852T4VAWHLz>PXHB;BY#&B%eH4G^zBq*)_)sDs}kXv7sCx( zNH@iF=XyYQIcnM|YgYw@)c(L&hdDE7Oiq_oN@mc|4dz_HbKq(NbmhL1A7DJk= z5h!f>;mtG2Et2JEgk)vGGyum+h8#UV(+3m_D)AF530*i2uNnjg*2)%J{uMu~vp)-X zP>?UeQuuHan#Rl%A5AM7^Zg4}T9`PMsV&+bq$&S$c!kk3-i=OA3*niDA*> zc8@A6Wpwf=aYre|IZSB*h>f#8>we{1kAUfPk3NwCoOvTZxC}1n;AzLbt#@{Hl3x6| z#zy$GeBwEcXWxQRTaA1y!LpzVS~=o3s7V|s9WgwSS8$dtW*%`jO%!}4z6~VzV(i;@ zFC^i|TU$z+(f$<%m>*b6tQzqk5g#scQ1QSF4KGB1b$M|y`#k7~^o*YO)lr9$zo7*- z;3OcFA1rk^Buq}D0FM*%JiE2%Y3c9L(UD}zX2kE&Jn2_=GgO`j^+&(OlQ3y1i{Dak zgoc$9w|hdpyB}BnVnO@-^EyY(wi)G88wQ*6HGSn=eN0`fR3MYB20OL309Z|A9`b=$ z+?T7rSEZ72b}&CEz&NIovTd~`gz{TD$#NXS(7jAN#mzWLhs<{)N+NzE8G@_0F^XSy zVIN;#)Ak&?>pT#K29I_-=`gY=sA4%oY=MEdh*|Mk(YM#`1f))gJh^;UF%RyzY0N%= zZY8Y(6sRBwQY(t+KLkzWOKH+$MNC1O+?Q zpQFbMfGEI*E7Lp6VPLkCXhZS&@Axx(^;wCdTP5B)8)9*Q~L*`9H z6$G|HXBif!Evqbu3yjAR$QtCX!_UpfPhTi!*faBvSM9RY260E9tt`R-B`G=U)n=u_ z=HpKv1=mc;$0UkJX0qbGdw%)7h%_TEAdHms21-nh!J_3Icw(_IcldRW@&voptESwwaK16?dh0x@%IhzdK{}kOZRW z9n6St?9Ey8eoN?>K{k6NKuOeKY$7y2MC2txkN8mZ_0~d$5YtN<2M;Tjrm$FZcDtmL z0tV3eX)ztGss{-p(t!I^qQh59hfe2^FK#_>7gntq6QV;pRb#`j7-+Pj1n>m!*GopP ziA`O449Y>>g_RqtpnwWg;MTMQ!wR*WB$k!=PmxfI-6Tg?!?xJ5%6bLhQ~?OWTXGt| z2;NF>SNk34w{f0l1%J8}$f*}V9Zf0#M&{j8^7x}f-6;rDx%Pk@&jwuC%aF5)Z-OOD zyv?s#89w?)`11+(3*ms-JybmWEE=I)2%*5!r|exwH%>O&_ZB$HJ;_*NrqjTG7@OkJb%4b>P;5 z7(!E4*Z>#({Ta5n`w`49Jub9%4w?zeC`eu&;RD+= zd9l)9?u?{wQ3TvW5&cTq$;4ta{eR#VV8QWSXPojA5M(f#ZC>LPNSU+Y+|6jfiyK9u zC6uK*)sRS(d6m-CC%(ko_ zsAy#4hLZq^kK}DX;xUpyBg{U4UFcUPrubK}%#+Gm8S5@+7zN(?8L&;cz#CW_Z%S)sh^gfFG{ z5xkpSBuCBUY7H{FvvMdFijA8Mji_8)->j-BU=eLTwCB+U%`z%R{;T}rSgJSehIwr~ zb2;8g1(!)QP02mS9gXN+N&dOD)I;`g9i?7=ZhF)`h7_we(G^l;C}`~FArXV49;spo7&yfzHNkYb9LP@pyrvpTQ=?W(Uq75X* z?)w281Z>O>T}7~fGIVZSMV1MjY|n4xjKV_WvNQGedCEDQvb736!`PO;+hS&F1)ZxA zqVkmDhvvpB(e+0nezdPiWKGM$xD^7{IbI3L-Zi9BnGL(tk-0I1y?`Cynkp_QT#Wfa zWi|XX2Nx@nd_@1)B7ns9A{Y7A2^ZUNYmiY&U@`Ap+*3_x{(Cn{oO?5EfRg~ZZO3fU z&4AJ{4z~%f^oBDPJqSsB&g_)+eg6ebYPdKiGCwT^7fC)jiF<4PK%C;uxj%7Ma$A^} zvhJf7>|kDgD{@QaY)s8s?~Qr-9SC_R0VAG@8-5hvkN0N;0*$)Ci;{;3y2_HL(9sZX zXn62`SQzHsNlYuwSN+kdqD-ZU*lic}uMQwIe)>pnY z#Z>KfSD2G#w6LNm4qlMO&y9az;n{d7EQ)t!#Eyo*c|n8IL^Bcq!qYV*%oi)Z(kQhF zJihXN8)tg|ZK}rlM6c#ElNVNAr8UjhjZBs$5Z+j>$hl8~(R|rOGrjRxj(YAOzP10Y zG0R8t?RsJS^_Ik&An7eEASS&EtvPWQqkKtZA6+_g zi_o%|c%|&{)^3e4q|P?3yak#JM2y_+!{}}u+O0vb`poPPLf|kp0Iil(?M&xybX{vp zvN?b#lD3`Eg?>$0Gg2wgPkJL7P=DP1cVJnHl&}AS28ZtGAYIVaCv5uwP1yIU)iqw= z$~hF=f*423gVI`+H(=+|$c5A?O?|JjMtqQfVD@PPJM7I7ITo>$!o(crb~fq`d$D}Q z8|=sE%^Zsz=b~cI%drI-SzTVGm{tH<>D&Ipq~C0f=aWlIG}>~_rL*Zd&yfjcv-!Rg zo9UJ$mDG@EmJ~RVpa+XQqC#RG5FP7jGLXdHLVhLWeZiOFrC|;?nG4tQVA&5K#D(v} zsAyVVPVsIRL=|uDMUAt--l_BW{=(Yh3}#U8W68h;m&*x=N{^LT9qmlybpXucObQ>u z!U{!+S`Y|(-FXAD_=4+eu|eFI(qBrjVCWg}%r~BY6-DOGk|;~->+v)2=ixWQGF(3+ zI{kiZ!7nyPmKlhIW9)H32Ogf&7K*?6C~*A-Mf|CGsTKQ3qJzr%P8Nz;vHh+BmL~dg zbnIPn`b8~1nMW}E0#zi!P#DKuu_M>dnTQ-stW^VLiBR27RIo`e&1TKsdi+Ot{aj2( zjXW+3L9qAo2aE;HH0j~zrUY&}vF&Ez)j<=Eck6XxcX9_takV-QgkUW=pHC^&pC=RH z@_7@okKX-Z9&;kb;_hlk;n{j)3-tVb6+FsjvPS9!;lZA@G5E2Re@Z!FD1>xg*WyNY zRshXwupZt2Wm@9nroDW6O2W*AZm`FP_ddOUL_C9;ig0fA%@{8$8m~x(oV%IF6=g5K zvKo!-U6pbkyg&km;!PgQf6CKP57aBtgXa0}0-m;ctDgou3h-!QlfkYOCBrqU^>%@T zBqSPF5s9h2Cz1Je_oAv&@MrLkTfdfgj>GKaC z*CwdHXh#L<+fwA!dFqD$DA00S;z5)Ff>1TNUEMfaA|;H@u)JXt;AC=@81r0vA73vC zO4cwO%Z%*(p8eTEf92m<|IqP%uq$k6(`$D+1icKy)}HM&hVy#2NefyN}gB&4Ds0P+DS;6Krt$K$yaF?aW-o%9T zsMEt*%rA<5a(hG-I}pSsK>5^jEGvdJuQz0uBiX2itKnfy9CP2y^g_Z`_rZ=T2r@_? z2G7Tg>FcL%#e9O}m#m5n-UP9D8Et@ISO1igt$|2$RQQtktjq&zFO!V;hp;t6YoYbB zoZrpzOwxB=Y;IkToulLp9Cv5~uj5h_ms7|EHLq8dwv*@M$9GjaSL81)N~H-plehKu z>s1NRy`AppH#f@k5AR>t8A(`_zWv@nb4UK=&jpy#LaU~B9@}WjiW00)Sd_m}jvFMo z6rCR{sB1J|nA1#D0PWXTErZh_Q)@f^a#cVFT< zy)l$v(8zBWT)z{_D@%^zW`B@p;v2dFxlLh@>P?3+#x^C^JG+Tzy6)kE<5HxM9}TEI z2)tM=zf#xeauR=heWB~nZEd&*BXQyjYBdTZSg%X#elY(V;?Lu%`HXq z(Ag+XHgt`Jr$HRQ+G-K^bFqd-*HFU55m;smv7kL6M>?9=+3o!bLMzJam> z6n?$KizUt;`m-aP5*qVHS}uRZeCWA=h(JTDWJEN;b4xO?sH9Rv_Lp>uq>-$v#!^Y1 zqAG0u>NM_%+&Q2$96+Ynm*g*1PRtbNAWPAwjI~a=m?J~aAru)=sywO3jhKnSepR;J zE$Z>k@&3M|uhVWzHllb0*_!Tv!7jo;6@j9G77Wf$GsuB4yK*HMZ3A(fWpb5RkT^}u zHr1PGuKWzd8KuS+d4;7wT z0+mMQ72&Lpynn)?mK8g*8Zcxa$sJi77_n0BLmA$>Xgj|d4bR_QU?Rvz@cHkxsgn_U zO?_?WHZ}dDs{b`u+v5e3&x{3Me*musaFiOIph?EE$r}QK#&PVtuN*cHOa8y>8Ku9UjDovUCmbY zD5LVFeP{^7Kt3uG*f6Zyi(t%Tk`rsF5{9|erotS=YQml68Y zBn0JgmDL7(pcGpHq(R+?7*1J5_VGf(k!A)@D`oB04!SWpPAa6pd0IXCV3l95M1N`Q z+m7ppa}XE5A>K(WJ|1Liv_1c#Q)CJMW;@RQnuz{EVL_&%V2_U0PuI_hHbeX83pisc zUDPBw(=DbD@engHh=L_>a=e>3^UsJF4?po2kq1(rIGXUs#V610up(cS-9-wLqBCc_ z4I##U_4?Gkv;x6a{6950LHZY+Shna&u3Ht}7CP_i&9u{Y{o8rllJ`91zRK7wH3EtP zOyLsoB%}xRVOJZEyQ<{Bw?Pe;fg*3WR<8&M79?0$bM?poV`!)AQx$T%dqT{{=h@`t z0&DXMuTI_WU(!dc`{Tz)BA%p2i?a7K4A1J!-w z!LLYD5$B!1e4+Rra;}F~La6qynoXMkm>51a~n3 zgP~W{Oo>9J!IF|FXf;`_K^R5J!YZ@VG9jI_0h0>RmrbvdAImZ2E$wf$XqK*WlEgms z#c@tb8fKq`yNMv8$9GXsS4hJ=^2WnXy0w{1Km3}hQJ?5T5;JYK?H*jABwyFgC<{ym zaa$qgjVDQ;F9lBDICA^mu-WzBHKw}n4k5p)q^Qn!hG7H zcV-FhJDs{X*|b}f1bLOj5Vi$MZl}uV@`7lcbYtYRyd9}coWXbTo|B1`yEYpr zt}nJkBKG%!&&9$Zyd&Dux#c5%y@ef{CJrxmE}{GOfDtOjHGYW*pt9^3O9+bf<~sq( z4>kT=Ms$LOoDRgJ>19H1{e!ONU#%C3P3G#kAN}LBb@u*65@^ubhPfO$!d_)veSwy~ z<1sfUnI5dR*YSlX#@{zO{Kv#-M%(wWPKlIMcJo&gsJx{WMx^=6p(MeY88o=Dv4^q{ z<^7vp|5wr7+iEhc0hJ116c3+_A+Q0XPybMKwblD7;~0*8F`3FSFcR8VWG#5u&QW4K zL-;PtAJ_lbno_ekKb%RSUXD%YW(Z5?X-I)m7B1knRW~vgHfxoEFUB=*OdB?#7O9Au z+LWu-L8libeG(5QJx0Y6j*gRAr*ltPNB%F=pe%gPWEnJQqkzyg{o9G_mGFBmD5}fL z5q)Ot{d6Z~=iy1^KAKKKn#;8q88@hDzwvtRhUb{3@h4-76mvQvzc20@!%EtnIcL@V zSvK;nw3mvyUe52gv3-t)2(wKMqbu2jb(HDkiTYj6h>{HB*Zg0Sg&?exW1TV31eV|9Ed~dh8)_(cMCv?NDwS7UqGR=4TRD*howkc$G34YQpr<^JBo?X2 zbv84eh|bq{aIBlXcC>trTE(6H9dpw-lia+0<+yl!4eguqTqQkK*o3+8Isi0blFlNL%PL{2}p!*ka! zr0-+Voa>1Ur4~v}Pf<7)SnErxv2)J~t+18MN>|P3waK(u-&5IguI55_6PZKhA!urE zLGr9fyA)=fV-W1{I9*biFEJv1UnSU=)wqEqAEmfR%|uPhXXmVSF)V@+Z<(=fe~A@y zg%!XrCWJcSs)F%Q(=;~k*4oG{b4>u?mWm{?c&oY}z9{Iv8*L(@JW5kLyMi>yfOjxR zKWQ0tpk32s18tgEK?Uc!7)_Rlmb^p6&8``wj)oi_+o&OeHf+gx{t!c?8V7HBHOt2} zCEK`88Z-w9l53D=l1WN1FaUyB zpB5p$Tt65IL2ZY&u1UA6R;UoQw4e576Ai_fW>&edYIk|Qb8~Z*t0S^~Rdy=~bAw#E zWxrk|W_z8`IbjI$tVCt9Nm7* zzuXH?_^AURxUsej8?o%ZuYfqphrbBq$qeJPx0(L5-CB(awAG<45<=IZ3mhknN)4&_ zYA|B{O0*m$bBQ0-nPw1$+fg||q8o}L!aryi+f&YJM?fM$9;^X;uMv82S%}m3+KS$M zxsdYFgNPb1Wd1%kuBuWQHV`^$jg(z*_yXI(>9|-1Y3FHej^Rlw;69lqd$0Blfu2Nf zLO=)3s?|OPVTou-$LmA=s2fJ}vPx!q)j#P6ag8DHOc*@?a1-X=WiVV1qj^taa^poAas_eAH-I~@w3Dn*z-mX;uh6K zjTIe`yI;){j_F9YQoVj+UH;xOun)O-v=z8r&!m{?I zw3{mw{>fUs&!*IN$2tEHwdBrmnMXm_ukc+njq9Z?dJjl% zU898HT+{M`hLo>~zQq6z8kE7+EPQ*vR=JRfbtn9&ayU!zG4O^-auB~HJ*y=t%w%rt z9Ybl~&vwi>$NPUmAVEnjDx%3DuFaI4u&|7l@O}sN%7h(2%5?cyjKENY5}O_ zP0rk3#ROR4+&zovG2cQgyWTFCbec#ZlSk`$xtXxAXz(yVI&&)*eIqK$q-0bn2NN(n zh^PKAc-Q;sW&P9UdySnuV~xs+-}!aG)q6}RDi}f9w)P?-go0E$ziB@X!7~RwE-;xp&!_o+;7fZ7e6EkB~xX&do zJS~pW(_+B~%`(N$A**6mk+H|lJTO{rwDMgj&=WOOqd|F{$dm{*23^P)R;7PB{i(bz z!r|Q*l6PDiUcQUD0)Ygrl$iG^x-GcE|ITZeLI^+17_RF8KV6YcjIosp9U3>nU)^Og0K3lB$Jv1Hg;;t*Cn z&XSBexPVlP5O3?e(-1l6o zNTQ&WFvUvBK>7*-GzBfQ5bx#EbL~w6R-#z%jmBLVYculr30XY;1p9(01Q`j}J-R?W zcxZsDT%9I!u;-s}<90V>&sRr$Kj)D zXK6JVv_h-6%u|&N-o$NU^t_;Pa}uDz5S74#SM&~hlU->$Z5aI;gnlj}Bwj+aHq8ys zp_ot!k8R3gXoJCY zE)cadiq^{(>B#^&I)pHqh8|^HS84PZ%-$YL-hdy<1@fDkYb9KKk%veBlgTt(2_T}V zz9Dsg5{6T=sp!IuXa9wDBwkU*UkfK~g9GA0qyg%9uuzR&0iya+wyEXDAC`}vVdi%- zQyeR3;#SW*wm7F@U#Fo_kN*TJKkb;PYALMdLbdDqVEM6fcA6iPV2A=KgPjU`(?BSv zwjYyTk&m4gU7kF)r|COUw^j*K+gWr$bjt&*qF;wwZAcUZpV4WN0T(ZvoiZ7thS{9f zueezK#?%KyM3mex4_UZPQ4u9sLPNuMVlIZ&R2vnsb~hjykc7kZk$z_G+`;Q8#i>2ZQD*V;Y1A>1jLt*Sr4Jm21F-DPmc z6As8;SQ2QJyN3%$ZfLM~zv0!YKFK*$iZA^X-`9714+f2Kp$J8utnqg}eT!{CX9XVM zhTRS)g82%Y4GdQNNUpp2x!Hvse4IW%bw-0|gQ+$Ah<-!@Ufm?9iIZBS>Cttfc&CLl z*5QX=nO&)N=Kw!R{mc2tSk_@Wh5KU8;( zqFOksIsz&8h^#Jwtb-y*dXSnk4=a6oT7B==%(qfw|MJ2H#BFtOE}oW!L#*PjoVo$1 z^Yf;uJhsUDIi`g@ppApU6dRkPbix^O{LFRPusqx0s4n>nso|%&48edzbjk9Raj4e2 zq5{{(c3GC6HHji#;n-TAJI']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: array + items: + description: |- + PipelineResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of resource + fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + serviceAccountName: + description: ServiceAccountName + type: string + status: + description: Status + type: string + taskRunSpecs: + description: TaskRunSpecs + type: array + items: + description: PipelineTaskRunSpec + type: object + properties: + computeResources: + description: ComputeResources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + metadata: + description: Metadata + type: object + properties: + annotations: + description: Annotations + type: object + additionalProperties: + type: string + labels: + description: Labels + type: object + additionalProperties: + type: string + pipelineTaskName: + type: string + sidecarOverrides: + description: SidecarOverrides + type: array + items: + description: TaskRunSidecarOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + stepOverrides: + description: StepOverrides + type: array + items: + description: TaskRunStepOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + taskPodTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be + provided to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may + use the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to + be used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how + to spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + taskServiceAccountName: + type: string + timeout: + description: Timeout + type: string + x-kubernetes-list-type: atomic + timeout: + description: |- + Deprecated: use pipelineRunSpec.Timeouts.Pipeline instead + Timeout + type: string + timeouts: + description: Timeouts + type: object + properties: + finally: + description: Finally + type: string + pipeline: + description: Pipeline + type: string + tasks: + description: Tasks + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceBinding + type: object + required: + - name + properties: + configMap: + description: ConfigMap + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: EmptyDir + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name + type: string + persistentVolumeClaim: + description: PersistentVolumeClaim + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: SubPath + type: string + volumeClaimTemplate: + description: VolumeClaimTemplate + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: Status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + childReferences: + description: ChildReferences + type: array + items: + description: ChildStatusReference + type: object + properties: + apiVersion: + type: string + displayName: + description: DisplayName + type: string + kind: + type: string + name: + description: Name + type: string + pipelineTaskName: + description: PipelineTaskName + type: string + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + finallyStartTime: + description: FinallyStartTime + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + pipelineResults: + description: PipelineResults + type: array + items: + description: PipelineRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineSpec: + description: PipelineSpec + x-kubernetes-preserve-unknown-fields: true + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + runs: + description: Runs + type: object + additionalProperties: + description: PipelineRunRunStatus + type: object + properties: + pipelineTaskName: + description: PipelineTaskName + type: string + status: + description: Status + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + completionTime: + description: CompletionTime is the time the build completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations + of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating + details about the transition. + type: string + reason: + description: The reason for the condition's last + transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, + False, Unknown. + type: string + type: + description: Type of condition. + type: string + extraFields: + description: |- + ExtraFields holds arbitrary fields provided by the custom task + controller. + x-kubernetes-preserve-unknown-fields: true + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + results: + description: |- + Results reports any output result values to be consumed by later + tasks in a pipeline. + type: array + items: + description: CustomRunResult used to describe the results + of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + value: + description: Value the given value of the result + type: string + retriesStatus: + description: |- + RetriesStatus contains the history of CustomRunStatus, in case of a retry. + See CustomRun.status (API version: tekton.dev/v1beta1) + x-kubernetes-preserve-unknown-fields: true + startTime: + description: StartTime is the time the build is actually + started. + type: string + format: date-time + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + skippedTasks: + description: SkippedTasks + type: array + items: + description: SkippedTask + type: object + required: + - name + - reason + properties: + name: + description: Name + type: string + reason: + description: Reason + type: string + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + taskRuns: + description: TaskRuns + type: object + additionalProperties: + description: PipelineRunTaskRunStatus + type: object + properties: + pipelineTaskName: + description: PipelineTaskName + type: string + status: + description: Status + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + cloudEvents: + description: CloudEvents + type: array + items: + description: CloudEventDelivery + type: object + properties: + status: + description: CloudEventDeliveryState + type: object + required: + - message + - retryCount + properties: + condition: + description: Condition + type: string + message: + description: Error + type: string + retryCount: + description: RetryCount + type: integer + format: int32 + sentAt: + description: SentAt + type: string + format: date-time + target: + description: Target + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations + of a resource's current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating + details about the transition. + type: string + reason: + description: The reason for the condition's last + transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, + False, Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag + since StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + resourcesResult: + description: |- + ResourcesResult + Deprecated: this field is not populated and is preserved only for backwards compatibility + type: array + items: + description: |- + RunResult is used to write key/value pairs to TaskRun pod termination messages. + The key/value pairs may come from the entrypoint binary, or represent a TaskRunResult. + If they represent a TaskRunResult, the key is the name of the result and the value is the + JSON-serialized value of the result. + type: object + required: + - key + - value + properties: + key: + type: string + resourceName: + description: |- + ResourceName may be used in tests, but it is not populated in termination messages. + It is preserved here for backwards compatibility and will not be ported to v1. + type: string + type: + description: |- + ResultType used to find out whether a RunResult is from a task result or not + Note that ResultsType is another type which is used to define the data type + (e.g. string, array, etc) we used for Results + type: integer + value: + type: string + x-kubernetes-list-type: atomic + retriesStatus: + description: RetriesStatus + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: Sidecars + type: array + items: + description: SidecarState + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was + last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination + of the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last + terminated + type: string + format: date-time + message: + description: Message regarding the last termination + of the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination + of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution + of the container started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container + is not yet running. + type: string + reason: + description: (brief) reason the container is + not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + steps: + description: Steps + type: array + items: + description: StepState + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op + flag since StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + results: + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was + last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination + of the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last + terminated + type: string + format: date-time + message: + description: Message regarding the last termination + of the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination + of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution + of the container started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container + is not yet running. + type: string + reason: + description: (brief) reason the container is + not yet running. + type: string + x-kubernetes-list-type: atomic + taskResults: + description: TaskRunResults + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + whenExpressions: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + PipelineRun represents a single execution of a Pipeline. PipelineRuns are how + the graph of Tasks declared in a Pipeline are executed; they specify inputs + to Pipelines such as parameter values and capture operational aspects of the + Tasks execution such as service account and tolerations. Creating a + PipelineRun creates TaskRuns for Tasks in the referenced Pipeline. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: PipelineRunSpec defines the desired state of PipelineRun + type: object + properties: + managedBy: + description: |- + ManagedBy indicates which controller is responsible for reconciling + this resource. If unset or set to "tekton.dev/pipeline", the default + Tekton controller will manage this resource. + This field is immutable. + type: string + params: + description: Params is a list of parameter names and values. + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + pipelineRef: + description: PipelineRef can be used to refer to a specific instance + of a Pipeline. + type: object + properties: + apiVersion: + description: API version of the referent + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + pipelineSpec: + description: |- + Specifying PipelineSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + status: + description: Used for cancelling a pipelinerun (and maybe more later + on) + type: string + taskRunSpecs: + description: TaskRunSpecs holds a set of runtime specs + type: array + items: + description: |- + PipelineTaskRunSpec can be used to configure specific + specs for a concrete Task + type: object + properties: + computeResources: + description: Compute resources to use for this TaskRun + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + metadata: + description: PipelineTaskMetadata contains the labels or annotations + for an EmbeddedTask + type: object + properties: + annotations: + type: object + additionalProperties: + type: string + labels: + type: object + additionalProperties: + type: string + pipelineTaskName: + type: string + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be + provided to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may + use the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to + be used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how + to spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + type: string + sidecarSpecs: + type: array + items: + description: TaskRunSidecarSpec is used to override the + values of a Sidecar in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the + Sidecar. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Sidecar to override. + type: string + x-kubernetes-list-type: atomic + stepSpecs: + type: array + items: + description: TaskRunStepSpec is used to override the values + of a Step in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the + Step. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Step to override. + type: string + x-kubernetes-list-type: atomic + timeout: + description: |- + Duration after which the TaskRun times out. Overrides the timeout specified + on the Task's spec if specified. Takes lower precedence to PipelineRun's + `spec.timeouts.tasks` + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + x-kubernetes-list-type: atomic + taskRunTemplate: + description: TaskRunTemplate represent template of taskrun + type: object + properties: + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver + options of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's + value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use + the node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret + used by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be + used to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to + spread matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + type: string + timeouts: + description: |- + Time after which the Pipeline times out. + Currently three keys are accepted in the map + pipeline, tasks and finally + with Timeouts.pipeline >= Timeouts.tasks + Timeouts.finally + type: object + properties: + finally: + description: Finally sets the maximum allowed duration of this + pipeline's finally + type: string + pipeline: + description: Pipeline sets the maximum allowed duration for + execution of the entire pipeline. The sum of individual timeouts + for tasks and finally must not exceed this value. + type: string + tasks: + description: Tasks sets the maximum allowed duration of this + pipeline's tasks + type: string + workspaces: + description: |- + Workspaces holds a set of workspace bindings that must match names + with those declared in the pipeline. + type: array + items: + description: WorkspaceBinding maps a Task's declared workspace + to a Volume. + type: object + required: + - name + properties: + configMap: + description: ConfigMap represents a configMap that should + populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers. + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: |- + EmptyDir represents a temporary directory that shares a Task's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + Either this OR PersistentVolumeClaim can be used. + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name is the name of the workspace populated by + the volume. + type: string + persistentVolumeClaim: + description: |- + PersistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used. + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected represents a projected volume that + should populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret represents a secret that should populate + this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + volumeClaimTemplate: + description: |- + VolumeClaimTemplate is a template for a claim that will be created in the same namespace. + The PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun. + See PersistentVolumeClaim (API version: v1) + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: PipelineRunStatus defines the observed state of PipelineRun + type: object + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + childReferences: + description: list of TaskRun and Run names, PipelineTask names, + and API versions/kinds for children of this PipelineRun. + type: array + items: + description: ChildStatusReference is used to point to the statuses + of individual TaskRuns and Runs within this PipelineRun. + type: object + properties: + apiVersion: + type: string + displayName: + description: |- + DisplayName is a user-facing name of the pipelineTask that may be + used to populate a UI. + type: string + kind: + type: string + name: + description: Name is the name of the TaskRun or Run this is + referencing. + type: string + pipelineTaskName: + description: PipelineTaskName is the name of the PipelineTask + this is referencing. + type: string + whenExpressions: + description: WhenExpressions is the list of checks guarding + the execution of the PipelineTask + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime is the time the PipelineRun completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + finallyStartTime: + description: FinallyStartTime is when all non-finally tasks have + been completed and only finally tasks are being executed. + type: string + format: date-time + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + pipelineSpec: + description: |- + PipelineSpec contains the exact spec used to instantiate the run. + See Pipeline.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + provenance: + description: Provenance contains some key authenticated metadata + about how a software artifact was built (what sources, what inputs/outputs, + etc.). + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags that + were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + description: Results are the list of results written out by the + pipeline task's containers + type: array + items: + description: PipelineRunResult used to describe the results of + a pipeline + type: object + required: + - name + - value + properties: + name: + description: Name is the result's name as declared by the + Pipeline + type: string + value: + description: Value is the result returned from the execution + of this PipelineRun + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + skippedTasks: + description: list of tasks that were skipped due to when expressions + evaluating to false + type: array + items: + description: |- + SkippedTask is used to describe the Tasks that were skipped due to their When Expressions + evaluating to False. This is a struct because we are looking into including more details + about the When Expressions that caused this Task to be skipped. + type: object + required: + - name + - reason + properties: + name: + description: Name is the Pipeline Task name + type: string + reason: + description: Reason is the cause of the PipelineTask being + skipped. + type: string + whenExpressions: + description: WhenExpressions is the list of checks guarding + the execution of the PipelineTask + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext contains tracing span context fields + type: object + additionalProperties: + type: string + startTime: + description: StartTime is the time the PipelineRun is actually started. + type: string + format: date-time + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: PipelineRun + plural: pipelineruns + singular: pipelinerun + categories: + - tekton + - tekton-pipelines + shortNames: + - pr + - prs + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: resolutionrequests.resolution.tekton.dev + labels: + resolution.tekton.dev/release: devel +spec: + group: resolution.tekton.dev + scope: Namespaced + names: + kind: ResolutionRequest + plural: resolutionrequests + singular: resolutionrequest + categories: + - tekton + - tekton-pipelines + versions: + - name: v1alpha1 + served: true + deprecated: true + storage: false + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ResolutionRequest is an object for requesting the content of + a Tekton resource like a pipeline.yaml. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the information for the request part of the + resource request. + type: object + properties: + params: + description: |- + Parameters are the runtime attributes passed to + the resolver to help it figure out how to resolve the + resource being requested. For example: repo URL, commit SHA, + path to file, the kind of authentication to leverage, etc. + type: object + additionalProperties: + type: string + status: + description: |- + Status communicates the state of the request and, ultimately, + the content of the resolved resource. + type: object + required: + - data + - refSource + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + data: + description: |- + Data is a string representation of the resolved content + of the requested resource in-lined into the ResolutionRequest + object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + refSource: + description: |- + RefSource is the source reference of the remote data that records where the remote + file came from including the url, digest and the entrypoint. + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].reason" + - name: v1beta1 + served: true + storage: true + subresources: + status: {} + schema: + openAPIV3Schema: + description: |- + ResolutionRequest is an object for requesting the content of + a Tekton resource like a pipeline.yaml. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the information for the request part of the + resource request. + type: object + properties: + params: + description: |- + Parameters are the runtime attributes passed to + the resolver to help it figure out how to resolve the + resource being requested. For example: repo URL, commit SHA, + path to file, the kind of authentication to leverage, etc. + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + url: + description: |- + URL is the runtime url passed to the resolver + to help it figure out how to resolver the resource being + requested. + This is currently at an ALPHA stability level and subject to + alpha API compatibility policies. + type: string + status: + description: |- + Status communicates the state of the request and, ultimately, + the content of the resolved resource. + type: object + required: + - data + - refSource + - source + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + data: + description: |- + Data is a string representation of the resolved content + of the requested resource in-lined into the ResolutionRequest + object. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + refSource: + description: |- + RefSource is the source reference of the remote data that records the url, digest + and the entrypoint. + x-kubernetes-preserve-unknown-fields: true + source: + description: 'Deprecated: Use RefSource instead' + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: OwnerKind + type: string + jsonPath: ".metadata.ownerReferences[0].kind" + - name: Owner + type: string + jsonPath: ".metadata.ownerReferences[0].name" + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type=='Succeeded')].reason" + - name: StartTime + type: string + jsonPath: .metadata.creationTimestamp + - name: EndTime + type: string + jsonPath: .status.conditions[?(@.type=='Succeeded')].lastTransitionTime + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1alpha1", "v1beta1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: stepactions.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.1" + version: "v1.15.1" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1alpha1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + StepAction represents the actionable components of Step. + The Step can only reference it from the cluster or using remote resolution. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Step from the client + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + description: + description: |- + Description is a user-facing description of the stepaction that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the container. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name to run for this StepAction. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + params: + description: |- + Params is a list of input parameters required to run the stepAction. + Params must be supplied as inputs in Steps unless they declare a defaultvalue. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this StepAction can output + type: array + items: + description: StepResult used to describe the Results of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', and + 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + The value set in StepAction will take precedence over the value from Task. + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to + the container. + type: string + role: + description: Role is a SELinux role label that applies to + the container. + type: string + type: + description: Type is a SELinux type label that applies to + the container. + type: string + user: + description: User is a SELinux user label that applies to + the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume within + a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1beta1 + served: true + storage: true + schema: + openAPIV3Schema: + description: StepAction + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + description: + description: Description + type: string + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + params: + description: Params + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results + type: array + items: + description: StepResult used to describe the Results of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', and + 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies to + the container. + type: string + role: + description: Role is a SELinux role label that applies to + the container. + type: string + type: + description: Type is a SELinux type label that applies to + the container. + type: string + user: + description: User is a SELinux user label that applies to + the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the GMSA + credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume within + a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: StepAction + plural: stepactions + singular: stepaction + categories: + - tekton + - tekton-pipelines + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1alpha1", "v1beta1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tasks.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.1" + version: "v1.15.1" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + Task + Deprecated: Please use v1.Task instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + description: + description: Description + type: string + displayName: + description: DisplayName + type: string + params: + description: Params + type: array + items: + description: ParamSpec + type: object + required: + - name + properties: + default: + description: Default + x-kubernetes-preserve-unknown-fields: true + description: + description: Description + type: string + enum: + description: Enum + type: array + items: + type: string + name: + description: Name + type: string + properties: + description: Properties + type: object + additionalProperties: + description: PropertySpec + type: object + properties: + type: + description: ParamType + type: string + type: + description: Type + type: string + x-kubernetes-list-type: atomic + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + TaskResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - type + properties: + description: + description: |- + Description is a user-facing description of the declared resource that may be + used to populate a UI. + type: string + name: + description: |- + Name declares the name by which a resource is referenced in the + definition. Resources may be referenced by name in the definition of a + Task's steps. + type: string + optional: + description: |- + Optional declares the resource as optional. + By default optional is set to false which makes a resource required. + optional: true - the resource is considered optional + optional: false - the resource is considered required (equivalent of not specifying it) + type: boolean + targetPath: + description: |- + TargetPath is the path in workspace directory where the resource + will be copied. + type: string + type: + description: Type is the type of this resource; + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + TaskResource + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - type + properties: + description: + description: |- + Description is a user-facing description of the declared resource that may be + used to populate a UI. + type: string + name: + description: |- + Name declares the name by which a resource is referenced in the + definition. Resources may be referenced by name in the definition of a + Task's steps. + type: string + optional: + description: |- + Optional declares the resource as optional. + By default optional is set to false which makes a resource required. + optional: true - the resource is considered optional + optional: false - the resource is considered required (equivalent of not specifying it) + type: boolean + targetPath: + description: |- + TargetPath is the path in workspace directory where the resource + will be copied. + type: string + type: + description: Type is the type of this resource; + type: string + x-kubernetes-list-type: atomic + results: + description: Results + type: array + items: + description: TaskResult + type: object + required: + - name + properties: + description: + description: Description + type: string + name: + description: Name + type: string + properties: + description: Properties + type: object + additionalProperties: + description: PropertySpec + type: object + properties: + type: + description: ParamType + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: Sidecars + type: array + items: + description: Sidecar + type: object + required: + - name + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: Lifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: LivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: Name + type: string + ports: + description: Ports + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: ReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + restartPolicy: + description: RestartPolicy + type: string + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: StartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: Stdin + type: boolean + stdinOnce: + description: StdinOnce + type: boolean + terminationMessagePath: + description: TerminationMessagePath + type: string + terminationMessagePolicy: + description: TerminationMessagePolicy + type: string + tty: + description: TTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceUsage + type: object + required: + - mountPath + - name + properties: + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: StepTemplate + type: object + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the container + should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds to + sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the container + should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds to + sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedName + type: string + ports: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedPorts + type: array + items: + description: ContainerPort represents a network port in a + single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. HTTP + allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdin + type: boolean + stdinOnce: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdinOnce + type: boolean + terminationMessagePath: + description: |- + DeprecatedTerminationMessagePath + Deprecated: This field will be removed in a future release and cannot be meaningfully used. + type: string + terminationMessagePolicy: + description: |- + DeprecatedTerminationMessagePolicy + Deprecated: This field will be removed in a future release and cannot be meaningfully used. + type: string + tty: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedTTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + steps: + description: Steps + type: array + items: + description: Step + type: object + required: + - name + properties: + args: + description: Args + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: Command + type: array + items: + type: string + x-kubernetes-list-type: atomic + displayName: + description: DisplayName + type: string + env: + description: Env + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: EnvFrom + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: Image + type: string + imagePullPolicy: + description: ImagePullPolicy + type: string + lifecycle: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLifecycle + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedLivenessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: Name + type: string + onError: + description: OnError + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ports: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedPorts + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedReadinessProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + ref: + description: Ref + type: object + properties: + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + results: + description: Results + type: array + items: + description: StepResult used to describe the Results of + a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: Script + type: string + securityContext: + description: SecurityContext + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStartupProbe + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stderrConfig: + description: StderrConfig + type: object + properties: + path: + description: Path + type: string + stdin: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdin + type: boolean + stdinOnce: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedStdinOnce + type: boolean + stdoutConfig: + description: StdoutConfig + type: object + properties: + path: + description: Path + type: string + terminationMessagePath: + description: |- + DeprecatedTerminationMessagePath + Deprecated: This field will be removed in a future release and can't be meaningfully used. + type: string + terminationMessagePolicy: + description: |- + DeprecatedTerminationMessagePolicy + Deprecated: This field will be removed in a future release and can't be meaningfully used. + type: string + timeout: + description: Timeout + type: string + tty: + description: |- + Deprecated: This field will be removed in a future release. + DeprecatedTTY + type: boolean + volumeDevices: + description: VolumeDevices + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: VolumeMounts + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: WhenExpressions + type: array + items: + description: WhenExpression + type: object + properties: + cel: + description: CEL + type: string + input: + description: Input + type: string + operator: + description: Operator + type: string + values: + description: Values + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: WorkingDir + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceUsage + type: object + required: + - mountPath + - name + properties: + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: Volumes + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceDeclaration + type: object + required: + - name + properties: + description: + description: Description + type: string + mountPath: + description: MountPath + type: string + name: + description: Name + type: string + optional: + description: Optional + type: boolean + readOnly: + description: ReadOnly + type: boolean + x-kubernetes-list-type: atomic + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + Task represents a collection of sequential steps that are run as part of a + Pipeline using a set of inputs and producing a set of outputs. Tasks execute + when TaskRuns are created that provide the input parameters and resources and + output resources the Task requires. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the Task from the client + type: object + properties: + description: + description: |- + Description is a user-facing description of the task that may be + used to populate a UI. + type: string + displayName: + description: |- + DisplayName is a user-facing name of the task that may be + used to populate a UI. + type: string + params: + description: |- + Params is a list of input parameters required to run the task. Params + must be supplied as inputs in TaskRuns unless they declare a default + value. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter is + referenced. + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this Task can output + type: array + items: + description: TaskResult used to describe the results of a task + type: object + required: + - name + properties: + description: + description: Description is a human-readable description of + the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties to support + key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the expression used to retrieve the value + of the result from an underlying Step. + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: |- + Sidecars are run alongside the Task's step containers. They begin before + the steps start and end after the steps complete. + type: array + items: + description: Sidecar has nearly the same data structure as Step + but does not have the ability to timeout. + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Sidecar. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Sidecar. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Sidecar. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + lifecycle: + description: |- + Actions that the management system should take in response to Sidecar lifecycle events. + Cannot be updated. + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that the + container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Periodic probe of Sidecar liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the Sidecar specified as a DNS_LABEL. + Each Sidecar in a Task must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the Sidecar. Exposing a port here gives + the system additional information about the network connections a + container uses, but is primarily informational. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port in + a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Periodic probe of Sidecar service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + restartPolicy: + description: |- + RestartPolicy refers to kubernetes RestartPolicy. It can only be set for an + initContainer and must have it's policy set to "Always". It is currently + left optional to help support Kubernetes versions prior to 1.29 when this feature + was introduced. + type: string + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command or Args. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Sidecar should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod the Sidecar is running in has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in the + container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. Number + must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request to + perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a TCP + port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, defaults + to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Whether this Sidecar should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the Sidecar will always result in EOF. + Default is false. + type: boolean + stdinOnce: + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on Sidecar start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the Sidecar is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false + type: boolean + terminationMessagePath: + description: |- + Optional: Path at which the file to which the Sidecar's termination message + will be written is mounted into the Sidecar's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the Sidecar status message on both success and failure. + FallbackToLogsOnError will use the last chunk of Sidecar log output if the termination + message file is empty and the Sidecar exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + tty: + description: |- + Whether this Sidecar should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices to + be used by the Sidecar. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Sidecar's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Sidecar's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Sidecar wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: |- + StepTemplate can be used as the basis for all step containers within the + Task, so that the steps inherit settings on the base container. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must be + defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeDevices: + description: volumeDevices is the list of block devices to be + used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + steps: + description: |- + Steps are the steps of the build; each step is run sequentially with the + source mounted into /workspace. + type: array + items: + description: Step runs a subcomponent of a Task + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + displayName: + description: |- + DisplayName is a user-facing name of the step that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a set + of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Docker image name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + name: + description: |- + Name of the Step specified as a DNS_LABEL. + Each Step in a Task must have a unique name. + type: string + onError: + description: |- + OnError defines the exiting behavior of a container on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Params declares parameters passed to this step + action. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ref: + description: Contains the reference to an existing StepAction. + type: object + properties: + name: + description: Name of the referenced step + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + results: + description: |- + Results declares StepResults produced by the Step. + + It can be used in an inlined Step when used to store Results to $(step.results.resultName.path). + It cannot be used when referencing StepActions using [v1.Step.Ref]. + The Results declared by the StepActions will be stored here instead. + type: array + items: + description: StepResult used to describe the Results of + a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of + the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + stderrConfig: + description: Stores configuration for the stderr stream of + the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on container's + local filesystem. + type: string + stdoutConfig: + description: Stores configuration for the stdout stream of + the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on container's + local filesystem. + type: string + timeout: + description: |- + Timeout is the time after which the step times out. Defaults to never. + Refer to Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + volumeDevices: + description: volumeDevices is the list of block devices to + be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw block + device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the container + that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from a parent + Task + type: string + operator: + description: Operator that represents an Input's relationship + to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Step wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: |- + Volumes is a collection of volumes that are available to mount into the + steps of the build. + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces are the volumes that this Task requires. + type: array + items: + description: WorkspaceDeclaration is a declaration of a volume + that a Task requires. + type: object + required: + - name + properties: + description: + description: Description is an optional human readable description + of this volume. + type: string + mountPath: + description: MountPath overrides the directory that the volume + will be made available at. + type: string + name: + description: Name is the name by which you can bind the volume + at runtime. + type: string + optional: + description: |- + Optional marks a Workspace as not being required in TaskRuns. By default + this field is false and so declared workspaces are required. + type: boolean + readOnly: + description: |- + ReadOnly dictates whether a mounted volume is writable. By default this + field is false and so mounted volumes are writable. + type: boolean + x-kubernetes-list-type: atomic + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: Task + plural: tasks + singular: task + categories: + - tekton + - tekton-pipelines + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: taskruns.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.1" + version: "v1.15.1" +spec: + group: tekton.dev + preserveUnknownFields: false + versions: + - name: v1beta1 + served: true + storage: false + schema: + openAPIV3Schema: + description: |- + TaskRun + Deprecated: Please use v1.TaskRun instead. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec + type: object + properties: + computeResources: + description: ComputeResources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + debug: + description: Debug + type: object + properties: + breakpoints: + description: Breakpoints + type: object + properties: + beforeSteps: + description: BeforeSteps + type: array + items: + type: string + x-kubernetes-list-type: atomic + onFailure: + description: OnFailure + type: string + managedBy: + description: ManagedBy + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + podTemplate: + description: PodTemplate + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + resources: + description: |- + Resources + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + inputs: + description: Inputs + type: array + items: + description: |- + TaskResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + paths: + description: Paths + type: array + items: + type: string + x-kubernetes-list-type: atomic + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of + resource fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + outputs: + description: Outputs + type: array + items: + description: |- + TaskResourceBinding + Deprecated: Unused, preserved only for backwards compatibility + type: object + properties: + name: + description: Name + type: string + paths: + description: Paths + type: array + items: + type: string + x-kubernetes-list-type: atomic + resourceRef: + description: ResourceRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + name: + description: Name + type: string + resourceSpec: + description: ResourceSpec + type: object + required: + - params + - type + properties: + description: + description: |- + Description is a user-facing description of the resource that may be + used to populate a UI. + type: string + params: + type: array + items: + description: |- + ResourceParam declares a string value to use for the parameter called Name, and is used in + the specific context of PipelineResources. + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - name + - value + properties: + name: + type: string + value: + type: string + x-kubernetes-list-type: atomic + secrets: + description: Secrets to fetch to populate some of + resource fields + type: array + items: + description: |- + SecretParam indicates which secret can be used to populate a field of the resource + + Deprecated: Unused, preserved only for backwards compatibility + type: object + required: + - fieldName + - secretKey + - secretName + properties: + fieldName: + type: string + secretKey: + type: string + secretName: + type: string + x-kubernetes-list-type: atomic + type: + description: |- + PipelineResourceType represents the type of endpoint the pipelineResource is, so that the + controller will know this pipelineResource shouldx be fetched and optionally what + additional metatdata should be provided for it. + + Deprecated: Unused, preserved only for backwards compatibility + type: string + x-kubernetes-list-type: atomic + retries: + description: Retries + type: integer + serviceAccountName: + description: ServiceAccountName + type: string + sidecarOverrides: + description: SidecarOverrides + type: array + items: + description: TaskRunSidecarOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + status: + description: Status + type: string + statusMessage: + description: StatusMessage + type: string + stepOverrides: + description: StepOverrides + type: array + items: + description: TaskRunStepOverride + type: object + required: + - name + - resources + properties: + name: + description: Name + type: string + resources: + description: Resources + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + x-kubernetes-list-type: atomic + taskRef: + description: TaskRef + type: object + properties: + apiVersion: + description: APIVersion + type: string + bundle: + description: |- + Deprecated: Please use ResolverRef with the bundles resolver instead. + Bundle + type: string + kind: + description: Kind + type: string + name: + description: Name + type: string + params: + description: Params + type: array + items: + description: Param + type: object + required: + - name + - value + properties: + name: + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: Resolver + type: string + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + timeout: + description: Timeout + type: string + workspaces: + description: Workspaces + type: array + items: + description: WorkspaceBinding + type: object + required: + - name + properties: + configMap: + description: ConfigMap + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: EmptyDir + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name + type: string + persistentVolumeClaim: + description: PersistentVolumeClaim + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: SubPath + type: string + volumeClaimTemplate: + description: VolumeClaimTemplate + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: Status + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + cloudEvents: + description: CloudEvents + type: array + items: + description: CloudEventDelivery + type: object + properties: + status: + description: CloudEventDeliveryState + type: object + required: + - message + - retryCount + properties: + condition: + description: Condition + type: string + message: + description: Error + type: string + retryCount: + description: RetryCount + type: integer + format: int32 + sentAt: + description: SentAt + type: string + format: date-time + target: + description: Target + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + resourcesResult: + description: |- + ResourcesResult + Deprecated: this field is not populated and is preserved only for backwards compatibility + type: array + items: + description: |- + RunResult is used to write key/value pairs to TaskRun pod termination messages. + The key/value pairs may come from the entrypoint binary, or represent a TaskRunResult. + If they represent a TaskRunResult, the key is the name of the result and the value is the + JSON-serialized value of the result. + type: object + required: + - key + - value + properties: + key: + type: string + resourceName: + description: |- + ResourceName may be used in tests, but it is not populated in termination messages. + It is preserved here for backwards compatibility and will not be ported to v1. + type: string + type: + description: |- + ResultType used to find out whether a RunResult is from a task result or not + Note that ResultsType is another type which is used to define the data type + (e.g. string, array, etc) we used for Results + type: integer + value: + type: string + x-kubernetes-list-type: atomic + retriesStatus: + description: RetriesStatus + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: Sidecars + type: array + items: + description: SidecarState + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext + type: object + additionalProperties: + type: string + startTime: + description: StartTime + type: string + format: date-time + steps: + description: Steps + type: array + items: + description: StepState + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: Artifact + type: object + properties: + buildOutput: + description: BuildOutput + type: boolean + name: + description: Name + type: string + values: + description: Values + type: array + items: + description: ArtifactValue + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: Provenance + type: object + properties: + configSource: + description: |- + ConfigSource + Deprecated: Use RefSource instead + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + featureFlags: + description: FeatureFlags + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since + StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource + type: object + properties: + digest: + description: Digest + type: object + additionalProperties: + type: string + entryPoint: + description: EntryPoint + type: string + uri: + description: URI + type: string + results: + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + taskResults: + description: TaskRunResults + type: array + items: + description: TaskRunResult + type: object + required: + - name + - value + properties: + name: + description: Name + type: string + type: + description: Type + type: string + value: + description: Value + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec + x-kubernetes-preserve-unknown-fields: true + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + TaskRun represents a single execution of a Task. TaskRuns are how the steps + specified in a Task are executed; they specify the parameters and resources + used to run the steps in a Task. + type: object + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TaskRunSpec defines the desired state of TaskRun + type: object + properties: + computeResources: + description: Compute resources to use for this TaskRun + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + debug: + description: TaskRunDebug defines the breakpoint config for a particular + TaskRun + type: object + properties: + breakpoints: + description: TaskBreakpoints defines the breakpoint config for + a particular Task + type: object + properties: + beforeSteps: + type: array + items: + type: string + x-kubernetes-list-type: atomic + onFailure: + description: |- + if enabled, pause TaskRun on failure of a step + failed step will not exit + type: string + managedBy: + description: |- + ManagedBy indicates which controller is responsible for reconciling + this resource. If unset or set to "tekton.dev/pipeline", the default + Tekton controller will manage this resource. + This field is immutable. + type: string + params: + description: Params is a list of Param + type: array + items: + description: Param declares an ParamValues to use for the parameter + called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + podTemplate: + description: PodTemplate holds pod specific configuration + type: object + properties: + affinity: + description: |- + If specified, the pod's scheduling constraints. + See Pod.spec.affinity (API version: v1) + x-kubernetes-preserve-unknown-fields: true + automountServiceAccountToken: + description: |- + AutomountServiceAccountToken indicates whether pods running as this + service account should have an API token automatically mounted. + type: boolean + dnsConfig: + description: |- + Specifies the DNS parameters of a pod. + Parameters specified here will be merged to the generated DNS + configuration based on DNSPolicy. + type: object + properties: + nameservers: + description: |- + A list of DNS name server IP addresses. + This will be appended to the base nameservers generated from DNSPolicy. + Duplicated nameservers will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + options: + description: |- + A list of DNS resolver options. + This will be merged with the base options generated from DNSPolicy. + Duplicated entries will be removed. Resolution options given in Options + will override those that appear in the base DNSPolicy. + type: array + items: + description: PodDNSConfigOption defines DNS resolver options + of a pod. + type: object + properties: + name: + description: |- + Name is this DNS resolver option's name. + Required. + type: string + value: + description: Value is this DNS resolver option's value. + type: string + x-kubernetes-list-type: atomic + searches: + description: |- + A list of DNS search domains for host-name lookup. + This will be appended to the base search paths generated from DNSPolicy. + Duplicated search paths will be removed. + type: array + items: + type: string + x-kubernetes-list-type: atomic + dnsPolicy: + description: |- + Set DNS policy for the pod. Defaults to "ClusterFirst". Valid values are + 'ClusterFirst', 'Default' or 'None'. DNS parameters given in DNSConfig + will be merged with the policy selected with DNSPolicy. + type: string + enableServiceLinks: + description: |- + EnableServiceLinks indicates whether information about services should be injected into pod's + environment variables, matching the syntax of Docker links. + Optional: Defaults to true. + type: boolean + env: + description: List of environment variables that can be provided + to the containers belonging to the pod. + type: array + items: + description: EnvVar represents an environment variable present + in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing + the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or its + key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + hostAliases: + description: |- + HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts + file if specified. This is only valid for non-hostNetwork pods. + type: array + items: + description: |- + HostAlias holds the mapping between IP and hostnames that will be injected as an entry in the + pod's hosts file. + type: object + required: + - ip + properties: + hostnames: + description: Hostnames for the above IP address. + type: array + items: + type: string + x-kubernetes-list-type: atomic + ip: + description: IP address of the host file entry. + type: string + x-kubernetes-list-type: atomic + hostNetwork: + description: HostNetwork specifies whether the pod may use the + node network namespace + type: boolean + hostUsers: + description: |- + HostUsers indicates whether the pod will use the host's user namespace. + Optional: Default to true. + If set to true or not present, the pod will be run in the host user namespace, useful + for when the pod needs a feature only available to the host user namespace, such as + loading a kernel module with CAP_SYS_MODULE. + When set to false, a new user namespace is created for the pod. Setting false + is useful to mitigating container breakout vulnerabilities such as allowing + containers to run as root without their user having root privileges on the host. + This field depends on the kubernetes feature gate UserNamespacesSupport being enabled. + type: boolean + imagePullSecrets: + description: ImagePullSecrets gives the name of the secret used + by the pod to pull the image if specified + type: array + items: + description: |- + LocalObjectReference contains enough information to let you locate the + referenced object inside the same namespace. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + nodeSelector: + description: |- + NodeSelector is a selector which must be true for the pod to fit on a node. + Selector which must match a node's labels for the pod to be scheduled on that node. + More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + type: object + additionalProperties: + type: string + priorityClassName: + description: |- + If specified, indicates the pod's priority. "system-node-critical" and + "system-cluster-critical" are two special keywords which indicate the + highest priorities with the former being the highest priority. Any other + name must be defined by creating a PriorityClass object with that name. + If not specified, the pod priority will be default or zero if there is no + default. + type: string + runtimeClassName: + description: |- + RuntimeClassName refers to a RuntimeClass object in the node.k8s.io + group, which should be used to run this pod. If no RuntimeClass resource + matches the named class, the pod will not be run. If unset or empty, the + "legacy" RuntimeClass will be used, which is an implicit class with an + empty definition that uses the default runtime handler. + More info: https://git.k8s.io/enhancements/keps/sig-node/runtime-class.md + This is a beta feature as of Kubernetes v1.14. + type: string + schedulerName: + description: SchedulerName specifies the scheduler to be used + to dispatch the Pod + type: string + securityContext: + description: |- + SecurityContext holds pod-level security attributes and common container settings. + Optional: Defaults to empty. See type description for default values of each field. + See Pod.spec.securityContext (API version: v1) + x-kubernetes-preserve-unknown-fields: true + tolerations: + description: If specified, the pod's tolerations. + type: array + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + type: object + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + type: integer + format: int64 + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + x-kubernetes-list-type: atomic + topologySpreadConstraints: + description: |- + TopologySpreadConstraints controls how Pods are spread across your cluster among + failure-domains such as regions, zones, nodes, and other user-defined topology domains. + type: array + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + type: object + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + type: object + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + type: array + items: + type: string + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + type: integer + format: int32 + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + type: integer + format: int32 + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + If this value is nil, the behavior is equivalent to the Honor policy. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + If this value is nil, the behavior is equivalent to the Ignore policy. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + x-kubernetes-list-type: atomic + volumes: + description: |- + List of volumes that can be mounted by containers belonging to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + retries: + description: Retries represents how many times this TaskRun should + be retried in the event of task failure. + type: integer + serviceAccountName: + type: string + sidecarSpecs: + description: |- + Specs to apply to Sidecars in this TaskRun. + If a field is specified in both a Sidecar and a SidecarSpec, + the value from the SidecarSpec will be used. + This field is only supported when the alpha feature gate is enabled. + type: array + items: + description: TaskRunSidecarSpec is used to override the values + of a Sidecar in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the Sidecar. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Sidecar to override. + type: string + x-kubernetes-list-type: atomic + status: + description: Used for cancelling a TaskRun (and maybe more later + on) + type: string + statusMessage: + description: Status message for cancellation. + type: string + stepSpecs: + description: |- + Specs to apply to Steps in this TaskRun. + If a field is specified in both a Step and a StepSpec, + the value from the StepSpec will be used. + This field is only supported when the alpha feature gate is enabled. + type: array + items: + description: TaskRunStepSpec is used to override the values of + a Step in the corresponding Task. + type: object + required: + - computeResources + - name + properties: + computeResources: + description: The resource requirements to apply to the Step. + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: The name of the Step to override. + type: string + x-kubernetes-list-type: atomic + taskRef: + description: no more than one of the TaskRef and TaskSpec may be + specified. + type: object + properties: + apiVersion: + description: |- + API version of the referent + Note: A Task with non-empty APIVersion and Kind is considered a Custom Task + type: string + kind: + description: |- + TaskKind indicates the Kind of the Task: + 1. Namespaced Task when Kind is set to "Task". If Kind is "", it defaults to "Task". + 2. Custom Task when Kind is non-empty and APIVersion is non-empty + type: string + name: + description: 'Name of the referent; More info: http://kubernetes.io/docs/user-guide/identifiers#names' + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use for the + parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + taskSpec: + description: |- + Specifying TaskSpec can be disabled by setting + `disable-inline-spec` feature flag. + See Task.spec (API version: tekton.dev/v1) + x-kubernetes-preserve-unknown-fields: true + timeout: + description: |- + Time after which one retry attempt times out. Defaults to 1 hour. + Refer Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + workspaces: + description: Workspaces is a list of WorkspaceBindings from volumes + to workspaces. + type: array + items: + description: WorkspaceBinding maps a Task's declared workspace + to a Volume. + type: object + required: + - name + properties: + configMap: + description: ConfigMap represents a configMap that should + populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap or + its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + csi: + description: CSI (Container Storage Interface) represents + ephemeral storage that is handled by certain external CSI + drivers. + type: object + required: + - driver + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + additionalProperties: + type: string + emptyDir: + description: |- + EmptyDir represents a temporary directory that shares a Task's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + Either this OR PersistentVolumeClaim can be used. + type: object + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + name: + description: Name is the name of the workspace populated by + the volume. + type: string + persistentVolumeClaim: + description: |- + PersistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. Either this OR EmptyDir can be used. + type: object + required: + - claimName + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + projected: + description: Projected represents a projected volume that + should populate this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + sources: + description: |- + sources is the list of volume projections. Each entry in this list + handles one source. + type: array + items: + description: |- + Projection that may be projected along with other supported volume types. + Exactly one of these fields must be set. + type: object + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + type: object + required: + - path + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + type: object + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + type: array + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + type: object + required: + - key + - operator + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + type: array + items: + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + matchLabels: + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + additionalProperties: + type: string + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume root + to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + configMap: + description: configMap information about the configMap + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the downwardAPI + data to project + type: object + properties: + items: + description: Items is a list of DownwardAPIVolume + file + type: array + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + type: object + required: + - path + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name, namespace and uid are supported.' + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: 'Required: Path is the relative + path name of the file to be created. + Must not be absolute or contain the + ''..'' path. Must be utf-8 encoded. + The first item of the relative path + must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required + for volumes, optional for env vars' + type: string + divisor: + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to + select' + type: string + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + podCertificate: + description: |- + Projects an auto-rotating credential bundle (private key and certificate + chain) that the pod can use either as a TLS client or server. + + Kubelet generates a private key and uses it to send a + PodCertificateRequest to the named signer. Once the signer approves the + request and issues a certificate chain, Kubelet writes the key and + certificate chain to the pod filesystem. The pod does not start until + certificates have been issued for each podCertificate projected volume + source in its spec. + + Kubelet will begin trying to rotate the certificate at the time indicated + by the signer using the PodCertificateRequest.Status.BeginRefreshAt + timestamp. + + Kubelet can write a single file, indicated by the credentialBundlePath + field, or separate files, indicated by the keyPath and + certificateChainPath fields. + + The credential bundle is a single file in PEM format. The first PEM + entry is the private key (in PKCS#8 format), and the remaining PEM + entries are the certificate chain issued by the signer (typically, + signers will return their certificate chain in leaf-to-root order). + + Prefer using the credential bundle format, since your application code + can read it atomically. If you use keyPath and certificateChainPath, + your application must make two separate file reads. If these coincide + with a certificate rotation, it is possible that the private key and leaf + certificate you read may not correspond to each other. Your application + will need to check for this condition, and re-read until they are + consistent. + + The named signer controls chooses the format of the certificate it + issues; consult the signer implementation's documentation to learn how to + use the certificates it issues. + type: object + required: + - keyType + - signerName + properties: + certificateChainPath: + description: |- + Write the certificate chain at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + credentialBundlePath: + description: |- + Write the credential bundle at this path in the projected volume. + + The credential bundle is a single file that contains multiple PEM blocks. + The first PEM block is a PRIVATE KEY block, containing a PKCS#8 private + key. + + The remaining blocks are CERTIFICATE blocks, containing the issued + certificate chain from the signer (leaf and any intermediates). + + Using credentialBundlePath lets your Pod's application code make a single + atomic read that retrieves a consistent key and certificate chain. If you + project them to separate files, your application code will need to + additionally check that the leaf certificate was issued to the key. + type: string + keyPath: + description: |- + Write the key at this path in the projected volume. + + Most applications should use credentialBundlePath. When using keyPath + and certificateChainPath, your application needs to check that the key + and leaf certificate are consistent, because it is possible to read the + files mid-rotation. + type: string + keyType: + description: |- + The type of keypair Kubelet will generate for the pod. + + Valid values are "RSA3072", "RSA4096", "ECDSAP256", "ECDSAP384", + "ECDSAP521", and "ED25519". + type: string + maxExpirationSeconds: + description: |- + maxExpirationSeconds is the maximum lifetime permitted for the + certificate. + + Kubelet copies this value verbatim into the PodCertificateRequests it + generates for this projection. + + If omitted, kube-apiserver will set it to 86400(24 hours). kube-apiserver + will reject values shorter than 3600 (1 hour). The maximum allowable + value is 7862400 (91 days). + + The signer implementation is then free to issue a certificate with any + lifetime *shorter* than MaxExpirationSeconds, but no shorter than 3600 + seconds (1 hour). This constraint is enforced by kube-apiserver. + `kubernetes.io` signers will never issue certificates with a lifetime + longer than 24 hours. + type: integer + format: int32 + signerName: + description: Kubelet's generated CSRs will be + addressed to this signer. + type: string + userAnnotations: + description: |- + userAnnotations allow pod authors to pass additional information to + the signer implementation. Kubernetes does not restrict or validate this + metadata in any way. + + These values are copied verbatim into the `spec.unverifiedUserAnnotations` field of + the PodCertificateRequest objects that Kubelet creates. + + Entries are subject to the same validation as object metadata annotations, + with the addition that all keys must be domain-prefixed. No restrictions + are placed on values, except an overall size limitation on the entire field. + + Signers should document the keys and values they support. Signers should + deny requests that contain keys they do not recognize. + type: object + additionalProperties: + type: string + secret: + description: secret information about the secret + data to project + type: object + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within + a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + type: object + required: + - path + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + type: integer + format: int64 + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + x-kubernetes-list-type: atomic + secret: + description: Secret represents a secret that should populate + this workspace. + type: object + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + type: array + items: + description: Maps a string key to a path within a volume. + type: object + required: + - key + - path + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + type: integer + format: int32 + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + x-kubernetes-list-type: atomic + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + subPath: + description: |- + SubPath is optionally a directory on the volume which should be used + for this binding (i.e. the volume will be mounted at this sub directory). + type: string + volumeClaimTemplate: + description: |- + VolumeClaimTemplate is a template for a claim that will be created in the same namespace. + The PipelineRun controller is responsible for creating a unique claim for each instance of PipelineRun. + See PersistentVolumeClaim (API version: v1) + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + status: + description: TaskRunStatus defines the observed state of TaskRun + type: object + required: + - podName + properties: + annotations: + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + additionalProperties: + type: string + artifacts: + description: Artifacts are the list of artifacts written out by + the task's containers + type: object + properties: + inputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + x-kubernetes-list-type: atomic + outputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + x-kubernetes-list-type: atomic + completionTime: + description: CompletionTime is the time the build completed. + type: string + format: date-time + conditions: + description: Conditions the latest available observations of a resource's + current state. + type: array + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + type: object + required: + - status + - type + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about + the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of condition. + type: string + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + type: integer + format: int64 + podName: + description: PodName is the name of the pod responsible for executing + this task's steps. + type: string + provenance: + description: Provenance contains some key authenticated metadata + about how a software artifact was built (what sources, what inputs/outputs, + etc.). + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags that + were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since StepActions + are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + description: Results are the list of results written out by the + task's containers + type: array + items: + description: TaskRunResult used to describe the results of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the given value of the result + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + retriesStatus: + description: |- + RetriesStatus contains the history of TaskRunStatus in case of a retry in order to keep record of failures. + All TaskRunStatus stored in RetriesStatus will have no date within the RetriesStatus as is redundant. + x-kubernetes-preserve-unknown-fields: true + sidecars: + description: |- + The list has one entry per sidecar in the manifest. Each entry is + represents the imageid of the corresponding sidecar. + type: array + items: + description: SidecarState reports the results of running a sidecar + in a Task. + type: object + properties: + container: + type: string + imageID: + type: string + name: + type: string + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + spanContext: + description: SpanContext contains tracing span context fields + type: object + additionalProperties: + type: string + startTime: + description: StartTime is the time the build is actually started. + type: string + format: date-time + steps: + description: Steps describes the state of each build step container. + type: array + items: + description: StepState reports the results of running a step in + a Task. + type: object + properties: + container: + type: string + imageID: + type: string + inputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + name: + type: string + outputs: + type: array + items: + description: |- + Artifact represents an artifact within a system, potentially containing multiple values + associated with it. + type: object + properties: + buildOutput: + description: Indicate if the artifact is a build output + or a by-product + type: boolean + name: + description: The artifact's identifying category name + type: string + values: + description: A collection of values related to the artifact + type: array + items: + description: ArtifactValue represents a specific value + or data element within an Artifact. + type: object + properties: + digest: + type: object + additionalProperties: + type: string + uri: + type: string + provenance: + description: |- + Provenance contains metadata about resources used in the TaskRun/PipelineRun + such as the source from where a remote build definition was fetched. + This field aims to carry minimum amoumt of metadata in *Run status so that + Tekton Chains can capture them in the provenance. + type: object + properties: + featureFlags: + description: FeatureFlags identifies the feature flags + that were used during the task/pipeline run + type: object + properties: + awaitSidecarReadiness: + type: boolean + coschedule: + type: string + disableCredsInit: + type: boolean + disableInlineSpec: + type: string + enableAPIFields: + type: string + enableArtifacts: + type: boolean + enableCELInWhenExpression: + type: boolean + enableConciseResolverSyntax: + type: boolean + enableKeepPodOnCancel: + type: boolean + enableKubernetesSidecar: + type: boolean + enableParamEnum: + type: boolean + enableProvenanceInStatus: + type: boolean + enableStepActions: + description: EnableStepActions is a no-op flag since + StepActions are stable + type: boolean + enableTektonOCIBundles: + description: |- + DeprecatedEnableTektonOCIBundles is maintained for backward compatibility + to allow deletion of PipelineRuns created before v0.62.x. + This field is not used and can be removed in a future release + once we're confident old PipelineRuns have been cleaned up. + See issue #8359 for context. + type: boolean + enableTerminationMessageCompression: + type: boolean + enableWaitExponentialBackoff: + type: boolean + enforceNonfalsifiability: + type: string + maxResultSize: + type: integer + requireGitSSHSecretKnownHosts: + type: boolean + resultExtractionMethod: + type: string + runningInEnvWithInjectedSidecars: + type: boolean + sendCloudEventsForRuns: + type: boolean + setSecurityContext: + type: boolean + setSecurityContextReadOnlyRootFilesystem: + type: boolean + verificationNoMatchPolicy: + description: |- + VerificationNoMatchPolicy is the feature flag for "trusted-resources-verification-no-match-policy" + VerificationNoMatchPolicy can be set to "ignore", "warn" and "fail" values. + ignore: skip trusted resources verification when no matching verification policies found + warn: skip trusted resources verification when no matching verification policies found and log a warning + fail: fail the taskrun or pipelines run if no matching verification policies found + type: string + refSource: + description: RefSource identifies the source where a remote + task/pipeline came from. + type: object + properties: + digest: + description: |- + Digest is a collection of cryptographic digests for the contents of the artifact specified by URI. + Example: {"sha1": "f99d13e554ffcb696dee719fa85b695cb5b0f428"} + type: object + additionalProperties: + type: string + entryPoint: + description: |- + EntryPoint identifies the entry point into the build. This is often a path to a + build definition file and/or a target label within that file. + Example: "task/git-clone/0.10/git-clone.yaml" + type: string + uri: + description: |- + URI indicates the identity of the source of the build definition. + Example: "https://github.com/tektoncd/catalog" + type: string + results: + type: array + items: + description: TaskRunResult used to describe the results + of a task + type: object + required: + - name + - value + properties: + name: + description: Name the given name + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the given value of the result + x-kubernetes-preserve-unknown-fields: true + running: + description: Details about a running container + type: object + properties: + startedAt: + description: Time at which the container was last (re-)started + type: string + format: date-time + terminated: + description: Details about a terminated container + type: object + required: + - exitCode + properties: + containerID: + description: Container's ID in the format '://' + type: string + exitCode: + description: Exit status from the last termination of + the container + type: integer + format: int32 + finishedAt: + description: Time at which the container last terminated + type: string + format: date-time + message: + description: Message regarding the last termination of + the container + type: string + reason: + description: (brief) reason from the last termination + of the container + type: string + signal: + description: Signal from the last termination of the container + type: integer + format: int32 + startedAt: + description: Time at which previous execution of the container + started + type: string + format: date-time + terminationReason: + type: string + waiting: + description: Details about a waiting container + type: object + properties: + message: + description: Message regarding why the container is not + yet running. + type: string + reason: + description: (brief) reason the container is not yet running. + type: string + x-kubernetes-list-type: atomic + taskSpec: + description: TaskSpec contains the Spec from the dereferenced Task + definition used to instantiate this TaskRun. + type: object + properties: + description: + description: |- + Description is a user-facing description of the task that may be + used to populate a UI. + type: string + displayName: + description: |- + DisplayName is a user-facing name of the task that may be + used to populate a UI. + type: string + params: + description: |- + Params is a list of input parameters required to run the task. Params + must be supplied as inputs in TaskRuns unless they declare a default + value. + type: array + items: + description: |- + ParamSpec defines arbitrary parameters needed beyond typed inputs (such as + resources). Parameter values are provided by users as inputs on a TaskRun + or PipelineRun. + type: object + required: + - name + properties: + default: + description: |- + Default is the value a parameter takes if no input value is supplied. If + default is set, a Task may be executed without a supplied value for the + parameter. + x-kubernetes-preserve-unknown-fields: true + description: + description: |- + Description is a user-facing description of the parameter that may be + used to populate a UI. + type: string + enum: + description: |- + Enum declares a set of allowed param input values for tasks/pipelines that can be validated. + If Enum is not set, no input validation is performed for the param. + type: array + items: + type: string + name: + description: Name declares the name by which a parameter + is referenced. + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs parameter. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the parameter. The possible types + are currently "string", "array" and "object", and "string" is the default. + type: string + x-kubernetes-list-type: atomic + results: + description: Results are values that this Task can output + type: array + items: + description: TaskResult used to describe the results of a + task + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for object + keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: |- + Type is the user-specified type of the result. The possible type + is currently "string" and will support "array" in following work. + type: string + value: + description: Value the expression used to retrieve the + value of the result from an underlying Step. + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + sidecars: + description: |- + Sidecars are run alongside the Task's step containers. They begin before + the steps start and end after the steps complete. + type: array + items: + description: Sidecar has nearly the same data structure as + Step but does not have the ability to timeout. + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Sidecar's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Sidecar. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Sidecar. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Sidecar. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the container is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of + a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must + be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + lifecycle: + description: |- + Actions that the management system should take in response to Sidecar lifecycle events. + Cannot be updated. + type: object + properties: + postStart: + description: |- + PostStart is called immediately after a container is created. If the handler fails, + the container is terminated and restarted according to its restart policy. + Other management of the container blocks until the hook completes. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute + in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom + header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that + the container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + preStop: + description: |- + PreStop is called immediately before a container is terminated due to an + API request or management event such as liveness/startup probe failure, + preemption, resource contention, etc. The handler is not called if the + container crashes or exits. The Pod's termination grace period countdown begins before the + PreStop hook is executed. Regardless of the outcome of the handler, the + container will eventually terminate within the Pod's termination grace + period (unless delayed by finalizers). Other management of the container blocks until the hook completes + or until the termination grace period is reached. + More info: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/#container-hooks + type: object + properties: + exec: + description: Exec specifies a command to execute + in the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the + request. HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom + header to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + sleep: + description: Sleep represents a duration that + the container should sleep. + type: object + required: + - seconds + properties: + seconds: + description: Seconds is the number of seconds + to sleep. + type: integer + format: int64 + tcpSocket: + description: |- + Deprecated. TCPSocket is NOT supported as a LifecycleHandler and kept + for backward compatibility. There is no validation of this field and + lifecycle hooks will fail at runtime when it is specified. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect + to, defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + stopSignal: + description: |- + StopSignal defines which signal will be sent to a container when it is being stopped. + If not specified, the default is defined by the container runtime in use. + StopSignal can only be set for Pods with a non-empty .spec.os.name + type: string + livenessProbe: + description: |- + Periodic probe of Sidecar liveness. + Container will be restarted if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + name: + description: |- + Name of the Sidecar specified as a DNS_LABEL. + Each Sidecar in a Task must have a unique name (DNS_LABEL). + Cannot be updated. + type: string + ports: + description: |- + List of ports to expose from the Sidecar. Exposing a port here gives + the system additional information about the network connections a + container uses, but is primarily informational. Not specifying a port here + DOES NOT prevent that port from being exposed. Any port which is + listening on the default "0.0.0.0" address inside a container will be + accessible from the network. + Cannot be updated. + type: array + items: + description: ContainerPort represents a network port + in a single container. + type: object + required: + - containerPort + properties: + containerPort: + description: |- + Number of port to expose on the pod's IP address. + This must be a valid port number, 0 < x < 65536. + type: integer + format: int32 + hostIP: + description: What host IP to bind the external port + to. + type: string + hostPort: + description: |- + Number of port to expose on the host. + If specified, this must be a valid port number, 0 < x < 65536. + If HostNetwork is specified, this must match ContainerPort. + Most containers do not need this. + type: integer + format: int32 + name: + description: |- + If specified, this must be an IANA_SVC_NAME and unique within the pod. Each + named port in a pod must have a unique name. Name for the port that can be + referred to by services. + type: string + protocol: + description: |- + Protocol for port. Must be UDP, TCP, or SCTP. + Defaults to "TCP". + type: string + default: TCP + x-kubernetes-list-map-keys: + - containerPort + - protocol + x-kubernetes-list-type: map + readinessProbe: + description: |- + Periodic probe of Sidecar service readiness. + Container will be removed from service endpoints if the probe fails. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + restartPolicy: + description: |- + RestartPolicy refers to kubernetes RestartPolicy. It can only be set for an + initContainer and must have it's policy set to "Always". It is currently + left optional to help support Kubernetes versions prior to 1.29 when this feature + was introduced. + type: string + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command or Args. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Sidecar should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that + applies to the container. + type: string + role: + description: Role is a SELinux role label that + applies to the container. + type: string + type: + description: Type is a SELinux type label that + applies to the container. + type: string + user: + description: User is a SELinux user label that + applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + startupProbe: + description: |- + StartupProbe indicates that the Pod the Sidecar is running in has successfully initialized. + If specified, no other probes are executed until this completes successfully. + If this probe fails, the Pod will be restarted, just as if the livenessProbe failed. + This can be used to provide different probe parameters at the beginning of a Pod's lifecycle, + when it might take a long time to load data or warm a cache, than during steady-state operation. + This cannot be updated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: object + properties: + exec: + description: Exec specifies a command to execute in + the container. + type: object + properties: + command: + description: |- + Command is the command line to execute inside the container, the working directory for the + command is root ('/') in the container's filesystem. The command is simply exec'd, it is + not run inside a shell, so traditional shell instructions ('|', etc) won't work. To use + a shell, you need to explicitly call out to that shell. + Exit status of 0 is treated as live/healthy and non-zero is unhealthy. + type: array + items: + type: string + x-kubernetes-list-type: atomic + failureThreshold: + description: |- + Minimum consecutive failures for the probe to be considered failed after having succeeded. + Defaults to 3. Minimum value is 1. + type: integer + format: int32 + grpc: + description: GRPC specifies a GRPC HealthCheckRequest. + type: object + required: + - port + properties: + port: + description: Port number of the gRPC service. + Number must be in the range 1 to 65535. + type: integer + format: int32 + service: + description: |- + Service is the name of the service to place in the gRPC HealthCheckRequest + (see https://github.com/grpc/grpc/blob/master/doc/health-checking.md). + + If this is not specified, the default behavior is defined by gRPC. + type: string + default: "" + httpGet: + description: HTTPGet specifies an HTTP GET request + to perform. + type: object + required: + - port + properties: + host: + description: |- + Host name to connect to, defaults to the pod IP. You probably want to set + "Host" in httpHeaders instead. + type: string + httpHeaders: + description: Custom headers to set in the request. + HTTP allows repeated headers. + type: array + items: + description: HTTPHeader describes a custom header + to be used in HTTP probes + type: object + required: + - name + - value + properties: + name: + description: |- + The header field name. + This will be canonicalized upon output, so case-variant names will be understood as the same header. + type: string + value: + description: The header field value + type: string + x-kubernetes-list-type: atomic + path: + description: Path to access on the HTTP server. + type: string + port: + description: |- + Name or number of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + scheme: + description: |- + Scheme to use for connecting to the host. + Defaults to HTTP. + type: string + initialDelaySeconds: + description: |- + Number of seconds after the container has started before liveness probes are initiated. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + periodSeconds: + description: |- + How often (in seconds) to perform the probe. + Default to 10 seconds. Minimum value is 1. + type: integer + format: int32 + successThreshold: + description: |- + Minimum consecutive successes for the probe to be considered successful after having failed. + Defaults to 1. Must be 1 for liveness and startup. Minimum value is 1. + type: integer + format: int32 + tcpSocket: + description: TCPSocket specifies a connection to a + TCP port. + type: object + required: + - port + properties: + host: + description: 'Optional: Host name to connect to, + defaults to the pod IP.' + type: string + port: + description: |- + Number or name of the port to access on the container. + Number must be in the range 1 to 65535. + Name must be an IANA_SVC_NAME. + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + terminationGracePeriodSeconds: + description: |- + Optional duration in seconds the pod needs to terminate gracefully upon probe failure. + The grace period is the duration in seconds after the processes running in the pod are sent + a termination signal and the time when the processes are forcibly halted with a kill signal. + Set this value longer than the expected cleanup time for your process. + If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this + value overrides the value provided by the pod spec. + Value must be non-negative integer. The value zero indicates stop immediately via + the kill signal (no opportunity to shut down). + This is a beta field and requires enabling ProbeTerminationGracePeriod feature gate. + Minimum value is 1. spec.terminationGracePeriodSeconds is used if unset. + type: integer + format: int64 + timeoutSeconds: + description: |- + Number of seconds after which the probe times out. + Defaults to 1 second. Minimum value is 1. + More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle#container-probes + type: integer + format: int32 + stdin: + description: |- + Whether this Sidecar should allocate a buffer for stdin in the container runtime. If this + is not set, reads from stdin in the Sidecar will always result in EOF. + Default is false. + type: boolean + stdinOnce: + description: |- + Whether the container runtime should close the stdin channel after it has been opened by + a single attach. When stdin is true the stdin stream will remain open across multiple attach + sessions. If stdinOnce is set to true, stdin is opened on Sidecar start, is empty until the + first client attaches to stdin, and then remains open and accepts data until the client disconnects, + at which time stdin is closed and remains closed until the Sidecar is restarted. If this + flag is false, a container processes that reads from stdin will never receive an EOF. + Default is false + type: boolean + terminationMessagePath: + description: |- + Optional: Path at which the file to which the Sidecar's termination message + will be written is mounted into the Sidecar's filesystem. + Message written is intended to be brief final status, such as an assertion failure message. + Will be truncated by the node if greater than 4096 bytes. The total message length across + all containers will be limited to 12kb. + Defaults to /dev/termination-log. + Cannot be updated. + type: string + terminationMessagePolicy: + description: |- + Indicate how the termination message should be populated. File will use the contents of + terminationMessagePath to populate the Sidecar status message on both success and failure. + FallbackToLogsOnError will use the last chunk of Sidecar log output if the termination + message file is empty and the Sidecar exited with an error. + The log output is limited to 2048 bytes or 80 lines, whichever is smaller. + Defaults to File. + Cannot be updated. + type: string + tty: + description: |- + Whether this Sidecar should allocate a TTY for itself, also requires 'stdin' to be true. + Default is false. + type: boolean + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Sidecar. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Sidecar's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Sidecar's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Sidecar wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + stepTemplate: + description: |- + StepTemplate can be used as the basis for all step containers within the + Task, so that the steps inherit settings on the base container. + type: object + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the Step's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry in + PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret or + its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of a + set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must be + defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Image reference name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + steps: + description: |- + Steps are the steps of the build; each step is run sequentially with the + source mounted into /workspace. + type: array + items: + description: Step runs a subcomponent of a Task + type: object + required: + - name + properties: + args: + description: |- + Arguments to the entrypoint. + The image's CMD is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + command: + description: |- + Entrypoint array. Not executed within a shell. + The image's ENTRYPOINT is used if this is not provided. + Variable references $(VAR_NAME) are expanded using the container's environment. If a variable + cannot be resolved, the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. "$$(VAR_NAME)" will + produce the string literal "$(VAR_NAME)". Escaped references will never be expanded, regardless + of whether the variable exists or not. Cannot be updated. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-command-argument-container/#running-a-command-in-a-shell + type: array + items: + type: string + x-kubernetes-list-type: atomic + computeResources: + description: |- + ComputeResources required by this Step. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + This field depends on the + DynamicResourceAllocation feature gate. + + This field is immutable. It can only be set for containers. + type: array + items: + description: ResourceClaim references one entry + in PodSpec.ResourceClaims. + type: object + required: + - name + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + request: + description: |- + Request is the name chosen for a request in the referenced claim. + If empty, everything from the claim is made available, otherwise + only the result of this request. + type: string + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + requests: + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + additionalProperties: + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + displayName: + description: |- + DisplayName is a user-facing name of the step that may be + used to populate a UI. + type: string + env: + description: |- + List of environment variables to set in the Step. + Cannot be updated. + type: array + items: + description: EnvVar represents an environment variable + present in a Container. + type: object + required: + - name + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's + value. Cannot be used if value is not empty. + type: object + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + type: object + required: + - key + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + type: object + required: + - fieldPath + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select + in the specified API version. + type: string + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + type: object + required: + - key + - path + - volumeName + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + default: false + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount + containing the env file. + type: string + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + type: object + required: + - resource + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + description: Specifies the output format + of the exposed resources, defaults to + "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + anyOf: + - type: integer + - type: string + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the + pod's namespace + type: object + required: + - key + properties: + key: + description: The key of the secret to select + from. Must be a valid secret key. + type: string + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret + or its key must be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + envFrom: + description: |- + List of sources to populate environment variables in the Step. + The keys defined within a source must be a C_IDENTIFIER. All invalid keys + will be reported as an event when the Step is starting. When a key exists in multiple + sources, the value associated with the last source will take precedence. + Values defined by an Env with a duplicate key will take precedence. + Cannot be updated. + type: array + items: + description: EnvFromSource represents the source of + a set of ConfigMaps or Secrets + type: object + properties: + configMapRef: + description: The ConfigMap to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the ConfigMap must + be defined + type: boolean + x-kubernetes-map-type: atomic + prefix: + description: |- + Optional text to prepend to the name of each environment variable. + May consist of any printable ASCII characters except '='. + type: string + secretRef: + description: The Secret to select from + type: object + properties: + name: + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + default: "" + optional: + description: Specify whether the Secret must + be defined + type: boolean + x-kubernetes-map-type: atomic + x-kubernetes-list-type: atomic + image: + description: |- + Docker image name. + More info: https://kubernetes.io/docs/concepts/containers/images + type: string + imagePullPolicy: + description: |- + Image pull policy. + One of Always, Never, IfNotPresent. + Defaults to Always if :latest tag is specified, or IfNotPresent otherwise. + Cannot be updated. + More info: https://kubernetes.io/docs/concepts/containers/images#updating-images + type: string + name: + description: |- + Name of the Step specified as a DNS_LABEL. + Each Step in a Task must have a unique name. + type: string + onError: + description: |- + OnError defines the exiting behavior of a container on error + can be set to [ continue | stopAndFail ] + type: string + params: + description: Params declares parameters passed to this + step action. + type: array + items: + description: Param declares an ParamValues to use for + the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + ref: + description: Contains the reference to an existing StepAction. + type: object + properties: + name: + description: Name of the referenced step + type: string + params: + description: |- + Params contains the parameters used to identify the + referenced Tekton resource. Example entries might include + "repo" or "path" but the set of params ultimately depends on + the chosen resolver. + type: array + items: + description: Param declares an ParamValues to use + for the parameter called name. + type: object + required: + - name + - value + properties: + name: + type: string + value: + x-kubernetes-preserve-unknown-fields: true + x-kubernetes-list-type: atomic + resolver: + description: |- + Resolver is the name of the resolver that should perform + resolution of the referenced Tekton resource, such as "git". + type: string + results: + description: |- + Results declares StepResults produced by the Step. + + It can be used in an inlined Step when used to store Results to $(step.results.resultName.path). + It cannot be used when referencing StepActions using [v1.Step.Ref]. + The Results declared by the StepActions will be stored here instead. + type: array + items: + description: StepResult used to describe the Results + of a Step. + type: object + required: + - name + properties: + description: + description: Description is a human-readable description + of the result + type: string + name: + description: Name the given name + type: string + properties: + description: Properties is the JSON Schema properties + to support key-value pairs results. + type: object + additionalProperties: + description: PropertySpec defines the struct for + object keys + type: object + properties: + type: + description: |- + ParamType indicates the type of an input parameter; + Used to distinguish between a single string and an array of strings. + type: string + type: + description: The possible types are 'string', 'array', + and 'object', with 'string' as the default. + type: string + x-kubernetes-list-type: atomic + script: + description: |- + Script is the contents of an executable file to execute. + + If Script is not empty, the Step cannot have an Command and the Args will be passed to the Script. + type: string + securityContext: + description: |- + SecurityContext defines the security options the Step should be run with. + If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + type: object + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + appArmorProfile: + description: |- + appArmorProfile is the AppArmor options to use by this container. If set, this profile + overrides the pod's appArmorProfile. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile loaded on the node that should be used. + The profile must be preconfigured on the node to work. + Must match the loaded name of the profile. + Must be set if and only if type is "Localhost". + type: string + type: + description: |- + type indicates which kind of AppArmor profile will be applied. + Valid options are: + Localhost - a profile pre-loaded on the node. + RuntimeDefault - the container runtime's default profile. + Unconfined - no AppArmor enforcement. + type: string + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + add: + description: Added capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + drop: + description: Removed capabilities + type: array + items: + description: Capability represent POSIX capabilities + type + type: string + x-kubernetes-list-type: atomic + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default value is Default which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: integer + format: int64 + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + type: object + properties: + level: + description: Level is SELinux level label that + applies to the container. + type: string + role: + description: Role is a SELinux role label that + applies to the container. + type: string + type: + description: Type is a SELinux type label that + applies to the container. + type: string + user: + description: User is a SELinux user label that + applies to the container. + type: string + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + type: object + required: + - type + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + type: object + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name + of the GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + stderrConfig: + description: Stores configuration for the stderr stream + of the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on + container's local filesystem. + type: string + stdoutConfig: + description: Stores configuration for the stdout stream + of the step. + type: object + properties: + path: + description: Path to duplicate stdout stream to on + container's local filesystem. + type: string + timeout: + description: |- + Timeout is the time after which the step times out. Defaults to never. + Refer to Go's ParseDuration documentation for expected format: https://golang.org/pkg/time/#ParseDuration + type: string + volumeDevices: + description: volumeDevices is the list of block devices + to be used by the Step. + type: array + items: + description: volumeDevice describes a mapping of a raw + block device within a container. + type: object + required: + - devicePath + - name + properties: + devicePath: + description: devicePath is the path inside of the + container that the device will be mapped to. + type: string + name: + description: name must match the name of a persistentVolumeClaim + in the pod + type: string + x-kubernetes-list-type: atomic + volumeMounts: + description: |- + Volumes to mount into the Step's filesystem. + Cannot be updated. + type: array + items: + description: VolumeMount describes a mounting of a Volume + within a container. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + When RecursiveReadOnly is set to IfPossible or to Enabled, MountPropagation must be None or unspecified + (which defaults to None). + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + recursiveReadOnly: + description: |- + RecursiveReadOnly specifies whether read-only mounts should be handled + recursively. + + If ReadOnly is false, this field has no meaning and must be unspecified. + + If ReadOnly is true, and this field is set to Disabled, the mount is not made + recursively read-only. If this field is set to IfPossible, the mount is made + recursively read-only, if it is supported by the container runtime. If this + field is set to Enabled, the mount is made recursively read-only if it is + supported by the container runtime, otherwise the pod will not be started and + an error will be generated to indicate the reason. + + If this field is set to IfPossible or Enabled, MountPropagation must be set to + None (or be unspecified, which defaults to None). + + If this field is not specified, it is treated as an equivalent of Disabled. + type: string + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + x-kubernetes-list-type: atomic + when: + description: When is a list of when expressions that need + to be true for the task to run + type: array + items: + description: |- + WhenExpression allows a PipelineTask to declare expressions to be evaluated before the Task is run + to determine whether the Task should be executed or skipped + type: object + properties: + cel: + description: |- + CEL is a string of Common Language Expression, which can be used to conditionally execute + the task based on the result of the expression evaluation + More info about CEL syntax: https://github.com/google/cel-spec/blob/master/doc/langdef.md + type: string + input: + description: Input is the string for guard checking + which can be a static input or an output from + a parent Task + type: string + operator: + description: Operator that represents an Input's + relationship to the values + type: string + values: + description: |- + Values is an array of strings, which is compared against the input, for guard checking + It must be non-empty + type: array + items: + type: string + x-kubernetes-list-type: atomic + workingDir: + description: |- + Step's working directory. + If not specified, the container runtime's default will be used, which + might be configured in the container image. + Cannot be updated. + type: string + workspaces: + description: |- + This is an alpha field. You must set the "enable-api-fields" feature flag to "alpha" + for this field to be supported. + + Workspaces is a list of workspaces from the Task that this Step wants + exclusive access to. Adding a workspace to this list means that any + other Step or Sidecar that does not also request this Workspace will + not have access to it. + type: array + items: + description: |- + WorkspaceUsage is used by a Step or Sidecar to declare that it wants isolated access + to a Workspace defined in a Task. + type: object + required: + - mountPath + - name + properties: + mountPath: + description: |- + MountPath is the path that the workspace should be mounted to inside the Step or Sidecar, + overriding any MountPath specified in the Task's WorkspaceDeclaration. + type: string + name: + description: Name is the name of the workspace this + Step or Sidecar wants access to. + type: string + x-kubernetes-list-type: atomic + x-kubernetes-list-type: atomic + volumes: + description: |- + Volumes is a collection of volumes that are available to mount into the + steps of the build. + See Pod.spec.volumes (API version: v1) + x-kubernetes-preserve-unknown-fields: true + workspaces: + description: Workspaces are the volumes that this Task requires. + type: array + items: + description: WorkspaceDeclaration is a declaration of a volume + that a Task requires. + type: object + required: + - name + properties: + description: + description: Description is an optional human readable + description of this volume. + type: string + mountPath: + description: MountPath overrides the directory that the + volume will be made available at. + type: string + name: + description: Name is the name by which you can bind the + volume at runtime. + type: string + optional: + description: |- + Optional marks a Workspace as not being required in TaskRuns. By default + this field is false and so declared workspaces are required. + type: boolean + readOnly: + description: |- + ReadOnly dictates whether a mounted volume is writable. By default this + field is false and so mounted volumes are writable. + type: boolean + x-kubernetes-list-type: atomic + additionalPrinterColumns: + - name: Succeeded + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].status" + - name: Reason + type: string + jsonPath: ".status.conditions[?(@.type==\"Succeeded\")].reason" + - name: StartTime + type: date + jsonPath: .status.startTime + - name: CompletionTime + type: date + jsonPath: .status.completionTime + # Opt into the status subresource so metadata.generation + # starts to increment + subresources: + status: {} + names: + kind: TaskRun + plural: taskruns + singular: taskrun + categories: + - tekton + - tekton-pipelines + shortNames: + - tr + - trs + scope: Namespaced + conversion: + strategy: Webhook + webhook: + conversionReviewVersions: ["v1beta1", "v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: verificationpolicies.tekton.dev + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.1" + version: "v1.15.1" +spec: + group: tekton.dev + versions: + - name: v1alpha1 + served: true + storage: true + schema: + openAPIV3Schema: + description: |- + VerificationPolicy defines the rules to verify Tekton resources. + VerificationPolicy can config the mapping from resources to a list of public + keys, so when verifying the resources we can use the corresponding public keys. + type: object + required: + - spec + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: Spec holds the desired state of the VerificationPolicy. + type: object + required: + - authorities + - resources + properties: + authorities: + description: Authorities defines the rules for validating signatures. + type: array + items: + description: The Authority block defines the keys for validating + signatures. + type: object + required: + - name + properties: + key: + description: Key contains the public key to validate the resource. + type: object + properties: + data: + description: Data contains the inline public key. + type: string + hashAlgorithm: + description: HashAlgorithm always defaults to sha256 if + the algorithm hasn't been explicitly set + type: string + kms: + description: |- + KMS contains the KMS url of the public key + Supported formats differ based on the KMS system used. + One example of a KMS url could be: + gcpkms://projects/[PROJECT]/locations/[LOCATION]>/keyRings/[KEYRING]/cryptoKeys/[KEY]/cryptoKeyVersions/[KEY_VERSION] + For more examples please refer https://docs.sigstore.dev/cosign/kms_support. + Note that the KMS is not supported yet. + type: string + secretRef: + description: SecretRef sets a reference to a secret with + the key. + type: object + properties: + name: + description: name is unique within a namespace to + reference a secret resource. + type: string + namespace: + description: namespace defines the space within which + the secret name must be unique. + type: string + x-kubernetes-map-type: atomic + name: + description: Name is the name for this authority. + type: string + mode: + description: |- + Mode controls whether a failing policy will fail the taskrun/pipelinerun, or only log the warnings + enforce - fail the taskrun/pipelinerun if verification fails (default) + warn - don't fail the taskrun/pipelinerun if verification fails but log warnings + type: string + resources: + description: |- + Resources defines the patterns of resources sources that should be subject to this policy. + For example, we may want to apply this Policy from a certain GitHub repo. + Then the ResourcesPattern should be valid regex. E.g. If using gitresolver, and we want to config keys from a certain git repo. + `ResourcesPattern` can be `https://github.com/tektoncd/catalog.git`, we will use regex to filter out those resources. + type: array + items: + description: ResourcePattern defines the pattern of the resource + source + type: object + required: + - pattern + properties: + pattern: + description: |- + Pattern defines a resource pattern. Regex is created to filter resources based on `Pattern` + Example patterns: + GitHub resource: https://github.com/tektoncd/catalog.git, https://github.com/tektoncd/* + Bundle resource: gcr.io/tekton-releases/catalog/upstream/git-clone, gcr.io/tekton-releases/catalog/upstream/* + Hub resource: https://artifacthub.io/*, + type: string + names: + kind: VerificationPolicy + plural: verificationpolicies + singular: verificationpolicy + categories: + - tekton + - tekton-pipelines + scope: Namespaced + +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Secret +metadata: + name: webhook-certs + namespace: tekton-pipelines + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.1" +# The data is populated at install time. +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: validation.webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.1" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: validation.webhook.pipeline.tekton.dev +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.1" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: webhook.pipeline.tekton.dev +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: config.webhook.pipeline.tekton.dev + labels: + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pipeline.tekton.dev/release: "v1.15.1" +webhooks: + - admissionReviewVersions: ["v1"] + clientConfig: + service: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + failurePolicy: Fail + sideEffects: None + name: config.webhook.pipeline.tekton.dev + objectSelector: + matchLabels: + app.kubernetes.io/part-of: tekton-pipelines + +--- +# Copyright 2019-2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-aggregate-edit + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" +rules: + - apiGroups: + - tekton.dev + resources: + - tasks + - taskruns + - pipelines + - pipelineruns + - runs + - customruns + - stepactions + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch + +--- +# Copyright 2019-2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-aggregate-view + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + rbac.authorization.k8s.io/aggregate-to-view: "true" +rules: + - apiGroups: + - tekton.dev + resources: + - tasks + - taskruns + - pipelines + - pipelineruns + - runs + - customruns + - stepactions + verbs: + - get + - list + - watch + +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-defaults + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # default-timeout-minutes contains the default number of + # minutes to use for TaskRun and PipelineRun, if none is specified. + default-timeout-minutes: "60" # 60 minutes + + # default-service-account contains the default service account name + # to use for TaskRun and PipelineRun, if none is specified. + default-service-account: "default" + + # default-managed-by-label-value contains the default value given to the + # "app.kubernetes.io/managed-by" label applied to all Pods created for + # TaskRuns. If a user's requested TaskRun specifies another value for this + # label, the user's request supercedes. + default-managed-by-label-value: "tekton-pipelines" + + # default-pod-template contains the default pod template to use for + # TaskRun and PipelineRun. If a pod template is specified on the + # PipelineRun, the default-pod-template is merged with that one. + # default-pod-template: + + # default-affinity-assistant-pod-template contains the default pod template + # to use for affinity assistant pods. If a pod template is specified on the + # PipelineRun, the default-affinity-assistant-pod-template is merged with + # that one. + # default-affinity-assistant-pod-template: + + # default-cloud-events-sink contains the default CloudEvents sink to be + # used for TaskRun and PipelineRun, when no sink is specified. + # Note that right now it is still not possible to set a PipelineRun or + # TaskRun specific sink, so the default is the only option available. + # If no sink is specified, no CloudEvent is generated + # default-cloud-events-sink: + + # default-task-run-workspace-binding contains the default workspace + # configuration provided for any Workspaces that a Task declares + # but that a TaskRun does not explicitly provide. + # default-task-run-workspace-binding: | + # emptyDir: {} + + # default-max-matrix-combinations-count contains the default maximum number + # of combinations from a Matrix, if none is specified. + default-max-matrix-combinations-count: "256" + + # default-forbidden-env contains comma seperated environment variables that cannot be + # overridden by podTemplate. + default-forbidden-env: + + # default-resolver-type contains the default resolver type to be used in the cluster, + # no default-resolver-type is specified by default + default-resolver-type: + + # default-imagepullbackoff-timeout contains the default duration to wait + # before requeuing the TaskRun to retry, specifying 0 here is equivalent to fail fast + # possible values could be 1m, 5m, 10s, 1h, etc + # default-imagepullbackoff-timeout: "5m" + + # default-create-container-error-timeout contains the default duration to wait + # before failing a TaskRun when a container fails with "context deadline exceeded" + # (e.g. CRI-O under heavy load). Specifying 0 here is equivalent to fail fast. + # possible values could be 1m, 5m, 10s, 1h, etc + # default-create-container-error-timeout: "5m" + + # default-maximum-resolution-timeout specifies the default duration used by the + # resolution controller before timing out when exceeded. + # Possible values include "1m", "5m", "10s", "1h", etc. + # Example: default-maximum-resolution-timeout: "1m" + + # default-container-resource-requirements allow users to configure default resource + # requirements for init containers and containers in pods created by the controller. + # No resource requirements are applied by default when this key is unset. + # Note: All the resource requirements are applied to init-containers and containers + # only if the existing resource requirements are empty, except Tekton internal + # containers can be overridden by named entries such as prepare or place-scripts. + # default-container-resource-requirements: | + # place-scripts: # updates resource requirements of a 'place-scripts' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # prepare: # updates resource requirements of a 'prepare' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "256Mi" + # cpu: "500m" + # + # working-dir-initializer: # updates resource requirements of a 'working-dir-initializer' container + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "512Mi" + # cpu: "500m" + # + # prefix-scripts: # updates resource requirements of containers which starts with 'scripts-' + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # prefix-sidecar-scripts: # updates resource requirements of containers which starts with 'sidecar-scripts-' + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "128Mi" + # cpu: "500m" + # + # default: # updates resource requirements of init-containers and containers which has empty resource requirements + # requests: + # memory: "64Mi" + # cpu: "250m" + # limits: + # memory: "256Mi" + # cpu: "500m" + + # default-sidecar-log-polling-interval specifies the polling interval for the Tekton sidecar log results container. + # This controls how frequently the sidecar checks for step completion files written by steps in a TaskRun. + # Lower values (e.g., "10ms") make the sidecar more responsive but may increase CPU usage; higher values (e.g., "1s") + # reduce resource usage but may delay result collection. + # This value is used by the sidecar-tekton-log-results container and can be tuned for performance or test scenarios. + # Example values: "100ms", "500ms", "1s" + default-sidecar-log-polling-interval: "100ms" + + # default-step-ref-concurrency-limit specifies the concurrency limit for resolving step references. + # This setting controls the maximum number of concurrent goroutines used to resolve + # step references (`step.ref` fields) simultaneously. This limit acts as a throttle + # to prevent overwhelming remote servers (e.g., git providers, OCI registries) or + # the Kubernetes API server, especially when a TaskRun contains many steps that + # reference StepActions. + default-step-ref-concurrency-limit: "5" + +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-events + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # formats contains a comma separated list of event formats to be used + # the only format supported today is "tektonv1". An empty string is not + # a valid configuration. To disable events, do not specify the sink. + formats: "tektonv1" + + # sink contains the event sink to be used for TaskRun, PipelineRun and + # CustomRun. If no sink is specified, no CloudEvent is generated. + # This setting supercedes the "default-cloud-events-sink" from the + # "config-defaults" config map + sink: "https://events.sink/cdevents" + +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: feature-flags + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Setting this flag will determine how PipelineRun Pods are scheduled with Affinity Assistant. + # Acceptable values are "workspaces" (default), "pipelineruns", "isolate-pipelinerun", or "disabled". + # + # Setting it to "workspaces" will schedule all the taskruns sharing the same PVC-based workspace in a pipelinerun to the same node. + # Setting it to "pipelineruns" will schedule all the taskruns in a pipelinerun to the same node. + # Setting it to "isolate-pipelinerun" will schedule all the taskruns in a pipelinerun to the same node, + # and only allows one pipelinerun to run on a node at a time. + # Setting it to "disabled" will not apply any coschedule policy. + # + # See more in the Affinity Assistant documentation + # https://github.com/tektoncd/pipeline/blob/main/docs/affinityassistants.md + coschedule: "workspaces" + # Setting this flag to "true" will prevent Tekton scanning attached + # service accounts and injecting any credentials it finds into your + # Steps. + # + # The default behaviour currently is for Tekton to search service + # accounts for secrets matching a specified format and automatically + # mount those into your Steps. + # + # Note: setting this to "true" will prevent PipelineResources from + # working. + # + # See https://github.com/tektoncd/pipeline/issues/2791 for more + # info. + disable-creds-init: "false" + # Setting this flag to "false" will stop Tekton from waiting for a + # TaskRun's sidecar containers to be running before starting the first + # step. This will allow Tasks to be run in environments that don't + # support the DownwardAPI volume type, but may lead to unintended + # behaviour if sidecars are used. + # + # See https://github.com/tektoncd/pipeline/issues/4937 for more info. + await-sidecar-readiness: "true" + # This option should be set to false when Pipelines is running in a + # cluster that does not use injected sidecars such as Istio. Setting + # it to false should decrease the time it takes for a TaskRun to start + # running. For clusters that use injected sidecars, setting this + # option to false can lead to unexpected behavior. + # + # See https://github.com/tektoncd/pipeline/issues/2080 for more info. + running-in-environment-with-injected-sidecars: "true" + # Setting this flag to "true" will require that any Git SSH Secret + # offered to Tekton must have known_hosts included. + # + # See https://github.com/tektoncd/pipeline/issues/2981 for more + # info. + require-git-ssh-secret-known-hosts: "false" + # Setting this flag to "true" enables the use of Tekton OCI bundle. + # This is an experimental feature and thus should still be considered + # an alpha feature. + enable-tekton-oci-bundles: "false" + # Setting this flag will determine which gated features are enabled. + # Acceptable values are "stable", "beta", or "alpha". + enable-api-fields: "beta" + # DEPRECATED: send-cloudevents-for-runs is deprecated and will be removed in a future + # release. CloudEvents are now enabled by default when a sink is configured in the + # config-events ConfigMap. This flag only affects CustomRuns; it has no effect on + # TaskRuns or PipelineRuns. + send-cloudevents-for-runs: "true" + # This flag affects the behavior of taskruns and pipelineruns in cases where no VerificationPolicies match them. + # If it is set to "fail", TaskRuns and PipelineRuns will fail verification if no matching policies are found. + # If it is set to "warn", TaskRuns and PipelineRuns will run to completion if no matching policies are found, and an error will be logged. + # If it is set to "ignore", TaskRuns and PipelineRuns will run to completion if no matching policies are found, and no error will be logged. + trusted-resources-verification-no-match-policy: "ignore" + # Setting this flag to "true" enables populating the "provenance" field in TaskRun + # and PipelineRun status. This field contains metadata about resources used + # in the TaskRun/PipelineRun such as the source from where a remote Task/Pipeline + # definition was fetched. + enable-provenance-in-status: "true" + # Setting this flag will determine how Tekton pipelines will handle non-falsifiable provenance. + # If set to "spire", then SPIRE will be used to ensure non-falsifiable provenance. + # If set to "none", then Tekton will not have non-falsifiable provenance. + # This is an experimental feature and thus should still be considered an alpha feature. + enforce-nonfalsifiability: "none" + # Setting this flag will determine how Tekton pipelines will handle extracting results from the task. + # Acceptable values are "termination-message" or "sidecar-logs". + # "sidecar-logs" is now a beta feature. + results-from: "termination-message" + # Setting this flag will determine the upper limit of each task result + # This flag is optional and only associated with the previous flag, results-from + # When results-from is set to "sidecar-logs", this flag can be used to configure the upper limit of a task result + # max-result-size: "4096" + # Setting this flag to "true" will limit privileges for containers injected by Tekton into TaskRuns. + # This allows TaskRuns to run in namespaces with "restricted" pod security standards. + # Not all Kubernetes implementations support this option. + set-security-context: "false" + # Setting this flag to "true" will set readOnlyRootFilesystem in securityContext for all containers used in TaskRuns and AffinityAssistant. + set-security-context-read-only-root-filesystem: "false" + # Setting this flag to "true" will keep pod on cancellation + # allowing examination of the logs on the pods from cancelled taskruns + keep-pod-on-cancel: "false" + # Setting this flag to "true" will enable the CEL evaluation in WhenExpression + enable-cel-in-whenexpression: "false" + # Setting this flag to "true" will enable the use of Artifacts in Steps + # This feature is in preview mode and not implemented yet. Please check #7693 for updates. + enable-artifacts: "false" + # Setting this flag to "true" will enable the built-in param input validation via param enum. + enable-param-enum: "false" + # Setting this flag to "pipeline,pipelinerun,taskrun" will prevent users from creating + # embedded spec Taskruns or Pipelineruns for Pipeline, Pipelinerun and taskrun + # respectively. We can specify "pipeline" to disable for Pipeline resource only. + # "pipelinerun" for Pipelinerun and "taskrun" for Taskrun. Or a combination of + # these. + disable-inline-spec: "" + # Setting this flag to "true" will enable the use of concise resolver syntax + enable-concise-resolver-syntax: "false" + # Setthing this flag to "true" will enable native Kubernetes Sidecar support + enable-kubernetes-sidecar: "false" + # Setting this flag to "false" will have no effect since StepActions are a stable feature + enable-step-actions: "true" + # Controls whether exponential backoff is enabled when creating TaskRuns or CustomRuns. + # If set to "true", the controller will use exponential backoff when retrying failed create operations, + # which can help mitigate issues caused by temporary API server or webhook unavailability. + # If set to "false", exponential backoff will be disabled. + # For advanced tuning of backoff parameters, update the 'wait-exponential-backoff' ConfigMap. + enable-wait-exponential-backoff: "false" + # Setting this flag to "true" will compress termination messages with flate + # to fit more results in the 4KB Kubernetes termination message limit. + # Only applies when results-from is set to "termination-message" (the default); + # ignored when results-from is "sidecar-logs". + # Alpha feature — this is a short-term measure. External result storage + # (TEP-0164) will address the underlying 4KB limitation. + enable-termination-message-compression: "false" + # Controls whether informer cache transforms are enabled. When enabled (default), + # the controller strips large, unnecessary metadata fields (managedFields and the + # kubectl last-applied-configuration annotation) from PipelineRuns, TaskRuns, + # CustomRuns, and Pods stored in the informer cache to reduce memory usage. + # + # Set to "false" to disable if you encounter issues with missing data in cached objects. + # Changes require a controller restart to take effect. + # + # See https://github.com/tektoncd/pipeline/issues/7691 for more info. + enable-informer-cache-transforms: "true" + +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: pipelines-info + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Contains pipelines version which can be queried by external + # tools such as CLI. Elevated permissions are already given to + # this ConfigMap such that even if we don't have access to + # other resources in the namespace we still can have access to + # this ConfigMap. + version: "v1.15.1" + +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" + +--- +# Copyright 2023 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-events + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" + +--- +# Copyright 2023 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" + +--- +# Copyright 2019 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + zap-logger-config: | + { + "level": "info", + "development": false, + "sampling": { + "initial": 100, + "thereafter": 100 + }, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + # Log level overrides + loglevel.controller: "info" + loglevel.webhook: "info" + +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + metrics-protocol: prometheus + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # OpenTelemetry Metrics Configuration + # Protocol for metrics export (prometheus, grpc, http/protobuf, none) + # Default if not specified: "none" + metrics-protocol: prometheus + + # Metrics endpoint (for grpc/http protocols) + # Default: empty (uses default OTLP endpoint) + metrics-endpoint: "" + + # Metrics export interval (e.g., "30s", "1m") + # Default: empty (uses default interval) + metrics-export-interval: "" + + # OpenTelemetry Tracing Configuration + # Protocol for tracing export (grpc, http/protobuf, none, stdout) + # Default: none + tracing-protocol: none + + # Tracing endpoint (for grpc/http protocols) + # Default: empty + tracing-endpoint: "" + + # Tracing sampling rate (0.0 to 1.0) + # Default: 1.0 (100% sampling) + tracing-sampling-rate: "1.0" + + # Runtime Configuration + # Enable profiling (enabled, disabled) + # Default: disabled + runtime-profiling: disabled + + # Runtime export interval (e.g., "15s") + # Default: 15s + runtime-export-interval: "15s" + + # Note: Legacy OpenCensus configuration (metrics.backend-destination, etc.) has been + # removed as OpenCensus support is no longer provided by the underlying infrastructure. + # Please use the OpenTelemetry configuration options above. + + # Tekton-specific metrics configuration + metrics.taskrun.level: "task" + metrics.taskrun.duration-type: "histogram" + metrics.pipelinerun.level: "pipeline" + metrics.pipelinerun.duration-type: "histogram" + metrics.count.enable-reason: "false" + metrics.running-pipelinerun.level: "" + +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-registry-cert + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +# data: +# # Registry's self-signed certificate +# cert: | + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-spire + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # spire-trust-domain specifies the SPIRE trust domain to use. + # spire-trust-domain: "example.org" + # + # spire-socket-path specifies the SPIRE agent socket for SPIFFE workload API. + # spire-socket-path: "unix:///spiffe-workload-api/spire-agent.sock" + # + # spire-server-addr specifies the SPIRE server address for workload/node registration. + # spire-server-addr: "spire-server.spire.svc.cluster.local:8081" + # + # spire-node-alias-prefix specifies the SPIRE node alias prefix to use. + # spire-node-alias-prefix: "/tekton-node/" + +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# NOTE: Exported traces may include Kubernetes resource identifiers (e.g. TaskRun/PipelineRun +# names and namespaces) as span attributes. Treat the trace backend as a trusted observability +# system. See docs/developers/tracing.md for details. +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-tracing + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # + # Enable sending traces to defined endpoint by setting this to true + enabled: "true" + # + # API endpoint to send the traces to + # (optional): The default value is given below + endpoint: "http://jaeger-collector.jaeger.svc.cluster.local:4318/v1/traces" + # (optional) Name of the k8s secret which contains basic auth credentials + credentialsSecret: "jaeger-creds" + +--- +# Copyright 2025 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# This ConfigMap allows cluster operators to configure the exponential backoff +# parameters used by Tekton Pipelines when retrying Kubernetes API operations, +# such as creating TaskRuns or CustomRuns. Adjusting these values can help +# tune retry behavior in response to webhook timeouts or transient errors. +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-wait-exponential-backoff + namespace: tekton-pipelines + labels: + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + duration: "10s" # The initial duration before the first retry (Go duration string, e.g. "1s"). + factor: "2.0" # The factor by which the duration increases after each retry (should not be negative). + jitter: "0.0" # Jitter factor (0.0 = no jitter, 0.2 = up to 20% random additional wait). + steps: "5" # The number of times the duration may change (number of backoff steps). + cap: "60s" # The maximum duration between retries (Go duration string, e.g. "30s"). + +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-pipelines-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.1" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-controller + version: "v1.15.1" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-controller + containers: + - name: tekton-pipelines-controller + image: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.15.1@sha256:89633d2774dab0497d30cb2ca73e7c2fff94687a38e2652c3c47075ac7890c40 + args: [ + # These images are built on-demand by `ko resolve` and are replaced + # by image references by digest. + "-entrypoint-image", "ghcr.io/tektoncd/pipeline/entrypoint-bff0a22da108bc2f16c818c97641a296:v1.15.1@sha256:84e497833db4d2d7201153784928428dd7139d6968281b73f032d860c0133618", + "-nop-image", "ghcr.io/tektoncd/pipeline/nop-8eac7c133edad5df719dc37b36b62482:v1.15.1@sha256:b233f4ef22a62268ae89c6d54b3cb2be9c903f229742a480e4abe5497d6aab5d", + "-sidecarlogresults-image", "ghcr.io/tektoncd/pipeline/sidecarlogresults-7501c6a20d741631510a448b48ab098f:v1.15.1@sha256:0dda297d99e2d67eaab16484cb984f545b429f000750950e63c9eaf6fbad3dfa", + "-workingdirinit-image", "ghcr.io/tektoncd/pipeline/workingdirinit-0c558922ec6a1b739e550e349f2d5fc1:v1.15.1@sha256:3fa8a3f41c0828807e969dd376881656097d53308274caac6145c0a4b4d110bb", + # The shell image must allow root in order to create directories and copy files to PVCs. + # cgr.dev/chainguard/busybox as of April 14 2022 + # image shall not contains tag, so it will be supported on a runtime like cri-o + "-shell-image", "cgr.dev/chainguard/busybox@sha256:19f02276bf8dbdd62f069b922f10c65262cc34b710eea26ff928129a736be791", + # for script mode to work with windows we need a powershell image + # pinning to nanoserver tag as of July 15 2021 + "-shell-image-win", "mcr.microsoft.com/powershell:nanoserver@sha256:b6d5ff841b78bdf2dfed7550000fd4f3437385b8fa686ec0f010be24777654d6"] + volumeMounts: + - name: config-logging + mountPath: /etc/config-logging + - name: config-registry-cert + mountPath: /etc/config-registry-cert + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_DEFAULTS_NAME + value: config-defaults + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-controller + - name: CONFIG_SPIRE + value: config-spire + - name: SSL_CERT_FILE + value: /etc/config-registry-cert/cert + - name: SSL_CERT_DIR + value: /etc/ssl/certs + - name: METRICS_DOMAIN + value: tekton.dev/pipeline + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + volumes: + - name: config-logging + configMap: + name: config-logging + - name: config-registry-cert + configMap: + name: config-registry-cert +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-controller + version: "v1.15.1" + name: tekton-pipelines-controller + namespace: tekton-pipelines +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: controller + app.kubernetes.io/component: controller + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-events-controller + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.1" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + app: tekton-events-controller + version: "v1.15.1" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + serviceAccountName: tekton-events-controller + containers: + - name: tekton-events-controller + image: ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.15.1@sha256:a816daf2107b5c10dd17c14d125989d5d109f7d928aaf8c88b1c189c34846376 + args: [] + volumeMounts: + - name: config-logging + mountPath: /etc/config-logging + - name: config-registry-cert + mountPath: /etc/config-registry-cert + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_DEFAULTS_NAME + value: config-defaults + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-events + - name: SSL_CERT_FILE + value: /etc/config-registry-cert/cert + - name: SSL_CERT_DIR + value: /etc/ssl/certs + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + volumes: + - name: config-logging + configMap: + name: config-logging + - name: config-registry-cert + configMap: + name: config-registry-cert +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + app: tekton-events-controller + version: "v1.15.1" + name: tekton-events-controller + namespace: tekton-pipelines +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: events + app.kubernetes.io/component: events + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: Namespace +metadata: + name: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + pod-security.kubernetes.io/enforce: restricted + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + # ClusterRole for resolvers to monitor and update resolutionrequests. + name: tekton-pipelines-resolvers-resolution-request-updates + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + - apiGroups: ["resolution.tekton.dev"] + resources: ["resolutionrequests", "resolutionrequests/status"] + verbs: ["get", "list", "watch", "update", "patch"] + - apiGroups: ["tekton.dev"] + resources: ["tasks", "pipelines", "stepactions"] + verbs: ["get", "list"] + # Read-only access to these. + - apiGroups: [""] + resources: ["secrets", "serviceaccounts"] + verbs: ["get", "list", "watch"] + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: tekton-pipelines-resolvers-namespace-rbac + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +rules: + # Needed to watch and load configuration and secret data. + - apiGroups: [""] + resources: ["configmaps", "secrets"] + verbs: ["get", "list", "update", "watch"] + # This is needed by leader election to run the controller in HA. + - apiGroups: ["coordination.k8s.io"] + resources: ["leases"] + verbs: ["get", "list", "create", "update", "delete", "patch", "watch"] + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers +roleRef: + kind: ClusterRole + name: tekton-pipelines-resolvers-resolution-request-updates + apiGroup: rbac.authorization.k8s.io + +--- +# Copyright 2021 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: tekton-pipelines-resolvers-namespace-rbac + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +subjects: + - kind: ServiceAccount + name: tekton-pipelines-resolvers + namespace: tekton-pipelines-resolvers +roleRef: + kind: Role + name: tekton-pipelines-resolvers-namespace-rbac + apiGroup: rbac.authorization.k8s.io + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: bundleresolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # the default service account name to use for bundle requests. + default-service-account: "default" + # The default layer kind in the bundle image. + default-kind: "task" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources + # "auto" - Only cache bundles with digest references (@sha256:...) + # default-cache-mode: "auto" + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: cluster-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The default kind to fetch. + default-kind: "task" + # The default namespace to look for resources in. + default-namespace: "" + # An optional comma-separated list of namespaces which the resolver is allowed to access. Defaults to empty, meaning all namespaces are allowed. + allowed-namespaces: "" + # An optional comma-separated list of namespaces which the resolver is blocked from accessing. Defaults to empty, meaning all namespaces are allowed. + blocked-namespaces: "" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources (recommended for cluster resolver since resources are mutable) + # "auto" - Never cache for cluster resolver (same as "never") + # default-cache-mode: "auto" + +--- +# Copyright 2019 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: resolvers-feature-flags + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Setting this flag to "true" enables remote resolution of Tekton OCI bundles. + enable-bundles-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines via the Tekton Hub. + enable-hub-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from Git repositories. + enable-git-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from other namespaces within the cluster. + enable-cluster-resolver: "true" + # Setting this flag to "true" enables remote resolution of tasks and pipelines from HTTP URLs. + enable-http-resolver: "true" + +--- +# Copyright 2020 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-leader-election-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" + +--- +# Copyright 2019 Tekton Authors LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-logging + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + zap-logger-config: | + { + "level": "info", + "development": false, + "sampling": { + "initial": 100, + "thereafter": 100 + }, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "severity", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "message", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + # Log level overrides + loglevel.controller: "info" + loglevel.webhook: "info" + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: config-observability + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + metrics-protocol: prometheus + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # OpenTelemetry Metrics Configuration + # Protocol for metrics export (prometheus, grpc, http/protobuf, none) + # Default if not specified: "none" + metrics-protocol: prometheus + + # Metrics endpoint (for grpc/http protocols) + # Default: empty (uses default OTLP endpoint) + metrics-endpoint: "" + + # Metrics export interval (e.g., "30s", "1m") + # Default: empty (uses default interval) + metrics-export-interval: "" + + # OpenTelemetry Tracing Configuration + # Protocol for tracing export (grpc, http/protobuf, none, stdout) + # Default: none + tracing-protocol: none + + # Tracing endpoint (for grpc/http protocols) + # Default: empty + tracing-endpoint: "" + + # Tracing sampling rate (0.0 to 1.0) + # Default: 1.0 (100% sampling) + tracing-sampling-rate: "1.0" + + # Runtime Configuration + # Enable profiling (enabled, disabled) + # Default: disabled + runtime-profiling: disabled + + # Runtime export interval (e.g., "15s") + # Default: 15s + runtime-export-interval: "15s" + + # Note: Legacy OpenCensus configuration (metrics.backend-destination, etc.) has been + # removed as OpenCensus support is no longer provided by the underlying infrastructure. + # Please use the OpenTelemetry configuration options above. + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: git-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The maximum amount of time a single anonymous cloning resolution may take. + fetch-timeout: "1m" + # The git url to fetch the remote resource from when using anonymous cloning. + default-url: "https://github.com/tektoncd/catalog.git" + # The git revision to fetch the remote resource from with either anonymous cloning or the authenticated API. + default-revision: "main" + # The SCM type to use with the authenticated API. Can be github, gitlab, gitea, bitbucketserver, bitbucketcloud + scm-type: "github" + # The SCM server URL to use with the authenticated API. Not needed when using github.com, gitlab.com, or BitBucket Cloud + server-url: "" + # The Kubernetes secret containing the API token for the SCM provider. Required when using the authenticated API. + api-token-secret-name: "" + # The key in the API token secret containing the actual token. Required when using the authenticated API. + api-token-secret-key: "" + # The namespace containing the API token secret. Defaults to "default". + api-token-secret-namespace: "default" + # The default organization to look for repositories under when using the authenticated API, + # if not specified in the resolver parameters. Optional. + default-org: "" + # Optional: Default cache mode for this resolver. Valid values: "always", "never", "auto" (default: "auto") + # "always" - Always cache resolved resources + # "never" - Never cache resolved resources + # "auto" - Only cache when revision is a commit hash + # default-cache-mode: "auto" + # Optional: Backoff configuration for retrying failed git resolution requests. + # These settings control the exponential backoff behavior when transient errors occur. + # backoff-duration: "2s" + # backoff-factor: "2.0" + # backoff-jitter: "0.1" + # backoff-steps: "2" # total number of resolution attempts (must be >= 1) + # backoff-cap: "10s" + +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: http-resolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # The maximum amount of time the http resolver will wait for a response from the server. + fetch-timeout: "1m" + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: hubresolver-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # the default Tekton Hub catalog from where to pull the resource. + default-tekton-hub-catalog: "Tekton" + # the default Artifact Hub Task catalog from where to pull the resource. + default-artifact-hub-task-catalog: "tekton-catalog-tasks" + # the default Artifact Hub Pipeline catalog from where to pull the resource. + default-artifact-hub-pipeline-catalog: "tekton-catalog-pipelines" + # the default layer kind in the hub image. + default-kind: "task" + # the default hub source to pull the resource from. + default-type: "artifact" + # Ordered list of Artifact Hub API URLs to try. First successful response wins. + # If not set, the ARTIFACT_HUB_API env var or default (https://artifacthub.io) is used. + # URLs must use http or https scheme. + # artifact-hub-urls: | + # - https://internal-hub.example.com/ + # - https://artifacthub.io/ + # Ordered list of Tekton Hub API URLs to try. First successful response wins. + # If not set, the TEKTON_HUB_API env var is used. + # URLs must use http or https scheme. + # tekton-hub-urls: | + # - https://api.hub.tekton.dev/ + +--- +# Copyright 2025 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: v1 +kind: ConfigMap +metadata: + name: resolver-cache-config + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines +data: + # Maximum number of entries in the resolver cache + max-size: "1000" + # Time-to-live for cache entries (examples: 5m, 10m, 1h) + ttl: "5m" + +--- +# Copyright 2022 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: apps/v1 +kind: Deployment +metadata: + name: tekton-pipelines-remote-resolvers + namespace: tekton-pipelines-resolvers + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.1" +spec: + replicas: 1 + selector: + matchLabels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-resolvers + version: "v1.15.1" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-resolvers + containers: + - name: controller + image: ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.15.1@sha256:b525f8a04d7a299e5e68c9d774a98b25c50357e802303a6fe6810b52d7f4daca + command: + - /sbin/tini + - -- + - /ko-app/resolvers + args: [] + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 1000m + memory: 4Gi + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + # This must match the value of the environment variable PROBES_PORT. + - name: probes + containerPort: 8080 + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the controller's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-resolvers + - name: METRICS_DOMAIN + value: tekton.dev/resolution + - name: PROBES_PORT + value: "8080" + - name: TEKTON_HUB_API + value: "" # Override this env var to set a private hub api endpoint + - name: ARTIFACT_HUB_API + value: "https://artifacthub.io/" + volumeMounts: + - name: tmp-clone-volume + mountPath: "/tmp" + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + runAsNonRoot: true + runAsUser: 65532 + capabilities: + drop: + - "ALL" + seccompProfile: + type: RuntimeDefault + volumes: + - name: tmp-clone-volume + emptyDir: + sizeLimit: 4Gi + +--- +# Copyright 2023 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-remote-resolvers + version: "v1.15.1" + name: tekton-pipelines-remote-resolvers + namespace: tekton-pipelines-resolvers +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + - name: http-profiling + port: 8008 + targetPort: 8008 + - name: probes + port: 8080 + selector: + app.kubernetes.io/name: resolvers + app.kubernetes.io/component: resolvers + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.1" +spec: + minReplicas: 1 + maxReplicas: 5 + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: tekton-pipelines-webhook + metrics: + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: 100 + +--- +# Copyright 2020 The Tekton Authors +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# https://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +apiVersion: apps/v1 +kind: Deployment +metadata: + # Note: the Deployment name must be the same as the Service name specified in + # config/400-webhook-service.yaml. If you change this name, you must also + # change the value of WEBHOOK_SERVICE_NAME below. + name: tekton-pipelines-webhook + namespace: tekton-pipelines + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + version: "v1.15.1" +spec: + selector: + matchLabels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + template: + metadata: + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-webhook + version: "v1.15.1" + spec: + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/os + operator: NotIn + values: + - windows + podAntiAffinity: + preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + topologyKey: kubernetes.io/hostname + weight: 100 + serviceAccountName: tekton-pipelines-webhook + containers: + - name: webhook + # This is the Go import path for the binary that is containerized + # and substituted here. + image: ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.15.1@sha256:8eb820ac797ac7a2efe1bf99f2c548f3ef208d28ac5c97ee51d36ae3181b6040 + # Resource request required for autoscaler to take any action for a metric + resources: + requests: + cpu: 100m + memory: 100Mi + limits: + cpu: 500m + memory: 500Mi + env: + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: KUBERNETES_MIN_VERSION + value: "v1.28.0" + # If you are changing these names, you will also need to update + # the webhook's Role in 200-role.yaml to include the new + # values in the "configmaps" "get" rule. + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_OBSERVABILITY_NAME + value: config-observability + - name: CONFIG_LEADERELECTION_NAME + value: config-leader-election-webhook + - name: CONFIG_FEATURE_FLAGS_NAME + value: feature-flags + # If you change PROBES_PORT, you will also need to change the + # containerPort "probes" to the same value. + - name: PROBES_PORT + value: "8080" + # If you change WEBHOOK_PORT, you will also need to change the + # containerPort "https-webhook" to the same value. + - name: WEBHOOK_PORT + value: "8443" + # if you change WEBHOOK_ADMISSION_CONTROLLER_NAME, you will also need to update + # the webhooks.name in 500-webhooks.yaml to include the new names of admission webhooks. + # Additionally, you will also need to change the resource names (metadata.name) of + # "MutatingWebhookConfiguration" and "ValidatingWebhookConfiguration" in 500-webhooks.yaml + # to reflect the change in the name of the admission webhook. + # Followed by changing the webhook's Role in 200-clusterrole.yaml to update the "resourceNames" of + # "mutatingwebhookconfigurations" and "validatingwebhookconfigurations" resources. + - name: WEBHOOK_ADMISSION_CONTROLLER_NAME + value: webhook.pipeline.tekton.dev + - name: WEBHOOK_SERVICE_NAME + value: tekton-pipelines-webhook + - name: WEBHOOK_SECRET_NAME + value: webhook-certs + - name: METRICS_DOMAIN + value: tekton.dev/pipeline + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - "ALL" + # User 65532 is the distroless nonroot user ID + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + ports: + - name: metrics + containerPort: 9090 + - name: profiling + containerPort: 8008 + # This must match the value of the environment variable WEBHOOK_PORT. + - name: https-webhook + containerPort: 8443 + # This must match the value of the environment variable PROBES_PORT. + - name: probes + containerPort: 8080 + livenessProbe: + httpGet: + path: /health + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + readinessProbe: + httpGet: + path: /readiness + port: probes + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/version: "v1.15.1" + app.kubernetes.io/part-of: tekton-pipelines + # tekton.dev/release value replaced with inputs.params.versionTag in pipeline/tekton/publish.yaml + pipeline.tekton.dev/release: "v1.15.1" + # labels below are related to istio and should not be used for resource lookup + app: tekton-pipelines-webhook + version: "v1.15.1" + name: tekton-pipelines-webhook + namespace: tekton-pipelines +spec: + ports: + # Define metrics and profiling for them to be accessible within service meshes. + - name: http-metrics + port: 9090 + targetPort: metrics + - name: http-profiling + port: 8008 + targetPort: profiling + - name: https-webhook + port: 443 + targetPort: https-webhook + - name: probes + port: 8080 + targetPort: probes + selector: + app.kubernetes.io/name: webhook + app.kubernetes.io/component: webhook + app.kubernetes.io/instance: default + app.kubernetes.io/part-of: tekton-pipelines + +--- diff --git a/packs/tekton-pipelines-1.15.1/pack.json b/packs/tekton-pipelines-1.15.1/pack.json new file mode 100644 index 00000000..6b47e966 --- /dev/null +++ b/packs/tekton-pipelines-1.15.1/pack.json @@ -0,0 +1,30 @@ +{ + "name": "tekton-pipelines", + "displayName": "Tekton Pipelines", + "annotations": { + "docsURL": "https://tekton.dev/docs/pipelines/", + "description": "Tekton Pipelines", + "source": "community", + "contributor" : "spectrocloud" + }, + "version": "1.15.1", + "kubeManifests": [ + "manifests/release.yaml" + ], + "layer": "addon", + "addonType": "system app", + "cloudTypes": [ + "all" + ], + "constraints": { + "dependencies": [ + { + "packName": "kubernetes", + "layer": "k8s", + "minVersion": "1.29", + "maxVersion": "", + "type": "optional" + } + ] + } +} \ No newline at end of file diff --git a/packs/tekton-pipelines-1.15.1/schema.yaml b/packs/tekton-pipelines-1.15.1/schema.yaml new file mode 100644 index 00000000..9d2e7a76 --- /dev/null +++ b/packs/tekton-pipelines-1.15.1/schema.yaml @@ -0,0 +1,2 @@ +pack.namespace: + schema: '{{ readonly }}' diff --git a/packs/tekton-pipelines-1.15.1/values.yaml b/packs/tekton-pipelines-1.15.1/values.yaml new file mode 100644 index 00000000..87500cf0 --- /dev/null +++ b/packs/tekton-pipelines-1.15.1/values.yaml @@ -0,0 +1,8 @@ +pack: + content: + images: + - image: ghcr.io/tektoncd/pipeline/controller-10a3e32792f33651396d02b6855a6e36:v1.15.1@sha256:89633d2774dab0497d30cb2ca73e7c2fff94687a38e2652c3c47075ac7890c40 + - image: ghcr.io/tektoncd/pipeline/events-a9042f7efb0cbade2a868a1ee5ddd52c:v1.15.1@sha256:a816daf2107b5c10dd17c14d125989d5d109f7d928aaf8c88b1c189c34846376 + - image: ghcr.io/tektoncd/pipeline/resolvers-ff86b24f130c42b88983d3c13993056d:v1.15.1@sha256:b525f8a04d7a299e5e68c9d774a98b25c50357e802303a6fe6810b52d7f4daca + - image: ghcr.io/tektoncd/pipeline/webhook-d4749e605405422fd87700164e31b2d1:v1.15.1@sha256:8eb820ac797ac7a2efe1bf99f2c548f3ef208d28ac5c97ee51d36ae3181b6040 + namespace: "tekton-pipelines" \ No newline at end of file From 8fc314f33af6009ec641c41f8678afeea08761be Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Mon, 31 Aug 2026 09:45:32 -0500 Subject: [PATCH 10/10] modified: packs/tekton-pipelines-1.15.1/README.md --- packs/tekton-pipelines-1.15.1/README.md | 32 +++---------------------- 1 file changed, 3 insertions(+), 29 deletions(-) diff --git a/packs/tekton-pipelines-1.15.1/README.md b/packs/tekton-pipelines-1.15.1/README.md index 74e53923..75e47913 100644 --- a/packs/tekton-pipelines-1.15.1/README.md +++ b/packs/tekton-pipelines-1.15.1/README.md @@ -25,38 +25,12 @@ The following tables lists the configurable parameters of the Tekton Pipelines c ## Upgrade -To upgrade an existing installation of the Tekton Pipelines chart: - -```bash -helm repo update -helm upgrade tekton-pipelines /tekton-pipelines \ - --namespace tekton-pipelines \ - --values overrides.yaml -``` - -**Note:** Before upgrading, particularly across major versions, it is recommended to ensure no critical `PipelineRuns` or `TaskRuns` are actively executing. You may also want to use tools like `yq` or `jq` to audit your custom configuration overrides against the newly released default `values.yaml` to ensure compatibility. +**Note:** Before upgrading, particularly across major versions, it is recommended to ensure no critical `PipelineRuns` or `TaskRuns` are actively executing. ## Usage -To install the chart with the release name `tekton-pipelines`: - -```bash -# Add the Helm repository -helm repo add tekton-charts -helm repo update - -# Install the chart -helm install tekton-pipelines tekton-charts/tekton-pipelines \ - --namespace tekton-pipelines \ - --create-namespace -``` - -Once deployed, you can verify that the controllers are running: - -```bash -kubectl get pods -n tekton-pipelines -``` - +To install `tekton-pipelines`, deploy a tekton-pipelines addon profile on cluster. + You are now ready to deploy Tekton resources. For instance, to test your setup with a simple Task: ```bash