From 240b0a2d69b6ecd65a0ced4935f46f711e556671 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Thu, 5 Mar 2026 10:24:42 -0500 Subject: [PATCH 1/9] new file: packs/kubewatch-3.5.0/README.md new file: packs/kubewatch-3.5.0/charts/kubewatch-3.5.0.tgz new file: packs/kubewatch-3.5.0/charts/kubewatch/.helmignore new file: packs/kubewatch-3.5.0/charts/kubewatch/Chart.lock new file: packs/kubewatch-3.5.0/charts/kubewatch/Chart.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/README.md new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml new file: packs/kubewatch-3.5.0/charts/kubewatch/values.yaml new file: packs/kubewatch-3.5.0/logo.png new file: packs/kubewatch-3.5.0/pack.json new file: packs/kubewatch-3.5.0/values.yaml --- packs/kubewatch-3.5.0/README.md | 329 ++++++++++++ .../charts/kubewatch-3.5.0.tgz | Bin 0 -> 27092 bytes .../charts/kubewatch/.helmignore | 21 + .../charts/kubewatch/Chart.lock | 6 + .../charts/kubewatch/Chart.yaml | 26 + .../charts/kubewatch/README.md | 325 ++++++++++++ .../kubewatch/charts/common/.helmignore | 22 + .../charts/kubewatch/charts/common/Chart.yaml | 23 + .../charts/kubewatch/charts/common/README.md | 346 +++++++++++++ .../charts/common/templates/_affinities.tpl | 102 ++++ .../charts/common/templates/_capabilities.tpl | 128 +++++ .../charts/common/templates/_errors.tpl | 23 + .../charts/common/templates/_images.tpl | 75 +++ .../charts/common/templates/_ingress.tpl | 68 +++ .../charts/common/templates/_labels.tpl | 18 + .../charts/common/templates/_names.tpl | 63 +++ .../charts/common/templates/_secrets.tpl | 140 +++++ .../charts/common/templates/_storage.tpl | 23 + .../charts/common/templates/_tplvalues.tpl | 13 + .../charts/common/templates/_utils.tpl | 62 +++ .../charts/common/templates/_warnings.tpl | 14 + .../templates/validations/_cassandra.tpl | 72 +++ .../common/templates/validations/_mariadb.tpl | 103 ++++ .../common/templates/validations/_mongodb.tpl | 108 ++++ .../templates/validations/_postgresql.tpl | 129 +++++ .../common/templates/validations/_redis.tpl | 76 +++ .../templates/validations/_validations.tpl | 46 ++ .../kubewatch/charts/common/values.yaml | 5 + .../charts/kubewatch/templates/NOTES.txt | 11 + .../charts/kubewatch/templates/_helpers.tpl | 33 ++ .../kubewatch/templates/clusterrole.yaml | 84 +++ .../templates/clusterrolebinding.yaml | 22 + .../charts/kubewatch/templates/configmap.yaml | 51 ++ .../kubewatch/templates/deployment.yaml | 136 +++++ .../kubewatch/templates/extra-list.yaml | 4 + .../kubewatch/templates/serviceaccount.yaml | 21 + .../charts/kubewatch/values.yaml | 474 +++++++++++++++++ packs/kubewatch-3.5.0/logo.png | Bin 0 -> 22320 bytes packs/kubewatch-3.5.0/pack.json | 28 + packs/kubewatch-3.5.0/values.yaml | 490 ++++++++++++++++++ 40 files changed, 3720 insertions(+) create mode 100644 packs/kubewatch-3.5.0/README.md create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch-3.5.0.tgz create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/.helmignore create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/Chart.lock create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/Chart.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/README.md create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml create mode 100644 packs/kubewatch-3.5.0/charts/kubewatch/values.yaml create mode 100644 packs/kubewatch-3.5.0/logo.png create mode 100644 packs/kubewatch-3.5.0/pack.json create mode 100644 packs/kubewatch-3.5.0/values.yaml diff --git a/packs/kubewatch-3.5.0/README.md b/packs/kubewatch-3.5.0/README.md new file mode 100644 index 00000000..45d8d9a8 --- /dev/null +++ b/packs/kubewatch-3.5.0/README.md @@ -0,0 +1,329 @@ + + +# Kubewatch packaged by Bitnami + +Kubewatch is a Kubernetes watcher that currently publishes notification to Slack. Run it in your k8s cluster, and you will get event notifications in a slack channel. + +[Overview of Kubewatch](https://github.com/bitnami-labs/kubewatch) + +## TL;DR + +```console +$ helm repo add robusta https://robusta-charts.storage.googleapis.com && helm repo update +$ helm install my-release robusta/kubewatch +``` + +## Introduction + +This chart bootstraps a kubewatch deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.2.0+ + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm install my-release bitnami/kubewatch +``` + +The command deploys kubewatch on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ------------------------- | ----------------------------------------------- | ----- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | + + +### Common parameters + +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | -------------- | +| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | +| `nameOverride` | String to partially override common.names.fullname template | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the the deployment(s)/statefulset(s) | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the the deployment(s)/statefulset(s) | `["infinity"]` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | + + +### Kubewatch parameters + +| Name | Description | Value | +| ---------------------------------------- | -------------------------------------------------------------------------------- | ---------------------- | +| `image.registry` | Kubewatch image registry | `docker.io` | +| `image.repository` | Kubewatch image repository | `bitnami/kubewatch` | +| `image.tag` | Kubewatch image tag (immutable tags are recommended) | `0.1.0-debian-10-r513` | +| `image.pullPolicy` | Kubewatch image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `hostAliases` | Add deployment host aliases | `[]` | +| `slack.enabled` | Enable Slack notifications | `true` | +| `slack.channel` | Slack channel to notify | `XXXX` | +| `slack.token` | Slack API token | `XXXX` | +| `hipchat.enabled` | Enable HipChat notifications | `false` | +| `hipchat.room` | HipChat room to notify | `""` | +| `hipchat.token` | HipChat token | `""` | +| `hipchat.url` | HipChat URL | `""` | +| `mattermost.enabled` | Enable Mattermost notifications | `false` | +| `mattermost.channel` | Mattermost channel to notify | `""` | +| `mattermost.url` | Mattermost URL | `""` | +| `mattermost.username` | Mattermost user to notify | `""` | +| `flock.enabled` | Enable Flock notifications | `false` | +| `flock.url` | Flock URL | `""` | +| `msteams.enabled` | Enable Microsoft Teams notifications | `false` | +| `msteams.webhookurl` | Microsoft Teams webhook URL | `""` | +| `webhook.enabled` | Enable Webhook notifications | `false` | +| `webhook.url` | Webhook URL | `""` | +| `smtp.enabled` | Enable SMTP (email) notifications | `false` | +| `smtp.to` | Destination email address (required) | `""` | +| `smtp.from` | Source email address (required) | `""` | +| `smtp.hello` | SMTP hello field (optional) | `""` | +| `smtp.smarthost` | SMTP server address (name:port) (required) | `""` | +| `smtp.subject` | Source email subject | `""` | +| `smtp.auth.username` | Username for LOGIN and PLAIN auth mech | `""` | +| `smtp.auth.password` | Password for LOGIN and PLAIN auth mech | `""` | +| `smtp.auth.secret` | Secret for CRAM-MD5 auth mech | `""` | +| `smtp.auth.identity` | Identity for PLAIN auth mech | `""` | +| `smtp.requireTLS` | Force STARTTLS. Set to `true` or `false` | `""` | +| `namespaceToWatch` | Namespace to watch, leave it empty for watching all | `""` | +| `resourcesToWatch.deployment` | Watch changes to Deployments | `true` | +| `resourcesToWatch.replicationcontroller` | Watch changes to ReplicationControllers | `false` | +| `resourcesToWatch.replicaset` | Watch changes to ReplicaSets | `false` | +| `resourcesToWatch.daemonset` | Watch changes to DaemonSets | `false` | +| `resourcesToWatch.services` | Watch changes to Services | `false` | +| `resourcesToWatch.pod` | Watch changes to Pods | `true` | +| `resourcesToWatch.job` | Watch changes to Jobs | `false` | +| `resourcesToWatch.persistentvolume` | Watch changes to PersistentVolumes | `false` | +| `command` | Override default container command (useful when using custom images) | `[]` | +| `args` | Override default container args (useful when using custom images) | `[]` | +| `lifecycleHooks` | for the Kubewatch container(s) to automate configuration before or after startup | `{}` | +| `extraEnvVars` | Extra environment variables to be set on Kubewatch container | `[]` | +| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` | +| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` | + + +### Kubewatch deployment parameters + +| Name | Description | Value | +| --------------------------------------- | ----------------------------------------------------------------------------------------- | --------------- | +| `replicaCount` | Number of Kubewatch replicas to deploy | `1` | +| `podSecurityContext.enabled` | Enable Kubewatch containers' SecurityContext | `false` | +| `podSecurityContext.fsGroup` | Set Kubewatch containers' SecurityContext fsGroup | `""` | +| `containerSecurityContext.enabled` | Enable Kubewatch pods' Security Context | `false` | +| `containerSecurityContext.runAsUser` | Set Kubewatch pods' SecurityContext runAsUser | `""` | +| `containerSecurityContext.runAsNonRoot` | Set Kubewatch pods' SecurityContext runAsNonRoot | `""` | +| `resources.limits` | The resources limits for the Kubewatch container | `{}` | +| `resources.requests` | The requested resources for the Kubewatch container | `{}` | +| `startupProbe.enabled` | Enable startupProbe | `false` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | +| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `livenessProbe.enabled` | Enable livenessProbe | `false` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readinessProbe.enabled` | Enable readinessProbe | `false` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `customStartupProbe` | Override default startup probe | `{}` | +| `customLivenessProbe` | Override default liveness probe | `{}` | +| `customReadinessProbe` | Override default readiness probe | `{}` | +| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` | +| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` | +| `affinity` | Affinity for pod assignment | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Tolerations for pod assignment | `[]` | +| `priorityClassName` | Controller priorityClassName | `""` | +| `schedulerName` | Name of the k8s scheduler (other than default) | `""` | +| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | +| `podLabels` | Extra labels for Kubewatch pods | `{}` | +| `podAnnotations` | Annotations for Kubewatch pods | `{}` | +| `extraVolumes` | Optionally specify extra list of additional volumes for Kubewatch pods | `[]` | +| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Kubewatch container(s) | `[]` | +| `updateStrategy.type` | Deployment strategy type. | `RollingUpdate` | +| `initContainers` | Add additional init containers to the Kubewatch pods | `[]` | +| `sidecars` | Add additional sidecar containers to the Kubewatch pods | `[]` | + + +### RBAC parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------- | +| `rbac.create` | Whether to create & use RBAC resources or not | `false` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `serviceAccount.name` | Name of the service account to use. If not set and create is true, a name is generated using the fullname template. | `""` | +| `serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | + + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install my-release bitnami/kubewatch \ + --set=slack.channel="#bots",slack.token="XXXX-XXXX-XXXX" +``` + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +$ helm install my-release -f values.yaml bitnami/kubewatch +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +## Configuration and installation details + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Create a Slack bot + +Open [https://my.slack.com/services/new/bot](https://my.slack.com/services/new/bot) to create a new Slack bot. +The API token can be found on the edit page (it starts with `xoxb-`). + +Invite the Bot to your channel by typing `/join @name_of_your_bot` in the Slack message area. + +### Adding extra environment variables + +In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `extraEnvVars` property. + +```yaml +extraEnvVars: + - name: LOG_LEVEL + value: debug +``` + +Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values. + +### Sidecars and Init Containers + +If you have a need for additional containers to run within the same pod as the Kubewatch app (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. + +```yaml +sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +Similarly, you can add extra init containers using the `initContainers` parameter. + +```yaml +initContainers: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +### Deploying extra resources + +There are cases where you may want to deploy extra objects, such a ConfigMap containing your app's configuration or some extra deployment with a micro service used by your app. For covering this case, the chart allows adding the full specification of other objects using the `extraDeploy` parameter. + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `affinity` parameter. Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `podAffinityPreset`, `podAntiAffinityPreset`, or `nodeAffinityPreset` parameters. + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +### To 3.0.0 + +- Chart labels were adapted to follow the [Helm charts standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels). +- This version also introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/master/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade. + +Consequences: + +- Backwards compatibility is not guaranteed. To upgrade to `3.0.0`, install a new release of the Kubewatch chart. + +### To 2.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +### To 1.0.0 + +Helm performs a lookup for the object based on its group (apps), version (v1), and kind (Deployment). Also known as its GroupVersionKind, or GVK. Changing the GVK is considered a compatibility breaker from Kubernetes' point of view, so you cannot "upgrade" those objects to the new GVK in-place. Earlier versions of Helm 3 did not perform the lookup correctly which has since been fixed to match the spec. + +In https://github.com/helm/charts/pull/17285 the `apiVersion` of the deployment resources was updated to `apps/v1` in tune with the api's deprecated, resulting in compatibility breakage. + +This major version signifies this change. + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. + +## References + +- https://github.com/robusta-dev/kubewatch diff --git a/packs/kubewatch-3.5.0/charts/kubewatch-3.5.0.tgz b/packs/kubewatch-3.5.0/charts/kubewatch-3.5.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..1f3cfcca15e04631fc0438eddfee67adbdae0f61 GIT binary patch literal 27092 zcmV*5Ky<$!iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYed)qd$IJ$r9Q{c$ijg_@1%WvuGoSeI^lXm@UUVLpg?Vhx^ zhDb<4O%W^r%F)*OefIlc0FdCTBujSEv*z-d zNX-AVyLMZ}&iz3i97RlGNm(QYErfh5$(Zr^0G&o7j)mljFB48$IHvCj7nDTiKNiGk>=bl6VXlb&+}3O<~P!%YE;o_puca;d2^Gc=es-XG8_U@RLVG5`o|?;Yd!f zM1I0KiDWoOaWV|4m=J*?Ch3U!Kn#TdLl+_TuRV00M2Jd6BQ$3TN7r8oq9-KwuSHg)N2lZLR~J5a_x5%_?(H9VaWrmSllcwf0Swo5N~l&> zBiibs361>;maQ(DVkrrqGNFEqLI$6wLJ~X`Ej`p3rh+Bh*Icl4@6s{d_YS??*5?+B zf19VM|JBfLx{U?;e|LZXprro~_a62CLp+;S+m3GT@2P2lj){;1Bqn(8@M!Ry9DH?f z@YU|YVgLE_ul&8|`{X(99~}n65yppye>)(4-~Ssv+Q3gO#Wv$ zOo+G-1F%{C4|WgtOZMNv{{ExbmXatJ{i5z-Q3K0%3&~!kl9Tv86#N%Q%P00JYmK zgtoTOD{t)SzlzNb^lN2PPv^GccVwjFTAwgtE_1l37ea%`^WO`@$ z>_Tz{PBMj>q&N)c858Ph%>%l6qa+N~Ur3T^9Ac?hs^!8eG-JzGG^IYR)Jzdpp(zdE zH6D^sAoD-T5Dq{ba2P6a3E7+khz)-wzEpD9a%&CH@1IHlkF&KNa{pcyv{T2ze-(k; z1r(1XCM5OIlm$dBc$C0uP*W1gZP8Kd6G=u%D2V#0z-HCnuz(o$G$`l4c?22?>Kfcu zn8%zAiBUX5RYvGKN~#q)su${STfhuhK%$OieACPTjc_PP6G9f)iTS@|83QO}d=^Pe zBf^EH#zKl191LVd4kfB0BqVOa1oN>#$LgQW;h;~HH8vk@nw%v4ot&H$9F zUV7TaXKwA;lXwhOzt&c4EqJsYkeI7gJqbFC+cHM6vjoT7pU@cz(iROlp&2i;wM!Ue zpGvhP9+!%%ciVJ2O(Y15Y7Jqoz$o5Q^Q^`{2PjU$@Qj7jFE_6~p%}hZRUy>0{Ld}d%kHZ^07f;o^ zl2M5Y^i(NjA)oFb5(=W`8z_D{dduV)CxS%ssRoxD?#yB0QPvBXFM5d}ygN>4Kzh)E z=xxQEbQOhYH16tmR>CrJ50KlIZt5MlvtafTwvUErO4N$;vzhSiI7|~Em4ch%C;=Eg zCyHsU7Jz|>u}{3^IwrBW7QNIc>&7hTrn;r4dZIhmjX9lRNz#$;8I$BAp2ne7@bO(N zlDJ@uWNbKLLLP?{3nI{Q5IE`$J|V2XsTvJk^jYMSSc;w?d`5jDx)G5#j9=4e+`~c8 zC6VNmh^}PNeIos?0x!Bsy}_Sd(^5~dwS!dwUvRD!=QHp$=DmicD#meW%GzI&>1y** zdC9IxWJ({Oog(@s{jHgj z7Ql)GwbhiEgGHz7*`Kv&PT8;2l!d?R3c5cMZqc$m`ksgB*qK6uDubmwh897yL;xJj z--RYCC~jQ9MPmPh#wTi}S4U@CjWae)3&W2p^4ijxV{LKEuf9ElqS4)hS)h3>LhuM5$s-^cF*DK&a1|U?Yhx)#v(AG1VQZ zDptL*@}-e8H7e1|35ttljYe9ej8cWd!%WOI8ch;jZr=}C62Qh&5rvcVODz^oWrc`S z!{Cw?SQ4EO^AasyV_r`PsGu5Ge-uUpT@YuNjKw7KMudt<;`x!9x)U|i_mb<&H}=0? z;$OZw{O7N)_g`JU+dG)Q{doQBTh$Q-eVKu6iK&e9t5Nl)G~v9tJVV=LifPy>bZzl! z5&%kuUJ@Z`1l16LQcH18gh1Pz{FYFzO!ahD%)C402;b&R!p@zY;k?Qvz#_Dkw1);)d}6o!LL`0>!L~v{efb zPR@_tblqIr(QEmFC4i9aNcuwKl>W5sR8!Op;pOWK z<=4u~IO zuD9rOCBY$8a0YTa80 z?SeGp7GN@EQ6+?z@M#eMyMQRyzc62#YR4=nS3F}uW2Il&uw3c?uwipcgbOMpiR6rh z$&^$yo0fPFB^tr$X|@F8)yyzMt5`#camGvOx~-Bo91A!d;p|;HWZ5e_2-%yMWoyG< z+0gk=phNaW+X=doYh)xsvT52K^pcEdM9k}qFsU$sEEE~nl(Pu56!A4a_In>rIsfH%2Ewk2g5BIH{M!_DJp3KI`q zLfKF-L?fRQ*bGqSgRlS3rBDP>Q-?FV2)#8KQYk~Cdu~S08vG!E1GgDq%dyZZc7Zff z=>`z;<79yLc6X=gn<<&XX5il8(Hq)AwuZ7FTzD3SMYjO5Uj?$i3lP&P#wIzjTFvfd z$2velb<`L%I>=ysMVY-1>5N1~h%P5MpzxOtWaw=vW5OxSN>J+zeyt2d(kWqyv`{Yf&y~T9Fbxw< zE+?Fb2@3=Cjedb-`es>BBJq`kW}q(gi)K(Q_jjeft{4EtmwIuP5z@TN(?uCm2o*ay zK>OeW%j0VduO`;E9QdX1wyjmk+_{gnl~!Z#m7N*_Va7klmLBv;@O13u;N0Ul!bwOkV=m%D?#%*gofH zyKp9-vgfF1$+XIqis7SB;I%92Ww51Lq*YO^67YGBnq|mkv29gVEWnOga6HnHix65R z(HRR6Hm^_&?>uxmju)wGy#_^tNau35VYnn=X!mE{-Hk-xv=-zIz2%lKLJ=T15gE z)c*=Pl=?Y93O|L^TNaSwpl=>o^=}R<^`d}MZvU+O-IMc}RHBR2m$e7T?jg@(QrgX{ zz~-9FH8LR{k`Sq%lA$SVTQs9mJcV#g<^$BulbGz0F8)_H!c)?=nCWs05z`%XaWil3 zh@K%>7Ko^E>la__Sv)O;^FDezWENYPIASGjz$;S{t;Tja?|PZx8f5~#Ws(fa3UH@d zDQM3_nbc{VJT>%$y#*?t0wG~P!IUp(UIprcgv6JOI|C)|NE64`1ac+-v?7a@G}~AK z56MEp%^8PF=kJXUjj{wK3`5o&Am+4QV3wFu2JXBN3jzN9Y^%2XaShxQzgT$Pm=iLM zQ}jyh6y^`3_Xr0B?Jk6z5IFyyens0%np5?Wov_QX@wJ9E4yH7sLaBOlq~5Wqr%5Pj z9FlI@nvSi_p;ka!vY3TzJimyQ)o{WhA-NhM#R2*Y(w~s~t(qg2A@~jB*CE4!P{f9R zx)z15fQHm^!8Qc0(aQK5%res5u!edZ~d>I=JL+xS5^$s-Szlh775Y ziu-X8P+bJgOr6TEv|O-N+lczp8e3CyW-Qq*+4_s%&5c{4!nS*|q z5Iv1Db5;la1&%!fm~6*|aTGDxLZ*=QHWXp%#W4$sut6XiPLc&u;5ZH`394gjplV8d z98=guR=sRjM%T1|E(X&;*+M)`R%%B05K4@RZ1149QgrJ7z!AEb>Z5~;;kPpu2pbZH zj(uP0wM}~QObApLYtTKH$Mq-Es2w+b0F4r%jAIx3}HDXe;+QPI>g z-;u$`9EOLzNOLwCYASaX0h`_7)2G()*;!SI<1|B@D%5)R z%;X7CiZI5KDjV}=LPHbmpz0{$91@caMCTxQ_N>*qWNN}tW-%leNjVlxu+YwI66_$J zM1xif!DnCUTx{k5diMr(yJ;Xd;CQZ&qI+3X_@__mgB1eQu1w<4MjrI$_usoFcL~w1 zEkMZgC&a%tHsmE93sd}ak8#seCI7!nNEj0?JQ;5!70{ymk4J}x1^GWbe9Zs&FwgJ5 z_nx5{oesd57}1cZmC%c+B8xvE1N5w?8NT+=E>%z&k-z_*ZV+v!vREgzojRbA(R8Y5IR9S(zHR0;=~Q|5f_mcw#vV$wtz_Eztk_ zhtG@p|LEZPqyB%8r=W6OpM>H#H|=kQ%5f8R>AG13WBgpxC>Wp<%~EPH-+#Qw0SQRUG`ZYrFDOslZ=@MEd8b?u=Iz`cBFreiL9d^jtzY(D7YlKoOeCp(GT)6)4@8<2lz1`jZ;iLWc5Rb7Ya1<<9c2`-5_hTS_t$FUzPW(5r6In>k$w-Z~ z)zJgJmx&VzGdzIICfo9=VpSe7xnhiUs^R5#c7UX1pv`V9&yK}19OzKsbIE_D{m&uy&MgM&+)2ShaNjj)I;j;mbE^bL!Q$ zY!lDj34vmw%(R@%O_xVuHaB}^~NmY)Bs?7z$#wHX7j+5YPv9Uc|qe~$Ja*Z&Xmtg?Q0_@ZVNpT&>1~ z(!q01!dByDs!+`qS%i_C#|7EQpOCFVufOZEPT|n)x)_uX^)H2md%kxe3b03BgG1fX z_4YNHH*HEJ zx15%&I8E$K>E(*fQf0Ze^T(01m2v(ku+wHug~j7hcYfFzo!WD`>y1@i%h||z%Z?l; z5Ex%L_-1HU+P1jU21nHlU6-&k8?QnpOMt+)P?vVy*cvAIp9kUcO`j?bBE2gv$`X^dV?qhcqebaIX6>Ytk#Wq zYRcppWh3Ebi-vk*y9YU#E7I+A@AMXG)B%JD0-y4AIK8x(X!+uf!@9#g~d({6A@ob?pI13O# zVo*K&I??+up(SYEdF2~uge?+@BlmGKq$1mT!@}|MY z+h~^mql1H^{et}O9q#Wx%Kt+=|Mef;E@TqvYJ)9HN!IQDcdM1VGgj+?01fBpYwe+H zwVV`Y0%0hvbMNY;4f;HUt-fCT4UHL2$EF`TbNX?swlb9hK1cu z>Q)Q1wN9-$WK0UlajZt^y6Wm@rpWdo8^DYt#* zafHW&dw}8@C!GA2P(dXTtyb6NnZDQm+h1E)y=seGxLGI0``e8M3pi_-k&rcah!CWD-Fe|zQ~ z_25#74`*q<@SnH0vgF|%WV4EgR7jz-@TFgkfZ+&IOxsk}0SXeX=w&*ln*m~eAJIB; zCiYV=AR#fi9$nfw3{y!)Q!T4erkTFtRvbPu6| zGtP#&a`%^Sp>HASU+!A-Tb*IM^0`GXiSRjv8yTvLlxlz(k8WGHs9X1-hHuR^0PdAe zU8p0oY^ud8-MZkLm~)r6hg;sA8Nn7XV;YdCqws*cEv}mI zFaQ)DCkB>e8EYsUoU2F71gs}vJBw|LPR~hRw=Fs)dVFY$kdV0j^Hm)ln2&|g$H#mu zHjaeFgGTzGghB=IaQ12n`r{b1G8@@ja1Ad=W|N|q?4+gnl9IQ0U&pGZJ`kR@y8#3Y(xz10$MPX8nNTEQ*(3B+D|iLgVx&rLVkFCka3x}k1~Wr!Lj$=iVhL|zeHXFs&tGo>two5H zvolrWm-5(~EGN^NY}U+U4q}Zu26CH*;HqDreQP13hCDtQ|t$W&wbC87O};e|A%!cRDoCn#oQcj&6Bt_ z6yIE)p=~n7H0-QLwq}X}Vv;S8NwX4{G}1eBfEU6+z=;rO8}@GaqE%4^Vv8s?;>|XX zHWcA_!e($<7O@El!v#dU)nf=H(TI{TK-wE{KmPAZUF_&uD(==BCV&(?Ulwh#e z8#69Ds}pY-#B^@uX6DZgrKzzb3U@{fCvws}hof8cz4;FJjlO>O?dezPUmR5PJzF?~K=~h}oN% zu8L4fh?yANyDpMeMJ#5Oy1xQ3xCniXXGP}!l?|6f?EkRgx`?ervBLFTSG912_eSUL|zrKF5Q$(!6Yn^UQu7en)E?Et$ zg^1;Ii!@oV_8R$Yha|;pTXbOCJCSUPCCLX>p&=PDPSk9QN0M-xkD$EAokPsc9I;^e z23xBnno-Uo*n^m1PSuhQIBrPbPF)sNVO|5WiDLO29ZeK_Yi{QyAE{c$jk60KECT8! zvFIzbo5i7d5-;c4sI$jPh#AZAZdf%VR@|0$wuw}6D{N8UU)WL=Y^#a0 zEWM4M$G6FJNO&&lHqHC%gd^OEW>@`!X`wKyPeWI*kBs-FLO8`!RLnoNDrSYbq7Ji> zfXj{wm|d8duf=GY`m118kQXz3HK%dAs-;=X0tYR0Cvr8>tQIq#M8`rc)vu~(mPgBC zmDX7mvz2HDt-NK?Ib-r_70gVXwJ}SrBrl{>+OV~M3E@9B<%cfZG~KR*Sz(GTV5U~d zMAYDBF@qu`aBy57xf;x>5;9fbmP$Y_oziBW8VSf@1_^p`_>zQpenET|1zAYoss4rn z^$`jE6)3hYvP#qLE}&UVI0gOY;ACr`!MBZ~v;t<5P6tu5ixYfvJ0kb;ctdq?RVOB-6a@NcmYrEw7v!1eeT_LTpwkvW@ zR{NJrm|0b}HfoKS<#RPwt^-P#r31MxYBiXZZXc=LCT2l;2MUVyof_yAQXd3}j?k6; zc!j7y@bx$h*$oMhPL?u2SAvbC-iMrE?(lHsdb9FYk}CTQFpDJZZXCT^`!0`J&0Qr$ z+-}iZ7LX#*kSe-1YBe;gz8|Gx-UQ4brxCg)b0nEgsj&#J<@jt#%yj39+jtIUy1>Se zEBnFqUPcONL2ZjZDA-sroe*@aUG(ccHL~em3e)TjO=%`Jj9d+7&J8fln;DnRRWTdK ztZFn%m%`NPvuqQ+e9g={c-2Zk?&_Fj_F3eFK%R=UBHCusicf=HB z^U@SVx+HS1lUZ+c>qgVwrnV?hPH&nyB9M2Du7XM#v$}b+bbz+1wtJ*@qlndE=H`%X z)Ee(hC}B8_N?Fmhu!>qnS983^l}@zjhN-{ za;%)qb?q!XD7_rgOz7)Ax9IAeLH3OA0U3MLFL(1#6Q2cvOBPknJs~Vv!Na{g_tntM z=67B^Z{{&G^)`WA6=r&a_WbMPle-=nHlXisTehiHyJ5S^S>l>4)rWYpR?V_?h<%ga zb8&pgE&5?X^o+)kNecQGlnA1SFWaAC9I{VripJKlquIDBH)(w&qdvDvi9k07cU;I< zio}E^VE}n^09ddAj7?Zo6~^^J$EajZn5xJm;Z<}`gj$WH={+F!*Ng=fNVU6zuugYG z1san`*>fat@-&swV|b3CQH60+GD@|yIkw*`@VzEcx?N}D&x?ibfyTITsxMFS1(ZDW zO08vpZdf4fPztgWCc-RgEca1i&}o=gvguzbJ$s&-U^iESGfG$8t{UEJGJgTTkKeq8{E9kPl}II1b=RyNEvw)mo8{75naox( zXEPd*0NqR!ph5~ONDXx-0(3_P1ITk-m-Oqu(X(flG=BDMfd0u6z)5L8H=)-D2h7jg z&JUeA?j#qQrexR6%!L9XF%3=Dst?A#K<_WmX)ZTGmSinpzVHmTkhU(HrF#>0)0M23 zL;>ND2f52Nz^;PPbxL+xty2l>a>-dV4(D#-1EX|MAw2@**Nf9Mb8Y~frxS#dNF3u5w0NV^aZV!$wR19$k-vp zC?Yo|TNprqJZMtn^016dF`H1y=-nx%QC4mTsU;Ge$BHc0Vn@w#KBs^;nkAu9v}yh& z2yOFB5-hEqu{qy9WU|$I7n2Bmu%kGgdq&FG)aG3my@=fOhD>II-B_&SOv<`XX>%TA zUdzta8(A8$BnoV*IucNcVmu~jn;Orr&;-Bw$UY9cR~@g_I*n%3q=WmKf$o8^wa0>o zU|TCPU-f=vG(vw@)66ey^ouI?%aF+{oB2lLHYGx+CNU@25bHPya`AuVph|@X^3@1K z4oIw(AP$12N@?7xQZP7};m9WeVsYy1223{XIZ$+%Kwx(#C|dXs4*24W`D1U{AB_Ru9m z0YifARHJ|L2E3G|_cnmjC@?)X7xso2rMFHMk+PLet93d8geQ2W8IS~q*y&0lzk=XN z1lSvn0D;#IiNfLn$1&O_-q?fWA{n?Tk(~NqZH8<-)@&0qE(v!=4SJ7e6zfiAs~{aE zoXs&Fx}eiIoGVpMBVt%Pi+=Wf#siamtdz0PmQs_N!w9xDmkAWyE@&=DwhF9ZZg0&# zWpCa4S)B`fA@#DoI>&-mFH@NAC9-FX%K_@|?H_1HyP#7VV(v0oCP2ldsAH29SGO7Q zvOX8?(fvFy&@3Iln&Ptmj%o+7ueld5*K`9UkGwT@(o{DtyB$sv8AfSjS87x|~Y-w$q z?zcECWk^TA?o?iv)Ki9%GA)6 zHz;@N_6EU(s@Q3AMqN)m=#sNU&1VzF6tlHjO}sE+H(Ewo3+Mn zd@4)^O(20{o(~{MGT$m1Co~`pwzpnvht}|Rt9RAHLuY^PQXvu|IwlQoJmxrnJ}GIs zWN6>p^>$mWu1?5nedITwmI53b)JIGSRhDUL3H(tj@RmHgWej+I1~&~lVh5QEGL^L^p#rdeF*80V?Nh-)u16+OnuQaMSn3Y zxTVT;^ujwJv08*g{@g=v)Ntp-*bF!fma=#gsqF7L@~uNho46m84qub`Z8~uMvujY+ zBiixM8LT;W&=g-2By{8nmYG3hmoS-DPJ5=73+9Xx`AGZ(SPe&WlmKg}_00*31oFDq8puOF_-5o7Nvpst=1iHbX%BHZcQvxm~B&Zw*HR5Iv z6#L0UblIpYC!}jGS?KKOQJ&&o8BZCJ+T71VExir$Hj_bm><`CrNVU|c?|`M2Eqy#o zuW1!W`;5noW3$A`)|n%MB`jrepcce5GF{zACfTUYxou7sW;QvLGCfdBPZEw0Cu7Xh znb?x-)w|bTtM%;J50J&%APzF0%2}XiwIUJzpJ&e$N1SmogS#orYoW@m%Gv zaJoX<)&rr)Fr2Fe<3v~5gYNBH+B<;M$fhjK3NZJ|Fm)z(#G-KC@sz@H<*`a7SXH1{ z0LRpHstZXqI_X3@YM2GI9g*U7r4w>!U6vbL^;+nOIFirj2J(oPDRXEW8S z$J(s4tTF0{w_6sCxU#NP&opPSD0P@wXNqBCZJKC5c=S}F5%vkFAU#zr-=vd{dbVfS zM))McoHDDNjCLSqrRUTR7!j&@t3Rx8;ApM}IYT4sg|VS>tnYSBv#>&2G~t~mMr`g^ zAS1oi0h25nji^s?sEgHDlU1xd+xum<|I3t)jUBm_{@G0g>B2IjW0=-_ipF~IY#$^; zvwg)Z-)kpENTX|^d7;)Ak%?rS;!yO|>L#2KFhTa<-~DdPgzRRB=yC2j@RsRGMe$+C z#ywqvbX6a;;WOLoN@o7t@1@g8Ur#4mO%kp|SWWsNV{jFZaZKnH2^wOx_EB123N(iE zZreDHMQ0~Vhd%3fv|)U$G{bhb``hu*v9emOBX$!h##2Dx(45f^-_a-ld-U7)-+4+r zqp{V|-@gA&@vd(KRWWX1+8uI&uL;+KmiYyqqL|SLCZ-uBH#o>TEgvj#K(;WAVN0EUb{BBgzkh-5P; zj+J#DkeCx+72h$Fy}r|;Y8bRf__Ay)7#}V%N=Hw!+6aG5eG&3Aa1UwjtN z|5F(@d)YNNrd)u)rw#}n$Jn0`3tGN`lkWFh7!Ysqp-B3Hl+}jEpUUV!5j2?H#avP1}r_s$GuRO61~@_ zC$HXKyz1^L5&S+1i4d9XG@NU*$=63|@C`T}$DHU9qY=8{RKks3f{o-2=A;!+Avql; zGDjeb6&1)W0J|TkeSCpVFWTtq<8Q?T^B)&(KC#?u{0ZWd z6EtQs!ofom6F#Lv3l@%o794~$vvR3B-XHOnulgsu|I0|WUgq>ND`@>T7Ty24d$d=$ z|LgGi{^R|x5AqZ)2vw?f%=mnOPNNaWLh{5{3!wbzd4O7!Smt)ioVc77__#!du-m zhM?6&qa@OIb9HTBTT@Ikmw8v`!y7nW_`f@tr1$FDiOJry4^5g$cHmfNwS;iWsAC;xWN z61`ut-5*cJchLq5cHdbRn3#v*C?mSL{mvAHIg+8Q1qp>-p zreD9(J1{KLaSOT6j^LZ=<%BmU|gNJ$SlLbcD!n2u|(T zHcijr>vCGda{!W1kUUh)FRMV+HF8i5y&Gr`D$t2|=oJDTmLHFp1qFSWUW1#C1;pXJ zQB123*|m}PUK{AeFRC`A6lYDgh)J}q zGh=5&>lBNknA1p(P#edwmk&KkD-F<}Mcbu(sX0f#7xm1OYck(KPe5uF{mX+=#OR4u zaG>l=y-IadYB`Xf=rmmLi(1U$2KR8xmoS= zNMknbJ)AVIKEZaYrEYUF_m#_vOAFlk;#MJScNDdy1+CCzS;$rtv1J6TL8LY&O%G#g z=$1BMX*hG?<_rx-q!-y454`?cV*T%4FMcNvz=HMv^XGd<#r6OG{?X(5{~?|`tpDNu z>bi^RYh^XZMb5qV*(66t={!0P*${_0;VOP~VYmewN_CxLAkWTkJ3)FUE}q|IwLJ^P zHc$)M6>8JUW?EQkX`*8%V$Nbt;Y3)vac6_e11fj|`*g!37!&C&H)i@SVlRW28#zIy zGr~{UG{&5u_J8%gy?%GMU7q>t`M~R>0Acn&mt_MyrU(8^*6q z$Csm$sdKg>v7WC@EAmm22%H(q(aRu8qp^4W6<7tEB%RM$^eY=KNi2j(6UOPkAb@Kn5;j%e94SxEUoJ~Pp9d?@Z++IoG0oV1CDPT@T%Kw=S&z+k0S9|^ zynlAMY2VxbtJgY)qa>0ce?t80n$kB|$Hh6vg_20pFfFj}?R&dAq&UC!P+$y&c1(!4 z2|E*o1NZIUKYeN=l!gO(_K>eaiwd`GIK0Qnn0y3>7@XK3I6!QKe*Yb2kvbgEr%z}| ze4GfPA;W116Tf>+bSR-MOC$7O``*3@3O7kf+BA}c!x$+<`r#`^ zq)dWNev3=Zbmum1&^D+K^_zqs#nw<483orxwx)+(oAjYsX*K!KXl!p*)&D3wYf zT2ZqemFR{=PbHEQ&Tg#gSM3@sQ8&G#%x&)s!;w(Cxl*g^7m+mc?H5S}+i;K@soh3i znF{XC1&)G>`lYR(Q}Mky)#&;kp8$@Arh^x#{Zn*yd~xx^yYrV9=+*i8yK|kx4CK*d zRkLY1IM>%BTKO%WNrgk!y76{>qc4o5lzZ9!shphiEtBTBJeiTm+|tR3n;2~eu@KT6 z!cE>d6mSY^NFdFSJxNOD_U*MfOO@RVYtqglKg4t@HiGsy35WAX?$KkDSxXp}{=ZaOZeycrpBhc5oPP|56`=8BaW@)nIS4Zp1YtjA}yX9@dH zU+;T=_TRz5;q#*X*FW5SwErIBS;78umi#*Nole$;Oe8_c{4jh2|7)Xdq^%A3dCr*3 zqGqi9BPT?cMs2-&XHAN_**M=qYNv5Brb6;L<40SDG zoe`Y|c8#;*1*T06<66G$@6>ttM=-=kiJ#dBCWMyB&#F(sgn`AtLt}INPjs$orF6_nTbaXl=5Ao}l4NY0)eDQl1?*jc&tfJwU+uz9>16wN zZlG<6`rr~Xq?P41ARr|_wTwgK8qgijI|bUvbLnTJB0FD-m_2xRz93=!+~(TGpJnWS zvzL441;9f4zrRA*}KkzRTc2aa?) zcQwJmq0C zckp7t-fUG2N*4a_tX&vK+vK+#@TzEqPPtTlXn}6P8F@VoxU7(U*GZ(E?=Z5(b&&Zs zNb_@40Mz-b2kt^piQ1_^Z9SCjQXBRhKqUgXNLE8C3y?-K53Q4Z8-)zZql4mi+Z?cJ zxxrh-VihxG^Q!Jl@0d%j%mB0Bt@MC0887EC(K#65{t25Ka0$g=_gK#il(wG37qM)) zn!{+@6+s4HtsG=fiZX!vi<-j;G;!`0J7Bs7*CB$oS&N>h1!ybMwOqY9hGTW|-aBKtlTy?W#;x8uC!;LaklR|C zj66}})-y!zZKVU+b-^qiTm}1$2Cb$6B4oDKb0F1t){#A|d=R5t4Ad6~dL8U#ePK+|gGXjG6e~^ekcjo3ncN=Kt^a%l3bN@A3T4gFGwv z{~cStkZZnH9T?WJ#kCG7AIVH@oT3tgLy(>`7ujsHz^n~b;Jc|)ZVxt?Bj4Cn?n%n( z@>;b7-Qhf6!`zBj?a?zwLCqanaK%>~vbhI2R)sk+>z;sxZGSQI^CcG1Hg^F@DYn*x zc3twWN~%Zw`A2`2(EplC?ymk9`hWI{`JejFpFiJ!)c+6htf2p2eT?DKgNfeqwcZSK zQAC}Za&=6%bQBWmf;O?{rz-hwMmVPdLAT0mi+psn4}a3>MKT)EkEq=(+w>YqbLF1S z7z$`AoYVVDM0$@>b{_{Q(nTFG6H0m0v-@XdJG&jxe_KbyE#d^Sc%$}T+o=6Z`|h2> zDd9#*7|zje2@dIqs)b1$Lub9#4@5(U@=~>-Fc)cHHQYGm%;edsQ7>B{_p!Y)g9@~5 zNcHmVg(?f4u$cHAuXQ>~FAo7AY3R5^dzv}8fbI|+4tG##Y@2CrudA&*pJYF#yiz=Z zR4T9(-Q6YRlgLB_EX}VDo+&vrl>F40;+lKAGJ-`e%t6!buEK21E98YtnBCa(hvdcj zrL^Wo=R%^4F>Q_*)r@gPXXQ*>o-V1&yf>LHEcX-(FTHWvfRigMPNNMH(^zT)Vv~|5 z-_)|AQLB8ti+M-kmb<-ksoZjT+a<9(jqQjh-CQo4Q(w-)vq}{Agb}U$!8w7?B zeQNV(FP@YEPNjlPzt(El`Vu+PR-~$FAkF7Ci2lu!|lg6*l%d9%l>KMiDv}*XwKJ$8<&_yR1kA;U)!FYHc{jAl*yj zSwuW^tZzw$qx|-2I;M9A?b(>^UlSqC=5b2=4pbRd-w5ad27jf|h^==o!j|p7ZW*Xr z8W8ssPew_dM?BHDH|ZPRZ-~AYQIHwoI4sf>?t*r+W8C+CcAiH|CQNC2s<<-A?^>sG zXa#|CpkEXX4rA(+>#ew2?3#nVMZVAGcZj4a?L23DYr1~q+E^B6uX^Gx8-KM$T|_eq z*zQ+bNkzSLP3B9f9mp`ZhSt#;>aGdIF}EL8%fqOaYcj7s68P5fIjKTcV?fo#0uG~@ za;X9^c%gGV=LEMxZt{sIOOlhXkq>JuLsTuk!EtO43OJFM3YQm%MgjTQRO?BKbbavT zLUFSo7E4=th?8-|iR6^bh`vyAgmB0S4(7-Q*Fdn8RAxse^{$E&-jzG>YM0G2v7EF~e;3A(sWF5&g8V8z_jh9enGyaH$D(eIWuNMi ze41t!F&E53#J8m}6-Y>?*u6;>3Xm&=L1(ac35B|FruM%yu>a0OE2<@X($B_~SE!{O zM7;4pnPK9$Fr{$YLqE_kL^1WR(TH*(vkSfLwf0&*0}V{0s>cL%A;u`vmkMY7#q@M+ zcr!p8M**9rgwtU3aH1~ynz4}JC=cp~34v3ak|7)fNX(~07N&PDE&!c*Fe(h4!g%=h z#$A(RLSPzXS6FG|#`>Q`GBp14MQ4;zw{%FkrN#{|rG;zxAc2RzSkT-uWll*$LwRXd z%-dJfgBIX)9x8FER#4lgBZMnhShWQgZD-fy!9;F(&r$}CZB$X*@hR=w-xth^lb4}1w{o!d&cW8vNhE?A(^cGJ4iaY&ai(0@&i#g@{yT~)$PYW9!u$=XsHc^W6Xd-DS zyfKmAk@+{AO_f%6Z{QGZC@%^O0uQ`ENI)2%iiw>MG1HRI_VrpkI(Q`R}kdW(if z2PE>{+~RJ(opXkT!&4-}!;l0y!lnZC!j+=BQ$J5^*yWicp2gfL)f{I{NlQMPHU-Go zwrI2+j4GJaJ%Lt41ri|KDf>&gSKad1ystA@S}T6G zh1!aS`yyk-_O_d!CfA!H%d_LXB$Ru6{!q^{`+t&gJSO*c{LKQFwg4w zU)&r87n(H?ocXEL--dU5RUkWflBVbKNwqKDDX?rZm_k$8^3Hq!9Kq@90QYhqyXDL+ zMQ^T23Q(%%-r|#Q@kMi`#w`-i)#X~|(>D1Hwt;d*It90~ox|NS`q1M~?Vs9io(0#g zSX5UVGS!&X_U3Ui`SPA6^naG#;f^!F0{y>xv|Eb*c;0`E|9+5XCH)@-gs0v_?W|2* zvzB3+0x2sJg`j+Zr@muYyHNIlgHB4lZv`mC%R& zKYjYtMz?5)1vxrE-EKg97LZPbtLE#3h5;hc49zgtn`k=71ncPgh2vMCg&sURAk%p_ z-40$nA_Y*6GZel+AXFSu@O=pN2V{m;RegN>#z<*ezzrDz@QH6}8Z^ zq*!$&wvl#QdZ<%j7Q@fXgINouCOSiA6Yz+$shu+Q2reAC#_gLlU_$>|NwP|SGvAf! zjoHj{M$l_#(Kki{&BjyPsSHz)d^h|R?pZBtGNi@KXr?WdqIMiO-HPp+SO?#8GNVMt zM8&cHF#+Cp0A~$v-g{e%s`BrlEyCzA_PG{A&OYkHKmtfx%#cjLiElxnfLR2 z2r)aWa$>H%V$7H6K5WCM-#D2OF35N4<=_P}KTWATm$^lYgM7DbQ?GLSsgv8dbl9N~ zFy@ta&>H>tM(EI&VShe8pZ8h9{=dOIqS5&7OMr#`-`$e`_ppEXX#YRNvx5EqgXRN- zhb)oi!WYiM5N?LR<0i8|Wg%1k5|10wf1fiZoAi7oG}mW}qX2EEo{6>%I&LE;p?AmR z6fI`&zSVod-_R&P?Joc6r{J$oZp8%e9UcwZI^F0G$LDWP-+ntl=UMMjKqT=c3DCAO z$(_XEpFR!L8&&4hr_K&C#zvIheW4Tj=`HhcjyO@>B#{Z9!!t&MGPTW(S20|>1%Y8C zno-UoeQW}Pv+Hl5Ftj0D*h?rNfDiJtbWJN=)k@bX*>ZdrkCVs$l4r60cS2fvzxY@P z90eS&G8rt;|A)K%;{EUY{m1iv5A&>`|4k$iK_`|8vdnndl|h*6%lArGd@U0zm9bX} zu+BMT6ThaxTsDY5zgAc-1SEgD#FW!vA6aK@igiv*?1znkPq9uNAEIlp)$Q6Sv#Q8+ zFAYr3TC#`cu*m8%uE^@4mwLT7(EY8QBbOzvv-&I?eW_T>WDpF<(y^)>JQD)A6d+x; z03jHDF9<*5WJEtM1?HN}Jzc2)$wmyiv4q*GC_BGUXfq$y24)50+HiPMJof_`Xp3ja zV2`z9KN^DQq?GxSLZ!$)QFL3a5*1nMZf!_p1@pESA(nZ-%HOKv8?z0V#X10T9K@yj z@+{nn5K1>Du`(pFAp=A5k%koWxpP23`?Mh|107GKb+$2HIPur0+!l(8%^cF8u0Dg> zScrDcwdQ3gIvi6B1py)NBtM7$pFm1yox1=fN{Z3UAS_=}f5w-XD-yeMT= z!KD2sE{;;|vN%_;erarYq^pK_!>i*Q2Kn9qk}jj%=pO__m1`-?|*ub=T80~#RM#p)36HWXNq<`i={S*-R~fH3a8kagaYMoDSM_YRioe9gV!>MU9=u=L z2jQadMY_d|s{1!^i|Gokkgd~d3TLr1PH|SD%LQES-zQg?(Y`33oFH-umt3Zn7CGZg z$t9Rxm+uN9yJ<@44SL`VB9FeeWsQx^`QE_z8g69SxCGvJ@d+5Pe{A2I>BI`-eplaH z4U~0#ZwBla?t5F>LsMr#-=~LW!|R;dJ}h$6I0AJCH_g4eM4Of*e-P(cQy11zfA{Ya z{oG!ehkI7^|HVwmF(=};a0M6O0{>tCXulZ$wSVv!|Mf7>UHpG%nh7rc-`5-W{yF^h z#W(;noa)_wS()`bfKFTY98Dpo)#VRRV?>;COuU|S>$i{|_7?rWe`-}{QoPk`43*Ax7 zMlbK3sA!@%9u34^HFT(vIhPuN`wb&%?%9{*)VP~f9}u4gB+YSdE*K=pB#Sk8HqCiu zW=jO|Y=+xhHl}Mb@3K+XeruZ7YA;QLoKoiAH;b*lfrUl}YdeJ%lz8o=(%gf*U0<-k zYjWyVmU7y0*i&-~+>o}gmPyX!IyCa5{@MImi)YZ)JROVSITM{GRP8k{D==uWk;NM( z)eAkF!fLxXrVcLEeyUEsI}MA$+BQ}NykU2k)5R4z=59{020&~2#oWRAW4OjjCgF-h zP-9l!qjzSr%Y&tRbT8T?EBbx9+r3zWfUR5>%?7?ju8hSclQEyux2jUPWK_%ArCF%D z#e2{suCaPIRgyP%|G->a*`Lj6HWYPurS1)w&p@7&hnyQ{p)we266U26NZfMse} zA})xz%MVTEK93uEMgK1+0bMx};DYnNNBg^b#rV(t$NYZ}^R({b06te-@E6H(KsFx$ zs#)xd@%{oj^^RZoyq?cjw{So1-V!mFbIj^$%lTw$V>5F=uE|_@F_bL;f~13((|?iR zJ>jCpNtXlWRPkoIPFv@}t@mO}Wn=O=+AiG2SLjE(Dp;eluvWPO`K_{R);U<`a9`{C z)uOw&I?Svb!x>QFx*t~}Rq8}sOeDAH(&Wiu`Mn^=iM~m9wed78ycowskh7K0{387M zPS*O2LhFPo=BQooLrwdx@V8AH%P;S=bK=|z+}049=a#JZZs%2SZNn?a@m<%8 z98p@qHqF)5lfr85r)n5$uFW*iFVg9xXFPq6fL)5|-Y-pQ@X45o^Bz}O8?!>{r~Ue2 z)^*%5YbO24g!tFlU9&)Mz#kw!6_%nx+jCZdYnepb#%4hO{Q~t5I!lj4rP;9t|5w6u z4>mXjtWwWUU)w9#Tpc|ZwrgxJ)quGY;*N7i5!+_-LtkxJ)x0aQ>BY26zlw$@KuTgKq4v-9+YHO%SQo5C=l*qQ2W zFRNV~mlJcLk!02m0j#630YxLnKJn&w8s_qxWlOypZ%SrV)Ou5@+jXvp?=7ET&D{UB zsC`|`^vxg>V2P`nsE>PC!m7_EDt%Xwm-@zX%caHKBWN@(Efz8!_R@i_T@{(z(JC$$ zTF$slxy)WR)+p_Z`&8SPb}>cWLXpf}Fz4FB&YzD$^RPlwSZI`>qi()?wkTYH;`GmP zBdZ?9u>Kf%s|aOYc8VU$yI#?iNnG98O>I!yjyWExcH8wjdF^cJ)3FKHoHym&?pbM{ z+r6z)iG!KSaz(~Oo+O-;D03;cOPAr|C`dI&?mop*ODkQA>C`Wxk*#3RWwu!MbrH?l zgP)?GA{&kPXYo^1vCgTv&eQAE1bXGy{~A18>Q_>0=>vGwAKDsHrZ z!U9Kur`BK@YhQR2&3)zsPl-h_lxI*u48Yqzn${@*<;=6~rQ^$&L+?f-{( zw$K@tN>jmQzIwpbv=gCWLc>65@fiEpcua)X+CrBTDv(Ixm~knPn2<1pm=`ovJVc}M z4&o%llFrPunZ3tR(Aq)~8S5zNZS9ya(WvM@Iv#o#g>%FrsHspwG2tkr5%F5y%Zpzw z)Fjv1LMOnX=>5qB3MdyXZ%kzm{?+KWyy3ri5B{|;CgYy^$Nm(vsFwj6V*fgcVeKPY z&pdGxx1M=JeBFBH$!Xkr_J3Pj=so6?B?6tkd?i|5%-OHRmo1M51ow0~&VFrqGvTv< z^!`9Ti8}c|e|7xw%`0yjY@m&1`9FNVcTiaW_Ye1XAMgKukY@{ht?z}i((sxNxw2YL z6g#w9$LPa9NI1>E{(0NpET?7(PfXy3xt?S(^+hk#MSn32wWZ2*!23PsEQys$(M*Oy zHl{ur5_vGdS0uwwS_KU|L4o|R_p5ON?F#efW#yUNaRyutamlH4h%e)=ZzzE zfcoA?@1u>nF_-ZT(kt;yBkrYm=5N&)v^d0K(t3gv`Y3I9j*?i}sc9*|3&-@mZFkmh zUDGHSAhm+0<2N{NO^L+HdR8cFge#Uza6Py;O2SabLc)Hwtu>u%(+IWyLBf!s9~cjV zwnk!W3!O$Xy$G& zh}@X*Fjo))HD?mB;mr-(-eHwWSC%qhKk1|5o(PATQ#u)@xh|0u;CGr zM4+?mQpNKml5|S)D8`%x9%a1_+Wz{xv-6IJUILa#{Yvk|Pb8bdg68t|1@Z}(bVPkD ziP%wmKZct$BgluKSX2E}{hhOfBOIq;VnzIG7t3{B^H{Y$H;b&Iat z@ak{gy=xmkOLoup*T?5=_3!_*J6EU)lL_WQ4ioj_p)rYBU`SG;Nz4L^NKgG8Nm_+i ziiyvrF^fnfQ+zTH(N&&L>M+qHDbeKqFacpY!7(1va7l5h5R^N~*YZ!5BrX=V^~Got z4Y-5tJ9PGxk~j1DRk6Ef^p$p$m@7^1sA9XZysaloKcq@O+OtP=l-_ylw1B7p2ZSK9 z<0(GzuJoLS>`m~sc>0`0zp|m1nIBhGc;YzbEanv4xoJ_DZY+d5jQa|BW|Mdk)n)N? zAlxIKLSjiqNhnAW(Pi;;A>1FHG=c*vuo^K}#gh-QUxDNbc%FZKe1bR;Ea5&` z1>F_pD5yqrX*^HPU*3V3tKu26koxl~RF}mwW`Q7n!l|4aVE2J%MC1+Q*JovPm&MaS zSPjRO@wARCWjW_5YVj000)^^r3s}5>nLW#N_rACP*A)l77EhS+UvbX(N|XJ)&+?mk zR<_%hgSvvfaqou4rk?vj)D;B+eC8$bnB#zChXnN2nUd90iEd~ZA`*!NjzUzP^cd3_ ziL}r7hQJ#Q5>~i+0q&vG5xUAY>okjBS<^>vf>G0&oN#u7aD)IsSR})Hp_c3*h8kmp zVcF?rwso)1O#i)7@XmcMs?T+XF1Ci;Js zmXDfOh-RHp5{3v$g6pk30)}^>$T?%Oof_#jQbTN#-Y4J4g_MKAhTWKW}eA z8P1sOq_Mt2@&ppjd8ncTaT135D1f-C?7&OrUlXo*5S^1T6_U@9IX&v?eSfF^+g>N5O+F*XRaM7JSlzw*HmgZ? zMoXkVPO@>BMR~vRKwSw>&^@)uDW2~LNJ7W;(HN?Da zl(A~^gGJ4%Mb&o1B=rkUeC@IEDC-SFHty~1_W#z~ectPT)x$CEI<-ZYM%{k5f7El- z`aF{OW9kC;i9l6Ewd;#BEGL)qm|Qs>JmWNy!XDr-3yjzlwDDKzUONdkAWIcXjxYRa zBB~kalMoA`X7;N(qS8XajS}~N2~mB*)3GRU&G-4p6naX2%cVC}Pr_ zuu*by`T7D0I*v>^yZfbgk%+WgOjcgq>Z$lUFKf&)>j}#WR;aKCAu8AcuknzC_qAH6 zYx)i@_|48*i=68rP{p2i3i6&`$9--KAYEZ48Z^6o3z`PmTDtUti=#3kN;YOzi6y=7=u>G8G4FpO4=hQ z2sk}msEB`MrCXJFHzSxPPDCJw_ViNIr=TZp`v+!a2x|3Ww+vT zt--%B_5r=)Fl0C80HTf?O+TBoi%fSWAjN@Qt~H?2m8qZ$0}P1~yq@}-AV7)P8)PRWcw=rSE49CCt#Ir3p53Osi;n>*Lk zHAxTi6hdtiv=_Y3hs;??16oZVoqidQJo%QvZS@-)Ac>HkbKqg zGk>JV&cl*%JSLlqn)^JH?&f0cKF_R|V`e=ho*!c2I;mYRwHY=94u*_dV`ZBONg|(A zD@vz8#m2%}_VwrOEvIbF<^pigWvsKJZpxPXf~~dL|aQkx#mjpR_Ac}Tw$l&iFKKaLxlj?s&eUN!Y@#Cq+iV(srt9{0@T!5n>s z1B*v=xd$Wd``$H$o@Q15rC@0SlwYu1@VTkq%o*m7V}NcF1BeM3)=c6tE_+?c_d1LG zRWX)IMyr>`cr2QmtbbYM@Vl7Al(4Vu3oU_*lg@sMorLbg=0W4K7)!;BTrkPS zyn3fH0x|wfV`UA(lr-??M9tO`A=?vSwl{E@?R_x~L|{>0LP2;m>Wu7Gj!m`>M-%T~fBiuiqyP)2q&>)8WPy|1qj z3!3}+0f(4KeAiaiIetB_Sj?p4P3z2nnOL}G(_2a-80yW;2Ort!KQFru?E~f9gckcX zVRlB>+0Qk(8Jh|Q3Ua%)5RfyX16Y$`i1)H$;$em3vX1>82Ha`1nyS9br_Fv#2tU#u z0AiJPl^O1p#?)kxYku$* z98)$=MuOlL;HMOYQ9vOnST5|Y$sL>-H9gXN)MCHu?u;C*Z9nhU&<8Q$Rr`6@+&!-e zy&Ef@#ELEUTLOWv&IH!8Ujy|2UKYG+IRoMRyhif?WS?f#tzfyBNJ)5-lZN%ywcHy= z<$>nTtM;q-d}bR~d_0vM+g3h%W%)fM_m34v(LT!87`i7`NIwU8Ob^0)Arr` z3Oo0EZLV9lqbqFv?w8}^dG*3-CCWvbGCn;aQ@!?EWdRwBLRoAO+X57s;v`?yMvT_4 zl?b|B7-lqPBn5^Vl<|ztiS(*+G^rYcCAakf`vHI|GrF${GCmCelG1b-DV5du zq~=5GYy%4})JD%hxJ#MKwkiR|$&K70zxcJI5?9?cMZJPm)<*Ze1-%{D zhD;iiD!i=Q+}XK~F?zRQ4x`sDc#2(8Ko?L0$aELaE4*$ipKaz6)ozPOTP;%hptLRp z$z_!J!p=)e{hXG6k}P8!r;P?J`+0?DW@y?d;GCA`Q0%%)Sp6mAH!)%OH%BTNZEhRX?bgp=N?e=svWvx%<7h}Z{JXVLDxs|Mzt=DsOI2r8%@x7 zm1_ss;nB(4VWck2JQWKrMN02;U&7AL)83e{)4#)=2`gTj(0WVOy>CxI+YBapMw*B` z)+?uw)v1A5?hG1%p0f~jfKoG+k(B02Hq2(hA#pO+J8dcz%u5S`j>yqVrh47!^p>>w zy3;|Q-&kt8A~f}K2QS=E|D;JQ!ByW3xgAvFj$URWSKyI({o>_$F{ZIf@y8CrKCBBJ zT%|?r4G;?WECtu>z3zOC^qd!Ye)z4UCpaSMtDhhY6B>(zZU)yWqJJkv^nFG2A4U=V zM^HrndPO)~&r=7aVbl8r^rM|`uiHT(~daYE-0a=2$5%^O7pKFCMT4rBG;sn#K2D)QTI$d zg;eyYv;i2T?(lp?pAb47CM)2`>n$z1+d>wkPb^($xE0jr3+QdC@Ot|)`1m*&@RPTJvOChb@ zkq`c4^1y-+PPGx#%ouHE$iXbY8QK>9W|l3 zt#(D^oEkC*2MMd($T-))zIL!tv_rsIYHQNIyySYUNHC7zV0Z1f=^;In(8)IxO!V|c zcnM6(g38sqH1WC}Mb=McOgYJ!sGtq2I%^`EzfJ^|x_dWaxzR{?sqI*^QA=SmubX4d z7tM?r&9=Oa@1`>BdXm!#&D}KhQA{QbUqE8BM8t*O<)GDWA3GPjpDy-3&DqqLc)MHu z85WX;F_Bbm+EHS^;!|ThCxa4jv8SEoRMJV2Ldy8LG``?^);%@=tW}{z&PXb^b1Fr8 zK|{^lF8;e0WVMgUF92* zmF9lT|BFRd{;XH8T{l{Sz_v@E;EBE6@gO7dj5-QEa9DA>(GI-S4LbI#&gRd7_Ln&+ z(e(<%<7E8B4-M( zPmp4w79^)Z!lcUCxKIrRIj)!lzk!~NIdl$&Fc@~=mxJM8*bB}EC%+$^p1|3`@$tdo z$>8k}j*j8Y(c!Oylflv95RU#02Zw*bAA`eRdqA0asdt%SoxaF{&2c%8f}sW7aGh6g z^6|ASiy + +# Kubewatch packaged by Bitnami + +Kubewatch is a Kubernetes watcher that currently publishes notification to Slack. Run it in your k8s cluster, and you will get event notifications in a slack channel. + +[Overview of Kubewatch](https://github.com/bitnami-labs/kubewatch) + +## TL;DR + +```console +$ helm repo add robusta https://robusta-charts.storage.googleapis.com && helm repo update +$ helm install my-release robusta/kubewatch +``` + +## Introduction + +This chart bootstraps a kubewatch deployment on a [Kubernetes](https://kubernetes.io) cluster using the [Helm](https://helm.sh) package manager. + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.2.0+ + +## Installing the Chart + +To install the chart with the release name `my-release`: + +```console +$ helm install my-release bitnami/kubewatch +``` + +The command deploys kubewatch on the Kubernetes cluster in the default configuration. The [Parameters](#parameters) section lists the parameters that can be configured during installation. + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment: + +```console +$ helm delete my-release +``` + +The command removes all the Kubernetes components associated with the chart and deletes the release. + +## Parameters + +### Global parameters + +| Name | Description | Value | +| ------------------------- | ----------------------------------------------- | ----- | +| `global.imageRegistry` | Global Docker image registry | `""` | +| `global.imagePullSecrets` | Global Docker registry secret names as an array | `[]` | + + +### Common parameters + +| Name | Description | Value | +| ------------------------ | --------------------------------------------------------------------------------------- | -------------- | +| `kubeVersion` | Force target Kubernetes version (using Helm capabilities if not set) | `""` | +| `nameOverride` | String to partially override common.names.fullname template | `""` | +| `fullnameOverride` | String to fully override common.names.fullname template | `""` | +| `commonLabels` | Labels to add to all deployed objects | `{}` | +| `commonAnnotations` | Annotations to add to all deployed objects | `{}` | +| `diagnosticMode.enabled` | Enable diagnostic mode (all probes will be disabled and the command will be overridden) | `false` | +| `diagnosticMode.command` | Command to override all containers in the the deployment(s)/statefulset(s) | `["sleep"]` | +| `diagnosticMode.args` | Args to override all containers in the the deployment(s)/statefulset(s) | `["infinity"]` | +| `extraDeploy` | Array of extra objects to deploy with the release | `[]` | + + +### Kubewatch parameters + +| Name | Description | Value | +| ---------------------------------------- | -------------------------------------------------------------------------------- | ---------------------- | +| `image.registry` | Kubewatch image registry | `docker.io` | +| `image.repository` | Kubewatch image repository | `bitnami/kubewatch` | +| `image.tag` | Kubewatch image tag (immutable tags are recommended) | `0.1.0-debian-10-r513` | +| `image.pullPolicy` | Kubewatch image pull policy | `IfNotPresent` | +| `image.pullSecrets` | Specify docker-registry secret names as an array | `[]` | +| `hostAliases` | Add deployment host aliases | `[]` | +| `slack.enabled` | Enable Slack notifications | `true` | +| `slack.channel` | Slack channel to notify | `XXXX` | +| `slack.token` | Slack API token | `XXXX` | +| `hipchat.enabled` | Enable HipChat notifications | `false` | +| `hipchat.room` | HipChat room to notify | `""` | +| `hipchat.token` | HipChat token | `""` | +| `hipchat.url` | HipChat URL | `""` | +| `mattermost.enabled` | Enable Mattermost notifications | `false` | +| `mattermost.channel` | Mattermost channel to notify | `""` | +| `mattermost.url` | Mattermost URL | `""` | +| `mattermost.username` | Mattermost user to notify | `""` | +| `flock.enabled` | Enable Flock notifications | `false` | +| `flock.url` | Flock URL | `""` | +| `msteams.enabled` | Enable Microsoft Teams notifications | `false` | +| `msteams.webhookurl` | Microsoft Teams webhook URL | `""` | +| `webhook.enabled` | Enable Webhook notifications | `false` | +| `webhook.url` | Webhook URL | `""` | +| `smtp.enabled` | Enable SMTP (email) notifications | `false` | +| `smtp.to` | Destination email address (required) | `""` | +| `smtp.from` | Source email address (required) | `""` | +| `smtp.hello` | SMTP hello field (optional) | `""` | +| `smtp.smarthost` | SMTP server address (name:port) (required) | `""` | +| `smtp.subject` | Source email subject | `""` | +| `smtp.auth.username` | Username for LOGIN and PLAIN auth mech | `""` | +| `smtp.auth.password` | Password for LOGIN and PLAIN auth mech | `""` | +| `smtp.auth.secret` | Secret for CRAM-MD5 auth mech | `""` | +| `smtp.auth.identity` | Identity for PLAIN auth mech | `""` | +| `smtp.requireTLS` | Force STARTTLS. Set to `true` or `false` | `""` | +| `namespaceToWatch` | Namespace to watch, leave it empty for watching all | `""` | +| `resourcesToWatch.deployment` | Watch changes to Deployments | `true` | +| `resourcesToWatch.replicationcontroller` | Watch changes to ReplicationControllers | `false` | +| `resourcesToWatch.replicaset` | Watch changes to ReplicaSets | `false` | +| `resourcesToWatch.daemonset` | Watch changes to DaemonSets | `false` | +| `resourcesToWatch.services` | Watch changes to Services | `false` | +| `resourcesToWatch.pod` | Watch changes to Pods | `true` | +| `resourcesToWatch.job` | Watch changes to Jobs | `false` | +| `resourcesToWatch.persistentvolume` | Watch changes to PersistentVolumes | `false` | +| `command` | Override default container command (useful when using custom images) | `[]` | +| `args` | Override default container args (useful when using custom images) | `[]` | +| `lifecycleHooks` | for the Kubewatch container(s) to automate configuration before or after startup | `{}` | +| `extraEnvVars` | Extra environment variables to be set on Kubewatch container | `[]` | +| `extraEnvVarsCM` | Name of existing ConfigMap containing extra env vars | `""` | +| `extraEnvVarsSecret` | Name of existing Secret containing extra env vars | `""` | + + +### Kubewatch deployment parameters + +| Name | Description | Value | +| --------------------------------------- | ----------------------------------------------------------------------------------------- | --------------- | +| `replicaCount` | Number of Kubewatch replicas to deploy | `1` | +| `podSecurityContext.enabled` | Enable Kubewatch containers' SecurityContext | `false` | +| `podSecurityContext.fsGroup` | Set Kubewatch containers' SecurityContext fsGroup | `""` | +| `containerSecurityContext.enabled` | Enable Kubewatch pods' Security Context | `false` | +| `containerSecurityContext.runAsUser` | Set Kubewatch pods' SecurityContext runAsUser | `""` | +| `containerSecurityContext.runAsNonRoot` | Set Kubewatch pods' SecurityContext runAsNonRoot | `""` | +| `resources.limits` | The resources limits for the Kubewatch container | `{}` | +| `resources.requests` | The requested resources for the Kubewatch container | `{}` | +| `startupProbe.enabled` | Enable startupProbe | `false` | +| `startupProbe.initialDelaySeconds` | Initial delay seconds for startupProbe | `10` | +| `startupProbe.periodSeconds` | Period seconds for startupProbe | `10` | +| `startupProbe.timeoutSeconds` | Timeout seconds for startupProbe | `1` | +| `startupProbe.failureThreshold` | Failure threshold for startupProbe | `3` | +| `startupProbe.successThreshold` | Success threshold for startupProbe | `1` | +| `livenessProbe.enabled` | Enable livenessProbe | `false` | +| `livenessProbe.initialDelaySeconds` | Initial delay seconds for livenessProbe | `10` | +| `livenessProbe.periodSeconds` | Period seconds for livenessProbe | `10` | +| `livenessProbe.timeoutSeconds` | Timeout seconds for livenessProbe | `1` | +| `livenessProbe.failureThreshold` | Failure threshold for livenessProbe | `3` | +| `livenessProbe.successThreshold` | Success threshold for livenessProbe | `1` | +| `readinessProbe.enabled` | Enable readinessProbe | `false` | +| `readinessProbe.initialDelaySeconds` | Initial delay seconds for readinessProbe | `10` | +| `readinessProbe.periodSeconds` | Period seconds for readinessProbe | `10` | +| `readinessProbe.timeoutSeconds` | Timeout seconds for readinessProbe | `1` | +| `readinessProbe.failureThreshold` | Failure threshold for readinessProbe | `3` | +| `readinessProbe.successThreshold` | Success threshold for readinessProbe | `1` | +| `customStartupProbe` | Override default startup probe | `{}` | +| `customLivenessProbe` | Override default liveness probe | `{}` | +| `customReadinessProbe` | Override default readiness probe | `{}` | +| `podAffinityPreset` | Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `podAntiAffinityPreset` | Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `soft` | +| `nodeAffinityPreset.type` | Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` | `""` | +| `nodeAffinityPreset.key` | Node label key to match. Ignored if `affinity` is set. | `""` | +| `nodeAffinityPreset.values` | Node label values to match. Ignored if `affinity` is set. | `[]` | +| `affinity` | Affinity for pod assignment | `{}` | +| `nodeSelector` | Node labels for pod assignment | `{}` | +| `tolerations` | Tolerations for pod assignment | `[]` | +| `priorityClassName` | Controller priorityClassName | `""` | +| `schedulerName` | Name of the k8s scheduler (other than default) | `""` | +| `topologySpreadConstraints` | Topology Spread Constraints for pod assignment | `[]` | +| `podLabels` | Extra labels for Kubewatch pods | `{}` | +| `podAnnotations` | Annotations for Kubewatch pods | `{}` | +| `extraVolumes` | Optionally specify extra list of additional volumes for Kubewatch pods | `[]` | +| `extraVolumeMounts` | Optionally specify extra list of additional volumeMounts for Kubewatch container(s) | `[]` | +| `updateStrategy.type` | Deployment strategy type. | `RollingUpdate` | +| `initContainers` | Add additional init containers to the Kubewatch pods | `[]` | +| `sidecars` | Add additional sidecar containers to the Kubewatch pods | `[]` | + + +### RBAC parameters + +| Name | Description | Value | +| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | ------- | +| `rbac.create` | Whether to create & use RBAC resources or not | `false` | +| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true` | +| `serviceAccount.name` | Name of the service account to use. If not set and create is true, a name is generated using the fullname template. | `""` | +| `serviceAccount.automountServiceAccountToken` | Automount service account token for the server service account | `true` | +| `serviceAccount.annotations` | Annotations for service account. Evaluated as a template. Only used if `create` is `true`. | `{}` | + + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. For example, + +```console +$ helm install my-release bitnami/kubewatch \ + --set=slack.channel="#bots",slack.token="XXXX-XXXX-XXXX" +``` + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +$ helm install my-release -f values.yaml bitnami/kubewatch +``` + +> **Tip**: You can use the default [values.yaml](values.yaml) + +## Configuration and installation details + +### [Rolling VS Immutable tags](https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/) + +It is strongly recommended to use immutable tags in a production environment. This ensures your deployment does not change automatically if the same tag is updated with a different image. + +Bitnami will release a new chart updating its containers if a new version of the main container, significant changes, or critical vulnerabilities exist. + +### Create a Slack bot + +Open [https://my.slack.com/services/new/bot](https://my.slack.com/services/new/bot) to create a new Slack bot. +The API token can be found on the edit page (it starts with `xoxb-`). + +Invite the Bot to your channel by typing `/join @name_of_your_bot` in the Slack message area. + +### Adding extra environment variables + +In case you want to add extra environment variables (useful for advanced operations like custom init scripts), you can use the `extraEnvVars` property. + +```yaml +extraEnvVars: + - name: LOG_LEVEL + value: debug +``` + +Alternatively, you can use a ConfigMap or a Secret with the environment variables. To do so, use the `extraEnvVarsCM` or the `extraEnvVarsSecret` values. + +### Sidecars and Init Containers + +If you have a need for additional containers to run within the same pod as the Kubewatch app (e.g. an additional metrics or logging exporter), you can do so via the `sidecars` config parameter. Simply define your container according to the Kubernetes container spec. + +```yaml +sidecars: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +Similarly, you can add extra init containers using the `initContainers` parameter. + +```yaml +initContainers: + - name: your-image-name + image: your-image + imagePullPolicy: Always + ports: + - name: portname + containerPort: 1234 +``` + +### Deploying extra resources + +There are cases where you may want to deploy extra objects, such a ConfigMap containing your app's configuration or some extra deployment with a micro service used by your app. For covering this case, the chart allows adding the full specification of other objects using the `extraDeploy` parameter. + +### Setting Pod's affinity + +This chart allows you to set your custom affinity using the `affinity` parameter. Find more information about Pod's affinity in the [kubernetes documentation](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity). + +As an alternative, you can use of the preset configurations for pod affinity, pod anti-affinity, and node affinity available at the [bitnami/common](https://github.com/bitnami/charts/tree/master/bitnami/common#affinities) chart. To do so, set the `podAffinityPreset`, `podAntiAffinityPreset`, or `nodeAffinityPreset` parameters. + +## Troubleshooting + +Find more information about how to deal with common errors related to Bitnami's Helm charts in [this troubleshooting guide](https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues). + +## Upgrading + +### To 3.0.0 + +- Chart labels were adapted to follow the [Helm charts standard labels](https://helm.sh/docs/chart_best_practices/labels/#standard-labels). +- This version also introduces `bitnami/common`, a [library chart](https://helm.sh/docs/topics/library_charts/#helm) as a dependency. More documentation about this new utility could be found [here](https://github.com/bitnami/charts/tree/master/bitnami/common#bitnami-common-library-chart). Please, make sure that you have updated the chart dependencies before executing any upgrade. + +Consequences: + +- Backwards compatibility is not guaranteed. To upgrade to `3.0.0`, install a new release of the Kubewatch chart. + +### To 2.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +### To 1.0.0 + +Helm performs a lookup for the object based on its group (apps), version (v1), and kind (Deployment). Also known as its GroupVersionKind, or GVK. Changing the GVK is considered a compatibility breaker from Kubernetes' point of view, so you cannot "upgrade" those objects to the new GVK in-place. Earlier versions of Helm 3 did not perform the lookup correctly which has since been fixed to match the spec. + +In https://github.com/helm/charts/pull/17285 the `apiVersion` of the deployment resources was updated to `apps/v1` in tune with the api's deprecated, resulting in compatibility breakage. + +This major version signifies this change. + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore new file mode 100644 index 00000000..50af0317 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/.helmignore @@ -0,0 +1,22 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml new file mode 100644 index 00000000..ae5cd04c --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + category: Infrastructure +apiVersion: v2 +appVersion: 1.12.0 +description: A Library Helm Chart for grouping common logic between bitnami charts. + This chart is not deployable by itself. +home: https://github.com/bitnami/charts/tree/master/bitnami/common +icon: https://bitnami.com/downloads/logos/bitnami-mark.png +keywords: +- common +- helper +- template +- function +- bitnami +maintainers: +- email: containers@bitnami.com + name: Bitnami +name: common +sources: +- https://github.com/bitnami/charts +- https://www.bitnami.com/ +type: library +version: 1.12.0 diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md new file mode 100644 index 00000000..0b310144 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/README.md @@ -0,0 +1,346 @@ +# Bitnami Common Library Chart + +A [Helm Library Chart](https://helm.sh/docs/topics/library_charts/#helm) for grouping common logic between bitnami charts. + +## TL;DR + +```yaml +dependencies: + - name: common + version: 1.x.x + repository: https://charts.bitnami.com/bitnami +``` + +```bash +$ helm dependency update +``` + +```yaml +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "common.names.fullname" . }} +data: + myvalue: "Hello World" +``` + +## Introduction + +This chart provides a common template helpers which can be used to develop new charts using [Helm](https://helm.sh) package manager. + +Bitnami charts can be used with [Kubeapps](https://kubeapps.com/) for deployment and management of Helm Charts in clusters. This Helm chart has been tested on top of [Bitnami Kubernetes Production Runtime](https://kubeprod.io/) (BKPR). Deploy BKPR to get automated TLS certificates, logging and monitoring for your applications. + +## Prerequisites + +- Kubernetes 1.19+ +- Helm 3.2.0+ + +## Parameters + +The following table lists the helpers available in the library which are scoped in different sections. + +### Affinities + +| Helper identifier | Description | Expected Input | +|-------------------------------|------------------------------------------------------|------------------------------------------------| +| `common.affinities.node.soft` | Return a soft nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.node.hard` | Return a hard nodeAffinity definition | `dict "key" "FOO" "values" (list "BAR" "BAZ")` | +| `common.affinities.pod.soft` | Return a soft podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | +| `common.affinities.pod.hard` | Return a hard podAffinity/podAntiAffinity definition | `dict "component" "FOO" "context" $` | + +### Capabilities + +| Helper identifier | Description | Expected Input | +|------------------------------------------------|------------------------------------------------------------------------------------------------|-------------------| +| `common.capabilities.kubeVersion` | Return the target Kubernetes version (using client default if .Values.kubeVersion is not set). | `.` Chart context | +| `common.capabilities.cronjob.apiVersion` | Return the appropriate apiVersion for cronjob. | `.` Chart context | +| `common.capabilities.deployment.apiVersion` | Return the appropriate apiVersion for deployment. | `.` Chart context | +| `common.capabilities.statefulset.apiVersion` | Return the appropriate apiVersion for statefulset. | `.` Chart context | +| `common.capabilities.ingress.apiVersion` | Return the appropriate apiVersion for ingress. | `.` Chart context | +| `common.capabilities.rbac.apiVersion` | Return the appropriate apiVersion for RBAC resources. | `.` Chart context | +| `common.capabilities.crd.apiVersion` | Return the appropriate apiVersion for CRDs. | `.` Chart context | +| `common.capabilities.policy.apiVersion` | Return the appropriate apiVersion for podsecuritypolicy. | `.` Chart context | +| `common.capabilities.networkPolicy.apiVersion` | Return the appropriate apiVersion for networkpolicy. | `.` Chart context | +| `common.capabilities.supportsHelmVersion` | Returns true if the used Helm version is 3.3+ | `.` Chart context | + +### Errors + +| Helper identifier | Description | Expected Input | +|-----------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------| +| `common.errors.upgrade.passwords.empty` | It will ensure required passwords are given when we are upgrading a chart. If `validationErrors` is not empty it will throw an error and will stop the upgrade action. | `dict "validationErrors" (list $validationError00 $validationError01) "context" $` | + +### Images + +| Helper identifier | Description | Expected Input | +|-----------------------------|------------------------------------------------------|---------------------------------------------------------------------------------------------------------| +| `common.images.image` | Return the proper and full image name | `dict "imageRoot" .Values.path.to.the.image "global" $`, see [ImageRoot](#imageroot) for the structure. | +| `common.images.pullSecrets` | Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global` | +| `common.images.renderPullSecrets` | Return the proper Docker Image Registry Secret Names (evaluates values as templates) | `dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $` | + +### Ingress + +| Helper identifier | Description | Expected Input | +|-------------------------------------------|-------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.ingress.backend` | Generate a proper Ingress backend entry depending on the API version | `dict "serviceName" "foo" "servicePort" "bar"`, see the [Ingress deprecation notice](https://kubernetes.io/blog/2019/07/18/api-deprecations-in-1-16/) for the syntax differences | +| `common.ingress.supportsPathType` | Prints "true" if the pathType field is supported | `.` Chart context | +| `common.ingress.supportsIngressClassname` | Prints "true" if the ingressClassname field is supported | `.` Chart context | +| `common.ingress.certManagerRequest` | Prints "true" if required cert-manager annotations for TLS signed certificates are set in the Ingress annotations | `dict "annotations" .Values.path.to.the.ingress.annotations` | + +### Labels + +| Helper identifier | Description | Expected Input | +|-----------------------------|-----------------------------------------------------------------------------|-------------------| +| `common.labels.standard` | Return Kubernetes standard labels | `.` Chart context | +| `common.labels.matchLabels` | Labels to use on `deploy.spec.selector.matchLabels` and `svc.spec.selector` | `.` Chart context | + +### Names + +| Helper identifier | Description | Expected Input | +|--------------------------|------------------------------------------------------------|-------------------| +| `common.names.name` | Expand the name of the chart or use `.Values.nameOverride` | `.` Chart context | +| `common.names.fullname` | Create a default fully qualified app name. | `.` Chart context | +| `common.names.namespace` | Allow the release namespace to be overridden | `.` Chart context | +| `common.names.chart` | Chart name plus version | `.` Chart context | + +### Secrets + +| Helper identifier | Description | Expected Input | +|---------------------------|--------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.secrets.name` | Generate the name of the secret. | `dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $` see [ExistingSecret](#existingsecret) for the structure. | +| `common.secrets.key` | Generate secret key. | `dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName"` see [ExistingSecret](#existingsecret) for the structure. | +| `common.passwords.manage` | Generate secret password or retrieve one if already created. | `dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $`, length, strong and chartNAme fields are optional. | +| `common.secrets.exists` | Returns whether a previous generated secret already exists. | `dict "secret" "secret-name" "context" $` | + +### Storage + +| Helper identifier | Description | Expected Input | +|-------------------------------|---------------------------------------|---------------------------------------------------------------------------------------------------------------------| +| `common.storage.class` | Return the proper Storage Class | `dict "persistence" .Values.path.to.the.persistence "global" $`, see [Persistence](#persistence) for the structure. | + +### TplValues + +| Helper identifier | Description | Expected Input | +|---------------------------|----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.tplvalues.render` | Renders a value that contains template | `dict "value" .Values.path.to.the.Value "context" $`, value is the value should rendered as template, context frequently is the chart context `$` or `.` | + +### Utils + +| Helper identifier | Description | Expected Input | +|--------------------------------|------------------------------------------------------------------------------------------|------------------------------------------------------------------------| +| `common.utils.fieldToEnvVar` | Build environment variable name given a field. | `dict "field" "my-password"` | +| `common.utils.secret.getvalue` | Print instructions to get a secret value. | `dict "secret" "secret-name" "field" "secret-value-field" "context" $` | +| `common.utils.getValueFromKey` | Gets a value from `.Values` object given its key path | `dict "key" "path.to.key" "context" $` | +| `common.utils.getKeyFromList` | Returns first `.Values` key with a defined value or first of the list if all non-defined | `dict "keys" (list "path.to.key1" "path.to.key2") "context" $` | + +### Validations + +| Helper identifier | Description | Expected Input | +|--------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| +| `common.validations.values.single.empty` | Validate a value must not be empty. | `dict "valueKey" "path.to.value" "secret" "secret.name" "field" "my-password" "subchart" "subchart" "context" $` secret, field and subchart are optional. In case they are given, the helper will generate a how to get instruction. See [ValidateValue](#validatevalue) | +| `common.validations.values.multiple.empty` | Validate a multiple values must not be empty. It returns a shared error for all the values. | `dict "required" (list $validateValueConf00 $validateValueConf01) "context" $`. See [ValidateValue](#validatevalue) | +| `common.validations.values.mariadb.passwords` | This helper will ensure required password for MariaDB are not empty. It returns a shared error for all the values. | `dict "secret" "mariadb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mariadb chart and the helper. | +| `common.validations.values.postgresql.passwords` | This helper will ensure required password for PostgreSQL are not empty. It returns a shared error for all the values. | `dict "secret" "postgresql-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use postgresql chart and the helper. | +| `common.validations.values.redis.passwords` | This helper will ensure required password for Redis™ are not empty. It returns a shared error for all the values. | `dict "secret" "redis-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use redis chart and the helper. | +| `common.validations.values.cassandra.passwords` | This helper will ensure required password for Cassandra are not empty. It returns a shared error for all the values. | `dict "secret" "cassandra-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use cassandra chart and the helper. | +| `common.validations.values.mongodb.passwords` | This helper will ensure required password for MongoDB® are not empty. It returns a shared error for all the values. | `dict "secret" "mongodb-secret" "subchart" "true" "context" $` subchart field is optional and could be true or false it depends on where you will use mongodb chart and the helper. | + +### Warnings + +| Helper identifier | Description | Expected Input | +|------------------------------|----------------------------------|------------------------------------------------------------| +| `common.warnings.rollingTag` | Warning about using rolling tag. | `ImageRoot` see [ImageRoot](#imageroot) for the structure. | + +## Special input schemas + +### ImageRoot + +```yaml +registry: + type: string + description: Docker registry where the image is located + example: docker.io + +repository: + type: string + description: Repository and image name + example: bitnami/nginx + +tag: + type: string + description: image tag + example: 1.16.1-debian-10-r63 + +pullPolicy: + type: string + description: Specify a imagePullPolicy. Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + +pullSecrets: + type: array + items: + type: string + description: Optionally specify an array of imagePullSecrets (evaluated as templates). + +debug: + type: boolean + description: Set to true if you would like to see extra information on logs + example: false + +## An instance would be: +# registry: docker.io +# repository: bitnami/nginx +# tag: 1.16.1-debian-10-r63 +# pullPolicy: IfNotPresent +# debug: false +``` + +### Persistence + +```yaml +enabled: + type: boolean + description: Whether enable persistence. + example: true + +storageClass: + type: string + description: Ghost data Persistent Volume Storage Class, If set to "-", storageClassName: "" which disables dynamic provisioning. + example: "-" + +accessMode: + type: string + description: Access mode for the Persistent Volume Storage. + example: ReadWriteOnce + +size: + type: string + description: Size the Persistent Volume Storage. + example: 8Gi + +path: + type: string + description: Path to be persisted. + example: /bitnami + +## An instance would be: +# enabled: true +# storageClass: "-" +# accessMode: ReadWriteOnce +# size: 8Gi +# path: /bitnami +``` + +### ExistingSecret + +```yaml +name: + type: string + description: Name of the existing secret. + example: mySecret +keyMapping: + description: Mapping between the expected key name and the name of the key in the existing secret. + type: object + +## An instance would be: +# name: mySecret +# keyMapping: +# password: myPasswordKey +``` + +#### Example of use + +When we store sensitive data for a deployment in a secret, some times we want to give to users the possibility of using theirs existing secrets. + +```yaml +# templates/secret.yaml +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "common.names.fullname" . }} + labels: + app: {{ include "common.names.fullname" . }} +type: Opaque +data: + password: {{ .Values.password | b64enc | quote }} + +# templates/dpl.yaml +--- +... + env: + - name: PASSWORD + valueFrom: + secretKeyRef: + name: {{ include "common.secrets.name" (dict "existingSecret" .Values.existingSecret "context" $) }} + key: {{ include "common.secrets.key" (dict "existingSecret" .Values.existingSecret "key" "password") }} +... + +# values.yaml +--- +name: mySecret +keyMapping: + password: myPasswordKey +``` + +### ValidateValue + +#### NOTES.txt + +```console +{{- $validateValueConf00 := (dict "valueKey" "path.to.value00" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value01" "secret" "secretName" "field" "password-01") -}} + +{{ include "common.validations.values.multiple.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} +``` + +If we force those values to be empty we will see some alerts + +```console +$ helm install test mychart --set path.to.value00="",path.to.value01="" + 'path.to.value00' must not be empty, please add '--set path.to.value00=$PASSWORD_00' to the command. To get the current value: + + export PASSWORD_00=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-00}" | base64 --decode) + + 'path.to.value01' must not be empty, please add '--set path.to.value01=$PASSWORD_01' to the command. To get the current value: + + export PASSWORD_01=$(kubectl get secret --namespace default secretName -o jsonpath="{.data.password-01}" | base64 --decode) +``` + +## Upgrading + +### To 1.0.0 + +[On November 13, 2020, Helm v2 support was formally finished](https://github.com/helm/charts#status-of-the-project), this major version is the result of the required changes applied to the Helm Chart to be able to incorporate the different features added in Helm v3 and to be consistent with the Helm project itself regarding the Helm v2 EOL. + +**What changes were introduced in this major version?** + +- Previous versions of this Helm Chart use `apiVersion: v1` (installable by both Helm 2 and 3), this Helm Chart was updated to `apiVersion: v2` (installable by Helm 3 only). [Here](https://helm.sh/docs/topics/charts/#the-apiversion-field) you can find more information about the `apiVersion` field. +- Use `type: library`. [Here](https://v3.helm.sh/docs/faq/#library-chart-support) you can find more information. +- The different fields present in the *Chart.yaml* file has been ordered alphabetically in a homogeneous way for all the Bitnami Helm Charts + +**Considerations when upgrading to this version** + +- If you want to upgrade to this version from a previous one installed with Helm v3, you shouldn't face any issues +- If you want to upgrade to this version using Helm v2, this scenario is not supported as this version doesn't support Helm v2 anymore +- If you installed the previous version with Helm v2 and wants to upgrade to this version with Helm v3, please refer to the [official Helm documentation](https://helm.sh/docs/topics/v2_v3_migration/#migration-use-cases) about migrating from Helm v2 to v3 + +**Useful links** + +- https://docs.bitnami.com/tutorials/resolve-helm2-helm3-post-migration-issues/ +- https://helm.sh/docs/topics/v2_v3_migration/ +- https://helm.sh/blog/migrate-from-helm-v2-to-helm-v3/ + +## License + +Copyright © 2022 Bitnami + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl new file mode 100644 index 00000000..189ea403 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_affinities.tpl @@ -0,0 +1,102 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return a soft nodeAffinity definition +{{ include "common.affinities.nodes.soft" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.soft" -}} +preferredDuringSchedulingIgnoredDuringExecution: + - preference: + matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} + weight: 1 +{{- end -}} + +{{/* +Return a hard nodeAffinity definition +{{ include "common.affinities.nodes.hard" (dict "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes.hard" -}} +requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: {{ .key }} + operator: In + values: + {{- range .values }} + - {{ . | quote }} + {{- end }} +{{- end -}} + +{{/* +Return a nodeAffinity definition +{{ include "common.affinities.nodes" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.nodes" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.nodes.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.nodes.hard" . -}} + {{- end -}} +{{- end -}} + +{{/* +Return a soft podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.soft" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.soft" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +preferredDuringSchedulingIgnoredDuringExecution: + - podAffinityTerm: + labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 10 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + namespaces: + - {{ .context.Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname + weight: 1 +{{- end -}} + +{{/* +Return a hard podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods.hard" (dict "component" "FOO" "extraMatchLabels" .Values.extraMatchLabels "context" $) -}} +*/}} +{{- define "common.affinities.pods.hard" -}} +{{- $component := default "" .component -}} +{{- $extraMatchLabels := default (dict) .extraMatchLabels -}} +requiredDuringSchedulingIgnoredDuringExecution: + - labelSelector: + matchLabels: {{- (include "common.labels.matchLabels" .context) | nindent 8 }} + {{- if not (empty $component) }} + {{ printf "app.kubernetes.io/component: %s" $component }} + {{- end }} + {{- range $key, $value := $extraMatchLabels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + namespaces: + - {{ .context.Release.Namespace | quote }} + topologyKey: kubernetes.io/hostname +{{- end -}} + +{{/* +Return a podAffinity/podAntiAffinity definition +{{ include "common.affinities.pods" (dict "type" "soft" "key" "FOO" "values" (list "BAR" "BAZ")) -}} +*/}} +{{- define "common.affinities.pods" -}} + {{- if eq .type "soft" }} + {{- include "common.affinities.pods.soft" . -}} + {{- else if eq .type "hard" }} + {{- include "common.affinities.pods.hard" . -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl new file mode 100644 index 00000000..b94212bb --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_capabilities.tpl @@ -0,0 +1,128 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Return the target Kubernetes version +*/}} +{{- define "common.capabilities.kubeVersion" -}} +{{- if .Values.global }} + {{- if .Values.global.kubeVersion }} + {{- .Values.global.kubeVersion -}} + {{- else }} + {{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} + {{- end -}} +{{- else }} +{{- default .Capabilities.KubeVersion.Version .Values.kubeVersion -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for poddisruptionbudget. +*/}} +{{- define "common.capabilities.policy.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "policy/v1beta1" -}} +{{- else -}} +{{- print "policy/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for networkpolicy. +*/}} +{{- define "common.capabilities.networkPolicy.apiVersion" -}} +{{- if semverCompare "<1.7-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for cronjob. +*/}} +{{- define "common.capabilities.cronjob.apiVersion" -}} +{{- if semverCompare "<1.21-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "batch/v1beta1" -}} +{{- else -}} +{{- print "batch/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for deployment. +*/}} +{{- define "common.capabilities.deployment.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for statefulset. +*/}} +{{- define "common.capabilities.statefulset.apiVersion" -}} +{{- if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apps/v1beta1" -}} +{{- else -}} +{{- print "apps/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for ingress. +*/}} +{{- define "common.capabilities.ingress.apiVersion" -}} +{{- if .Values.ingress -}} +{{- if .Values.ingress.apiVersion -}} +{{- .Values.ingress.apiVersion -}} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end }} +{{- else if semverCompare "<1.14-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "extensions/v1beta1" -}} +{{- else if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "networking.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "networking.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for RBAC resources. +*/}} +{{- define "common.capabilities.rbac.apiVersion" -}} +{{- if semverCompare "<1.17-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "rbac.authorization.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "rbac.authorization.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Return the appropriate apiVersion for CRDs. +*/}} +{{- define "common.capabilities.crd.apiVersion" -}} +{{- if semverCompare "<1.19-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "apiextensions.k8s.io/v1beta1" -}} +{{- else -}} +{{- print "apiextensions.k8s.io/v1" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the used Helm version is 3.3+. +A way to check the used Helm version was not introduced until version 3.3.0 with .Capabilities.HelmVersion, which contains an additional "{}}" structure. +This check is introduced as a regexMatch instead of {{ if .Capabilities.HelmVersion }} because checking for the key HelmVersion in <3.3 results in a "interface not found" error. +**To be removed when the catalog's minimun Helm version is 3.3** +*/}} +{{- define "common.capabilities.supportsHelmVersion" -}} +{{- if regexMatch "{(v[0-9])*[^}]*}}$" (.Capabilities | toString ) }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl new file mode 100644 index 00000000..a79cc2e3 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_errors.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Through error when upgrading using empty passwords values that must not be empty. + +Usage: +{{- $validationError00 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password00" "secret" "secretName" "field" "password-00") -}} +{{- $validationError01 := include "common.validations.values.single.empty" (dict "valueKey" "path.to.password01" "secret" "secretName" "field" "password-01") -}} +{{ include "common.errors.upgrade.passwords.empty" (dict "validationErrors" (list $validationError00 $validationError01) "context" $) }} + +Required password params: + - validationErrors - String - Required. List of validation strings to be return, if it is empty it won't throw error. + - context - Context - Required. Parent context. +*/}} +{{- define "common.errors.upgrade.passwords.empty" -}} + {{- $validationErrors := join "" .validationErrors -}} + {{- if and $validationErrors .context.Release.IsUpgrade -}} + {{- $errorString := "\nPASSWORDS ERROR: You must provide your current passwords when upgrading the release." -}} + {{- $errorString = print $errorString "\n Note that even after reinstallation, old credentials may be needed as they may be kept in persistent volume claims." -}} + {{- $errorString = print $errorString "\n Further information can be obtained at https://docs.bitnami.com/general/how-to/troubleshoot-helm-chart-issues/#credential-errors-while-upgrading-chart-releases" -}} + {{- $errorString = print $errorString "\n%s" -}} + {{- printf $errorString $validationErrors | fail -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl new file mode 100644 index 00000000..42ffbc72 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_images.tpl @@ -0,0 +1,75 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper image name +{{ include "common.images.image" ( dict "imageRoot" .Values.path.to.the.image "global" $) }} +*/}} +{{- define "common.images.image" -}} +{{- $registryName := .imageRoot.registry -}} +{{- $repositoryName := .imageRoot.repository -}} +{{- $tag := .imageRoot.tag | toString -}} +{{- if .global }} + {{- if .global.imageRegistry }} + {{- $registryName = .global.imageRegistry -}} + {{- end -}} +{{- end -}} +{{- if $registryName }} +{{- printf "%s/%s:%s" $registryName $repositoryName $tag -}} +{{- else -}} +{{- printf "%s:%s" $repositoryName $tag -}} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names (deprecated: use common.images.renderPullSecrets instead) +{{ include "common.images.pullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "global" .Values.global) }} +*/}} +{{- define "common.images.pullSecrets" -}} + {{- $pullSecrets := list }} + + {{- if .global }} + {{- range .global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets . -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names evaluating values as templates +{{ include "common.images.renderPullSecrets" ( dict "images" (list .Values.path.to.the.image1, .Values.path.to.the.image2) "context" $) }} +*/}} +{{- define "common.images.renderPullSecrets" -}} + {{- $pullSecrets := list }} + {{- $context := .context }} + + {{- if $context.Values.global }} + {{- range $context.Values.global.imagePullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- range .images -}} + {{- range .pullSecrets -}} + {{- $pullSecrets = append $pullSecrets (include "common.tplvalues.render" (dict "value" . "context" $context)) -}} + {{- end -}} + {{- end -}} + + {{- if (not (empty $pullSecrets)) }} +imagePullSecrets: + {{- range $pullSecrets }} + - name: {{ . }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl new file mode 100644 index 00000000..8caf73a6 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_ingress.tpl @@ -0,0 +1,68 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Generate backend entry that is compatible with all Kubernetes API versions. + +Usage: +{{ include "common.ingress.backend" (dict "serviceName" "backendName" "servicePort" "backendPort" "context" $) }} + +Params: + - serviceName - String. Name of an existing service backend + - servicePort - String/Int. Port name (or number) of the service. It will be translated to different yaml depending if it is a string or an integer. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.ingress.backend" -}} +{{- $apiVersion := (include "common.capabilities.ingress.apiVersion" .context) -}} +{{- if or (eq $apiVersion "extensions/v1beta1") (eq $apiVersion "networking.k8s.io/v1beta1") -}} +serviceName: {{ .serviceName }} +servicePort: {{ .servicePort }} +{{- else -}} +service: + name: {{ .serviceName }} + port: + {{- if typeIs "string" .servicePort }} + name: {{ .servicePort }} + {{- else if or (typeIs "int" .servicePort) (typeIs "float64" .servicePort) }} + number: {{ .servicePort | int }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +Print "true" if the API pathType field is supported +Usage: +{{ include "common.ingress.supportsPathType" . }} +*/}} +{{- define "common.ingress.supportsPathType" -}} +{{- if (semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .)) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Returns true if the ingressClassname field is supported +Usage: +{{ include "common.ingress.supportsIngressClassname" . }} +*/}} +{{- define "common.ingress.supportsIngressClassname" -}} +{{- if semverCompare "<1.18-0" (include "common.capabilities.kubeVersion" .) -}} +{{- print "false" -}} +{{- else -}} +{{- print "true" -}} +{{- end -}} +{{- end -}} + +{{/* +Return true if cert-manager required annotations for TLS signed +certificates are set in the Ingress annotations +Ref: https://cert-manager.io/docs/usage/ingress/#supported-annotations +Usage: +{{ include "common.ingress.certManagerRequest" ( dict "annotations" .Values.path.to.the.ingress.annotations ) }} +*/}} +{{- define "common.ingress.certManagerRequest" -}} +{{ if or (hasKey .annotations "cert-manager.io/cluster-issuer") (hasKey .annotations "cert-manager.io/issuer") }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl new file mode 100644 index 00000000..252066c7 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_labels.tpl @@ -0,0 +1,18 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Kubernetes standard labels +*/}} +{{- define "common.labels.standard" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +helm.sh/chart: {{ include "common.names.chart" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* +Labels to use on deploy.spec.selector.matchLabels and svc.spec.selector +*/}} +{{- define "common.labels.matchLabels" -}} +app.kubernetes.io/name: {{ include "common.names.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl new file mode 100644 index 00000000..c8574d17 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_names.tpl @@ -0,0 +1,63 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "common.names.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "common.names.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "common.names.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create a default fully qualified dependency name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +Usage: +{{ include "common.names.dependency.fullname" (dict "chartName" "dependency-chart-name" "chartValues" .Values.dependency-chart "context" $) }} +*/}} +{{- define "common.names.dependency.fullname" -}} +{{- if .chartValues.fullnameOverride -}} +{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .chartName .chartValues.nameOverride -}} +{{- if contains $name .context.Release.Name -}} +{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Allow the release namespace to be overridden for multi-namespace deployments in combined charts. +*/}} +{{- define "common.names.namespace" -}} +{{- if .Values.namespaceOverride -}} +{{- .Values.namespaceOverride -}} +{{- else -}} +{{- .Release.Namespace -}} +{{- end -}} +{{- end -}} \ No newline at end of file diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl new file mode 100644 index 00000000..a53fb44f --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_secrets.tpl @@ -0,0 +1,140 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Generate secret name. + +Usage: +{{ include "common.secrets.name" (dict "existingSecret" .Values.path.to.the.existingSecret "defaultNameSuffix" "mySuffix" "context" $) }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret + - defaultNameSuffix - String - Optional. It is used only if we have several secrets in the same deployment. + - context - Dict - Required. The context for the template evaluation. +*/}} +{{- define "common.secrets.name" -}} +{{- $name := (include "common.names.fullname" .context) -}} + +{{- if .defaultNameSuffix -}} +{{- $name = printf "%s-%s" $name .defaultNameSuffix | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{- with .existingSecret -}} +{{- if not (typeIs "string" .) -}} +{{- with .name -}} +{{- $name = . -}} +{{- end -}} +{{- else -}} +{{- $name = . -}} +{{- end -}} +{{- end -}} + +{{- printf "%s" $name -}} +{{- end -}} + +{{/* +Generate secret key. + +Usage: +{{ include "common.secrets.key" (dict "existingSecret" .Values.path.to.the.existingSecret "key" "keyName") }} + +Params: + - existingSecret - ExistingSecret/String - Optional. The path to the existing secrets in the values.yaml given by the user + to be used instead of the default one. Allows for it to be of type String (just the secret name) for backwards compatibility. + +info: https://github.com/bitnami/charts/tree/master/bitnami/common#existingsecret + - key - String - Required. Name of the key in the secret. +*/}} +{{- define "common.secrets.key" -}} +{{- $key := .key -}} + +{{- if .existingSecret -}} + {{- if not (typeIs "string" .existingSecret) -}} + {{- if .existingSecret.keyMapping -}} + {{- $key = index .existingSecret.keyMapping $.key -}} + {{- end -}} + {{- end }} +{{- end -}} + +{{- printf "%s" $key -}} +{{- end -}} + +{{/* +Generate secret password or retrieve one if already created. + +Usage: +{{ include "common.secrets.passwords.manage" (dict "secret" "secret-name" "key" "keyName" "providedValues" (list "path.to.password1" "path.to.password2") "length" 10 "strong" false "chartName" "chartName" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - key - String - Required - Name of the key in the secret. + - providedValues - List - Required - The path to the validating value in the values.yaml, e.g: "mysql.password". Will pick first parameter with a defined value. + - length - int - Optional - Length of the generated random password. + - strong - Boolean - Optional - Whether to add symbols to the generated random password. + - chartName - String - Optional - Name of the chart used when said chart is deployed as a subchart. + - context - Context - Required - Parent context. + +The order in which this function returns a secret password: + 1. Already existing 'Secret' resource + (If a 'Secret' resource is found under the name provided to the 'secret' parameter to this function and that 'Secret' resource contains a key with the name passed as the 'key' parameter to this function then the value of this existing secret password will be returned) + 2. Password provided via the values.yaml + (If one of the keys passed to the 'providedValues' parameter to this function is a valid path to a key in the values.yaml and has a value, the value of the first key with a value will be returned) + 3. Randomly generated secret password + (A new random secret password with the length specified in the 'length' parameter will be generated and returned) + +*/}} +{{- define "common.secrets.passwords.manage" -}} + +{{- $password := "" }} +{{- $subchart := "" }} +{{- $chartName := default "" .chartName }} +{{- $passwordLength := default 10 .length }} +{{- $providedPasswordKey := include "common.utils.getKeyFromList" (dict "keys" .providedValues "context" $.context) }} +{{- $providedPasswordValue := include "common.utils.getValueFromKey" (dict "key" $providedPasswordKey "context" $.context) }} +{{- $secretData := (lookup "v1" "Secret" $.context.Release.Namespace .secret).data }} +{{- if $secretData }} + {{- if hasKey $secretData .key }} + {{- $password = index $secretData .key }} + {{- else }} + {{- printf "\nPASSWORDS ERROR: The secret \"%s\" does not contain the key \"%s\"\n" .secret .key | fail -}} + {{- end -}} +{{- else if $providedPasswordValue }} + {{- $password = $providedPasswordValue | toString | b64enc | quote }} +{{- else }} + + {{- if .context.Values.enabled }} + {{- $subchart = $chartName }} + {{- end -}} + + {{- $requiredPassword := dict "valueKey" $providedPasswordKey "secret" .secret "field" .key "subchart" $subchart "context" $.context -}} + {{- $requiredPasswordError := include "common.validations.values.single.empty" $requiredPassword -}} + {{- $passwordValidationErrors := list $requiredPasswordError -}} + {{- include "common.errors.upgrade.passwords.empty" (dict "validationErrors" $passwordValidationErrors "context" $.context) -}} + + {{- if .strong }} + {{- $subStr := list (lower (randAlpha 1)) (randNumeric 1) (upper (randAlpha 1)) | join "_" }} + {{- $password = randAscii $passwordLength }} + {{- $password = regexReplaceAllLiteral "\\W" $password "@" | substr 5 $passwordLength }} + {{- $password = printf "%s%s" $subStr $password | toString | shuffle | b64enc | quote }} + {{- else }} + {{- $password = randAlphaNum $passwordLength | b64enc | quote }} + {{- end }} +{{- end -}} +{{- printf "%s" $password -}} +{{- end -}} + +{{/* +Returns whether a previous generated secret already exists + +Usage: +{{ include "common.secrets.exists" (dict "secret" "secret-name" "context" $) }} + +Params: + - secret - String - Required - Name of the 'Secret' resource where the password is stored. + - context - Context - Required - Parent context. +*/}} +{{- define "common.secrets.exists" -}} +{{- $secret := (lookup "v1" "Secret" $.context.Release.Namespace .secret) }} +{{- if $secret }} + {{- true -}} +{{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl new file mode 100644 index 00000000..60e2a844 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_storage.tpl @@ -0,0 +1,23 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Return the proper Storage Class +{{ include "common.storage.class" ( dict "persistence" .Values.path.to.the.persistence "global" $) }} +*/}} +{{- define "common.storage.class" -}} + +{{- $storageClass := .persistence.storageClass -}} +{{- if .global -}} + {{- if .global.storageClass -}} + {{- $storageClass = .global.storageClass -}} + {{- end -}} +{{- end -}} + +{{- if $storageClass -}} + {{- if (eq "-" $storageClass) -}} + {{- printf "storageClassName: \"\"" -}} + {{- else }} + {{- printf "storageClassName: %s" $storageClass -}} + {{- end -}} +{{- end -}} + +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl new file mode 100644 index 00000000..2db16685 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_tplvalues.tpl @@ -0,0 +1,13 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Renders a value that contains template. +Usage: +{{ include "common.tplvalues.render" ( dict "value" .Values.path.to.the.Value "context" $) }} +*/}} +{{- define "common.tplvalues.render" -}} + {{- if typeIs "string" .value }} + {{- tpl .value .context }} + {{- else }} + {{- tpl (.value | toYaml) .context }} + {{- end }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl new file mode 100644 index 00000000..ea083a24 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_utils.tpl @@ -0,0 +1,62 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Print instructions to get a secret value. +Usage: +{{ include "common.utils.secret.getvalue" (dict "secret" "secret-name" "field" "secret-value-field" "context" $) }} +*/}} +{{- define "common.utils.secret.getvalue" -}} +{{- $varname := include "common.utils.fieldToEnvVar" . -}} +export {{ $varname }}=$(kubectl get secret --namespace {{ .context.Release.Namespace | quote }} {{ .secret }} -o jsonpath="{.data.{{ .field }}}" | base64 --decode) +{{- end -}} + +{{/* +Build env var name given a field +Usage: +{{ include "common.utils.fieldToEnvVar" dict "field" "my-password" }} +*/}} +{{- define "common.utils.fieldToEnvVar" -}} + {{- $fieldNameSplit := splitList "-" .field -}} + {{- $upperCaseFieldNameSplit := list -}} + + {{- range $fieldNameSplit -}} + {{- $upperCaseFieldNameSplit = append $upperCaseFieldNameSplit ( upper . ) -}} + {{- end -}} + + {{ join "_" $upperCaseFieldNameSplit }} +{{- end -}} + +{{/* +Gets a value from .Values given +Usage: +{{ include "common.utils.getValueFromKey" (dict "key" "path.to.key" "context" $) }} +*/}} +{{- define "common.utils.getValueFromKey" -}} +{{- $splitKey := splitList "." .key -}} +{{- $value := "" -}} +{{- $latestObj := $.context.Values -}} +{{- range $splitKey -}} + {{- if not $latestObj -}} + {{- printf "please review the entire path of '%s' exists in values" $.key | fail -}} + {{- end -}} + {{- $value = ( index $latestObj . ) -}} + {{- $latestObj = $value -}} +{{- end -}} +{{- printf "%v" (default "" $value) -}} +{{- end -}} + +{{/* +Returns first .Values key with a defined value or first of the list if all non-defined +Usage: +{{ include "common.utils.getKeyFromList" (dict "keys" (list "path.to.key1" "path.to.key2") "context" $) }} +*/}} +{{- define "common.utils.getKeyFromList" -}} +{{- $key := first .keys -}} +{{- $reverseKeys := reverse .keys }} +{{- range $reverseKeys }} + {{- $value := include "common.utils.getValueFromKey" (dict "key" . "context" $.context ) }} + {{- if $value -}} + {{- $key = . }} + {{- end -}} +{{- end -}} +{{- printf "%s" $key -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl new file mode 100644 index 00000000..ae10fa41 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/_warnings.tpl @@ -0,0 +1,14 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Warning about using rolling tag. +Usage: +{{ include "common.warnings.rollingTag" .Values.path.to.the.imageRoot }} +*/}} +{{- define "common.warnings.rollingTag" -}} + +{{- if and (contains "bitnami/" .repository) (not (.tag | toString | regexFind "-r\\d+$|sha256:")) }} +WARNING: Rolling tag detected ({{ .repository }}:{{ .tag }}), please note that it is strongly recommended to avoid using rolling tags in a production environment. ++info https://docs.bitnami.com/containers/how-to/understand-rolling-tags-containers/ +{{- end }} + +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl new file mode 100644 index 00000000..ded1ae3b --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_cassandra.tpl @@ -0,0 +1,72 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Cassandra required passwords are not empty. + +Usage: +{{ include "common.validations.values.cassandra.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where Cassandra values are stored, e.g: "cassandra-passwords-secret" + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.cassandra.passwords" -}} + {{- $existingSecret := include "common.cassandra.values.existingSecret" . -}} + {{- $enabled := include "common.cassandra.values.enabled" . -}} + {{- $dbUserPrefix := include "common.cassandra.values.key.dbUser" . -}} + {{- $valueKeyPassword := printf "%s.password" $dbUserPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "cassandra-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.cassandra.values.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.cassandra.dbUser.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.dbUser.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled cassandra. + +Usage: +{{ include "common.cassandra.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.cassandra.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.cassandra.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key dbUser + +Usage: +{{ include "common.cassandra.values.key.dbUser" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether Cassandra is used as subchart or not. Default: false +*/}} +{{- define "common.cassandra.values.key.dbUser" -}} + {{- if .subchart -}} + cassandra.dbUser + {{- else -}} + dbUser + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl new file mode 100644 index 00000000..b6906ff7 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mariadb.tpl @@ -0,0 +1,103 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MariaDB required passwords are not empty. + +Usage: +{{ include "common.validations.values.mariadb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MariaDB values are stored, e.g: "mysql-passwords-secret" + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mariadb.passwords" -}} + {{- $existingSecret := include "common.mariadb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mariadb.values.enabled" . -}} + {{- $architecture := include "common.mariadb.values.architecture" . -}} + {{- $authPrefix := include "common.mariadb.values.key.auth" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicationPassword := printf "%s.replicationPassword" $authPrefix -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mariadb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- if not (empty $valueUsername) -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mariadb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replication") -}} + {{- $requiredReplicationPassword := dict "valueKey" $valueKeyReplicationPassword "secret" .secret "field" "mariadb-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mariadb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mariadb. + +Usage: +{{ include "common.mariadb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mariadb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mariadb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mariadb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mariadb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mariadb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mariadb.values.key.auth" -}} + {{- if .subchart -}} + mariadb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl new file mode 100644 index 00000000..a071ea4d --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_mongodb.tpl @@ -0,0 +1,108 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate MongoDB® required passwords are not empty. + +Usage: +{{ include "common.validations.values.mongodb.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where MongoDB® values are stored, e.g: "mongodb-passwords-secret" + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.mongodb.passwords" -}} + {{- $existingSecret := include "common.mongodb.values.auth.existingSecret" . -}} + {{- $enabled := include "common.mongodb.values.enabled" . -}} + {{- $authPrefix := include "common.mongodb.values.key.auth" . -}} + {{- $architecture := include "common.mongodb.values.architecture" . -}} + {{- $valueKeyRootPassword := printf "%s.rootPassword" $authPrefix -}} + {{- $valueKeyUsername := printf "%s.username" $authPrefix -}} + {{- $valueKeyDatabase := printf "%s.database" $authPrefix -}} + {{- $valueKeyPassword := printf "%s.password" $authPrefix -}} + {{- $valueKeyReplicaSetKey := printf "%s.replicaSetKey" $authPrefix -}} + {{- $valueKeyAuthEnabled := printf "%s.enabled" $authPrefix -}} + + {{- $authEnabled := include "common.utils.getValueFromKey" (dict "key" $valueKeyAuthEnabled "context" .context) -}} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") (eq $authEnabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $requiredRootPassword := dict "valueKey" $valueKeyRootPassword "secret" .secret "field" "mongodb-root-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRootPassword -}} + + {{- $valueUsername := include "common.utils.getValueFromKey" (dict "key" $valueKeyUsername "context" .context) }} + {{- $valueDatabase := include "common.utils.getValueFromKey" (dict "key" $valueKeyDatabase "context" .context) }} + {{- if and $valueUsername $valueDatabase -}} + {{- $requiredPassword := dict "valueKey" $valueKeyPassword "secret" .secret "field" "mongodb-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPassword -}} + {{- end -}} + + {{- if (eq $architecture "replicaset") -}} + {{- $requiredReplicaSetKey := dict "valueKey" $valueKeyReplicaSetKey "secret" .secret "field" "mongodb-replica-set-key" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredReplicaSetKey -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.mongodb.values.auth.existingSecret" (dict "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDb is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.auth.existingSecret" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.auth.existingSecret | quote -}} + {{- else -}} + {{- .context.Values.auth.existingSecret | quote -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled mongodb. + +Usage: +{{ include "common.mongodb.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.mongodb.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.mongodb.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key auth + +Usage: +{{ include "common.mongodb.values.key.auth" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MongoDB® is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.key.auth" -}} + {{- if .subchart -}} + mongodb.auth + {{- else -}} + auth + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for architecture + +Usage: +{{ include "common.mongodb.values.architecture" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether MariaDB is used as subchart or not. Default: false +*/}} +{{- define "common.mongodb.values.architecture" -}} + {{- if .subchart -}} + {{- .context.Values.mongodb.architecture -}} + {{- else -}} + {{- .context.Values.architecture -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl new file mode 100644 index 00000000..164ec0d0 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_postgresql.tpl @@ -0,0 +1,129 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate PostgreSQL required passwords are not empty. + +Usage: +{{ include "common.validations.values.postgresql.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where postgresql values are stored, e.g: "postgresql-passwords-secret" + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.postgresql.passwords" -}} + {{- $existingSecret := include "common.postgresql.values.existingSecret" . -}} + {{- $enabled := include "common.postgresql.values.enabled" . -}} + {{- $valueKeyPostgresqlPassword := include "common.postgresql.values.key.postgressPassword" . -}} + {{- $valueKeyPostgresqlReplicationEnabled := include "common.postgresql.values.key.replicationPassword" . -}} + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + {{- $requiredPostgresqlPassword := dict "valueKey" $valueKeyPostgresqlPassword "secret" .secret "field" "postgresql-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlPassword -}} + + {{- $enabledReplication := include "common.postgresql.values.enabled.replication" . -}} + {{- if (eq $enabledReplication "true") -}} + {{- $requiredPostgresqlReplicationPassword := dict "valueKey" $valueKeyPostgresqlReplicationEnabled "secret" .secret "field" "postgresql-replication-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredPostgresqlReplicationPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to decide whether evaluate global values. + +Usage: +{{ include "common.postgresql.values.use.global" (dict "key" "key-of-global" "context" $) }} +Params: + - key - String - Required. Field to be evaluated within global, e.g: "existingSecret" +*/}} +{{- define "common.postgresql.values.use.global" -}} + {{- if .context.Values.global -}} + {{- if .context.Values.global.postgresql -}} + {{- index .context.Values.global.postgresql .key | quote -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for existingSecret. + +Usage: +{{ include "common.postgresql.values.existingSecret" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.existingSecret" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "existingSecret" "context" .context) -}} + + {{- if .subchart -}} + {{- default (.context.Values.postgresql.existingSecret | quote) $globalValue -}} + {{- else -}} + {{- default (.context.Values.existingSecret | quote) $globalValue -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled postgresql. + +Usage: +{{ include "common.postgresql.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.postgresql.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key postgressPassword. + +Usage: +{{ include "common.postgresql.values.key.postgressPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.postgressPassword" -}} + {{- $globalValue := include "common.postgresql.values.use.global" (dict "key" "postgresqlUsername" "context" .context) -}} + + {{- if not $globalValue -}} + {{- if .subchart -}} + postgresql.postgresqlPassword + {{- else -}} + postgresqlPassword + {{- end -}} + {{- else -}} + global.postgresql.postgresqlPassword + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled.replication. + +Usage: +{{ include "common.postgresql.values.enabled.replication" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.enabled.replication" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.postgresql.replication.enabled -}} + {{- else -}} + {{- printf "%v" .context.Values.replication.enabled -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for the key replication.password. + +Usage: +{{ include "common.postgresql.values.key.replicationPassword" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether postgresql is used as subchart or not. Default: false +*/}} +{{- define "common.postgresql.values.key.replicationPassword" -}} + {{- if .subchart -}} + postgresql.replication.password + {{- else -}} + replication.password + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl new file mode 100644 index 00000000..5d72959b --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_redis.tpl @@ -0,0 +1,76 @@ + +{{/* vim: set filetype=mustache: */}} +{{/* +Validate Redis™ required passwords are not empty. + +Usage: +{{ include "common.validations.values.redis.passwords" (dict "secret" "secretName" "subchart" false "context" $) }} +Params: + - secret - String - Required. Name of the secret where redis values are stored, e.g: "redis-passwords-secret" + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.validations.values.redis.passwords" -}} + {{- $enabled := include "common.redis.values.enabled" . -}} + {{- $valueKeyPrefix := include "common.redis.values.keys.prefix" . -}} + {{- $standarizedVersion := include "common.redis.values.standarized.version" . }} + + {{- $existingSecret := ternary (printf "%s%s" $valueKeyPrefix "auth.existingSecret") (printf "%s%s" $valueKeyPrefix "existingSecret") (eq $standarizedVersion "true") }} + {{- $existingSecretValue := include "common.utils.getValueFromKey" (dict "key" $existingSecret "context" .context) }} + + {{- $valueKeyRedisPassword := ternary (printf "%s%s" $valueKeyPrefix "auth.password") (printf "%s%s" $valueKeyPrefix "password") (eq $standarizedVersion "true") }} + {{- $valueKeyRedisUseAuth := ternary (printf "%s%s" $valueKeyPrefix "auth.enabled") (printf "%s%s" $valueKeyPrefix "usePassword") (eq $standarizedVersion "true") }} + + {{- if and (or (not $existingSecret) (eq $existingSecret "\"\"")) (eq $enabled "true") -}} + {{- $requiredPasswords := list -}} + + {{- $useAuth := include "common.utils.getValueFromKey" (dict "key" $valueKeyRedisUseAuth "context" .context) -}} + {{- if eq $useAuth "true" -}} + {{- $requiredRedisPassword := dict "valueKey" $valueKeyRedisPassword "secret" .secret "field" "redis-password" -}} + {{- $requiredPasswords = append $requiredPasswords $requiredRedisPassword -}} + {{- end -}} + + {{- include "common.validations.values.multiple.empty" (dict "required" $requiredPasswords "context" .context) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right value for enabled redis. + +Usage: +{{ include "common.redis.values.enabled" (dict "context" $) }} +*/}} +{{- define "common.redis.values.enabled" -}} + {{- if .subchart -}} + {{- printf "%v" .context.Values.redis.enabled -}} + {{- else -}} + {{- printf "%v" (not .context.Values.enabled) -}} + {{- end -}} +{{- end -}} + +{{/* +Auxiliary function to get the right prefix path for the values + +Usage: +{{ include "common.redis.values.key.prefix" (dict "subchart" "true" "context" $) }} +Params: + - subchart - Boolean - Optional. Whether redis is used as subchart or not. Default: false +*/}} +{{- define "common.redis.values.keys.prefix" -}} + {{- if .subchart -}}redis.{{- else -}}{{- end -}} +{{- end -}} + +{{/* +Checks whether the redis chart's includes the standarizations (version >= 14) + +Usage: +{{ include "common.redis.values.standarized.version" (dict "context" $) }} +*/}} +{{- define "common.redis.values.standarized.version" -}} + + {{- $standarizedAuth := printf "%s%s" (include "common.redis.values.keys.prefix" .) "auth" -}} + {{- $standarizedAuthValues := include "common.utils.getValueFromKey" (dict "key" $standarizedAuth "context" .context) }} + + {{- if $standarizedAuthValues -}} + {{- true -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl new file mode 100644 index 00000000..9a814cf4 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/templates/validations/_validations.tpl @@ -0,0 +1,46 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Validate values must not be empty. + +Usage: +{{- $validateValueConf00 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-00") -}} +{{- $validateValueConf01 := (dict "valueKey" "path.to.value" "secret" "secretName" "field" "password-01") -}} +{{ include "common.validations.values.empty" (dict "required" (list $validateValueConf00 $validateValueConf01) "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" +*/}} +{{- define "common.validations.values.multiple.empty" -}} + {{- range .required -}} + {{- include "common.validations.values.single.empty" (dict "valueKey" .valueKey "secret" .secret "field" .field "context" $.context) -}} + {{- end -}} +{{- end -}} + +{{/* +Validate a value must not be empty. + +Usage: +{{ include "common.validations.value.empty" (dict "valueKey" "mariadb.password" "secret" "secretName" "field" "my-password" "subchart" "subchart" "context" $) }} + +Validate value params: + - valueKey - String - Required. The path to the validating value in the values.yaml, e.g: "mysql.password" + - secret - String - Optional. Name of the secret where the validating value is generated/stored, e.g: "mysql-passwords-secret" + - field - String - Optional. Name of the field in the secret data, e.g: "mysql-password" + - subchart - String - Optional - Name of the subchart that the validated password is part of. +*/}} +{{- define "common.validations.values.single.empty" -}} + {{- $value := include "common.utils.getValueFromKey" (dict "key" .valueKey "context" .context) }} + {{- $subchart := ternary "" (printf "%s." .subchart) (empty .subchart) }} + + {{- if not $value -}} + {{- $varname := "my-value" -}} + {{- $getCurrentValue := "" -}} + {{- if and .secret .field -}} + {{- $varname = include "common.utils.fieldToEnvVar" . -}} + {{- $getCurrentValue = printf " To get the current value:\n\n %s\n" (include "common.utils.secret.getvalue" .) -}} + {{- end -}} + {{- printf "\n '%s' must not be empty, please add '--set %s%s=$%s' to the command.%s" .valueKey $subchart .valueKey $varname $getCurrentValue -}} + {{- end -}} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml new file mode 100644 index 00000000..f2df68e5 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/charts/common/values.yaml @@ -0,0 +1,5 @@ +## bitnami/common +## It is required by CI/CD tools and processes. +## @skip exampleValue +## +exampleValue: common-chart diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt b/packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt new file mode 100644 index 00000000..d370a31e --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/NOTES.txt @@ -0,0 +1,11 @@ +CHART NAME: {{ .Chart.Name }} +CHART VERSION: {{ .Chart.Version }} +APP VERSION: {{ .Chart.AppVersion }} + +** Please be patient while the chart is being deployed ** + +To verify that kubewatch has started, run: + + kubectl get deploy -w --namespace {{ .Release.Namespace }} {{ template "common.names.fullname" . }} + +{{- include "kubewatch.checkRollingTags" . }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl b/packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl new file mode 100644 index 00000000..e9a51c31 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/_helpers.tpl @@ -0,0 +1,33 @@ +{{/* vim: set filetype=mustache: */}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "kubewatch.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Return the proper Kubewatch image name +*/}} +{{- define "kubewatch.image" -}} +{{ include "common.images.image" (dict "imageRoot" .Values.image "global" .Values.global) }} +{{- end -}} + +{{/* +Return the proper Docker Image Registry Secret Names +*/}} +{{- define "kubewatch.imagePullSecrets" -}} +{{- include "common.images.pullSecrets" (dict "images" (list .Values.image) "global" .Values.global) -}} +{{- end -}} + +{{/* +Check if there are rolling tags in the images +*/}} +{{- define "kubewatch.checkRollingTags" -}} +{{- include "common.warnings.rollingTag" .Values.image }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml new file mode 100644 index 00000000..bcc1e78d --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrole.yaml @@ -0,0 +1,84 @@ +{{- if .Values.rbac.create -}} +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +kind: ClusterRole +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +rules: + - apiGroups: + - "" + resources: + - configmaps + - daemonsets + - deployments + - events + - namespaces + - nodes + - persistentvolumes + - pods + - replicasets + - replicationcontrollers + - secrets + - services + verbs: + - list + - watch + - get + - apiGroups: + - apps + resources: + - daemonsets + - deployments + - deployments/scale + - replicasets + - replicasets/scale + - statefulsets + verbs: + - get + - list + - watch + - apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - list + - watch + - get + - apiGroups: + - extensions + - networking.k8s.io + resources: + - daemonsets + - deployments + - deployments/scale + - ingresses + - replicasets + - replicasets/scale + - replicationcontrollers/scale + verbs: + - get + - list + - watch + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - get + - list + - watch + {{- range .Values.rbac.customRoles }} + - apiGroups: {{ toYaml .apiGroups | nindent 4 }} + resources: {{ toYaml .resources | nindent 4 }} + verbs: {{ toYaml .verbs | nindent 4 }} + {{- end }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..2973f781 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/clusterrolebinding.yaml @@ -0,0 +1,22 @@ +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +apiVersion: {{ include "common.capabilities.rbac.apiVersion" . }} +kind: ClusterRoleBinding +metadata: + name: {{ include "common.names.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ include "common.names.fullname" . }} +subjects: + - kind: ServiceAccount + name: {{ include "kubewatch.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml new file mode 100644 index 00000000..31836f5f --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/configmap.yaml @@ -0,0 +1,51 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ printf "%s-config" (include "common.names.fullname" .) }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +data: + .kubewatch.yaml: | + handler: + {{- if .Values.slack.enabled }} + slack: {{- toYaml .Values.slack | nindent 8 }} + {{- end }} + {{- if .Values.slackwebhook.enabled }} + slackwebhook: {{- toYaml .Values.slackwebhook | nindent 8 }} + {{- end }} + {{- if .Values.hipchat.enabled }} + hipchat: {{- toYaml .Values.hipchat | nindent 8 }} + {{- end }} + {{- if .Values.mattermost.enabled }} + mattermost: {{- toYaml .Values.mattermost | nindent 8 }} + {{- end }} + {{- if .Values.flock.enabled }} + flock: {{- toYaml .Values.flock | nindent 8 }} + {{- end }} + {{- if .Values.webhook.enabled }} + webhook: {{- toYaml .Values.webhook | nindent 8 }} + {{- end }} + {{- if .Values.cloudevent.enabled }} + cloudevent: {{- toYaml .Values.cloudevent | nindent 8 }} + {{- end }} + {{- if .Values.smtp.enabled }} + smtp: {{- toYaml .Values.smtp | nindent 8 }} + {{- end }} + {{- if .Values.msteams.enabled }} + msteams: {{- toYaml .Values.msteams | nindent 8 }} + {{- end }} + {{- with .Values.extraHandlers }} + {{- toYaml . | nindent 6 }} + {{- end }} + {{- if .Values.lark.enabled }} + lark: {{- toYaml .Values.lark | nindent 8 }} + {{- end }} + resource: {{- toYaml .Values.resourcesToWatch | nindent 6 }} + customresources: {{- toYaml .Values.customresources | nindent 6 }} + namespace: {{ .Values.namespaceToWatch | quote }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml new file mode 100644 index 00000000..f1b6adb8 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/deployment.yaml @@ -0,0 +1,136 @@ +apiVersion: {{ include "common.capabilities.deployment.apiVersion" . }} +kind: Deployment +metadata: + name: {{ template "common.names.fullname" . }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if .Values.commonAnnotations }} + annotations: {{- include "common.tplvalues.render" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: {{- include "common.labels.matchLabels" . | nindent 6 }} + replicas: {{ .Values.replicaCount }} + {{- if .Values.updateStrategy }} + strategy: {{- toYaml .Values.updateStrategy | nindent 4 }} + {{- end }} + template: + metadata: + annotations: + checksum/config-map: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- if .Values.podAnnotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.podAnnotations "context" $) | nindent 8 }} + {{- end }} + labels: {{- include "common.labels.standard" . | nindent 8 }} + {{- if .Values.podLabels }} + {{- include "common.tplvalues.render" (dict "value" .Values.podLabels "context" $) | nindent 8 }} + {{- end }} + spec: + {{- include "kubewatch.imagePullSecrets" . | nindent 6 }} + {{- if .Values.hostAliases }} + hostAliases: {{- include "common.tplvalues.render" (dict "value" .Values.hostAliases "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.affinity }} + affinity: {{- include "common.tplvalues.render" (dict "value" .Values.affinity "context" $) | nindent 8 }} + {{- else }} + affinity: + podAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAffinityPreset "context" $) | nindent 10 }} + podAntiAffinity: {{- include "common.affinities.pods" (dict "type" .Values.podAntiAffinityPreset "context" $) | nindent 10 }} + nodeAffinity: {{- include "common.affinities.nodes" (dict "type" .Values.nodeAffinityPreset.type "key" .Values.nodeAffinityPreset.key "values" .Values.nodeAffinityPreset.values) | nindent 10 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{- include "common.tplvalues.render" (dict "value" .Values.nodeSelector "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{- include "common.tplvalues.render" (dict "value" .Values.tolerations "context" $) | nindent 8 }} + {{- end }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName | quote }} + {{- end }} + {{- if .Values.schedulerName }} + schedulerName: {{ .Values.schedulerName }} + {{- end }} + {{- if .Values.topologySpreadConstraints }} + topologySpreadConstraints: {{- include "common.tplvalues.render" (dict "value" .Values.topologySpreadConstraints "context" .) | nindent 8 }} + {{- end }} + restartPolicy: Always + serviceAccountName: {{ include "kubewatch.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.initContainers }} + initContainers: {{- include "common.tplvalues.render" (dict "value" .Values.initContainers "context" $) | nindent 8 }} + {{- end }} + containers: + - name: kubewatch + image: {{ template "kubewatch.image" . }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.command "context" $) | nindent 12 }} + {{- else if .Values.command }} + command: {{- include "common.tplvalues.render" (dict "value" .Values.command "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.diagnosticMode.enabled }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.diagnosticMode.args "context" $) | nindent 12 }} + {{- else if .Values.args }} + args: {{- include "common.tplvalues.render" (dict "value" .Values.args "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.lifecycleHooks }} + lifecycle: {{- include "common.tplvalues.render" (dict "value" .Values.lifecycleHooks "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.extraEnvVars }} + env: {{- include "common.tplvalues.render" (dict "value" .Values.extraEnvVars "context" $) | nindent 12 }} + {{- end }} + {{- if or .Values.extraEnvVarsCM .Values.extraEnvVarsSecret }} + envFrom: + {{- if .Values.extraEnvVarsCM }} + - configMapRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsCM "context" $) }} + {{- end }} + {{- if .Values.extraEnvVarsSecret }} + - secretRef: + name: {{ include "common.tplvalues.render" (dict "value" .Values.extraEnvVarsSecret "context" $) }} + {{- end }} + {{- end }} + {{- if not .Values.diagnosticMode.enabled }} + {{- if .Values.startupProbe.enabled }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" (omit .Values.startupProbe "enabled") "context" $) | nindent 12 }} + {{- else if .Values.customStartupProbe }} + startupProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customStartupProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.livenessProbe.enabled }} + livenessProbe: {{- omit .Values.livenessProbe "enabled" | toYaml | nindent 12 }} + {{- else if .Values.customLivenessProbe }} + livenessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customLivenessProbe "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.readinessProbe.enabled }} + readinessProbe: {{- omit .Values.readinessProbe "enabled" | toYaml | nindent 12 }} + {{- else if .Values.customReadinessProbe }} + readinessProbe: {{- include "common.tplvalues.render" (dict "value" .Values.customReadinessProbe "context" $) | nindent 12 }} + {{- end }} + {{- end }} + {{- if .Values.resources }} + resources: {{- toYaml .Values.resources | nindent 12 }} + {{- end }} + volumeMounts: + - name: configuration + mountPath: /opt/bitnami/kubewatch/.kubewatch.yaml + subPath: .kubewatch.yaml + {{- if .Values.extraVolumeMounts }} + {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumeMounts "context" $) | nindent 12 }} + {{- end }} + {{- if .Values.sidecars }} + {{- include "common.tplvalues.render" ( dict "value" .Values.sidecars "context" $) | nindent 8 }} + {{- end }} + volumes: + - name: configuration + configMap: + name: {{ printf "%s-config" (include "common.names.fullname" .) }} + {{- if .Values.extraVolumes }} + {{- include "common.tplvalues.render" (dict "value" .Values.extraVolumes "context" $) | nindent 8 }} + {{- end }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml new file mode 100644 index 00000000..9ac65f9e --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/extra-list.yaml @@ -0,0 +1,4 @@ +{{- range .Values.extraDeploy }} +--- +{{ include "common.tplvalues.render" (dict "value" . "context" $) }} +{{- end }} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml new file mode 100644 index 00000000..05a6bebf --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/templates/serviceaccount.yaml @@ -0,0 +1,21 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "kubewatch.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: {{- include "common.labels.standard" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "common.tplvalues.render" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + {{- if or .Values.serviceAccount.annotations .Values.commonAnnotations }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.commonAnnotations "context" $) | nindent 4 }} + {{- end }} + {{- if .Values.serviceAccount.annotations }} + {{- include "common.tplvalues.render" (dict "value" .Values.serviceAccount.annotations "context" $) | nindent 4 }} + {{- end }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end -}} diff --git a/packs/kubewatch-3.5.0/charts/kubewatch/values.yaml b/packs/kubewatch-3.5.0/charts/kubewatch/values.yaml new file mode 100644 index 00000000..0a9eca23 --- /dev/null +++ b/packs/kubewatch-3.5.0/charts/kubewatch/values.yaml @@ -0,0 +1,474 @@ +## @section Global parameters +## Global Docker image parameters +## Please, note that this will override the image parameters, including dependencies, configured to use the global value +## Current available global Docker image parameters: imageRegistry, imagePullSecrets and storageClass + +## @param global.imageRegistry Global Docker image registry +## @param global.imagePullSecrets Global Docker registry secret names as an array +## +global: + imageRegistry: "" + ## E.g. + ## imagePullSecrets: + ## - myRegistryKeySecretName + ## + imagePullSecrets: [] + +## @section Common parameters + +## @param kubeVersion Force target Kubernetes version (using Helm capabilities if not set) +## +kubeVersion: "" +## @param nameOverride String to partially override common.names.fullname template +## +nameOverride: "" +## @param fullnameOverride String to fully override common.names.fullname template +## +fullnameOverride: "" +## @param commonLabels Labels to add to all deployed objects +## +commonLabels: {} +## @param commonAnnotations Annotations to add to all deployed objects +## +commonAnnotations: {} +## Enable diagnostic mode in the deployment(s)/statefulset(s) +## +diagnosticMode: + ## @param diagnosticMode.enabled Enable diagnostic mode (all probes will be disabled and the command will be overridden) + ## + enabled: false + ## @param diagnosticMode.command Command to override all containers in the the deployment(s)/statefulset(s) + ## + command: + - sleep + ## @param diagnosticMode.args Args to override all containers in the the deployment(s)/statefulset(s) + ## + args: + - infinity +## @param extraDeploy Array of extra objects to deploy with the release +## +extraDeploy: [] + +## @section Kubewatch parameters + +## Robusta Kubewatch image versions +## ref: https://hub.docker.com/r/robustadev/kubewatch/tags +## Bitnami Kubewatch image versions (depricated) +## ref: https://hub.docker.com/r/bitnami/kubewatch-archived/tags +## @param image.repository Kubewatch image repository +## @param image.tag Kubewatch image tag (immutable tags are recommended) +## @param image.pullPolicy Kubewatch image pull policy +## @param image.pullSecrets Specify docker-registry secret names as an array +## +image: + repository: robustadev/kubewatch + tag: v2.9.0 + ## Specify a imagePullPolicy + ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent' + ## ref: https://kubernetes.io/docs/user-guide/images/#pre-pulling-images + ## + pullPolicy: IfNotPresent + ## Optionally specify an array of imagePullSecrets. + ## Secrets must be manually created in the namespace. + ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + ## Example: + ## pullSecrets: + ## - myRegistryKeySecretName + ## + pullSecrets: [] +## @param hostAliases Add deployment host aliases +## https://kubernetes.io/docs/concepts/services-networking/add-entries-to-pod-etc-hosts-with-host-aliases/ +## +hostAliases: [] +## @param slack.enabled Enable Slack notifications +## @param slack.channel Slack channel to notify +## @param slack.token Slack API token +## +slack: + enabled: true + channel: "XXXX" + ## Create using: https://my.slack.com/services/new/bot and invite the bot to your channel using: /join @botname + ## + token: "XXXX" +## @param slackwebhook.enabled Enable SlackWebhook notifications +## @param slackwebhook.channel Slack channel to notify +## @param slackwebhook.username Slack username +## @param slackwebhook.emoji Slack emoji +## @param slackwebhook.slackwebhookurl Slack Webhook Url +## +slackwebhook: + enabled: false + channel: "XXXX" + username: "" + emoji: "" + slackwebhookurl: "XXXX" +## @param hipchat.enabled Enable HipChat notifications +## @param hipchat.room HipChat room to notify +## @param hipchat.token HipChat token +## @param hipchat.url HipChat URL +## +hipchat: + enabled: false + room: "" + token: "" + url: "" +## @param mattermost.enabled Enable Mattermost notifications +## @param mattermost.channel Mattermost channel to notify +## @param mattermost.url Mattermost URL +## @param mattermost.username Mattermost user to notify +## +mattermost: + enabled: false + channel: "" + url: "" + username: "" +## @param flock.enabled Enable Flock notifications +## @param flock.url Flock URL +## +flock: + enabled: false + url: "" +## @param msteams.enabled Enable Microsoft Teams notifications +## @param msteams.webhookurl Microsoft Teams webhook URL +## +msteams: + enabled: false + webhookurl: "" +## @param webhook.enabled Enable Webhook notifications +## @param webhook.url Webhook URL +## +webhook: + enabled: false + url: "" +## @param cloudevent.enabled Enable Cloudevent notifications +## @param cloudevent.url Cloudevent URL +## +cloudevent: + enabled: false + url: "" +## @param lark.enabled Enable Lark notifications +## @param lark.url lark webhook URL +## See: https://open.feishu.cn/document/ukTMukTMukTM/ucTM5YjL3ETO24yNxkjN +## +lark: + enabled: false + webhookurl: "" + +smtp: + ## @param smtp.enabled Enable SMTP (email) notifications + ## + enabled: false + ## @param smtp.to Destination email address (required) + ## + to: "" + ## @param smtp.from Source email address (required) + ## + from: "" + ## @param smtp.hello SMTP hello field (optional) + ## + hello: "" + ## @param smtp.smarthost SMTP server address (name:port) (required) + ## + smarthost: "" + ## @param smtp.subject Source email subject + ## + subject: "" + ## @param smtp.auth.username Username for LOGIN and PLAIN auth mech + ## @param smtp.auth.password Password for LOGIN and PLAIN auth mech + ## @param smtp.auth.secret Secret for CRAM-MD5 auth mech + ## @param smtp.auth.identity Identity for PLAIN auth mech + ## + auth: + username: "" + password: "" + secret: "" + identity: "" + ## @param smtp.requireTLS Force STARTTLS. Set to `true` or `false` + ## + requireTLS: "" + +## @param extraHandlers Manual handlers declaration +extraHandlers: {} + +## @param namespaceToWatch Namespace to watch, leave it empty for watching all +## +namespaceToWatch: "" +## Resources to watch +## @param resourcesToWatch.deployment Watch changes to Deployments +## @param resourcesToWatch.replicationcontroller Watch changes to ReplicationControllers +## @param resourcesToWatch.replicaset Watch changes to ReplicaSets +## @param resourcesToWatch.daemonset Watch changes to DaemonSets +## @param resourcesToWatch.services Watch changes to Services +## @param resourcesToWatch.pod Watch changes to Pods +## @param resourcesToWatch.job Watch changes to Jobs +## @param resourcesToWatch.persistentvolume Watch changes to PersistentVolumes +## @param resourcesToWatch.event Watch changes to Events +## +resourcesToWatch: + deployment: true + replicationcontroller: false + replicaset: false + daemonset: false + services: false + pod: true + job: false + persistentvolume: false + event: true + +## @param customresources Define custom resources to watch for changes +## Example: +## customresources: +## - group: monitoring.coreos.com +## version: v1 +## resource: prometheusrules +## +customresources: [] +## @param command Override default container command (useful when using custom images) +## +command: [] +## @param args Override default container args (useful when using custom images) +## +args: [] +## @param lifecycleHooks for the Kubewatch container(s) to automate configuration before or after startup +## +lifecycleHooks: {} +## @param extraEnvVars Extra environment variables to be set on Kubewatch container +## Example: +## extraEnvVars: +## - name: FOO +## value: "bar" +## +extraEnvVars: [] +## @param extraEnvVarsCM Name of existing ConfigMap containing extra env vars +## +extraEnvVarsCM: "" +## @param extraEnvVarsSecret Name of existing Secret containing extra env vars +## +extraEnvVarsSecret: "" + +## @section Kubewatch deployment parameters + +## @param replicaCount Number of Kubewatch replicas to deploy +## +replicaCount: 1 +## Kubewatch containers' SecurityContext +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod +## @param podSecurityContext.enabled Enable Kubewatch containers' SecurityContext +## @param podSecurityContext.fsGroup Set Kubewatch containers' SecurityContext fsGroup +## +podSecurityContext: + enabled: false + fsGroup: "" +## Kubewatch pods' Security Context +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container +## @param containerSecurityContext.enabled Enable Kubewatch pods' Security Context +## @param containerSecurityContext.runAsUser Set Kubewatch pods' SecurityContext runAsUser +## @param containerSecurityContext.runAsNonRoot Set Kubewatch pods' SecurityContext runAsNonRoot +## +containerSecurityContext: + enabled: false + runAsUser: "" + runAsNonRoot: "" +## Kubewatch resource requests and limits +## ref: https://kubernetes.io/docs/user-guide/compute-resources/ +## We usually recommend not to specify default resources and to leave this as a conscious +## choice for the user. This also increases chances charts run on environments with little +## resources, such as Minikube. If you do want to specify resources, uncomment the following +## lines, adjust them as necessary, and remove the curly braces after 'resources:'. +## @param resources.limits The resources limits for the Kubewatch container +## @param resources.requests The requested resources for the Kubewatch container +## +resources: + ## Example: + ## limits: + ## cpu: 200m + ## memory: 256Mi + limits: {} + ## Examples: + ## requests: + ## cpu: 100m + ## memory: 10Mi + requests: {} +## Configure extra options for startup probe +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes +## @param startupProbe.enabled Enable startupProbe +## @param startupProbe.initialDelaySeconds Initial delay seconds for startupProbe +## @param startupProbe.periodSeconds Period seconds for startupProbe +## @param startupProbe.timeoutSeconds Timeout seconds for startupProbe +## @param startupProbe.failureThreshold Failure threshold for startupProbe +## @param startupProbe.successThreshold Success threshold for startupProbe +## +startupProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## Configure extra options for liveness probe +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes +## @param livenessProbe.enabled Enable livenessProbe +## @param livenessProbe.initialDelaySeconds Initial delay seconds for livenessProbe +## @param livenessProbe.periodSeconds Period seconds for livenessProbe +## @param livenessProbe.timeoutSeconds Timeout seconds for livenessProbe +## @param livenessProbe.failureThreshold Failure threshold for livenessProbe +## @param livenessProbe.successThreshold Success threshold for livenessProbe +## +livenessProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## Configure extra options for readiness probe +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes +## @param readinessProbe.enabled Enable readinessProbe +## @param readinessProbe.initialDelaySeconds Initial delay seconds for readinessProbe +## @param readinessProbe.periodSeconds Period seconds for readinessProbe +## @param readinessProbe.timeoutSeconds Timeout seconds for readinessProbe +## @param readinessProbe.failureThreshold Failure threshold for readinessProbe +## @param readinessProbe.successThreshold Success threshold for readinessProbe +## +readinessProbe: + enabled: false + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + failureThreshold: 3 + successThreshold: 1 +## @param customStartupProbe Override default startup probe +## +customStartupProbe: {} +## @param customLivenessProbe Override default liveness probe +## +customLivenessProbe: {} +## @param customReadinessProbe Override default readiness probe +## +customReadinessProbe: {} +## @param podAffinityPreset Pod affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` +## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity +## +podAffinityPreset: "" +## @param podAntiAffinityPreset Pod anti-affinity preset. Ignored if `affinity` is set. Allowed values: `soft` or `hard` +## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#inter-pod-affinity-and-anti-affinity +## +podAntiAffinityPreset: soft +## Node affinity preset +## ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#node-affinity +## +nodeAffinityPreset: + ## @param nodeAffinityPreset.type Node affinity preset type. Ignored if `affinity` is set. Allowed values: `soft` or `hard` + ## + type: "" + ## @param nodeAffinityPreset.key Node label key to match. Ignored if `affinity` is set. + ## E.g. + ## key: "kubernetes.io/e2e-az-name" + ## + key: "" + ## @param nodeAffinityPreset.values Node label values to match. Ignored if `affinity` is set. + ## E.g. + ## values: + ## - e2e-az1 + ## - e2e-az2 + ## + values: [] +## @param affinity Affinity for pod assignment +## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +## Note: podAffinityPreset, podAntiAffinityPreset, and nodeAffinityPreset will be ignored when it's set +## +affinity: {} +## @param nodeSelector Node labels for pod assignment +## ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## @param tolerations Tolerations for pod assignment +## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] +## @param priorityClassName Controller priorityClassName +## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/ +## +priorityClassName: "" +## @param schedulerName Name of the k8s scheduler (other than default) +## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/ +## +schedulerName: "" +## @param topologySpreadConstraints Topology Spread Constraints for pod assignment +## https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ +## The value is evaluated as a template +## +topologySpreadConstraints: [] +## @param podLabels Extra labels for Kubewatch pods +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ +## +podLabels: {} +## @param podAnnotations Annotations for Kubewatch pods +## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ +## +podAnnotations: {} +## @param extraVolumes Optionally specify extra list of additional volumes for Kubewatch pods +## +extraVolumes: [] +## @param extraVolumeMounts Optionally specify extra list of additional volumeMounts for Kubewatch container(s) +## +extraVolumeMounts: [] +## @param updateStrategy.type Deployment strategy type. +## ref: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy +## e.g: +## updateStrategy: +## type: RollingUpdate +## rollingUpdate: +## maxSurge: 25% +## maxUnavailable: 25% +## +updateStrategy: + type: RollingUpdate +## @param initContainers Add additional init containers to the Kubewatch pods +## Example: +## initContainers: +## - name: your-image-name +## image: your-image +## imagePullPolicy: Always +## ports: +## - name: portname +## containerPort: 1234 +## +initContainers: [] +## @param sidecars Add additional sidecar containers to the Kubewatch pods +## Example: +## sidecars: +## - name: your-image-name +## image: your-image +## imagePullPolicy: Always +## ports: +## - name: portname +## containerPort: 1234 +## +sidecars: [] + +## @section RBAC parameters +## +rbac: +## @param rbac.create Whether to create & use RBAC resources or not + create: false +## @param rbac.customRoles custom RBAC rules to be applied +## Example: +## customRoles: +## - apiGroups: ["monitoring.coreos.com"] +## resources: ["prometheusrules"] +## verbs: ["get", "list", "watch"] +## + customRoles: [] +## Pods Service Account +## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ +## @param serviceAccount.create Specifies whether a ServiceAccount should be created +## @param serviceAccount.name Name of the service account to use. If not set and create is true, a name is generated using the fullname template. +## @param serviceAccount.automountServiceAccountToken Automount service account token for the server service account +## @param serviceAccount.annotations Annotations for service account. Evaluated as a template. Only used if `create` is `true`. +## +serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + annotations: {} diff --git a/packs/kubewatch-3.5.0/logo.png b/packs/kubewatch-3.5.0/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..298fdc27a5d9d8797829801ac7f4b0d08f62a101 GIT binary patch literal 22320 zcmXV1by$?!*Chl*kPeknB&3mU6hQ2LDHECg}?r zn#P%&^lLSbw4FIT4?Xq9yE}I;`;_AtbRL%WVN=*_P8N+q&y9u2&lf*Eh{SJ;CSa5& zp-ur_l;l}X??;`zlD)Ej$s$yxYt!=cAH)yq!1&s`&6rfXIY_&Y6OQMZ?#!!yOX5}a z^_q@nOz~z;90iGW^4=83cbWR1>3A3IZ-s=0h91k~s!B^UJd{tOr>D1k-$F)AEcclN z78?5QNgTI~wDjy2>{$F<-Y5A|seowMHGIS+OO5J@ai&Mclu7O#0lXlR}>h z>fTp!5nU1?_Ysrq<{qbLzXR;s>6awi6FBzD2K9-BQNJ1v`6)I=dEfWJIfH{vq|`q4 z9=hM7@SsdcrHpq~MN!`e3u0jk@El&j7L#MYx?qOhX2}f((vkO{RV(MB@uH;a!3HT+ zLci$XSlN(@Dt)dZt|~((tk*zm4=-pQ%ZF5GBo}&y?!N(HYN|8dY+&Y}ChHPsghW$2 zyp2;`XJ^HkC-kBHH88?@T!f%E@?$6QlN%6{agxPV%_02sjkjA##AHkNZMwu#YyfWo zwf@tYN;ixsw6n_Us_TUgS-+FvDn;dg^~&@auppM0XXbp5ZEW`T@q%Dz6UoxTLJKz{ zfi#Gyfc*~oC7Lp`@S{08Vr7*UvMxm1X7zDNzI{zELpQe3`=+Zn7_HHBq#=S!qc5{o zdq7x*Cp(B`7|&dK^EciHbxM&wut}un+}zv?H(Q?-5z5oLy0_LNCTDi)%VcskRVQl{!J|@NH6ZXXssI)N8 zf^T^a)j6AkEGw<=(<=4`)vv0nlOQzkndLMzCK7N`Q@GHeDeYqaF7^@?(%LRCkjOn- z8c9#flN;p@aFG4(dD0KQlEC7`;9DmQhEI>}!M92*_;$l@5c_E#%-Kl{lC8qstVdaX z2C*>q#+6VRY?h>B@?owV&gEgian5-iyjf{);N5$2`Km2(F??pHEw7tiZSWY;a=%=- zVR66-=nUWjyVqG6r79l}eh8oUWQ(EOJ>}4qauYHc;ez3gaYq9pMy^t3NUbQ2gb~8x zb$e+UQGdKJFSd1zONTRW0yDT;uQ#Nvnn~;OG&JWqSX4dp@m>KZmk%u>1JS@D51V|Y zU7GKSffQa$A<;S5Vq*6E0z#`#clu{4zdl<#1XnezA9ZHG^X-#NyC?L~@q64e z%lG`K!-Hnxg>oOU7|RcF54=!5z>+fLxq1<@TCdFb3-jC){NfFHwf;!-et+m{3<=D` zpwtoj4{Xf}&ToqCpwo24Aco_EdA?h4!Rv1A_?--s5puw;+O(%A%h;`YILGXnZfAsv z{0xpV6&$4-qtXEnc!Er|$?ivUld)57^SE4$CVK19T#1B`5$m=MW>u05pZFSITo!Ed z$^l+bO+*0eA7^`Ix_z|me>e^QO>1v&yQx8Z@8Ajeo_j|=PBmOaUL{j+g#WbSn(~(7 zpFc-33{r##ouT3M{lY)0o+@cE6#W5f%EA_!*rD`VWxnRhU}C$&lWKQkVIoDTXkkm54y_+Fucgf$rYtus?EX zY>JK3IHIB?S20CBM{~^4q=#Fg1t#O34y&L{II!lVjJ3J7K}` zgaN@djzd!jVTBvXy2xUO7Q=PkWO+Mlz*DTAaLT7FA7P8H?u=BAa-mz5xR2uY{mi-^ zfAHfXkGk#cfcfz%iVsrWSLEFv(-lt>Izzj|ynaD}TcWxgCzTV#g7pW|cnZ?eqy90! zK0bcGdvkdORZTN*^0`iVCF5EL(=B)h^fl@MPlOubo$dZTTAl%+%t`QmuQ>=}q?X1c zSy@Ox^o@=RjwVS9W7Z(DT@BpPquiND&s<#@{1)ON4I8H~@_%|!=PA}YA?3{VkmK_H zyWWBBXeM(zZwP46##1eKyg_!W$fw2F%O}N9lIATeGj#I?S_l44e+>mlk^8ydg5+EU zKvnU37)hUtZ7w)HK_r$@ObF$DS2XuzRTTm9Zg2Kn0AhM(oU6}$0|(dpf*a^TS`Pa; zf9%{%?`r$ZW>>%Vs!7y^{ZGeZwXtCAD~zmUB^8{4qq#hZNrLNg-sBpy)?rUBOVO|z z0IGV%oU_?JfrEEAK2L<6gKvuA{b_@~_pUwLU$4<&bJl{+ z52_2?FD6Iz2pcAR(wBzROHuj7P~2GO-xHT585l*%jr<*KBt z@s3nhA_N1i1JJ>SBzOfd_p-2@*=vcED123QdX1}kY1+LLYz9EjX0aZ+keNvOZy*q> z>|IS!Ts7ytC+7H%7Dlf%7DX0qX^Uw`A70Oix%+WfvCkH5>TKdMLb{Sz3?~N2(C-?O zyV(X%0ZXoRzc)&zg)4XZ=f=;=yQ;h6Gb|~}q_(MzrG*2D#WTci**gzKo2lhbvltA) z%DAdLBsOUuC~T~n{*qDG%%)9k$Xo?Vx-gL%%2!oYBn*#Q!vGVerDhW$X?{FgxY_*N zC~J#*dGsash`^#igC{G9rIF{~c7fFv)jT#I=H2p;WnJUib=Q?h?AI%>SqC6HagOF# zN`!8P{i!@o<1?EPy)PQ5ew}QPHSo6h5S%*#g#0~O?jZZJ(1+qGj{9E?q%3d*ge|*~ z$otrR3A6mp$BF>)tradVOp77OjSit8z;>bx~)-TE?o+t%jkUv^qlD;58k{S(7Gdj;yhCcTP3h1S4 zKRvUy-@|iFBekZhQJfMC$z339nt`yK1-SHV3$Eb>zU$o& z#}34SV&6yrRY16S9e>*puGnIP(Z^^9y%DqEfw;M&)b`hO=wATOX>Va?@OumI&s7}G z7p3&Qppj2vMCcW61=wS1dRIIWVfrxtKcJmBCE7ojP~H}_yey(j*?qBp>ag6F_Hkvl zVlLJyykN%w_k9by3fMOk9g89Np|7JfGZ}a9?cMuN7b*Z<=;C-NaJ1vo@*$VJ(Mzh^ z5ApcptvM^LJ~050yaDKeN(;LbfFiS4*n*C|MuQ)sl`{J?LVhv4?A`fG#YPHBXI0tK z{0r(u=;8xHE)h|*>vqW4TMe$HT=8a^cewD-r2GkD*d&7b2areIG0qcB7&QQ(ZY@tf zX?q{dJu9+l`j!O!6Ps|VV=oR zpT`dI!XLNee9qVu1~A-F(y@vy*`uzpGFO+4SRn-H?f9|Eo12q|>l&BVCHLkrN4<}e zuOt>J0<+n0;mF!p3hS4`YR902F(0M22&3p6n; zL^f$JpL(3XKh*7|H7+qIaYH9wWCL%$?^Us=Z*YT_z#jV|1Vyfx6PT1<#{{#rGxKQI zMCY#TBzvR5((`}SvYyyc6!~_nsQ;=$b4QcZ<@aAx(4k%xmrtVo@IgG%xwy{p7f8P- z?HI}SR?5g-n87-sNl%M@ox?l($O7kU1Kw#EEapHObeB3_6CRtT5h22{F+`_ zJaM2xLZc#I(6B60BBI7QlV@NL7h+hL9W$KAzKzA-PH*=`J2S7>EBls`pQ{6CNH?|a zVUte-Pz4Xb0xCB-b}!0?5QwyWHzPT4@HM#{mp%m?VQ=GyDWNjwkBqR9xKWf|3-^3P z!Lc!cj8yce3Rb{{BhI(;PVfW-aQayP{D!1Y`~i_qaf+#o9zLV1yJu-{JN1(|cQqwn zQ}idSX-VbBV~={-I|HxYZ)R8f0dLS{T9$>NwO%kWZZM^ zq1e4yz*U-7)}b}+y?-Hm@kR6NOH%tuBkp!#GA-_~>7Q5pTkQDqNuDlhxv?){gNV+6 z6jW4r1MXP>kgZ%$1zQc5OEXVVucX6%i^?kzG%*4nAYLRI0E21{2p=in@+$W_U7&H# zFmxCAoUtg(LAOpi)Wqr_@rpU`liGwS&Lf2rM}ETvZ~~bFXMl+P4CUN)S0D!W8~D6}KR1F5MP&oSE`8N%Nd}>*mQ`dAtuH zs!_%r!2)nn3WQbg+EjOaUx5Ty(_LzSA;uX%-V+obx>U0T_fx0MF8~HEJf3Lkq)xk~ zh+-PJff?-jf*9TZ*wa#Gx_$WhVo!|)xr{Z#+soVS2L$2oKzm`#UZ1mkLIaEz@SuN5 z&29?E#a_fa!=%k=_vFoKLGN>&8p3l@WUdxNgT{c+?%`HQ&JP;(^%E)8rsAP&_wvZ~ zzzf6x;BV;7Yxy$nG5D9{E$xY9seJ=+Ml+n!zZbfS?b)dn2?zqlUg}gH@1>`z@#}w& zNJ?(e_xSvMs%m}$40QJ<$q(=IlRl)9LR@bzx!xP z{2o2{;z{9zjkH``L6oA-O*g>1uVBI)WR6ZCGh&74C+lvtK47_KY!Mp zegd)*9{}8h^E^KLK7?s+8&vGZE6whuJ1u!ETsbZ7} zv-Zvl^27kKWwEHb#t<|_>pS2TaE}{BrfvXnaSrF65p(el2wV3SOmEVPKf{U@%5)dw9`EV!ER#-ljysE;t+FG<6$6X>ylw#?wz+fzWpP;rVhXe>wEm8hXNSZ3%iqtq8~fHfIobN4{Tyv8`!FGrFgJ{(iihb}C0zY?We_!JPGN#b#t z=x;$jX*=y9{p^(t{CTR_3w`70X+Kg>MDn#07GrgIyBI%%p|$v9griy@MP$V?GU?oX zE`RTX$kJ9#UI+Ziq96`iL?nKUMtY@Ja4y@ztR}e)pSqAE)uS@wuiO{wK#A=Co3gjt z-LQ~#I!M^@lH;@W7F9~0ei|j)5%oO*jOJ|!Q$kbC{jZ!A9F7^KC4B`#^+5G!xzK zY!bbnDv%o)TdA;S$2q=KSm0M@atEqaWy3bsO#T%8&I_q|r^hCsqRjA*23(pZ~tD4=l-B9KX3=0M&D*JUFHi(mRpmt|4n<3$0c zr-ZSFTGYxg)t)fj`I|sxZ5!TyxwoPexQU}sL*lNY|F8dhAZ2H7Q9Umg>Z^dWHu|M^ zFZGVZGP#+Rn$6xT`hJdO=jwAej5Luf9o@;AeWY7e^J1?;nxQ$8wf>A^u^yz(GYT(z z*UQsE*I4(p`scp?#vYJ{2+<|Mi_d4<*Lu696mFG%Uh^U^v>3#=0Q>*@$4m<(x^&LF zo%!kh9%Zq?bgS^DQUAd~L(NNTLq6RP4|cETRRbtNC*ng%rpNMTkTCSH9<*_s@d|$& zNIb>x5dj5i`R#^XqV3A!Ofht@|fpV$}5IDcZs(DEsRjiS&N!*14k8q4>D;)=$lfwL4_?Uc;#|cw{`7Y|hx3CS+X?Gw@w`Y~+bpFSi3v*?H z%D%+Jp6T#;XWM@@JrdUhi@s3D?_5!H7hdcnx3EOYJF>%=RnjNkLu38bQEM#PZmBp^ z3pls#W7o;`d?{qnQb))8dmBEN?(VZxHffIbKzGO0Li+{sa%y&4#43_iGiZzr{H{`B z(U=v|*PKQ~1MGp;#R6$I{m*HJo?csY%cIObDVtzUud|$mJZjwQVsTT-<7rx%(F%UA zbC0UN&FK%}ii=MmZvB+IRHPfA3Nt#ib#{kUfVZ|GfoBtXHn*U6xVpwKx-OQ?{VkvK z)Snqe08RE_k^ah6oD&A}#0Q1Ui9QEL;H88IjcB=QjbCv8dHl~So;lMPJ2fTUp0Z|i z_BWyv2%b0XYNTax`lknu*FBxq=9r*|MoH*Jd%mWa$mu^Y6$hIqs&r#`%A`3$# zmK3w-gm`$LB3g&Wm|~c>W87wKkR`=6q{?SL*BQ6|wD#S(J;ls-jENH+LQxTd)62RH z+6~EHlAn3gB3w9YMW^ehX2!1CC*(f17Ni9wYg5hPJU#K*m;7w9ILPyM)HLH2&(MVx zp?>PfI}35{EyWuax_IsD&sWAhuw%dZ+s}}e-tV#OBfiS%nZ~~;305#bNj2ttv1@II zF>iY?n&-r9dATK(0Z9t>-FEh&)QxNwB9G$yYW<|DBHj%7@2zO?ljgxoldH3}@pXE_ zjPM{6m_T)35nUo^aj}1??sUfG1svXnziq2c=+oZg9V{(fZj6l^9zYS^2LTD6kvi8F zj!XIr^Q~@JBTfw`d6XTT%uqV#M^TETGna$-pk@A7XEBGtyO*A<#+Tc9#{E82(EP9a zl_l2N#kX|!(qQ@@5!vHSUfj+>Ht@wy=AzYb{Gf!G7D(fP$KaZmh$eU zrii=K!t+R=U@jBi4(FmPBh!>_bB2^9g!E2F>WLNw^uJU}%_CtVs;F^y`Brcd8hZT( zH23@CaQZ4gAhe6B5wkdeHaAY7YeGx2_3ETEM{rduFYbui zd44sSpRGAh)_Nj6{oRh7f+H7=NV(Vd+(``&CgUgOI$`xce?K>7sR#`f1ihyIYIBZY z!tqf-j~s_Z;|#eZSj)gBg%lmyPklKs!HLdJ_9{`{C2KVg`& zEfrEtGlbSSEVSVRsPivs zAHm6P@p+#f-cx3P+%1I>CF(w)D^t6blWsc#^)dm5e>s`o&w)40i5~REpsHqrJe<J$I9gHbBh@Y_$J?&8d#%^%S2CaZ#3>+SbaLc9#d9}2Kpt-?6DaT!EwB|TYBAf1 zCQ2OICeM6?kyY~kMZtr$>Vvo=HIpi{omCdDg`w|sdcC5?5?Tx`SnQO@U0U!3_zBBh zax|-t!Y5q7pWo8L$=t2f^?xCI~7O8V{j+ z`pmAM%%+8JfXj9?YS+bYUkCY|J|^B3p@ipX9r!X>j6?T3F8t@^`wV<^fr3e9#UTu0 z;;vZ&)d=wkY`TI=RfO5$172g=d4$NA%H8zG=+X?suu#)yBRI zgq?P3ZvwFumL`&Ul))VInJV(1vBJ^<)DrrV`2mkH0gd)9&ZmSHNy~1ruc7b0^j=1t zAgn1`CNRu(LQ_exlDUDpRH{^ytOEVsP;Jza$fucFW>cI!H41BP;>IhZ)NA2m%jpNf z=&mXIF*|pXo}Td;1+K{h#H2%XZjG;o1MW!S_i}!ktF$Q%Fr(F$r}2xlWHW98GArvT z*iP_yX8W0xRs&4x3Nl^k90nUpQMIrcjTUOmw2v%qnPhsX;K2+4S?gb;PwpozeQ5*6 zJh~hYUwxSv6^y7Rsvda2X`J#vGEX-&6(eI~IDv#XT4Dx%GnT|VSwZHfQtJ36cW{dB z7YgTt0s<*oIs;8LL&mQ|Lst<7h;f!{bFHu$W~_MbzE7DfFel&QBK2T8;^JGjhUeCRSIqmpGPqJip3s8Ro6-A8u(IZRR+O#qwW1T-9+@EqY9M7Se1%#U#!rlih&VJ%VMb-(AIACZ;z zNu3Y9Lac^-dJmpBi*oXK&Jh%aN%LO_dIKP4LskS2z6r!-k|YcI^e(9bE8!9@K_0bN zPNXR<{R2nKlI1j4T|TKq^Mk%FHlOx`yYIr!^rWSCJRWUS5uJTBe9Bk&(`$#6=3(niTvo0%;L>t#AQ8t=DLB2>_K!ZctK2L zEiIW1Ouf;0ncF_16DrYjZm;rW!b5AGQs6d2H+_1aA$0MKmy``ip)w~~B7u~;4;HXD zE^w9;a@0Q&vUql_-Sp~jhf-L? zs`t>qQ|Fw-hXdMSZ1nV@;- z%1*_qW02G`1#}G)MuryFXCdlC_m$Y_~%UdBaCFP-;=N}&WjtfjjXkN{#oF9MzT!PdYCl{{s zPOzrv!V~uN_lKdmzOU%%hr=f_#9b`9J}0y&^N=qe(sSX$*BY?%=H4nSJqJYdw%v!A zc(c7q(cihLG6|F0iQ~PqL8~0aGK|r1fICFU{Q<=?E!wTsGY|kd`;W~_EuYzua|;-b zlwZgvnWxZ+O&FjVsGzdBVcKMKm4w+`-{_g$^tbx%*~bm-D#4lNU|ykt=O`o1pqTGb zfum){axDY$hex4I`Gw*0-f;GI{o35V4#jVAh2?zBHl19@0uS=J+K0b{ByS@P*@H7} zED>YB(d`5u*;o~q#&Mrv_*>cAmJ#X556QXSAipW>XOtUKY&WJ`Z|1KP{9x{5w7P+x zThnmYL^!Hq!zSn`IgxqyuAH6pz3erb+3nVG2-+_PL=Q*(@XzutYX6=cPo7BKg^+?mBJwjH}OY|$m6_m?MWPo$bejan0`UVyI6hs7I;7DE+v z$`l-#H15xeeOf+#mfPrXvSeAms-X)V%)%~r!?1QxmAKn!&~>{@<~Za`|GY=2oVo`` z_8!<6K2^hYSrgjBtrc%IAb^w-Ra0qMqR!IP7*tT}GpbMx`Uxf14x_b~nbvv=Nl;O_ zqFhpW12?~yD6~=$0*w*^h0l-8+b+3KkId2QTKCxiEUeysSWm0d$!sBfA?VCch zU+jh8(4hI9fJ)r3+Uv4sq9sw%(2a$g(_jCnkPK;bF*&hMJ6D-+^8!h$%B;f^TXS(G z&Suy2d|~ddIGpZC25})G-npcVj?q*%_~fWzRAhn##zpkR-VdQSvv+MU>(zR=%46i$ zB)asvK5!wmF2SCU>fDI-a@Dmz-Lj2()UV4?|-UE351T#)?gc?A~WPknPIb6tvGF1OqQ_i;Ig~TyossduwY;&bwTC9>X=9aziLH z{7LiGWcEvT0?SqeR*r1@H>4Kk=Az8+XpJWJ=Bt05ux&5(!UcIM#NhBD_x&dwBUHon zWpp}CnY;sGAI1m9Wtu{&CWWf(w{M!JJe8HjZSihXGl*)|muE^b(?ly+bIO#RynMo~mIRt9!ZMyJM&BYJ<|)=)63opGi< zOVX1|%2vwcCQGtnxfY>W|EK3eSZ;6V6&y)G>$75`Bho!t?N8`^dYZwVuJFcP*}a3~ z_}C@yhF1u8q{{aSyUbg2KWa5C{3;N0>Y63K%zok3>E7neli?CWWsPje`ohjs?0m+- z?M+Xi;l$ZKRg#8(IjZQJ@RS^p`!sd?>xvK`vhD1+QF&!+^8iT!_g=DJ^XW~Y4k;-H zqlMg`Ub9YuZgMp|jJkkk&5Um^L)Y2c$$<>uHdC-Qt++*8kl*&2_m(fo0}7fL*PiyD zDgs`&W!wQRP}a&&L?x9Q1MYkvDNt}FR0aGQTsolAq8B!zO%=ChxlWG1)uFEj21pupBnz9(-jA*t+v7R)7 z8OGDBPnuLv;;$i#4N#SYV}wXst%Da3x|j0W_0M}@Yv>fpFSONrnd3r3$w-gR*|8Zo zf=bZ(%ZR}DGeY1WHx&_66fN!;QREjWeI}FZtKXwxR2e*o8Cadt88EH|;H7;y_!X4A zW(1Bs35urBP_1&%Tko$9VGs5P1Jx-jep72yc^%Q7t$CXgCd*s02X@rc1d4U{Ur2pZWJJN&LB^>ohd81&p+ykb-fYuZ?U{{Juq5|O$^1Rb zE8E|SOA!;7^|D`k-kY?2cCBU<7hDsfC6~n1s$4~+bHybiE!Nvh&}5Tgwx%P@JtQ^z z#zwrA8ZV-ZXrlJ{MJmihM!JCw$U2OSa-!+Sh5AO;OUnJEFfgoz5fy(kK3D^d->_gH zc9%)uJxd=Hmbi)w@U(Gltb;7AbBCRErz`GMq}zHv_E3l}jO!Gzd4J&|DnF#=UB`uk zZaEr~t2WZQLI)*yIJY27E zl!A3s@Ta?UUIC>rgF0%1DsqX%qNwl)ptl zLk-kCer*AtDV9&+FK3cRf;LO+9hS$|d0;~i#Tv|YLxO>xiy;Kh%7qWSWKOPI6OJ7T z(%vkoR9`a3DRr8GHEZ7oA#gD`KV44g(W`R)6;|xozshc$vN_2c7^c@Q){O_|6=we_ zjAjk6&bP&Ex2s-51HrShkOx;n>7s&^2lI<)rPES+AUWZHxCuR4q&EBj zl%!$r@GdNQE*}M?5%_;=#vDi$7p13H@u96Et9}W3L{ByUI9=c$(Y(?oSfM#cR1>pW zF|`BB!S4xdq*%@%Of!YPzGBzJ9g&NxEphRl4CDAOb>n(>mVPG`+^S)mG*K5N^vR)0 z?x=hH-7A+e(L2B6&t6QZL_Ergclw6fU7Fw>Zzny zZGt}tdUljfmKsfl>|p5t3`uN`S~of6H&(({+A@hS5w5u7sr9Qx#h6NHOh|R2m??|T zo80CqWmhw}QW6-5CW-j^`hEApPX#KK78OG|uabi$mC*%?@61nK0}@?Z3V#*5HtEkM zb|^1C9*Y7m%mG~*VCy#;kvh+M_3NjX-Z*->QW6OMtc0yjk&hz%3eq{pZS=serctum|>y)76072a>uRbBe&6E;!{C>1nJ!mo-QGxa);+N`%;-!kE6w6I2Jyr!q9u zqxS>3zs+iJ8IaPWkh>4y^M(uWp$8XcZ7Lu#4}Jjrf645w1Ki`>Q))#Dx^Hpe!-k^N zHBUz}a+jW#_M+nV;8$^E+w1Vp`R-V_z5i1^K&OhyZ8X* z{fAwvbf$Ikr=ObA9Goze(bFlG!$L!4QJqb}b;)}6AW15uS$QKvYLI1XffhsI4d{v< z-q~2{Zu=-`i_kg0AnG>tmYc?f7jTZ!CB@hdDE;VM{thr!j2+NOnTG`Q?Po*<2`H9@ zKsQYoky^ete$eP+q3{*eocc>;BP_;o1*%X*FgUsy@paTe5yhViH{AF0i5WDVu^|0V z04c3zCjA+GVgwIH{z*A{@@cb4s3^!XVcuXk(I6dR_@4%%{~ji5C{StUT!bOSHFuL_ ziOR~=2=;+Z>w(Cn!DRE4$i84&FR$Ud?t);*viXoS(*gYEG0(R0rJ>Bw+f&7yg+%;I z6H&i$TT`Ni;3!Ku(93k4?}`U~#I!v;Z}FeMfq@m~W}|QD?TYUm2r5K{{z2pC!Y38* z5wBeY`jnc$&Jx3dB{g*|SEB&7nS{5bsfF3JX-Cm6pS7ojvLLo9&Z*%K%MzkGJRITDu3#|?&Dz>uvYOD}G5=!b06zC>1&vQB_U=1-p z^eVpOEN4HmoZXI{$6FZ(Unq2+pg?Mh3ES5QZZ+UX|d-mK@p(xv_fVd3&qU}hNkOUQR`)+gj>jF&JealeTy{IE=%W$_It(#T5G#Jmuos5JvcEhjKI zYo*xe`?XN!9wApv6;4cO1}y)84%l(WPNz?Y$~nuclB<{Aib)_6T@gRhT(?g$;Gl^n z9Tp0Z#ae#2%lWyt_lJ`I(rtd2r^FT|7X*HWg}#e^iRW)nMdnxfm^xz+mlT%2EFqED zDAMg#^c{$Ee48?|>dgQCM0o?O!dB}uZF;9$FY3{X`jkF5`=uOtm)D!;cO?c6#f2fm?rD_4C~Ju|a>pIG5kD?)ro(s-IHW;^O`N@58sd#&M179v@|%Pr?c zNbaPJ+3>OM0wMcfcS*6o7b_3MUFKF#v+p`nF0nr;_T6FW#iQnaB0mnYwwdy(oedeP zZRS^%fU!IV!0<>}cA%9)I+c+Iqa_`59~(XU5KQ-`oj-LFv>sP?>q(a@!p#kaN)mKTmJ+14ud>YLUubO^ z>ruSeJf0WT{B%lW`)t0(3*)tpe*GEGO7XWM?Js@R^PutE)%N>FSCR9S0%ym^4qN%= z0KwC97BV7oPo~Su{nYR!lgrC1qRM+F6N*X($HuOnV6Lx=?^ZbTC?)lOli8}IoUAW7 zOa1O=cJoNo#iIlF2yrWJ*_`(#M2#9;I12vT>ou-r^D(JQu5(Pcg*tZTwxJ&xZ8A_K z@j)OF5=V3L&usH_;aete>>2#~!r903$2p_P+R9WR0n{%`t5Yx=cUvp8aqDe1{%#5C zMsR_mgdSB~=u=s4au`n=;JQQWaNI%6$x&gXnZ3OAb2e&qJW1fTwIvb%_;GB>xGFUC z?^g(#Qu!l)N{5!CbuWdas%|2hmtBYL^aAdv7nFb zL-5GFHveSpe%XqM9cbGtH-A*BsoE?8^1>fD&a(bNrKQ^xfR!59)0OTOyJyuhdx>UV z1gVw-vp0?h>qMi-7p@D8tXO`2z{0X>V>CJ|hncUS>hF0b=8_?49v)M=Eqpj`r%xDg ztO8R%ed}w?7y#F|+U@`6AOHJU+h9$~S+`z_0ytS5_%{a^5%IBcM)u7BU`PfY|2VBqngujvkL*I1)eewu1 zNIxm8JEBVk6tSX#7us&zs&4{=L1sIn&OjwC&Ga!K4$N!(M@uSjJTSH$0Q2bh zAxU{rW0CA$^&@jyNPD&+wwIw&9MzaoOooVgbl4M6VP_T84RS9sEA6@Dcby<8fvd`u zd&EC!=$3-n(hfNP@oGB6*j-zt7jJ=^_Tc#0b0x=oIZ&?J0%tKRSa3#0t~qT>iN_1AwMTS`#kmhfNk^3sk&Ev3NtEs_HLYp92=`WyqmM03nc$NVnZ zMO{#g-P*)5`mzXJH3Of=6D950DWbFs)yT0}nbK(%C3Zp>G~@mR8qo z<5hIwN&ef+sZ37}WMWfW7eWp(0PEN0laf=FZu3U{8__vB_f#&^1V*OcMqQV8bw$yx z>JLyWLStjGGz1@4D`uy|_C;!zW z}2i1-o zSMJ5!bNB}W$q-V!->76G;xudtmvzQL;x3NqwLx0R%(WyPFN^Hdf{BQu+11Ase}cUY z4u7uD$pO4rkQ3J@rxwCJhfJ0tk8e)(+99nWY&Vtr<40hu-NFwRYz);5rUFmXfyPa} zQ!;y(>v~_{NdI?lea@APfRVdYunTHgIV|)lT4~#d|Efzi34QQ>x#v#_7xUp+j(DY9oEANdxvF>F{683cH{Pf8yi%Y<)&nUo5b#OOg&{$c8oTREuS# zF+=iVqx{Y=m6MNpNophgshtD%^__0!-c;OwC(UpNLZTa-9d96AoeM@+R(l?B4sz9I zgo(Fw`;^D>fp|6yWDC%=sW`v})3pWgP79Lj1yq%&4@ZGZl<$B|eg#}#H0I>1#XElm ztT%6%I$h1Wr!gnT@StT@x4q4n{WKjCy1Na3@<7-^oQd*7Lu70`E3Xa>1IEu3*rKQAO&)tlYiUmSOJH#=lmVkBU$qbV zR2WT5A89RtFTU#nmm&GDLQ5M%U)%HM2GSZ#p$!#yW-+)7nYErwPd}Cai?$O*g6f+k z`e^vB`BOL`69~n9@6P75xV`i|6_O&&{oFfmfedZT7u@K02bV<78L2uq#=t_~t#LLk zWgG&|;0o*lU@k@;H}M%QO?9+?Ehre<)1uEj+AOun=&D0Ye zDW0hGRQSFg9f;{d1MZ&SwP986u9n)*p)xJM1J2M{C{tYgPN{$oxthsuHQ_a91vCA! zFz8hPF|mMsT@udxogH*O{B}CPhQ3G&`uf-sTyB*OECH{DW@Ojr`EcREueHL^zuRhK ziXVZF?MyY@)L_hH7LEN{3w&A~->e)Sv-}GBDwhIKb0C16lYg@TXCl(xs!19}q_@u| zJuDV3HT9{rn;!TacQHE8iR3(gj+Mwwqs*CHPj&vN6l@g^`U1XyK)tI-P3XJVyq&I% zRObN-iXsy?$zUs31n~;Ye?BFJ9YJ%Khk~^4RkY?pxlngn2fLW)RkqT$7e|G|`!Og| z(1UH~5F9AZkkVN_dJF6j7oA;9{upZ*IC>V~>R=PNgI)Z7m@Hal4KL^|x;sX;zSW^% zz6T!{^LNvqMx;zkmQ}zvWvYan|0fmuCXf+;#uIf6l4uoP(>4}8fManQFh?h&{oCOz1_2tG=%d$ijs-k?{lt}gf$#34Rq z>_7BHYeId&Dbg;I5(WsQPkV72${0_jgx-_`0$yb&%~TlRzG~pMzKxqPa4pGF&TR7z zFhDw;qa8-mn%Bl1jp)Fh*^dB@V9{XGPQWy#q`VONdZ+--LD!)jSE)@Emlr?~*gk^A zL{5HTvUAJQ{8}YInqePG%ci<87ce;8^Sj>YVgrl$l=d$acBtaUwyMHW7we`FAK~tu zRb>cFpjIwHp~T6@O#d-c_`Vl#nAVN$NISGH1h{w7FMSdQNuB}n57-OgprP&e>jTwm zr-f!#dM9>u*Vy|40#SnIx^=D`x--cT_QS2ehxZ4VAh(X?U3VA?z$UuTA;{mXz?>Qy zN~xF*4+STY82AA|H@Z*Zd*!EHL3tppl?A28uL%WD7Qansd7`b^jw zFCZW%fD){S+8}v z=eSq}Bqv4R-@{Pg48LA6jl~J@*0XX#a{xr@W&KL#p>$5by;OoezZLB12i)$d#4;1oXg6-4;-&z6EJhia(_P*sQlc%mZHnwius4Ig)4JqQ zy=a&n>uKoEBCV0JvS_g4CLWL~QRsK;!`-FTXojgG=0k~eb#~>yJIC>xdcaB5)!_G1-^PcKcF zO_5yP?5Eg1d1-e1O|fXokHzP$s4#H|*?yg=?SLy~qH>3w0ds^ClI%Ek5gd5+u1b#c zWV>-YKn$2$%s-rkCWy`m5S{-4&DXJSOv&1QZqooXmiG5Viw?43%mo4wf)zGnR-+Q`vvP}r;r^P6H&$-W+ay`wq7XM>GAwJ^ zNiB5F>UxG4eHmM#m0}gX=k&G?XdC00f1-VT%~ZN;r)Zf#R`_$C-XwIYIz9gniYo1VZo-$Me>b?W< z`xPm;Ir<8?$m#Fl+M4Z6xHAXffnEi2eKL}ColhquxTp|V#>wZ2b`Cz}*mG&PFxqIp ze&A+B-W)Tn;l$pbJ`LjIZE9nriJsNzEg0c#p->y8dvo6D`CUC(_d3yBR7*^008-Y^ z0z|Wn?sI|vYvs!Sq5h&i24fq0e9Km2nPf?pEQLz4Wyuo08ObioO!h5IvL!TP>}zQ3 zB)b?YOc_b~YDmVCeU}+qJlFI53(rq@&F~rbo^$T|{l4dYkdo?>VaiIH2W$#oKDtg? zfC(v4fZgd!J&8-=1@ z&GkE4=GI@X4bhD3!+W4tbzX_<5WP$l+*#O40=BPi3DP{N{P#Y3`Gy91v+MQv!n1kyH?OItWS_o!qnmtJZxPG!*? zAefl$-Z|CQk^Fdmd_|kVbAZbDcdHT)en$dN)X)150qnUUJ}{$Z$%+@Re^u6bj?-?j zXQb+tBl;u0$SR-+3RDO4wqN_{lQ0Dt#|eA@3CpJs{$q0KJg)D=C5IFdDhCe0Cg3G_ zZp)}V661Mvl)(Z^58s`h z61X;YxE7<>9i5p{w%>V>StU)TG!DrGX^w}BW zz(KbKs(2GB!nKs06q3X1dM3BT%1ZEAI(Rhnw%-)FmhX6YtKzF?)KkuU0qF=nt=)i6 zmACFgfoWhzG6z$6V(7Xvn)%25t7-NC_Hqy%s5@^Mb`9#v)$xYc;2%lCqdW2xA$gc{ zZq6~eJlOwTstfQID%Amo37K14Kb?^s&bP4*LNE!B7o9hM37;;zHp2l(wZBvy%Xz?~ zCvp2^9C;|si#ZVGjrcAwam97()ICh4U1%@*3`NZH(h|mb*%xpIX+@`tZJ{SqhzM`=8({zTik%UY`))5wdfy*dJ5Lr+K9}su} z5V!?keFsT)OMOySLKv_~Xp|5zP8L`Z5n+azkGX;8oqd4$XEp*xr=6$ab|(f9DpmE! zc2K#_z0{l@!@UuKz zAhq%2{Jd|E!Cgk{9{7%j{(8Xk$qF=~&16=w z!_Y3U`;(W_!+&mE*r+)<@hhCkL57*?6bTaBaZz>y1oPR>{f*d=8OSd^kY5QPzs`6( z<8Mj$hB}S@L>8Rn2=6ZKdvFkybz;&N8BG@gzn$uZT$3QB1O2o)(=Dk9WVpS>WSz!$ z0dK$5rg;7`;4kX6_uq-bj3W(k6NKi1#HaIpjr|C>w+o0kN32d_l-8o7E$bpHVP*@lC*xm;C1B;2=I~s2M9wr{|~^TQ72?44=A<~8E~eu z3Ljp8bA%ZW3B(+Em3Gd|1`w5xb3U zfRJKls_*ZKfN-b{*lhjnO8E=O`G~ZhfV-t*H*lWjV&^Vm)>}tP{GbQoK&R-Wx;^7( z-fj+7-!RT#MgVyO2*XyyVa_B4Ir7movs=mD0?6&b9VWCX;m)3;k88X!w}dqGOJJVJi&V9>OAV%elNX_<|Yhr zLYQ&z#&2m=?4b?~7rDpSlw1Gg7o51@9)sAh1-bSp#qSlE!J)-)7zcQ7_y#Z!t%v$} z6!4a@=W_X4A>EN7-xpqDw!vqm+h_tIbPUBy;NsZ<8vV!b=+xjO?ILOMMw19*Cjgd_ z+anW`{zd9{di;qe7QUHU)b7m5YKRRx3$AI&M12ON`yoYA(wHage`VVvL5e7aUl8C~ zyHUV4>_C#2t6_}N6p(*9P~0y4v#hz?_?I(DmbDk@OxmD7KLb^d6#oBf?w}%##6{`NIJ!7O<6e zpkKrS#rLMRD{oVi@MS_(mv4}Mx~Nyu zkK;R^G&=@88%%jbxve9Kh-x>_dt~v2bC27Y80xTIbG_`Gcg)H+j2|pr^F13G1-YlJ zBIEmK=}ZRtmc?=-VKtWeR*VscT8`JQUT*6s;wjU6qlp|8nofyIiZ#?Y{x9geO5>oC zrD;jY;{|433n<}gh7m$+2qy9CE6X?WgFd}~NUl;9Uy`aIJ=cb=k-yLjGWK9I0;!UH zxtHVnv71(M4pStV$`o2&3$xm!8QJO;`L^e}5^d#9*G_VB?{=oP&6naF>p?&3A4o5} z7lXUWhvIf+O_@~f<}M9!qj_CgV(cd^cDpVg+xJ>JJF`yihW|O4I7m8vrA=H>ZWg-G z&SG_1C*v>??i$;QXcRfR2Kga>0exoj`#q>wEy$3UULx?q>iLaRA1$Lti{Q;7=EA9SJ`-4 zq~s_9c|{(m<;TV7Vr(7E^EM;ttQj818s4>He&{4P*%Vq+`w&x<3jf%>$anIiiAy21 znLv#F2=xyEt=;>!A=h&`Kg2ceYf zI$u8N1l=psm_{v06!er3WX;w@vKPS$lx+8UIPCx2JGfX5F88;fs}V6}X-c%Vnizt` znpKFBH`}g(eBPl`?OKzp4ch?2TuttT|ROcRP@6|_BfV45+p*JJRny3FsMz3PJI;JvFd&b17k zuK1O;cj7wULZWSBmXo+wh0Y| z3eVR-ZALekYAhRdK{{RVvs#p1InTAQI|bU$KosdehwWI5jL^=j zDf{31OjNvuk#vQpT@Q%ie6y)q+bPj7w_=nrga%nf9ZtPw{zR-VB*?;BJ0-S-{^eb3 zP6vhGcv>)7BJd5#dyhZC;O+sT%<;brI~xtJGta7$fSoLG61oGFFJ7NS`OH^fD24i z3l2>ezl?ZhM#;Ts5&1s)HA7`oB1eWP#PqqV(igX|wk8AG>WOSEwPJ zb&5srNjhfC)ghrfy)I5N3e|NqD>B~jZW)$=dsRx1HDB8d5vXIu?-a6H5QGS4C?75L z4pD?|%lR2mW!>4xN>6`9>@f|xsv+a7sxE$|uzP6H_Sn1K;tEe9r>C=RE`O%(0F1QW z-h4jTLl~V;2bx?kLB5N#{ezt)cSq;kn)avbr?|#IbgF@wfs-QFBbe%7c|W!d#(3)& z3}ak2%@K0GYsPGm%$-XC_w2r{MZ)b5x)?%x-zjF3l#hQ;c}jKo#D@pQY&oTV>9=l- zGV;0ar&uSt+cCPzgH2KMhY(}qYSu<+N7H3sadN-W^VNfkF=mI?C$AqXF#k-8*FA-k zyf$uV7}fsKDelypb_@&p$*4CkPb}by8q;}gHI>TlhD}df5~Bv8_RJUF`K0Kd9%r}9 zT8i(gN}nkOC4qN3S^3x_#*4jWXqg(HRzLY#W4h~(4Nd^$DBetQ1pIRvnYqKa9#i8rSJFLj3tN^;$E_SHr8x?eAM{cT~;BCf-UWyH zM(7v`v>0AAg!c`IfPjv^`vC`Ka?L{D_$G)q26a!4rghD@FHtzJFmeja!IV?S|zv$QNV3HjyeQ6rh+-%&IA*_FTn8kwAw&hQK>)rlN z1{*dzwt>wyW4NdWofpG&tN#|c+A~tUg1t}|BYiwq`7fw2zPT68!hFHkb7=KC78bQg zj)Cu}TZRMIX@ozIC`eU_`ywlgV`?}O2M5T$3+I0;Xdce;fh@MU9+rOv8CHBNKlQbT z>T@>o+c4&p0|K`~@qr8&?RqmgRUjC2+09 Date: Thu, 19 Mar 2026 16:37:49 -0500 Subject: [PATCH 2/9] new file: packs/trident-operator-26.0.2/README.md new file: packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz new file: packs/trident-operator-26.0.2/charts/trident-operator/.helmignore new file: packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/README.md new file: packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml new file: packs/trident-operator-26.0.2/charts/trident-operator/values.yaml new file: packs/trident-operator-26.0.2/logo.png new file: packs/trident-operator-26.0.2/pack.json new file: packs/trident-operator-26.0.2/values.yaml new file: packs/trident-operator-addon-26.0.2/README.md new file: packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml new file: packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml new file: packs/trident-operator-addon-26.0.2/logo.png new file: packs/trident-operator-addon-26.0.2/pack.json new file: packs/trident-operator-addon-26.0.2/values.yaml --- packs/trident-operator-26.0.2/README.md | 24 + .../charts/trident-operator-100.2602.0.tgz | Bin 0 -> 11642 bytes .../charts/trident-operator/.helmignore | 23 + .../charts/trident-operator/Chart.yaml | 15 + .../charts/trident-operator/README.md | 24 + .../crds/tridentconfigurators.yaml | 54 +++ .../crds/tridentorchestrators.yaml | 25 + .../trident-operator/templates/NOTES.txt | 18 + .../trident-operator/templates/_helpers.tpl | 416 ++++++++++++++++ .../templates/clusterrole-rancher.yaml | 13 + .../templates/clusterrole.yaml | 458 ++++++++++++++++++ .../templates/clusterrolebinding-rancher.yaml | 14 + .../templates/clusterrolebinding.yaml | 14 + .../templates/deployment.yaml | 82 ++++ .../templates/postdeletecrdshook.yaml | 82 ++++ .../templates/postinstallupgradehook.yaml | 70 +++ .../templates/predeletecrdshook.yaml | 41 ++ .../templates/serviceaccount.yaml | 20 + .../templates/tridentconfigurator.yaml | 111 +++++ .../templates/tridentorchestrator.yaml | 108 +++++ .../charts/trident-operator/values.yaml | 327 +++++++++++++ packs/trident-operator-26.0.2/logo.png | Bin 0 -> 4314 bytes packs/trident-operator-26.0.2/pack.json | 16 + packs/trident-operator-26.0.2/values.yaml | 346 +++++++++++++ packs/trident-operator-addon-26.0.2/README.md | 24 + .../charts/trident-operator-100.2602.0.tgz | Bin 0 -> 11642 bytes .../charts/trident-operator/.helmignore | 23 + .../charts/trident-operator/Chart.yaml | 15 + .../charts/trident-operator/README.md | 24 + .../crds/tridentconfigurators.yaml | 54 +++ .../crds/tridentorchestrators.yaml | 25 + .../trident-operator/templates/NOTES.txt | 18 + .../trident-operator/templates/_helpers.tpl | 416 ++++++++++++++++ .../templates/clusterrole-rancher.yaml | 13 + .../templates/clusterrole.yaml | 458 ++++++++++++++++++ .../templates/clusterrolebinding-rancher.yaml | 14 + .../templates/clusterrolebinding.yaml | 14 + .../templates/deployment.yaml | 82 ++++ .../templates/postdeletecrdshook.yaml | 82 ++++ .../templates/postinstallupgradehook.yaml | 70 +++ .../templates/predeletecrdshook.yaml | 41 ++ .../templates/serviceaccount.yaml | 20 + .../templates/tridentconfigurator.yaml | 111 +++++ .../templates/tridentorchestrator.yaml | 108 +++++ .../charts/trident-operator/values.yaml | 327 +++++++++++++ packs/trident-operator-addon-26.0.2/logo.png | Bin 0 -> 4314 bytes packs/trident-operator-addon-26.0.2/pack.json | 17 + .../trident-operator-addon-26.0.2/values.yaml | 338 +++++++++++++ 48 files changed, 4595 insertions(+) create mode 100644 packs/trident-operator-26.0.2/README.md create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/.helmignore create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/README.md create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml create mode 100644 packs/trident-operator-26.0.2/charts/trident-operator/values.yaml create mode 100644 packs/trident-operator-26.0.2/logo.png create mode 100644 packs/trident-operator-26.0.2/pack.json create mode 100644 packs/trident-operator-26.0.2/values.yaml create mode 100644 packs/trident-operator-addon-26.0.2/README.md create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml create mode 100644 packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml create mode 100644 packs/trident-operator-addon-26.0.2/logo.png create mode 100644 packs/trident-operator-addon-26.0.2/pack.json create mode 100644 packs/trident-operator-addon-26.0.2/values.yaml diff --git a/packs/trident-operator-26.0.2/README.md b/packs/trident-operator-26.0.2/README.md new file mode 100644 index 00000000..0f246c1a --- /dev/null +++ b/packs/trident-operator-26.0.2/README.md @@ -0,0 +1,24 @@ +NetApp Trident + +[![Support](https://img.shields.io/badge/support-official-0067C5.svg)](http://mysupport.netapp.com/info/web/ECMLP2619434.html) +[![Chat](https://img.shields.io/badge/chat-slack-4C9689.svg)](http://netapp.io/slack/) +[![GitHub last commit](https://img.shields.io/github/last-commit/netapp/trident.svg)](https://github.com/NetApp/trident/commits) +[![license](https://img.shields.io/github/license/netapp/trident.svg)](LICENSE) +[![Docs](https://img.shields.io/badge/docs-official-0067C5.svg)](https://docs.netapp.com/us-en/trident/index.html) +[![Go Report Card](https://goreportcard.com/badge/github.com/netapp/trident)](https://goreportcard.com/report/github.com/netapp/trident) + +Trident is a fully supported open source project maintained by [NetApp](https://www.netapp.com). It has been designed +from the ground up to help you meet your containerized applications' persistence demands using industry-standard +interfaces, such as the [Container Storage Interface (CSI)](https://kubernetes-csi.github.io/docs/introduction.html). + +Trident deploys in Kubernetes clusters as pods and provides dynamic storage orchestration services for your Kubernetes workloads. It enables your containerized applications to quickly and easily consume persistent storage from NetApp’s broad portfolio that +includes [ONTAP](https://www.netapp.com/data-management/ontap-data-management-software) (AFF/FAS/Select/Cloud), [Element](https://www.netapp.com/data-management/element-software) (HCI/SolidFire), as well as the [Azure NetApp Files](https://www.netapp.com/azure/azure-netapp-files/) +service, [Google Cloud NetApp Volumes](https://www.netapp.com/google-cloud/netapp-volumes/), and [Amazon FSx for ONTAP](https://www.netapp.com/aws/fsx-ontap/). + +Trident features also address data protection, disaster recovery, portability, and migration use cases for +Kubernetes workloads leveraging NetApp's industry-leading data management technology for snapshots, backups, +replication, and cloning. + +Detailed documentation for Trident can be found [here](https://docs.netapp.com/us-en/trident/index.html). + +See [NetApp's Support site](https://mysupport.netapp.com/site/info/version-support) for details on Trident's support policy under the [Trident's Release and Support Lifecycle](https://mysupport.netapp.com/site/info/trident-support) tab. diff --git a/packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz b/packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5aad9ff63eff782cf97a889adbabff8435dbf2a6 GIT binary patch literal 11642 zcmV-=Errq_iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ%avZmkAbft;Q{=QfLD3(px_J?$)AM;EI3#t%wM_MpJocVd zI8LCe(A_Yr3S|J*WLwt8zQ(@ZKFJ1dRj6w>FQVmH)(?pdB#?TWyRSyOhr4^PMt>RY9vr;h z{|k&Bje?#p=K`_6j2?`u-nc)>hcfabW}MJ;49h(aWm)la?=Tqc1tTxQJY*yjD)9*3 z;W&X%N(sy;g9v9aU6FJS=U5zN*%pT@EmLrOc?MiihUOSDMwdj^iy7pcq;n5IEN}t) z!N_0WEog$run;2S@1N z8^&}_ZCa3}bMG3jZYYcR*z-+GJl|61`C!L~=gVe!*ZC9|jN1D5?_f9BI|xSpXv<5H zq`y9{Jh95~7*LkQBt(*z-qM!e9gTv$L&fVS@Bha5U!pk2{81G^|M=fKc(uP~kFBP!7YPCx2h6pOlT^(`SWoLL)dzQ!3P0Ti$!&$M zXeZirZ@l2&9Q zKrCDkfkTlq3@DA@!{rXV!)b_jAfk{`0SS%BYz0D!CD)x8z!e1)MG)p((4?f8^oC}spV7#d%^kk5RH+_9sUW^h@$4UC z4-{{XoZkQp|C$qqqm!JGbbhHBNz(b*Jf%hQ=`9X(HA$;7x*jXnSC}Q-W&rq*AQ3K3 zZ!?BDSCUcW>HKTF8bh_MvTG_(Q1tW|&eB?zRwv_Hst<@IhX>8nB&wyhl0f;x35ZFW z-+EGQnYr(nrh?Hp#%vPjbCRAre3L>&BvVmb;in$BQgo%FV0oI#f#ME=vQ}jW>8gVb zu^Ls;1?wshy2MOEaS%1NvH^9Q5_i>5Ar?}SeOIekneP1#YpkBS9mx=J1ZyvJyX0VkPQNwtMS zsdZF6k)Fc?uY!IIgF!*lB#+|>jY+ryj)glnXL%e$rn9;TGc}i$jNxo{PQ`>_F6Rsv z%Owt(#L$L@o4orlz^h}hq9}DljKv9IfaIK2bh+);1?2)_s_kx|Gh1Sd14#vDQcSr( z0tfKYuo4EtC1S&vOos+|upM|MCe2&#MWKP-)A@V6#IYqo;*IGXVwFf|?K7mHYHGx4 z9-=8WfE4%{G??f_;?GHZqeih~v^#xRiJ1DC=RSJ;ijoJOQ+f3SI%(`CDZ#J{$ZC?VcmT}_mkg1O*3+OQjOm||r=rcynm%A&zwk(4?> z*A>7yo+Ck)*e*p7!^+@OJ%OX5NlntnF!<|;51i&*l2{szN4cOp&oat{?a+wuYL9Ml z$S@-`A|bf&49ovWIxi46D{c1k>1`P2Q5#~06S_pjU_%asG)56gF@u{0PJyIcpxC9c zAfZ`(lLRO8KEttO%TXJN1u1njcAR!(Z!}^bPK6%M%6HX4&4kh0l_jM_)7~F~Lbi~K zc|j8lOM(EUTG}&NO&b}i{vKwe9EWOkvoQtynq+YG{t}j$k(u=$bywXKiT8B=R;}C1 zS=s8dn9k?2C-k}=UJ86GfHL@n)3j70MFnFRNC>xaCu&6DqdX!K&WtczZCXS$DyQpe z<;uyV#MwWkIx4wq7TtIXt>JVhP)ly_{Mky2o-*C?tzGjIW!E!Rt*PCthr^=Qn*u`D zuVy9VQc+DTx{)$Pmy`&zwsZTiz*Lh@*=)4Jteb*ZXFm+R#!mhCPK4ch0ME)gp>C|a`QMYCL4M`(scvQ!lVXJm5{bV5JfWb_0HSkPv zrx99!-%=Lh6D&};XqbCKxxiQ`TcQAF7>S(Wz-yFs>J4L>M-xVuB$5l4G?L01bGTWM zaG`S{i;vRO+xCP>E-1IVo07#Y%i_vhu{G7)RVuLsS}tY)L{aSBx~5 z9bKu-qR{O+I-a!h!Vv4r{L19S^3?L==y>Ar0)?3#+BIrbT6dLvLGw6L%f-O6byyme z7w!iv7zueRnR05rghWFGo(u1gMtI1{C5~tBFj9^*xeAoF88I~4-$m9~M+?U@ zf1%64FLWx)kaS6}apZN?JBGol#2Bb`n4b_)W~{}1gNRTzF`$`H7NNx7g4Q+IxH!>kd}Q&Vq9ki!<^=FATT^*m@j}KfeY(hsyLYAR4z$y z1XC1V<22%d*IV}(_D9KxOB&Q5JJVzM0;S;svtzxax}dRg6320&IuRIUwKu+lgv<~AK=C?sMvp)}Us z9Do!Hlx0U+Q`tl-f`4N)&upUh^<#FLhHRzC`5v$AE=!$%AI`6iCJ*MIR8rYm9`dF2 zwfivRw~9+!TgDO1m&v)>AudufMg;mV{~gUO`J zbpyk8ssfT0bIiBjUY#DlgUQ9|k7uVpefzD~sL_$Vi*m&46}=h?%3$EG#h@%Tn&MP& zcvyd8*8K1hPM4Y@KxJ9QcY0oWRTXB+YNPcYsq# z4#UR31s^VbOO~#l=TqNoZ1Mn(;@FkX8zL4Z^IZ}g1{58Zr_v7HDj~P@AlVDx{KLs< ztxZbC+}0#{EJ)VU8g81S`q|jrx@knf0`dMvjbTge!fmPITgE)!3gA@gfe)8$$#=aY--=<-AuDv^L4t2pSR} zz}ZZ@_;4f@psk@c2m;TlF*QY$1nLRHdaM&fihW!=63VU2Fw4h!xED!Unab2RqaTP# z)}yOhu3p0Yeqj}^-eC&NG<9b6>u?V~uaQ%iKP0s#va#=d{6Ld?GJOP=gBAal1^N?e<#0+MPCartE&KCIYXteDW zNX+)(f^uP2hb3A!QCZK{=4$LHmyvO5N)0@xsIvk|tvA&!a~zjn#&9NW9bqgMZr!*} zOYQ2rTsjBml{_nMg|4TgXqTTxk%^5JPV>Ag@ z>$wQFBmoyX)smnW49ekZeQzW+daeP_GZgAVsr?mr6OARM0vCa+3`3H0A+2;ZuxVt-Y5Ld40faOI3$jbWh-USF~^?VON70j#=guD}o)>4~oAjy-}Wg30~HL1W5XY zBGDH2tXE5|{G$kvj_y>eH4SqdBhCW=&pW+ENfv9J>6UW=*HBK&bf<;2RZ~t|Gf~4lUwT!pyPS$7%)oqlf4h z{d)BOKNmR8e{r`G&`1)D@KgIXy)9_nZl4Pv*LS`h!VwK_V zq&}2u@G*Ql{QTLIP~PcnrWBxYo?5F*9R&+K1Lteyfni_|S4r3b_+_rLE#0Xl_)(uZ zl8_(lmjCY{Se}M(xUc>s$z?v9ky{w}12A<--Szpir>Q$;7zqrhz%a|>cm==aC^jbx zvP{t(ct2rXw}KZEgKPtbDGpK2F>tAB9EGl0Yn;N`$(9hIRkJ!e@X~A>oSa`uSfzI} z9Bv1matWCkM^<8-SKOSRQ)xsLJ|eYEjyNDiyrH&}u@a`rTrw+oX)_Cc8j#NXP52%2 zqMmOQ?c?t@@6eLQf(yEmhQd{JRub<>T*gQ$W-$0y?*A(v)auemHy5w=KPy7#^rjpk zHo^jN-J^C_NkOSoOg+7-pvo?-H^t?${@a9U!0*6t7E6<7@c#{9@Xx{BhY(E?nwoP~ z-4yD4O`@DU1HKq4s>gErB&iBeY&0m)D4Y4*1oOW))dr5Fm?j<-r&47e%Cew(ETlL| zS(*z@k>BChT$+1p`m#7wu&(`eg8f#S^fA!32J0~!v^T}to#R$hq(O9JeXZirI%zLM ztYZ`BR!W*3w2grFjqvJ7xAk}xTsKl3W494T6-TlGMg`ZZBdam%9TZhEm6CC4sGjzy z)lknI)=3-7E^b42h34>kU9(mPL0#nypD{(is;3qk401l zDE_qtqd9*u_=VGS&@o0!ur|S0=Pou?pT&ub9!aR4zv$C3^&=inHw~!$JLp&cnT;1; z(+g$HdT%e3U@heDzJ7IZxGC{#w0yT|S~(igPUYh(@fL;oMa9o;f5$jC~V-R&0WJlmRNQB`I&=$QV}c0bNe^+raMQ7KPzP?U$7P3}R1t7F#lb zSNMG7Z0zgsXXOw{BeO)X@!ZO9ubMbj=h9V(nRQXE2@Dq$wxpKXYVoFMhE)rzQe{_v zL%5CA9)G8Ip36KFPJ7N}Udygh6Y#_I7YQ3vdYxx5SndvBP{0r5fN(0c#fRU5KCVM% zu(hVWTcGYc5%BG>)#0~>TWYrhpw{y5R6Kl9pCg+tX)4aYkeF6E!M7?@kJiPdN^F%~ ziX@rCR21zu*Lbx9-{@`i@po0=Ai)AfNT9$KU8hlG1`EU|Eu_hMEo2`9Y_4HKRyZyHM#E@n>XDE^rLIAhbGC|tw2iva0rK0l&O5co1G7BUp_%GL4^~m5Y+V$1 zEoxh89qR{RGy&%(vF<6b*!v91P{^|3b-_@hv1nR>`rP=UZBHAXQKkw7mi{2j@>+_C zL05^oWhIdLZ9ug5vWD~X=keWv-h&l3AAv40wgHL;}6 zGW#sEUyICk7$Tvyu?h*+;YjMJM!YhD9_hmvzvNt)%dxm%xw=8H#|^eXyu9Vi9(Xf@ z!q`^}#EXpT8lf;bt@T|J=vQsh27qJd6tL}9uo{M&6)(^|>R@#1Z(~W#c6ROOYRlY| z>hI<+DS{O&{^!pUjSK1i-PO70G{WkL(o^=WI$%_7dncT>92(r)ObR+GcnUe#P!if? z;cJr*b8zjel@NRF#RFudt%_$UX_J!X98{TtinxR7Tx6!84dM`7aw>vWSX>qIzewMx z3zn+<+K3CAdIa24l^d{xmHe>Qre(%`?90!ey-f|iM>F@H%-Gw+)O!>|?}28X|6e^~ z`oGrK6aQ__F)$iq-)u+R?^%F#?|&TZ*W$nTb`N%UpX0xu;xo#i2vY3XI0@?eyzbi} zY>L7FgPXRKcD}5n(vXuu-cX;G`%7T<^m{GVtggF+)-!b9$s6UgeN z31dW(O{vg7ZjdM*WbjR3K=CueF?N1x^;TjxMIYE4P4rM7uUo1rx)5RJ%nkzk<0 z7;(OFul-T{!b_aCPdE1?@^Pp#ckqAZyt7Ha=2W1so!E>p8a-%i z7A<~&qR<*jUnP`0a2R&bPd~`dr zg+~1l)mPEwmX@zVm(A7h`!uIgvb8aN=G-IU?UB9Bb?jr&^6-9rimtlLP-vwiuc9T*b!kU444^rd z%TWsG(ZVqj52jUvqZfh*(M+zm1+7lyzb~tKsqY3tuFOLS7t{AEwfT*Zf}Du6vI+t zy4qBS>ZnroKEnx)NW1jZ^Ea!e@FH#s*HNu=Zxn|YaA9B0P?u24%)SDqPPd$(X2k2# zTio6bWNw_TS4Ua6z+5Q5RD%GS+gqTQ013Jlzk3sT6Ti&uEzwVa1YJu3$_1S>dZUig zkQQO9<#$Q00W`Zd$mEED>nyr$>$rg&n#yh}MNeW{P_JFRhhjfG&8d<&NHzQ|HkB7_r~a_l6j z*BfVf%pb|I^(b_%BWg1dTqhz;k>R9YjPBmJD#QQ4W^m$&^?irKeLQFQ7MHr-yr;wK z3FdvByGdZb%-x%;FVabEopK)s^jdB`7P*h1J@3td>Q)-furyX@!Y&*nNavPY7w^K6{#A{0aZr;p< zgW5!SHx1G=b~l-zd4|KWx;-F^Nr?Cuc0B;Kse|YC4K?*R>jf^>UiMaKovj|=c<+$B z3DLb;&5lb`zoT>;r${pzHM&Dl(BCDsVntuPfws$$OxM>r6Rkza|lt%EJ89}NI8jZ zNZm3U;pCNh{=834%7;LmMKVnilt!gQ`p~!oyDnywm7P<4AlqC)9hFyR*PnkbARICC z!FTsyeP-W2_wB3l-#Pam_P@a1awfWY=R@Zm>JCNvdiI{WaJqE4rbp=H!^uC-kA65U zGC*JI^_J0O>?DGI9mCjCjr0i;i*cc{)cyAjRQ3(mR(y}AE9xL!y26rm^gsT7ar)2W zi_??S^Q*I?_y2r*_P&L@Ar|4VyvTp3Rn0HF*iHu%?)HOz)!eDUVp2u?km0Dp!bBF( z46GsP>rHhzW$Wt$jeGIGX_PB3wbXND_l1|X*k=0tWj8I=v+>QV49ds09IOo|S%Iq) z58DJusi}5Hy(938$es!Fs_wJ5ipPR-Eg4SpvtCKDX3L3s)tIu?2X^f4(|=W-iRbSr zzMl18M!C?w_K-z7xgh4*HYRakAkBK6b2J~t$VaZo|h%=d3FnJ>g(3qWN80^3xCS3im36g)Q9lOEL59W8bL$ZtQ#;yIR+<$Wq?w20VPJicP zjjD}&o_%7vf$y`~kyF{lWvBf&I$hICl0h5miJEJu_M(=)AtLgpt7;{N#qRT9?G^Mq z$+fm@|I1{iSnUzDLF46Jzf38M4jxr(U)^17cht`rBC!-<;~}ZKsa(HF+tR*Yo}puv z-y)BJexBV;d`zD z*4Y31dx!P=pZ50lpWpv|lJAk7pnZ#l&320KvO!bbb6LOpkWprxZ*~@02$2~Lk})c1 zNaHbF9Zzf;l{502(P(5H-iXbynAqe!W$U!IdP1X~7OUCIj4s~{ue(`2o6Y?O#g6`E z5Z!&Mhqk%CL*@2vkhq&88|;l7K>a0-4Yot>xD|2-T#Y@DJMDk;A(9P0uGu-Nb1;G28U*w(N}9=~cw;PC;#}zz3f@KX&(C2cuvV?2er=p>|#tIJ|a#H=Mw- zYC#fAbK#^7Uhj=Y19$=7W1Oj1gaqvFK|)dvh{MtMmr$%gfrpG_0v3n^N+HiO%=G1> zKxeS~N|g#s<-PkEmy@I8FR-bhUsr0{tbW_rH)H+J){%c4U!R@RU*hYt{}_H0_wPFU zZ}0GR-`Gssh8!4JlQ z<#-1M{F-FP7bpCRewfB&Nsz#@z-Eq~!A@aYtZ}Ohe*XMWrsNn13R7%6Oi>U7_4Wbq z7~>3H)zTxHR-IKi=GbdPY2P4qTL=-w98xOu%YZekGjeYS)??T~J@bF{nC=5&fY;3b zySt6^Kcj<#!{_<`DZcyd?%vaHQw^EvjoWPGmH{<3T1LN4Rw+6DPLh_`S3tK09T>XG z>*AOB%ohJu}tB`UEq=xM-{O^Jm4+7mKG)rkLjwfC(5 zpX94MYdf6(HP?Pam6U5jV*$Cfv`iqnppVj-Z?1)_1WlJ7etjk0iMrtM+=+xV70igf z2I5oW$^ZJKVf?i?MX5MDsjM&RjkZAMQJt8`_AspUE{b_?*#>mCQ<<{9uu(Y&KE??M zGgbM$1QX@f9jy3`jLmey+~!J8ISt$MfrqZ z<<;Bnn)ou|jq$ob90uu(4iIS1K@$F{{ao&z-1=rlVu2Z!YEM(>b)-Oo*f_`f?-zcv-1TTmzgMfbB7cvLO$M=zEBOMdIu|E??hORWEQNBg6_#`=H% z`TfTy`R+EWd~jr;+bvwo9-H}u^{oAtvJjtOfx<<5C`<#a2#YzJEDzhu$eaS~`VGI* z0Z5gFq=Egu$kosbA+ig733X4YcMT}BU?nk5LwuAA%JWP|5w;Q7ge%Ccho0#Yr?;vG zr+{H%BfX8>uF@4njLO`z?#QG%R6)0sF=6y})keor4W@}WRX6eBHH9shbyCdVQkI|& zUKiN~sS)8)rjGK6i1&2fUaSVRrhlBn_bUFXtpN^9Z?K_;eoyD`@e;>H8`ZD2daIDt zT>(1(iL&ciOmBE6cM6E2jS?GLVb)znXBP!BMyGhvDegsfQNZN%2wF7+u5HWW0?!E- z_WkNgQu73R6}ZBr>wJo1EKUfk6f2Xn`ZM}I{ZUAnrb(^-Ufka!#C6^?R zWIa_sm1(@w^rG2CTdRidrd*JW?qYe`ns>*Z?L+YBeOe-GFgk6^+PEKkDt@{iY`Zd} z&|$UALW`N(ZYyfWq}fde$J1W{tL_1mz}DyA1g`F0YcuNTcv1l@Qq4>pW@n8sESp%` zNBjpY7zwNGa5E|>b3y+@`x>-gK$UU=54-(28|+R2s1^7nj%V*Mib*=Rm*`ZdfDWMc zDtZiX7T|RUDJBeO z&d_8y8@D)js*rlD1)o3nXa?O=$21Ld#&B9Aw2|9NUrXSdF}9l-ZB%!b-=qO@RBL}v z!$4UeUd|})H8$Jrz*23!Cux4WA?#0DF;t=b%H~iRNaEh*yOuyxi#w}U^jBF$c}q?S z+IELdnOokXbJ*(cS;x{x;*#-K9yPM5IVq19zs zca~X8u>tO+*-lRzP`$B%u%KL2_IaIz>YP#se0B>y(%10+sc365PbtHXg=0y?_Z40<%;_N9%rvn*~l`nv*yp=^Qc?UZXkYf%gKg7KDRwzHs0R z9LF$^=~Q2MO49ib=!Y4XSlvbDq@y(QUO!JLSp`d5?h1=HWyQ2lEY7W1L}$NuEY zbXZn2Md5Xxfet15HsCjz_iZpm*WR~*NaWv?k-7Kn|MXtKkBAYPb2vLW9BCrrSk!xSbR4)$Koi<>;}L9Zb&2+-wk$0qX8_`$s_&a-#zc+zkIyZ zs^RCCY85yh4oNZ(_=4a#QU|G~D4OG;Q6N5@%}7X4?2kr=ua92^d^z9NMaRQovNB+H zKO&^bkfbv@yus7q>G2QmCwqsxe?8bg2o@rVwNRxzgBbgJi$frXI>T6I_Wx?7Koh+{5RogVDE!HsjBaUhI|d5A{z3Z4wB_0h}$_i_i;WCZ0l_SfP{+YxVgD;Sg;+ynLeOC#W;lsb23kH&8Jb$1zY)Cpfo}(^3+ws zGZbRJ13V8GfVjf{vAAOZE_G-JoLNwKd3<^1u(vz{>4%&IhO30CejgIK(2H{QW~}bz zpyaN;-JJtT;rpT%`%0TS*`Lvft79OUc4cvhRw+tIXhTk%BUI|_zj@nG9p+N3aw@iW zdUM5o?M>k87%F?<*PMjc@k$Yb5hw9V7T|e;OKyvTBGrpp0RGSa`rjO;jG{!?#D5L+z~{ z9>+9~ws+v;X{t+$lM5U&M}0D8wvK>q!(hm#0<^lkk(w;;^o+mF;eEZqND6j5I9_F zs=0VVe8(8Jd84mOFM9sB-396UqhC7ueb_!o}I0 zF`nv4<3)VATsN&SV>RA0msXp)0!IZM=~`_}(msA8DsvAVZOs${jW z(i(`+^d8j73O?BKHKHu7+S;%?r}v;)RwF4^CWy6L**&POY~i->R9l-m=K3CVT5~m0 z6{upZMDBJFnc*;K#C+;|9j{E>OCD_YX0Bd-Q8`@|IhyaC;7hQ{J-wf;s3|ye@8cU2U&yKcjn^zE{ON` zCGeVlt1!P^ztK9Px(4&rB}UGlE_hAX{?UT`{5^lq-}CqU-Rb+k0RRC1|EwNJ2LKEK E0Py(_#Q*>R literal 0 HcmV?d00001 diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/.helmignore b/packs/trident-operator-26.0.2/charts/trident-operator/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml new file mode 100644 index 00000000..82160961 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +appVersion: 26.02.0 +description: A Helm chart for deploying NetApp's Trident CSI storage provisioner using + the Trident Operator. +home: https://github.com/NetApp/trident +icon: https://raw.githubusercontent.com/NetApp/trident/master/logo/trident.png +keywords: +- NetApp +- Trident +- operator +- CSI +kubeVersion: '>= 1.24.0-0' +name: trident-operator +type: application +version: 100.2602.0 diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/README.md b/packs/trident-operator-26.0.2/charts/trident-operator/README.md new file mode 100644 index 00000000..0f246c1a --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/README.md @@ -0,0 +1,24 @@ +NetApp Trident + +[![Support](https://img.shields.io/badge/support-official-0067C5.svg)](http://mysupport.netapp.com/info/web/ECMLP2619434.html) +[![Chat](https://img.shields.io/badge/chat-slack-4C9689.svg)](http://netapp.io/slack/) +[![GitHub last commit](https://img.shields.io/github/last-commit/netapp/trident.svg)](https://github.com/NetApp/trident/commits) +[![license](https://img.shields.io/github/license/netapp/trident.svg)](LICENSE) +[![Docs](https://img.shields.io/badge/docs-official-0067C5.svg)](https://docs.netapp.com/us-en/trident/index.html) +[![Go Report Card](https://goreportcard.com/badge/github.com/netapp/trident)](https://goreportcard.com/report/github.com/netapp/trident) + +Trident is a fully supported open source project maintained by [NetApp](https://www.netapp.com). It has been designed +from the ground up to help you meet your containerized applications' persistence demands using industry-standard +interfaces, such as the [Container Storage Interface (CSI)](https://kubernetes-csi.github.io/docs/introduction.html). + +Trident deploys in Kubernetes clusters as pods and provides dynamic storage orchestration services for your Kubernetes workloads. It enables your containerized applications to quickly and easily consume persistent storage from NetApp’s broad portfolio that +includes [ONTAP](https://www.netapp.com/data-management/ontap-data-management-software) (AFF/FAS/Select/Cloud), [Element](https://www.netapp.com/data-management/element-software) (HCI/SolidFire), as well as the [Azure NetApp Files](https://www.netapp.com/azure/azure-netapp-files/) +service, [Google Cloud NetApp Volumes](https://www.netapp.com/google-cloud/netapp-volumes/), and [Amazon FSx for ONTAP](https://www.netapp.com/aws/fsx-ontap/). + +Trident features also address data protection, disaster recovery, portability, and migration use cases for +Kubernetes workloads leveraging NetApp's industry-leading data management technology for snapshots, backups, +replication, and cloning. + +Detailed documentation for Trident can be found [here](https://docs.netapp.com/us-en/trident/index.html). + +See [NetApp's Support site](https://mysupport.netapp.com/site/info/version-support) for details on Trident's support policy under the [Trident's Release and Support Lifecycle](https://mysupport.netapp.com/site/info/trident-support) tab. diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml new file mode 100644 index 00000000..f3aa8971 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tridentconfigurators.trident.netapp.io +spec: + group: trident.netapp.io + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + x-kubernetes-preserve-unknown-fields: true + subresources: + status: {} + additionalPrinterColumns: + - name: Phase + type: string + description: The backend config phase + priority: 0 + jsonPath: .status.phase + - name: Status + type: string + description: The result of the last operation + priority: 0 + jsonPath: .status.lastOperationStatus + - name: Cloud Provider + type: string + description: The name of cloud provider + priority: 0 + jsonPath: .status.cloudProvider + - name: Storage Driver + type: string + description: The storage driver type + priority: 1 + jsonPath: .spec.storageDriverName + - name: Deletion Policy + type: string + description: The deletion policy + priority: 1 + jsonPath: .status.deletionPolicy + scope: Cluster + names: + plural: tridentconfigurators + singular: tridentconfigurator + kind: TridentConfigurator + shortNames: + - tconf + - tconfigurator + categories: + - trident + - trident-internal + - trident-external \ No newline at end of file diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml new file mode 100644 index 00000000..f16b855c --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml @@ -0,0 +1,25 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tridentorchestrators.trident.netapp.io +spec: + group: trident.netapp.io + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + x-kubernetes-preserve-unknown-fields: true + subresources: + status: {} + names: + kind: TridentOrchestrator + listKind: TridentOrchestratorList + plural: tridentorchestrators + singular: tridentorchestrator + shortNames: + - torc + - torchestrator + scope: Cluster diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt b/packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt new file mode 100644 index 00000000..acb0dd88 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt @@ -0,0 +1,18 @@ + +Thank you for installing {{ .Chart.Name }}, which will deploy and manage NetApp's Trident CSI +storage provisioner for Kubernetes. + +Your release is named '{{ .Release.Name }}' and is installed into the '{{ .Release.Namespace }}' namespace. +Please note that there must be only one instance of Trident (and trident-operator) in a Kubernetes cluster. + +To configure Trident to manage storage resources, you will now need to configure at least one storage +backend and add a matching storageClass. + +Examples of backend and storageClass definitions are available at official NetApp Trident documentation. + +Further, You may find all Trident releases and source code online at {{ .Chart.Home }}. + +To learn more about the release, try: + + $ helm status {{ .Release.Name }} + $ helm get all {{ .Release.Name }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl b/packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl new file mode 100644 index 00000000..bbf3dc01 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl @@ -0,0 +1,416 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "trident.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "trident.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "trident.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "trident.labels" -}} +helm.sh/chart: {{ include "trident.chart" . }} +{{ include "trident.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "trident.selectorLabels" -}} +app.kubernetes.io/name: {{ include "trident.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Trident operator level +*/}} +{{- define "trident-operator.logLevel" -}} +{{- .Values.operatorLogLevel }} +{{- end }} + +{{/* +Trident operator debug +*/}} +{{- define "trident-operator.debug" -}} +{{- .Values.operatorDebug }} +{{- end }} + +{{/* +Trident operator image +*/}} +{{- define "trident-operator.image" -}} +{{- if .Values.operatorImage }} +{{- .Values.operatorImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident-operator:{{ .Values.operatorImageTag | default .Chart.AppVersion }} +{{- else }} +{{- "" }}docker.io/netapp/trident-operator:{{ .Values.operatorImageTag | default .Chart.AppVersion }} +{{- end }} +{{- end }} + +{{/* +Trident force detach +*/}} +{{- define "trident.enableForceDetach" -}} +{{- if .Values.enableForceDetach | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident IPv6 +*/}} +{{- define "trident.IPv6" -}} +{{- if .Values.tridentIPv6 | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident SilenceAutosupport +*/}} +{{- define "trident.silenceAutosupport" -}} +{{- if .Values.tridentSilenceAutosupport | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident ExcludeAutosupport +*/}} +{{- define "trident.excludeAutosupport" -}} +{{- if .Values.tridentExcludeAutosupport | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +Trident AutoSupport image +*/}} +{{- define "trident.autosupportImage" -}} +{{- if .Values.tridentAutosupportImage }} +{{- .Values.tridentAutosupportImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident-autosupport:{{ .Values.tridentAutosupportImageTag | default .Chart.AppVersion | trunc 5}} +{{- else }} +{{- "" }}docker.io/netapp/trident-autosupport:{{ .Values.tridentAutosupportImageTag | default .Chart.AppVersion | trunc 5}} +{{- end }} +{{- end }} + +{{/* +Trident log level +*/}} +{{- define "trident.logLevel" -}} +{{- .Values.tridentLogLevel }} +{{- end }} + +{{/* +Trident debug (equivalent to debug level) +*/}} +{{- define "trident.debug" -}} +{{- .Values.tridentDebug }} +{{- end }} + +{{/* +Trident logging workflows +*/}} +{{- define "trident.logWorkflows" -}} +{{- .Values.tridentLogWorkflows }} +{{- end }} + +{{/* +Trident logging layers +*/}} +{{- define "trident.logLayers" -}} +{{- .Values.tridentLogLayers }} +{{- end }} + +{{/* +Trident log format +*/}} +{{- define "trident.logFormat" -}} +{{- if eq .Values.tridentLogFormat "json" }} +{{- .Values.tridentLogFormat }} +{{- else }} +{{- "text" }} +{{- end }} +{{- end }} + +{{/* +Trident audit log +*/}} +{{- define "trident.disableAuditLog" -}} +{{- if .Values.tridentDisableAuditLog | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident probe port +*/}} +{{- define "trident.probePort" -}} +{{- if eq .Values.tridentProbePort "json" }} +{{- .Values.tridentProbePort }} +{{- else }} +{{- 17546 }} +{{- end }} +{{- end }} + +{{/* +Trident image +*/}} +{{- define "trident.image" -}} +{{- if .Values.tridentImage }} +{{- .Values.tridentImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident:{{ .Values.tridentImageTag | default .Chart.AppVersion }} +{{- else }} +{{- "" }}docker.io/netapp/trident:{{ .Values.tridentImageTag | default .Chart.AppVersion }} +{{- end }} +{{- end }} + +{{/* +Trident image pull policy +*/}} +{{- define "imagePullPolicy" -}} +{{- if .Values.imagePullPolicy }} +{{- .Values.imagePullPolicy }} +{{- else }} +{{- "IfNotPresent" }} +{{- end }} +{{- end }} + +{{/* +Determines if rancher roles should be created by checking for the presence of the cattle-system namespace +or annotations with the prefix "cattle.io/" in the namespace where the chart is being installed. +Override auto-detection and force install the roles by setting Values.forceInstallRancherClusterRoles to 'true'. +*/}} +{{- define "shouldInstallRancherRoles" -}} +{{- $isRancher := false -}} +{{- $currentNs := .Release.Namespace -}} +{{- $currentNsObj := lookup "v1" "Namespace" "" $currentNs -}} +{{- /* Check if 'forceInstallRancherClusterRoles' is set */ -}} +{{- if .Values.forceInstallRancherClusterRoles }} + {{- $isRancher = true -}} +{{- end }} +{{- /* Check if the annotation prefix "cattle.io/" exists on the namespace */ -}} +{{- if $currentNsObj }} + {{- range $key, $value := $currentNsObj.metadata.annotations }} + {{- if hasPrefix "cattle.io/" $key }} + {{- $isRancher = true -}} + {{- end }} + {{- end }} +{{- end }} +{{- /* Check if cattle-system ns exists */ -}} +{{- $cattleNs := lookup "v1" "Namespace" "" "cattle-system" -}} +{{- if $cattleNs }} + {{- $isRancher = true -}} +{{- end }} +{{- $isRancher -}} +{{- end }} + +{{/* +Helper functions to render resource requests and limits for each container of trident from values.yaml +*/}} +{{- define "trident.resources.controller" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "trident.resources.node.linux" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "trident.resources.node.windows" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Helper functions to check if resources are actually defined (not just empty structure) +*/}} +{{- define "trident.hasControllerResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.controller -}} + {{- range $key, $val := .Values.resources.controller -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{- define "trident.hasNodeLinuxResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.node -}} + {{- if .Values.resources.node.linux -}} + {{- range $key, $val := .Values.resources.node.linux -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{- define "trident.hasNodeWindowsResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.node -}} + {{- if .Values.resources.node.windows -}} + {{- range $key, $val := .Values.resources.node.windows -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{/* +Helper function to check if operator resources are defined +*/}} +{{- define "trident-operator.hasResources" -}} + {{- $val := . -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + true + {{- end -}} +{{- end -}} + +{{/* +Helper function to render resource requests and limits for the operator +*/}} +{{- define "trident-operator.resources" }} +{{- $val := .}} +{{- if or $val.requests.cpu $val.requests.memory }} +requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} +limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml new file mode 100644 index 00000000..6300f2f2 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml @@ -0,0 +1,13 @@ +{{- if include "shouldInstallRancherRoles" . | eq "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: trident-operator-rancher +rules: + - apiGroups: + - management.cattle.io + resources: + - projects + verbs: + - updatepsa +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml new file mode 100644 index 00000000..92279962 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml @@ -0,0 +1,458 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: trident-operator + labels: + app: operator.trident.netapp.io +rules: + # Permissions same as Trident + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - apiGroups: + - "" + resources: + - persistentvolumes + - persistentvolumeclaims + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - persistentvolumeclaims/status + verbs: + - update + - patch + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - events + verbs: + - get + - list + - watch + - create + - update + - patch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - resourcequotas + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments + verbs: + - get + - list + - watch + - update + - patch + - delete + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments/status + verbs: + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots + - volumesnapshotclasses + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotclasses + verbs: + - create + - delete + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots/status + - volumesnapshotcontents/status + verbs: + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotcontents + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshots + verbs: + - list + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotclasses + verbs: + - list + - watch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents + verbs: + - get + - list + - watch + - patch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents/status + verbs: + - update + - apiGroups: + - csi.storage.k8s.io + resources: + - csidrivers + - csinodeinfos + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - storage.k8s.io + resources: + - csidrivers + - csinodes + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - trident.netapp.io + resources: + - tridentversions + - tridentbackends + - tridentstorageclasses + - tridentvolumes + - tridentvolumepublications + - tridentvolumereferences + - tridentnodes + - tridenttransactions + - tridentsnapshots + - tridentbackendconfigs + - tridentbackendconfigs/status + - tridentmirrorrelationships + - tridentmirrorrelationships/status + - tridentactionmirrorupdates + - tridentactionmirrorupdates/status + - tridentsnapshotinfos + - tridentsnapshotinfos/status + - tridentgroupsnapshots + - tridentgroupsnapshots/status + - tridentactionsnapshotrestores + - tridentactionsnapshotrestores/status + - tridentnoderemediations + - tridentnoderemediations/status + - tridentnoderemediationtemplates + - tridentnoderemediationtemplates/status + - tridentprovisioners # Required for Tprov + - tridentprovisioners/status # Required to update Tprov's status section + - tridentorchestrators # Required for torc + - tridentorchestrators/status # Required to update torc's status section + - tridentconfigurators # Required for tconf + - tridentconfigurators/status # Required to update tconf's status section + - tridentautogrowpolicies + - tridentautogrowpolicies/status + - tridentautogrowrequestinternals + - tridentautogrowrequestinternals/status + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + # Now Operator specific permissions + - apiGroups: + - "" + resources: + - namespaces + verbs: + - create + - patch + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - get + - list + - watch + - create + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - delete + - update + - patch + resourceNames: + - trident + - trident-csi + - trident-controller + - apiGroups: + - apps + resources: + - daemonsets + verbs: + - delete + - update + - patch + resourceNames: + - trident + - trident-csi + - trident-csi-windows + - trident-node-linux + - trident-node-windows + - apiGroups: + - "" + resources: + - pods/exec + - services + - serviceaccounts + verbs: + - get + - list + - create + - apiGroups: + - "" + resources: + - pods/exec + - services + verbs: + - delete + - update + - patch + resourceNames: + - trident-csi + - trident + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - delete + - update + - patch + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + - trident-csi + - trident + - apiGroups: + - authorization.openshift.io + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + - clusterroles + - clusterrolebindings + verbs: + - list + - create + - apiGroups: + - authorization.openshift.io + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + - clusterroles + - clusterrolebindings + verbs: + - get + - delete + - update + - patch + resourceNames: + - trident-node-remediation-access + - trident-controller + - trident-node-linux + - trident-node-windows + - trident-csi + - trident + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - list + - create + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tridentpods + - trident-controller + - trident-node-linux + - trident-node-windows + verbs: + - delete + - update + - patch + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - get + - list + - create + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + - trident + verbs: + - delete + - update + - patch + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - tridentoperatorpods + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml new file mode 100644 index 00000000..b70fcff9 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml @@ -0,0 +1,14 @@ +{{- if include "shouldInstallRancherRoles" . | eq "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: trident-operator-rancher +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: trident-operator-rancher +subjects: + - kind: ServiceAccount + name: trident-operator + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..e6297525 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: trident-operator + labels: + app: operator.trident.netapp.io +subjects: + - kind: ServiceAccount + name: trident-operator + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: trident-operator + apiGroup: rbac.authorization.k8s.io diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml new file mode 100644 index 00000000..c57bb587 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml @@ -0,0 +1,82 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: +{{- if .Values.deploymentAnnotations }} + annotations: +{{ toYaml .Values.deploymentAnnotations | indent 4 }} +{{- end }} + labels: + app: operator.trident.netapp.io + name: trident-operator + namespace: {{ .Release.Namespace }} +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: operator.trident.netapp.io + name: trident-operator + template: + metadata: + {{- if .Values.podAnnotations }} + annotations: +{{ toYaml .Values.podAnnotations | indent 8 }} + {{- end }} + labels: + app: operator.trident.netapp.io + name: trident-operator + {{- if and (eq .Values.cloudProvider "Azure") (ne .Values.cloudIdentity "") }} + azure.workload.identity/use: 'true' + {{- end }} + spec: + {{- if .Values.affinity }} + affinity: +{{- toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} + {{- end }} + serviceAccountName: trident-operator + containers: + - command: + - /trident-operator + {{- if or .Values.anfConfigurator.enabled .Values.ontapConfigurator.enabled }} + - -configurator-reconcile-interval={{ .Values.configuratorReconcileInterval }} + {{- end }} + {{- if .Values.operatorDebug }} + - -debug + {{- end }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: trident-operator + {{- if and (eq .Values.cloudProvider "Azure") (eq .Values.cloudIdentity "") }} + - name: AZURE_CREDENTIAL_FILE + value: /etc/kubernetes/azure.json + volumeMounts: + - name: azure-cred + mountPath: /etc/kubernetes + {{- end }} + image: {{ include "trident-operator.image" $ }} + imagePullPolicy: {{ .Values.imagePullPolicy }} + name: trident-operator + {{- if (include "trident-operator.hasResources" .Values.resources.operator) }} + resources: + {{- include "trident-operator.resources" .Values.resources.operator | indent 10 }} + {{- end }} + {{- if and (eq .Values.cloudProvider "Azure") (eq .Values.cloudIdentity "") }} + volumes: + - name: azure-cred + hostPath: + path: /etc/kubernetes + type: DirectoryOrCreate + {{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml new file mode 100644 index 00000000..a9ee84dd --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml @@ -0,0 +1,82 @@ +{{- if or .Values.cleanupCrds }} + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: post-delete-service-account + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": hook-succeeded + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: post-delete-cluster-role + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-9" + "helm.sh/hook-delete-policy": hook-succeeded +rules: +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "delete", "patch"] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: post-delete-cluster-rolebinding + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-8" + "helm.sh/hook-delete-policy": hook-succeeded +subjects: +- kind: ServiceAccount + name: post-delete-service-account + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: post-delete-cluster-role + apiGroup: rbac.authorization.k8s.io + +--- + +apiVersion: batch/v1 +kind: Job +metadata: + name: post-delete-hook + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed +spec: + template: + spec: + serviceAccountName: post-delete-service-account + containers: + - name: post-delete-container + image: {{ .Values.helmHookImage }} + command: + - sh + - -c + - | + set -x + kubectl patch crd tridentorchestrators.trident.netapp.io -p '{"metadata":{"finalizers":[]}}' --type=merge + kubectl delete crd tridentorchestrators.trident.netapp.io + kubectl patch crd tridentconfigurators.trident.netapp.io -p '{"metadata":{"finalizers":[]}}' --type=merge + kubectl delete crd tridentconfigurators.trident.netapp.io + restartPolicy: Never + backoffLimit: 4 + +{{- end }} \ No newline at end of file diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml new file mode 100644 index 00000000..103b2b15 --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml @@ -0,0 +1,70 @@ +{{- if or .Values.anfConfigurator.enabled .Values.ontapConfigurator.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: trident-operator + namespace: {{ .Release.Namespace }} +spec: + selector: + app: operator.trident.netapp.io + ports: + - name: http + protocol: TCP + port: 8000 + targetPort: 8002 +--- +apiVersion: v1 +kind: Pod +metadata: + name: trident-post-install-upgrade-hook + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, hook-failed +spec: + restartPolicy: Never + {{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | nindent 4 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | nindent 4 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | nindent 4 }} + {{- end }} + initContainers: + - name: init-container-1 + image: {{ include "trident.image" $ }} + command: + - tridentctl + - --debug + - -s + - 127.0.0.1:8000 + - check + - operator + - --timeout + - "7200" # Keeping it 12 mins as AKS extension script has an upper limit of 15 mins. + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + containers: + - name: trident-post-hook + image: {{ include "trident.image" $ }} + command: + - tridentctl + - --debug + - -s + - 127.0.0.1:8000 + - check + - operator + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml new file mode 100644 index 00000000..507b38df --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml @@ -0,0 +1,41 @@ +{{- if or .Values.cleanupCrds }} + +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-delete-hook + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed +spec: + template: + spec: + serviceAccountName: trident-operator + containers: + - name: pre-delete-container + image: {{ .Values.helmHookImage }} + command: + - sh + - -c + - | + set -x + if kubectl get torc trident -n trident; then + kubectl patch torc trident -n trident --type=merge -p '{"spec":{"wipeout":["crds"],"uninstall":true, "skipCRDsToObliviate":["tridentorchestrators.trident.netapp.io", "tridentconfigurators.trident.netapp.io"]}}' + while kubectl get crds | grep '.trident.netapp.io' | grep -v -e 'tridentorchestrators.trident.netapp.io' -e 'tridentconfigurators.trident.netapp.io'; do + echo 'Waiting for CRDs to be deleted...' + sleep 5 + done + else + echo 'Trident orchestrator does not exist.' + fi + restartPolicy: Never + backoffLimit: 4 + +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml new file mode 100644 index 00000000..7a73016d --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: trident-operator + namespace: {{ .Release.Namespace }} + {{- if and (ne .Values.cloudIdentity "") (ne .Values.cloudProvider "") }} + {{- $cloudIdentity := trimPrefix "'" .Values.cloudIdentity }} + {{- $cloudIdentity = trimSuffix "'" $cloudIdentity }} + {{- $cloudIdentityPair := regexSplit ": " $cloudIdentity 2 }} + annotations: + {{ first $cloudIdentityPair }}: {{ last $cloudIdentityPair }} + {{- end }} + labels: + app: operator.trident.netapp.io +{{- if .Values.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.imagePullSecrets }} +- name: {{ . }} +{{- end }} +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml new file mode 100644 index 00000000..8496eb5e --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml @@ -0,0 +1,111 @@ +{{- if .Values.anfConfigurator.enabled }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-anf-backend-configurator +spec: + storageDriverName: azure-netapp-files + {{- if eq .Values.cloudProvider "" }} + tenantID: {{ .Values.anfConfigurator.tenantID }} + clientCredentials: {{ .Values.anfConfigurator.clientCredentials }} + {{- end }} + {{- if or (eq .Values.cloudProvider "") (and (eq .Values.cloudProvider "Azure") (ne .Values.cloudIdentity "")) }} + subscriptionID: {{ .Values.anfConfigurator.subscriptionID }} + location: {{ .Values.anfConfigurator.location }} + {{- end }} + virtualNetwork: {{ .Values.anfConfigurator.virtualNetwork }} + subnet: {{ .Values.anfConfigurator.subnet }} + capacityPools: + {{- range .Values.anfConfigurator.capacityPools }} + - {{ . }} + {{- end }} + netappAccounts: + {{- range .Values.anfConfigurator.netappAccounts }} + - {{ . }} + {{- end }} + resourceGroups: + {{- range .Values.anfConfigurator.resourceGroups }} + - {{ . }} + {{- end }} + customerEncryptionKeys: + {{- range $key, $value := .Values.anfConfigurator.customerEncryptionKeys }} + {{ $key }}: {{ $value }} + {{- end }} +{{- end }} + +--- + +{{- if .Values.ontapConfigurator.enabled }} +{{- $includeCR := false }} +{{- range .Values.ontapConfigurator.svms }} + {{- if or (has "nfs" .protocols) (has "smb" .protocols) }} + {{- $includeCR = true }} + {{- end }} +{{- end }} + +{{- if $includeCR }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-nas-backend-configurator +spec: + storageDriverName: ontap-nas + svms: + {{- range .Values.ontapConfigurator.svms }} + {{- if or (has "nfs" .protocols) (has "smb" .protocols) }} + - fsxnID: {{ .fsxnID | quote }} + protocols: + {{- $filteredProtocols := list }} + {{- range .protocols }} + {{- if or (eq . "nfs") (eq . "smb") }} + {{- $filteredProtocols = append $filteredProtocols . }} + {{- end }} + {{- end }} + {{- range $filteredProtocols }} + - {{ . | quote }} + {{- end }} + svmName: {{ .svmName | quote }} + authType: {{ .authType | default "awsarn" | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} + + +--- + +{{- if .Values.ontapConfigurator.enabled }} +{{- $includeCR := false }} +{{- range .Values.ontapConfigurator.svms }} + {{- if or (has "iscsi" .protocols) (has "nvme" .protocols) }} + {{- $includeCR = true }} + {{- end }} +{{- end }} + +{{- if $includeCR }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-san-backend-configurator +spec: + storageDriverName: ontap-san + svms: + {{- range .Values.ontapConfigurator.svms }} + {{- if or (has "iscsi" .protocols) (has "nvme" .protocols) }} + - fsxnID: {{ .fsxnID | quote }} + protocols: + {{- $filteredProtocols := list }} + {{- range .protocols }} + {{- if or (eq . "iscsi") (eq . "nvme") }} + {{- $filteredProtocols = append $filteredProtocols . }} + {{- end }} + {{- end }} + {{- range $filteredProtocols }} + - {{ . | quote }} + {{- end }} + svmName: {{ .svmName | quote }} + authType: {{ .authType | default "awsarn" | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml new file mode 100644 index 00000000..5f5038df --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml @@ -0,0 +1,108 @@ +apiVersion: trident.netapp.io/v1 +kind: TridentOrchestrator +metadata: + name: trident +spec: + namespace: {{ .Release.Namespace }} + enableForceDetach: {{ include "trident.enableForceDetach" $ }} + IPv6: {{ include "trident.IPv6" $ }} + k8sTimeout: {{ .Values.tridentK8sTimeout }} + httpRequestTimeout: {{ .Values.tridentHttpRequestTimeout }} + silenceAutosupport: {{ include "trident.silenceAutosupport" $ }} + {{- if .Values.tridentExcludeAutosupport }} + excludeAutosupport: {{ .Values.tridentExcludeAutosupport }} + {{- end }} + autosupportImage: {{ include "trident.autosupportImage" $ }} + autosupportProxy: {{ .Values.tridentAutosupportProxy }} + autosupportInsecure: {{ .Values.tridentAutosupportInsecure }} + logFormat: {{ include "trident.logFormat" $ }} + disableAuditLog: {{ include "trident.disableAuditLog" $ }} + {{- if .Values.tridentDebug }} + debug: {{ .Values.tridentDebug }} + {{- end }} + {{- if .Values.tridentLogLevel }} + logLevel: {{ .Values.tridentLogLevel }} + {{- end }} + logWorkflows: {{ include "trident.logWorkflows" $ }} + logLayers: {{ include "trident.logLayers" $ }} + probePort: {{ include "trident.probePort" $ }} + tridentImage: {{ include "trident.image" $ }} + {{- if .Values.imageRegistry }} + imageRegistry: {{ .Values.imageRegistry }} + {{- end }} + kubeletDir: {{ .Values.kubeletDir }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 2 }} + {{- end }} + {{- if .Values.tridentControllerPluginNodeSelector }} + controllerPluginNodeSelector: + {{- range $key, $value := .Values.tridentControllerPluginNodeSelector }} + {{ $key }}: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.tridentControllerPluginTolerations }} + controllerPluginTolerations: + {{- range $value := .Values.tridentControllerPluginTolerations }} + - {{- range $k, $v := $value }} + {{ $k }}: "{{ $v }}" + {{- end}} + {{- end}} + {{- end }} + {{- if .Values.tridentNodePluginNodeSelector }} + nodePluginNodeSelector: + {{- range $key, $value := .Values.tridentNodePluginNodeSelector }} + {{ $key }}: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.tridentNodePluginTolerations }} + nodePluginTolerations: + {{- range $value := .Values.tridentNodePluginTolerations }} + - {{- range $k, $v := $value }} + {{ $k }}: "{{ $v }}" + {{- end}} + {{- end}} + {{- end }} + imagePullPolicy: {{ include "imagePullPolicy" $ }} + windows: {{ .Values.windows }} + cloudProvider: {{ .Values.cloudProvider }} + cloudIdentity: {{ .Values.cloudIdentity }} + enableACP: {{ .Values.enableACP }} + acpImage: {{ .Values.acpImage }} + httpsMetrics: {{ .Values.httpsMetrics }} + enableAutoBackendConfig: {{ or .Values.ontapConfigurator.enabled .Values.anfConfigurator.enabled }} + iscsiSelfHealingInterval: {{ .Values.iscsiSelfHealingInterval }} + iscsiSelfHealingWaitTime: {{ .Values.iscsiSelfHealingWaitTime }} + {{- if .Values.k8sAPIQPS }} + k8sAPIQPS: {{ .Values.k8sAPIQPS }} + {{- end }} + {{- if .Values.fsGroupPolicy }} + fsGroupPolicy: {{ .Values.fsGroupPolicy }} + {{- end }} + {{- if .Values.nodePrep }} + nodePrep: {{- range .Values.nodePrep }} + - {{.}} {{- end }} + {{- end }} + enableConcurrency: {{ .Values.enableConcurrency }} + {{- if .Values.skipCRDsToObliviate }} + skipCRDsToObliviate: {{- range .Values.skipCRDsToObliviate }} + - {{.}} {{- end }} + {{- end }} + {{ if or (include "trident.hasControllerResources" .) (include "trident.hasNodeLinuxResources" .) (include "trident.hasNodeWindowsResources" .) -}} + resources: + {{ if include "trident.hasControllerResources" . -}} + controller: {{ include "trident.resources.controller" .Values.resources.controller | indent 6 }} + {{- end }} + {{ if or (include "trident.hasNodeLinuxResources" .) (include "trident.hasNodeWindowsResources" .) -}} + node: + {{ if include "trident.hasNodeLinuxResources" . -}} + linux: {{ include "trident.resources.node.linux" .Values.resources.node.linux | indent 8 }} + {{- end }} + {{- if include "trident.hasNodeWindowsResources" . }} + windows: {{ include "trident.resources.node.windows" .Values.resources.node.windows | indent 8 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: {{ .Values.hostNetwork }} + {{- end }} diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/values.yaml b/packs/trident-operator-26.0.2/charts/trident-operator/values.yaml new file mode 100644 index 00000000..e30cee4b --- /dev/null +++ b/packs/trident-operator-26.0.2/charts/trident-operator/values.yaml @@ -0,0 +1,327 @@ +# Default values for standalone. +# This is a YAML-formatted file. + +# helmHookImage specifies the image used for Helm hook jobs +helmHookImage: "alpine/k8s:1.33.0" + +## Node labels for pod assignment +## ref: https://kubernetes.io/docs/user-guide/node-selection/ +nodeSelector: {} + +## Pod Annotations +podAnnotations: {} + +## Deployment Annotations +deploymentAnnotations: {} + +## Tolerations for pod assignment +## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +tolerations: [] + +## Affinity for pod assignment +## The following affinity configuration ensures that the Trident operator will only be scheduled on nodes with the specified architecture and OS, Hence, do not modify this section. To add custom affinity rules, please append your content to this configuration as needed +## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - arm64 + - amd64 + - key: kubernetes.io/os + operator: In + values: + - linux + + +# tridentControllerPluginNodeSelector additional nodeSelectors for the Pod running the Trident Controller CSI Plugin. +# tridentControllerPluginNodeSelector : {} + +# tridentControllerPluginTolerations overrides tolerations for the Pod running the Trident Controler CSI Plugin. +# tridentControllerPluginTolerations: [] + +# tridentNodePluginNodeSelector additional nodeSelectors for Pods running the Trident Node CSI Plugin. +# tridentNodePluginNodeSelector : {} + +# tridentNodePluginTolerations overrides tolerations for Pods running the Trident Node CSI Plugin. +# tridentNodePluginTolerations: [] + + + +# imageRegistry identifies the registry for the trident-operator, trident, and other images. Leave empty to accept the default. +imageRegistry: "" + +# imagePullPolicy sets the image pull policy for the trident-operator. +imagePullPolicy: IfNotPresent + +# imagePullSecrets sets the image pull secrets for the trident-operator, trident, and other images. +imagePullSecrets: [] + +# kubeletDir allows overriding the host location of kubelet's internal state. (default "/var/lib/kubelet"). +kubeletDir: "" + + +# operatorLogLevel allows the log level of the Trident operator to be set to one of these: +# trace, debug, info, warn, error, fatal. +# operatorLogLevel: "info" + +# operatorDebug allows the log level of the Trident operator to be set to debug +operatorDebug: true + +# operatorImage allows the complete override of the image for trident-operator. +operatorImage: "" + +# operatorImageTag allows overriding the tag of the trident-operator image. +operatorImageTag: "" + + +# tridentIPv6 allows enabling Trident to work in IPv6 clusters. +tridentIPv6: false + +# tridentK8sTimeout overrides the default 30-second timeout for most Kubernetes API operations (if non-zero, in seconds). +tridentK8sTimeout: 0 + +# tridentHttpRequestTimeout (duration) overrides the default 90-second timeout for the HTTP requests, with 0s being an +# infinite duration for the timeout. Negative values are not allowed. +tridentHttpRequestTimeout: "90s" + +# tridentSilenceAutosupport allows disabling Trident's periodic Autosupport reporting. +tridentSilenceAutosupport: false + +# tridentExcludeAutosupport allows removal of the autosupport container when installing Trident. +tridentExcludeAutosupport: false + +# tridentAutosupportImage allows the complete override of the image for Trident's Autosupport container. +tridentAutosupportImage: "" + +# tridentAutosupportImageTag allows overriding the tag of the image for Trident's Autosupport container. +tridentAutosupportImageTag: "26.02" + +# tridentAutosupportProxy allows Trident's autosupport container to phone home via an HTTP proxy. +tridentAutosupportProxy: "" + +# tridentAutosupportInsecure allows Trident's autosupport container to skip TLS verification +tridentAutosupportInsecure: false + +# tridentLogFormat sets the Trident logging format (text or json). +tridentLogFormat: "text" + +# tridentDisableAuditLog disables Trident's audit logger. +tridentDisableAuditLog: true + +# tridentLogLevel allows the log level of Trident to be set to one of these: trace, debug, info, warn, error, fatal. +#tridentLogLevel: "info" + +# tridentDebug allows the log level of Trident to be set to debug +tridentDebug: false + +# tridentLogWorkflows allows specific Trident workflows to be enabled for trace logging or log suppression. +tridentLogWorkflows: "" + +# tridentLogLayers allows specific Trident layers to be enabled for trace logging or log suppression. +tridentLogLayers: "" + +# tridentImage allows the complete override of the image for Trident. +tridentImage: "" + +# tridentImageTag allows overriding the tag of the image for Trident. +tridentImageTag: "" + +# (Deprecated) tridentEnableNodePrep attempts to automatically install required packages on nodes. +tridentEnableNodePrep: false + +# (Deprecated) tridentSkipK8sVersionCheck allows overriding the k8s version limit for Trident. +tridentSkipK8sVersionCheck: false + +# tridentProbePort allows overriding the default port used for k8s liveness/readiness probes. +tridentProbePort: "" + +# windows allows Trident to be installed on Windows worker node. +windows: false + +# enableForceDetach allows enabling the force detach feature. +enableForceDetach: false + +# cloudProvider indicates which cloud platform Trident is running on. +cloudProvider: "" + +# cloudIdentity indicates the identity that needs to be set on service account. +cloudIdentity: "" + +# enableACP allows enabling the Trident-ACP container to run. +enableACP: false + +# acpImage indicates the image the Trident-ACP container should pull. +acpImage: "" + +# httpsMetrics allows enabling the HTTPS metrics. +httpsMetrics: false + +# iscsiSelfHealingInterval is the interval at which the iSCSI self-healing job is invoked +iscsiSelfHealingInterval: "5m0s" + +# iscsiSelfHealingWaitTime is the wait time after which iSCSI self-healing attempts to fix stale sessions +iscsiSelfHealingWaitTime: "7m0s" + +# configuratorReconcileInterval is the resource refresh rate for the auto generated backends. +configuratorReconcileInterval: 30m0s + +# forceInstallRancherClusterRoles will install a Rancher specific ClusterRole and ClusterRoleBinding when set to true. +# When set to false, the ClusterRole and ClusterRoleBinding will be installed only when a Rancher cluster is detected. +forceInstallRancherClusterRoles: false + +# Auto generated ANF backend related fields consumed by the configurator controller. +anfConfigurator: + enabled: false + virtualNetwork: "" + subnet: "" + subscriptionID: "" + tenantID: "" + location: "" + clientCredentials: "" + capacityPools: [] + netappAccounts: [] + resourceGroups: [] + customerEncryptionKeys: {} + +# Auto generated ONTAP backend related fields consumed by the configurator controller. +ontapConfigurator: + enabled: false + svms: + - fsxnID: '' + svmName: '' + protocols: [] + authType: '' + +# enableConcurrency enables the concurrent core feature in Trident **TECH PREVIEW** +enableConcurrency: false + +# Resource requests and limits for Trident components (controller, node, operator). +# Configure CPU and memory for each container and sidecar to manage resource allocation in Kubernetes. +# +# IMPORTANT NOTES: +# - DO NOT change the names of any containers or fields - or, they may not work +# - DO NOT change the indentation - YAML indentation is critical for proper parsing +# - Default values for controller/node are shown in comments (e.g., # 10m) and are applied automatically if not specified +# - Default values for operator are directly specified in the config (not in comments) and will be applied +# - By default, NO limits are applied - only requests have default values +# - Container names are listed as they appear in the pod specifications +# +# STRUCTURE EXPLANATION: +# +# 1. CONTROLLER POD: +# The controller pod runs on a single operating system (Linux), so there are no OS-specific +# sub-sections. All containers within the controller pod are listed directly under 'controller'. +# +# 2. NODE POD: +# The node pod runs on multiple operating systems (Linux and Windows), so it has OS-specific +# sub-sections: 'linux' and 'windows'. Each OS section lists its specific containers. +# +# 3. OPERATOR POD: +# Unlike controller and node pods, the operator has actual default values directly specified +# (not in comments). If removed, no values will be applied. +resources: + controller: + trident-main: + requests: + cpu: # 10m + memory: # 80Mi + limits: + cpu: + memory: + # sidecars + csi-provisioner: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-attacher: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-resizer: + requests: + cpu: # 3m + memory: # 20Mi + limits: + cpu: + memory: + csi-snapshotter: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + trident-autosupport: + requests: + cpu: # 1m + memory: # 30Mi + limits: + cpu: + memory: + node: + linux: + trident-main: + requests: + cpu: # 10m + memory: # 60Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 1m + memory: # 10Mi + limits: + cpu: + memory: + windows: + trident-main: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + liveness-probe: + requests: + cpu: # 2m + memory: # 40Mi + limits: + cpu: + memory: + operator: + requests: + cpu: 10m + memory: 40Mi + limits: + cpu: + memory: + +# k8sAPIQPS sets the maximum QPS to the Kubernetes API server from the Trident operator. (default 100) +k8sAPIQPS: 0 + +# hostNetwork sets the hostNetwork field in the Trident operator deployment spec. +hostNetwork: false + +# nodePrep enables Trident to prepare the nodes of the Kubernetes cluster to manage volumes using the +# specified data storage protocol. Currently, iSCSI is the only value supported. +nodePrep: [] diff --git a/packs/trident-operator-26.0.2/logo.png b/packs/trident-operator-26.0.2/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..6a7f76663a04adbeb8ac133449f97dc67ed0c215 GIT binary patch literal 4314 zcmd6r`8Qj8_s0`KRjZBp;-)3R3n#&i1C;IrWY zwquj;f&$VD0LO~E#)>aT0eA(cC<0CF=3QTVwY+6QMh+FOv{@8!GqN!$; zCy3JbGVY|+NA4|qu$@&W*M^z@Bzswv9)7F&&6!mB((g!o&LWn0vzq?MOc~-zd1B4dBW zk)u*v!MAEVz1n%?pyww&i{b~a9-n*9hf1qrF{Im8WGDI<)?4}bzMQq6K(UydhcTa| zT^%^6wqugjNvVE$&ZBdE)i#%Ba-!Wg+ziGlWm}L|)V0y~{I_!RgQTQfepX+wp3=YP zLEZ_TS0|wHley1`QuW#r&a*}_{S0y$AL`*6aHGO5H~99a(A=As;2Wr#0=49(umhFJ zJo4(kqt1vy&YXYI_(-^5#g`8PMF73+LT*1pXDeMM5XWyBA>a8eU!s}eh??4pXpM~ zNaH3=Qzs6(x-O9azP0Km{(B7(PDD~&na=|u&&}Tnx91%V?Z8zf-Q*g{1>@AA0<~Di zQ2vfSqeJQI6ZGTBAD_sJqvQzr2n#-o4Xt@h1;Sq}Mg*#ESKgHQ@wsfA+brspt&b_Z zveix^grXmKJnfO~`$>5ex-6XnPDxK|ZTjAcFMia&S zCMLuqudVZWds_*#0cMB@jlSfe%dRWHX{ALSBgMc{&Hi4`4$-a(Nsw?bMQF+~M?5Bz zi)lh4uoQd)Y^|O7b^EIT(pQaW0Lin}!^?IEwC#e$n229Uacy}d&OPT`7m|+7A*?6% z9dAZV2I4mK8mla-{QEpJ8l9AX{)4f?DnY^Bk~Y*OtbKa8vjjtu@6c_+xvb&%utl8) zySiEJfTyA(VcmKg$|jsOwK>HbgkP9a8~-#GZfK1X^GFjV8IBrBa<6?ZExVVo{dr`F z8GCv2d__Pk<@|NpJod{zFBjqXIkn47$Y>;Q?aaOw*>hz#{u2P|4h1q7io8={ zu(EZP&y3S*2&GE7O}TQ_^6mz(tMV&H$*KcB0MT&Imtt)R<%WBec8VpXmp0F4VX*$eS z^)uH0_*5Lmi+rO~v%Cf0ee=qj8@s~1FC3Hj&!u7fWi!HdwW#tzEJCTS;%X(IbTzyYnumGEp)(imq^y@YBbMG zSHPNs#}1-u2I&o}3d3&K8!+#kqOFQD<6GGutrWZ9p@Ytg+WB(gUiJx8-wS$lZ;9wP z44&hkRgx%Yl!I!DX`3_kcQ%LjgX^mnKVQXQ*V@CIqh>26-z}?3iGtaDx+%&omI=aVnqqD|%dm=d z-HKreT8Q(X|w!%GNsr*3zqBFV$KTh<*XAB zGE&m(fTwT9=;i4#$U=v$_Uy2`jrC=Orw-`m(XAa1bherD?F-yM=tkcQk{09#RueV! z6{US%!-7X7!f*S(lF<{q_B!y+5cj`kdYt7Lxa$=WVT3VzQO6+nBK=E&E@NhTy;Q@Z z%m>M*IVR4OsY3@%7q!LYEH;!Dblrj>yK0vhdi_sdWII&xy5S2d3R!Hr`I6Iz89Hiy z#yzH-)KI-|k;-)`)gd-T0x4JXAn6`v+5l(zNn~qy6;S30hF)BI$A~XO4d^yh|9JSz z5XpXE@ah&W?j^ly@-JB|&goCuvd>)YM@X)66Xo>OVs>Y_#+-}6JXTa1BU zM^^T~roEC@DxCW4Sz*%)xgY|qq54i;gL@8z84g07&8)p$Zo9oe(@onlRXQ(}6+!?9 zt&5P5!_n8IviLZ!GMVThr+9&?$!r@goK~619ZevW-#gO@= zMb|NGhtOp5*v5&P*!H9Oz9iHNbm&Pm=#n0x%;P?-t9lDn?2$F9!eR`%V%v_k%G1gD zh%(0M4eeoV#k&a|`nj>fDUvBAX38mH#s)rjBP;jzAANhy;jH$tK?RFLB~4SjI5h%(8dp!5xfd)0mRQlrIb**T= zI?I4tZFMRRZY8LbJWLBMtU6}-2rgUOM5IUeUR1~wbL*o)U*c#0q`Eye%hDcSPt!Bkn?{P1B2RaM;#WNRq(>?Sa$7}v&{*WS8PzZ2# z=HLVOw280KD#BYH1kOSLgpDyvMNSlz04Qo8_J}XAhw1Y}`A79l837PSm;8>$Dz|u) zX`w?;52iR{a4Di&2ofYJS_}B~SFNt&L38L#I>1&qBhsajE3oYCjC>&%{VK!tulSfR zfZXRf%aw#|WkjI05_q--hG+9O)P?sl8RPazY#c0C9?uN@z~dIMi`w@<^KtGECd+UqioDNGq ztq1}8UX!%lTLp$wd=u^Qtv#o`%to3CR8&+!SdlA0vH*hIZD%``<9S~IIQlASBe;Ye z6=|dqJvNlrt0SgT-WnKu|ED>0>P>n2K^p1MNt&hudq_Iu;9-4d*2ctX|;%oAIic zgR(Ta-HGK`R&JIW10eGV@$buF`Y!*F7UkqYz!4CReTG$)t<&`eO^z<{v-~KfyA|&O zkF_zBx)kKDL>DyG`1^;b3oQa#b7A`PL0=a|OV+vlM$ zu*OnKA{3gzmBAkPN5RjFFZF06?1EyVie+A$Yh2s(vZ~$r*RHo30*Z|cSb+rqcBufH zB)O}l)^>*j7Z1z>i@n1(GrjoNBc&uuC{zqkb<9c6uRlln;W89f&(9+6Q>PknhC7#E zK6tDIYzT#3Lpi3K^ei@x|51#YbTul)8W?;5ZodX}Vz$?@!@eS{Vxpgcz-L9dkM1;R z1ZR^!O|E|KfI``TZh8yog=-GcWC8r5L-b{RR(Mk7ko{3MupV zpY=MB({DOlY({gD(L7=&i$?xX#H1I_F&@16^Q0i^1WLSwBsxH1#3p#Y8Xm z09^~CFc9`?aGx>8=>`UG+z0GafslLd9|ILUFo^_o6c TM>kIXxd53OTfr+0|9tQtU!4)S literal 0 HcmV?d00001 diff --git a/packs/trident-operator-26.0.2/pack.json b/packs/trident-operator-26.0.2/pack.json new file mode 100644 index 00000000..556e0321 --- /dev/null +++ b/packs/trident-operator-26.0.2/pack.json @@ -0,0 +1,16 @@ +{ + "annotations": { + "source": "community", + "contributor": "netapp" + }, + "cloudTypes": [ + "all" + ], + "displayName": "Trident", + "charts": [ + "charts/trident-operator-100.2602.0.tgz" + ], + "layer": "csi", + "name": "csi-trident", + "version": "26.0.2" +} \ No newline at end of file diff --git a/packs/trident-operator-26.0.2/values.yaml b/packs/trident-operator-26.0.2/values.yaml new file mode 100644 index 00000000..be45f274 --- /dev/null +++ b/packs/trident-operator-26.0.2/values.yaml @@ -0,0 +1,346 @@ +pack: + namespace: trident + content: + images: + - image: docker.io/netapp/trident-operator:26.0.2 + - image: docker.io/netapp/trident-autosupport:26.0.2 + - image: docker.io/netapp/trident:26.0.2 + + charts: + - repo: https://github.com/NetApp/trident/releases/download/v26.0.2/trident-installer-26.0.2.tar.gz + name: trident-operator + version: 26.0.2 + + # Add Pod Security Standard label to trident namespace. + namespaceLabels: + "trident": "pod-security.kubernetes.io/enforce=privileged" + +charts: + trident-operator: + # Default values for standalone. + # This is a YAML-formatted file. + + # helmHookImage specifies the image used for Helm hook jobs + helmHookImage: "alpine/k8s:1.33.0" + + ## Node labels for pod assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + nodeSelector: {} + + ## Pod Annotations + podAnnotations: {} + + ## Deployment Annotations + deploymentAnnotations: {} + + ## Tolerations for pod assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + tolerations: [] + + ## Affinity for pod assignment + ## The following affinity configuration ensures that the Trident operator will only be scheduled on nodes with the specified architecture and OS, Hence, do not modify this section. To add custom affinity rules, please append your content to this configuration as needed + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - arm64 + - amd64 + - key: kubernetes.io/os + operator: In + values: + - linux + + + # tridentControllerPluginNodeSelector additional nodeSelectors for the Pod running the Trident Controller CSI Plugin. + # tridentControllerPluginNodeSelector : {} + + # tridentControllerPluginTolerations overrides tolerations for the Pod running the Trident Controler CSI Plugin. + # tridentControllerPluginTolerations: [] + + # tridentNodePluginNodeSelector additional nodeSelectors for Pods running the Trident Node CSI Plugin. + # tridentNodePluginNodeSelector : {} + + # tridentNodePluginTolerations overrides tolerations for Pods running the Trident Node CSI Plugin. + # tridentNodePluginTolerations: [] + + + + # imageRegistry identifies the registry for the trident-operator, trident, and other images. Leave empty to accept the default. + imageRegistry: "" + + # imagePullPolicy sets the image pull policy for the trident-operator. + imagePullPolicy: IfNotPresent + + # imagePullSecrets sets the image pull secrets for the trident-operator, trident, and other images. + imagePullSecrets: [] + + # kubeletDir allows overriding the host location of kubelet's internal state. (default "/var/lib/kubelet"). + kubeletDir: "" + + + # operatorLogLevel allows the log level of the Trident operator to be set to one of these: + # trace, debug, info, warn, error, fatal. + # operatorLogLevel: "info" + + # operatorDebug allows the log level of the Trident operator to be set to debug + operatorDebug: true + + # operatorImage allows the complete override of the image for trident-operator. + operatorImage: "" + + # operatorImageTag allows overriding the tag of the trident-operator image. + operatorImageTag: "" + + + # tridentIPv6 allows enabling Trident to work in IPv6 clusters. + tridentIPv6: false + + # tridentK8sTimeout overrides the default 30-second timeout for most Kubernetes API operations (if non-zero, in seconds). + tridentK8sTimeout: 0 + + # tridentHttpRequestTimeout (duration) overrides the default 90-second timeout for the HTTP requests, with 0s being an + # infinite duration for the timeout. Negative values are not allowed. + tridentHttpRequestTimeout: "90s" + + # tridentSilenceAutosupport allows disabling Trident's periodic Autosupport reporting. + tridentSilenceAutosupport: false + + # tridentExcludeAutosupport allows removal of the autosupport container when installing Trident. + tridentExcludeAutosupport: false + + # tridentAutosupportImage allows the complete override of the image for Trident's Autosupport container. + tridentAutosupportImage: "" + + # tridentAutosupportImageTag allows overriding the tag of the image for Trident's Autosupport container. + tridentAutosupportImageTag: "26.02" + + # tridentAutosupportProxy allows Trident's autosupport container to phone home via an HTTP proxy. + tridentAutosupportProxy: "" + + # tridentAutosupportInsecure allows Trident's autosupport container to skip TLS verification + tridentAutosupportInsecure: false + + # tridentLogFormat sets the Trident logging format (text or json). + tridentLogFormat: "text" + + # tridentDisableAuditLog disables Trident's audit logger. + tridentDisableAuditLog: true + + # tridentLogLevel allows the log level of Trident to be set to one of these: trace, debug, info, warn, error, fatal. + #tridentLogLevel: "info" + + # tridentDebug allows the log level of Trident to be set to debug + tridentDebug: false + + # tridentLogWorkflows allows specific Trident workflows to be enabled for trace logging or log suppression. + tridentLogWorkflows: "" + + # tridentLogLayers allows specific Trident layers to be enabled for trace logging or log suppression. + tridentLogLayers: "" + + # tridentImage allows the complete override of the image for Trident. + tridentImage: "" + + # tridentImageTag allows overriding the tag of the image for Trident. + tridentImageTag: "" + + # (Deprecated) tridentEnableNodePrep attempts to automatically install required packages on nodes. + tridentEnableNodePrep: false + + # (Deprecated) tridentSkipK8sVersionCheck allows overriding the k8s version limit for Trident. + tridentSkipK8sVersionCheck: false + + # tridentProbePort allows overriding the default port used for k8s liveness/readiness probes. + tridentProbePort: "" + + # windows allows Trident to be installed on Windows worker node. + windows: false + + # enableForceDetach allows enabling the force detach feature. + enableForceDetach: false + + # cloudProvider indicates which cloud platform Trident is running on. + cloudProvider: "" + + # cloudIdentity indicates the identity that needs to be set on service account. + cloudIdentity: "" + + # enableACP allows enabling the Trident-ACP container to run. + enableACP: false + + # acpImage indicates the image the Trident-ACP container should pull. + acpImage: "" + + # httpsMetrics allows enabling the HTTPS metrics. + httpsMetrics: false + + # iscsiSelfHealingInterval is the interval at which the iSCSI self-healing job is invoked + iscsiSelfHealingInterval: "5m0s" + + # iscsiSelfHealingWaitTime is the wait time after which iSCSI self-healing attempts to fix stale sessions + iscsiSelfHealingWaitTime: "7m0s" + + # configuratorReconcileInterval is the resource refresh rate for the auto generated backends. + configuratorReconcileInterval: 30m0s + + # forceInstallRancherClusterRoles will install a Rancher specific ClusterRole and ClusterRoleBinding when set to true. + # When set to false, the ClusterRole and ClusterRoleBinding will be installed only when a Rancher cluster is detected. + forceInstallRancherClusterRoles: false + + # Auto generated ANF backend related fields consumed by the configurator controller. + anfConfigurator: + enabled: false + virtualNetwork: "" + subnet: "" + subscriptionID: "" + tenantID: "" + location: "" + clientCredentials: "" + capacityPools: [] + netappAccounts: [] + resourceGroups: [] + customerEncryptionKeys: {} + + # Auto generated ONTAP backend related fields consumed by the configurator controller. + ontapConfigurator: + enabled: false + svms: + - fsxnID: '' + svmName: '' + protocols: [] + authType: '' + + # enableConcurrency enables the concurrent core feature in Trident **TECH PREVIEW** + enableConcurrency: false + + # Resource requests and limits for Trident components (controller, node, operator). + # Configure CPU and memory for each container and sidecar to manage resource allocation in Kubernetes. + # + # IMPORTANT NOTES: + # - DO NOT change the names of any containers or fields - or, they may not work + # - DO NOT change the indentation - YAML indentation is critical for proper parsing + # - Default values for controller/node are shown in comments (e.g., # 10m) and are applied automatically if not specified + # - Default values for operator are directly specified in the config (not in comments) and will be applied + # - By default, NO limits are applied - only requests have default values + # - Container names are listed as they appear in the pod specifications + # + # STRUCTURE EXPLANATION: + # + # 1. CONTROLLER POD: + # The controller pod runs on a single operating system (Linux), so there are no OS-specific + # sub-sections. All containers within the controller pod are listed directly under 'controller'. + # + # 2. NODE POD: + # The node pod runs on multiple operating systems (Linux and Windows), so it has OS-specific + # sub-sections: 'linux' and 'windows'. Each OS section lists its specific containers. + # + # 3. OPERATOR POD: + # Unlike controller and node pods, the operator has actual default values directly specified + # (not in comments). If removed, no values will be applied. + resources: + controller: + trident-main: + requests: + cpu: # 10m + memory: # 80Mi + limits: + cpu: + memory: + # sidecars + csi-provisioner: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-attacher: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-resizer: + requests: + cpu: # 3m + memory: # 20Mi + limits: + cpu: + memory: + csi-snapshotter: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + trident-autosupport: + requests: + cpu: # 1m + memory: # 30Mi + limits: + cpu: + memory: + node: + linux: + trident-main: + requests: + cpu: # 10m + memory: # 60Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 1m + memory: # 10Mi + limits: + cpu: + memory: + windows: + trident-main: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + liveness-probe: + requests: + cpu: # 2m + memory: # 40Mi + limits: + cpu: + memory: + operator: + requests: + cpu: 10m + memory: 40Mi + limits: + cpu: + memory: + + # k8sAPIQPS sets the maximum QPS to the Kubernetes API server from the Trident operator. (default 100) + k8sAPIQPS: 0 + + # hostNetwork sets the hostNetwork field in the Trident operator deployment spec. + hostNetwork: false + + # nodePrep enables Trident to prepare the nodes of the Kubernetes cluster to manage volumes using the + # specified data storage protocol. Currently, iSCSI is the only value supported. + nodePrep: [] diff --git a/packs/trident-operator-addon-26.0.2/README.md b/packs/trident-operator-addon-26.0.2/README.md new file mode 100644 index 00000000..0f246c1a --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/README.md @@ -0,0 +1,24 @@ +NetApp Trident + +[![Support](https://img.shields.io/badge/support-official-0067C5.svg)](http://mysupport.netapp.com/info/web/ECMLP2619434.html) +[![Chat](https://img.shields.io/badge/chat-slack-4C9689.svg)](http://netapp.io/slack/) +[![GitHub last commit](https://img.shields.io/github/last-commit/netapp/trident.svg)](https://github.com/NetApp/trident/commits) +[![license](https://img.shields.io/github/license/netapp/trident.svg)](LICENSE) +[![Docs](https://img.shields.io/badge/docs-official-0067C5.svg)](https://docs.netapp.com/us-en/trident/index.html) +[![Go Report Card](https://goreportcard.com/badge/github.com/netapp/trident)](https://goreportcard.com/report/github.com/netapp/trident) + +Trident is a fully supported open source project maintained by [NetApp](https://www.netapp.com). It has been designed +from the ground up to help you meet your containerized applications' persistence demands using industry-standard +interfaces, such as the [Container Storage Interface (CSI)](https://kubernetes-csi.github.io/docs/introduction.html). + +Trident deploys in Kubernetes clusters as pods and provides dynamic storage orchestration services for your Kubernetes workloads. It enables your containerized applications to quickly and easily consume persistent storage from NetApp’s broad portfolio that +includes [ONTAP](https://www.netapp.com/data-management/ontap-data-management-software) (AFF/FAS/Select/Cloud), [Element](https://www.netapp.com/data-management/element-software) (HCI/SolidFire), as well as the [Azure NetApp Files](https://www.netapp.com/azure/azure-netapp-files/) +service, [Google Cloud NetApp Volumes](https://www.netapp.com/google-cloud/netapp-volumes/), and [Amazon FSx for ONTAP](https://www.netapp.com/aws/fsx-ontap/). + +Trident features also address data protection, disaster recovery, portability, and migration use cases for +Kubernetes workloads leveraging NetApp's industry-leading data management technology for snapshots, backups, +replication, and cloning. + +Detailed documentation for Trident can be found [here](https://docs.netapp.com/us-en/trident/index.html). + +See [NetApp's Support site](https://mysupport.netapp.com/site/info/version-support) for details on Trident's support policy under the [Trident's Release and Support Lifecycle](https://mysupport.netapp.com/site/info/trident-support) tab. diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz b/packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5aad9ff63eff782cf97a889adbabff8435dbf2a6 GIT binary patch literal 11642 zcmV-=Errq_iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ%avZmkAbft;Q{=QfLD3(px_J?$)AM;EI3#t%wM_MpJocVd zI8LCe(A_Yr3S|J*WLwt8zQ(@ZKFJ1dRj6w>FQVmH)(?pdB#?TWyRSyOhr4^PMt>RY9vr;h z{|k&Bje?#p=K`_6j2?`u-nc)>hcfabW}MJ;49h(aWm)la?=Tqc1tTxQJY*yjD)9*3 z;W&X%N(sy;g9v9aU6FJS=U5zN*%pT@EmLrOc?MiihUOSDMwdj^iy7pcq;n5IEN}t) z!N_0WEog$run;2S@1N z8^&}_ZCa3}bMG3jZYYcR*z-+GJl|61`C!L~=gVe!*ZC9|jN1D5?_f9BI|xSpXv<5H zq`y9{Jh95~7*LkQBt(*z-qM!e9gTv$L&fVS@Bha5U!pk2{81G^|M=fKc(uP~kFBP!7YPCx2h6pOlT^(`SWoLL)dzQ!3P0Ti$!&$M zXeZirZ@l2&9Q zKrCDkfkTlq3@DA@!{rXV!)b_jAfk{`0SS%BYz0D!CD)x8z!e1)MG)p((4?f8^oC}spV7#d%^kk5RH+_9sUW^h@$4UC z4-{{XoZkQp|C$qqqm!JGbbhHBNz(b*Jf%hQ=`9X(HA$;7x*jXnSC}Q-W&rq*AQ3K3 zZ!?BDSCUcW>HKTF8bh_MvTG_(Q1tW|&eB?zRwv_Hst<@IhX>8nB&wyhl0f;x35ZFW z-+EGQnYr(nrh?Hp#%vPjbCRAre3L>&BvVmb;in$BQgo%FV0oI#f#ME=vQ}jW>8gVb zu^Ls;1?wshy2MOEaS%1NvH^9Q5_i>5Ar?}SeOIekneP1#YpkBS9mx=J1ZyvJyX0VkPQNwtMS zsdZF6k)Fc?uY!IIgF!*lB#+|>jY+ryj)glnXL%e$rn9;TGc}i$jNxo{PQ`>_F6Rsv z%Owt(#L$L@o4orlz^h}hq9}DljKv9IfaIK2bh+);1?2)_s_kx|Gh1Sd14#vDQcSr( z0tfKYuo4EtC1S&vOos+|upM|MCe2&#MWKP-)A@V6#IYqo;*IGXVwFf|?K7mHYHGx4 z9-=8WfE4%{G??f_;?GHZqeih~v^#xRiJ1DC=RSJ;ijoJOQ+f3SI%(`CDZ#J{$ZC?VcmT}_mkg1O*3+OQjOm||r=rcynm%A&zwk(4?> z*A>7yo+Ck)*e*p7!^+@OJ%OX5NlntnF!<|;51i&*l2{szN4cOp&oat{?a+wuYL9Ml z$S@-`A|bf&49ovWIxi46D{c1k>1`P2Q5#~06S_pjU_%asG)56gF@u{0PJyIcpxC9c zAfZ`(lLRO8KEttO%TXJN1u1njcAR!(Z!}^bPK6%M%6HX4&4kh0l_jM_)7~F~Lbi~K zc|j8lOM(EUTG}&NO&b}i{vKwe9EWOkvoQtynq+YG{t}j$k(u=$bywXKiT8B=R;}C1 zS=s8dn9k?2C-k}=UJ86GfHL@n)3j70MFnFRNC>xaCu&6DqdX!K&WtczZCXS$DyQpe z<;uyV#MwWkIx4wq7TtIXt>JVhP)ly_{Mky2o-*C?tzGjIW!E!Rt*PCthr^=Qn*u`D zuVy9VQc+DTx{)$Pmy`&zwsZTiz*Lh@*=)4Jteb*ZXFm+R#!mhCPK4ch0ME)gp>C|a`QMYCL4M`(scvQ!lVXJm5{bV5JfWb_0HSkPv zrx99!-%=Lh6D&};XqbCKxxiQ`TcQAF7>S(Wz-yFs>J4L>M-xVuB$5l4G?L01bGTWM zaG`S{i;vRO+xCP>E-1IVo07#Y%i_vhu{G7)RVuLsS}tY)L{aSBx~5 z9bKu-qR{O+I-a!h!Vv4r{L19S^3?L==y>Ar0)?3#+BIrbT6dLvLGw6L%f-O6byyme z7w!iv7zueRnR05rghWFGo(u1gMtI1{C5~tBFj9^*xeAoF88I~4-$m9~M+?U@ zf1%64FLWx)kaS6}apZN?JBGol#2Bb`n4b_)W~{}1gNRTzF`$`H7NNx7g4Q+IxH!>kd}Q&Vq9ki!<^=FATT^*m@j}KfeY(hsyLYAR4z$y z1XC1V<22%d*IV}(_D9KxOB&Q5JJVzM0;S;svtzxax}dRg6320&IuRIUwKu+lgv<~AK=C?sMvp)}Us z9Do!Hlx0U+Q`tl-f`4N)&upUh^<#FLhHRzC`5v$AE=!$%AI`6iCJ*MIR8rYm9`dF2 zwfivRw~9+!TgDO1m&v)>AudufMg;mV{~gUO`J zbpyk8ssfT0bIiBjUY#DlgUQ9|k7uVpefzD~sL_$Vi*m&46}=h?%3$EG#h@%Tn&MP& zcvyd8*8K1hPM4Y@KxJ9QcY0oWRTXB+YNPcYsq# z4#UR31s^VbOO~#l=TqNoZ1Mn(;@FkX8zL4Z^IZ}g1{58Zr_v7HDj~P@AlVDx{KLs< ztxZbC+}0#{EJ)VU8g81S`q|jrx@knf0`dMvjbTge!fmPITgE)!3gA@gfe)8$$#=aY--=<-AuDv^L4t2pSR} zz}ZZ@_;4f@psk@c2m;TlF*QY$1nLRHdaM&fihW!=63VU2Fw4h!xED!Unab2RqaTP# z)}yOhu3p0Yeqj}^-eC&NG<9b6>u?V~uaQ%iKP0s#va#=d{6Ld?GJOP=gBAal1^N?e<#0+MPCartE&KCIYXteDW zNX+)(f^uP2hb3A!QCZK{=4$LHmyvO5N)0@xsIvk|tvA&!a~zjn#&9NW9bqgMZr!*} zOYQ2rTsjBml{_nMg|4TgXqTTxk%^5JPV>Ag@ z>$wQFBmoyX)smnW49ekZeQzW+daeP_GZgAVsr?mr6OARM0vCa+3`3H0A+2;ZuxVt-Y5Ld40faOI3$jbWh-USF~^?VON70j#=guD}o)>4~oAjy-}Wg30~HL1W5XY zBGDH2tXE5|{G$kvj_y>eH4SqdBhCW=&pW+ENfv9J>6UW=*HBK&bf<;2RZ~t|Gf~4lUwT!pyPS$7%)oqlf4h z{d)BOKNmR8e{r`G&`1)D@KgIXy)9_nZl4Pv*LS`h!VwK_V zq&}2u@G*Ql{QTLIP~PcnrWBxYo?5F*9R&+K1Lteyfni_|S4r3b_+_rLE#0Xl_)(uZ zl8_(lmjCY{Se}M(xUc>s$z?v9ky{w}12A<--Szpir>Q$;7zqrhz%a|>cm==aC^jbx zvP{t(ct2rXw}KZEgKPtbDGpK2F>tAB9EGl0Yn;N`$(9hIRkJ!e@X~A>oSa`uSfzI} z9Bv1matWCkM^<8-SKOSRQ)xsLJ|eYEjyNDiyrH&}u@a`rTrw+oX)_Cc8j#NXP52%2 zqMmOQ?c?t@@6eLQf(yEmhQd{JRub<>T*gQ$W-$0y?*A(v)auemHy5w=KPy7#^rjpk zHo^jN-J^C_NkOSoOg+7-pvo?-H^t?${@a9U!0*6t7E6<7@c#{9@Xx{BhY(E?nwoP~ z-4yD4O`@DU1HKq4s>gErB&iBeY&0m)D4Y4*1oOW))dr5Fm?j<-r&47e%Cew(ETlL| zS(*z@k>BChT$+1p`m#7wu&(`eg8f#S^fA!32J0~!v^T}to#R$hq(O9JeXZirI%zLM ztYZ`BR!W*3w2grFjqvJ7xAk}xTsKl3W494T6-TlGMg`ZZBdam%9TZhEm6CC4sGjzy z)lknI)=3-7E^b42h34>kU9(mPL0#nypD{(is;3qk401l zDE_qtqd9*u_=VGS&@o0!ur|S0=Pou?pT&ub9!aR4zv$C3^&=inHw~!$JLp&cnT;1; z(+g$HdT%e3U@heDzJ7IZxGC{#w0yT|S~(igPUYh(@fL;oMa9o;f5$jC~V-R&0WJlmRNQB`I&=$QV}c0bNe^+raMQ7KPzP?U$7P3}R1t7F#lb zSNMG7Z0zgsXXOw{BeO)X@!ZO9ubMbj=h9V(nRQXE2@Dq$wxpKXYVoFMhE)rzQe{_v zL%5CA9)G8Ip36KFPJ7N}Udygh6Y#_I7YQ3vdYxx5SndvBP{0r5fN(0c#fRU5KCVM% zu(hVWTcGYc5%BG>)#0~>TWYrhpw{y5R6Kl9pCg+tX)4aYkeF6E!M7?@kJiPdN^F%~ ziX@rCR21zu*Lbx9-{@`i@po0=Ai)AfNT9$KU8hlG1`EU|Eu_hMEo2`9Y_4HKRyZyHM#E@n>XDE^rLIAhbGC|tw2iva0rK0l&O5co1G7BUp_%GL4^~m5Y+V$1 zEoxh89qR{RGy&%(vF<6b*!v91P{^|3b-_@hv1nR>`rP=UZBHAXQKkw7mi{2j@>+_C zL05^oWhIdLZ9ug5vWD~X=keWv-h&l3AAv40wgHL;}6 zGW#sEUyICk7$Tvyu?h*+;YjMJM!YhD9_hmvzvNt)%dxm%xw=8H#|^eXyu9Vi9(Xf@ z!q`^}#EXpT8lf;bt@T|J=vQsh27qJd6tL}9uo{M&6)(^|>R@#1Z(~W#c6ROOYRlY| z>hI<+DS{O&{^!pUjSK1i-PO70G{WkL(o^=WI$%_7dncT>92(r)ObR+GcnUe#P!if? z;cJr*b8zjel@NRF#RFudt%_$UX_J!X98{TtinxR7Tx6!84dM`7aw>vWSX>qIzewMx z3zn+<+K3CAdIa24l^d{xmHe>Qre(%`?90!ey-f|iM>F@H%-Gw+)O!>|?}28X|6e^~ z`oGrK6aQ__F)$iq-)u+R?^%F#?|&TZ*W$nTb`N%UpX0xu;xo#i2vY3XI0@?eyzbi} zY>L7FgPXRKcD}5n(vXuu-cX;G`%7T<^m{GVtggF+)-!b9$s6UgeN z31dW(O{vg7ZjdM*WbjR3K=CueF?N1x^;TjxMIYE4P4rM7uUo1rx)5RJ%nkzk<0 z7;(OFul-T{!b_aCPdE1?@^Pp#ckqAZyt7Ha=2W1so!E>p8a-%i z7A<~&qR<*jUnP`0a2R&bPd~`dr zg+~1l)mPEwmX@zVm(A7h`!uIgvb8aN=G-IU?UB9Bb?jr&^6-9rimtlLP-vwiuc9T*b!kU444^rd z%TWsG(ZVqj52jUvqZfh*(M+zm1+7lyzb~tKsqY3tuFOLS7t{AEwfT*Zf}Du6vI+t zy4qBS>ZnroKEnx)NW1jZ^Ea!e@FH#s*HNu=Zxn|YaA9B0P?u24%)SDqPPd$(X2k2# zTio6bWNw_TS4Ua6z+5Q5RD%GS+gqTQ013Jlzk3sT6Ti&uEzwVa1YJu3$_1S>dZUig zkQQO9<#$Q00W`Zd$mEED>nyr$>$rg&n#yh}MNeW{P_JFRhhjfG&8d<&NHzQ|HkB7_r~a_l6j z*BfVf%pb|I^(b_%BWg1dTqhz;k>R9YjPBmJD#QQ4W^m$&^?irKeLQFQ7MHr-yr;wK z3FdvByGdZb%-x%;FVabEopK)s^jdB`7P*h1J@3td>Q)-furyX@!Y&*nNavPY7w^K6{#A{0aZr;p< zgW5!SHx1G=b~l-zd4|KWx;-F^Nr?Cuc0B;Kse|YC4K?*R>jf^>UiMaKovj|=c<+$B z3DLb;&5lb`zoT>;r${pzHM&Dl(BCDsVntuPfws$$OxM>r6Rkza|lt%EJ89}NI8jZ zNZm3U;pCNh{=834%7;LmMKVnilt!gQ`p~!oyDnywm7P<4AlqC)9hFyR*PnkbARICC z!FTsyeP-W2_wB3l-#Pam_P@a1awfWY=R@Zm>JCNvdiI{WaJqE4rbp=H!^uC-kA65U zGC*JI^_J0O>?DGI9mCjCjr0i;i*cc{)cyAjRQ3(mR(y}AE9xL!y26rm^gsT7ar)2W zi_??S^Q*I?_y2r*_P&L@Ar|4VyvTp3Rn0HF*iHu%?)HOz)!eDUVp2u?km0Dp!bBF( z46GsP>rHhzW$Wt$jeGIGX_PB3wbXND_l1|X*k=0tWj8I=v+>QV49ds09IOo|S%Iq) z58DJusi}5Hy(938$es!Fs_wJ5ipPR-Eg4SpvtCKDX3L3s)tIu?2X^f4(|=W-iRbSr zzMl18M!C?w_K-z7xgh4*HYRakAkBK6b2J~t$VaZo|h%=d3FnJ>g(3qWN80^3xCS3im36g)Q9lOEL59W8bL$ZtQ#;yIR+<$Wq?w20VPJicP zjjD}&o_%7vf$y`~kyF{lWvBf&I$hICl0h5miJEJu_M(=)AtLgpt7;{N#qRT9?G^Mq z$+fm@|I1{iSnUzDLF46Jzf38M4jxr(U)^17cht`rBC!-<;~}ZKsa(HF+tR*Yo}puv z-y)BJexBV;d`zD z*4Y31dx!P=pZ50lpWpv|lJAk7pnZ#l&320KvO!bbb6LOpkWprxZ*~@02$2~Lk})c1 zNaHbF9Zzf;l{502(P(5H-iXbynAqe!W$U!IdP1X~7OUCIj4s~{ue(`2o6Y?O#g6`E z5Z!&Mhqk%CL*@2vkhq&88|;l7K>a0-4Yot>xD|2-T#Y@DJMDk;A(9P0uGu-Nb1;G28U*w(N}9=~cw;PC;#}zz3f@KX&(C2cuvV?2er=p>|#tIJ|a#H=Mw- zYC#fAbK#^7Uhj=Y19$=7W1Oj1gaqvFK|)dvh{MtMmr$%gfrpG_0v3n^N+HiO%=G1> zKxeS~N|g#s<-PkEmy@I8FR-bhUsr0{tbW_rH)H+J){%c4U!R@RU*hYt{}_H0_wPFU zZ}0GR-`Gssh8!4JlQ z<#-1M{F-FP7bpCRewfB&Nsz#@z-Eq~!A@aYtZ}Ohe*XMWrsNn13R7%6Oi>U7_4Wbq z7~>3H)zTxHR-IKi=GbdPY2P4qTL=-w98xOu%YZekGjeYS)??T~J@bF{nC=5&fY;3b zySt6^Kcj<#!{_<`DZcyd?%vaHQw^EvjoWPGmH{<3T1LN4Rw+6DPLh_`S3tK09T>XG z>*AOB%ohJu}tB`UEq=xM-{O^Jm4+7mKG)rkLjwfC(5 zpX94MYdf6(HP?Pam6U5jV*$Cfv`iqnppVj-Z?1)_1WlJ7etjk0iMrtM+=+xV70igf z2I5oW$^ZJKVf?i?MX5MDsjM&RjkZAMQJt8`_AspUE{b_?*#>mCQ<<{9uu(Y&KE??M zGgbM$1QX@f9jy3`jLmey+~!J8ISt$MfrqZ z<<;Bnn)ou|jq$ob90uu(4iIS1K@$F{{ao&z-1=rlVu2Z!YEM(>b)-Oo*f_`f?-zcv-1TTmzgMfbB7cvLO$M=zEBOMdIu|E??hORWEQNBg6_#`=H% z`TfTy`R+EWd~jr;+bvwo9-H}u^{oAtvJjtOfx<<5C`<#a2#YzJEDzhu$eaS~`VGI* z0Z5gFq=Egu$kosbA+ig733X4YcMT}BU?nk5LwuAA%JWP|5w;Q7ge%Ccho0#Yr?;vG zr+{H%BfX8>uF@4njLO`z?#QG%R6)0sF=6y})keor4W@}WRX6eBHH9shbyCdVQkI|& zUKiN~sS)8)rjGK6i1&2fUaSVRrhlBn_bUFXtpN^9Z?K_;eoyD`@e;>H8`ZD2daIDt zT>(1(iL&ciOmBE6cM6E2jS?GLVb)znXBP!BMyGhvDegsfQNZN%2wF7+u5HWW0?!E- z_WkNgQu73R6}ZBr>wJo1EKUfk6f2Xn`ZM}I{ZUAnrb(^-Ufka!#C6^?R zWIa_sm1(@w^rG2CTdRidrd*JW?qYe`ns>*Z?L+YBeOe-GFgk6^+PEKkDt@{iY`Zd} z&|$UALW`N(ZYyfWq}fde$J1W{tL_1mz}DyA1g`F0YcuNTcv1l@Qq4>pW@n8sESp%` zNBjpY7zwNGa5E|>b3y+@`x>-gK$UU=54-(28|+R2s1^7nj%V*Mib*=Rm*`ZdfDWMc zDtZiX7T|RUDJBeO z&d_8y8@D)js*rlD1)o3nXa?O=$21Ld#&B9Aw2|9NUrXSdF}9l-ZB%!b-=qO@RBL}v z!$4UeUd|})H8$Jrz*23!Cux4WA?#0DF;t=b%H~iRNaEh*yOuyxi#w}U^jBF$c}q?S z+IELdnOokXbJ*(cS;x{x;*#-K9yPM5IVq19zs zca~X8u>tO+*-lRzP`$B%u%KL2_IaIz>YP#se0B>y(%10+sc365PbtHXg=0y?_Z40<%;_N9%rvn*~l`nv*yp=^Qc?UZXkYf%gKg7KDRwzHs0R z9LF$^=~Q2MO49ib=!Y4XSlvbDq@y(QUO!JLSp`d5?h1=HWyQ2lEY7W1L}$NuEY zbXZn2Md5Xxfet15HsCjz_iZpm*WR~*NaWv?k-7Kn|MXtKkBAYPb2vLW9BCrrSk!xSbR4)$Koi<>;}L9Zb&2+-wk$0qX8_`$s_&a-#zc+zkIyZ zs^RCCY85yh4oNZ(_=4a#QU|G~D4OG;Q6N5@%}7X4?2kr=ua92^d^z9NMaRQovNB+H zKO&^bkfbv@yus7q>G2QmCwqsxe?8bg2o@rVwNRxzgBbgJi$frXI>T6I_Wx?7Koh+{5RogVDE!HsjBaUhI|d5A{z3Z4wB_0h}$_i_i;WCZ0l_SfP{+YxVgD;Sg;+ynLeOC#W;lsb23kH&8Jb$1zY)Cpfo}(^3+ws zGZbRJ13V8GfVjf{vAAOZE_G-JoLNwKd3<^1u(vz{>4%&IhO30CejgIK(2H{QW~}bz zpyaN;-JJtT;rpT%`%0TS*`Lvft79OUc4cvhRw+tIXhTk%BUI|_zj@nG9p+N3aw@iW zdUM5o?M>k87%F?<*PMjc@k$Yb5hw9V7T|e;OKyvTBGrpp0RGSa`rjO;jG{!?#D5L+z~{ z9>+9~ws+v;X{t+$lM5U&M}0D8wvK>q!(hm#0<^lkk(w;;^o+mF;eEZqND6j5I9_F zs=0VVe8(8Jd84mOFM9sB-396UqhC7ueb_!o}I0 zF`nv4<3)VATsN&SV>RA0msXp)0!IZM=~`_}(msA8DsvAVZOs${jW z(i(`+^d8j73O?BKHKHu7+S;%?r}v;)RwF4^CWy6L**&POY~i->R9l-m=K3CVT5~m0 z6{upZMDBJFnc*;K#C+;|9j{E>OCD_YX0Bd-Q8`@|IhyaC;7hQ{J-wf;s3|ye@8cU2U&yKcjn^zE{ON` zCGeVlt1!P^ztK9Px(4&rB}UGlE_hAX{?UT`{5^lq-}CqU-Rb+k0RRC1|EwNJ2LKEK E0Py(_#Q*>R literal 0 HcmV?d00001 diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore b/packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml new file mode 100644 index 00000000..82160961 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml @@ -0,0 +1,15 @@ +apiVersion: v2 +appVersion: 26.02.0 +description: A Helm chart for deploying NetApp's Trident CSI storage provisioner using + the Trident Operator. +home: https://github.com/NetApp/trident +icon: https://raw.githubusercontent.com/NetApp/trident/master/logo/trident.png +keywords: +- NetApp +- Trident +- operator +- CSI +kubeVersion: '>= 1.24.0-0' +name: trident-operator +type: application +version: 100.2602.0 diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md b/packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md new file mode 100644 index 00000000..0f246c1a --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md @@ -0,0 +1,24 @@ +NetApp Trident + +[![Support](https://img.shields.io/badge/support-official-0067C5.svg)](http://mysupport.netapp.com/info/web/ECMLP2619434.html) +[![Chat](https://img.shields.io/badge/chat-slack-4C9689.svg)](http://netapp.io/slack/) +[![GitHub last commit](https://img.shields.io/github/last-commit/netapp/trident.svg)](https://github.com/NetApp/trident/commits) +[![license](https://img.shields.io/github/license/netapp/trident.svg)](LICENSE) +[![Docs](https://img.shields.io/badge/docs-official-0067C5.svg)](https://docs.netapp.com/us-en/trident/index.html) +[![Go Report Card](https://goreportcard.com/badge/github.com/netapp/trident)](https://goreportcard.com/report/github.com/netapp/trident) + +Trident is a fully supported open source project maintained by [NetApp](https://www.netapp.com). It has been designed +from the ground up to help you meet your containerized applications' persistence demands using industry-standard +interfaces, such as the [Container Storage Interface (CSI)](https://kubernetes-csi.github.io/docs/introduction.html). + +Trident deploys in Kubernetes clusters as pods and provides dynamic storage orchestration services for your Kubernetes workloads. It enables your containerized applications to quickly and easily consume persistent storage from NetApp’s broad portfolio that +includes [ONTAP](https://www.netapp.com/data-management/ontap-data-management-software) (AFF/FAS/Select/Cloud), [Element](https://www.netapp.com/data-management/element-software) (HCI/SolidFire), as well as the [Azure NetApp Files](https://www.netapp.com/azure/azure-netapp-files/) +service, [Google Cloud NetApp Volumes](https://www.netapp.com/google-cloud/netapp-volumes/), and [Amazon FSx for ONTAP](https://www.netapp.com/aws/fsx-ontap/). + +Trident features also address data protection, disaster recovery, portability, and migration use cases for +Kubernetes workloads leveraging NetApp's industry-leading data management technology for snapshots, backups, +replication, and cloning. + +Detailed documentation for Trident can be found [here](https://docs.netapp.com/us-en/trident/index.html). + +See [NetApp's Support site](https://mysupport.netapp.com/site/info/version-support) for details on Trident's support policy under the [Trident's Release and Support Lifecycle](https://mysupport.netapp.com/site/info/trident-support) tab. diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml new file mode 100644 index 00000000..f3aa8971 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml @@ -0,0 +1,54 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tridentconfigurators.trident.netapp.io +spec: + group: trident.netapp.io + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + x-kubernetes-preserve-unknown-fields: true + subresources: + status: {} + additionalPrinterColumns: + - name: Phase + type: string + description: The backend config phase + priority: 0 + jsonPath: .status.phase + - name: Status + type: string + description: The result of the last operation + priority: 0 + jsonPath: .status.lastOperationStatus + - name: Cloud Provider + type: string + description: The name of cloud provider + priority: 0 + jsonPath: .status.cloudProvider + - name: Storage Driver + type: string + description: The storage driver type + priority: 1 + jsonPath: .spec.storageDriverName + - name: Deletion Policy + type: string + description: The deletion policy + priority: 1 + jsonPath: .status.deletionPolicy + scope: Cluster + names: + plural: tridentconfigurators + singular: tridentconfigurator + kind: TridentConfigurator + shortNames: + - tconf + - tconfigurator + categories: + - trident + - trident-internal + - trident-external \ No newline at end of file diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml new file mode 100644 index 00000000..f16b855c --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml @@ -0,0 +1,25 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + name: tridentorchestrators.trident.netapp.io +spec: + group: trident.netapp.io + versions: + - name: v1 + served: true + storage: true + schema: + openAPIV3Schema: + type: object + x-kubernetes-preserve-unknown-fields: true + subresources: + status: {} + names: + kind: TridentOrchestrator + listKind: TridentOrchestratorList + plural: tridentorchestrators + singular: tridentorchestrator + shortNames: + - torc + - torchestrator + scope: Cluster diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt new file mode 100644 index 00000000..acb0dd88 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt @@ -0,0 +1,18 @@ + +Thank you for installing {{ .Chart.Name }}, which will deploy and manage NetApp's Trident CSI +storage provisioner for Kubernetes. + +Your release is named '{{ .Release.Name }}' and is installed into the '{{ .Release.Namespace }}' namespace. +Please note that there must be only one instance of Trident (and trident-operator) in a Kubernetes cluster. + +To configure Trident to manage storage resources, you will now need to configure at least one storage +backend and add a matching storageClass. + +Examples of backend and storageClass definitions are available at official NetApp Trident documentation. + +Further, You may find all Trident releases and source code online at {{ .Chart.Home }}. + +To learn more about the release, try: + + $ helm status {{ .Release.Name }} + $ helm get all {{ .Release.Name }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl new file mode 100644 index 00000000..bbf3dc01 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl @@ -0,0 +1,416 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "trident.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "trident.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "trident.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "trident.labels" -}} +helm.sh/chart: {{ include "trident.chart" . }} +{{ include "trident.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "trident.selectorLabels" -}} +app.kubernetes.io/name: {{ include "trident.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Trident operator level +*/}} +{{- define "trident-operator.logLevel" -}} +{{- .Values.operatorLogLevel }} +{{- end }} + +{{/* +Trident operator debug +*/}} +{{- define "trident-operator.debug" -}} +{{- .Values.operatorDebug }} +{{- end }} + +{{/* +Trident operator image +*/}} +{{- define "trident-operator.image" -}} +{{- if .Values.operatorImage }} +{{- .Values.operatorImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident-operator:{{ .Values.operatorImageTag | default .Chart.AppVersion }} +{{- else }} +{{- "" }}docker.io/netapp/trident-operator:{{ .Values.operatorImageTag | default .Chart.AppVersion }} +{{- end }} +{{- end }} + +{{/* +Trident force detach +*/}} +{{- define "trident.enableForceDetach" -}} +{{- if .Values.enableForceDetach | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident IPv6 +*/}} +{{- define "trident.IPv6" -}} +{{- if .Values.tridentIPv6 | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident SilenceAutosupport +*/}} +{{- define "trident.silenceAutosupport" -}} +{{- if .Values.tridentSilenceAutosupport | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident ExcludeAutosupport +*/}} +{{- define "trident.excludeAutosupport" -}} +{{- if .Values.tridentExcludeAutosupport | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +Trident AutoSupport image +*/}} +{{- define "trident.autosupportImage" -}} +{{- if .Values.tridentAutosupportImage }} +{{- .Values.tridentAutosupportImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident-autosupport:{{ .Values.tridentAutosupportImageTag | default .Chart.AppVersion | trunc 5}} +{{- else }} +{{- "" }}docker.io/netapp/trident-autosupport:{{ .Values.tridentAutosupportImageTag | default .Chart.AppVersion | trunc 5}} +{{- end }} +{{- end }} + +{{/* +Trident log level +*/}} +{{- define "trident.logLevel" -}} +{{- .Values.tridentLogLevel }} +{{- end }} + +{{/* +Trident debug (equivalent to debug level) +*/}} +{{- define "trident.debug" -}} +{{- .Values.tridentDebug }} +{{- end }} + +{{/* +Trident logging workflows +*/}} +{{- define "trident.logWorkflows" -}} +{{- .Values.tridentLogWorkflows }} +{{- end }} + +{{/* +Trident logging layers +*/}} +{{- define "trident.logLayers" -}} +{{- .Values.tridentLogLayers }} +{{- end }} + +{{/* +Trident log format +*/}} +{{- define "trident.logFormat" -}} +{{- if eq .Values.tridentLogFormat "json" }} +{{- .Values.tridentLogFormat }} +{{- else }} +{{- "text" }} +{{- end }} +{{- end }} + +{{/* +Trident audit log +*/}} +{{- define "trident.disableAuditLog" -}} +{{- if .Values.tridentDisableAuditLog | printf "%v" | eq "true" }} +{{- "true" }} +{{- else }} +{{- "false" }} +{{- end }} +{{- end }} + +{{/* +Trident probe port +*/}} +{{- define "trident.probePort" -}} +{{- if eq .Values.tridentProbePort "json" }} +{{- .Values.tridentProbePort }} +{{- else }} +{{- 17546 }} +{{- end }} +{{- end }} + +{{/* +Trident image +*/}} +{{- define "trident.image" -}} +{{- if .Values.tridentImage }} +{{- .Values.tridentImage }} +{{- else if .Values.imageRegistry }} +{{- .Values.imageRegistry }}/trident:{{ .Values.tridentImageTag | default .Chart.AppVersion }} +{{- else }} +{{- "" }}docker.io/netapp/trident:{{ .Values.tridentImageTag | default .Chart.AppVersion }} +{{- end }} +{{- end }} + +{{/* +Trident image pull policy +*/}} +{{- define "imagePullPolicy" -}} +{{- if .Values.imagePullPolicy }} +{{- .Values.imagePullPolicy }} +{{- else }} +{{- "IfNotPresent" }} +{{- end }} +{{- end }} + +{{/* +Determines if rancher roles should be created by checking for the presence of the cattle-system namespace +or annotations with the prefix "cattle.io/" in the namespace where the chart is being installed. +Override auto-detection and force install the roles by setting Values.forceInstallRancherClusterRoles to 'true'. +*/}} +{{- define "shouldInstallRancherRoles" -}} +{{- $isRancher := false -}} +{{- $currentNs := .Release.Namespace -}} +{{- $currentNsObj := lookup "v1" "Namespace" "" $currentNs -}} +{{- /* Check if 'forceInstallRancherClusterRoles' is set */ -}} +{{- if .Values.forceInstallRancherClusterRoles }} + {{- $isRancher = true -}} +{{- end }} +{{- /* Check if the annotation prefix "cattle.io/" exists on the namespace */ -}} +{{- if $currentNsObj }} + {{- range $key, $value := $currentNsObj.metadata.annotations }} + {{- if hasPrefix "cattle.io/" $key }} + {{- $isRancher = true -}} + {{- end }} + {{- end }} +{{- end }} +{{- /* Check if cattle-system ns exists */ -}} +{{- $cattleNs := lookup "v1" "Namespace" "" "cattle-system" -}} +{{- if $cattleNs }} + {{- $isRancher = true -}} +{{- end }} +{{- $isRancher -}} +{{- end }} + +{{/* +Helper functions to render resource requests and limits for each container of trident from values.yaml +*/}} +{{- define "trident.resources.controller" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "trident.resources.node.linux" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{- define "trident.resources.node.windows" -}} +{{- range $key, $val := . }} +{{- $containerName := $key }} +{{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory }} +{{ $containerName }}: +{{- if or $val.requests.cpu $val.requests.memory }} + requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} + limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Helper functions to check if resources are actually defined (not just empty structure) +*/}} +{{- define "trident.hasControllerResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.controller -}} + {{- range $key, $val := .Values.resources.controller -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{- define "trident.hasNodeLinuxResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.node -}} + {{- if .Values.resources.node.linux -}} + {{- range $key, $val := .Values.resources.node.linux -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{- define "trident.hasNodeWindowsResources" -}} + {{- $hasResources := false -}} + {{- if .Values.resources -}} + {{- if .Values.resources.node -}} + {{- if .Values.resources.node.windows -}} + {{- range $key, $val := .Values.resources.node.windows -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + {{- $hasResources = true -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- end -}} + {{- if $hasResources -}}true{{- end -}} +{{- end -}} + +{{/* +Helper function to check if operator resources are defined +*/}} +{{- define "trident-operator.hasResources" -}} + {{- $val := . -}} + {{- if or $val.requests.cpu $val.requests.memory $val.limits.cpu $val.limits.memory -}} + true + {{- end -}} +{{- end -}} + +{{/* +Helper function to render resource requests and limits for the operator +*/}} +{{- define "trident-operator.resources" }} +{{- $val := .}} +{{- if or $val.requests.cpu $val.requests.memory }} +requests: +{{- if $val.requests.cpu }} + cpu: {{ $val.requests.cpu }} +{{- end }} +{{- if $val.requests.memory }} + memory: {{ $val.requests.memory }} +{{- end }} +{{- end }} +{{- if or $val.limits.cpu $val.limits.memory }} +limits: +{{- if $val.limits.cpu }} + cpu: {{ $val.limits.cpu }} +{{- end }} +{{- if $val.limits.memory }} + memory: {{ $val.limits.memory }} +{{- end }} +{{- end }} +{{- end -}} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml new file mode 100644 index 00000000..6300f2f2 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml @@ -0,0 +1,13 @@ +{{- if include "shouldInstallRancherRoles" . | eq "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: trident-operator-rancher +rules: + - apiGroups: + - management.cattle.io + resources: + - projects + verbs: + - updatepsa +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml new file mode 100644 index 00000000..92279962 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml @@ -0,0 +1,458 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: trident-operator + labels: + app: operator.trident.netapp.io +rules: + # Permissions same as Trident + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - apiGroups: + - "" + resources: + - persistentvolumes + - persistentvolumeclaims + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - persistentvolumeclaims/status + verbs: + - update + - patch + - apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - events + verbs: + - get + - list + - watch + - create + - update + - patch + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - resourcequotas + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - pods + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch + - update + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments + verbs: + - get + - list + - watch + - update + - patch + - delete + - apiGroups: + - storage.k8s.io + resources: + - volumeattachments/status + verbs: + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots + - volumesnapshotclasses + verbs: + - get + - list + - watch + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotclasses + verbs: + - create + - delete + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshots/status + - volumesnapshotcontents/status + verbs: + - update + - patch + - apiGroups: + - snapshot.storage.k8s.io + resources: + - volumesnapshotcontents + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshots + verbs: + - list + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotclasses + verbs: + - list + - watch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents + verbs: + - get + - list + - watch + - patch + - apiGroups: + - groupsnapshot.storage.k8s.io + resources: + - volumegroupsnapshotcontents/status + verbs: + - update + - apiGroups: + - csi.storage.k8s.io + resources: + - csidrivers + - csinodeinfos + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - storage.k8s.io + resources: + - csidrivers + - csinodes + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - trident.netapp.io + resources: + - tridentversions + - tridentbackends + - tridentstorageclasses + - tridentvolumes + - tridentvolumepublications + - tridentvolumereferences + - tridentnodes + - tridenttransactions + - tridentsnapshots + - tridentbackendconfigs + - tridentbackendconfigs/status + - tridentmirrorrelationships + - tridentmirrorrelationships/status + - tridentactionmirrorupdates + - tridentactionmirrorupdates/status + - tridentsnapshotinfos + - tridentsnapshotinfos/status + - tridentgroupsnapshots + - tridentgroupsnapshots/status + - tridentactionsnapshotrestores + - tridentactionsnapshotrestores/status + - tridentnoderemediations + - tridentnoderemediations/status + - tridentnoderemediationtemplates + - tridentnoderemediationtemplates/status + - tridentprovisioners # Required for Tprov + - tridentprovisioners/status # Required to update Tprov's status section + - tridentorchestrators # Required for torc + - tridentorchestrators/status # Required to update torc's status section + - tridentconfigurators # Required for tconf + - tridentconfigurators/status # Required to update tconf's status section + - tridentautogrowpolicies + - tridentautogrowpolicies/status + - tridentautogrowrequestinternals + - tridentautogrowrequestinternals/status + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + # Now Operator specific permissions + - apiGroups: + - "" + resources: + - namespaces + verbs: + - create + - patch + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - statefulsets + verbs: + - get + - list + - watch + - create + - apiGroups: + - apps + resources: + - deployments + - statefulsets + verbs: + - delete + - update + - patch + resourceNames: + - trident + - trident-csi + - trident-controller + - apiGroups: + - apps + resources: + - daemonsets + verbs: + - delete + - update + - patch + resourceNames: + - trident + - trident-csi + - trident-csi-windows + - trident-node-linux + - trident-node-windows + - apiGroups: + - "" + resources: + - pods/exec + - services + - serviceaccounts + verbs: + - get + - list + - create + - apiGroups: + - "" + resources: + - pods/exec + - services + verbs: + - delete + - update + - patch + resourceNames: + - trident-csi + - trident + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - delete + - update + - patch + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + - trident-csi + - trident + - apiGroups: + - authorization.openshift.io + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + - clusterroles + - clusterrolebindings + verbs: + - list + - create + - apiGroups: + - authorization.openshift.io + - rbac.authorization.k8s.io + resources: + - roles + - rolebindings + - clusterroles + - clusterrolebindings + verbs: + - get + - delete + - update + - patch + resourceNames: + - trident-node-remediation-access + - trident-controller + - trident-node-linux + - trident-node-windows + - trident-csi + - trident + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - list + - create + - apiGroups: + - policy + resources: + - podsecuritypolicies + resourceNames: + - tridentpods + - trident-controller + - trident-node-linux + - trident-node-windows + verbs: + - delete + - update + - patch + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - get + - list + - create + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + resourceNames: + - trident-controller + - trident-node-linux + - trident-node-windows + - trident + verbs: + - delete + - update + - patch + - apiGroups: + - policy + resources: + - podsecuritypolicies + verbs: + - use + resourceNames: + - tridentoperatorpods + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml new file mode 100644 index 00000000..b70fcff9 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml @@ -0,0 +1,14 @@ +{{- if include "shouldInstallRancherRoles" . | eq "true" }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: trident-operator-rancher +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: trident-operator-rancher +subjects: + - kind: ServiceAccount + name: trident-operator + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml new file mode 100644 index 00000000..e6297525 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml @@ -0,0 +1,14 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: trident-operator + labels: + app: operator.trident.netapp.io +subjects: + - kind: ServiceAccount + name: trident-operator + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: trident-operator + apiGroup: rbac.authorization.k8s.io diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml new file mode 100644 index 00000000..c57bb587 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml @@ -0,0 +1,82 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: +{{- if .Values.deploymentAnnotations }} + annotations: +{{ toYaml .Values.deploymentAnnotations | indent 4 }} +{{- end }} + labels: + app: operator.trident.netapp.io + name: trident-operator + namespace: {{ .Release.Namespace }} +spec: + replicas: 1 + strategy: + type: Recreate + selector: + matchLabels: + app: operator.trident.netapp.io + name: trident-operator + template: + metadata: + {{- if .Values.podAnnotations }} + annotations: +{{ toYaml .Values.podAnnotations | indent 8 }} + {{- end }} + labels: + app: operator.trident.netapp.io + name: trident-operator + {{- if and (eq .Values.cloudProvider "Azure") (ne .Values.cloudIdentity "") }} + azure.workload.identity/use: 'true' + {{- end }} + spec: + {{- if .Values.affinity }} + affinity: +{{- toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | indent 8 }} + {{- end }} + serviceAccountName: trident-operator + containers: + - command: + - /trident-operator + {{- if or .Values.anfConfigurator.enabled .Values.ontapConfigurator.enabled }} + - -configurator-reconcile-interval={{ .Values.configuratorReconcileInterval }} + {{- end }} + {{- if .Values.operatorDebug }} + - -debug + {{- end }} + env: + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: trident-operator + {{- if and (eq .Values.cloudProvider "Azure") (eq .Values.cloudIdentity "") }} + - name: AZURE_CREDENTIAL_FILE + value: /etc/kubernetes/azure.json + volumeMounts: + - name: azure-cred + mountPath: /etc/kubernetes + {{- end }} + image: {{ include "trident-operator.image" $ }} + imagePullPolicy: {{ .Values.imagePullPolicy }} + name: trident-operator + {{- if (include "trident-operator.hasResources" .Values.resources.operator) }} + resources: + {{- include "trident-operator.resources" .Values.resources.operator | indent 10 }} + {{- end }} + {{- if and (eq .Values.cloudProvider "Azure") (eq .Values.cloudIdentity "") }} + volumes: + - name: azure-cred + hostPath: + path: /etc/kubernetes + type: DirectoryOrCreate + {{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml new file mode 100644 index 00000000..a9ee84dd --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml @@ -0,0 +1,82 @@ +{{- if or .Values.cleanupCrds }} + +apiVersion: v1 +kind: ServiceAccount +metadata: + name: post-delete-service-account + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": hook-succeeded + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: post-delete-cluster-role + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-9" + "helm.sh/hook-delete-policy": hook-succeeded +rules: +- apiGroups: ["apiextensions.k8s.io"] + resources: ["customresourcedefinitions"] + verbs: ["get", "list", "delete", "patch"] + +--- + +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: post-delete-cluster-rolebinding + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-8" + "helm.sh/hook-delete-policy": hook-succeeded +subjects: +- kind: ServiceAccount + name: post-delete-service-account + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: post-delete-cluster-role + apiGroup: rbac.authorization.k8s.io + +--- + +apiVersion: batch/v1 +kind: Job +metadata: + name: post-delete-hook + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": post-delete + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed +spec: + template: + spec: + serviceAccountName: post-delete-service-account + containers: + - name: post-delete-container + image: {{ .Values.helmHookImage }} + command: + - sh + - -c + - | + set -x + kubectl patch crd tridentorchestrators.trident.netapp.io -p '{"metadata":{"finalizers":[]}}' --type=merge + kubectl delete crd tridentorchestrators.trident.netapp.io + kubectl patch crd tridentconfigurators.trident.netapp.io -p '{"metadata":{"finalizers":[]}}' --type=merge + kubectl delete crd tridentconfigurators.trident.netapp.io + restartPolicy: Never + backoffLimit: 4 + +{{- end }} \ No newline at end of file diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml new file mode 100644 index 00000000..103b2b15 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml @@ -0,0 +1,70 @@ +{{- if or .Values.anfConfigurator.enabled .Values.ontapConfigurator.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: trident-operator + namespace: {{ .Release.Namespace }} +spec: + selector: + app: operator.trident.netapp.io + ports: + - name: http + protocol: TCP + port: 8000 + targetPort: 8002 +--- +apiVersion: v1 +kind: Pod +metadata: + name: trident-post-install-upgrade-hook + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, hook-failed +spec: + restartPolicy: Never + {{- if .Values.affinity }} + affinity: +{{ toYaml .Values.affinity | nindent 4 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: +{{ toYaml .Values.nodeSelector | nindent 4 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: +{{ toYaml .Values.tolerations | nindent 4 }} + {{- end }} + initContainers: + - name: init-container-1 + image: {{ include "trident.image" $ }} + command: + - tridentctl + - --debug + - -s + - 127.0.0.1:8000 + - check + - operator + - --timeout + - "7200" # Keeping it 12 mins as AKS extension script has an upper limit of 15 mins. + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + containers: + - name: trident-post-hook + image: {{ include "trident.image" $ }} + command: + - tridentctl + - --debug + - -s + - 127.0.0.1:8000 + - check + - operator + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml new file mode 100644 index 00000000..507b38df --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml @@ -0,0 +1,41 @@ +{{- if or .Values.cleanupCrds }} + +apiVersion: batch/v1 +kind: Job +metadata: + name: pre-delete-hook + namespace: {{ .Release.Namespace }} + labels: + app.kubernetes.io/managed-by: {{ .Release.Service | quote }} + app.kubernetes.io/instance: {{ .Release.Name | quote }} + app.kubernetes.io/version: {{ .Chart.AppVersion }} + helm.sh/chart: "{{ .Chart.Name }}-{{ .Chart.Version }}" + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": hook-succeeded,hook-failed +spec: + template: + spec: + serviceAccountName: trident-operator + containers: + - name: pre-delete-container + image: {{ .Values.helmHookImage }} + command: + - sh + - -c + - | + set -x + if kubectl get torc trident -n trident; then + kubectl patch torc trident -n trident --type=merge -p '{"spec":{"wipeout":["crds"],"uninstall":true, "skipCRDsToObliviate":["tridentorchestrators.trident.netapp.io", "tridentconfigurators.trident.netapp.io"]}}' + while kubectl get crds | grep '.trident.netapp.io' | grep -v -e 'tridentorchestrators.trident.netapp.io' -e 'tridentconfigurators.trident.netapp.io'; do + echo 'Waiting for CRDs to be deleted...' + sleep 5 + done + else + echo 'Trident orchestrator does not exist.' + fi + restartPolicy: Never + backoffLimit: 4 + +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml new file mode 100644 index 00000000..7a73016d --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: trident-operator + namespace: {{ .Release.Namespace }} + {{- if and (ne .Values.cloudIdentity "") (ne .Values.cloudProvider "") }} + {{- $cloudIdentity := trimPrefix "'" .Values.cloudIdentity }} + {{- $cloudIdentity = trimSuffix "'" $cloudIdentity }} + {{- $cloudIdentityPair := regexSplit ": " $cloudIdentity 2 }} + annotations: + {{ first $cloudIdentityPair }}: {{ last $cloudIdentityPair }} + {{- end }} + labels: + app: operator.trident.netapp.io +{{- if .Values.imagePullSecrets }} +imagePullSecrets: +{{- range .Values.imagePullSecrets }} +- name: {{ . }} +{{- end }} +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml new file mode 100644 index 00000000..8496eb5e --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml @@ -0,0 +1,111 @@ +{{- if .Values.anfConfigurator.enabled }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-anf-backend-configurator +spec: + storageDriverName: azure-netapp-files + {{- if eq .Values.cloudProvider "" }} + tenantID: {{ .Values.anfConfigurator.tenantID }} + clientCredentials: {{ .Values.anfConfigurator.clientCredentials }} + {{- end }} + {{- if or (eq .Values.cloudProvider "") (and (eq .Values.cloudProvider "Azure") (ne .Values.cloudIdentity "")) }} + subscriptionID: {{ .Values.anfConfigurator.subscriptionID }} + location: {{ .Values.anfConfigurator.location }} + {{- end }} + virtualNetwork: {{ .Values.anfConfigurator.virtualNetwork }} + subnet: {{ .Values.anfConfigurator.subnet }} + capacityPools: + {{- range .Values.anfConfigurator.capacityPools }} + - {{ . }} + {{- end }} + netappAccounts: + {{- range .Values.anfConfigurator.netappAccounts }} + - {{ . }} + {{- end }} + resourceGroups: + {{- range .Values.anfConfigurator.resourceGroups }} + - {{ . }} + {{- end }} + customerEncryptionKeys: + {{- range $key, $value := .Values.anfConfigurator.customerEncryptionKeys }} + {{ $key }}: {{ $value }} + {{- end }} +{{- end }} + +--- + +{{- if .Values.ontapConfigurator.enabled }} +{{- $includeCR := false }} +{{- range .Values.ontapConfigurator.svms }} + {{- if or (has "nfs" .protocols) (has "smb" .protocols) }} + {{- $includeCR = true }} + {{- end }} +{{- end }} + +{{- if $includeCR }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-nas-backend-configurator +spec: + storageDriverName: ontap-nas + svms: + {{- range .Values.ontapConfigurator.svms }} + {{- if or (has "nfs" .protocols) (has "smb" .protocols) }} + - fsxnID: {{ .fsxnID | quote }} + protocols: + {{- $filteredProtocols := list }} + {{- range .protocols }} + {{- if or (eq . "nfs") (eq . "smb") }} + {{- $filteredProtocols = append $filteredProtocols . }} + {{- end }} + {{- end }} + {{- range $filteredProtocols }} + - {{ . | quote }} + {{- end }} + svmName: {{ .svmName | quote }} + authType: {{ .authType | default "awsarn" | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} + + +--- + +{{- if .Values.ontapConfigurator.enabled }} +{{- $includeCR := false }} +{{- range .Values.ontapConfigurator.svms }} + {{- if or (has "iscsi" .protocols) (has "nvme" .protocols) }} + {{- $includeCR = true }} + {{- end }} +{{- end }} + +{{- if $includeCR }} +apiVersion: trident.netapp.io/v1 +kind: TridentConfigurator +metadata: + name: netapp-san-backend-configurator +spec: + storageDriverName: ontap-san + svms: + {{- range .Values.ontapConfigurator.svms }} + {{- if or (has "iscsi" .protocols) (has "nvme" .protocols) }} + - fsxnID: {{ .fsxnID | quote }} + protocols: + {{- $filteredProtocols := list }} + {{- range .protocols }} + {{- if or (eq . "iscsi") (eq . "nvme") }} + {{- $filteredProtocols = append $filteredProtocols . }} + {{- end }} + {{- end }} + {{- range $filteredProtocols }} + - {{ . | quote }} + {{- end }} + svmName: {{ .svmName | quote }} + authType: {{ .authType | default "awsarn" | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml new file mode 100644 index 00000000..5f5038df --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml @@ -0,0 +1,108 @@ +apiVersion: trident.netapp.io/v1 +kind: TridentOrchestrator +metadata: + name: trident +spec: + namespace: {{ .Release.Namespace }} + enableForceDetach: {{ include "trident.enableForceDetach" $ }} + IPv6: {{ include "trident.IPv6" $ }} + k8sTimeout: {{ .Values.tridentK8sTimeout }} + httpRequestTimeout: {{ .Values.tridentHttpRequestTimeout }} + silenceAutosupport: {{ include "trident.silenceAutosupport" $ }} + {{- if .Values.tridentExcludeAutosupport }} + excludeAutosupport: {{ .Values.tridentExcludeAutosupport }} + {{- end }} + autosupportImage: {{ include "trident.autosupportImage" $ }} + autosupportProxy: {{ .Values.tridentAutosupportProxy }} + autosupportInsecure: {{ .Values.tridentAutosupportInsecure }} + logFormat: {{ include "trident.logFormat" $ }} + disableAuditLog: {{ include "trident.disableAuditLog" $ }} + {{- if .Values.tridentDebug }} + debug: {{ .Values.tridentDebug }} + {{- end }} + {{- if .Values.tridentLogLevel }} + logLevel: {{ .Values.tridentLogLevel }} + {{- end }} + logWorkflows: {{ include "trident.logWorkflows" $ }} + logLayers: {{ include "trident.logLayers" $ }} + probePort: {{ include "trident.probePort" $ }} + tridentImage: {{ include "trident.image" $ }} + {{- if .Values.imageRegistry }} + imageRegistry: {{ .Values.imageRegistry }} + {{- end }} + kubeletDir: {{ .Values.kubeletDir }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 2 }} + {{- end }} + {{- if .Values.tridentControllerPluginNodeSelector }} + controllerPluginNodeSelector: + {{- range $key, $value := .Values.tridentControllerPluginNodeSelector }} + {{ $key }}: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.tridentControllerPluginTolerations }} + controllerPluginTolerations: + {{- range $value := .Values.tridentControllerPluginTolerations }} + - {{- range $k, $v := $value }} + {{ $k }}: "{{ $v }}" + {{- end}} + {{- end}} + {{- end }} + {{- if .Values.tridentNodePluginNodeSelector }} + nodePluginNodeSelector: + {{- range $key, $value := .Values.tridentNodePluginNodeSelector }} + {{ $key }}: "{{ $value }}" + {{- end }} + {{- end }} + {{- if .Values.tridentNodePluginTolerations }} + nodePluginTolerations: + {{- range $value := .Values.tridentNodePluginTolerations }} + - {{- range $k, $v := $value }} + {{ $k }}: "{{ $v }}" + {{- end}} + {{- end}} + {{- end }} + imagePullPolicy: {{ include "imagePullPolicy" $ }} + windows: {{ .Values.windows }} + cloudProvider: {{ .Values.cloudProvider }} + cloudIdentity: {{ .Values.cloudIdentity }} + enableACP: {{ .Values.enableACP }} + acpImage: {{ .Values.acpImage }} + httpsMetrics: {{ .Values.httpsMetrics }} + enableAutoBackendConfig: {{ or .Values.ontapConfigurator.enabled .Values.anfConfigurator.enabled }} + iscsiSelfHealingInterval: {{ .Values.iscsiSelfHealingInterval }} + iscsiSelfHealingWaitTime: {{ .Values.iscsiSelfHealingWaitTime }} + {{- if .Values.k8sAPIQPS }} + k8sAPIQPS: {{ .Values.k8sAPIQPS }} + {{- end }} + {{- if .Values.fsGroupPolicy }} + fsGroupPolicy: {{ .Values.fsGroupPolicy }} + {{- end }} + {{- if .Values.nodePrep }} + nodePrep: {{- range .Values.nodePrep }} + - {{.}} {{- end }} + {{- end }} + enableConcurrency: {{ .Values.enableConcurrency }} + {{- if .Values.skipCRDsToObliviate }} + skipCRDsToObliviate: {{- range .Values.skipCRDsToObliviate }} + - {{.}} {{- end }} + {{- end }} + {{ if or (include "trident.hasControllerResources" .) (include "trident.hasNodeLinuxResources" .) (include "trident.hasNodeWindowsResources" .) -}} + resources: + {{ if include "trident.hasControllerResources" . -}} + controller: {{ include "trident.resources.controller" .Values.resources.controller | indent 6 }} + {{- end }} + {{ if or (include "trident.hasNodeLinuxResources" .) (include "trident.hasNodeWindowsResources" .) -}} + node: + {{ if include "trident.hasNodeLinuxResources" . -}} + linux: {{ include "trident.resources.node.linux" .Values.resources.node.linux | indent 8 }} + {{- end }} + {{- if include "trident.hasNodeWindowsResources" . }} + windows: {{ include "trident.resources.node.windows" .Values.resources.node.windows | indent 8 }} + {{- end }} + {{- end }} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: {{ .Values.hostNetwork }} + {{- end }} diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml b/packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml new file mode 100644 index 00000000..e30cee4b --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml @@ -0,0 +1,327 @@ +# Default values for standalone. +# This is a YAML-formatted file. + +# helmHookImage specifies the image used for Helm hook jobs +helmHookImage: "alpine/k8s:1.33.0" + +## Node labels for pod assignment +## ref: https://kubernetes.io/docs/user-guide/node-selection/ +nodeSelector: {} + +## Pod Annotations +podAnnotations: {} + +## Deployment Annotations +deploymentAnnotations: {} + +## Tolerations for pod assignment +## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +tolerations: [] + +## Affinity for pod assignment +## The following affinity configuration ensures that the Trident operator will only be scheduled on nodes with the specified architecture and OS, Hence, do not modify this section. To add custom affinity rules, please append your content to this configuration as needed +## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity +affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - arm64 + - amd64 + - key: kubernetes.io/os + operator: In + values: + - linux + + +# tridentControllerPluginNodeSelector additional nodeSelectors for the Pod running the Trident Controller CSI Plugin. +# tridentControllerPluginNodeSelector : {} + +# tridentControllerPluginTolerations overrides tolerations for the Pod running the Trident Controler CSI Plugin. +# tridentControllerPluginTolerations: [] + +# tridentNodePluginNodeSelector additional nodeSelectors for Pods running the Trident Node CSI Plugin. +# tridentNodePluginNodeSelector : {} + +# tridentNodePluginTolerations overrides tolerations for Pods running the Trident Node CSI Plugin. +# tridentNodePluginTolerations: [] + + + +# imageRegistry identifies the registry for the trident-operator, trident, and other images. Leave empty to accept the default. +imageRegistry: "" + +# imagePullPolicy sets the image pull policy for the trident-operator. +imagePullPolicy: IfNotPresent + +# imagePullSecrets sets the image pull secrets for the trident-operator, trident, and other images. +imagePullSecrets: [] + +# kubeletDir allows overriding the host location of kubelet's internal state. (default "/var/lib/kubelet"). +kubeletDir: "" + + +# operatorLogLevel allows the log level of the Trident operator to be set to one of these: +# trace, debug, info, warn, error, fatal. +# operatorLogLevel: "info" + +# operatorDebug allows the log level of the Trident operator to be set to debug +operatorDebug: true + +# operatorImage allows the complete override of the image for trident-operator. +operatorImage: "" + +# operatorImageTag allows overriding the tag of the trident-operator image. +operatorImageTag: "" + + +# tridentIPv6 allows enabling Trident to work in IPv6 clusters. +tridentIPv6: false + +# tridentK8sTimeout overrides the default 30-second timeout for most Kubernetes API operations (if non-zero, in seconds). +tridentK8sTimeout: 0 + +# tridentHttpRequestTimeout (duration) overrides the default 90-second timeout for the HTTP requests, with 0s being an +# infinite duration for the timeout. Negative values are not allowed. +tridentHttpRequestTimeout: "90s" + +# tridentSilenceAutosupport allows disabling Trident's periodic Autosupport reporting. +tridentSilenceAutosupport: false + +# tridentExcludeAutosupport allows removal of the autosupport container when installing Trident. +tridentExcludeAutosupport: false + +# tridentAutosupportImage allows the complete override of the image for Trident's Autosupport container. +tridentAutosupportImage: "" + +# tridentAutosupportImageTag allows overriding the tag of the image for Trident's Autosupport container. +tridentAutosupportImageTag: "26.02" + +# tridentAutosupportProxy allows Trident's autosupport container to phone home via an HTTP proxy. +tridentAutosupportProxy: "" + +# tridentAutosupportInsecure allows Trident's autosupport container to skip TLS verification +tridentAutosupportInsecure: false + +# tridentLogFormat sets the Trident logging format (text or json). +tridentLogFormat: "text" + +# tridentDisableAuditLog disables Trident's audit logger. +tridentDisableAuditLog: true + +# tridentLogLevel allows the log level of Trident to be set to one of these: trace, debug, info, warn, error, fatal. +#tridentLogLevel: "info" + +# tridentDebug allows the log level of Trident to be set to debug +tridentDebug: false + +# tridentLogWorkflows allows specific Trident workflows to be enabled for trace logging or log suppression. +tridentLogWorkflows: "" + +# tridentLogLayers allows specific Trident layers to be enabled for trace logging or log suppression. +tridentLogLayers: "" + +# tridentImage allows the complete override of the image for Trident. +tridentImage: "" + +# tridentImageTag allows overriding the tag of the image for Trident. +tridentImageTag: "" + +# (Deprecated) tridentEnableNodePrep attempts to automatically install required packages on nodes. +tridentEnableNodePrep: false + +# (Deprecated) tridentSkipK8sVersionCheck allows overriding the k8s version limit for Trident. +tridentSkipK8sVersionCheck: false + +# tridentProbePort allows overriding the default port used for k8s liveness/readiness probes. +tridentProbePort: "" + +# windows allows Trident to be installed on Windows worker node. +windows: false + +# enableForceDetach allows enabling the force detach feature. +enableForceDetach: false + +# cloudProvider indicates which cloud platform Trident is running on. +cloudProvider: "" + +# cloudIdentity indicates the identity that needs to be set on service account. +cloudIdentity: "" + +# enableACP allows enabling the Trident-ACP container to run. +enableACP: false + +# acpImage indicates the image the Trident-ACP container should pull. +acpImage: "" + +# httpsMetrics allows enabling the HTTPS metrics. +httpsMetrics: false + +# iscsiSelfHealingInterval is the interval at which the iSCSI self-healing job is invoked +iscsiSelfHealingInterval: "5m0s" + +# iscsiSelfHealingWaitTime is the wait time after which iSCSI self-healing attempts to fix stale sessions +iscsiSelfHealingWaitTime: "7m0s" + +# configuratorReconcileInterval is the resource refresh rate for the auto generated backends. +configuratorReconcileInterval: 30m0s + +# forceInstallRancherClusterRoles will install a Rancher specific ClusterRole and ClusterRoleBinding when set to true. +# When set to false, the ClusterRole and ClusterRoleBinding will be installed only when a Rancher cluster is detected. +forceInstallRancherClusterRoles: false + +# Auto generated ANF backend related fields consumed by the configurator controller. +anfConfigurator: + enabled: false + virtualNetwork: "" + subnet: "" + subscriptionID: "" + tenantID: "" + location: "" + clientCredentials: "" + capacityPools: [] + netappAccounts: [] + resourceGroups: [] + customerEncryptionKeys: {} + +# Auto generated ONTAP backend related fields consumed by the configurator controller. +ontapConfigurator: + enabled: false + svms: + - fsxnID: '' + svmName: '' + protocols: [] + authType: '' + +# enableConcurrency enables the concurrent core feature in Trident **TECH PREVIEW** +enableConcurrency: false + +# Resource requests and limits for Trident components (controller, node, operator). +# Configure CPU and memory for each container and sidecar to manage resource allocation in Kubernetes. +# +# IMPORTANT NOTES: +# - DO NOT change the names of any containers or fields - or, they may not work +# - DO NOT change the indentation - YAML indentation is critical for proper parsing +# - Default values for controller/node are shown in comments (e.g., # 10m) and are applied automatically if not specified +# - Default values for operator are directly specified in the config (not in comments) and will be applied +# - By default, NO limits are applied - only requests have default values +# - Container names are listed as they appear in the pod specifications +# +# STRUCTURE EXPLANATION: +# +# 1. CONTROLLER POD: +# The controller pod runs on a single operating system (Linux), so there are no OS-specific +# sub-sections. All containers within the controller pod are listed directly under 'controller'. +# +# 2. NODE POD: +# The node pod runs on multiple operating systems (Linux and Windows), so it has OS-specific +# sub-sections: 'linux' and 'windows'. Each OS section lists its specific containers. +# +# 3. OPERATOR POD: +# Unlike controller and node pods, the operator has actual default values directly specified +# (not in comments). If removed, no values will be applied. +resources: + controller: + trident-main: + requests: + cpu: # 10m + memory: # 80Mi + limits: + cpu: + memory: + # sidecars + csi-provisioner: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-attacher: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-resizer: + requests: + cpu: # 3m + memory: # 20Mi + limits: + cpu: + memory: + csi-snapshotter: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + trident-autosupport: + requests: + cpu: # 1m + memory: # 30Mi + limits: + cpu: + memory: + node: + linux: + trident-main: + requests: + cpu: # 10m + memory: # 60Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 1m + memory: # 10Mi + limits: + cpu: + memory: + windows: + trident-main: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + liveness-probe: + requests: + cpu: # 2m + memory: # 40Mi + limits: + cpu: + memory: + operator: + requests: + cpu: 10m + memory: 40Mi + limits: + cpu: + memory: + +# k8sAPIQPS sets the maximum QPS to the Kubernetes API server from the Trident operator. (default 100) +k8sAPIQPS: 0 + +# hostNetwork sets the hostNetwork field in the Trident operator deployment spec. +hostNetwork: false + +# nodePrep enables Trident to prepare the nodes of the Kubernetes cluster to manage volumes using the +# specified data storage protocol. Currently, iSCSI is the only value supported. +nodePrep: [] diff --git a/packs/trident-operator-addon-26.0.2/logo.png b/packs/trident-operator-addon-26.0.2/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..6a7f76663a04adbeb8ac133449f97dc67ed0c215 GIT binary patch literal 4314 zcmd6r`8Qj8_s0`KRjZBp;-)3R3n#&i1C;IrWY zwquj;f&$VD0LO~E#)>aT0eA(cC<0CF=3QTVwY+6QMh+FOv{@8!GqN!$; zCy3JbGVY|+NA4|qu$@&W*M^z@Bzswv9)7F&&6!mB((g!o&LWn0vzq?MOc~-zd1B4dBW zk)u*v!MAEVz1n%?pyww&i{b~a9-n*9hf1qrF{Im8WGDI<)?4}bzMQq6K(UydhcTa| zT^%^6wqugjNvVE$&ZBdE)i#%Ba-!Wg+ziGlWm}L|)V0y~{I_!RgQTQfepX+wp3=YP zLEZ_TS0|wHley1`QuW#r&a*}_{S0y$AL`*6aHGO5H~99a(A=As;2Wr#0=49(umhFJ zJo4(kqt1vy&YXYI_(-^5#g`8PMF73+LT*1pXDeMM5XWyBA>a8eU!s}eh??4pXpM~ zNaH3=Qzs6(x-O9azP0Km{(B7(PDD~&na=|u&&}Tnx91%V?Z8zf-Q*g{1>@AA0<~Di zQ2vfSqeJQI6ZGTBAD_sJqvQzr2n#-o4Xt@h1;Sq}Mg*#ESKgHQ@wsfA+brspt&b_Z zveix^grXmKJnfO~`$>5ex-6XnPDxK|ZTjAcFMia&S zCMLuqudVZWds_*#0cMB@jlSfe%dRWHX{ALSBgMc{&Hi4`4$-a(Nsw?bMQF+~M?5Bz zi)lh4uoQd)Y^|O7b^EIT(pQaW0Lin}!^?IEwC#e$n229Uacy}d&OPT`7m|+7A*?6% z9dAZV2I4mK8mla-{QEpJ8l9AX{)4f?DnY^Bk~Y*OtbKa8vjjtu@6c_+xvb&%utl8) zySiEJfTyA(VcmKg$|jsOwK>HbgkP9a8~-#GZfK1X^GFjV8IBrBa<6?ZExVVo{dr`F z8GCv2d__Pk<@|NpJod{zFBjqXIkn47$Y>;Q?aaOw*>hz#{u2P|4h1q7io8={ zu(EZP&y3S*2&GE7O}TQ_^6mz(tMV&H$*KcB0MT&Imtt)R<%WBec8VpXmp0F4VX*$eS z^)uH0_*5Lmi+rO~v%Cf0ee=qj8@s~1FC3Hj&!u7fWi!HdwW#tzEJCTS;%X(IbTzyYnumGEp)(imq^y@YBbMG zSHPNs#}1-u2I&o}3d3&K8!+#kqOFQD<6GGutrWZ9p@Ytg+WB(gUiJx8-wS$lZ;9wP z44&hkRgx%Yl!I!DX`3_kcQ%LjgX^mnKVQXQ*V@CIqh>26-z}?3iGtaDx+%&omI=aVnqqD|%dm=d z-HKreT8Q(X|w!%GNsr*3zqBFV$KTh<*XAB zGE&m(fTwT9=;i4#$U=v$_Uy2`jrC=Orw-`m(XAa1bherD?F-yM=tkcQk{09#RueV! z6{US%!-7X7!f*S(lF<{q_B!y+5cj`kdYt7Lxa$=WVT3VzQO6+nBK=E&E@NhTy;Q@Z z%m>M*IVR4OsY3@%7q!LYEH;!Dblrj>yK0vhdi_sdWII&xy5S2d3R!Hr`I6Iz89Hiy z#yzH-)KI-|k;-)`)gd-T0x4JXAn6`v+5l(zNn~qy6;S30hF)BI$A~XO4d^yh|9JSz z5XpXE@ah&W?j^ly@-JB|&goCuvd>)YM@X)66Xo>OVs>Y_#+-}6JXTa1BU zM^^T~roEC@DxCW4Sz*%)xgY|qq54i;gL@8z84g07&8)p$Zo9oe(@onlRXQ(}6+!?9 zt&5P5!_n8IviLZ!GMVThr+9&?$!r@goK~619ZevW-#gO@= zMb|NGhtOp5*v5&P*!H9Oz9iHNbm&Pm=#n0x%;P?-t9lDn?2$F9!eR`%V%v_k%G1gD zh%(0M4eeoV#k&a|`nj>fDUvBAX38mH#s)rjBP;jzAANhy;jH$tK?RFLB~4SjI5h%(8dp!5xfd)0mRQlrIb**T= zI?I4tZFMRRZY8LbJWLBMtU6}-2rgUOM5IUeUR1~wbL*o)U*c#0q`Eye%hDcSPt!Bkn?{P1B2RaM;#WNRq(>?Sa$7}v&{*WS8PzZ2# z=HLVOw280KD#BYH1kOSLgpDyvMNSlz04Qo8_J}XAhw1Y}`A79l837PSm;8>$Dz|u) zX`w?;52iR{a4Di&2ofYJS_}B~SFNt&L38L#I>1&qBhsajE3oYCjC>&%{VK!tulSfR zfZXRf%aw#|WkjI05_q--hG+9O)P?sl8RPazY#c0C9?uN@z~dIMi`w@<^KtGECd+UqioDNGq ztq1}8UX!%lTLp$wd=u^Qtv#o`%to3CR8&+!SdlA0vH*hIZD%``<9S~IIQlASBe;Ye z6=|dqJvNlrt0SgT-WnKu|ED>0>P>n2K^p1MNt&hudq_Iu;9-4d*2ctX|;%oAIic zgR(Ta-HGK`R&JIW10eGV@$buF`Y!*F7UkqYz!4CReTG$)t<&`eO^z<{v-~KfyA|&O zkF_zBx)kKDL>DyG`1^;b3oQa#b7A`PL0=a|OV+vlM$ zu*OnKA{3gzmBAkPN5RjFFZF06?1EyVie+A$Yh2s(vZ~$r*RHo30*Z|cSb+rqcBufH zB)O}l)^>*j7Z1z>i@n1(GrjoNBc&uuC{zqkb<9c6uRlln;W89f&(9+6Q>PknhC7#E zK6tDIYzT#3Lpi3K^ei@x|51#YbTul)8W?;5ZodX}Vz$?@!@eS{Vxpgcz-L9dkM1;R z1ZR^!O|E|KfI``TZh8yog=-GcWC8r5L-b{RR(Mk7ko{3MupV zpY=MB({DOlY({gD(L7=&i$?xX#H1I_F&@16^Q0i^1WLSwBsxH1#3p#Y8Xm z09^~CFc9`?aGx>8=>`UG+z0GafslLd9|ILUFo^_o6c TM>kIXxd53OTfr+0|9tQtU!4)S literal 0 HcmV?d00001 diff --git a/packs/trident-operator-addon-26.0.2/pack.json b/packs/trident-operator-addon-26.0.2/pack.json new file mode 100644 index 00000000..eae1740e --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/pack.json @@ -0,0 +1,17 @@ +{ + "addonType": "system app", + "annotations": { + "source": "community", + "contributor": "netapp" + }, + "cloudTypes": [ + "all" + ], + "displayName": "Trident", + "charts": [ + "charts/trident-operator-100.2602.0.tgz" + ], + "layer": "addon", + "name": "csi-trident-addon", + "version": "26.0.2" +} \ No newline at end of file diff --git a/packs/trident-operator-addon-26.0.2/values.yaml b/packs/trident-operator-addon-26.0.2/values.yaml new file mode 100644 index 00000000..9b251ac0 --- /dev/null +++ b/packs/trident-operator-addon-26.0.2/values.yaml @@ -0,0 +1,338 @@ +pack: + spectrocloud.com/display-name: trident-operator + releaseNameOverride: + trident-operator: trident-operator + namespace: trident + content: + images: + - image: docker.io/netapp/trident-operator:26.0.2 + +charts: + trident-operator: + # Default values for standalone. + # This is a YAML-formatted file. + + # helmHookImage specifies the image used for Helm hook jobs + helmHookImage: "alpine/k8s:1.33.0" + + ## Node labels for pod assignment + ## ref: https://kubernetes.io/docs/user-guide/node-selection/ + nodeSelector: {} + + ## Pod Annotations + podAnnotations: {} + + ## Deployment Annotations + deploymentAnnotations: {} + + ## Tolerations for pod assignment + ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ + tolerations: [] + + ## Affinity for pod assignment + ## The following affinity configuration ensures that the Trident operator will only be scheduled on nodes with the specified architecture and OS, Hence, do not modify this section. To add custom affinity rules, please append your content to this configuration as needed + ## ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + affinity: + nodeAffinity: + requiredDuringSchedulingIgnoredDuringExecution: + nodeSelectorTerms: + - matchExpressions: + - key: kubernetes.io/arch + operator: In + values: + - arm64 + - amd64 + - key: kubernetes.io/os + operator: In + values: + - linux + + + # tridentControllerPluginNodeSelector additional nodeSelectors for the Pod running the Trident Controller CSI Plugin. + # tridentControllerPluginNodeSelector : {} + + # tridentControllerPluginTolerations overrides tolerations for the Pod running the Trident Controler CSI Plugin. + # tridentControllerPluginTolerations: [] + + # tridentNodePluginNodeSelector additional nodeSelectors for Pods running the Trident Node CSI Plugin. + # tridentNodePluginNodeSelector : {} + + # tridentNodePluginTolerations overrides tolerations for Pods running the Trident Node CSI Plugin. + # tridentNodePluginTolerations: [] + + + + # imageRegistry identifies the registry for the trident-operator, trident, and other images. Leave empty to accept the default. + imageRegistry: "" + + # imagePullPolicy sets the image pull policy for the trident-operator. + imagePullPolicy: IfNotPresent + + # imagePullSecrets sets the image pull secrets for the trident-operator, trident, and other images. + imagePullSecrets: [] + + # kubeletDir allows overriding the host location of kubelet's internal state. (default "/var/lib/kubelet"). + kubeletDir: "" + + + # operatorLogLevel allows the log level of the Trident operator to be set to one of these: + # trace, debug, info, warn, error, fatal. + # operatorLogLevel: "info" + + # operatorDebug allows the log level of the Trident operator to be set to debug + operatorDebug: true + + # operatorImage allows the complete override of the image for trident-operator. + operatorImage: "" + + # operatorImageTag allows overriding the tag of the trident-operator image. + operatorImageTag: "" + + + # tridentIPv6 allows enabling Trident to work in IPv6 clusters. + tridentIPv6: false + + # tridentK8sTimeout overrides the default 30-second timeout for most Kubernetes API operations (if non-zero, in seconds). + tridentK8sTimeout: 0 + + # tridentHttpRequestTimeout (duration) overrides the default 90-second timeout for the HTTP requests, with 0s being an + # infinite duration for the timeout. Negative values are not allowed. + tridentHttpRequestTimeout: "90s" + + # tridentSilenceAutosupport allows disabling Trident's periodic Autosupport reporting. + tridentSilenceAutosupport: false + + # tridentExcludeAutosupport allows removal of the autosupport container when installing Trident. + tridentExcludeAutosupport: false + + # tridentAutosupportImage allows the complete override of the image for Trident's Autosupport container. + tridentAutosupportImage: "" + + # tridentAutosupportImageTag allows overriding the tag of the image for Trident's Autosupport container. + tridentAutosupportImageTag: "26.02" + + # tridentAutosupportProxy allows Trident's autosupport container to phone home via an HTTP proxy. + tridentAutosupportProxy: "" + + # tridentAutosupportInsecure allows Trident's autosupport container to skip TLS verification + tridentAutosupportInsecure: false + + # tridentLogFormat sets the Trident logging format (text or json). + tridentLogFormat: "text" + + # tridentDisableAuditLog disables Trident's audit logger. + tridentDisableAuditLog: true + + # tridentLogLevel allows the log level of Trident to be set to one of these: trace, debug, info, warn, error, fatal. + #tridentLogLevel: "info" + + # tridentDebug allows the log level of Trident to be set to debug + tridentDebug: false + + # tridentLogWorkflows allows specific Trident workflows to be enabled for trace logging or log suppression. + tridentLogWorkflows: "" + + # tridentLogLayers allows specific Trident layers to be enabled for trace logging or log suppression. + tridentLogLayers: "" + + # tridentImage allows the complete override of the image for Trident. + tridentImage: "" + + # tridentImageTag allows overriding the tag of the image for Trident. + tridentImageTag: "" + + # (Deprecated) tridentEnableNodePrep attempts to automatically install required packages on nodes. + tridentEnableNodePrep: false + + # (Deprecated) tridentSkipK8sVersionCheck allows overriding the k8s version limit for Trident. + tridentSkipK8sVersionCheck: false + + # tridentProbePort allows overriding the default port used for k8s liveness/readiness probes. + tridentProbePort: "" + + # windows allows Trident to be installed on Windows worker node. + windows: false + + # enableForceDetach allows enabling the force detach feature. + enableForceDetach: false + + # cloudProvider indicates which cloud platform Trident is running on. + cloudProvider: "" + + # cloudIdentity indicates the identity that needs to be set on service account. + cloudIdentity: "" + + # enableACP allows enabling the Trident-ACP container to run. + enableACP: false + + # acpImage indicates the image the Trident-ACP container should pull. + acpImage: "" + + # httpsMetrics allows enabling the HTTPS metrics. + httpsMetrics: false + + # iscsiSelfHealingInterval is the interval at which the iSCSI self-healing job is invoked + iscsiSelfHealingInterval: "5m0s" + + # iscsiSelfHealingWaitTime is the wait time after which iSCSI self-healing attempts to fix stale sessions + iscsiSelfHealingWaitTime: "7m0s" + + # configuratorReconcileInterval is the resource refresh rate for the auto generated backends. + configuratorReconcileInterval: 30m0s + + # forceInstallRancherClusterRoles will install a Rancher specific ClusterRole and ClusterRoleBinding when set to true. + # When set to false, the ClusterRole and ClusterRoleBinding will be installed only when a Rancher cluster is detected. + forceInstallRancherClusterRoles: false + + # Auto generated ANF backend related fields consumed by the configurator controller. + anfConfigurator: + enabled: false + virtualNetwork: "" + subnet: "" + subscriptionID: "" + tenantID: "" + location: "" + clientCredentials: "" + capacityPools: [] + netappAccounts: [] + resourceGroups: [] + customerEncryptionKeys: {} + + # Auto generated ONTAP backend related fields consumed by the configurator controller. + ontapConfigurator: + enabled: false + svms: + - fsxnID: '' + svmName: '' + protocols: [] + authType: '' + + # enableConcurrency enables the concurrent core feature in Trident **TECH PREVIEW** + enableConcurrency: false + + # Resource requests and limits for Trident components (controller, node, operator). + # Configure CPU and memory for each container and sidecar to manage resource allocation in Kubernetes. + # + # IMPORTANT NOTES: + # - DO NOT change the names of any containers or fields - or, they may not work + # - DO NOT change the indentation - YAML indentation is critical for proper parsing + # - Default values for controller/node are shown in comments (e.g., # 10m) and are applied automatically if not specified + # - Default values for operator are directly specified in the config (not in comments) and will be applied + # - By default, NO limits are applied - only requests have default values + # - Container names are listed as they appear in the pod specifications + # + # STRUCTURE EXPLANATION: + # + # 1. CONTROLLER POD: + # The controller pod runs on a single operating system (Linux), so there are no OS-specific + # sub-sections. All containers within the controller pod are listed directly under 'controller'. + # + # 2. NODE POD: + # The node pod runs on multiple operating systems (Linux and Windows), so it has OS-specific + # sub-sections: 'linux' and 'windows'. Each OS section lists its specific containers. + # + # 3. OPERATOR POD: + # Unlike controller and node pods, the operator has actual default values directly specified + # (not in comments). If removed, no values will be applied. + resources: + controller: + trident-main: + requests: + cpu: # 10m + memory: # 80Mi + limits: + cpu: + memory: + # sidecars + csi-provisioner: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-attacher: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + csi-resizer: + requests: + cpu: # 3m + memory: # 20Mi + limits: + cpu: + memory: + csi-snapshotter: + requests: + cpu: # 2m + memory: # 20Mi + limits: + cpu: + memory: + trident-autosupport: + requests: + cpu: # 1m + memory: # 30Mi + limits: + cpu: + memory: + node: + linux: + trident-main: + requests: + cpu: # 10m + memory: # 60Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 1m + memory: # 10Mi + limits: + cpu: + memory: + windows: + trident-main: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + # sidecars + node-driver-registrar: + requests: + cpu: # 6m + memory: # 40Mi + limits: + cpu: + memory: + liveness-probe: + requests: + cpu: # 2m + memory: # 40Mi + limits: + cpu: + memory: + operator: + requests: + cpu: 10m + memory: 40Mi + limits: + cpu: + memory: + + # k8sAPIQPS sets the maximum QPS to the Kubernetes API server from the Trident operator. (default 100) + k8sAPIQPS: 0 + + # hostNetwork sets the hostNetwork field in the Trident operator deployment spec. + hostNetwork: false + + # nodePrep enables Trident to prepare the nodes of the Kubernetes cluster to manage volumes using the + # specified data storage protocol. Currently, iSCSI is the only value supported. + nodePrep: [] From e2d97499de5738182f54ccc052af632638800283 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Tue, 24 Mar 2026 09:17:34 -0500 Subject: [PATCH 3/9] renamed: packs/trident-operator-26.0.2/README.md -> packs/trident-operator-26.02.0/README.md renamed: packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz -> packs/trident-operator-26.02.0/charts/trident-operator-100.2602.0.tgz renamed: packs/trident-operator-26.0.2/charts/trident-operator/.helmignore -> packs/trident-operator-26.02.0/charts/trident-operator/.helmignore renamed: packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/Chart.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/README.md -> packs/trident-operator-26.02.0/charts/trident-operator/README.md renamed: packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt -> packs/trident-operator-26.02.0/charts/trident-operator/templates/NOTES.txt renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl -> packs/trident-operator-26.02.0/charts/trident-operator/templates/_helpers.tpl renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/deployment.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/serviceaccount.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml renamed: packs/trident-operator-26.0.2/charts/trident-operator/values.yaml -> packs/trident-operator-26.02.0/charts/trident-operator/values.yaml renamed: packs/trident-operator-26.0.2/logo.png -> packs/trident-operator-26.02.0/logo.png renamed: packs/trident-operator-26.0.2/pack.json -> packs/trident-operator-26.02.0/pack.json renamed: packs/trident-operator-26.0.2/values.yaml -> packs/trident-operator-26.02.0/values.yaml renamed: packs/trident-operator-addon-26.0.2/README.md -> packs/trident-operator-addon-26.02.0/README.md renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz -> packs/trident-operator-addon-26.02.0/charts/trident-operator-100.2602.0.tgz renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore -> packs/trident-operator-addon-26.02.0/charts/trident-operator/.helmignore renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/Chart.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md -> packs/trident-operator-addon-26.02.0/charts/trident-operator/README.md renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/NOTES.txt renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/_helpers.tpl renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/deployment.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/serviceaccount.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml renamed: packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml -> packs/trident-operator-addon-26.02.0/charts/trident-operator/values.yaml renamed: packs/trident-operator-addon-26.0.2/logo.png -> packs/trident-operator-addon-26.02.0/logo.png renamed: packs/trident-operator-addon-26.0.2/pack.json -> packs/trident-operator-addon-26.02.0/pack.json renamed: packs/trident-operator-addon-26.0.2/values.yaml -> packs/trident-operator-addon-26.02.0/values.yaml --- .../README.md | 0 .../charts/trident-operator-100.2602.0.tgz | Bin .../charts/trident-operator/.helmignore | 0 .../charts/trident-operator/Chart.yaml | 0 .../charts/trident-operator/README.md | 0 .../trident-operator/crds/tridentconfigurators.yaml | 0 .../trident-operator/crds/tridentorchestrators.yaml | 0 .../charts/trident-operator/templates/NOTES.txt | 0 .../charts/trident-operator/templates/_helpers.tpl | 0 .../templates/clusterrole-rancher.yaml | 0 .../trident-operator/templates/clusterrole.yaml | 0 .../templates/clusterrolebinding-rancher.yaml | 0 .../templates/clusterrolebinding.yaml | 0 .../trident-operator/templates/deployment.yaml | 0 .../templates/postdeletecrdshook.yaml | 0 .../templates/postinstallupgradehook.yaml | 0 .../templates/predeletecrdshook.yaml | 0 .../trident-operator/templates/serviceaccount.yaml | 0 .../templates/tridentconfigurator.yaml | 0 .../templates/tridentorchestrator.yaml | 0 .../charts/trident-operator/values.yaml | 0 .../logo.png | Bin .../pack.json | 2 +- .../values.yaml | 10 +++++----- .../README.md | 0 .../charts/trident-operator-100.2602.0.tgz | Bin .../charts/trident-operator/.helmignore | 0 .../charts/trident-operator/Chart.yaml | 0 .../charts/trident-operator/README.md | 0 .../trident-operator/crds/tridentconfigurators.yaml | 0 .../trident-operator/crds/tridentorchestrators.yaml | 0 .../charts/trident-operator/templates/NOTES.txt | 0 .../charts/trident-operator/templates/_helpers.tpl | 0 .../templates/clusterrole-rancher.yaml | 0 .../trident-operator/templates/clusterrole.yaml | 0 .../templates/clusterrolebinding-rancher.yaml | 0 .../templates/clusterrolebinding.yaml | 0 .../trident-operator/templates/deployment.yaml | 0 .../templates/postdeletecrdshook.yaml | 0 .../templates/postinstallupgradehook.yaml | 0 .../templates/predeletecrdshook.yaml | 0 .../trident-operator/templates/serviceaccount.yaml | 0 .../templates/tridentconfigurator.yaml | 0 .../templates/tridentorchestrator.yaml | 0 .../charts/trident-operator/values.yaml | 0 .../logo.png | Bin .../pack.json | 2 +- .../values.yaml | 2 +- 48 files changed, 8 insertions(+), 8 deletions(-) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/README.md (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator-100.2602.0.tgz (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/.helmignore (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/Chart.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/README.md (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/crds/tridentconfigurators.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/crds/tridentorchestrators.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/NOTES.txt (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/_helpers.tpl (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/clusterrole-rancher.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/clusterrole.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/clusterrolebinding-rancher.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/clusterrolebinding.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/deployment.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/postdeletecrdshook.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/postinstallupgradehook.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/predeletecrdshook.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/serviceaccount.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/tridentconfigurator.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/templates/tridentorchestrator.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/charts/trident-operator/values.yaml (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/logo.png (100%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/pack.json (91%) rename packs/{trident-operator-26.0.2 => trident-operator-26.02.0}/values.yaml (98%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/README.md (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator-100.2602.0.tgz (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/.helmignore (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/Chart.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/README.md (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/crds/tridentconfigurators.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/crds/tridentorchestrators.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/NOTES.txt (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/_helpers.tpl (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/clusterrole-rancher.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/clusterrole.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/clusterrolebinding-rancher.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/clusterrolebinding.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/deployment.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/postdeletecrdshook.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/postinstallupgradehook.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/predeletecrdshook.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/serviceaccount.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/tridentconfigurator.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/templates/tridentorchestrator.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/charts/trident-operator/values.yaml (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/logo.png (100%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/pack.json (92%) rename packs/{trident-operator-addon-26.0.2 => trident-operator-addon-26.02.0}/values.yaml (99%) diff --git a/packs/trident-operator-26.0.2/README.md b/packs/trident-operator-26.02.0/README.md similarity index 100% rename from packs/trident-operator-26.0.2/README.md rename to packs/trident-operator-26.02.0/README.md diff --git a/packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz b/packs/trident-operator-26.02.0/charts/trident-operator-100.2602.0.tgz similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator-100.2602.0.tgz rename to packs/trident-operator-26.02.0/charts/trident-operator-100.2602.0.tgz diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/.helmignore b/packs/trident-operator-26.02.0/charts/trident-operator/.helmignore similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/.helmignore rename to packs/trident-operator-26.02.0/charts/trident-operator/.helmignore diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/Chart.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/Chart.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/Chart.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/README.md b/packs/trident-operator-26.02.0/charts/trident-operator/README.md similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/README.md rename to packs/trident-operator-26.02.0/charts/trident-operator/README.md diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt b/packs/trident-operator-26.02.0/charts/trident-operator/templates/NOTES.txt similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/NOTES.txt rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/NOTES.txt diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl b/packs/trident-operator-26.02.0/charts/trident-operator/templates/_helpers.tpl similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/_helpers.tpl rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/_helpers.tpl diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrole.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrole.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/deployment.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/deployment.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/deployment.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/serviceaccount.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/serviceaccount.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/serviceaccount.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml diff --git a/packs/trident-operator-26.0.2/charts/trident-operator/values.yaml b/packs/trident-operator-26.02.0/charts/trident-operator/values.yaml similarity index 100% rename from packs/trident-operator-26.0.2/charts/trident-operator/values.yaml rename to packs/trident-operator-26.02.0/charts/trident-operator/values.yaml diff --git a/packs/trident-operator-26.0.2/logo.png b/packs/trident-operator-26.02.0/logo.png similarity index 100% rename from packs/trident-operator-26.0.2/logo.png rename to packs/trident-operator-26.02.0/logo.png diff --git a/packs/trident-operator-26.0.2/pack.json b/packs/trident-operator-26.02.0/pack.json similarity index 91% rename from packs/trident-operator-26.0.2/pack.json rename to packs/trident-operator-26.02.0/pack.json index 556e0321..8d55e884 100644 --- a/packs/trident-operator-26.0.2/pack.json +++ b/packs/trident-operator-26.02.0/pack.json @@ -12,5 +12,5 @@ ], "layer": "csi", "name": "csi-trident", - "version": "26.0.2" + "version": "26.02.0" } \ No newline at end of file diff --git a/packs/trident-operator-26.0.2/values.yaml b/packs/trident-operator-26.02.0/values.yaml similarity index 98% rename from packs/trident-operator-26.0.2/values.yaml rename to packs/trident-operator-26.02.0/values.yaml index be45f274..3d7ee6a3 100644 --- a/packs/trident-operator-26.0.2/values.yaml +++ b/packs/trident-operator-26.02.0/values.yaml @@ -2,14 +2,14 @@ pack: namespace: trident content: images: - - image: docker.io/netapp/trident-operator:26.0.2 - - image: docker.io/netapp/trident-autosupport:26.0.2 - - image: docker.io/netapp/trident:26.0.2 + - image: docker.io/netapp/trident-operator:26.02.0 + - image: docker.io/netapp/trident-autosupport:26.02.0 + - image: docker.io/netapp/trident:26.02.0 charts: - - repo: https://github.com/NetApp/trident/releases/download/v26.0.2/trident-installer-26.0.2.tar.gz + - repo: https://github.com/NetApp/trident/releases/download/v26.02.0/trident-installer-26.02.0.tar.gz name: trident-operator - version: 26.0.2 + version: 26.02.0 # Add Pod Security Standard label to trident namespace. namespaceLabels: diff --git a/packs/trident-operator-addon-26.0.2/README.md b/packs/trident-operator-addon-26.02.0/README.md similarity index 100% rename from packs/trident-operator-addon-26.0.2/README.md rename to packs/trident-operator-addon-26.02.0/README.md diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz b/packs/trident-operator-addon-26.02.0/charts/trident-operator-100.2602.0.tgz similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator-100.2602.0.tgz rename to packs/trident-operator-addon-26.02.0/charts/trident-operator-100.2602.0.tgz diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore b/packs/trident-operator-addon-26.02.0/charts/trident-operator/.helmignore similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/.helmignore rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/.helmignore diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/Chart.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/Chart.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/Chart.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md b/packs/trident-operator-addon-26.02.0/charts/trident-operator/README.md similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/README.md rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/README.md diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentconfigurators.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentconfigurators.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/crds/tridentorchestrators.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/crds/tridentorchestrators.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/NOTES.txt similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/NOTES.txt rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/NOTES.txt diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/_helpers.tpl similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/_helpers.tpl rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/_helpers.tpl diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole-rancher.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole-rancher.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrole.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrole.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding-rancher.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding-rancher.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/clusterrolebinding.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/clusterrolebinding.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/deployment.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/deployment.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/deployment.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postdeletecrdshook.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postdeletecrdshook.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/postinstallupgradehook.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/postinstallupgradehook.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/predeletecrdshook.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/predeletecrdshook.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/serviceaccount.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/serviceaccount.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/serviceaccount.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentconfigurator.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentconfigurator.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/templates/tridentorchestrator.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/templates/tridentorchestrator.yaml diff --git a/packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml b/packs/trident-operator-addon-26.02.0/charts/trident-operator/values.yaml similarity index 100% rename from packs/trident-operator-addon-26.0.2/charts/trident-operator/values.yaml rename to packs/trident-operator-addon-26.02.0/charts/trident-operator/values.yaml diff --git a/packs/trident-operator-addon-26.0.2/logo.png b/packs/trident-operator-addon-26.02.0/logo.png similarity index 100% rename from packs/trident-operator-addon-26.0.2/logo.png rename to packs/trident-operator-addon-26.02.0/logo.png diff --git a/packs/trident-operator-addon-26.0.2/pack.json b/packs/trident-operator-addon-26.02.0/pack.json similarity index 92% rename from packs/trident-operator-addon-26.0.2/pack.json rename to packs/trident-operator-addon-26.02.0/pack.json index eae1740e..b9130116 100644 --- a/packs/trident-operator-addon-26.0.2/pack.json +++ b/packs/trident-operator-addon-26.02.0/pack.json @@ -13,5 +13,5 @@ ], "layer": "addon", "name": "csi-trident-addon", - "version": "26.0.2" + "version": "26.02.0" } \ No newline at end of file diff --git a/packs/trident-operator-addon-26.0.2/values.yaml b/packs/trident-operator-addon-26.02.0/values.yaml similarity index 99% rename from packs/trident-operator-addon-26.0.2/values.yaml rename to packs/trident-operator-addon-26.02.0/values.yaml index 9b251ac0..4e7f463f 100644 --- a/packs/trident-operator-addon-26.0.2/values.yaml +++ b/packs/trident-operator-addon-26.02.0/values.yaml @@ -5,7 +5,7 @@ pack: namespace: trident content: images: - - image: docker.io/netapp/trident-operator:26.0.2 + - image: docker.io/netapp/trident-operator:26.02.0 charts: trident-operator: From 6df0aee4e549c95e15bc22eca479d49a7e849d13 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 25 Mar 2026 08:55:01 -0500 Subject: [PATCH 4/9] modified: packs/trident-operator-26.02.0/values.yaml --- packs/trident-operator-26.02.0/values.yaml | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/packs/trident-operator-26.02.0/values.yaml b/packs/trident-operator-26.02.0/values.yaml index 3d7ee6a3..66e247f4 100644 --- a/packs/trident-operator-26.02.0/values.yaml +++ b/packs/trident-operator-26.02.0/values.yaml @@ -4,12 +4,7 @@ pack: images: - image: docker.io/netapp/trident-operator:26.02.0 - image: docker.io/netapp/trident-autosupport:26.02.0 - - image: docker.io/netapp/trident:26.02.0 - - charts: - - repo: https://github.com/NetApp/trident/releases/download/v26.02.0/trident-installer-26.02.0.tar.gz - name: trident-operator - version: 26.02.0 + - image: docker.io/netapp/trident:26.02.0 # Add Pod Security Standard label to trident namespace. namespaceLabels: From 4f8cdde52e5f641d231dc14717058bf35edb109c Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 25 Mar 2026 16:07:46 -0500 Subject: [PATCH 5/9] modified: packs/trident-operator-addon-26.02.0/values.yaml --- packs/trident-operator-addon-26.02.0/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/packs/trident-operator-addon-26.02.0/values.yaml b/packs/trident-operator-addon-26.02.0/values.yaml index 4e7f463f..f35ae8e7 100644 --- a/packs/trident-operator-addon-26.02.0/values.yaml +++ b/packs/trident-operator-addon-26.02.0/values.yaml @@ -6,6 +6,8 @@ pack: content: images: - image: docker.io/netapp/trident-operator:26.02.0 + - image: docker.io/netapp/trident-autosupport:26.02.0 + - image: docker.io/netapp/trident:26.02.0 charts: trident-operator: From 9e280d6fe7cc6e91d5514d3233ea1bebb321c11c Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 29 Apr 2026 11:35:49 -0500 Subject: [PATCH 6/9] PAC-4031 - Upgrade elastic-operator pack to 3.3.2 - PAC-4032 - elastic-stack pack to 0.18.2 --- packs/elastic-operator-3.3.2/README.md | 51 + .../charts/eck-operator-3.3.2.tgz | Bin 0 -> 150538 bytes .../charts/eck-operator/.helmignore | 24 + .../charts/eck-operator/Chart.lock | 6 + .../charts/eck-operator/Chart.yaml | 26 + .../charts/eck-operator/LICENSE | 93 + .../charts/eck-operator/README.md | 20 + .../charts/eck-operator-crds/.helmignore | 23 + .../charts/eck-operator-crds/Chart.yaml | 23 + .../charts/eck-operator-crds/README.md | 16 + .../eck-operator-crds/templates/NOTES.txt | 1 + .../eck-operator-crds/templates/_helpers.tpl | 62 + .../eck-operator-crds/templates/all-crds.yaml | 11940 ++++++++++++++++ .../charts/eck-operator-crds/values.yaml | 7 + .../profile-disable-automounting-api.yaml | 29 + .../charts/eck-operator/profile-global.yaml | 6 + .../charts/eck-operator/profile-istio.yaml | 11 + .../eck-operator/profile-restricted.yaml | 12 + .../profile-soft-multi-tenancy.yaml | 18 + .../charts/eck-operator/templates/NOTES.txt | 2 + .../eck-operator/templates/_helpers.tpl | 418 + .../eck-operator/templates/cluster-roles.yaml | 133 + .../eck-operator/templates/configmap.yaml | 88 + .../templates/managed-namespaces.yaml | 13 + .../templates/managed-ns-network-policy.yaml | 228 + .../templates/metrics-service.yaml | 22 + .../templates/operator-namespace.yaml | 9 + .../templates/operator-network-policy.yaml | 59 + .../charts/eck-operator/templates/pdb.yaml | 19 + .../eck-operator/templates/podMonitor.yaml | 42 + .../eck-operator/templates/role-bindings.yaml | 98 + .../templates/service-account.yaml | 15 + .../templates/service-monitor.yaml | 34 + .../eck-operator/templates/statefulset.yaml | 166 + .../templates/validate-chart.yaml | 29 + .../eck-operator/templates/webhook.yaml | 535 + .../charts/eck-operator/values.yaml | 377 + packs/elastic-operator-3.3.2/logo.png | Bin 0 -> 5810 bytes packs/elastic-operator-3.3.2/pack.json | 39 + packs/elastic-operator-3.3.2/values.yaml | 394 + packs/elastic-stack-0.18.2/README.md | 87 + .../charts/eck-stack-0.18.2.tgz | Bin 0 -> 45047 bytes .../charts/eck-stack/.helmignore | 25 + .../charts/eck-stack/Chart.lock | 33 + .../charts/eck-stack/Chart.yaml | 47 + .../charts/eck-stack/README.md | 93 + .../eck-stack/charts/eck-agent/.helmignore | 24 + .../eck-stack/charts/eck-agent/Chart.yaml | 10 + .../charts/eck-stack/charts/eck-agent/LICENSE | 93 + .../eck-agent/examples/fleet-agents.yaml | 24 + .../examples/system-integration.yaml | 133 + .../charts/eck-agent/templates/NOTES.txt | 6 + .../charts/eck-agent/templates/_helpers.tpl | 51 + .../templates/cluster-role-binding.yaml | 33 + .../eck-agent/templates/cluster-role.yaml | 22 + .../eck-agent/templates/elastic-agent.yaml | 89 + .../eck-agent/templates/service-account.yaml | 22 + .../eck-stack/charts/eck-agent/values.yaml | 257 + .../charts/eck-apm-server/.helmignore | 24 + .../charts/eck-apm-server/Chart.yaml | 10 + .../eck-stack/charts/eck-apm-server/LICENSE | 93 + .../jaeger-with-http-configuration.yaml | 29 + .../charts/eck-apm-server/templates/NOTES.txt | 6 + .../eck-apm-server/templates/_helpers.tpl | 51 + .../eck-apm-server/templates/apmserver.yaml | 53 + .../charts/eck-apm-server/values.yaml | 108 + .../eck-autoops-agent-policy/Chart.yaml | 8 + .../charts/eck-autoops-agent-policy/LICENSE | 94 + .../examples/basic.yaml | 16 + .../templates/NOTES.txt | 7 + .../templates/_helpers.tpl | 52 + .../templates/autoopsagentpolicy.yaml | 35 + .../eck-autoops-agent-policy/values.yaml | 95 + .../eck-stack/charts/eck-beats/.helmignore | 24 + .../eck-stack/charts/eck-beats/Chart.yaml | 10 + .../charts/eck-stack/charts/eck-beats/LICENSE | 93 + .../eck-beats/examples/auditbeat_hosts.yaml | 110 + .../examples/filebeat_no_autodiscover.yaml | 52 + .../examples/heartbeat_es_kb_health.yaml | 23 + .../eck-beats/examples/metricbeat_hosts.yaml | 158 + .../examples/packetbeat_dns_http.yaml | 37 + .../charts/eck-beats/templates/NOTES.txt | 6 + .../charts/eck-beats/templates/_helpers.tpl | 51 + .../charts/eck-beats/templates/beats.yaml | 75 + .../templates/cluster-role-binding.yaml | 35 + .../eck-beats/templates/cluster-role.yaml | 22 + .../eck-beats/templates/service-account.yaml | 23 + .../eck-stack/charts/eck-beats/values.yaml | 181 + .../charts/eck-elasticsearch/.helmignore | 24 + .../charts/eck-elasticsearch/Chart.yaml | 10 + .../charts/eck-elasticsearch/LICENSE | 93 + .../examples/hot-warm-cold.yaml | 198 + .../ingress/elasticsearch-ingress-aks.yaml | 26 + .../elasticsearch-ingress-eks-alb.yaml | 37 + .../elasticsearch-ingress-eks-nlb.yaml | 27 + .../ingress/elasticsearch-ingress-gke.yaml | 36 + .../eck-elasticsearch/templates/NOTES.txt | 6 + .../eck-elasticsearch/templates/_helpers.tpl | 51 + .../templates/elasticsearch.yaml | 78 + .../eck-elasticsearch/templates/ingress.yaml | 48 + .../charts/eck-elasticsearch/values.yaml | 393 + .../charts/eck-enterprise-search/.helmignore | 24 + .../charts/eck-enterprise-search/Chart.yaml | 9 + .../examples/with-custom-configuration.yaml | 19 + .../templates/_helpers.tpl | 62 + .../templates/enterprisesearch.yaml | 62 + .../charts/eck-enterprise-search/values.yaml | 108 + .../charts/eck-fleet-server/.helmignore | 24 + .../charts/eck-fleet-server/Chart.yaml | 11 + .../eck-stack/charts/eck-fleet-server/LICENSE | 93 + .../examples/fleet-server.yaml | 17 + .../eck-fleet-server/templates/NOTES.txt | 6 + .../eck-fleet-server/templates/_helpers.tpl | 51 + .../templates/cluster-role-binding.yaml | 33 + .../templates/cluster-role.yaml | 22 + .../templates/fleet-server.yaml | 64 + .../templates/service-account.yaml | 22 + .../charts/eck-fleet-server/values.yaml | 169 + .../eck-stack/charts/eck-kibana/.helmignore | 24 + .../eck-stack/charts/eck-kibana/Chart.yaml | 10 + .../eck-stack/charts/eck-kibana/LICENSE | 93 + .../examples/http-configuration.yaml | 36 + .../examples/ingress/kibana-aks.yaml | 28 + .../examples/ingress/kibana-eks.yaml | 48 + .../examples/ingress/kibana-gke.yaml | 31 + .../charts/eck-kibana/templates/NOTES.txt | 6 + .../charts/eck-kibana/templates/_helpers.tpl | 51 + .../charts/eck-kibana/templates/ingress.yaml | 48 + .../charts/eck-kibana/templates/kibana.yaml | 66 + .../eck-stack/charts/eck-kibana/values.yaml | 194 + .../eck-stack/charts/eck-logstash/.helmignore | 24 + .../eck-stack/charts/eck-logstash/Chart.yaml | 10 + .../eck-stack/charts/eck-logstash/LICENSE | 93 + .../eck-logstash/examples/basic-eck.yaml | 44 + .../charts/eck-logstash/examples/es-role.yaml | 25 + .../eck-logstash/examples/monitored.yaml | 49 + .../charts/eck-logstash/examples/multi.yaml | 78 + .../charts/eck-logstash/examples/volumes.yaml | 107 + .../charts/eck-logstash/templates/NOTES.txt | 6 + .../eck-logstash/templates/_helpers.tpl | 51 + .../eck-logstash/templates/logstash.yaml | 58 + .../eck-stack/charts/eck-logstash/values.yaml | 115 + .../charts/eck-package-registry/.helmignore | 24 + .../charts/eck-package-registry/Chart.yaml | 9 + .../charts/eck-package-registry/LICENSE | 93 + .../eck-package-registry/templates/NOTES.txt | 6 + .../templates/_helpers.tpl | 51 + .../eck-package-registry/templates/epr.yaml | 35 + .../charts/eck-package-registry/values.yaml | 57 + .../examples/agent/fleet-agents.yaml | 122 + .../eck-stack/examples/apm-server/basic.yaml | 52 + .../jaeger-with-http-configuration.yaml | 60 + .../eck-stack/examples/autoops/basic.yaml | 30 + .../examples/beats/metricbeat_hosts.yaml | 217 + .../examples/custom-elasticsearch-kibana.yaml | 78 + .../examples/elasticsearch/hot-warm-cold.yaml | 199 + .../ingress/elasticsearch-ingress-gke.yaml | 40 + .../examples/enterprise-search/basic.yaml | 42 + .../with-custom-configuration.yaml | 52 + .../examples/kibana/http-configuration.yaml | 24 + .../examples/kibana/ingress/kibana-gke.yaml | 80 + .../examples/logstash/basic-eck.yaml | 113 + .../examples/package-registry/basic-eck.yaml | 95 + .../charts/eck-stack/lint-values.yaml | 3 + .../charts/eck-stack/templates/NOTES.txt | 10 + .../charts/eck-stack/templates/_helpers.tpl | 48 + .../charts/eck-stack/values.yaml | 60 + packs/elastic-stack-0.18.2/logo.png | Bin 0 -> 5810 bytes packs/elastic-stack-0.18.2/pack.json | 36 + packs/elastic-stack-0.18.2/presets.yaml | 260 + packs/elastic-stack-0.18.2/values.yaml | 80 + 171 files changed, 22812 insertions(+) create mode 100644 packs/elastic-operator-3.3.2/README.md create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator-3.3.2.tgz create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/.helmignore create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/Chart.lock create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/Chart.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/LICENSE create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/README.md create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/.helmignore create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/Chart.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/README.md create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/NOTES.txt create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/_helpers.tpl create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/values.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-disable-automounting-api.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-global.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-istio.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-restricted.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/profile-soft-multi-tenancy.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/NOTES.txt create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/_helpers.tpl create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/cluster-roles.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/configmap.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-namespaces.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-ns-network-policy.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/metrics-service.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-namespace.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-network-policy.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/pdb.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/podMonitor.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/role-bindings.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-account.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-monitor.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/statefulset.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/validate-chart.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/templates/webhook.yaml create mode 100644 packs/elastic-operator-3.3.2/charts/eck-operator/values.yaml create mode 100644 packs/elastic-operator-3.3.2/logo.png create mode 100644 packs/elastic-operator-3.3.2/pack.json create mode 100644 packs/elastic-operator-3.3.2/values.yaml create mode 100644 packs/elastic-stack-0.18.2/README.md create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack-0.18.2.tgz create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/Chart.lock create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/README.md create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/fleet-agents.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/system-integration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role-binding.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/elastic-agent.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/service-account.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/apmserver.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/examples/basic.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/autoopsagentpolicy.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/beats.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role-binding.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/service-account.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/elasticsearch.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/ingress.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/examples/with-custom-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/enterprisesearch.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role-binding.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/fleet-server.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/service-account.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/http-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-aks.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-gke.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/ingress.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/kibana.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/basic-eck.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/es-role.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/monitored.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/multi.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/volumes.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/logstash.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/.helmignore create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/Chart.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/LICENSE create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/epr.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/agent/fleet-agents.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/basic.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/autoops/basic.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/beats/metricbeat_hosts.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/custom-elasticsearch-kibana.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/hot-warm-cold.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/basic.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/with-custom-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/http-configuration.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/ingress/kibana-gke.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/logstash/basic-eck.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/examples/package-registry/basic-eck.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/lint-values.yaml create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/templates/NOTES.txt create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/templates/_helpers.tpl create mode 100644 packs/elastic-stack-0.18.2/charts/eck-stack/values.yaml create mode 100644 packs/elastic-stack-0.18.2/logo.png create mode 100644 packs/elastic-stack-0.18.2/pack.json create mode 100644 packs/elastic-stack-0.18.2/presets.yaml create mode 100644 packs/elastic-stack-0.18.2/values.yaml diff --git a/packs/elastic-operator-3.3.2/README.md b/packs/elastic-operator-3.3.2/README.md new file mode 100644 index 00000000..37d43fa4 --- /dev/null +++ b/packs/elastic-operator-3.3.2/README.md @@ -0,0 +1,51 @@ +# Elastic Cloud on Kubernetes (ECK) + +Elastic Cloud on Kubernetes automates the deployment, provisioning, management, and orchestration of Elasticsearch, Kibana, APM Server, Enterprise Search, Beats, Elastic Agent, Elastic Maps Server, and Logstash on Kubernetes based on the operator pattern. + +Current features: + +* Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats deployments +* TLS Certificates management +* Safe Elasticsearch cluster configuration & topology changes +* Persistent volumes usage +* Custom node configuration and attributes +* Secure settings keystore updates + +## Parameters + +* Kubernetes 1.25-1.29 +* Elasticsearch, Kibana, APM Server: 6.8+, 7.1+, 8+, 9+ +* Enterprise Search: 7.7+, 8+, 9+ +* Beats: 7.0+, 8+, 9+ +* Elastic Agent: 7.10+ (standalone), 7.14+, 8+ (Fleet), 9+ +* Elastic Maps Server: 7.11+, 8+, 9+ +* Logstash 8.7+ + +Check the [Quickstart](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html) to deploy your first cluster with ECK. + +For general questions, please see the Elastic [forums](https://discuss.elastic.co/c/eck). + +# ECK Operator Helm Chart + +A Helm chart to install the ECK Operator: the official Kubernetes operator from Elastic to orchestrate Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats on Kubernetes. + +## Upgrade + +To upgrade your ECK implementation: +1. Review the specific upgrade path for your current version in the official documentation. https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html +2. Ensure compatibility with your Kubernetes cluster version (1.25-1.29). +3. For Helm-based installations, refer to the Helm install guide for specific update commands. + +## Prerequisites + +- Supported Kubernetes versions are listed in the documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html + +## Usage + +Refer to the documentation at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html + +## References + +Documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html +GitHub Repository: https://github.com/elastic/cloud-on-k8s +Community Support: https://discuss.elastic.co/c/eck \ No newline at end of file diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator-3.3.2.tgz b/packs/elastic-operator-3.3.2/charts/eck-operator-3.3.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..8209f26bd99219ea0f3671ea641f289be69f3348 GIT binary patch literal 150538 zcmV*6Ky$wziwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMZ{cHB1dFgSnrQ{Zc7PAq>Sb+w)JZhreIvNF+$FIvf&IloPE zVl;{F#)t$s04TY~<30Nt`+EB%dr-I#yfs@=TXtr|b7o>SK~$koHxvp5l3Yf-AOb5c zc8(WVsCbF<>`$9~c6WDopB)~;e|L9xoB!S0-8=Zx-qXEj2m8+s_jS9ygQw4){R!=E z6pNmxlnRSK?cNzyb8vr<2N(3OL`cfn1YPZqa8dX_58{J(f0UAfu#~Wb5;++~DB&!n z3K~!*70$Bb^A~c25W_i{ppc)UM5OwSAO)9Haj~4B@py#LRTG3v1T9RbCmEKCCg?ch zWr{dMKb2D=7*Rx`$0x@>Z6VkFXu&nag;Ir_?Ci{`T9nf`;rR|Ree5KTq-OVqsZYV2^NX|`zJcZ438po zboL5e5OGDsC_>*8tfX$u6cL4>lAsIsg&W<4!pY?*LT}tyF3TzLl>hp_zT1oU_u}1X z_v=xPDN~p-A^;tdW10b-|5t^+C%^4~)SiryS{7u2a8YD5!J5{i#x#6xR(yCq!_%Sv zGoD;-6vlx5-#yrU*4F>K5BmQ;o~C-ggBGWABGm-R1>S%9Y_gjkJWcn%nH}KiH;4PX z>C@!dH`8yvO{UMD?mau)CExDtK0i#qc{=+xO_Oi;zkQz0z9l%>$N1a*!{^g)Msvb6 z0wkTF@&4}qvuO7)+TDA*_s!(++sW?p`1!ZbzukNKbbs&v8b7G6TR%1VzrtBbQ4*A3h8CLMC8JDfW0&ehj3oak2?IhuLVGd#xtI%_YBJI+L;Q+}Ye9h! ze)xtQOn+WxDN3mnWnt$yK%LJ3OE-ckL84^Lj5npT84-jjXFWCa{TThs>;Mh=b~X$y zDanXM#A8r!MVO*E%a$m?r6hi3QO%K&4Ku+Zeu@K5BQ;yYHnNNw(!}Oe8@D%zLC5uPlHxsls8qplj$z+7kqri!9y(QePZV)s>g&;Hf zzG6#3=2R-Ngo%zDen`rbOCrK`97!&BYReuCwJ5XfjAu0IhpIJ80ZlZF>VpY7oxSGj zOb|(!g5DIK_jRN2Jl2fPxI(EGJCbhef8a7xKp-=%)hb&9Q+Pf>tjsd#eMSq3WI+-- zqk&M@6bZ0}o^*_UI6b>S3D1j+YDsA#r1d0K5+vn9VMS(Tc0rVR8w0?%T3DRqq?|~= zUau2DIn`FI;qpzO`&y%8E5=>=%z(oq?aK^`*x1tjw|tk_e(?4T!YADGn69UJwS; z?*!2UX^=J^HM@1{Ig~&Rr@<-iHOgqNr^cBw2S^K$?LfD2;>4Z-jpDmYW=BoYe<`b zwc=5C{}c4#V*~n2JSCY2j8hX=!WqiUi#vffoja%nPd7Ezf~WDQ-k*g6U^X%+2ctEJ z3zC$;Kv@#{0^Fr3H)XV^pmjfOxd!3Cbuj4DbjbEkqA=3fX!=;-B3V1Jxy4WkkNfo4Q5 zr6RcE3h`F#Om}kK&nb5-?cMU-+`S%b&trg2Cs?#L-Sa;O=_s6F)eKQmnYdH{s1#E`HnDmcr*2g8EuRviQk7?-dsKOt2= zngBULx%P5ae{Wj8f`+{vfdRs4k1DWj+}DX9SdnAnJ6|NcAnAEvbXqF{>t#n0ng#~y zvF+oWXWD-b{`#J>l(M{c&ns){0seL|oB?pra%) z4kojsH|*=ax6N#;xBQYY2SwIi86VSN*Wp89WSb*w0k+20VU3Y}=hew0bg_QdxQ__B z<26R8!PQJujY}Fpb(amRq`!w%uhq;=G>zNiomMTqu);Ak)NZaQ$+lZMQ|VXJsa;3A zbve9OBrh_oz_VoD15*Mgl+DfTSRwA1o};r@$Tro0T*IyzX=#E-R*~rsG0JhF$6M{n zcr^!<3FN+EjrH&;tS&=60XzU57{hb&^6292>GAJJXRm(0I6438$@%X;pT9JFOOu_Q zj3+o-aH%HW?CgGT0OkFRZPh?EE} zW#rex2usNmYWZeL)HNZjl6^x)56e5{*JQfj{IWh-9XdtR$hOr)_u+)v^mrCd@b@K4 zGat!0J9!lmmT>L-93Sa+QlY77;wIeno)DqvOs_gfjI^0|k%tt~nGK#C6QLj$1EVl3 zOoVy`FNJ=qU+P5`Os2(Vf{y3kePmU&8E_&*$}b)Ck|#hMAl17K)_MAk zd_jeSlu`lSgoy|l*|b0{9O*jLpH0wsN9D!N*Z3Zxi!d}Kh*W|ms*b8wt%*Wha~NlcPybGI6Io7ks+954oAJFIt7Ksn zt3ku5z8Y>`6`M|1jjPe(6Afww@^u6}<^`{$0{-pen^!oaDF#Fw)G0M1f>;XIeE;p? z;Q{nx*4u$<(_I96{Pw+B?SmX>IrokMRtuC8N#_h~kc(Y9VKTmC5Gv5hq>C55ESbf- z3l(U!{hFw2E-uaLM4OW{o;n%Vz+P(yoY_Wxs^gIjrNC5J{iLa{dolW%=XuF&^rX@j zm*tdza{!?SV^k&23Bs8oLJt!izdqF(RvV$emn^BicO$b3*M?ccK~#ox8>LKI4G@N; ztQ+?O6;l0;s>P4yYgDp~NQub%BBKda*-~3a4dM9c=eMVCUQf`O;0Ylq!U`>UX~MCB z%FDPOQ(9nITPP+(FfCTe0%2+BqnqVe!{Mc@!jw2kGzxkk8ON#gfm9O#hJnVTV7NhO zsWw=@czW^r!iM>J)=ZDk@q#3mK2PM*b7oBWPRbLx14Ag3+_Aotj4U%yHs48^j0&Dc z_TA1S_#-kud$>6lM5|LwwIk?JbzGP-d2HO7Chm1V<{pQjf3z-EdjJ8(lhGq&6(Cq6 zX@1aa^}T1`#`{kXoU%gd^n@hw@(m9)PhBl;6G z-XD)DY+&Up`AoekGezGLhFP*)%eV0~4V@b!b-F*4>kcDjdPL;CB1~!|gP^Ka1JWxC z-~dWoEYo3Nxj9gRjs$I2ck~Dp#?jfS@oZ1eY6=H*NOQb_5{O5QudPQiQY0feQNj`@ zrE)#$6hu&-8jFs~A_Y5ta{LqW9ikK~3`}Fvr63H>nJi5>-$4p}`IKr?HZAq6A1^Rt zBtt1-Tmcp|S=3sf#5TFc(kT64zo@x#=;(Ta#tV|=AbFO>&9-32(xX}iJVF_t|CNX- zm(2)G#^-abr806wvKakU+eg|%xc4n`!(27sO zJGATGZTlD7(2Qz_J~!E2(9-VJ%wajF2ZLGn*TI*jtCUR3c_regHrxps?~X?R;_(Yo z2$GmY4Q(Rzq|-#k#_q#bMX=pO8M@k!_YULTE!Xl)dlU6QrZ6$2_XU@se`$Nxevf{? ztN+jPk9!H*Lqgjf@GmO}6SO<3elZI<>(zW3*v|9Olrq4;2$EOYeX!vnY1yla3xb@& zULou=8f~xthLxZG@$Jitogd%6J*(K$fhR02I5q246hL#~(h!5Ve;uwz4=-;HQ^R;- zl%E+C%JC(UDCbfkNtoMUFc~NU^^K&^G>6kblzOVYJG?NjE*57+}@gx?4~@LWq95N zuRv)JDa)E5D2tFL=i1%eWr5h@XtN(bxv6qm<{EvUo}qZnyi*43-u@;GAa5 zMy&Dl49(2%Ztv@iOG&lAYj}5pPS36mxAp%&1MVJ=(PLaH9_ht!qO||z`mR`767|9; z-FA*fYYB~=f^KI}n82B)Tc`byey6g7@gJcldXfC3ip@GO*4btJS_2pdqZvb>O(~KW zu&{ysdoAoH@|-Q}QF|jAQ?3>+7-wkBj2B0kT+o?v9<*6XVk8x2DHbWZY{xjz@B+Dx z?*uSH=1=opyU1hbSWI9Ho!KyeJP=Upw1%o1gP@FkFDdt1qBrfVml-DYu^86TL^;kV zVd^c-2`>SrwAqi4*oBmR0b!JihOnoMvrMbzlytE~tM3VVwkxeR2nF*72-F377>9m1 z6SVh@!^Q{4{My+6(u~7wBkLl-rbf0z1(x!fi`3Z#&FlVa$T%(wy&5;$lkSb(+W_FU z10NVbC?jmH7Fu^3{OmRdxlml-IWb9zZRIV^Yn15sM7lf?^1i?jAatk%ySP_G=swa~ zCZ&(S(V5TRxTYzo1F%bUv%;h{b<-uk=>EE}cF7Y}6!ay*DG?_bF?$Q`QDx8o5#J)% zf(A5wq_W;s2K~M|GIhRM5S*#SHe#Gb;2rCAzEu(~@Pg%%B@4kB zFJ;(Wi|gK0?;IKvwC7mQ`NHd_-2%`3{QYU$^#;9EWPG_QZ`P(<8#T8oKNn!wo;4Q( z+$tGsCU}mX$9uc+F5>JOi;9Cfeg0Y=s$Eq8LG@>r20@(pOz>P&p_JNayBJN)2N^v= z=L8bklkStah3}&}Wz_ZCG~?5q9BVG$dBKx1C(L*dJGh{6o<1sgni~v8RfuOWkdK3S zkmFgO7GIAxk>t_``8q=Q5L>DU;(0>bx5_n(!{8?fqw$S)I|BI-LN+cHPE*;HD#{xn ztr4=X%)Ul5H>lZ7BX6kHS2I_rzWE-~lQQe}Rd4IP`KXGcuAyO&Rn*hoc{4WJQT2bl zAi_X_Lp*|H1WQuijiC&}Z2{5~WVu8;Ce|~tTBq&>`k%3~LvvB9AR7p{L#sCGb;i@& zx_j`>o6B0?&Q{_X9BqN#A(Ugd4R&Kv=(pC3O$9QxFnx=~+^0w@ftj3X@6WPEd&}rd zuaew0xq^?4t*iB9G6*e*S7yW~HcV%?9PPHZO*F&I>}}aoGr{tsi=+BF^;rZ9&bZLy zl?vxYkSrJ|n?_K$sc=A3!_w6_U`FtabX}PEww+0vy>@>}%I=stMI~zknN(WEdgC?a zVjN!B{5MN(2}+x?kTi;;nN0vN-R;FTCCq)}T&3V6kQbJaU`M?#g8#_uJ!zZk0?MEOqkA*Zm)5eyJ|6Dm*09O%N=)(V#&2yYYsm8a=lKFV>yQ;r;juiep z7Gxxu;2y9ACR*9u}0}n zvnggF{M6c$O0e6?dNf*N=Lqu zIM@#|a#|;HJ7v~8aUCKM%w)hN^|=hi?!S5Id_W+ywkXCM`nx6?a9=?4Cyc8nt2x#L z!0Tg}pm85tjIG~lRK&$4E&fUbopmlxIg*#Oun`0sE3~|R2hDRjb3$hL&c-CQ_n{5Y zw(f`Zc`ceKjyWsWptajqy}|y6_LwUN@h@-&TcVs`W-J&uyeCltr8oD5(JfdzwyY~^`i-@5QA5eU5Jo30wVjn*usa>AN zOZ4&Mf4T&I-ls?Ye_xQSAVS8fxO*w6)$+f;`}D9`|Lxh{^QRB;e;?0>4?9mrC+`av z$F3cCGZlgUMzo1$CgV?`X9w^?qA4+zXW+0(V4h8ZCcW%3&LC8%lDJko>R$$Xjko?M z&F#*|I2t3{7h$RX=Lm>#Y}Pu}7X7T$zR^EQoWU*~!bM?=(cB+pPG>&K0iF0gQscy$ z!@0^wPQXXS65*<3)(~~w8QzM*bmj@#D#&G<^uAw*=$Z8Wd<6rTe7F9rRycZ6m`+;e z1@Nr>cthk0L7AGN@t4Wq_{FW8MF(ab7T`S}L8l>kc=B<+{vvz?UPUfKqH~zC@<>ds?6T3;mv>3q?2IjMPM zuH-@&3H_ndwTRdxPlwtt>+v{Tbm~?%=QAoY%*X^a3++_`7g$k&!wwXl>w0YeF;BUflx|JmP6%oyrVay>4Y2p5ekAo6KaR5JVea6z(zne7h z?9(W6Ffe}Gs+UuGhV3NF9U8ykct_IN+6r*ep`u&RjU#bzro3XI6>Yj$?zYq5k<|dkZP#Qolm`v4F6p81W@x{8 zI^CT_E{I-mF~p5wW>65`WL~=0(SEw$jV)CLH}ve2emSzd<>=Kf?A9bk|k8fFliKmTv2i@ zM?oG$WW(HT2npvRr7Y~f-96~aPtu|L9rUny*Yvw0ljK>4Zc;iTa|{9gWe$0Fkg$VX zZgWX?cbZWd_P$n^1&3<%5h7Q_bR21hl2j_fl*zVDGE8&x%5JLJf16?lmVBD`b6l*4 zTQCy=5dgSUmG?U@K!=byM zzT}bOA|D(kE^=FRrSWGt*x=VMdA!75p0utWXnf#QLF?xl)3@J#$wZkFtOf}&h3lvM zzrx{~AHL)f;yGc%Lxff`_-Bp5%`ac_D7DwIu142wL#b~6+@Zz8w_h?Lq{7Li@x*NL z{UNF}zo10+{T|Y#>-CpRn9N=}H%JfH(2}A0GaP;J>z6!e?RD@qB*V4?L9a1E*Nd8J z=z9MpQ>4JjC7u&^2gV>}>g^p_TEAMFpq{s15JiG@LiNvtXZCnuM}VdkVSr=Ltg4F} zlsFjL%`(R>|3*`C-XA|ezl_JfwWp%06neY0uRZ43yRx_M?J?8a!N94dlAZk3v4pD5 zr;VT0PUdWUUAV^7Dh{Rp!}0_}aUg<&k^^p5`+`Cp;Rg+By`hHqf9@=g{--DZ$DKG9 zJiGgaaI5ow_V%6~HuL|U9~?g9|J}=DgV30z=rQA}3JtF)Nw$R^_XMQd_2sr)_xxyj}`xK zoM-4?$ab=C$kq3Cw-H>`QF{-fU3O+A$UY^#3aHbx8=uGV8i@wc6(!f>##Hu0#`C!# zbF4_DID9&>6-;jO9Z9LW&3AB1U+u%&^PGt%1&+|F&@DJgp*?N3C(<@CwiW#{o)b0R zMq_PQ^?$*xLYoHI{y^y<&>+%zYv`@eTo=?T?si)^ox#p7P&S@=qb72Fs^Y;Fs1D45a(y(2DiTkt(0i!P{DJmM}A z-wqXYPGZNJ|F%$9FUPx}w-(oHg8n>aOxu)Onz8=`b7Y)IJxykbTK%hvNa){SDXafs zmbdq3u{Md|9gW%sQMs$#+aM~R#58UYzq?q^O)}4&4D1FG*_aL9AWomiOm7gwjac#x zE6dFp`wb%Y3H*WEW4Ah;up@G^+12tLqZq?}Nm&5W zw-vu6>_$0#U6i^*&R|Cx{U;9|_r-r*cHCWKzkeD&|NVUT>C@)<&!@Zl5Aomoc$ylZ zl5^mISGc%SY%?gn)ORlY?z+PvN0Lim*9rPp!Ya-oAG&c zRo#38gI7>e}R%ei+2o*VoFA$v^5i?{0-SDsiMvmV{)inx{2(Ccr=DWVj83u56^^SkUa&e541-YRAB<>^k zGFo7{h!XuelJuXX!l4KI1jEsj=*kz}@0hyks({8DL8HX2l`|jYUNH41*&LX(wySGyd++DyO4$z$(Y@pjf zqovu z*LTR=TJyhuho0~E`SaezbGKY*m%e`t_RG(`Sbcal{`ACuT=|en1>PYLG*tiZ@cCXn z{-+~IG5*_^C4o&IRPv2>H~j9%`IH2JT)BTYe9w+I$} z)ebb9Kv6wbzXKO}s}6vDr{6#K#BJyql7D|QyuH5uHfmrX|My^juTlSRfA8tR-h=$# z$8%Hp|7uod+3S^cH^LzBtx9zaYnf<$HDlS=C0c}AS+C8jGjsU8J7?xATjMCIdCTKg zXnVt2O4|D*3ZD8qBkcN0C5!OFL=pI@9+q(r~`2F1^7GxOuyw`b^VcvANLq|5}*!)bA) zwl^{Xfkbq!X2*9V`}$@0LRr~63@7{%`rDVld$*RV<^(oJgC4_;Z{~LCy3oO~q^*Br zQTtSC-Qa zJ9zfIS^wqP!~XC6JhwSDboaFS&V688Exz|u(H(9Ai5mRe)8FdbLAt+L`-&I+`EBlY z=?1&T{VumXQq}g7y7Sj6XUCd>$O42b_D9APtvD`FnTNN>#yptYJkQ{x>Y{mBGiK{= z6tvEXJY+JppC0|+PGtOq`9B8-`_25HgS`j+e=m>K|Bu5%N*&j7G+y=G<-65cf@$4E zpLI@$4K#l6C2#r+%Kx3Se+K3MV0Zs{Gymt{=|ld{y*xM0|Iu#9(b?$*?0lS_Y2WX$ zui7_mz70zHRkw&W8f{gb-^r=mVCZOb2V6ICzV#+irQ5kj&&*)z(WVW>D0NpyXQ#;C z;YC%TSF`;hp0hogE~Vc<|vGjx7y9&OhwZH=r-EPCY^MXNFIT5eg4d!la-&eMP9 z)8qdY>2wp7Kg=@}|7+L(c)I`m*@ORgA5TL|7Ce37FZ}u*F8m5LX6Rm-6+z`wowYyx z@=J#}*Q#~!u!|5mWk*+-W||xZdiYCt0@10`>aXF>@%x_{ZggM!tsj8=gkIr;Rrt4l z`t(0fUvWk?huqx^46Xn7p6)g4KRtW)Q2*&(p1Uu*H(BNAzA7BGo$e6*fcXcO8|!_1 z_tz#MoKTOsKvdYDApbDP8g}t}1I8fuq8-Rpw?OOH3T>(59g^ScYSji$( zV6~W_o%)Zf5N_6#(d+)MS~4B+i&fpqMBsun3hN+L`}s})+H^5RoWk%*51F6!fb0oP zffwj+d#++UJ$`h*3%LpB@xgceQlB3GPwDt`4w#gw_(P&%+<#MF)Mj-4Bz{S+`@esad$g zJq{h^weEV4gXOaECg<%gw@TcnBDntrbI+gZZTAKX#w*?Y7Q;>_6Q9doPdG zFI56yjkoQxXJz@mhBV+(@m&9_{`*^gN$PcN8<19gr{Uiq5Z${(yr)g&RsgU$)K!7q z!3gqZwZ(w^=bP9B9NPce-)r6f{p{)CgZ$sebF1CE246S#yKc7GbW!W%6K*&)u)XP~ zQ~mSS##3MKo7jAETR5LO)NjAu^g+AZ9JM3iwvpR33J#XFH;iPmAobH{)t1n~uK7h} z((Jc{i7{VMW_bMKk`{j@g3gwZ)!yWvez{PYj5|8%VU3QKj~7_}MAig_#_b-)TU+5) zSo5{ue2$9K?Sf95R8jTSXR@j`Sn(xly$U>>WE|n>(#>V znjth2O3>U^qaW{#I}mM-!xojlA^zs8Rd~A=QF~vog6iKT_y?M~I7DqsA3yHc{l=XH z$BFQ%;;ns0lVJb)RtuiEPhZ6HD(QhZC0Gyv4w^xJ=L(A*QL-IVl3(uBMc$IgE-7~4 zy1j=T!q5El`F{#4GAlDl?zr~*({TOg!)NXD|9g86=fCdd(aXBcp6AC!Ap`HuGSbDp zWCOQXUKJl7-D%a;(0+Hm?Q}J+FK>`f)S2w_DKmnNrJ)IVeZx5vq{wK3>vuQVACIe; znbSfR_kd}@m2A$MIT>?Kpwg3C5HzDCOC=f;A-EVL#qB@ioJfi1WDKjFv59%x_g93e z*!~jq`gTEK|4MO$uQ*K+hBUm4Cd$m6hIev&;epk9PI*%1gee*OF2@P?r=K!DmpcMq zk0)sS%ZFdbYFUt9$CF>jGnx^p1i|^Q#A^doeqy$bp3c=F4yV=&kmpYQlqa_7lF9~$jn$G<^GLJ|R8efV|k8~r+- zeE9fr`@^qemi}FGrvLtRd`Xt__mZVV{4O|Gb}%15LPvsYzBLJ0m}x+AnP-$;%4*Ps z;0ckEhXAjLP^SBwr-pU{_y7h<=Zp*TdrqaKY+m(b_`~)x6FfK6)DsBbDGopUZh!gs zn;Ff9;r-qMSYy&p2G=lWZJ_R_Pc_mu$WY!4+}}R_HV&j@L6S>Z=Jp=qaZSrSE`+vD zU&U{&qKLo8lALL0dEB_Tc)SJbOD^#K(`T~Gn`w5Nenl=9@dgt&COe_^k$E7QQunViDfT+gWuj z3Ohn$+icwYJ+imXeg`Ua$K9nJw(Ho}=wY*!thQp>_x9_3bRIq@?5a5`LxDGEC+A0R z-<<#c`smfk#o5vEN#h7Q9Gm~4c5d4}V7lyXbLYD=h&VcLG;SAq3^6%-^Wyi@vyDU7 zD})jRywUl3XWg4v{_W)ZAK$$B>GzA1D`!6>YfyH!m!`J!^+(eBxkW?~rlVHv{Lh;c zzz?^t&fuO#>4Kow!A~`zy$Lv5UGcy@Rzuc~mv~fKW$4zJj++Qu8`;%`CF)4Sc80r8 z_im_n{&>Z+GA9ruZy5`4ZH($Mo^`WKi9u1nX}k~wr*Gg2Sby8`ZOIoPvDQ_=4cv&W z?7KE@!!tgxIZ$2l-i-2h(pBZf&gD0-Gk97hEb^F05)3{8$sOq0Uk!n-0AHsYb4jhJHOi zgj~?0&4v7d3aS1^)#69fe(e=q%4G9=qW@{LYe&XYpVd$`3xC}#JUp9GMpZyx_seGC zD4uCSuSb-EA8!e5WBWfn`+rwBqbXJ-f=a}9+yWfP|JvW%Yu5jHez^DiVgK(wo)0&u z|LE1(tqum7uT5!#H|>KA32f}3DM6HV9Rh+X4;np`Yy2W*5JXfWi{m%|<0{rvIM=ha zhEaUgM#0seNXd*cl5QBKW_`FOLKkg7wzQ^1&2JSC@a#gOhESOMv(9e+VDA?F1t`%;5mWFYMZ*|B}(9}{X|3kMA!~b zfI;2>eMxXi#ECY9l(Po?=de?+I(JmJ&|Yh(rZYrrZ=S9F__Y1Xxge&%3TMRa+zt)o zb1Sol=f+Qu{dcmwks5%j?f=2Er_KA{_nz(VKIH%0%d>_KZ=U?XDQx_5CdiyhCAyE9 z{ne^aHn)1;tQtzw{3f|T7N^?Uc+)2|!f=wY{Nk9npj<2EM7N6UMv6&h{yRxjl;Fse zSnab_dwaKbFfC~-w$g5jAA{hEPrC>uO9wsNbxMPpDto|@qAOO|G&JFsS7 zb|e|0YP;1fU)Gz#iz;uZ7UftkxeHZ!-+p<5=Y*-~@*C;y=Z_K|UG3qlSl~VLc7(w0 zm4bAvv)yQGEmm?!D+j-kpLWr@tz^xEJe|-uoIR|As{eK)IBudGu?+btZ^x6aQKorh zbI2S8Pu}B16V|JOb8&EWVXdd(RbA!LuQBNX{#oxU~{ z;M0Z;2S9!2wyi@I{xqBxzCJ!bIeL3y|M>arh5MtiA7Ww32hqE+=oNWe@bs^~(EEef z^@&}P*M;tLiCdAcEo^rdGshSYqP7`Pn-YZ|lLxR*xs z^t%VC>z6v9-4`Qv8k_r-JGgTCLF8^Ka@AGz<~EoPC$rh)K??h&u(iPZO!C*9vwL$q zn}ErKOnw5HG$!#uFz+CkpVK_HU!MKPD3YooA3 z9LbfMcLl#kc&#*0$EwOBgX6Jb-gUCaS^_IeUNvD|M4wu!uco52dp}d@a5x%OK zsC#o#4Y&tM+nA&ouk=COZYpk{(;dB`%x%OEeGt6cZs3=S%LHeX&3paOnv?H7c-Yrp zy*$KUoKG4|^=EfY8!N|(sUAf5#v&|}qE~dK!pWsMumQKCQ}VEsTp_lalwX?IHm7j; z1qg2!TRq6_4dpiDbE&ZGh{amrbqyXQwqIgB5x+FCb%=d-X$_Hi5YyXv$h_!}(%Scs ztp8wR*GPG_^!(BU*5dU=$ZIE0JxK0N_f`rqw5Ba^a;b-I&I>Ld>#46YS=7P>gPyX-GBlK4+C@&>CeQ_d3aUr<2 z`=gkq1n-#Ug8zLKU&(~0WM@>>(@;bz`MKx1>#52A%hThN*B2+7hA|-j&ky&T_do7G zd-hQO<6fQ<)$|Mn9jwv<}8(XXpC*I`Hy#GH6KIe8&fe%%`K#qeti{ zNk{<~`;A85FHxx*!X+t^&(t**WE(AciSS$y0=KGU8R9c&p@_&Otg#Z#%pLy{O-aVD zW9a&r7fV6s3*~SfjovN@GSIm|bAg$XrhCLVi^%&VDbrkUwN z526sHz=EKZ2zq4{;x!kS(havF2xW-iWPuVa39`3MBgIDwMwe4}Aw@rFURJF}qyOe5 z%JCAeg)aoZqA95X)Zt}nN>IS{rF^ONgWYJv!9 zG&oKYBF$AfY^lc~6=sU!3`wF8pTT%$1glaIso~5@1_h{aM%A)OmbgBUoa<>!7MRV+ zwkxc)t$RtRNXq<5duD1;P1Yq@)&YztYtUWOa~Z%8L_^Vi@~KQpL0}+tEKMh)ik1tk z5S37gnIxKk(`6Hn#!zskh}gE!wwvI*co{wehBuAWf(YFKO^6&>YI){w3@%1TOiLd@ zjfVf<|MUM!qy$b$jx{raH3yCx>4__#%oi{{w!C$Q71YOAA#8T6+X(LWfngNz6-qKp zb6H0R?-4P)+XX4Eo|i|3{#N=Y=M^rWR2DT2Q5+NFAoRfgN@*a)1F& z!kJZM#s#$Ra*aKo1+%$rpxJ@Bq3a2#sTW`kl3Hd^3nHCvCoGkS<~d0zRwP@xfz(GJ zN3u*72pjCXfi`>6Sb%y(+Mgo}oXs@u`qPo^+i>%1D?dgeOQ{fHvUGxs*;2co*9(s3 zL`k^qt5{Z45UQ!B&`j`L!x`aBw!R7mACE?M)?lKS9Yzt*aqCdZ0H)yzqFJ%fs@il~ z>7PRIoH9)ss~O;q2xD|D#~JBy{WNqekOaK}-EyvVjS+M|Whn=?rg@Pq1O22ifp4Hf zpjvP}C+`bEq|BC{11KBSDe&kKdRtxR<0%3X5fYU$bVYe)77BGbZX@6h{RuT9XE92* zM^>SW3dw7lW#%>?tZ0I>Z0YY4GGbKIOx~*L`7}1olGQO&g;r%g5~4MUc4Qhj2l|2W zkzNN_dL8Vd6fY&hGyRk9Ly&}M4*@34fZXmH%9M-*fvb}h6rEIp<3#%wT9|(1*W^l@ z7HY_9&>=MuG$1tztB!JzZ9Tb8<>1y>svZCjqs3|nYWv}7+n_o4Lqz0Qb86;A5xt~% zO2Igfo*YRu!$SKaFemt0layb}?K*2%TcIu2HuxR9R7U4vq1kSUxE6VRz z6+JWRjE<(4)*-s56z6)mi?E>D5RWv31`#+YHe+A~V&K!X9lOdLUQ(877bqihoEgOy zKLIMdAW(JMxNh3SK6&C$eewjZ9$aX3r;Ljh=l{~l+K6&CG`wv4uB_IK4S>*lI zwx-^;YDmKZ&Bp}@ET18&;?d~IlO->oJVAoYwEJhQC!#E+S2Qhgrio&422USw<_&cS zop{x6a0U$nG%}xWBgr$+a)qEoaUmD92;3n@S1#t5(SI6-^_mY1!i1a`iGX@dNkXUI>X*4V@T0d16~Ud4h6+wROK{1cst{ zCh(NCsAL%c#Zqcp0;Xr=h+)~T;MW>8j#9YQ8c`*!(+)-(q|I(;Y0u({D_FHKC2#`H z6$Y_U%;gPOsnOK>U8zpJToqWysRlPR8a8c)-1<7*Pd?#ert@neAmh>K z2W^BoIJz?~a$~meR680?%(cQIlTn0zd0}r8hSn9?8sWKlNmH^z*iMr1GL1NkF29jG zNht(jYKO9vypIKxu6B~%oh1nAz zX-M2FyAcfLBBRnQ3Sf+BIGWyIxFsr)Wxhx=tU=;)3-=mNP5&2y&uB&>8()k3^`?}~BV5p1mIEKs z|9j8(>-v9xZ}<8BgZ{sdXZ2OLGn`2>8r84Mos5QV$hDuJ_dj>a;i<0e_>!RdN zaNRiNI~E`|z4~l``p=Ql&_=DB&PM)vv1s*ocK?o~CJmr=t<~<~;i1X0svm)p9pm-s zDCB)XOrO^--$uA&6TNpKGtRV1%vz+95$1T`8t zP{Gd;O8GUr#v(mBJDv1*XFlw@-n9FY(ndZ<_-ggNsh^wkAD%z;>3@4S`9>~(SR?;q zZ@-!U@$_*2>4W~ikEeAJ(ggkT+i0}v`X8reZ3>oF2ll!M`{r|x>ET)b>6Cve73CWf z|3Udbc(&h^|AYPA2l>B`=Tpf4sNm^Q{mv9gQ<7j28_x1qrcBUSe=!~*qy*N>^SGlW z?1-JRDKA-i2AQyE{AA@fkowX3=G()=gYkoQsy&_ZFNjovYR`BhN?=g_pEvFQvxCEj z{Lg!Ny5xWC59%(ZBKdewAK3L?;*ZQcLX4yH?~jgytRQz|-Zf1LlHqlGL~f%6VF_`G zJ@wbYZG0nyx^DCH7}yZZ@%fADw=OkhUVU!be+f^g{7XJlQSGY9JL!QT`9FNt%>R7; z{NTa=zn7;|{uRM_gvZ;+{A)U_0gT-jWG0QA&A3R2Rse&}LhnH>$Q(a0NhRSyAsg`+ zljO2-0%-@BRaKYeb07XcW&X!2IHJ-w%u(|O+<)`sO-=q`A4S$SS)xRwa_9I?w?Gfc z|MR`wM*Mg8@ZtW)`*~{NyZsR^3jgOpd=T%CQX&&U3$smga{N=ZV|H9h#dGAeKrNMJ z!TlMv;Vq>RO~O4O*gpxRTE7LRj0-j&U6SQB7b!${k4nYg6mk@yGqYQW&fO8y2)%T5 z9isaF-6*mfc)A0>gExxIUY%~;+{&wZKo<%pm!rsU&y6n2De)Bh`oF&0i}&~9-Dvmg zQI087m@*;&SCV6zO%O>g|5xqIqzU)h{zvvOXj1@3YFUtp%g+T*=&C+Vx1Im>VKRh>iZYux3FGyApA!Ajn?FtOY|H0v5)BYdm*AMc456_1WJ5NR@?+cejt{qU9 z$qwugkDlzhfk))}Aw{-23|Dtis2S}bERiaxYR%^ss)h=95 z`#|n+Tt-ARCk%uY3JVcYQ_)wu@&0bS3!gZP;_AIcg{^XTNl4Ks-L*=?echqrzV7)d z)bd|wS@=^)P<}SrL+$=fr2W%NniL2GuhT{+7z7Cq%sdBGsAT|1PxEZ1a^W=SD z%8;xENo=z=ME7Q0fH05V5$JG@$u+MND#gnD zU?GMzC}pxBIi6JYDB023>0b{nYCof{!P*eAY3Wb7!aIqM&Q9Yh-(P5PR5UDES<9HO zrOVeq{VS@yL%L(93yha#u&`7lsU46nJs?OSi1Y`W;2^OrR2nzBHalQai(HvO)srhC z6cQxib4LH^`}QZj!4*)|J^^eGnF??9o^!lJfpo%1_6l4b%G=hOJFh+5nKJxWLYhYW9XCBa8H<%u+ z)!+oX?aBkq$Gi4^FYTBZUn;%V0%HZsp{tiwon(_eV0H#@YLiJ)K z%V|!Pg!9rwDm``0ZjZrOLrkL3l9DzXoHBHbbCMlvLwLV)rDsJ(dJ@)}tE*ZaO zkqMspte*DRTStdl!*5BIe*6HcND?-cCm>}I>Wv}to=T9hV0CJ0!vZm#^mUQ51Egst ziPBw4Qc28) zvrT;&TlGhCh}M_7zpjA>$`S&&8E11-p5mPWk`t!hAuiB6P!Y2-yCCY_O((73>07(j zUSrnIs@7Iv>6cTdvarGk>nv07;4+2bi!v?m4wgR1<@m-d6^?t=2IfH285-Qt#KJxnyP+MrH!<# zK?R`IaI|WNvO}0T->cC{T7na4|KpqWPnUThGU_Y`W(ZFu&q_tyXdaXI6ZCWo${3-7 zh(xas=Ah@DgH!NSns$4;f8H7b2)R2No>h*!h|bU}{QhTFk%vmOJJion15xNTOUkU$ zM*+IiB@(=3sgVnC0Z>jE%p0Gfy&-5X>@Jq^(bvK60q2 zgsq)F*!{DwXv-DOnv6662ue~_2Fztp8GWuf1lZ#-jY*8`;@ZyKYk;FyrD>UwbZcE6 zR0~2iJ1}w$eLEvCB{Oa-hw%*fLJv8|;?mgDlw_o1(a?O}hUydx1tqC6TrwyN?w~@A z6iYfFQ;gnd@2(P%0WcQ5it8Sq6P#Mjtx!g=RGLTNS9>~t%MY$5d;^eNg)xn0KoLg{ zS5?r_%#}AS1BtMe<^})>f+c5eAW)Ln7X&rgZQB|?xq_2gP#ug)lnP84Nw;oHy0Dz4 z?%4?+gQ#qAdE>FV$0X!YES_7m+cWy{?yg@|qU^ zcQ)`f>9=6ul|BTeD9;U1xS(^&YRuE5P>4HBQI^5vI1N9@XJoAr6iVHM;!(M>9HIBV9pc2)(=%>q|ZCN??RUs`O z2)b2F%YS{dpqBq^!%;2Aun$44;JH&!OAt7|)e}%Ll_0@EI@n)k`B3`Lxh=?Lc62e4cD_dE`V(p76TBi>#zOFVD;+ANTqk?JBRxaSlGC>>kcP; zslol*tDcl!4+N(A6=W3#_$=y6i+8V->T&7T&)ecMwEk>py?(uB)l6-fD+o@P+YQ{- zh!8X|_Znu#^(w&xRCNQlki<@X@7)%@|fKbz3@V0F;U4cTB+_Ybor#&0q~o z%wlB>i`;d0YSEXp1}0&tjdNQMXazYsHS0;U6SIw9Px^smVok|fYgcBhDn8(@#>4dk zf3{s0iC&Zd!SD12*TQX^)q+p>Ik|8hfp#?2;Ik$2W$D}fH!3by&(JD?^``PPX!_cw z?)2nE*?hx<3qfSTL1Xtb3Zz%L@+W@7!{*Ct{c&>qQy-rVa#?j(_qyXUS9se9ZEH}l z`$qCYEw|lK#eT(XlUePgRk+-GG`v(rxgz6gjV^|gw$}Gc`ZKzE*usFe?utLd${8cD z^;Em70wT;(@`ReY7`WeyZ?O(s=UK52*xaJ32h#n#g`GMp{;9(i67wvs(2=ogTBY~) z6rp#e$ljS7L4H1eX(AmsG4~8Lv0d4XBtp~F_T~QcJ1){(GBJhQ&=!O#nqYsV_-3FA zEaf#9sRiZ!{1l)}$#@Is_y{FhCBem%a4+B4$txSFLXUZ24pj8-RYd3=E@*T~mbSx7 zvILb9V2SWtvzqF}6zWe93?s!AiQ$SXM})^-*&5}nne$!C4!zUZSGm2q2g;!4lm5GZ z2;indU@zFRf@mpaDB=0k-ey?cRb@66>{)V+?slbHv|+bb2)u@q-`zmh&=bCoyDJLc z)!LfEoQb+#&}88&_t@)N!;Evg!S2Mi7X`1p6uSWw$H(+4}(lUEo*+bbm%> z${7F?N;00&k8j_edAwHylzRGhgS_Q@t>H{zAzHZrvy2dBlK)R^1;W+N)DNu>Q0h+b zh9#P)w3`aoH0#=BHt9L0JA3*dMlU$~TA8gImJun@yPT)wU9g6F2MBj;511iNInPMT zQUrs%WrFw*wH`WL#c&*Mq2ftU9eQEzCSZ>E6ifv0*tT2`Kyod8( zd8wqk#k=jnqAQBw)w{}hc!#jEm-@o`QLC*LF6nB|v)}LhL|*3|e9i$u9Pl?kows>2 zUvpp-H_Ghq)%;(EgSZLza8u6VMqI;ta}4jzE!?bA_=k51KZ8R!s1F95!F3hFXLba? z6gTizPT+0NK`oRj2D~1?x;hgGe`a_IHxLKDN&P5t2a=Ro2P1dsymi;embt$9K{KG| zTBpnm<->!OE+4~V@61N+D#_I>+jFjY9pq8(>CxU%tlSKG1DL!b3OgBcy;q0n0OwWl z+_z5jVE@uHy}h44MGGQ~UsrdDpt-9vM(2!+Rq6TbB_*^9dh|97>MN|%F>ZHnTEK-*Shb|@`4VWjD$0B#h=Z}+8}zmY?(I|E;Zs*b z+S*&`bXA6Zm4vlKbWPdGGOpd3mmH_x;|#Neh}S$N=02hg?mn*s(n82|#Q>08@2J=%Bd zsIHg5#GKj@WR67&aRXPn13bmGw$F_ls%Zvpt|iADFw>B$YcSWJP zC7T;>53{B9arMj9h_4C-g^!);)3Z&=iSN`&|LK|5xxy3Qi@sS5Xn(KNf}x!fI%k7v zLjtpu=h+gRP|SSiR0hQZa?GGpIK4$#Bs3w>V=PfIkiLSDxsj>v_ib%EY_$+jrk&L7 zu;geZx5g76f?-JTznM9`rjj66cBe@tfH1=}i<|t&_>iPeNyS48!OQu=CILtnNAv7v zx}_4~OzK5}mO%UMkagtf}YuMnFPF+peUwA)ae-vQrw@v>>Sg3}RUa ztQAQU@Q}soC>c~QftT_`?j)Qgq)^h`0WKp()HN5El+E35JC7{4M6{3*W@%(!M0#H7 zz$vXY{a0@+HtMQ*PO&*HE{UZQFD*jW+W6|zc6j!LhZsD7*sxlGU0T;L4M1p`ty>wU zwcSk{K)RJ-x|thg!+AF~OoJn7nynifrge08&1~JmFb!$cw%NLkVOqy?u9>YH7$#?# zhLm=v-MW!w8kE3ZyS2V$8i29dZVgzbfxg$ZTSJy<0L*%JYuGXk$=_7+78*owu)*Tdv zDEd0`7mseHHWzT%!e_wi$-m}M0ZlXG<5Zh!sc>?MPS51FHU)&jf{}}qh&9gA5UCey z(rxOwJ!EGYtkSSXfEGXCoPr!!f`8A|pmwVaGZ?L^4=tl}ex)51za?p3FVCPf@p>!v zFU9})9MR84`nC3YBKxJ{xvdu5{SYgv8+OEkZdZ6>GcK&kH&vkQZj@z~A+KF4EU^7J z(R1qVE4N!6m0uT!Ebj6(s@VPjm}-|Kw&ixDNk=w9BB?7m(>PaTk-vzUwd&O+tcj+iC7uPv|#-Z6itr}dqU7L7wcV&xHywK>jB(OV;)#=v|EzNi6c zoc=b-E~U~Xk-5oqN<%HkaQUi)&?|!U;*9y^7wd?9Ez#H^k}abdPAHp?1I7E;hu()g zqLWIIw_`3^qi%r%>vj}g@&spNlNJE%Wq8XiT!%O&Tx3#)FuKOJWEGaO%!xhkSJQyV zYd`}FDncd0%XmJsU%Eq5%~_Zdbxmw(D?50}5o9b`Rh?xhB^kXMv{kN4*hjElmF^?b zYw*l3UYc?8ZC@2E$MPQ~5qRZkl8T0|Ots0Z(3a$}Wk{4$sVSrpf%Exr*rzf*j0f1P z=ar`d3gg6EU>?)3e9$%;+a=O?TN_U4N++=tixf@C0$)+S#vydUOA{02aKNoXkzB!0 z9-A6x*%IYEHESpBOY(wee7=OagRsU>kd9zg3L-&!DpEJ)o?OgJg?4ASXvzevO$NOe zwWzy0&Y`)+ONr)0Ris0bmiO8B)N3M*`(&~=)O@Z#kZbn?-uok>&0k3dT{!*_;Rm*v>zapG zcQRbs$35$oGH_RKd@?WbvWWlZ22NAN+XU1MV+70xc3>axqz%qHrG~Ekepu`GbEwJG!{$GT1(>^Q&rhR05LSr-dKV1 zqj{~*#Us^NmuDwP#zW`A*C|G{_ zt+=tzWV?Z#zDo|nr`q^%>SY_zp$x_P-iV70d;PS|9?1He9Wa({ZJw%|W?;W$^^V8@ zfV=OPtQEz*nezAQe;Hi1x7xz3eY7qbgaMU93gPkuDmleW!?EuS zX|U2>8r#nf=cd{q2j`Ckq>XAfQ|H;^wc?Q zu$Z)~Qg;Mn+f)-)ZJi?r3o~gw3e{sSG{$kIRBgqkaqxDG9{XA|Ug>WQdWL5Z-+xi! z%=MzxQt0Gx7ErB?^Kdi4( z3yH%u5G42aRE9E$rbMsbyY4P*KBu!VmeVs!{vtPQPUA#UEw$sC5~lQ*V%y*H(xO*|j1 zLc*f}zSNv|daNn?I`qK4j(tFksQQUXJy}Bm_MWM<26G!Jp28-HDY&PWghbZBQKZsaJ>u;M6IzDuhYfNP{SBVSFZgQt37+-wK^r@-QHtN_X(2@5AmyV}{G{cR|=@*iq+ErKrw!3|4qOcwjTsmVj zj|L++nwmqjTJHq7d2msj39fj;v*E@!4{9OH41s)U^Z;I!jgzm4hI=rcn9VZHmPoai&1%|e3PuUxPr7$Sk582WD37u zuj5vn+yq@GL-AkpJV8IR$gkf#vCTp*sxRYCk6s^DNIQ?zG+pn|uX)aYIF6nj96SZP z<>d4F`Z}hVVaQrE8%uh6yl_SUXKOI5?S@s+G%{raQdD22uEW5ltFP<2W3iunjUp&s zv$Ky1p}FLe@#~DFbAtF45$2@1BJWjrdI-uYg~JuIBqAwQT)?2kEYbh_c5m+>UZ^~K zq|uC^lsaYeNPijaM|$-Y0nqj2sbc`w@@s@5^fxlS;K?OXcgOkJ;nSzL$3}kL#^&wI zi`(L{CWE|z^+6@tc7@sDH+J)nxwHchD`EZQ%Y^3zW=ja5P!%D}n2o*>b!zHMB^s$RUl`2FS4_a`sc(`-jsX8i%%w_k-r-4o~+4g{5q z{-d;-C`NySReW`|>sqiNr@WSSxiKhv!3|_jQNl(T*_TwA zAN>~u_jQqd{Wt;N`=7e95L~hsi#8Y^Nc**qsUepsF(LR^kB!SFP~~9y;b`35PPIHO z`Yx%e=nZ>P3|>-I5EtxLV57RwgXj$@K8G}KOsg}q%gmxks69Ob5TA5PBSr?x&a%Y` z4baZ*y6%~dX*)GtY<}i(*vZNQr~7MmbAI_5#q!1Fm@USxts8ZAbACBHVYBbwnEya5 z&h`1tWh9@-J|4=}&H3fQ&#s2occMu>y%PAk@Y#j6EBr-byZ4*255!wkGas?nMqr~O z%iaScyB7?PciyG%1y`F@^+*pyV2xL%!mq#j>dUX@2(9fD!V*l%zg+)t{+ADD@870X zWsew$dc+|N!t4sA?vaKLEPm7b9Q(b4mWG4DE>(`W=?#~qu@(?*&1*vMY<2gwX(u*L z$_rEM3qQP4~M?)ABXq~FtIBG65;F}MsBz43Q^QJX^EgK3<(V}7E zuPraE*VpgSKmJGqW!RX^+&b$Ln(zb~KnBs@7@HH57#T}AXA=P~pW^FX^D4U+n}`=A zp|zPi754HruX#1)YHn`}saGFVb0v7bIkQQXhx9&=)xl($1BSPCN0%GMk!u3AQNat^ zOgrbRShbRNTrM?&CqgAuFSsSu5*hPOOVwoXuLOh%7hG!$3&d-3o_+&5wumL>V@T_8@T0N-Kx_uZnh08-x40}U(=mkG%? zoB56~Pdi10TzHqs6eji);rk`*g@kiHI6ckLop@ENh1OD)XG^0HH3yAj?rgquxY)nA zoT0%7NMv*Ny(3VNNL)f~VVoKhCAkF*|1NBR(u#I1#)50uR+{}{nz#!kZ_4{Wmn-K) z>DF5r=MaFr!}=KfeRpFG@g#m;S2U$@x#P^HUt2F|=HteE&_nyPCv=KBcK*aAyxSc; z14?4mHrJ52m3Ys&kBgySQ!j;I)2D6(E-q0T+y3iDF7A=kJSKy&a=08$`hF9X^|Y*=}AeV?u2RVX!hc-(CHhnE?7+809Q8!LD^on+D!M*bwKVY8?a`! zp;~(H)I0%Osaf%oaj#v`m0=gvjNP`fz!-YBS`e(;TQKg59+37B(JBFV*@z+GSkz$0 zd!5%I#B8+5{>t~8?QT{f1rEY;HS)dIg(2+wAvyA5cws9As>?=Jk`1Q@v&Ri z1F$}XE3`=4e%@UWe=T+}fUnKO@*?E>%N3^j+syU=dOJ0@{g7r7Z53JGW$ry|DuFZM z=_g54Rf@dOj1gsp7ufHv9k-D^0*u_X#)d5K;2rbXA8&3()<@h(@W?I?!4P-ub7yXG z74s(nNvGTEDDAc-4b6R(xC`bQ3(>V|VN9ns}fKgcg>-SpiFKmn*|-_e*oWHSz(NWP3PE z*JmH17b}X%a#6Io+lbxl0`;kp>E2Kr8b)NeA3o#+H{FOj7DU<98^nnH^wrDXr8jvu z$5kF9<{aqan-AAkn3#VC0;QdxQVpM-!g1sP$!(;SlQeCgrI`nfAb6S*H1VZe^Sc4L z8;+fM#||IdfU-AgaSuuQ<{N;MtO~W6vmZnae#O;bP(Iv6*ywF6h;}6uv^@b6!+kGr zdC9NDK!8|Wefrk^ctB~w@7N>2wIHQ&Cm)S1*j8jWN==>Uz8582hUatkMwKs`5darr z{`t68x%lV-mwsHD>OStunLM6o5RAl!Y5r}p%{wfp@g+{EzsEh= z_IwN4-?4u$Eps>d;l>UO(%-CE>DsX;hx)W`mP(;MrmT%Js1IoP9YIi#!w5kqM2-z{ z)??@R)+~o~5=jcuuw_8dV}o|Va5)+K*wzJ6{eOS;&dgd3ISS1HxBo;T#Pd%jIof|( zM?iUjnEb}j5M?6+>ag^RDz5dTs&lHy{(1O{oTUV~r)PZ&IXpqwi>;*0-{>p85t?PT*rH!P(mprFU_g<8GU%JaE5%nm};H zBufN8dBeuF!ZCdBF$vRh>$d1f1DsTC%mGg;*S|dIMveSw-mbUH1B7xRmW`FnK0*-a zvjIi{5o?-Ik493n;=%ex#NH5wl@Q!I_aUJC z78@HaHc;nBEa9VBwDj*QvHZx6K4Q*rp-S-)sz(sDg<1>Dg+WCpN4wd!^N17@{KcGI zQz9(voPp{eNc;Qk{MDE9msn2XUyviyEtFH}%&Dz7jOT$iX1ALRUK*&zzf#&7&FyxHvR!Ylnv8Y79Qbm$?umtq zYy}r@_F12o^jrT<4QLNgSfFN05Q(0y>vDUnraMsdcK#PEw6*DaqpTsjYymN-7KPwi zI1LRuWx3LFhnB;%G#dJE=db23cd`^}fo_sNN^L5CC)aWy{UjK$tAU?5kxN+}OINT) zJ;dlS!$uFdrkEM8TfVrr64S#(dc(z9mDd82A>V*4wKjvTYCkS`yVuk43{$ZSS}fXH z5X0qwRS{o5*Fg!PXU2;aFcwvJAfZm{@;OZ3wJ5c059$3J-PU5|QoW1b;G9v;)iQ*S9~?5HDnZ?8<{U~j^x-HS~|n5bOV zPNg7wMuF@nQs9a=tBETv%C)6r>=OtKhgr39i|R!+NXxY>cwKC4j*=zww$ekj*o-r#lw$JO)$ot=QbCOWv&9(xD+=^NMj$=P8lj4DW<%iaY{vk<^=k zr@F%L#V(Ps--?ZuzNYmy87vPM%0Z%5Oy>?6wF2`XtukDI3m66yYO=G^nOQL>B$Nl1 zGZ{9#Wc*gEqHX+gjj80`vNkp^H*7Ya&y3nvsnV!p2N<(>+Er%y_LR$_n1?ie7k02) zu*i^14Myg*b4X8!dvJ$FfQ+RxsrP&C|^?Ctrt5aLxXRSg_=SHC|yHwR#+YwV;I>Q1lPYrwjn_l&&0 zOBh|_Hkio!-HD6odDMinYEwJ_wS9PCe1C?qBhVOQA9JfhqVbnIC30tXa;5V3U=NvJ zPob~7toKV^^P&*L>4$0Z@^ZUUn_GtG7o_k&Vi#h1T3eM!vYB4+La??P1NVJIjj$?! z9TJOEj_nYbc|{4On6Gp7ScWV*mKbi#f&9@9!p9T3JJ@QmELlY_g;ycD&=8{veHd#$ zQ6oNb*+9NEM-XxBw`s3qXcTxGP7P>)S8B>N%e&jjuAA)RcQvHXK}zPw&`o1>@&{hZ zqTuX)TKx>Rik=!9S(-mI;{GCJ^VVl0RUB0+&t4LazWMj76DFF){MbeKb$N<7OlBBa zTQ;&l4YX1@vK;f=h@GVxWu-7B$+9)-J>nesYv!a&=0^zbwR-6E6jfD9%SK>dhNooM zalqjG@MmP?mC3CbIlL;B--vZpj7DMvTlunk8@#g}ofoVWW29WIS! zy63E+vUk7jWc_TdiXil|w!AOZW0|3+cQmQoNC~;%BMNLhhai?S5OoJf=IKEd?OL1{ zT(0d5q=dMQ%HAIa$_wrJO4M5F#vE)|Ia`>wtqZs%kQdlVmufV6kN4N1L3F5Fw8OkbIo5~^AX2oy18D>dpj9mvB8OXGfWPwr->J7e z&$lnVx@!dI0w1n=(uNDSmK$zwYH&tcE$SDJl!TD!$79-YtigiYn!}MFr5JF$l62EQ z8Sk`%rF3?AVPglZ)e1l!_!*pyE3xJd@6JWga4*nYCB$(UP1h`(E-vvw)D0xd-<9%5 zSChLHf$h*Zl0?h&8>1;*^9`#77|?C$m5v$5(`_7x(7lt*{QkEPp1V-%bz912a|(x= zylop*>(g93h~iYsyUZxwvJs1>t;H#?WCooq5hZ+`|H`G2Pc$OQ^t+ekWH8$<3*cLc zRI3(HhLXM9JX>Gg)!XYE&*T7pS@ctMK~-rhz|4>=mx6GVoLyr>#wj2isioW7wNcEy zE3@fJ&im}1)30BY?3}Mfan5xlpzAZQ4G7xK%)~x@E1Z*jg~Xjj8e zI%2jFQ%f+u z)%;GJcFI+T_3K}CAK@pcLmom(fFJI?%HykZ*OYRv=rBjbjyU-M*YE}?XgJ!QjTaB2 zJ=_=*83Z&Zd-bywKTlwKU|>n(Rp6m#yDQlvW3uL4qbwtjL$i;S_iyaX3qwNF<+|jR zUa7_^X-AqqnA5b{b2xlG#%bTL?DB_mb~I=<#Y?(ahUpXt+3060dd?#NUh*hTy1PE_ zb~Z*Z#vE88Iz1R?rFgV^$zAPQQ&;$m;zRYtx7>eP>bA3TgM;(Nn|$JKx}z*INca-@ ziN8QxJM3-dLRAu%N%z*3SjM{!{Jj28(#l3BQSifg7jD*vfsBs`&3aHoh$7jm&0#Bz zweYYkAM!tH)$X3>kcb;{c6kBi+Y7Ke_``-;IP>aOKscC-qezAa^~)c?=j>K7n0-CW z(uFx6&Mq&oRcUqpfhhVEQI5$v&njLw8^p9a30h=t=?-yds?g%a!Y=?g|2hPR${ zyn_>khyoO=RMi&dQ1LWH@RpjAfF>N+6Eg?|j#f_v0M!C$qn6x)Z!i#I6STrBx)Ubs zs8liZJ%$1Z%Q^;KV8kPv;%{W#={pF@f8vgPiE%)1%)srpZWjyDaS)Phh%2yxfTbY; zue#7ot2GAb^P&*Bt(ztaF+lQ7$z$t`;dy2iruY!_LqhQ;7FWiyEf;8a%VuL0oh{`Q zF3XYfC9YmA*{y0;Hl!cHfM_wm3AFL99GvSOJdSfXN^be${*l*{PB46cRHl))(lq`A zwG>~efGjXSmT*UP$?wOJHz-?b)UnSR?qguYHx_tWdE2NpZ-`D8h)(Q<3*0^6PO|r@ zc+L`)Bz%>)4Tcr2JqE@b3mWCH+qPStev#PD8@LoQi>6uC0sx*=-SDz;@hc0V*{x_E zMW7^Z&q<2S^q(tP1j`-vK81xekJb#63qt2qOACl|5>}RQKvJnjRGNA7M%UBlJvNBfb&e zYD5}|%nr6iWKuD^VR#blJM?WryC|^F?W=?dI{Lk6_%SiUdgqd3l1Z`@@$Q$5#e_=F zifZN6>f2s6s=7B8L3_??rM1iXJYdtF?XqXPjGkw^?B~&|r0a^UuBFnl_!>wkhqlII zw|+AAL4mcy8%s$(=3n9e^MwA*$RYFDggX1DaR<0) zjYFIB9h-m$M`I>sElas>*WL^J-t=_L@K)jSt`*!)qrnHR*#zsBKub+|HNq@bwRn)K z)uhhdwiHpO8?uO2@@{2cUhs-9jG>AA7$TWEQa8M5b*HOfcnFsh=|T26+>KXC><-&e zsVU@I#^}WH+3$v&?ZV}?51ZE>d|r_0(}=o!&Hmq`|MTzvogM%0qoY5)%zpRhe?R&^ zbNI)<9slp+|F(bp`|@Uio{-7H8o!yy&4H?e zDL6>QR4Mp#@Ec6VDfptx$>o;EB;gjhd)A`91Nef)1iVE5*+EcK&vsv4y99c6&l5sE z?UU-2!e<(0A$-%WmZaBrvY2)qtS1f=Xc6y{!u#2iY_xv>U%1y7Q~}n!GUDZL=A?(+ z_;C2Wfve&+>8Z}_2Iz5Visa8Iti zcekF3G^1*^0P_((KDJgL)F3Cj*-8#OrS z`-?Rxnx0Y@7Asx?*yOSib+>ZOdMA8=IphsMEEB11s%E7uY$!;`vrxupx7o-9+E^^K zGdjpGm`ba&VcSI6z%5D1F3P3gTHY3d!c_pICf@%hK)f~88vP&SxNLO)dgKTh5lq)h zSsa72fR_tV;OU`q1P+#Jf}_Mf)DiD0XDMo;+q>Ni?*^7Dfzbz$zHx%hAC5VqVT=nn zK{#cX0#_f79OFimEenKQBUy&z$CPj4-RYbV9*AxiD+KF_;4XI$bR@xw+EYH_FlOD( z%s@PfsBddW`S^Yi>Nb4#6NmtYYg70h!EUFBiY}^m&ok!-Sk!9C{?I|xNe%u=v+*z> zQ#FWq>9URt#GS z6F+_!gPjOQ)j~;-YBK^II@;S|yDPJmf058uyetk22%3nn<|uyr+*Wl9(Tq7tu%HJ) zVdLI6{=j9yZwv8ZI7M`S(AWT={mills8U}K^p@>lZiOS$6-?tpJA*FZ5$l6@Z*|b( z14U0R>9{c4YRr4?g7e5c^IGykcOf@9YS*M>&{4cq9EO|wkrspgTf)X6qt7b^bDrxFlIU~Vh4B2cUz^ny`nUL>=advq@h%kedq4*tYu`KNr)-6O zLDP=m!8Ou5n{~q%_niSjprXZw)oob<$le=tDqC`awz{i1fHtn%qLEeMP@*sutZs)A zygcm1*SOHo7z(r43iT*-W7!}U%#BcgrBTLv7YPIscm|Oz>=@oy%5zGAtDQ}s(EMzL4sPj5U<&bzx|EP zuaF{O4r=n>|Ndg+R~?H(?{}6WeEg>nN)11z2*1YhWi0gQzYM%!(GcVvbvb<{x zUVA_Jf-${NX0y29;QR|GcA$hT&@KUOaiw(AL1@Sr~bhuadiU*F~Xp3$*gSNJ_v5`H$&E3X&_q6H2zsmdF< z7P{f)YPz16;1)P-~m2ZNj$)3oY~`Gev8-+MX#|pD9{*o1+O;$mn7bWdT~g%)Jl)bpHYH2%!0W!^1Fzc<9mJ-Yh#O2xbVvs8-X{h%ISe5&Trm~2J1M++ z$Hv7XgHyn|e-2|9hu=u7F%j`1skDT)PeXHuV#u87a>N)<+Mppamd_F!}Vl{ZLNrR+Go7q%?`Ss5oxio}A8+(0b z4)91F6i-T#Z?h#Yw3u0}Kx@qwis#uaRn!IE)uPz2C=j9>gSop1HJulArT8?CMd;6Sdmyo(17*SyTty1@J;Ub?~qP{1`Wq0kcu=qt0@3?w_^npM%% zcZviIw7cUI+gc0=G^*%{!{WXb-o8bBJ5~n{!T;Y&mbRBD{ZWD%mRuI|{(3A`Y^Qs1 z%|!iA?qki`683{zZY~*v7g`a75&brHIx6;-@Xo<{IYNWPL+f#^Mx)}k;N?BQquSad zHMq6~%|f4gShXz499nQK{F>L%lpFMwf3Q*zAKU#Vi(a z9fXe`&1T0Zh!Xn%#dTX{&WH#c`(VU0ln=I@j*7fBS`uc z$4;zW!^G(X%Q`4A``PKQXtiXr(it!FjK0XsyvhiaK%)NY4vT}TYHp?UkO8{wWwsEV zHYl&9+bNV7KT6_hpZ=-kolB_)Q>2Fev9;I1l&o%A{M&sFrrp#iON6lF!4&OD|Jd63 zU`mnQ!LhZ+!4#9I+sD>E2UCjX92{Fa98C6PiV5w(b8DxQDY^qk&#m;6DN@JuxfMB? zB4wwZTd|WVQcc>q6+f9``)~T(V%r_;p~#ZVifgpQ+YPZP9i_Z8JJ7Nls4p4D2%|DI z-eHMSw>2SicE{D9Uj7+YQdeyN2%ob5=3ne4Hdm_1A+sA1)y(8SDhR!o0ETUjY7B|J zxYQ@+C_wflq>Mg}3u&Q^v8L_SoxLfxCj$u$Is|0(2fmiD4`{%DubQZI>kei(w7N3P z9=%f!Mp1DWkM#A1INg&h_MeOX^HX>~pMZ#9`Kk`Ah#FfNvu z)@}qAoc$J@w&u&FTy$vx*3sxMain$dueu}Ebhji}4&LrUd|0QE@jQmUn97ngI!&e%e&*Q#XV6JJ*aQf*m^vA|ImtHNQRn%-BuZU(|D zP|cj)X}{3*9Z#~{Z-M)_wr*m)cp@|Exzq~oYF|Dtahvtm}9if!Ae*p-TH+qP}nwr%T)S+VWp z=C^gu-hF!X=sWHh-G8m|yn$z}^_}xG*Q8z5N&CEVJ*~{?eqVy)w?kjW3BEMbck#`< z)M~K_1@7!wG~?nUh-NZ8`fPnoFf^CtXsUbhKHB6oh58KxwcOc?yd3UERj6lz6d3V~ zpGfYxD-)~*%LbBNG5Z@6C>>%`_jvOmn@)ZnYlnKoCk*5@528DnYF8k@nl`RTAz4<$+I&*Hk=XVYSNRt2b;OlZBqRC6jfb z6LnTae-csl>JDNNU-B?lA?P?v$sFyGzmjRvmaDH;;kq&s$P1idXI^O1R~gbK-&!vd zYGK)KXEP0T1Cfer;2z1LDwQ+>lCxT3jcG9~@goYTs?vYNYNCxpJ9Mz~e2S3dk^j0= ziqAt|chg5}$0zO=IpI~n?|GT$DKJc0_e(Lm2Jh4sK<*w!^EUWq8plIk50I>*_|Qck zffVewtE^Dj`=XM&ck|mRMUKlTA_ZlZW4>HcoUa(2jR^;(!pK;;DlL|LwIM~!C3O9s z0IeRFDw$mce3H{Fq?|xms)J<2vuhsqWQxp%A6`?nh12a_!P))}c9=q~V4`zg6WY9n z4;AXbToE$#RB&#IOtM?257*b=IpIiySd^GSf4KYY7Q^5WD^$MZBx!!noP>y{1Mg!xHte_ToE9F{R9`I?d^u@7 zjMC6BNhy}l74gup@ZvO_UFvfj8%WKi-fFh-mDIo=a6gQgv?bqB|x<7=S?udD`Mf-*fMT0wtypAp3H zANN}9dXC;jiWm45ZzU7E+ByfG6J2*7+xu&3Fuv@LSYXsA3*5vv)HFrMip+9GDEOxI zrKle~P|!*9+~LB*kvUMY+n&_|19@$jh@mZHM^kZS>`&WRt=-S3cUh$y7S614m2kp@ z1%#ur6J-*2*1%w6#v3HAqJCpX1bwiNF5>(eIKV9%0Ez~0WlE68jwfE7hN5udQc+%p zr;uRyHM37wBs zb{;mNeKaepkXr`aze)At88r7TUs5=bu944z*8e%e3-KqPpBy5uY9+_M9mnci8R7Ql zBm_Ggk)56SP1J3?L_UpYz~T=s>zsERsFn?}HMR0cf-W5rR#JhqDj)-BbX_u&zs!5a zMA|I|$vLf3MBI>n===IY_e7?U6tk{YL25;czo!A^aSyj{I^HoBZT7!2?O(*SAb>xCU^~V0jaE@3^d@sv^hCh0crz+rr zrd_;nE7tjZKrc6VC$;vdMkd2eC)6Qb=^-sHqpdDJfXCuRg0F8H{sNAf8frx{O*)To zXdVt8Fq}vrYTvuch~Ze<+gP^BZT}jlaMYNLn5YvLyr*Ye;*9Cw^U$vDo^ZWN5)K~e zB+Ax^muQdUr)p>&(FP6w0T39}*dsU0%*LTE6s>RECdp&-B^kkJoNH?~&-Z(Ghx5&W zE6Xu7`g%r0uNV}eUZZtvlkYH))TJH^G&7fB7_CJ2lo3w;c3229fA)K8y7v(d*-#r8 z>quY{N>;k()Gio8AjnMl%Bb{&MHi-jwJgx|E${kmwUcR_rXCEuR8r%v4mj6?Zf=7m z?qZaV_CBWp7T~dPBD;meu*gl5QoHk_m3=cPXp-ssr%!k-!r@GD{XDf3Z^92a?Ev^G zFwj*wSmvdZfiZC%Kpv$Dl=-AYk!?nDeej5Zmct1~4Gh?T_ZbnxWeh5fd$UId@2Diae7H+3 z*nqARk&)cA?Lwtx`(kA2o*?|>f|5d?w?3WVO6|-2F8DZ5-oYK9qHL0~^^02)-f;PH z_r#cPhR8-{^MGyt^m0Dk|AEqKp#+y%l?;2^z18V#{(HIlk;2wr1Ygf-yP2_I7XG^+-IOmsfDIlpd(|t7F{<)Ub0D9q2A|I0?1B@ZBDh;%QY z&w|vdy*4s4-za<4VetqFT#%++BjDl zpU=CDD+}AKAsgH#Q3ki|wE|}?gXIa?jM=ppza47eWNM$F4hvYFCjz?u83{U2yeihj zo(sI%stMqkXRs_T3ZIg%^LnZ?6ABbS@6j^8hEsK@PH6D} zOE6Z>x-%Y|LObdHy-eq0_ufS#Wu7@uB-Opd(yP(N#hJL#0hI#G;{|d{% zy^g!EPlr>#rMxzQ(g&$jbi@{$421Bw6-X?IiUCh>(J5=RAg31z4+`yW>ZsAu?iTxe zB7#fM)n~Lnt&lVk+=fpyj4$QvUu1!r-SQ5iplHsHAjzm7%{X{{bpv#aT?~@$g8wwJ zJdg?O?3gsyl5R~~TN6B4gk02s&a$4eP}nEzoYr@|D=l(u)x}X=6URpD$eC=g?+R0< zG9BJmAaePkBzW(qu0ZqKQq57VjMU$ogg~lgTTNe;pOxXl8{uT)CsdsS_GXBox<>dx zppkdOHbdq^`nJ%4a|hDd%L(L2^w5L}wKnUjxWf5OGj(Q*TAf5lo8+p@afa-}w#&3h zR0u$poeFy|=S&*_o<^NCVgEhyo4qdt;;q6W>s*e!4V?rPk+{fqqs=B{Z2k9%)o+Zb zbF|GmC25JO=JMQ7koojtn9i2Dk4n%SMB7MLLj&*vn=BM=g&P~dPJ2Zsv%2b6ai(3U zCdB%?FgZ-Q<8SmescNWtvn4NN1K&5Lqclo;2M7aK(MF&hF0gB1$KyO6Xk$nz2tmaP z^Y?Qy*hF;;$aJ-uF%Szv3Rtn~E$2T%W|4Qeu3k1JC+q*E_lCY*+~VqHIfcQrUeU%= zNS%@OJxVUaLLYkAxTWQDU6-lARu)oDC-o4y&afX$eRUwh-^0hhV|n-pvl?%4rGbUs z5ig(*l`_=+bWs=d34z7VX~@$IuieIKN;K+DAsr$zj5!;+Biw(_9#6E-b2zPxxJ81e z{e)f`-o9+dHV+}YzHQ5+h#bc?W_@3E6JWw;JMhO_&F0BfT&TSzqutrKIQnk>N3Eo( zHE5u6zqul{`{h_aXtUYbcKZs>MF=Ya%|2RXLVcc+yaK!pKX22w zyx!B3>3lWb(Z-(-mPfqiHqU+-Zh7qeEMK79dP=Q0Aa=dKX;zv~wkTZX%mVmLSK;+* zdIoW+Mb2XU40P46&x3p}csCv{$v)p@025NDPNRJP55(Cd6hrDOqEV!X%ZV!?swwQGKpA>G={v2E0EWX#y!?L zF`w9WJVJ&Jecso-$;pwI5Nv3?!hJ%_-6_wY2^uSHynW?BmdixnoSmEAw^uC-a>tl0 z^o38%*>zSvGqEk+ff!EtjA=->d26G!iioEA>k$6pw4~Z->0B`wE|AYxy+OlN1t^8E zxaci7)bsno3di|FnsWq3rF$jb8ceQgPq*B2eS;1Ink9z2Qh$buP(4?;Ud={L3V=XQoJ=U%2$&7!cX}cWziGo*ov~}vH3`^R z7&oxPg!)6iJ@yA@Y!_k65Brg)yZK|*W_P(gx8IRo9<+?<4`hI9dfe`;!l2wv^XD|6 zD3$HhE3!x7v2*%ZorTkY)FC+S88)zz{kIZ}V!(_Mt@0>`q}H>_!+Aq-t|c6!2CDS1Yq@q-QD z0?!-<3J6?@?KmPVCY<#h1WvS$j~8{(02FhMHWF64xzT@!GOQz+tl8%USO0OY&NBX&rPNzIt5KvdAd1Izx|pR>Y4w(2(LCYagJ1jd$jdK6 z7>bav%seCwk1Mg+h=Vv-T){c$-U9>~d*LQ{d~|uZi8dtb^R?XBXvu7Z-2~$4i42C& z%8PPT{(hbl1O!%i`Em49)6Kz6Bxc0pP}uSBt*jQ0*DNbW?pxyyX06e0 zk?4vz->JM{zjrf*mw&e)fs*UZP42+fphrCi!g0L#9umkfex2Xr*RXxB=SY(Dl5ffd zHp72`*aM$%_UPBYrH_j#IwS3*@?Q$?a+tYV>&NkOB$n%Nhvwzed!!ugKwWLz%J3^N+?wuo zlz>H4f(2L0Fpl&QSK^rUKpQ1Q<)qFoZ95wcOq5Xy6FCcsUwr-%)bp~ehf+9U459nl z#7Pt4OTlSbCYM-y&X_(%8NgHnR78am-{wi$%wK?5Qsj8>xB6!CN$rHq);EatC6Mz; zK8cMIw_BO2eSREo`jB6se75D8eS67OI+0>N9D+eOt}u)AU!rEqez<$PDvwPnTaF(V zxP`l15uJB2ty`mNLn8ra4{%}SrT(=RJdMgFe53s465b-G#-H}%4D`aJp`bI<%&zV_ zb?P-xdb2M0r?2MFV5>04xNAR6e~=Ky!MtaU+Vl*1RB9oZJ7*DhL7Vs%vKyrn7#&<< zDb9la4C~ip2NAz0tvMO+&vyk23Rr=N0yJwCln+OVyL_n`ln{wPIiYk+f&09LB|92e zEez~*0$rHqMdw5rmBTW@vc&Bs-43IOylZOz<0z4Jyj~>_Dpt0WI5w(g2a^#%haOG? z!q^YielA^%cwo>X4Qq(3li+rY_JAEvDpnP})TK441a1v-$W}(SOs+qP925Qx#?HVW zWSCMVqf-*aXhYlta(Lt~1;N*G*XosFP1oZr#wqUOXBhKNZ z)c)qSlIc3vUH9?#8!l+irn!hO)(1;w9ehF9M^pF3-SSt#yC;sWbk+qgGTZ8=*(^)hffzz#!}^X?Nin(5}`%0O93k*MYp`0_f(%8`ta*M+iq zeb`AS322IM>CPDkfEGv3&amdyhKhpp?;s-ovOaCw+>aKy5r+ChL3n*{?Znb#KD%Dx zE}vJ0+T7g#IP6eV^xgYW?^P~E^=R+A{W}muL`#7R@@~faf*G%5D1&#r zOjfLuk0@Gv2`bNl$c)u#KI)i}4C065v_9eBVN2O_B7{WY*@Jl}rL6OF=g5Fx{)3*I}*jm*Q%*S5YDn@~j9* zKC2S=+Uhdh9>#ZT%%|dPpmW| zR)ZEO)~O%DI=cOnCYwX~W870@o)>E!nKmgzM~=BPPF<1s#CtN>9pJy@(QY*6Bz>?u zWch@eRDpiQz*DN5I{}b+9X+)RtjcQv)(FRs18<$yn9BnGO+kC<5Z<5O0wIenTb%xO z&MPcNYeO0gY;4I{I6i!^UB~0T4X@4^khOb$-y3I|(#$KFv_(uUbo?yy;XaUE&qSMq zc+=DzufrR5Zgm?l;+>VZ1SB`ZgVeDXT-61+n3KGA1>@Uh&?M`IakT9)m!Ya3G3m41 zdXEBq-vX97LV-slf8Pjxke`T8@_~y$3@yIB4b#KlXR7K8XIv_&NuW<9Z65IDVltMc zvyp*W?Bbkngj>nbecQB4z6N& zbdCNtvIX3^Gr9cjT)efF=ZM>&-`1?Q@`|v_L4$PyGKU#GUC91H*05Te_)K#mDE!NsYko$# zuOt;}YMa17vlf2WVM=;Jd#2IuN3Xc0(0k1%0yxu<>>f}WKNO%rfa3g5Ojw2N^mNE# zTAP&*&Q>8mnf0*7f|o6E(ITVzHmmZ!bHT{bMalZrTp6kp#CXw~Lpcz8t5{UG-ysY3 z0hzax7DSY(Wb?;J;_94EG%pjQEL1C{^g{Fci_`El`A=Q^wwfo5zQrW2{9}rDz-xUh z8{q#G-P3S-RE6LQmg!8qD!}g8+!=5&BFL}hOpnu2DJ(92JW3&L<2 zz$ca1Sn|6u+vvS1PWBe9q5MU|&$344m++3UFLD+-nMi3zVEai7IL9LWlwaw^>J!+lY>P~Dln zKX)-v_u(khjXo?)lDepxEx9ZvTsm#=!+zG=OBbvc-Sn&{Ealf(0BMsFOXwT2f3>8y z*l>fB&or|!pLPm|BmG6x)rdT{o8)?*r&HIvILihNbdvwd8sZ;a*3hKpK!Q6e%iaJN z0Hzk;hOo{6a}RD0Y%+LsRG~h6oI~H(B6rDLnejTby4AkN@ zR~&VIE%IeE_7rI(h&@$lj<#xa7)2HO>=E}DgymgXWPYK4&{uCSAS#KW@$^#vcXJoY7ND`eQE$jKgdiji6yFiExC4{)Ls zr!i;JCyx=8s0TWfM^1;gUG$ElT0%$&mogznCkzOB>VEDa3aM~^z(HoQ-6pPBL7CZ{ zx1hAkH^LEKU_&3n6$hI`sWjcTcm(1X3J?q9O?F6QMIxeQJg=-HQFoYmMmINwhZ_|3 zB$NyUp%Q7@pH{%m7xRGy_KpR14$Ipw(?uj&-;}Rh8-@9yPBGzkIn(pQ_u&2{4lYm- z&Es+4#lq2DfZF+f!1>+G=1-6kZI}E7S97dXGbf|KgJk8_@hT?xtJ4rlNNd9vga=8A z(grLFga-!|rQvOpoZwshX-_2&mrl7nlOAAEkuj1Hx;Yp=Kku)XJT=lZG9QoZo2~Zy zga!za3OSPdfV9Uy=#P@uKQ~+3k%ZULp!AVBqR=w7aG&@~ss_=k5A_=(NpuwKdGFxQ zVzIk%r5eAY=Ym=_k*&;B9hOqsTImov_If8RWrSw+9Zbb0G)pJI(S!x%yZ1vhm2hQ4 zb;naeB|liFFKTW|R5eq1>fLw|Uv<%MsC8K3R0c@D{H77HB*1Ys*Yr{|Nxu zOqSXT5vFu`@f^JX+K1-0C;njbYzPdO6xGH_J=c3+6!(flUwUAuBUcL+V}>{~w#vSl zTM*jXnX#e9lErbi;P0|vTa^dDKinIGH-2WySaW*6E2>^I`fWPY$yK7XF!{X`v$(r);K3zs*nmuDCdc!vhUIY~!mjep7|`cgBiUeyLKE`gk6JYg@E)DRYD` z#v)Yk+kO6~FG+78uKG{O9CqW>>#c&rJ=ksvm!YtiV+P^s29N*N$$NPi?{!axRdUuD$mHji;4;=biH) z9|W2tHldFckncPrR)Mu!!FBPk(}Q!5`wGO`3S&eRpeH0#o z2qG~sK2==NYBP9-bRKYLgXwjxA$t5Cq7gnhTvCrOE|^4R)-z{FAhLsM)uSK>sq4aLg@nV=kPO;=`7Y5bARBib+hmz`A(P$es51xqq9Pk1eot`&T| zX!eo$365TNH3?XgOMb~vcfd&m+6!Yi!Gt@O6`PkVV1CHKrm3k;{?*{-wn*bml9^Vh zbl+2A&3lDg@k+&yE`dv$VnBA8i?XNujV>W&PZ8*s>^(mrUwXN6k#N?`> zb^I=K^Yp7jT2i42F=)Ltf1ILjoqxKKjkI)Uz-tqc zt*-~R326^>%t?iPJBz=R}&8~83q*V%|O2k|6Yh!B*bx)`&kSE5kx7Z5-X)Pb-U8FEY%f#TayKTW~(PR(vZ_ zifivbYBye`S0Hy2NlZfwMVZU&6m(LxbZ=J@vGqh+bDmc9y5?FWcyPK>IgVvkdnK(iKGwV? zaSKRwKFA1CjY)9eMJBWK*MKC9rPI^LBYf`yUq%ZlBdbhDXlbbR+&T+JW#g7Mh}n!+ z*^FEGzk$_Ipk&$W`zqJOugU%ZY~0N1L?(>8YdWAK&5otHIdGvIp{x~|dn;q5U`)s@ zd-z1BZo)Totu22XuC7wmQt8T%b$;rZQl+v0H(4@rJ5&yO5!UKwPVxTp*T*@fAwDJe zQ*3%0hiZH*^wvM|7ERF$sjR*e|t%8Er z{7(8)@9fL`6Z$(lB`zuVeg^{#5fAijTc-~}U{~F!fU%Zeej&cl6MRS4qrxqlNYo*;Z6pEjI6x_nbx9NZlluvclmYvo8`0r z2q*De7gn|kSLvFC@2y2k_pKp=2x}|@6@CrVBftSQmCUb$%nW!G{!*|-2o#r}8dVu6 zh3eLZ8PPM1PqH<<5Z?GV_u#IYvk61{QB3JxmYq4N(b%^F2ob3l2wBLB&#PW9lar{rDAIx;xu!zr&I5$ zigdcqc^Kc2eb9YMQA-C0lXQ#<0zd4axgzzPX{udUpnA!{q7SLg;-qIn7m$8%t{y#T z-7y=*3$3>Z_kpRlC$Qlv(qikguUq;>I7;0W;^0DNGy*y|I#zV(+eOiW9sV~FO$3WF*-?nK*-iaNt zTV#cS=a^|c`{Pq*;Q(P$>kW<56LbkY{1|)tq=!!BUz=*d4bda@9m^+tpDeBQeU60+(pj+ z23mC{`R`~I_LfCXSQ;nl7;?|`*E$fK0sr?3uC&K2p8fxUux6C=Hs3o+b#MFmGyp+$ zCGKw+_*e|_(mr{}v*9yz5SaX(xax|rw%W~sj4Tfq%@76R`hI%W?$$|B{L!)~LG=Dd zQz^%Rs=6aO=dY-e>F{y4f1KmF7qgU^br+A%O>$oiY1lpsm~-Z32T@h9mpPL58yr{V zY&xj{s?LF|>|qxfICOqnQOAj?Vv^*fb@(#4;mji2UHpeMrtdEvas9zzG(ooBcRZos zjlz2K9p4KCHC13^@QM~qt8djCbd%RhBapx(0rY>XD?L*FqplRZ@du>46zO<#9Un{N ztF8pR)qX6xP)#sav`HX*R$Q(1LEAan{#<#3Nq5MPvE|XyR5$R(6hn3n7H{@+h8jr( znPNdynPFi1NrvioEO_&U|iy_vx#lqdJu5ocz9ekO-t-#n>M6(w@XV z=*icaUpj7<R2xqh`{5c zUObWnVshi{Oe}o$vI4rFNgd^81!)9t7;o`i018y1&#N_drPzI5w9-EcG7DM%Rgk&v z21Rk{FzQ&XjU98Zr%}pJ*v6o!?!`>|E%aTCqP=EGmRq zE1P#>U0dYfcZXRrxeD+x4t!U&!a*8-{0+E;o&UzEgdFoPCkMIPCfRFNL$lmVHWzMn zA6Lu&J8;v7ZLCr$r1QN6B$n0wScsD#HcRVzNXKkt^NLffO$P<&h)H#cN0!1K)Rty{kl{iYfEo>P zMjrr_X2nYSv5Sat*va?R3v{OLH{rN@-@B)}&BjO|dI#PeoBCTrrjkJL=e5ATP@LV% ziPK3My6u_1zYgSc^i`9P%2_mIMWPu`70B4v*c`{9U*-<)u{W{}gXChcg%_iXugSTZ zt9olj>e-9GSYtihvfQigeETx8VY#iW^R&&9L&)nkv4?(30BzwJMUp!#yG^^9ci{c- zc)d-&ks%%vab!>Iyb^Y(0k_z4`s3k|F2cnBPW$013}Z2@yHA@&MQ`%_wG4TGWq%Ms zTMH8Zai~%t`O}i-i3dlqBeuDY-U-%lY=cl1=Ac3OZ)Q}#CaRZ0uLsS&JEJILog;`sl=vIh$TAsFa<8Lfnkg(@rK__qq;3;07wdinctL?{) z#>G1X4g!OJ+cWa}wUhjhd&bPfZ=u{;_3ngabeKb)3fCQF2Ro6$8x8;5GYS*7pxZAi zd4Il!$7&;$syVeEzfVFqfdIV&$+@h) zl2O#UPrD^)YE{(pmnl@Q=#k3PTuSX$RL9lV#Bu4bi6iF45C*Y|*_L!FLlr%Z;MZ{j zjSJ6}{yfmv#u2txmZ}R#O1u40%b(y1v|z{WQv>b1%>fO34Huc9jo*5;Aay2>e`C( zRX^ZbSq9b1T{>+_m^?r===^tNR+98@$n4lE^Ruj5NEDrhmw?YH1&>JP?T;u7w?n-S z(p~kY)|P{nPzuEjqC>fjh1Z11m>mUqINLenOX#hlNZrb-cG=|?F{QF5@V0e*$+7}Zu}$!WlH`)@MK*4qI1 za)9vEq}{B|?-;IxfLZ@PXE<^y)7OKR%1*1!sP#AVI80fp?N@R3cVe;IhC3RRE5Cpi#** zvGsKJTg%hZ%M2ZuEb1>O3}@5oq_#U=;(&94<6wxViuHi3l&O0k1`sHhi@cc}*6<8N zteNK>p0ig`;OQTm70hNHlCqMd;wA3kya`iP={N%)vVD@2Ap7+~qFRIZ3BwOYBz}(s zO}A(L>9touqu7B;_>U{Xl0OS;wgO^ROGGla9luoJ8 z6fTH=up#$`tUEs<(e~GcE7@umDfNdc{2tiL{^Qg9m40~}DGW>xB(T}jvd}VV>ys7xb2c^SJqQ-CKlf=0F~-^26F$ z)1IK@n#DLAFdL|l+Ds=Q1;(tIsfC0~h=gv95-p)@6ywXK${U$g=HI(kPgw>bBlZR{ zS=X2HMm_ApWOd8-gM-0beyg`}L2q}Jo?_D^StEj6d{E0~pmw~fw7hC!5-3= zyVfdc1Jik%5%_ML?C^MWR$$3gE$tFe;cD2lyfyI?xcvSSktFBvY+~-{X=^sK=GTOY z2wK7HTVoxGNgnO%^e z_gh!`q%-gGBV5!f&GBn8<~SJ4Ey3FHVd(F=Nw+X9&qXT#y8*e=7b!}|V4f2*x24?o z!{5R1*~YkS+MD(8JX)*u@b48u2t3oAclGd{_is!mGmSkFMgJ6i45^V%%(lsBTS9CA>f8;qQ#=p69Ym^i&4*ik5ah{aS}92F zFYhZHiiO^-4he=&og*jeT_Z}Vi+ZIib=%JV94TyCE||j?u75!5xn?I+NlqGtRk4*< zpODTp=^p+tKiSD8=Y^6Xu9nKDAj-XpD)^<&mTkUWQe(@$;-@@eWJg^#dFfzxsbGOnOmwxJb~Unm zYXJB<6ibzn@pOGm%6JBdXQj;dcIdl<@Uf5h=|e?fq0Mn`5l{2o`lr7cM;~v6&EZ() zqIk!uIPv;)k?AETMOrGY%XT6(4->7yAl*`}^Yt~p8gTa9bHLnvj*-u(_hR#~ed32c zr_|L&F@}EP^YGZ%a}^*f!kM&h$AII*fhh<1 zim`s7R?ne)zJ7zy9Nx!84E-PEr;rD~P%-I$7v=z(%p0}}R7?(LjLp8@YXc3|1heyhf++x+d zV$~lYdB2*Q*sso>*QhbD{Kz%E2!bCELLt`lz>L^SQfdNzmGR?vpt1`1eP(2`m>`uR zr(G9EKb1!dZR);UNKo^Ae6QiL?ku?SM%C-;pwxtkSO$xeQ^ho=o;dl=@KFwAIzSAc#CM30zKRrR8;5Jt+lpy3E|~Od1o0?R5*X+acJ| zJOSmjQsmUxfVhVOE|7ghXE)Z?@hn`S_|R2obHMiYI1Ad+>)jV}640XD-99+a|Ac6~VN9xiB&EH9U}JJ<|qnD0Olj%@o>dSI=lND_R%^9htjqZ0(GjwppVGn9ZaS z7~w{c1_n6XZ}S`s}mtl9;nA|0we zup5yfxbPS!0{Tu==w>v`=AF2}k(9+h&wF00l})+k7I0>Ij`GkDL1ngCuLNkZd;4!$t9Kn0&nh)UNy)On!y%vrhtT#v$o_)*{YA>g zJL!t$3pWA|iCkim{g*r7`&Pd!5!i;7qOImtU^Dbn+}!EKHJcYxT<3XYw>>o=72dL+ zeGr`ZG(~2=pIokTgFh#6>^puW%wtAHiL>P6*62oxuCLaI2-`T)!cxc{@V-u|O*;kD}xww2q#kXDXr|}&j+w{7WojQ0Fl%kv;rBd)K=He1ckvbF^ zv3p7NbUDcHu?)eVsB*jUvxr2ET|eFd+3pGoqqq6;eBEey29I^*!g%xY`k?g|=K0lG zcMkJj-8oiu+&@_2EOk(2r#l+^$s6Y%AlqNhT-jS1upijoG&;XtbFwseM7e+Mfz;ii zyb`SZ%j5Jt_`=pJJPLBc(1;LH0Up{*2;0!CU zb7M5!#q;SD?ShApMN`WM)hr4>UpeJ-3ZxJ(ThXl}^-V1ac^A*|e7PJ064Lq%Tsm@M zn*go=@{C-Pd1tb_SIm3`cstCy08PE#LPp5CNKy4J=$Od!N^FTJ8i$rlA0G*Fw&VSM zk;?(ZW^CoS*&z>+#*CkBAnq*tqDnA4jbDWOZYXMuv@jRFMo^oD+7CbHe(K?9&)EvTv?ie& zEcR6?=sJhodVSnwxC7*+YS{sG5F(f0{SveEEY7KO>_o_mM_Cl8suY7zA6JQy+%uAI z)z6(*`Ax@^t5&nI5bUL^HE7K(Tpz!eBC!CSKQ?ZFay3E>^+}lAl;i|}4n)^ZrvnKiR21tiCmt%@EzznR1~#Xe;oL4vkQfC8QN}+t83lx=;wDg^5Gp2 z1X<%I%x%8FF-eA1!Mm)H+l$jg?9Z#XSmys~4g)weJ`y;N!#)!kq4JtbPOr|@H!)vv zn@j4W@t8|~n7J<{Wi=LVe3hcr)yfrE%kWSouU*|Qy(Wc6t-peVqKzp`@~8(r;3eaU z6{@)xa@eZjMM*8JK`W$2&ij`{8~<6US=6tNK)9vFkrrxYpVw*yAsa;49TJnTX8JCGeU4)eY<)n4V%ar3$`->1{DsnMFIrh1bo3GhepLZ zk%_jaEE;?3)T;ghKj7nUforI|qLL*)<@6|`NLg3SF3k!_n@r9S|3j2KaL_gtNARaU z*VSdTIt~$$7yDYidzMb1OJISPj3{+{sMoM%g2^v;)`_U4F}%)5#T$4hHaF8(`&zTM zLpgQGY@y$r8}^9lWYib`OldZr4eCvA0N6!679-n(M5IDhGSLg2@)%3XWN}hOatIPEb~4 zsImU;N{S0B>D=qPh1An@J;Swy6gM`?^w2;(!z|C&<&cq-wCjz;Mxe#RRN0$VFGNH= z+*}ZNJsP!-j?e%MmZpwoM({k|+Z=d?7U735t%H&y@6*}LOTCESpeQA~LA(2DO3-q@ zm_cPz@4addtYrYF9J1|sF5y_5r-wRgBkBv$=wz=an3z31=~^UiqYA_oOttNvqbSr} zbkiOU07`BTo5;WYj~nVHebFuK*`4A~z+WM1R`;edG?Nc{v#*0h!VHl?!*ei#WA88; zL&7^zHoeKe&Jr2F(1sYh6D#&qsIl^tC6Cror;K25Qr6*gEN}$uHK~!$rB%27 z*~2KILn2Y}EP^ZIcZ8lrngKPBr->j^$XW%YpMNC$=z@-c7FY0sUkfV}Gsvfn7g_L# zr6(fp%p>M4%2+z^NiirR-#KbLcSbZiK56(3aHvN@$-x2)hS6kH66%V*AfDyhqr_EP zulEgW^4;{Of~DpS$Y;sZuGX?MPUQt=K6P%*+MnN+GP!F_x?hP;MxS*bl{qAX>o{^s z9G35lDCEl{oqbe9!{!|Si?+9ZitAnUE`z(fySoJU;1Jy1U4py226wkW@JpKRLQ0WxbuHXKA|3q3WBfCa<=ID?utD(K3juu) z#KFY#A2lz*nfdB1hfc>9mUxWS*A5@sy&_AKPDn!Phzo(F4!d;RudRPFk<~n4QfGS9 zxTdF<5=Xp9gjt*M?}%jt2ztH*UZB@fvABA09+jsgL^@)UYTILRTLygEGtHN>E5M6v zwqx1qQ2CaR!IQ^36CWFjoqu$dbk)Xh`d#scet~nNn7)8J5zPokcw!3DJLHQ%58xP0 zG&|_Z%1ywbGyZ*z3B9Re-3C|vcVBm@bC-~AlhnG$-cLBVO`TM`O>`NgO~xF31JvVD zBXiFp#BX5u`q5cA<1otGaEerSTj`~?>rwo<;R29Ec=)ZPalLhDNaRp9N}u9tTJ{ce zXV%Mb(7_W2+i{I^R`LT_FA0hDa60?7xqY3stxGnEI5xeeR|&**3+T0VHx~tPoJlC%Y*q{l3&*$j?b>4EY#XW2W5b53jV`zhV1ryYD-dIyyZ?efHZge{J@Eo*q9x z{$QOtT_*W$h)6@s0$9Y5zHR2evc@yuj8?wcK$v>ljj|KMQ@)=ld;HgfU^)*`s1y|@ zWs74q(3C2GR+#Bg;`V(}3R(8&qe+a5qi)(g?4O#!0-8;Q_5JZHHkzx-Qgz$yKxTW-=Kust;uqTHHg8be!_klkM`58_#i8I@+8VDMqVzheHl=uDjV zDV$Wj)#7${0ki4WT^eztaBfBiiW~|ndGELpgwS5gsw+x3{Rq3Z_qviYl<(-h&p*Hn zDj{_qN^3X>dsSXY%qq?d_2G07us|aD@HV-4;*B*HxMZmx8Zc`snL}Uex@^78S3=CZ z(~I|X{D)bmgEz-a^N2p~J`SsAI7gxX_*i-QxEivzb;SG-t_7F#>jG}d{*s?F1K#E2 z_!CVZEHETTU9ZS2ck+6nXM{59sfNlXJkZ*2zv!>{KtR$)e=_IId_Y{b;Yg!>9eVE+ z*3|<5;xEoyXXbn334y5yOa4});-~|uD@fQ|#S%r)Qm86BkHRQDD>QD4kx|B5i9#BL zeP9*Xy^w%z1v@y^Y+gOuylIDW3Q$3F>OvNipv>en&;jXa>dAo`MZ*_e=A!Us>HLqy z7m_ba(BECbp$#I7l-82nE&v2nnnrBvvKznXSwfel_)r>*RAyl@IVZDLd1M>E!L{#e zNtC1$G@b-&;^v$Nla-e71Q9OYBFWSrji-q06M&*=8Lcw9exPQW&mKOo1=LKN*%)K$ zYJaA^B8aMC!|8{m`qdm;=A{mbrok7Hu{}iMr*}Qs56W3#M&pk=Yh;F*4eK?!l~^H| zVrGy?yVI!h>$t#~Sr5$6CA;|yZ-RE7`Ilgrdq0K*{StIo&lApT(0|wMG-P;8n^u@` zzezS(T4`4txy#f*PiCQCh44G9R4w2dc~g*LVh0fH$47S-L3+>V#WTS|LYmoJcO{BB zsowlTrXOC}q7ZDYhw2ymkXr#V61fLr`%mBQjcC}H@jHB!vAyU;QeD<2teg8#tSuWc<&-OKZh zrdbJ$07vRgThok(!xLQj?$2R%KmN>dj&;V{B*gDV-Mb$4B{Kmr$ATkF#3Fr*|rU$n#0>t zwIR&Y!tv$@6Zz3S>dZ*cdw+nIeI?FZem2u}b;)WdMXVj783Nv=wT9VD#g>@`n|H2LO4jv#U z*SvpZT50GNh3#n8i5?m}=cw{4HJ+c=UNQjsq$9sTd|;`SU>vx(#2&s_3irs^w7ZQO zvYaxMEKiy0|gGqvM8As%A^ zf~^rz`oCFzM%Btx`pll9qJ&OcwsY_=`c(+Hskv`inr@0#5{RWiZ|8Z}JnysqFdL66 zZE?3IkrRMp70d8G`xRMSQRTB#gQI0Kfh&8r?1Q4)OL>F z8@x$G<*V7$)$F5$lAS04PbrVypvv`Qo>@556piD@-Ba(`CWXeD2hc25u5s}kdu2%&8;_ih*z`= zn(I!eTPUii2?&qc{aI~b9wpgH*yGhR3|@_YSmnCQL>WnB%~cOU$JGcmZRW*)3wvG9 z(K$?6q{&3K-TV_b+8Z3a>Ylbk1CNFJS~iZ7 zzzJoMi^?O9U~{L>223aET<%Tn2;4>fs6_*p&aB|5$>Jq#v|7yYKZyc5KC{@M7uqWU z*zG4`kqvkbOKoZL!TFWqj5VJfJ;e5{FjUm?(h^znNc*mE1LjkeIh&DG-RXen{R(wJ1zkWo&Ui}H(oTqMuFE3!K8!4CNt5z$>6w-1->y|Ray}gIkCiK`G)n6a;|$<#Qg7wwarSQ#MmeqE_5TF1aic?v_7Xq{lYreQDM)w?$CX=a^`< z!_dJMGt@6r9OZlHFAp9m_}1L0uLfOTkJt?gmSdAl!Ap5IN%8K&L?hE6Q0|a4Rve?H zx81T^(#E{Ts?l!HmbaCm=it=5^R&Suiujb9T9RUN#C<(5{-5j-5bOZv=dq{yULJfi()D zw%KG1e_-u4*~$u-v024WGfcHM4P^qNNCFLuM%$oW49pf78jgg@Bf%n>iNq}0)&cS4 zjQAAVR?nhQGEZyUK>m~ZE?0}rnpsQZZV_@&81y5e;^|{rq50Lx+VwN3wO~CZ5%u0T zq4`)j<8QUAVY%+3Z*No8QmDmwWU(>_tr|Vu`psU$oY?#wd2x%#X@UKS0Vk{%M8w@_ z03G4{#DqclvUx-uLX#0M*@-fpHucAWIWt^^vc2od5Z$ylZ?Mh zmxK(z$R$;^n%?e2y*jqFD&wTbcJXj64{n$jyoxhbU71=bH=&eAHP+bWi1;XaSw9zE zf3xNhbpji%x9h*?@6f+24}5;lXz17X2k)|?RiBa|_9*%E-8JQR zAG}?Ge3Ayp2nZxg6Ve27N}+%=aR`uVekyS{mlSY}qA&DO=y0UDSm~|dEeb$SMP%vi z`e@hJ~P0&@UBP*as9UC`N$AOf9Z)EPC z@@mPt__~F7p$XWgrdBpFN}=qOut$eOlN5y6K<2pSHerR^TbEhuNX=NRxn~W& zY#?Qv_p2BYD{2)(Pc2St%E{(08-UCJdg7Xx%|c|3Zzp>`R)4!|)G<&Y?y}r*#9=Oa z!CICqajkIB?>M5vdi(T~I{ds=vOo)lUODk+@UID$sq7c5tw80zccz7EQFL{Hv&9fn zGxo*b@ERSkLAk@6Vh=BkVod%s){l$>$(SipOJ=+&IjFMD#^(HxZ34!~JM0826o90s z33%H$5jrFt;5>L4LA@IG6W){t)x=KYTBEIpXBxi+9Joq$>xnsp*o#3)I|1brD81&! z0z{bhRXbPgMq``(n_fG5R>(Kujlxp`xdFL}v3}7leioY{jYdHVAGv)UOMkm-T%4&B z%hG?lYo09{YkAfz6E~zj&v}sL4`6bE?dw4(Pmx~&vm_Ixlo8^!Cs#m&nzQDSXFl2$ zI_7}LZh@`x!4p=`$8kiIXWRZ;6>9T!F;Su&omPt+Ci5s`NTPT1kyIT<@j?1byq~>Z zxfA2=h-+kZjtTm~$u1BBp5qGflFK-3FDydcrrT*8 zKe~SoN=i6j1DtRy9jDerb)zs1zsfxi9$%&(H%<#Z9jJyr-`(I*vG9sB6`79OeQ(d< zI60=YS!$lQS$36NoYE>UDTm3`9o zw&tNR;uFtkz5{T?f;=4vFq&H==lFP;zdOz+Jt)B|Lkp%a4xX4`u_T#}efS)rFn^^w z4N3eP&6MLo)5)c@fnQnJe@d5M#4z9Q_RJ06oSy+c38visM;OEvToVGE=vTUrB~+@c#%>e)G8KYVR`Y7yQ#a$4 z#PbOaRJP5aSqK9m_D&-0N83!&roFppzMt|(CfiyFd3psvu~hN|j1mb+vVMoQoB>Ia z$`T_H-v>dRZ&_-m5+C$2+^C`ZU%a8CBmDIYRfL((>M)e~xZ%xdT7!Pm$*#asyd?46 z6@LWpba6G*6431EeyA#9_er^%%zE!boOZdheLf(kqJ|`~t#?|51YCR--oW$V2BZ&5 zY*V>m-T%{Ha|89)t{|5HNP>~x(zm=N-lmd*94!-s(V<)a>91LKqS!l$LzKAq)bImL z*S>zG$yV$@E^cCEZR<8#K2BGZPGe#AI5oK#%TlHRos;RZeP8BYVN9HArfOLzp2Qz+ zm6~g&Sx~0hZ45S}`BHsuo$tP)0PY_+2z~-DS(1ufGr zHwh4T%XK5va5J1G5=QpmPk)Wb_j^92$)7?KSceOxDo+tM@bh@z&u*+WEOj&2j@1k! zhizm?X$wiRD!)}tv`a{yE9KNfbg%eT+#IMCHg~c?A{NoY7hsP+JoJ^9eUkWTHWfIeK{oDHs1v_$$gwWY3Ld})& zwT``WGF2BBRq0OO;H81J&yBeVkMi-IO=A#qm{y){UwhVFb1~caPxwR&P zvTaU37hv;XbCtS{($o+%GL>`F0C~OL=&00s->Q`vNwaaUyJ6gpXd$iJKGzNw(bb6i zm8=>vddf4rQLiLCG1Wq~d%qCiLg^eK#3?^1A$ z0zgHVlNRTs^iW#~u8yti<%;(22wOvqU5RLQ4~s0#-w0dkwlhE0}sjnpwrrZtD z#=7Dkx%q&JM$?~3nl{_7k*KRm{6Tiz_Nnl~78&FBCJh?gWhZ;G;2?p!e^X5KH*l8d5pg@3_*znkUI7*AFD>IW62 z8|6RcCy%(9$M;WzjRDkPTUePgTxM@y7oo70C5I2R@@bI_{qP;~f6;v)$^W=*6c+G- zPTk3G%yCpeyremuBvyHNIwl6nUj8c0AGP5by|WA`$rCb`TU5IR?JN)JAP%n~O49kdA5lOq=dUR6`(L7f!oNjHOiCD>3HX8tR|b{>-hlN1sGo&b&)Gm2mSD=e}I1}%oB zCN;|CB{NxWs3)`1^+Fwkb@@M{z@j(S$)E$2AOix9_X`yJR65vc*!Iv$P)r%8k4(829RBsL)#agpyE zurk#MPxlQqt+KvBmn6-!B;EAqjaVfU`=`_vP=gIaB{YH>$C6~fj5zR~Os`O4?cwe! z_>V1{7+4oO!FWtvkzoz%;WFYGP0{I|nr@8PFN1~>!W@h@tT{EwBU4$F6OOKM>p*TBCO zwyoC}g?}n+n4BM4g+DLX%IzyYy3WcWCZB*Jwe9_OXQhemTn1<}g@uzVif)A-obHGZ zk9MQxnRBpd7*qt^y0mTQ2->G@x{XckBQuMp=Rt$?pc_6BiKa`JI(XY6Ej`h1%TFf+ zPK%GaF@N?9SB#^!5RE0lEZ!fQj$Q_edMb4PY5>t0A?z7va?di$7?L~ck8@VHPC+yF z-#%hH)C&eH!V6_U#eG-r{)${v&&6E{WS}Tf9AA-{(ozsbIH=pEMg9L%7o}rYq~_Zl zFgr=-V)rX*FdB~4zijEZ2=FG&U&xi012TQrO`K8MZB zHzPJy15b7m)V=ofPGs)Cztls*cre^>R@1#%E~R*sded5#!~KRHPy>JJH7u!72YNAS zHqcBlYfZEW3Of~nh1D|Y_2Z8(5Qx?&&S;E;XqQIsg09e9s!v+SBxiLbh>hsQO3 z3D=tAnL@2?F{F+jU(nR8{^K@;29qBAux7(p65fUZq0;h#AiuD;xsiv(2pbR_Dv*wV zns(mYW={gg_lSyK_wWLK#vwNeQf9F}d3V39RVTVHT(;w+UICe4Dj$ft%oW5@ zuyALM14@=AkoSu(C7WxaYrHmHGt^nNI2sr{>B>=S9B8wrI7!{*sjS?%Kbi&yOX+L9 z!y7-BG+w>bIIzBlEwR@wHqX6gOuAk+HpdbI14UszJ2_c;sFo&6gZqboIQU6JZKN@EZq;GOpmn}R19qY7Bv z>w)8<>aWcR-4{PXG@+#xa6ehQTc+cD$z}45Bg1WByeyqO>@0T(8^-8(G(R2Ux;GEc zn=;z7=Oof~cIB`ax9<;x#IHoFD~pSA=bAM_3eh;-(+rc`CD~c!a{fhNHc!NwQnVP; zGoO>2`S(l>H)^;0t+CH#p5ZU=r{Kxk@QKU3c8|$WP@|=`MuH2al4+;5{n|MBJ)07) zuKVMzc-8I!%}{P_3n#X=)KfDC-QB|fQL4^iTlnKdA?*pl9ht9RH)};MQj0s{h{DHw z@M-f{P(+jDSm$msBR1H?5XRjcGpKmGDkdrv#&H5 ziJOyESaxaZKl9Re9x_lk_tU`JgbjZI^75;fAFftO)&@sGK7hk+b+aKM;3mv=YXN@B zqV)J-`)Dm=^9Rmx=JN<4Pvc%os?8G1N>BF0F#U)plY{zUXm92v;d`G8*2uG^1J8{l zncLgqjBah|P)H|pRy0mKO$3fh1^sq2m#LVk&X2T1d(|5oO9+xohAKoRPgCIcR|+Zh z!cJ|}b%eZA7j@3cx%-C?8}(;yo|E%xt%=SC?N-g@gvGmAoAc`r-`9`) z>}}uor&(={aUUnwUl5(xuEB;vT^N}4T>RdJjwIViR-5G8vq*mJl?1-0@4PHaa_@wX zLb}mdElt|h5`W8Dn>3oe!$d+q_j#bx#++}g_V-(9%Uk`6K6z{CJ}lO1dL8(*IJ68d zOuk0e{23!AvM9dn-5}Bl&c=G|!+bvU#6$re54Yi9jWnG#ht5^4G-F627!W{Tf%BHL zFSu(HBw#{9igT7O6AzVm4A1TZJ5zz?HkmrrSt?7}sym9m$|}@L6SwD2IvgO@#IUy4_ejV35K_QC?lC>!A~|KFWE4s6|pIMhcAOAN&;Ta&ek|eMJ`EW zajn1a*1WM*(v63a`t`}|*QhiY(pLS{9$gdVe>CpP^Qdfe{a0BlYHx#e(a^oNr(TF7 zJE2Lpi)Y@?YrRIy*J*g^iuBVb=-{xBj>w3KcKuu|_%-8=AKZS}-#583n1`dvA!_+* zA9*MF%^V6sq1BI*k6@qJTp=Dhj2$N&Mly`B+X-7i+C{dRV=`rbMCzC4Tv7(@F6_f< zWAkYrL)_mnh+6HU=vVr&xn0dOzKdh_kw;g#;@O@TqwZ>3)gJI%*b{5p;#Y^dSm>}r zPR$Nwc2pXGHTmkI1p-dgyS77e2(3;1_$nuDbyJtRqz$c8Wm*;|b~P5mWP*a`#SkP@ zU({FT6}a|K^^r+fh8%U5Mry_o6@Cl=s))r9sF&~j^_k$RPl^q8thWwK?9O{Ik0u@w zaK!C1cQUFcnYC>=>Qr~w&si$M9xs(-2(AOq;xPP>!i!(NGCJ_8q+ary!sR?pPW=?O zQ+$Vnp4v$pHU5ST0kc4X?zkCeP@#uOTi3gpm!!5c=$A2>(~O0p4{IWa9h;#0z_@h9 z0gdO;OiaJl3|A~FmSyPRx;dHSS3wW|=F<6nmflOKZ}+MVGx$lXL_)2=4MMAo_nvP8N}hU6qP81c z$4K8EwfIW8U&(e#E?mpkC?rH$qGOw}7MvXQfXHaXkaxWVsWA*}sCH{h#@lX_o>W?7 z*pf8m>d8zV!+Rx=?q=r}tmLEJq92<5U}xY7Nw@x1+nJ};8zRZlqid;!YSvYfb4!(A zbC<|Tm)?P2|?1xdFsFKGAky|VV>{Q1`+ z%C7^G?exhr=^RL~XRmQp(;JntkAqYNn7zhxtCLv9`{H7AUV!@oDD0`Vhh~5}+^HPybqLqg`-xHHz76Wy z3e=;iRg>9L$^Ep^2syW`-e?~AMsOSn^#|-JA4ejKH^e@hvj>cQh}>Ptm~<%CL!RHe zr6*f|oF|hggf&UQ2z|vM_Ht(T&vMq2kBhOr{07Wz`%8!B#P5(lZ=$d7r2YY@-7xtm zdygM>xBOhO+6;LpZ8b1_6>5nm%|hocBoqzAU^_0lx-v1FzoK-E^4sIpDP0729}q3+ zP^wR3?_qGBFOjL4AKltCpdjBOWdV5x{CNFa?OYBvaRE*-R0a%X+~&lP4;SvnWsOAX-S=LFG29rps94_&X6V`XT}^&^?MoRZ zsUKcfQzx92OGl#KKjXRme1ow4k1w}`k(@jZtSCh=m-MW*L&IAW#p_Q>9)Hn?f%&6u zitoOuB{SzblFH zMkL+tX{a|CJTQI|f}s$h=*MdbDaPmzR1Fuim~GnK8K3e$cbcfVbSuXWuN?3M5)?9! zA0VN`*s1yLHxxEOm~hu|#UlH12#l!ht9E#wJ=DxAK&14F22P+e-M8D_uYZHDD^MN! z49UjbA7hip^rgQk&Mpn)b++xFvw-vlngQF3ozkeWH1$0j{^XA4_3P&3%tf14Z{m1ihEPlcHt zS`kG*{`TG&9Z}qL;tNIWm+OkfLo}}R_MLB3EvZ=b<}tI9GtTng5f*fh-}<7&hZh>PCGkyo<~ zRB5xebT%e z4MTGODegDLGZdK6`dcV#kZ8a=N{e~Ps)(!~OrKNx@{JET3!IP~xQaH*Pvju;SH9Fi5}F>we}e{|S=N>utQ%s!AmbP0h8UC;s^nSosS~^AMtDtQ)IF zmhh|jj2BP>ZG|=39wQ82(Duwc+aHM;^^T#@m6N_)Ayk6be@L-uBujS5FR5-&Ebvby zELVSB_?JWY@;FD}igIOZZCUUm#daSvjaC{S;bvSlD~g!IpydRLMbJr*;CD-rbX6a%%149exi#JW!;}fml0|5kbwbFo1|*p)wj|k zw%I_~nC<4$wo;4aHk$#nDP|KlGdh#GG=75{v6!f^5b{&fD%>$=D$Yd@W-fUoiO}rf z>fVjQ=j>64HtY((gOcaDn{Q*`_d<6h5XUq2IGVC3SGqnY>afUA$mU=w+g03`TF^jM zV=4o-eDzg}Ll|Uu_j}p`Jse?*#1U2}v_$0OQ>?;k>oJX-~8t zvl+0h#l+O4r`kBAn?cW2(d`Pg?jPAy--$7}Q;?=W{pEIY+ggX!2yx#W*V-MA772PC z;0?BNS(7ASIs^awgYB$qfv_F@ISZwUtt!nD4BeHKD^Fe9Y}+<)i)_b*PM%B-MtcW} z@39%uzG3MFS?`DN$|_ z96xfjd;Xt$ohB_#C?Bopq{9Yu?aSD>`u3VJ6*FMvb{8}jut;qCT(%QJjG5_NB;q26 z9PkHUS;C|5a1G`nH0p3CakJI_F-oiiCqvjktlw9s(=rH$l2PH>!S>jjI@e5&llVaA zV1-R@yw3ECbQ{q}60q#FY2rX<+B37AZ{EVN{fX62H;uHL&%#Mbc``Re;cf0eRF0dj z1mQGhtqEtvI8dM~Wh{eS5JcY?#L{VRG!4!_8vmtoeo4jt|48NVQ2(WJjFo=47g#LM z8?I}rg(adAf70$PTKGy;9@}loxGnqwrl7LUWOkz^l9%$rO+r63-8_1vg2lU!tUPS@ z9uh3Jc*IJ49IkF^4*c(Aj!oU1&;xao@{-k>{i5(VUZfQ&M#4GElWd=00n~@sy~Ry9 z!Z|JnYjrb{i?Z`d9_BT1nQ+}<2f>8 zq}L>}v>s!{s5PUdxpq!z^`OpAB_2$T-JjQox@K0E77f|wK{MLeezfo z=^u{W0{Mag@3%B|6|RCAPT|w_R0BYjusk_smLou$p#D(t78I!uxVFas8F$!T|;qZAzfB}9ucR1&EZ zmad}f(s^s0-6_&u4FJ&<5*MwN(Dp?cd#lLG8~tkW%d!L-9mWhJ<22eT)#`-~+;tvC zOObe|khR&eRt0%LSnZ#>HFKNr6jS8@9~u$vC|Q%|i?U4xrRt7yK-6mRM&%P>~AHJsGjOq6;XhfHM7>_1= z{w{bdGq#dJ<3TDp4hgYOefUh$VAth;7XAlH=jIzRC4|=Wkj^>?)3F_NR*tculIuO_ zBV+ueKd@7icA$mFI5}&1@}=TTv~hr$U-5Sl-r^|l$?o%*cTOqIA@idTt?VGY`d0Lq zySxurnG&g7wp+lU(8ujisvE>ort*?Drs3XXYYZ>x28Z4hQ))|r}wzhVB^e?=ASkmaew{o`OCp6`0 zB_U%tjTBf9mG;aZ6>RuiCcV7m>V78`ixt659&xG;3}~O|jkjiW_Y@?kBw_@s#($qN zUf~z;r%(g>3sDH>2(N^wt7iY~V1?+}9T;#@7hSOMI`4T)K(aR0Ia(Ydsz!<)YH)ZW zb46RX9IgudGpasgAyu9CIN+ZVA|SJZbhl@j?A3FlHvGfYym)M+bN?kBz5lA&&Gi)$ zd(ai??1#(XS3SygSfRHJ-0&aHzFNQ7%|kMPM{s@=OI#Nxs?jKvo2y_hnfMO}k>JmA z;ezCe$i&wyG7Wq26z}mMK1XEdf8=upP(ky$|H5;u3!lMm;Ibs+O;^KLBfQ$zl)>)b z*vuo^Um<L#c%mK4K z>Cm36W+L*KNx9Sn8RL2#j{hi-S1B^>Bww7WU#{-D+s@Nim(6Sx$64*PTF3Uy)xdNT z`V;K!DshH2mT=>xiYabAn^%nPY&-+CcRca^LNX>|djtU?g@%y%-P=(UFze8SNj73F z{{JJL69|~3U3~IL*n}d+e;CeOF%PQF?p#PRrI9X%U6Wf!V1i_9jlH0El}7y7hmpAl1( zz9)o9@iLUy#9XQi(w)--noU_TWWcgfn+@V6zM3+e*Bm(3D?@%OV7F9qdjP;>9zgyc zW#cSo%D@>?5R9?@i9#F08*(gxG$WmW`};S$rM6F5;R|LmBcq8Jc{8}TD_OrGY8y*` zPFWyoiV}w>VxG#iqPw^s#oeN9CK)qm3HzC(gSHXZ>w7qRTN@PHWUldC%0$(XM%Qvp zaZY~|G}QERWjgfVOlY}k$tg@KQ^pW^C67%hC8=skDzEgH)w)u=UhEn4_XH<&mTZdq zAUSax)u6})c?rn%X0hX_*Y`F8vV4!ON*$JLrK4>yiqO?=zv*8fyJZB0D6V{2FOFU2 z(q_bMQf;&TO`EfiKEUT=J@A$FrW=;;2w&5BX>C+g74TUX&VU>q!75mwGQ~Kew>l2} z!4VYjT%rw5Z3bwmPSpGCkBP9h!#TamrHeE}! zwTmX@zwW6#s&S~M6Kx@EcA)fKm(wWNx#SPo!f?u4{_^_y+7oA?OR8R%xbflE?S7~(5gxruH?+F zVYnVBV69e_l$l77vpm{iH!K3vXb_FmAooor4i_P*BTVcg(B}eoiN^EsQ;titlHpQ=I%3!@OysmxE-*Ajj30 zr<)tr^na3`@l=h1SI$!f`N`$l>k5_n^LTyG2aIZ}s>rNdZkTiNhr_FA*Mz{+|nl!UHCy0O6f4s78n#m3Ai?0Y&el63mHE`$&Y*?G91KC1#mnawTYK2BbUI`1|@j3|1~%r~I8uBra&q#RknK&Vc3;mFYxR(s*AO ztZo4dl3eoI43ggZxb6ph6kzym5XCSZzGmM14Oh#?c03RemI-s${ z5x6<>;sj%EeFc-^@Bd1A5;O7qpOc=0|0F$0aNJg+KuOQA28<0OxgOI#N!-=+g-nt+ z9LPstqTePD*!FY2cLVA{8%E3$0g3b@Fs6bGhmMWxk5)|FIJJ_w&|o5`y-C*gBB7;^ zAM`xbhMTgp6u9y|i6pJHja&nIK@?7Y0;8ec)!g7p>gQqw(3wV+>*=BN31whUFW1oU z-)o8b`G&+f9>#~eYFDXh)7fz~r;|fV_ZB`5s|0{44JgnS z(QcHC+nx{__WGVMS1x;BI#wU-Fllbx1SPI}7e2FFJ!P0ZRPUr3FW)HT?^!ys%EmI9 zuj{xHU5lap1sB6A4zSK+!_2vJ#|@x#3gs*i53kT@DC@ywvY~!oy6MyLd&7JC#fTJY zT+HrbTP26vM?o)BKR|yIORq2WWJlg}XlmEV(3Q6t^>qL~iFGY=AKphhThmw2%*Me1 zz9QXG?M>sx*To{49>v;kYY`^doSEa(xTuTkPvcjOl;$RHW>3*{YuB!5EQZsee?}5r z#omIoRhYEQB|#&J-v0@CO4fryo*jQfp2esor%N5!F=egj_lXt(^*e0Uzq5_LNTys> zwrq>~b6QB6zBDX_C)uQT10CpTzgA(}F`oLQWMGQ+*)_sE zy12mJgM{-|Oikbb#|Cr!dVzj$nNY-hxdgLPlMQfZ)*S-1JjDu<{?+oN{@e1jQI4$A z;Fl#?IhJt>AD&HY0dPA>7rH{Zg2%mtU-Z>eW_Kc#$jFZLsDt4_&X%wq$0_5Ua!#B- zfCpo)jX~q&dcnmXse~lJ-VmMqyXooiTLk>yO-~{8BWpFak+5U=GS+%SIMAgwGv&=w zpb!31?g?N~%(h~z5h|sW--^(s@-8>T^kdIC7@mYQadNdqEzEzAYALIvo>d_v%D%7i zKT*#(`=Mal73HiKlW^ScDPZQ93KnB8*Py+F#5OmDAznz*?>r=(-Hw7wS_<3a=h0=H z%#v4jZR>o+x!)P?dJ!+DiP`9~R-P!n-|&zKngaFU78f)VT2oJsH--mhE-RAzYEM;L zz;V*0<1Sy_m>S!WIFrgKi#|m*d)SKqnYO%W={EnkeIgNl>2I_gmhAJLa_-_~YsxR- z_K{va&i7fM2ac!vQ&;X%PUpWRdOwFUsjCj&>D=JivJu*H5LSGaG^9j3DxHkp0yHf9 zNlL!iaepVnT{D?&I+e1mrT?z|r_{TyKjt_2ThrCX_s{p}X)Jubq+nKH<+6zedUkLY zk~$|W>2<0M?&~+84-3>-u^Z2>0lHPlTxk-rqT)D*YjH(WF5ZDSImV1nmg&FBO#963 zF(cN$Ce+8n@f?TEnXqrdXOlr;@1dD71;iJ%^S$+jdCIT|zWs~UxkaDYNB-Y~b;M5p zH({Mxx)l(tL&*OB3hStaclrI;gIkfkPfCyV*^kac^eLxCgjWu+?a9T4Jbyrrb@@N$ z64@#BPE}iPw+`H3*$9Xl0)D+2^H2XXmk5e_-h-l^-n?lDEKO_V5K3=8uwR78Bs{I0 zogUa6&cL)t`ml6L?1itHBfGIFFn1Ul>pSYc;imAH|39)i=rNm@zJ*)rv<$9B-CfSW zI7S3k*JXNwhK?|g3Cn<=U0Y51-UQHTjFHPjHFO+-@D{AjbNUaH30(Iepf@_F%Q5dV)4})w~iR=2ZXt6a> zH{67tCH3y#mdLyQ;J9lQaev8B4$SNptbWRaq>MeoZvgzT$HRh%=b?R(g+JC;1l2q@ z<%$P~p~PBx-#FY2EV&0Dcv10rz%8K&f3h+6Gd#-mZ`*jW6ojE#o}OKNU8pb0U~DWJ z-ITENz&T6D&$?n7EHoB>K1NG9;+~Jh#}?PtBp8VFdpvCvE=BRm*`@!Eb##%rH_ok@ zmXQ$v4OxmuTZ%7K+~;Jbn7TGX3p3s%ILeBGFM7j6X0;>tbFW3vm0OShE?&Q@?$4cE z>ZWKzmluQ))pFQbeHn7qx@>BL2I?W3K&*l2iS46pifX6@!J^2Zl{#)`TA$597Su(c+9^m5^J_!KQBm&99mzdY21YFV(rHvHuRjmS!Uumd$_ z9M-L_V(glvmNew^QXAP3jfde~DZ~q%6=N~=@^wt!cVOEhr12RZV;o?irQKV}viV!m z(M}J&=t7KLA9{Dj9n5-@6B)v{9mtH-qrBX-r zb&80f`=pu01{pbm-BhHr=z(fGVxzDw7-AXuC#AEbMqy0x>p8w&`oNOK)aJmHI^7rBUNob?)JI zHjncX{wc{?vf}Cx>=K(Vc0|gy9Tc;-glA_v^NyHg3xfv9(p7_aFBKKh`361LU4AcX z7k*Fzn;6p@C&^j!;Z{|UKj==xQ|us1p-kN0A?GVWU}PnKtr9=cS{kBw#2%06WSZXm*PGH>_uNsZ z-C10kq=pzMhJm8yjlKvIi2aBVn(rJrM1CtWBvt{*u16VNgw|$Id}`6mL2FC6ZYIMS z_PiQuG;Pl`sqO>#wj?Q0C}RUK=6fORi2~OsV<2)=iCTyj<3GO_`GF3KrSgcr+5kPh zD4~R*gphe#+|C{2orZPU&$i!`!`T@ZM$hm72EWEqA2{3F^yiON4y&*$-FnZvXzO!T z9JV7b3!4LLh$99H9pgGYyz0+1`&PVIpSv*7lbIWPU$czjQ)ENDx0~lVa5roEv%WnC zr!;)teVxqu1;YIg5oLBoj`%Tu$Y)J|>g3~&yWlbZf~@~yv>`B*ZzF)6=h-h;E?3Hd z3}&XLhY@@vr!8mDL`P)&Mn8`kCFKuc-+WtxR%+%s;KCQqnP4y(vL|FrWqf&bfsj~% z6@J!yIP6ig|L|*C4)H8Bg`n4vSgx9Z+zErWB#OCA|-dA|zy zO{eu8d%UX@wCnGBUPZ78;Aur{-B9auOIKH~)>)I`wTB*Mqy1$+a`g?ADyL+jcZB|c zIEcnlEg+ZxGa%k)l!l(Jc|7v`h!!|I_E-b}6Wec25pM6wc}3DJb1zl3f4la)-NV|h zlMNIF&~-kbMHzixdDGRNzJ7-ddI5n#_+QWzgOtaz%QRAjCI>rd6@VSNct_;6iHl#U z6yj>&FqrE7d+0ynATn?XC5vADXvWzJYi9RvQU^>Xu$`mLU|P;Kf_*`-P}?EYH}(m@p#_MIPCdzD9_w8vBL|E$ zf}av`G>*dXGBGIMVq~a1f(s zHG(^x*0HC}ME}2tyXWTIzedmVvF#n(wr$(CxntY5ZQI#_3t+4x`^zR%FE-L0y?PCZjrr4W;qHtD#euvwU3HRsxMs25B*s! zYmWCfk8O5^8(W92#}{pC3Q`u4Fy^%B(11qX&z@Eff~#z`eTtcyF!99Xcf;dYjO@8# zO8)I@QH_e+t6WExBU&t2cS+VY(t5EJYPYp5ZU-9e{UjczIKUOSu2Sw*Y2)#7pM`s( zh6<)k%_(mB>#f@nBI6JFqHW)WP0NUx+%LOb&N;vH&6QM#GUPr*1*tb=ec^U(RxseB zjR#lmdMTHPO|&l~4Su`01A42M0&yZ#8BCWuvJGgrE;}Sa;r*_M@Hpv*wv}TcPsf2d zoV1T`oPfqwv#ixqoRb$3K`=?4S?;P}3u|D59X2+woX5lq*TGR6yhOInU22^|0(gPK z&wulbZ$l#TO1A#EP@JfG(758tS$np1DUTbDn$k~2)@5?yDYC5RVHt&=CUXw3S!rT6ar8&kGur`^!vJ6b1U2MuX(n-h0sHg9 z+RxrKtd;O5MhZ2S#ZbJgt{EBT;=C2FbWK=eqSy!AKM11`J}VNz)(ByOKG3`YSf`(kS0)*=a#Wzd5p!I;C1z-zcLxkz5pZV^p=wo^ZTkyKDY5&K~n~N)dHN<^v zUU`hl6t;P3{RqVvx`ZS#+!1DNho-*6nZs4B3>txpK}h`|pC3WMaj6d%n=>I_KhYV} z{}|*tMZ`z&N}9xBxAMShj;`slnR`28)-p7)Rq5V1@t|He&}jlY&qD*!uTn{6YGS?k z)l{$%OMx$pe|2*^llcc;lhObg`6+%7vkQIXX^n$sLzV`Byk!1dC9G03TaA{j3B&@) zPT6=Oh!}iv34<3-`{CRVjKcxgLKND|V!LFiS$3294xSn3x@+(;2!knfo=mp@ph1+W zsD!N#w}vouFfZp!?AY1mGwNQf%D%&SXEL*D>`kv{rZlOH=!IqE%6D7Ey0&v_NNAG3 zwM!t%oIO>k({=lJSHpqlp=F~&ivHH6sMZmF765-1*niKvy>#O>_qyJ{K+>VIzJ7lm zPSp|AY;LABI-Xd?0)0cSEpPgkeMbX#eClJnN7J6oF!{T#`(4R60CftqJ>@`Bb0b2h z02-i;pN9sv%gZ+}&6AV{+t(;vbxx1s4mV4SAcWwOQ(0w!=z|{DqT-}Md`oo15PFVt zaRM36_s+)5*~Xq+O8=`#MU^{^wo!sgV_c>2PIvV$(_=MQ(q)AGx!{Nx!YDZvzo#r> z8g^czMZF-zx--dDu_ZHPFdMAM`f0{PRdJWjdMZ=T(Jx_T!Aty~jrN+KHv2?%zP}HH zR;{-xmzE|VJQ^(me}oxv)K~AC4@>Dj?o#DB?o#PJ?p0v$`}n2T_d9lNEH^f`*O&Eu z0lt^->zdkHt##b!iqhscK&Zdv=1Bv=$;0|r=M>_=6da(uo_=-cvKgOK*j)t=;4g^ zaU-jrOPgSfx9D0>dSt-6y$P>&`sHzTbo_-j=3bpps%h39NJrkejHMbAvQqLUiQikX z4;ZtKB|L&&mlir>qTjC_;nhI_x8gy9T5jq+`bLKn<6h_e;!TNLxT;h3B3~g(hP}h4 zjNjIss!07b`U$`&{_k2u6|kbOi4Spvh7@WV2r&q+yl^&wfT<%?)ZITzX6-D8w#WuP z;M4+p5{{9_k%dm7I;A}2dz+@PZV>W;INoX9iowgLOWC$&3l<)^qS$gW|j zWPW#fkg=$kc$WwH6k5I4)@Ww)AHOqCt!se#u1CL#k0&+Fah)>yk4Dfi2@vFLLr)l@& zmea-X%Dl%D*vXO$RzB<;_a`P+jB2Y|ebA6eCVfn- zd7YlN*3XqPML02jtGNcJjl~^6Nod_QoO3qI)zhi#N)Szb+<#LM2`|=~i}I`51v5h4 zMSip8IiN|?{XP)CQWr$zQB(A*&a|w~YapX*jj=Vn0wRermeSph$hsAwsdyp=?jfS) z=M9yH4SOM+lT)cmf^#LVs!*y3x_W1u7p>0!+N&F~m#W?jEkq{S(Z5U3NrLWg?xFwz zy*tTRk+6~nf6**4DpUX{PHn#8^p2?qi%IvPh(xA0ykSHJb;L;K0?9?>fX+#@B%q|M z_h>xr{Y9+?v`>$3V;X^c5<6Z{EKT6WZZu5`nj@smHw;+4WS&G5{U_l$>3sjSqNIw# zN`qgUblFpS*x!gfo%qsPZah4a!^-Xq2BK8FZXmiOORw?+Qli*mt5}2AFWQe#dL81l z`*q&cesT$jvfw1ThG9{u=7!Obzp}!HhFmy5@Q>+!WvIX^SGX*4ojV#9`kGU ziNJ1zUgE^1siqt8xGxE_#V4A*)nFW$q2=jmeiDO>UqD*67VOYep`>u%5l`b${lUxs%|#j zDt$k;krUve6MZmJzOKh~n!SZcSUfFArkFizqkWVh@cr6~LU(bsQn?REo;nj%hU1&e zni6e1?p*0Lu8qR4uPL&9hVkPJZ8g|L06Z0~S5aDY)PZ@@JEQjsSoAd}XVbAFz7?6rjkRTly6YbhaVL$4Ue;Z4<->W}oWD3sIQ9K#QJsdV*f zrUg5>*HF;+pmOn`-qyIaP$cCog67AcP zU%Jw*Nv1hx2Ms?h%~`lj)R9X{mazUfz5WKlU;Tc+IA7r@RtVjK{o_Y#VF+Sa>`P;5 z>t0~9WczqHLFZC^(X8S>Rcvkq96pS6f?nH^wtdrqddx8F8wyHzWh((>`pas9Q~Brj z-$^d3cNx?Vxd>;_Pu8=F4iSn*_K*lWif%#rb!^L@REI(__ieMdys8qBdyne-Y%@mV zi?uquE1$i%lQn3c^;_kz%6Lx~X|FSKBA_cHqdKW(jW}y>uufgZRtg^nxLU5t)d}dJ z#3J*S8olM4BGHM#Y)>~S?#r_6!W^(of9N{Tg3tZkqWPGs=tQv1)FRQ66e067*b&A@o)=pzf_CXUgtBk zkS80 zW;8SxE}9)pi*W#?jfJw4hz5}i2at^Ukbtuj*9q%R#ph@+%MHsp(7|)P^t~O;*5fuj zUI}01NXj(t4a+JK*1A1XJggP}=m`oS4n=tC-CFbTqsdfhKubQz!}8}@frSn_@y8|a zN74VL2lQ`HucBozJ65izo1}HPwmNcU8N_cBjmIS>^}`SZe&<#q(N%(7OgEHZwYq&h zsNQ)sWgJ51%hgsps`6rs$w6IZCzthmXyARf>>3!HZ zeqmn8Cyd)(XCV3~^P{P%8)W12jRW()B{n_0PU}ij|vPMiaghpWDf{xSDMo23BD2 z9x3mosJRn7AW+Cd3vof13=&Z`7-Opn1I>4fWCT*wh?vv}(_9BFx-@P7 z(iqzykwvMY5H>Uck%=o$ew=^>QpWM|)S4+Mq(n2NvrAlCD=5#jq?h`}rsPc16PgWT znm;5=G?&J=v=&HRS6d{^F4`yAq*oB6p(AHQRt2qpm;~S5;JF!bM*{1q8kAhx!`_Nf z$1=)|3vJz)a*K1ZXvKu-37wL>m?t82MVNXyoj1A9I2z88vU)jMpc8SrQ8|+j{e)RQ&xcq zGR$(;uOkw(ISgpV>)5f!%V4g@TD&!n|CuUb=>6s}qLb)n!1RXgK<^CGxRGElpg$W6 zK-ZL}#%t-Sm*>vik{7eVb|t}&p`8!Z3T%(WVoO9<(IS}ujcPu3#(sMXnIMk$e;Pb- zm-I|dxU9e$f=zo{OsvtFYYP((js@Q^S%zUI*K7;ga;PGlk5ssX?yrQiZ;00+p97o} zgwwZgjNz9V3W9u}Rn^nRy~}A6y}aygV`gr3jJ&Sl6{WFUHiseE(VWwGmA!3Qj^^mb$dorNmIvb z1Nq(%g79BVwgC#~p>Cr-+PY`2s$t^Pe1f5&TH2(gU=VLC33}g&$!sLO6QmLZDEd3x zR%lpTW)2xtk5{OE3Aoj+Q0V6UkA@dFZgU-vySW-*K;Y={lhsxqf&~VCK1N`QDNyHe zUFD;;*t10aE%S6>Y*nQ;V@0*T6HPWma_R-)kocE`2e@(lF9~lAHF%-#Uld+GWminX z@R*`~k?ZdW(u+3b3td&`KhQ1??u@Wd({vdD5m}?-WxFlY1{XDz4Jf+&f7TB{(kB{f z7P;^b<{RJyZwxN50N`D4mqBi&8l9xnOJYoRieWhRh78f|z5kun-Z*e{hZ+uj2C~}N z{byFYUQ*uI48z45RJ3uMe;$Php4rTv^}nKbcl6DIIF0OOWk<4-WG{u?x<^omtq!QU z79J?bh(k@Mjx@1!#f&B5@H#Ec=th!gY%~`iyipce7$%h%(Z>I8i+5Z%7s8EuNY&IP zH2q-7t;y+H&A=?3IbR8L?~LbQ=1m-m9pwB`hSJB0MHbSDu)G_4{Zi^f>uPjx$u@EcuB4qIY zEv3akCLrMDKwlS-f#D>(00x0}>lJaSeK90pa&&HT+}h;ZQ&%g0vVM=Z?XiSM?100J z<|XO+;fVlnrG#kZ?e;JA-BiZj$!Cdc^WoI5>Ntx`(Nmpp!FjV#51aR(H6?iY$hsZuOlm>NEbe zmyE1R%wn#5~2esTa z>7LwL?>?s(pKNIf1h^C2tG|a^;@G9SUbhG9j}`xK-7c*Z$TT`F9&V!MC!1|4ir(Vh z8a`duG8p`&;(QHqLaJ~&bST@NhJs>_`ywh7m#p<4;VjC))DLe52|{5hdML|Pyk5HT zU%FZJxFC|>%E-;IfmdxQ5PX6Ej%KT-|7$eMi}oMUYy%VtNDh7FI>p~KKYaNA*|wWZ zhJr!4Q4TboL|--+fN~QXD)mtkeyiE&YF3`sauF`5AbllE3Nli8VS*zP6M&LBr%H*` zRHo8^qONhHx(Y3FfyrQ7Q@?_DfgJAuAi7j?lu>7c7*e2>uJC>JC$gk_{5D+ ztQSmfEoi`5(DkE08J#z!L5hOst-<*fHiw_ZR9KbC#JxExs6wSH#QIEzM~0B$MuKoZ zoG2NN?v2A;odl5=zYLW~*qA>UOihopY>5j}wL3~^rMsE_eT8Iw;g`2aqs{4C8 z%GtYEp#=^867>HPYK^Ny;q?Uh;;aiFh&y zf|8CHn#6Ve@3b9jH1a~X_m9yxIp@TFav<&2T6 zKI^e|)m39O96)naJg8PT`*7CQo6bdj{qMncvRajp(aRMe&uD9F(Ep=r2a53^v^`%v zT>TdkVW7GSDQ&PbeD@2-m~G(Xnu48e;}G1#W$bWQp}jl3hE3FdN<<@5Pt|-%be15q zStC5y3mrC_<-yZ1`EIRSTW+T>QSNt6`I5!WWtO*=;X(jo7r#1_aCJwk#DfX1Ra4op zIB!VMOE~~s?h+)=;CPG|;=+{a5X=QvO9IAG(h}vdvK&x4g#~vzWiWL8 zAESbd&G}WRDg3gXLDoL;<)ql~|2xhOazk?y(%g2>^2|rfgo5>;G7uGRZS+nd9Mf4m9}JeX;}GtRDy#J?Rx4`d$-{^Yj_>%rNg2bL?mA z9{GBCyml}7`;7^0IKI-#0HLjp?GvB^=`>3`<#jb`Bve+OP5WhoO4 z2N2uk&+_eP|3ldUPTT%Sc38m3XKQ0~CvSwN-$Tc)7aNX84{WWgWusGqEI)(yQyN_6 zRR3-8zU!aw`5IZS7nIk;_DpDKX!`+4Xqm`wYQV4T?y&!=**!l0quHr4f8uaKS&ZE6 zUxZDq>ebZJ$?=({fUt+eJONg z;%bIT8l6T3|5uzHQ2|ES{}aw`Z~DJ*b`X;^g#gH~wyubyQ%3uMTQigMJNZ6q(I`4P#qY zpDqzk0OsZNS4fo~>4w^!!-oh4B_sEA*)f7SxH^N`1+Mvq#nHi9r2y}_oM>@d+ofuxwQcZ z;ZCT94YN%LJ7?aiWBdO!>!L$#he*U{T&SZK^bIp_pyEC@>HsCFFgN}gw=W!Qa4-=p zf*~)oXH?qu)zh91U#xawoF)KpAACLe^ggc-aYN#(rOKFZ!)R|jwLOn=;jNhjXKLc} z94s<7JdWia*!OyfT5=>&R?-vLQ!U7K!b28nEtQ4pEs@)T($*$qX}Mqdd6C9CE1r=M z286%9U5&WQms|h$E9G=e00Sq62+s^6??$i8aIzGxZ4J6<>~m6d88J6h;}j9^3Wf+PnOc~*BtJmP&c zU9UzmJRm2~v-RTungEoG#p!5UK$wVV9#W-N%TZB)_f2R(3K6(-=o}nS+EhuWFU@3We*v4Z z*8iy`)vw7!pGZR>sQ##Yq@0c1g7Q!`rOd0QT#RwYsf`~IEIpeFneP;!sHq%Ah2Af& zoin^`EStuw=zgJMegjiMr!KMctIQ0@v)-y^UEpEHiQ^att5VoHdCHFXS+!r1`dPJ) zrt)CC$j_+D6#Zw_UKTpQ*%N%Y{RGeg9WH}*s@x~5G$U>OQ|5J7GnAvbe7`#T2PBS01WE)>mtORg*Wpk5>* z)J^i5x~@7q%s7s6+L;~G2Jp${;^vc3g~V@_ACcYZT0;dg3NrSXSV7?wU*y}v_`#0{ zwD^;Gscpf!5Hqi(OX>0W4P&v6=a4&nQ>=h45hEs*evU0=r2vuSDej$6ZRftc*LoR&H$-fUaMDEK zS`gko1m7k$hT=~LFzn$$u0P+3LW^S9M66%r^$H`9xmtziUzKotkD~N#sBJ0|wF4Ez zxx+zHgI`NwutvUC!pXl)L}>&^L>fxEk~NgJlh5+A@*zBT#AATx{{*cV?q|SGkj&u% z_3u}&{(48F|5VGyTLYSfOT;1Y`fPQn2|%s2PIu$W?-NIM^9ZQyuq6txH?pV@`J6*h8?!!&IM!Ypy6ws`7KR7?RkqlKv+O@lvx++6ixl)+1Ds5>yU0jZIr|(IwwgQVxh18?JcnW81Z*J>k$wVS9N3{o-|p@Jjob zAjSWp@;DMCQWUSWcCdRS$hl@u+E5V^(%aX21-x2Eo7Hhx!|a~EHDhB z5?B4-yq*gl&ka1?c(vJF=$4aE4ZA!D2Dnqy5ss?de%%!CS6?E1r`T4WVcbEFLG z!a~7fL&`G_S+f&m+C6&KnfE1^+AJHPR$Inq)?wFC3rs+u-{GGH{l!(@Bb^G71{6k5!E=pF`h%IK@PCG7~i)rWJM|z;do2wj##r{Og5Hd6cntvf$dwWB`u?#cysUlz4J+UXt zN>sgrVM>Ce`Nic5;-Nod)d$ykz4(4&U72E=NMzzsj_m+HIj+$(4?hP+wl+pEobiBT zK4qEj!&79V(;rMN+up6kKHg*WMfg+Y&(-W>df^#ZrzG)#u!>7|`owyX853-A>r4JgDx<})5K_S3y-N0p!>Z&IO#h(%RFX5(5!PNQ2Ho0O;Kc>JS z4aCn;O6`7IEz7sQqms*Ii>h483z9&=aFm4pt9A)^`k+y%nbj=I$lDYULRgGD_3oIY{^Jg0V; zBmk#m5qK*YTCE^Gleb2rzXhYdoZQw@>hD8iMg;zskUEoM@ zhAKqa`n&{=hA!Oc`qjVyTnX*2Dn}RNGbF6WnCswwLt_#|)euK={=qr|%zyTEv`pqu z!X^UqZD=bPT~@l~*&wPwy(gc|bhTS!N)3_rIRZEWHV!vIq43RBUt#|qolrau{Eh3D>LurPBt%+7qhmsT6 z&9T;b4yB@4gC5jf>G&3X_=YX>q2|34!mzNgd^7w$>9hJ-$yu>R*uYc-ANqDj3tFLR%PNF026?}c(2FbM%R~_SR>V4bKl2Gc}botF3ZZUGsYze zJ}yrbv7Ki7lC2|4chYCu-0c==LBur_0R-Zm$<{sZG+9mnKqw-94cv6)WtMCUXrO*> z9Cqx-&+oyvuxSIuL|BHhjYKJ{ip#`z@kHy#A+Q>k^3j#fd~%N&n#vfFx#sZ+*)+Bl zp`EKfd6`!!ARBYz;27pNab+Jhc^5=9w6k{mTl#J~$MF5as(Fb6l6(;4r*nE+lfOFk z%Qvl!$HE9(uXQWo96S>LRobVVU zc3*eia}6r>$F@tGQOo(- z*;;j1mN`~1sZASXj{;}s_X!QM$QJ_buToM58JKFyEz$YH=WC92ab^mw>Y7D8Erol1 zIBp_Xs66(h=zNwj3LEj3vE&>A9)#jtfW4@q!+{CUb5OAQsm%v^tuNp0a&r^pC; zu9b*HTTs}E@I!ydgeK%+Fp~mKAr$x<%F<+IO;kHX02(qaMb(D5N}8(dDDq1(O)Aj& zM#LV<)&-SyrGA9F3RluTHb_mnmal=$&Uk_Q(bkA+;RP8SCBr`xq;jZ)c^GsekdwGD zAqwtlE%3Gr{Kp76h$yi0WTRcq!AR6}h^y)?{j2mZF)BIRg)NNnl}X+dNm>* zzBofk^fHd{%zyuA50KFlR5T$=D&&g`o7rD-_jsl1_K(hend}Kjj@Zy1io|O7JM|d> zC**h1lj~rVh=c*!;&!oK6DHrw;>4F%jDFqH>^AC`O$p#L=53+z1Rr{2sJ;S+`;6aY zzzA7E3s{0+@Ze7)bDPT%*!GFbO=|c6nFtBr^pivt1Jn~3Bnw|~Zi{n2s8JuJ`k%S8 zQr%jX1s*peHAguDBo44zKX|(L>gsa3#GaMwiVi*V__|ygL_l6 z@j-=GW`_RFI{*G&TATLP&eG0)o_%q(J@g_mv@+cbkn)L-1x&<@lEU@5-rRyP34~%v=et&**n75}C}z3GO}~whO3atuk{Y&tv3B^$2a{m-^6z2M9%G z95I2_$Q(u2jg0ozqoe{~+iF>Jsyqg6$MYZx6}Ja$ zSG#^(+f;IMOe@n$KgW6YpukSZhEd!n0d4qsu7P|tG*Ao5+2bkePVrgj@9v_#H6}}p0+t8P(Uvth>|(AQ`G(%1 z+3bet_d`l8m#IYgakr9k!xAUZ`JQ8jTlBN!HY;z4o-5{!IUaivQ1q(Y%cBn;aq zA)Q*VIzYcSnKGoe^^q5sQE3*%i!0f~Oh5`jK}(N?yMgAM;TVgf@#&-{`e#$?FeOY< zI~TovX-IFnOF6^jYMOUn@yReMBM({ZI*IJ!8Lq6oxO#iSR5zO%+MB#`!DN(_A6LKJ zGOwynHYa;8ts)dk%w9M33wz(jqEg2~Tf3{|E}n6v8^JAaK)ol}TK4Q$X9PKSw)Y8Yp0c@F<*fg1aW^$grZ9U5ORfGWLP*Zs||f&Yzu4%roQf0;88CK_{1Y6 z0d=3n!nm&`mA-6Eb?3&Y0Tt^52A~ohRm}hs04Hk>*kmH3zi2KLV4!Pz>G@*BG#Bgy z^i@YqVIRMLJsWqk>V7IFbW$)jbTX=#=op`k@Hv?l5>W~UCB7AYeT7Cgb((&6QA&AHJ zRg&+|jPw-^j5QPz`!v?Dm3Svbkp`Oj$UaeNUytNPyK=~TF;!TE{m`d71J$AuSOh|5 z>BWfdkd+$s5$rnW&mleYv;)+DF}(^6e&6@{c^Xw#aZzMqVCf=x9{7UNb6-F5f#2Nv z$PE1Bd$-^=3A4b2a4eP~&1&S7I&1CXn&@tdzj;2IbW*vsl`O{?@WXQp#xw^2uUvo#wu1AOP;NLdzq zgOsZQ7p*TM7V^sv9=wOQeL3M#=2$6H>$VOxI)n@Yz_H-q7O<)pPy&q1^ZvoiJcp+$ zJ@ua@xQl|nS~N-&UeSB2q_dB0wMKS6z6y{PLVZZ~TQ;v551ETtP-v;9NU{S}GJTdf z)6$V*q%{?p549EsY&#kpIO#f$Y7Rz{baOx1lg`d)&{x^$ zR%R{)#r;XUE*aiq{?5pLX)yY9_ZUFp&-1$FU<9jwSL8(_)Pf|%6OK+kihfyaTM_~& zJnXUUmPU?0jIP=(J~yfOzILtE^#+W4?w$X$C@NpA6DR!5_{u%Etp=1m?3j7k)mO-A zKyBcQ;tHL<9eH$W^mWFj=i~ljzBqPeZu^%84oB<&>=o`K@X9-DxsmF{-k zkHf7YHoLz=5-pJh_?~|2ExPPGIsBdS2*Pbeb<|EzVmEu?ZR}{8TgP;Sj24N%)>l{j z^1!*h3OpONpKpUcLXu8NH6y*v2;E+h3Q-$Sa-8&^FfQlI@6o z8@Z;i?z=e7f!zb2c0Dn$+?hzrLik7z4yz)MI@W#I+ihE@((qc5r4gz!*;(^XK7 zLbq_ulB`4$?{JrR7K&w`D3!2@2wy9W@s%q0!uk=8KPR=HQMcrEvap2&N0xzQ3xx zwRGb_lA(S%G;!(bSx&Sm$LL_usVBUUfZbrc62ztJnO8{)oJlWwii;8U>ENL)IC0Xb z@5xkxyY|mfyrk>PQmUTM?IE_qMYVu>fYfX15Pa&-vuw9-)*7lpL;Q2Z(pjlSs-iCR zUshBPFOc?_7e#JVuw;Q-qZfmMiB@)ibIVx-55FtBYoixd+sMf}){xn{6^$>FQh(=e zSg(bs#aHytKr#y~>0q;DV%|J9Q;%U2z>_N)jLU4x8%7|(BKz978x-_hVST<(!bTZf zGCCnwMPdY?!%a<)#ybaeo{t)HA$qtF0zMJcZ^PCi?c8F0>I|AASE9m2u-dt?pjnC< zPFk&bA#iW#rWK4EiRL~(_WL=*_BqmH>)8I%3vXap{yCG!DH(gD9Ih%tPCbO`N6tq+ zLmx=!EADH&j8tTW{7?fK2$HE;iUCzd-hXw?o30ANmun?TVpq6$2IDSi{JH%b^%}zJ zN5k{+do!qT%@Yr?sAl&w>SKGH-BF0+V+nJJi9);8rK zG!D#y-4E9y4>qAxv0;S8gnTY&V(L-^(S^qHM);N4Uon*@NO0u{T~eVD8I3d)SVs@# zjki~DsxLFFzr84in-`KgZ3rTV&7=@A2WyJKiSr!%PU+eLz^*TKcR2t2s?vHn^iwo%1G#i}SD*?IXh=0l%{)FoqrH!M?q_LGy za*opQGMt;Wx=Z)VgGH85@l{|8a`4>pHwE{?KO}UTY^7&fouN?cJthcn&jQ&e19h)% zB2`5(&+4`4m&RK!-DRXkBSb0QxU~$cF@kdX^Lh!3C2nm`>nL4 ziW-YcJ)3twei(8E$|n87!L&*7cb%jVV?PjK7g*_}Np=lX+FZ1;^h|wXzO5r7(eP*Qto)q2Zj<$4`T6#Ih=PdIYL~OoXSXz;@XG0f@v%_ zy{MUjp3HCU{F#u+hBd1F_pv;oeQGlXQi>FYY}ftWcxW0d+}hUbRo&$jWm2DjW{u#} zJ^}RzKV9kTyhJtYD8S$-n8m2s0Yq%Kwz{{pr!)LN=kl=gEn2R}hkB8aa5sW<)O0Y| zU`ue4)Q@b*m$(lu);8}9Tg04{?(LEnPQxkz`U49r60^!s+_M)%<9Bp*e`%;&wq4fBWzGTjYo7?E3u=)ZTYzG*q#rQI}z8MR!G z&TC%CMFW53&b=%wes1f+k6yhdIx#Az*YlCxssY@JDzgP73*gH2tcv>-xl#Z~&_x6y zztao~RX=IFQfiCgwf5Wvb)9ZR!)Q*kwN;=)doL$O@aG|um=i>@<07n-f-lXl7_>89 zL(JEr0)ajXM10|`vpzuIh>-SPljUOS5hxq5X0;GtmELA$wZ0tykq1dVK_wE+W+xIz znJtd^I)97>&xSQA;=)3F>_KZ;@NtmDWGP~N&BW;VjRq~b7i<#kjty`ifjZxPx3Ab4 zU8}}Eust*q_VRi?xpnGOjHI#m#Nun_m4D(L9K9YrnLGtr9MO5&r;1tw=4%yStUbb) zn=ubOUcR7$i*Cz0zA$(#->B8e;h19rwU2-6|#4CmRh1H z>-eMFV!p^ws8G2WBJ+8m9$`m+fM7hJ<;`_>X!d((vsaU{+5sfig9!>Mu+cK6_Tsua zW&-X$7Mufik40nhYNF0r^!vQ~=03s*0NMydd6PS_rz)V;N;BW~t>M};jM)jnEy9A+C^m-yl<-~PA>iMZYX%-bC}n?YZ0d&@FQJ_XrXiLw!;LO4e?0z-0nZ=He`mVvn{nCLUaPCv zmDy0T**3jpJqF6T0%jWLq6}Jz4)2TEu9d64nAbAl-|+a;af92E&qRf#GiaD#*lER0 zOEF9w1d0L|?Q~P6v#y6+*6ZnDNK0{He8;%0`}$a$Kf1ej^pnkK5Y0QMmxeh!$3=>< z3l8?$tqQ`HF>LSIw^#!*R-gs%NKX2Go@eJgy$LdCPWSY5#($_WLpGDax!l(ce%Eia zTSK0qw=MaQL_M+o#hYh(m#y3@8haj23*a3SB_Dd$%IW_LpZx{Nhc`idW8={n(wauK z^Xst*9n9rT_t2(ggqH}P{;obCDTvhMrjo~`3Nd9Mjwy_r77%bxX7qX&U37i-I-0`N zi@heS&IVy9jZpVtAu_X4;z?9@d(pAD`}|s3;86hR#xf5_4Fkg!Rw9}K-h)h&Z7u!1 zUU;Z2Z??tHCHg5Vi=AyZ+G21z7cgk?O6SkLAcGH?7WqY`c}-_cr^ie8Z4I7W&G5^r zM>s=Xd^F^;+Z-n94Miv{;{9z3)Fpzn>+Dmd2q7?}whNWX z8)}EmpcH?me{zbH9bWoAha>&1Gx(LzBAn5koAK4iX6Q>eY;J^{O1~8D^k-I%z(68ceLBQ)&b8O!~gRA#Tf?Bf%pFG{vWu>cKC$CuMdp^s&At zSqKkTsze~0-V8F|3pjIy-7)EfLuJVd2&9%U5)i zwP&!~%FKXc5>IWra3R*RY8c(; zZ2ebLqJ}IspwTeWOSq2@MQJjR?EN)a6`BVAg3CUstu#H@L&bH{Ksw?4RYT}b^&}it zkV#l|dW;M|=s1WDa^ed1w~E-2>q)Z)lW<0$hb~6`_nV`3#wL>@Woeu)?Kk9k&s~Ii z@CC-*nz++$gUN=-p*#ZVmg|6EdR8qb{b?(dlId9Mk56(@z1bvp$G+2dOTD&J3kRSa zlR(kP+_XEo!oxICDY=Dv>dZYs(5V!?nuw6}7c+&iwkn5X^Se%*Jhz%5q62`3Wa!W& z(n4MS$RJeaBd+X?ad87^A@%Vl+u}UO z=#pd1;5H3(f@shN2c=*S8!W^6$L}`@w^!wJ=Yw-PNXyw=f$lSvw1t%c{l8|Y-gG{j&b{x_l_<8v0EV125ufq>y)H(<9GwmIINCz8LX zVK&)nI|i^fD2*AfJ7uvqp-Fw7^^`-=q%$zH_O4wt>yfEdfH&`pgZTp0dYr$>ACJn!8vWe|(l@vtBS(DVSD^qAu#pg+jj+!c*)1Gx5ce zgE@Kq;BN!0=7{q5`|R7fnXRe$%V;=+Njkb$ma-WuYu#V|++^D$ZPzd?c;O1(xex zy%?H`xO;WdfelZRZiLo3clHjCG1TfrrH zZ8Bz4fu=78x%!qM#JI0Td-_VqY*MB=PXz_5v#XG-_Nq5?pN31FDiB(d>tO>S??)%K zn#m`}T9Zm>F#83LDUyW(S_HfRyD`aSX)ztF0yqb-??z&yD~`1s za_B4K%PkqBV2n1ncJg_Gt%&`|Ld?PYxFt9wdbn;-$pUllzO#Bap_{A|pA(rPMetI+ z8!<9A1l+{O4hnA~u;ud=UKoSNb za!_BJARaDK`pF0z7hRDl(9E;Bce5Fj!7DVr0|TxZKGYtJ)=M~!;xDoo@JY1&r?eZJ zk=?|krGf3hRnz&!0m1eSKL4@OSSsG>QZ}LnC$hh7dTPh;7x}5c6hF8>r9Rdd$RQ(c zZq)hA+LxrNE%Fs$={|J=n?+a_~fRS1ZUp{D^+U} zjt)WH&taR8XC^|~d7~eW&laYuH-9EpR1nYqXt}(I)vY98NRIzBw3RmdUO7QGp+e_( zPB$Hx8Q20EkoX4yGZ-0_-uKx(qOV<~9rgE-tOvphpo24n zYYtL0!#K&`F((2*kObW=aGt_85It*`vy5P&pe~7_4C0li#8vpXIr1-_Z+JqoFW2)} z&`&{&w|%*iJW@ESIHdYm9h?%;Ya7S$iN(MJ1*TK%@XuZ9<*Pd66B3}0n~5%#12?$I z&IS8=kK#PH2aa@l#@<-On#{pOGw}c%wD%3~RgQh5kf4M)KyUy zms5j)tX6vmvJ`8Mlo)fBF*(9v#{(jSDUEDXqTcri zG6PHlPuTm}y@2y~{9ViITHB{u9HwD*@pwkj% zL0wnE!j@t;yo6ugl?TU#>I109xz$bZiqbQOMLnjxB1|$Y`IK#JDoo&81=UUDG)0&z z7p0Y;s7exfmt~d0s7g@>=cScU5hLbBantzoT8XSm*I<_mS~q{FriWTKq0Nf~)@nUy z3erI~`cEorOrbNo?K{~7`quMHNz=c#M1tkfqyAA-jlfW|19Cc8V&9Y2^v!|=m zW=>=TL0Y2XdbUuA6r)C8t;_uUqW6ycxh8RmW7{d52yl{wJrR{ga_ z&U~^?*&0b**@uR~us7&zhUMG-16LQDhLx&}AS)yh21-T3+^@NDVCpWt2!8HH(HIE z_Y?j_luf;upsQ0_xAXNKrYWTis$lDMsuZa|Iw|NID zXFd8iw`TV}1~2)uEh0gq2J47}HA>C3q7&6BM=I|l1XvtZG;p08hh9n)O8e(fO(xyO}_3(3tA;mxpReUL? z08UT#TUPsDOk0Y0|9>&f{mcMB{$KGQ=Up4F@_>9bQn5CX*>lA#P#|A}h{v^h%M zvVL>zIn&@&tZJ6AnX!H5hK+b;Sh2GkoJa__JzZ2#sA5!tR)NlwYyyn&<3^&U~ zB=I(QH!A^VCyYgqgN)0Pqg|zLCUWnu)s9HzNp5G6qB7#Qq2{2efL!)ac_hLUoR#<< zgJ9G}Ge7PA{i>0QSFub&l1FoOL%j?Nw`sqZE$!*Pn+bqLd{$aLkC(85r0TE(+3z`~ zO7I{dL0W4XBqXnzJ;}F|SZVGv4}@3_cRBt46Z%d$gh54C<3Q-< zTKf7bug`pI;cPt(Z}8Vn$U+vZveXd!k=g-Zm-1r8OyzmsY;8vpv7?tTLdKdzJGRA8 zT47uIpXeJoHFgn!_utSr#4pT6{W*4^&Vi86{|dgj7$Y>W!CM%xx{;uquJ7Lx zN+>UtQE`yJ*7!6(7U1$3WFPEj%&T(FQN5=fP|Nl(Jo@isOOVxf$6s6qWv%Ht(O%62#}I!VZ#8rbI%911wUp`=X*(AhaWFw29^%Z%d}|qy)=7IeUl<4kX#1Hnla# z%@o3!S?GZ;!T2@a)L)!Wx8K_&sN^{#p6a$wOBNqw_YOCyf_>vEcZ2&ix=NvIYekDM zv5Z}X-mZj$!#<`KW}^?zHOOE_hikDZ6ed)0s?sTOKE|-~SL7dlGX}@yv!?wlKX@AF zJQxwyozU-_%RJ^u24HM9J3e|_oXF)W{)l3uo2P{irmQbe$;&c)F-O`>0ntCMVnM8= z=C-G+No<7+3;$6(^^k>!t{U`aj4>Ut2+mu0n) zEUnuw3o#SDi8Ei#WlX)C4-C1~k#GedrHeh!!x^iQBTA#rCCTo&N!G5f=x;*Hd9 z^+^vQ@|F6wST;fwRU2~}E&x$X37wrhB{;|n?(|ESI43zD=lmaqncYW$y1wt>km-l^ zBT;Z_Pp9B=O1a7)2{16$D0Q`Z+ZJ-;5Bj?@(~-VKtktK>qTS7!MT*bZ1GO?aDB0Ad z<5@1Vu(5ST{E1)-MEX!ImraCDuQI1_;E_@+P!vQQaH-U+YPEhvu+yGp08Mu0WYOoH z6G1vLKo6ImhugGXY7EAmVi6tdeB%v#skc>TYMR*eoSvrk$bsT~#iWuo$Fdg1M-3LJ z^|&crQwjY}!tY*n`F%RFO@w6{dI~z!b*`c&lRo|dwhk1Ep`5cb`F9NdZqu#Q@Q1B) z<9w3TXPfnffd^3zbEEj(e0$OE=a+v7XbTv6UQixm8B;?;L++DO@EVbBwFRj|_>*9- zTreSx6PC`7e=x<&w`8JM{w~jlGjK0v7gNvzgZ;tCt}k0`-|tF_4IWknna-=7?Lf-L zZuWrm1KU`tOtm1c>xgITaO#wP`1-h9C}%i4GgW$*L|_3{|LD*rdrciV3V-ZEK4!h- zf&1^$a&^eFDO13x%)l5Om^}L$skI6TNB9ZfVTrgF5G`_6IpUoV_0TV;yXxq6 z^##D$fZnE#*WIH|hH*P3bR9&A^;t0JB~$|pxS)0VS0mXkRx@8PhAhlAqr-@Jy`y5h zl}T9Iic9za{OjxR%Zq;P?i3_38lO!?3XU1g@w|W|sVLQ9MK>3r&G=0~i%~&lKe=sr ziLt;tZd;>1$H?r+XYvo*zfwb?x3H`T8y#IGK30nc4Eat~c%!-wpf5_wH9KaHqRxk= zU+yE`I;ML3a(|;ghc0QyJWdWFVGki@-7k!O?~kQrAik%CMOTu?9q7O8Y<9H&>g1t& zqc1DphVxX0*Hu=F!?1GICuyG#+=ip_i8YKz*Vc|g)iuKtot-axihA>G;A;s4|y*q=rjYkB|2|3@+5Zk z3CGq!)tHr7d1JaF`C*zkj85b6!v11cJB8|bzZ_ubO~!-uV+WD7B>8H*+r6ZoMLyZ? zwJ}o<_5dDc&!MTVL&m#H&)#5!O}0wIJH)h!RE54Z=JxgCly;^n9O=NVl@My1UY=z zH2Jk39SWKW)LPvtjg3tcgqsW^8)();9T_OJ7bVo@(P6kE>I^t{Ipf{v;BB-avZh$$ zu=U|T;_eg|$meq6?HDAv`)EYB8*64D;%l)gR$-}8cj=q;%lEcBU#~uMK@K3D zAq97Al3B?%=mvX+@91)syo2>is(<(k0@G(AbTi??hjeJ6s5+eNm@aK$$dA;e*RK&a zeV6q(U&eh~rV3T)prK3KC^(PH7TbFFLce49b!r*{|IZx{PtY72AxHYWfPd_GfTHVN zLq-;{S_Mi*ld&H3vrJPsy~_*5oJ;~XLv=A7zvEA(Ig&V8T*FF@^W!n_h5hVmuO%lg zt*W9?pKZx#sk>QPq^k58Inlh{>uY--29WhoM}L=s4mb?Vr9X zRqL%ju6FrRWh0Lbcv6$e+O*A$=cGV_6Nu^r5cc|Z8Gk+6p7VEoUZ{1uzaSrf=+;Kr zPBolUoK09MK0YkPG(=q7Mr)0fv5l0cb{A%K>07QW?zEx5OGjhMMq|m|V+SH6K-~>0 ziz3{%wq}QG@V8GGL5DD_v+BGkm?&gThpUf?vvdeBv}!G8wzd|@_S~v4VD*F20jW_< zM^4c7j7orhn83JTkEqgByRSg*cSz$5*0XgbP)$SK?~wfbbN;CN$f}wsyy+Gb1Xbf& zYV*@rn|;+@-MTZvnf7lhZ2@xqU1kH8gFX=fk?n0a_>4}auYppBLov^Xt)M7Q>E?DV ziH&NU7J3tiAn3Yb&?UXYr3O4av;eFzExKjS*bzwt{s3*(imK`3s@#<}^bhisxp4!O z>7j`clc?dil*<{9vzGyvADNUaKUq`G(v)KCh9m6)s$8|GuYMG_l&;O2l$`Qt7GT4? zzIUxfcK7B~54Gttdh=>;V1k)AZv3X+_?QL`&X?}}!x!Rk!lQHtX;o-CAvKt35AGVW zqRis5bO?Spy|xjczcCq7t9I|#5E`b6)H0?C>wNxXx0{)&#@BCUH+(ti8ftB;nhOR$ z>j1o9i#f(LJ!aA6q*xBe40P*bh<%I2)oa9np-M2Py8(J8+#(d%aIv`I{<35k0NODP zGX?`1D%co^EcGE{(hkvyr?uuI%@H0Wsau8omSLYvn0DPi^jiBAT8sw})Y~%ZZ#ko4L|?fj9tI=qRt&A*{h5?M&&E1bqnFy^zZWX! zlo#Ln@7&AwyX!0yq#J5JnPLNY0&Xz+YRDrFKoZ*NDYC-`rfuPNBR%zp=sb9Xf{@48 z4^DcYj0p`?m(-PcZAR*}Z`z5S1W!6oabACYkw^V4$9K3G2!#`B|NFrag3**Z=@KN~ z#&2!_p^aLzSG0~vf6mb8VR;JyO!v$v_062OJ0pzU)6uO>rwp1~1oX;8+v*>O#E`Ij z5Mqxsy2Ti)2uF)HiABzf8T3BseTL_DRW-s=9kBpkXTDBG5?z9REqqCj4vs)b z{07a(HL>taF~Dc@-?m_%9!`A;ss7Pl#qaux#p2CJ^@5YWDO}m*10qjWE(8yzBz`F4 zNe{!MJaGuO`v+f`>8g&R>i3FjP1@(O_N~WL{$fWH=CDWeWkB}E@VFurLfV|?!Qbhy z&{n~lNrI3rmfIe1F}MD(T1VS^VZcvPq}iEB$Sb^)$y}0>$JD<#8(nv3>uW&0I9wS` zR*&aFwHM*pY1`N240kf^?i0GvT@&gZZWXlsTLL!T5a2}H-=iux@uP4dz(0QncFr2P zvLBNDjEak?v*lxdpW{}j`txA<_=4e?RqB?nvS#UWOOf?{LHy#YN8T;<`F=%_U(Z6! zPm{heyBPf^A8_dos*;O|{ z0O}xL`*HgV(J!Qi#X#Yg2(A}1zVVDrze&$sbb4?nG|yu3yFrf3)@7MUrNcs4T`q8q zGJj>*U`}C_Z3*7DNX?MHnNr(~I2tf`9-A{)H9p+K)6=!p7eB?T2?U^BMLURlII>Fp z=xYHfFu9WwxBv;eE<-OJ{@Wb#%87v#V(MqMQnjWpAq)F?CUH%nZ}6(MMITsi+@e^C z{17fm53{dMB$@n4Cj#rD`V=mU@J$e$5{Eil+ge)lRCzzYAl?DPX_DXkq4K!_ox^o^ z)=1=Q!;I+nMg_{S8=^DligP(~OKS}Sj%yIfoVv1!FdX6_+txK*Ik?F1+N=dZViG*$ zS>>&%&zDx%Nufi%MWcWxFqY?w&f2hM=Wu@@rEZB=viU|F2eI|4X2-Tl*5Ak!NV>Wa z9}~x^7<&$<>{O+W?QNH5;TX;fa-2+?i0}Fv;G}PDz?x#zz-&5M- zwtnBr2P}$|ufHR%S|MMqDQ}F0KBpDs%o>gwfU*TiqeeO&-fKGOqut$`i#qjArpr0;PQOqb_$I%G^ty!)nIi zhb1-3lQKuMV6iTaH|Ldcwgm?fd6H|#3b_b1rhFX({j|5wZ@~w!WvY*vHYlWpETf0^ zMLaKwJ!SUU{tw!}vMmF8^^pnTa<4flG`BVwWYzPU?1RtTD)*sWboDcbpL;}knH!fj zJ}t(@fiarWT53{XSrC@LHdrI7UVqRC;hs0rp9xG++2;qx$zh$#5!VJbzzu3p;ZI=I zHy{sApwq96$j35?-^Bhb7mL@z0 zV6dsmK|m23ifauo*HDAEIB7o*Tpr&oFI?&qpt5f+?-@ByRx8$w)Lz%#X)*NtNVyIo z+sQw4PEqc#X;Sxdyo?^Hs}pDAtF7QY4+F$Ddkt>=kj=9utC5)1i5yNpRz2t1q(}F+ zpuFB3i+x_{)Uj%0F@maa=r=;bZBEpV?29Z)GlTX*M508Lt7U7rzK5Y0W)ygp=;uwS zNKk>{fQwmxs@2(;oEdKY8h2 zyzzy<-4w#c?`2^^N+(vD_IGrK9Poli- z{bcC4h)vQ@Ygyuv1ds{_4?9>md`*2^=FL+zmJgKZ3W|edoy|Q``aRey!~b9aeeA#p z=n~jKiR#tetx-yyvUhYD_EZUiglT1*r{5F1Ow*w95?SUp*KI1R(GT>&83 ziljCwpRT^|mju404m~l%+D;wm;crddTo6~QF83T=tv2d-X*9CXC~c+ITCO0DFxxks zN7~vWn#Fo?U!BHCt3L*wJaqrIu83pU&cKcI2}NL+Wf<0iZOmVPc?&nZt(`YRiGL{@ zv?fGzY(g}bdHOkJyy`O0ttoAix8sgf7@L-lYx7i+Z-)ALp3Qiyf2W*9VmuAZ_#i<- z#W3%_eGMp$ksZRco*W2G4NY5;hr~BxT+y`MFpOR(RiVRoSfOTyzS10RP=b5WIP+>` zM=0*tr6LspsYpxnYpKNEY$&UD3hQUsdT)7hvd5CPs#8$j2k`U{8uEp1e%4djm7Ehw zD7!$?Qad{OeRa=$-CcbpW_(=D&GC0i`#c@_@_+COudo05@D+u>4sS_#=8{hD3hXrCLX}WQ>|xnT z^LkLWDQmI^-aI}YqK*$Q?w1<(1wJ+;uFa&-0lDCGOL>uwfMNlFKUI_5Rg=`ez34lT zdWMFuo-gO7A9DILn0t;T2hR=c;(9^?t#UddiXO{zt7Gjdsq9;9qG}BVMdJqbF%x1j zJTYa1D@bn(SP8K;@qEAa@His}sI6Nh?j0~S@Bml_#m)RR z0FN#frGv>=!bWWJ|nW^0A`b=(F-^SO+;CvMsP=&M;jS0!A4aM0*q$`X;N}-WpiYHsUVzexPlWypDQMG74GK+01z` zu;Q?=UYV4PE0f2lJjG_4FNBS3) zlGXusY?tvqhxg|mfZ7p1-ON91Gs#QgqQ(udsXvg@Q-H93u|{~WU(0Q!zWX16chmHX z^ERnDy3oMQ?sGw&#)4Kq*qiHIPsm#&e!f0G`FhQpJ$|*iec1qYIrCg{#n2*AOmziX z-|DiimCL^w7T$a?&c#FsK>X?@-=<^HD%}3ol z>Y~Kf7`(~wU#9gR?(lO1{PLth;JT&WXBPxRe#dEwFEe2ILNlX`QjiQh#G{Mj@nfkFLC$_In$;9Y0qH=y$TXKjq{cCx zNr9_wZrZA4T-sO!2lxJkPcF8!S`-{XaPzCY^u0%jAg_;mZT}!Rv+-ka%KsOV&Dodn zS`{MhV$2(i2E>h%PEI0*`A>$1_~2c&xHqBah9qW(ykRRP?ZP^fPSq zvdPd?!+6xMR4XNBCivDU&&Tn|qp_AW*4P^?^w9C$*c62u6l2Br7A#a077B7>Y3Yu& zESH(D0?W_ksIWBYuw&S;{9BfqVrfCAkiMxfix2TB{pT4L44*$y!A8Mj2xHRbV~yLQ z^_!c+=X4rh9Qxb%eM`?iwrBW*rkY35C64e_SlUy|2L8ajv%=!W#>ll)fUOp0N0(n6 z{=BoQcO8Z{YDUljG^|HGh9D(qw2pw{x_+ZFfuD1kuT98$Q~x+gH9LCVUaDWyyh>(* zXJy6zJ2VWw0zbC32TAo>?Rp@3Gu(VC)P9(MIf{%&oOX-H+DhMM`%Z+SZ?oXW2KrNN zqp`a);5Zho9p8IzC%Yzkn{2{)Bc*V$g7K}G^4R6o$#<`VMi>oy#hmY3G@}Y z(&l2@K5lxrqIUvd`!3AL{xzwJo#uJb&o}mdmU)q}V)N>k`ByJPv%)PCO(;4Xq;RBJ!eG;(0K(1p*EO|i!zBL7emPqgC9cx2#II5j z?qnQ;&5t1+T}vS+#eu)kCOQfXT1_%qv8psA;q9Mn+W2dj2IRBat^M;qyox+U==Vf_ z;`h>_kge~6T!c);=PS z)shR}&~nlyM+?*7en)a}M>mKZT*Z&T-ya;zJFL7ON~q~CI0uyDudfF&P>u*^0!Bk= zOQ4su$0HRH?)7$Y2&;jVQ2t1cEhI^zYb_U=!#_Wgb|4N9QYH@Xu#}%hnWcx3+01qz z``oN{MxZ2_ygJ2=PT{0S-0GA$CjF~PlJ=%y_4B?{EC!&Vqn>x)Qwez5s&qs(WD5t= zhKoplut7l=iDl-cG;Bk7uI#z|sQTX=8eImxPk1i58|sv0Cj1SyN|83}-5?{CRlv20 zb}`T2#LO&3$wg>aJ;FX6uRp{FhQG%WiUg4QMOSPt!PYC1cW3O=WK!6R43*H@frk>E zyG9$sS3j_QR^nTuql_t>jW6Ng(FnUk+l|cFrX>SL)TkiZ?wbCvFwX#i`vwOfSp!uv z4t?;qbQW117qQ=ja=^z3Xl;%(jbF3#A`|e16flPbGxHIc&XU_{u6LukH2DLp9m**3 z(0SIf(lOg?f`6mcvB#bKIdopNQSR&UTddd8steFW7xUAUyt+YiSwu2?+YpL@?a|p) zKc2rmTrq&57D>3XeoJ$M2aQ}?P$ zXJ}+5Hz8`tY6M2q_xF`c+_CvoUH8`>OQP53AKs2#(Z<6xsTk>mLwAkv+ug&{PzLnP zY)_@{yhXib&y{zJO+=Pj`JX_W;Plf|-)qA5;%N4v-#5}rii!%y52to3eJ&RJou-TJCXjj0mg1wIM_TXL|e5^jmbt|ygex{S38D9;GzLl z1iF*_zFfXg{2GylENW*MrYgu$IGv_XLdw}ME1ex>hdxm70%NJAZWFSfpRVj*gwQ?7 zX@TCKvA!ASFK7qSWUgzQSLk`)$DFmKdA+FYC@0>A_o@kt=^z2=Sb$hoqhgS@ zZtc6abUo!{q}{_%QwPNlff_BhvNMcO=t4`COd9_ql@j+axteDXga@AF?DPVCf!Ph~ z+%HZt>N)u7P5*NteyDtk9le(3&DHO1+>lfb3-1QkXRfWibh>EP6Op-Uy&qjEY@8B0 zOUk-=w+;*F9h)B~X0KLK-bu6x#pr(zVY`0#Z*N|Kc%B#1uF6=nzu1yVU1)tP#?bBg z1x0-kXWJhZ;?rbZ=QSDte63F#{;og&G>prqJU*P2ChaCCV9zgBzOqD$o|^q#o&MBT zWNrW6uj`oL5MuLEa+kSHzWy^ecxWaY8yb1^N#Cb$i-E8(t2$-}@ZEp!MVg4rif6M* zI49A z9-?x5fGB;))16V_AWcwiln@OufkDW-#D7dP<}*wsC=Ov0_CF>G&J_=wCRqcmau0k< zBouI6>cKqCk!MywbJz~}u&dT?p|@}&>AK*JF`L;E{>+aV=a1b|DEr6{ zX>0A!FHJ$$4+pxMm{@xvWm%yjPq;QD@VD>f`<;KLYgNkC!SX0J{48l(Wonm1*b6?z z*gPs*wHV_9A{&0PTyT1F@m$LQK-&h`r=!=U}P zbtJhGie^&y8+2H%#ZgCRaROVdlbl;v4dy_I7H1I&e|3IgYio0JS>cLKd~>eOy=QNg zWi=Q|9g6XEayi5o-HYZ_7an8Z=Hd=QeV9TYDTPQ{J4qu<={y7mySCI1Z$Tgu^MkNX z{xx+2kbj?##Ic%hhtF-xerlV zNG3`)x=qtq>Z0Et%i=bHVwcAs79EN;vOVPj^-LkBH*~HjgS>YrrqH==8|uiUiA;jh zZ8a%bR|T$O<{5ESL^rIy8){n~SeRg%3b&rm_$83`fvzAwEVN$Fcig;2#^xQ84k}ng8Ik2uP5}Fv!(%e_m;2lI78MY(js|&&;@x{( z&l|z}m-CIva)@5RFE!nla5T`-O)zwpfoV-wAG+9RrDh2zTKSjzZIb3U>yMgnzZU0` zbbdk6fdT??i0X|TN;MOM{Sna~koqLxZ0mt=uRnAM2U9KdUUfH{)L~Dyp2g9lX|cyU zhvj-q&)r4xFaH~G%dcfiy?m~jVu)U*^(0^|XI5YDX#DQ$ci5IcOV-`PZO#OD5$IVQ zkZ0e7j(dQ2k%z@iN9H+vR&)T~-p0lK#4}`~r7tF#vLvq}=qi<4Z$l!_36Tt*92_S= z$L~)#6@5wwO*z;F`e*?ogJj@C~2f{)+H0}3*1?Mfa8S{patRn-Q#(X;g|RFFid1mcIrl>AgfG^L!-uGOCs zOrih)D%JPrKSXjHj{mzN`GAXF&Crz`GmX`Z5H@vx4l_mHavR?93fw)0%vai<*Avwf zy28~zZZq7@55=jzgRib@bOjJ;cJAXZICMYE+6^7)B4MYsYfOb1KJ!^co6f&Aa!od# zPBS%*Q|)q)_`p8OZ<9P<9()<_ZIUY;K2B<*<4gz$1ttmTdXI5%Wq|&yx(2(Fzm`%KX}US|^T7vymTdKI+OUReAkix8 z^)5f*QFw5hdNv}p+8Jf(3O! zV42xgVVvK-?tW-V>{Zs+bG5^}FD+u$HESLO(&GQ!beD7U$UwVQnAgwrd46Pee>lBk zSk^2vMUV=7<6;YFiLaBt(`FrOtx#iFoG5ZrU{Kmv#5xAGO!J)|dyUT%Wm$^B^glPb z;hvGTzmG+*5ELt-b*F&uj&PJ&+tGK=8b@Lb|gS@3;jQ? zc}cl+qWW=^YO)Q<44<1pW~xudJMO%{Rb!i?uQhl|l<0WwFX$mu=*nNR7Q%HhRXMY5 z%giQ-Z@3Fel4h*-s_v>|WymY<J(`8zzxV3Q&J(HxLIv zJ4P+Yl2r$^42OvS8Bn7Edk(GI= z0JsNp-1oJ>kCk0c(~xm=+1<+~fs4o7s3O!G0t}RGI+dINKYoT@N9CBu@d+MQ(j_Q? zhAiSQ;$JN^e2eD8dO@CNlyx|fCG<Bc8Ym1kM1DOzU78|JI--}Ry1^h0mNrIe-#MJie(!cus zm1oa42=}(n+7<+T_i_|O7~-%k67?{gyuF4KrP3f8OD>TaYCuPX2Cr?X6cM>LpsYnX zOH6ZFe89)IC56xP7bUi1T)v#LBGZL)zV1*ZCPe~JN=HqEpktK%1;Wqy^pp17FCoU! zT|fI~$IEHJ1_7mf#z|V5Bl=PB<8Vgx>8*e7p+?sNGf!4j?tte=o#L@AT7sk#<6==Q zS~!bFn4Byy{J2k>x@rwNeWuMUx&(;qo$syzjvrs$Ki67gBNNNBByfhwPNz5oceIJHzq7`B>6W<@XZ`9E`oNb;{yxW4=e!&~DB6t% zyotiO5hJbh+#S|H3ljfPTay6Q{;sVNKKtZq9X>4DRMPz!be}sBJ|=FMRMqgm9^=pj z@HTt!#l7Wn+|nAd-3RJT9A@<-v29*AAXe`x1sJNHC4-Od(Tln8NMoC`yu*(P!C zq;yeN`6dcA2-eDk0HBoA6~|Gj4FvB{rM_B=c}_8FAb&fKH9^paBb3ocwHK`WrWO9q zgR>Y7#Z&hyR2A_xRQq_4pREkP z8~^mqTZwvWgnUuSb$m@Z5Vw5iZhIT@1`;gyhiB6p>0d2uqtRd#bI;+Wnz`JnY_aSmQ6RXp1;WX>=G`gV=(=r9t~`;k)0OnX zM6rQ15J^X*ecop(aBB-CWp=v1V#u48TQV>a;uL35Kiw`98VKL zYV7nM)wRt6OQ6X_XNq-uGom%b{k;O6i=$QR z)TVKmpE=DP&u|V=K{`K*0RV{Gz8B8pP}H0!yZhTzY!YyRIa>cO#`&-fZ0B;6$(>}T zHL8sUVks$O!TkT$Hy=j01r`{OJr(0L1<_5_5`c72E)U@NJ_?#tVDH^z2AY)BZZEDs zXOCozYwHy)#ztIqW!|_TJjr@L6@!!H_ML+0{Cq}1VxHJbz{07zT!6_c5-ROC;F263 z^zkp|Wm*ah=MZH0OrPy2Gs5`T{GBejV~IM%?l0?AR>17J`iq5U^v|a>vT~>&*>>BS zA!6%aVZThVbnza@n5+q-S=zg@wo(%kB@G^o#HvkL`bc%r59bp%CI*vLAz?gutro+K z$~)vaNRL;kNSapdh(G^UW0Oz8_lP`2rY|Lr0vE;KWi7po82bf7R&@D~7@N{_awaF& z4;{VG-EWJW?X63?;>(l*2d}l?b+3xPilI#qClZw)n&x$2D%6%CvAXMdR|@Ps|L*1a zdmi6?gvb(!A;ph#9=HGB9rIP#Z^xVjZc*kxf^4PkH(cevJEbna->Ac^ME!#0EjGjC zqP2Lzo_}4QEsn7wX>1N->$d3@y?*&Toi1S9IoDJ96o!^Y=V-PQhJTvey61IPgZ+%= zmIGzDE|JBQS|%9S5Gs1gbAL_iew|3w!{@_xuH*i*<{BwHgw!h71^Si4y}EAzzZ~87 z7Fx=#!-9|A`&z#O!sy)^3^ZyADEPj4(k^3VUGabL_e|vyxAl3lxbw>90er332g)|J z89r|>cfSKQyQFKP3URyw)>;g>c5*p7l#sv2-mB?;<#D}{xZQ|Yq6|Gu@KoqYbJu0Y z1H)|yPJ`m}&2(m_oh>oX$r+I|Erc8 zMuF6`)jaUU-%0l^4f}iIS^w3Z6ACM zZ+V#hfzVAjBHO5q!(%?2&%{GX+1}Zao>{;0 zWPAT5KtH*A`$#S?XUqpby7(=k&p4~~oh6$aHexU|Z^7kgUHK%0ORaqnJFJJ&t+3Tj zEa2<6j{F@INNI%-#Od1zl~%#3d^;I>qXWc?WXl< zc^~^njn`fW3vCZk$j!nfIO&Pl$T}FG-~LBnCaP`Wj&Ti6dZxOIMa}|91DhEn@5b*d z%RN?h`q6Nk$9|b=R4ncTvW+8lt)?B7g5TGUATsjK7~&H}KfJu@q?pBrK_isY91=N_ z((;1(cD8);3G@p6nJRQlZ33K;gs*#Z-B(EKWbItxn3?YR4FYuDNoj?q#6Yz9$QIjo zR2&$Z{3#{=Q<%->Dnh%m+T>2~+RD=)f;twgv(482ugm3QPx>0y=FzHo^L%kNy6lI7>ArN(P8wn5 z60sCExu_|n%8ete=A`S9vy<17NN#ji_kzY&Kg!typ@Un-DshZM(QwEjAPfvp55xAW zVDGbNb4|gBK_)ZOsD|5!z^fbDx&PX10{!-MTUFF$9!LerG^W)Cb|QyOCxBpA3KuGf zuJ9Gg*s*Zf55%R#O)%H-&-lCDh2CC6M`db@Vvz^UY^VCu6u!*eC`ruYa>8j zK@qcC`;A5vu^atm8>f75pAm*N8+9UGWSaWYuF4=O)Uq|xzBCYZ{XtSc9t=N1*@p&d84P$>FWiW^SDEmjSCHLD(I zXWw$0h6I`E5w``){$C+Jq0N0?n7nq)uihfJ)^~AV80uAthaa(c_Voelbv0;^*xTqN zPOkBeQx10WK!$`ywd$Zcd;|*jl%_Z1P0aO6J|0JkjEuDfeeeK3J{wtjBax5>r`ScU zDTXGNW0CZk+!<3Wx1kJ&AYt7g6sOKLMRyL)0hx^=eBX)(^Y|R5p0-B1LWENLD)S7=@M?~qAr`WY|XN*S+;H4wr$(CZQFL$EZeqrt<|e{W1l`9 z@keC*d6Czd-}8=l#LkQ&;(D~zzNJ2$;i}^GqhJ+s*=5oBtS zh+D6_f{!bVW;&Ml-+BsJ`#G1rw8WvAt;-|6Fim-s7!?#iLpvAA1wr6GDSoJ`( zA7d?Oxh)aaL2mTwb1}`Uy1=D!{{&EJ<00HjPLT;B1hHnYt(YjV8aZiu$zuNtf1%NdhR~erN$AK?Fxm`TrSYE zGgj!SOI8GnZXzR=qo~xl^;97{EK^l)R|kp=SahQzDia-M<)t5_W)nZ1w8@a}Kmm~S zO}t(=@0!f@Tip|^ue{k=tXX(q-uhC&;yN1Z!6@}h76R6zv&p3aYSa;XKe z8(kYqL3Z2q;eZAMKh--n8iX2`RT8M{{2^&dnoYL79r=0fkzs!8(oH&Drwt#zP<79A zEPuCyARYm}>_Z8<4hTq5z#b6qBTafa8Y5WWExhiw*2QQSw8AXMFI>SY zFoTJ$%1>XJQ=GbnIa0?KllzKbRx6oL*G(5M{S@dIzmae1>r!QDR+10Dy_n9U=L+Eg ztn3MUdb;YYIxWW;4F+9o+`!&ufSFWeH#eEpw5?!tRi^+xCNm5x*w3cP;KeQ;!|UBm zfo(tfWgv6DCAw8?pw2%db-@nkt`QQSk-)kks;K0&gV<=+Uw*x8#Cn?HIKk zQQCut^)n+MI3;h(p$fS;vxSK;$D53AWu3U)hocm7B z{uuVjJfZHy*jhV(a#EZvj|YPLX5(7Q94)7Aqs=HW6M%oy$w!$oYw;=DNNx`aClBk7;UyOrc9u5H$9;@tlz z>S_>6Fz)7abxDBVn7>&1L3y19_UzlXwTdUT&wk;YR1wO!X|HUE52tT-%XzPOD%_`^ z)X}i&9*@a)4T<5yZYuIl|qz^ z@m{Ez?3|5iPfr&K(;}-EXfh(EH*g5Q6-R(%QK0%xm zS`o0U8zRd2ovm$eyAeUp$G(T*dQ_w=KCip5?aGB5SvqXT`8H#I$lOT0L$W<5>j-He8H2*q9rfvR3Zdc8gGDQA-M+z4B?{wKF^=z2_giR?*dMVsY z+1VvHiAOmal;w>89F(Vbe>(rs+5vc}la?&$IgWx&Cc?WvgfSV+Zk}*F;AmrtT8atb zAkDI#)*Faiidgz{q6#Ans!R2>OOt_5yC!mRw{LB-FZVrrxEn_UD^hSsv_Z6Wiw7md ze)T5G^k$2v)tZ-aBkZ~1;klEI+pM6;JBq%bJ)Nx)6BHx0iSS-$-s#d-9JK8qF1qBH z{r08ti!ga0<%&spL}6k}`)k)%Yp7k<{NTN}0r;ZUaB`I*$01?7?Rq*6bv`gqB%r;o zCDoDtxj6KKr`YlT-MdZ$e`D^{{qL|?9{XAP^mvluxLz2s9Tz$E{IAdGEvu4T`d&5eGOgR>p#U( zQ`H}E!vBmCqI&G_h(rsR#VNZxb!^1;&`stEB=SE)8>nh5aQig`40rUjuH4gE$~iG859fIAPl4LWM8bwSGc?`Hw zo^FthRP)PHM!%$Og&Le)0T^eobMm0LS6xzjeV9vhDteJg1y!BtS2)(Lq!;it)gb#; zmIhOsfY%Q41p(Kiu^D=Af+-(ibMl%%pizLF&(L~3-9u3ArX?aZZDRA69}<`k)_ioA ze~Ci*8^cQpT;;Df6clyU5e8inxXUnbH8;Zee4p!GzfU8B4<)v! z)#MbaA6}Qq)x^w4k1>V(Ydyf-BHkD(ySK}oQkxO<4Shuea0=O!Q`shnNg+3btqWyY zGVh+Xx&;j2#si@5cSAp_mG+So9DV6z*-Nc8c-&*Or0J;WfFb5y6GD->1)qwIa^1)2 zVU8EBo+Lco?p^BrvnSJo3TrR#_I@h-6G@`;@?Pt)7PryA=+40MUSucX`*oG4hi;D} zz}N0yN~bZNF6bRbOk3oUFQClX%VD-TqtI21s=Wwwt1*sa5`l$YPScEcQrtn@=X~Rj z_KW6`K<-tG03wMmjnHKaHh9J93t^QZ5|Eaje|YE9sCsp2Dzgqcd3;JZIkL4FQPB*d zfjH81f)k-Sd}WF^7<8`fgYl>FsTJm@@u{n|33~tF*Qr{I?DT&$J~f%Hw}VU;`~tLc zeqy<;0*FHH==>?GPnIp7IlABg%EOEz@TgGY9^C`H$a=;}YxhL{Z>3M<1LIeV5PQPo z{8J8dRDP+Jo0j2dj|@vzS$^EL!LK4+m3ZXp2Lf-{pukg9h=7-Q{%+A;yH2`MP9S0e zdMkW4mq5R3ghZ*92vJ^vXL-lwjoYYTph+^){E#;c#}+y@r?C4x%muCqB2KJGM_mkP z)bq35MqRHB$0OF-{03echq{cgS7xJcZPO(J+#uqi@iQPT2NHafb<$}7FuiG2F`f4h zACGW=(H@e+2z?+7V&oERV|f3K;98**uQ=C_bKwjtmXh8q zD9yR!dyl98tHC|Moci(V0n-;_Eh%t_I>r4v!oe&W9PtNaYq)l;wJB#dBcPo!Q0JX& zRU+II)CyCWxdfBp?kGu9mNimr5ym@9Hy2hK5~ygXa$@))ihPVh6`BxvDp{9QG?w@i zINM)K`r719&e@M)5;OeC0p)K|PpLQ9sD$8sAbCZ!!8|yze8C8@FkRrI`{@W%a zb9~!>^gY?Sy+vYQ>X6_TI{rP9*M3la`vd-m1s|gwIzX~Y&$|m9EVu9f3*c}QtMq*8 z=`yKS78=L#L?0A>tr~J8W!x$gDGUMr!`wWefboU@p>0U5--Q0~0%2L-JRaBE8^ckT z@ZZ}ie5QU)Ub}G##bXT_*O#E0#9ro1Qm_-JUv_qLvy6#@H6n!^g%_m}Uf1xhaAO1_ zL~#ZaR!`g*x-E4~dp6nI$DW?~u8`c%pHT-ZvC~yJm%lc%CB-{W&Ueg;1R)5mDX)u- zSl|u#nGO9*2FV2$uE^^}rOr1>Ppnn~@CN`C9L6jyPsK^B9PzE$(x$3FgJo7*x!BU; zG?}jurR1X*CHshp(+eF7f365paD5UQz<>E-9*bDdouarIpFw|xMND+qNKgGp-P+yA z;oOoP__EamB^o1Qr7?j}u^oBzt&>ui$7MYHGiM7fAB=Y}9f|U;I^egpMEBsH`q>Q_ zi!!UKM%3I*2;9Kd?k!es`QtqXTo?t-(R}7j6N`hJ6`1dUSlE8OU#S#5t7fB~gjx!#KtBBnHBTUo{QE_k5&+`S#zpDUe)cN7L#zl!hn}`4Go}cPjI*aWuIfa) z3;(yg@#77FWlwOr;gx%e>MpQQbPxRiyjc+p*?ci~K{)rAslJkjn3 z;3IqU)dW(g6WXmk#1LQn4|FU7oEx8xdp45EgUp#Vs^03Jjc7>VS8I5Rzg(TB($Fv&HjkpsU+S2e=iCz`6wMU8AN zXCy7TQjn_#8bFO=M-Q`@g4Hp<$s4G8tO6tw@X?`R@x-`VPPYT33q!O(MrXbR7Ke^3 z7hdBqlwu4pjSu8fTasyp(X+!3zl2&>=~1flIPE2aH~?Sv?F?3+tujl3g8#n zZq8~Ov|-V$yn_z>$!-N<%&h3&mN?`U+z2d%QTn5e)*^sooJ;jE6MMfp=4zENl+Wi; zv=NOPm)vLQM^_Qh_DZm^dhECqKa^!5fwNoB2`L zt#d&5vO+MAqDx@yNbnkHs*9qxp;gzl%{mXm2g8;J5 zuOl=plr}=;eVXa*oR$FRU*z5CDGw1dOV0^=OA%%=|O)8U)uC%2QT-{G&`O z7YT3;A-Uf2Y@5c)sFi!_EOe*F%IV*qpRf05`$5{vKJ)`j{IUj$vHc(QFYR>eDu7u> z{)RSEJK8vi^07X(8D&&9Y2F{HI$l3V*aIR3(ajxRJ_FPm&jJ%BFx`DfK{wwIHCMUC!|q2%Uq(z*9eh!nRF9ebl-@KbWbZ9X$(M0{RQxq1dKLy@cgCbd<;7{YYEKm5(` zqG|*RymvoaaM>=8yC$h zWl3p%AR8qhWeH^v^c@L3zmb%y@C94Gi@tznlA1Auu;BRvg4ff2AK+GvE3nx$A8@{n za|LIK{<`=mVTx2cgijq6eN!jleC!Y@{xD)fs~tU!gYoRd-JYF;xB%W}(gz>agrlun z@&Kugw6xxdOUyquA+J+n!Fbw{<~d*g-a*Fc{IUeSwdsbLrjUo{hzNJkIQi z45r2qg}u1{&EYYa>XagZd63?3y0l$OWGV#A^IaQ?GTQa`L1!OrTeBZ|xLLoq#=^Rq z*8s-nEfs8_UIBxGN#z7OzaiWqKUzKcjpHLBy(1o4MnXP1=-5sJxX=u7SMwIJ7D|g{ zLao1HWb=*YF5mJIvDPIcbB&F8HR^Ryw|?V#W=G+;fO?M0blii+wVM2@;of3;sXCT30SNb+bmHIYzA+^x%GsIgL!&pc#KN92J^j?7Dz z&DAB6c;t5hl(-AxJs2#893|;-r%SZ4cu{F{tK2J4wtJpm%jTQtYcLm|k<3=}&eI3{ zo#618rq83h86MPF`?-I07BH1iBa{q>6I$e;78I4EBA8}>edIqG3YI}M>TSLCQZV>y zVetj?XFEVAi_@;k*S$r*GC&zr9#m_da*^YkfKUPTr8gp6dy9&tIG+PsuE2_0J=1E4 zfyy}!%Zd#TqLfYtlH3FT%#RPM!Q_xuG5(2+)*Ra!BnX>FnT2G!!m5WJnP0!~!k1F! z2dfs3nACIF3WX)&in?zP@Wl^nuJ4MF_6HFO=?XjKob|#hJZb}y@0$aLq|%~6inn3e z_cO`{6AIDwQ-dR6E1b0`D z+nt|DhoNm*LGA;Ou2tLVwLgi8m+>O&n&&E9KP01}sy2$?trC&}J7C!Iv77 zgBl;=@7K$1ZLj-_wYoUEoP=;|X_(8F`3%m&gAE&C^Q4W#47!9R+xX*|FJljPK2-b7 z!h7`_40C#Hb4Kh^W)hu7!bz+Yl+B2BY;NEJ@8*mV1einfxyDlwN}WTkHhNHuaLXfn*8d z*$IiDZEl5S4_n%YVjV-I0+_5ENtFajSRseJl8md4fMkkMqx|%g1Wl=eqV6HK9`%q` zbhv-^hqwm4i1d(RSdn-HtiZXd`dPo$qo^|BOA4EM#qEpQLzDv?Bt{My!YaP*h3A7K zMu>DL#kstvC0IoH1%czh&4NriLF;2M5*8Y{Hf;&J*Xi{2j$0z$8U?J=H_`W#Qxnp) zZ&_Npvyu(9tEC`%SFV^M=F*qlkC^|UTvRvWnSaG8*3!~cS?}^+PA^u+e_LIem%5vPBv+yo0%Z} z1cI^D`MA&2FHJAdFRl;$?c)|8^261!dUVJRffneYKylA;dSh zzy(wd9xb8zv=aJQ_1B*@RBnkoYu}0883X&lQiC=Y(ytlo{2W>;_rkXp$-#}7mRO%i zwPaGMwVg(yP;*crKEa-6Rz0#l5#SGaRR<8+YIa9q?J%T2X<>a9KH%^TIGvJY7an|7ep~pQ)j2ZEC#*ZUoWm-1#pd9%jJ7B zxfDF_z0X3!UQGmLmpyV7_f2Hk;I8=^q$2HUB{vda?sE}AVvziwJjYTTw**}Fn;5TK z4=wt9a2Btz)VBEhyWOD0C4S194CFQ&oGI0`G)}e#Ro#p7CZ3LI^t2FRu8+r$EY;Gk z(DM{z20#`SY`{pS+KtZ|gAAN?Bf4?xk-ZLCvQ)f0?3C-z5J#V{ln>0**B)~8sjY)L z(Ll|Cx&Y~wZ@5S5n?CdT-04d+ssc+lRN}D$>2Q>REy3bvO;rRvfQFqs|D5LH5Yj(;G1I=~{@O9D4*IM@c zD+Li86YMHSkFl?4yNlkgnCtGQXAqWaE8=PWY4?NoZm(p{)t>=NyW_Y?ZDFKYISI1y zjbszmWO=M?s>pCg5*yiy2Ceu<^DWt43e{?hDHUc19da_`xytt|ax_CBEcKO2@2De= z2a4h71@$e)A}^JV0Jq;++iwUps=doe$x(!I&ve7uy9hg2Mg zF6+BV9Ea9Or$8!4U!H7qH#$7NmZ;H|EEoW9PsW>{!SLtD&YYK3B>TN}ari$-5UF@8{k?UD@MWpSp>+YIuS$y*?DVR}p zA8@YChG{_^dDLcwV`fw+U5+;4H}?{cf(%=3ls9PM9+S6a`IgYXq2DKCe>POTCJEH% zu-bRo)4J#o>TxvBkssIJ&hzqJWZan@*4l%u@K1?$*M7+#U z2>=)oME((;t1TM*)VJhCbeUMx_!xs((_WITZH_SiZIK!+)AK}B;5l~N@-o?)J2wYgAJqi0o_$~h0qi}K(k~2#143>&Dk?QapG{j zbkKzN?sZCiLO4t5B6`UrdlTQFuoii#{w?BIk!#X6LIOw$qn0ap zCvZ(9Ipkf-mbkiROS%TQ2)S2u7IYK0N$cG}IUxe0!OU5E<#D!x;BNNKc&w=gWkbc# zem=}G(i{A4rW|Q(}5ycp(-kCBHp`F&|ydfFza#g+aP*xJaPXs8&Y)zX) z1U8e6Zdy@y0*5bY4n5lP#E=tULj&22jYMHsTLgtp9o3yh=RQ1(-Y)p#d{R8pgym3x zk3Ft{XA~i^hJIYl#b}8eX={L)1C`=UrSj(uPT7&8=9!&U=wlhT6qvG6#7_F1EzIL7 zW7=iqIkfn0i^2rqs~2UqIM+cUMt#Yv#fUxKQDRx$Qs&P2&Y%Z{Q?KPIxn=UTw}UG* zJ$e6iGE@QWt9e4kKrOQY@2Uxa#3ar>?5J(YVK6JW2$KogPrS)7af*B1Q z{miC?Q38p6J6gk~T;UMQ+6q%1q{-YwAupJW6DS)um8p$mTw#!Dv`L3P8OdB{(c`p1lg8k5rVKN z2KiY*+GUg%YZ_20!gyfSU*kF&9N{p1ss!Lil%D3g5-$!oHJgmf`$C5JPl^X zaTRhHmlH%E-*e#zYZ>1A(9FA4??50&t6FRi4OpoEUc7vGECH8sR)=$$*0(u%pP`G- zNiDv@Y+dH8zEPZPFOj%xa~jng45%EIhwa=V&-h+F*`d}spGM26-w`%m+>3-(zu#6% zIC-5Zt-#|*bm7Vwz$`uoHhD@#NC9t3Mr!XdnuE_tg~14(azTG=s5U*?tP8W#<4&L8 z<1{TQ@4|62pD-!>tVKKIYRKrWw~GbeAWy|gw8B0$o)Qk`Bz;qrhi@+=#^6gGD;@d) z>*fIZy^0^A% zuA?5micYUW+g<$3^U-EG=J*7Jh*OwJ#uaw4V$N_{LKie&+h@|)AXP0mP&cKeH%&L{ z=j3)Lp0@Jovd(~0bioOo8pS`ClBkUphUe@}Mo}>Z@EQp%DLog8EmC$zS`sJCrm>>x)v*Ul*%ad_y6I%2QGa@$o5;-4<-Ig2!#mm*4rL$N zf`7s=So3$?5FWhjI#JZ-F?)?A`0Q%$SdH|RzIX3^t0Ks26z}1M!DhBMo?c$+f*=O0^q=VJ6AQ@Hy5736bzFqe(F z0+OXp1CjLF|Wbzk(OoXajw!8e)jDIf~xu~R{nl)TtomvJ_G2Wsa=ssy z`2jK`$KGLH0FZ+_RV4n7y}=!1<@|BirM^}Jo`nY-& z`vN0xl;(+%*Yc$J!ZPFyFm0+2)5hDJdc>Z)1vt6vY4fNupAgtR@-g9AFZ8);->)z& z4Lqlx?@j-rQTYM!;cI{b87RCS1}B6e!vipRn{W*3w$vD)evb>OYx1xYD~Zt-E1KZ^ zY(XQ5?Xmdf0tJ(p)&$sOlceSGRagb&Jf>Dxun0_!AwF}g(*3&MJiHwZ(7%8fF9IHOH^ zDrYUs7AM)Wowl%A;lIE{(53Ay;eV^y8!3;%2&TE@nu|=h3(5*JDNxj4wyD>ddjeh5 zL7lVYyseiMC=9T9xj_svJekgL?sNS$pgiq2C0d1d23KI$7Bf=41=E9TO(H%NU$*b| z>q@`?{X^~A1$0)XHaY%j59vb*f!cii7jjlAem)|^%E_CRa`x{+6rn@$MiEgsb=hpE zqU!Og8F@HgsquQG_{LslF3Y1M+!2Ox72gq9o0`E9%P!FF!~usH7TBiU(1gaK+SD2c z#N}}1=9qs{%XPzzY>3=d_7Nv2&<$*5Fwuv-NI_E#E58iqrzr=_ohF*v{u~{rkA-H%`!7wg;xkXOst{R*#IIrL+eywya zNpk&!_pdEOh6XfDPOY7XEdx=T`Cp>+LhQ0Me+h9Wu~X5XD}Fk*e@Zi0YXI)Kgw66f zrkC**^zUD2DK6WY>EAw1^@lMN1r_^nM@PvjG{%GwfJFbazAY!>{r|8&i~nnV&~Zcm zVSN-U|JC})$^QSXkKX$KwLahNlmF5B9%uiX_5Hg0hxO6m=lmDzR^9?JTP!+9r5kshe!uWAcQ?xPcrAMX~Rn6QLGjKH*Y=^%q9%us7)5>8w>a z$#cEAi!WSLa(rz%?ibd&pVCqKD?KJk4HxvOiE+q#iMWWnY=N-I5|k;O$kBTdghrKc zrsSv~_o&7aBiyEnjR*IWOEIgigX83GE<>>u$OM!dl23Ae6AKI)yEha!Sq#M%$&SVm zsx~dZopudVz=kw%(JfGTAFVe<=?xB_K(*xKsE9vc|2bRWm8bj9+6QmjuPmu3P28J+ z0B(Ut(Jjrz)=iTDwFtPMwWx@r*uG`{_ccrWWni2lPOLLR0d?8Z(CA#;F-Sil7K6PLZHvvt1$5!>|~2`9zg z4b_X21P_E|$}$)Y!lF4{-e|K)sZP1eD0rW=Syr$Nz_cCuW)z!}6N%zGBAz(fb0Z@ctL?+pYeez3=Ahzj_}ik%e4c@z#!7(s}vKvpjp?F$)2O z07}ft(4}k$23f=e%fTOK2JH>QI@4M0)8+z^UF;Nm*w;>Tbo3V;5gdh}3dKfe``N@s zLJ48eWM2@e*yJdt3p(L3$;Wp-f_9GZ+s5jZKH$5XB?Yd8sXJsdqRgsb zHN)lQ>djrXuT&!lQLCRFLqE%4z~ipGV{s2PALTntbPAO0S8-eh1))V2d!}fMEPHn(a*j zSnd@>+`D;M0Ubmf6sdnk_%HSwtjYhs>_WViYMvL6>Jye=%YlU#O_prQ4DX1~7O z|HOVk|6)JT?o|jWoFEx>b!7#q z&Q#qrF`|HvCez)*nzr_o2VPU<>_m6b%&BJ8Yos{F@O(yvw(V1uRH{Qwmb&v(l}z97 z@At>Fx#_n$lXTE39o2L_KaYrfQsOOfdoD8pdOiz{_5TRilr(aic-SBLILk<(#rqk@ zYvf8lcUcIDCc5|ifO+HdXsQZcBVv8Z!OLGh^q*xyWSRNT-Z!`K5AP%R_;>H4Z2KR* zkC#VvA9(#qoo$iJ&zXS0l={WSLLzMV055k)A}`W1wLy9C%*k#w?s^hxb`}SnYv+(? zVI$6=CmbdZ1rNN-J8f#n+Zpu_w}3?uGF3cMYel3!Y{#qpFAUGhdVj!Mx0AWM(R1!M zm3DVvIX3P>lU!Hy;YXv#{Q@{n#3F+NS!aJN>_{FG%fUD=wXC2yA30kcthJRWB#5f- zHd5$w0cZU=_kG|?ugm4dorcU*1kcQ&VG|_LxeV`C#w%-C+L(y$i8G2*y_xX7i8H7@ z|4+!pdRQ(|chOt+LU#jUtyB$TI3eNdS47{JgJHnE26qUnTS4GL2bXHja)T|YDbfs? zPPl+ZD!TR_l9hxB(%%zkDIJdV3{J+2bB_o1j^e_2TdCi?RMU?3UTLGG_A;_Y=kE4y zwp&GJj3yi@9&&ZBZ6$y-3JdVBeNEo^jFV@E*lgyqw9sE=zX z$2~&*H}R97hBIgct!zex$s5q<>S2j7*e}LTGmh!M5m$~gps3_gu^El8W>6ErMmmWs z-*8&=H0^D_evpM*~nVG2Nm%%mDj98 zCozs;HuW}10kiJOS^1jHi3*#j zqY1LeI^hocqUS>2OvG9U5R1L!T=S4bN3$00Ugu5228T6qiqL$2yY zr8tu2NLx@42)BB`ELEnajMc5dSVe8L#-XR87=rcm4x?`04tDG&@-5S2sTaMsFgYil z4`1Dnssew+Qdg2B%`##Cu6edNnYnORO^Pr&@^}muUJR1N{OKR?d(z@ zU_hkDO^ULaiN0=A#OfkC*0K$@NYOIEsz*|>`+FwmbL#2ApX#7p?6_%%aZ#Ub(U?uv zLbBUbD3z6l(j9uQ;~ggQZOs~2fG)8@XrUOd$}@>nkr4H63zl{c8h)X@f^L~fRJHpA zBtTFInpa8uVb4Hkg7rJ^nSFMbUIP6t=Hm38>`Ym*X$5K@=Pr5hDpiHd{)~sJNO>)>r8Ds`HNVX(Rik6P;C@cmjs-Yq~>EGFvS7(pVczY;>SfAO3 zjcFIK+MGLjpzVhf%DQvDbQpP$LeWHH1f@W+3JjD_W#o0(AK)0<}un+6Mh%pz^R%nq=JRIVj?7)?nJ z{!sh@cEmEloQg#D4M)twv+oQ3L+t^;`&tjOX7H5iMvGc3hM{iwOs%(l2TGdyEbIq2 z2O$Gb*-D~*0kxVzvsPYB*hpR2_i700mlVLNAL0-K+;!nM-D5>-Bei8BLvOX3c@>Q~ zN1H;oE0(@Mf0(f(&e7{@;#1GA88!;$H`>}RLlhG(ly>#CU!F6|L52fI9O4U06J7bP zfyTpeR=F>Z?6K}yA=9BuxJ`j0 zg6}!+uQi(M$^ssWo9|@+r>p{U)Nc*JKTflc_-kj*ujp3X^$N43eDB(9OhI2uEt(4I z3~GB)pvQ%zi9*rLtvb7%v|E~Dn|DFigH~x7a*;+gBmTGhDemW&U7Ix zDzl{sS}hn}geBj-&ndbC(VTk(ZGvT20UB&Q)bG7W&TOudl{DuvI1Y0oi{FO73eO=M zhAOUF=k^wW^0s%rFg$7+@b>($AuQN{j+wFB2xtb%zKeEk(zgN8ElZ~7A3nV1>j)vy zjJm2nge+aqW+h;y;FI@ejRfD05tB1>jWNXrfRNhPbfZ>fXmdWfd`1UgRFt4n8%)A& zwq$VV>Axc(#@*o)%|BqEMs~T_n!@C+g3LVP^>CT|ckK9QvuR)Br#()rJDrbkT0Bu- zzoV#Z2qd;WK_7psG+odaT&dL-A!|+)qk(Zz1AZR(L;*o57!s`*lND7)@muVhy@W5? z!}&Dg#G?wNRAh+`2}793jR$~U;ilYKb|0Z|8th%5dV3k8#5c%Ls&AoMslK}JZhcmsW@bU zAODDx(Lw;{*7~R0TA~3p)(tzF=;3SM<7ev5f_)}#YE(gC z;u8QbCotzneuJ=g|wy$+Kmd$PD`?e_u)}Qtx zYbVU&jj6_R>&$~=YUWWczuB_|v~WD%V6mJ1^=sUSmh}Gx0WX^&6)witSUaZ(kjofe z$`0cQQN#^a?L3>1piFpySa}v*y8QPLD7OS!)ur;!^<|bRS2HCS^H{;TllN{bJNB)6dp+YrxjWz=YbHWk!WILLy?P? z#W*bx6Xkvc11Xp?jF~uItzvklJ`E4siB}n>hL9YJ(KLSR%Lq>TBdIuz6y-=-N%Q?o zgxc$9Mtczqw?b(z`I3e+?-2}$+&YP2wBv*Se&00b=Z^w8l1I1Z++FhY8cK#kQN|R? zIk`AOR@p=q-ow~hm7xCiHAbVwUKlogM^OW5{1`4l7_qcC|CzgQj z<)^DT?lwN<70b4A4 z8M{)`rfPTZy_lw|Hl}-6%EHHBl?N)Me${c0`O)_7yu&KaBtZQ>tk7XKhB+j{W}X6D zou^#=!*)FdD#&@FEGJ->fRuf@(bd$=t=+7>Alec`l9E(e&HD~%Z7XDu9!g&G66z+> z6ZDE3a1#02lnutyU5eAMTh6)S>+E8xcvKOal)%^uJ8d>|N(2dekj_)KY{!u;TlK-aIV`A)6(Q?%E4=zTZB{3)xN8D>-lkq8`eo&f5 zKUm$0Y#f6^A@v#f#HlFNSoaW_zunXAQe#z-4QM5Ri*~X-wR0uk+o*JlIwbL`ec!l- ziuW9crN-yxgcvW`hmNeJuNUTs_9#*z7x%Dp&l3-1ZMAGgYFtYK9)ZIe*=i9%=08#p zFr=1kZ@IZ=KPiYU3c$JYPk);x+VKS>)>Dnr5su4p4E0t}EHaRKfn-;+yo6 z_gtGzRXUIb5Q`B!=B5l&kB*?9ECjt}RKc@jmJ62MGh9iK_!1aETSR(G(=iMGlXJ)}B6iE9VY z7hOhIZoZ+FaQJDiz4|?1$>bAm_@H{BwBi}+LxoP;v;It*p(;i!C5zYUpnT7DmPXF} zX4ieUoSy)vb>vqTwFUGqHW;?f1tWkYLjn1byY`0;e&}-(sbYXl4i0QMN0U1P~~t4X6w)_7JPk+}iihrwSV|#LMV!J2IyZ z$&Zh|LFy-Mcb!B0@rI6JQ`SQ)fr|@OYT=ak#jq#FXeIex-&YWOhwDw~K(mg>L#qn5 z#=fxSAWjk+I?hdJvE>Rk0m@?OF?%hG?((#EaX>PYhAX6qR(#6!*>>Yci_TtC`*7&q zrMqnM%Z_zi$uG>u`PwS@+hDL{?II(AW2z5BuYKsX_D3+k5-rbF?Uv&dMOy6ydfb`1 z4TtaQwAzHezZI0q(R}R|+x|K(+XEy6tX1axU#~Sak@84)9Ar~WagXk&^@Y%PK1s-S z2BVEu7CSnmb0Qk&8W#u|dBrga#4Yb(Mz{aWJUAAeC^T`bYpiCeO}uDa5PwygsPhp; z!^GgIPcrK;6rI|mFs}{s>N*5Fc%nSKd<2`lVZ+O{=}MeQM{3gBdAr?CM3_C;)hJ_- zZokiTf-}IaY(iC@sL-5-f6t5XJt@F58hS7a5U*5M&e`j6aLcX5WP&X+n?+M>2Iz=^N8S0 zdpX#(Y&=+2NIDv-pvMkfiOATBmWA_PYeVO8%#4kKW(%K5b9;INWr%zI$O?_1cyMJ} zrSlBp6^e&$=ZvgIYm3DHL)$w=S+*|dwqY~FR)%dm!?tbPwr$(CZQHi3%;1f+_O3d6 zpQ_vHqMeudFy7~wW6b{b{&%#~YCE1n{k|JA{=z?Pz37d9ZB$}ZB}Fro!r zCdP>f9Fg0H@KD%zD<1=`@wlgfWbPryuQG-}KIaRwIN^Z7V^WfxQ}wQ!+KkdupTW?O zrdx1#ygfh7Wh8kRmU6zGq7i(ke0?LXq}fw=9iDsgLVbdGsk6|j3y+GbQmzvg8$79& zGqw%T_F#0>ynwz2r5-?xr-!9{aby1*oy*1|asOsU_wcArkfpdnIbCed*Iol{o1lIUS)wZMEB=QNy3XUFSS zYmMBxt0bJ8fE5IA1qYtwvV~L6rc4xJWjS5-bW3H3>OQ?AxDit<)p%LiYWM+)g6cpo z>?Q3uD=Rl<6jgLzb{i!UI-;7`xt$4wTp;94GNKr#RDazFixBavB|(989hHs4zuWSL zI=rro#}@Ka#+UgDFp0BbF{Z|H+Mr$j4c1~NHV9Mj&6m&u@TCur70-pwf_Mxzz~1)v z2C~cLVgZkH(GMyvCtvrFyB$_$lory#@qCQcDR0ZU+F8>dE>l4>wK04@C*6rT?9||% zqrr2x#)+301#Av+I5Cg{k!|Vpg(VxA&yce4ty7sPabko?OHw<1z^9s2j3kQ*jB^PV zW_belDt?+_Q)5TxatjgJW1~#)vPTiVn_OVtwNP&Ju~jq)6kWH^AlHLF@&{R44vv?{ z<@m-rpzzyAilO;X3BHdDk!}D7WSUrq&Nhfvf)muh$2k z=S7mUC(vwQPNv$Mx(qhs_NK}sJ7rjL2htyjP9tt$_NHQ+h$CKUcQc1F65H%bcPGuH z{qVXx(SV#zH04aODPmK|&*17#I+iSZYss;RyMlDS-JqTlmuS?qo$3Qq0@d5pzT%sz zF6n8mDTEs6lYl7${|m5NhBul}eSKW|ARG+4Ktt3_f95!R4Zrcxjk2t1jb}Meq z;s>~Ep+B=0#m<)*jCIwmu#TgrkFpRIJ)>K{Q9HSXw)H*J^Ni5vAI8d@j=1dv-KJ{E zRX@4u`Azp6IWj9sciR06TF>Mn5aEO7c##pE8aP&i*HGn z4iRtSqpDE$z1SF)NrWBd$2wdv3v7=BHikec$s(bJmBu;l=nlnZ{68<;JHUDl_3*B#K}W14x1PvDreHw%+@&oy>~$$VvIF-)h*;A zTb*McMO%bW!BH?K6*41AfoUrZC@6n)pb|J?^?28j?jYc)L@$z=^mFc2;X4NOpsTXAt6zueeZo@8~NG* zX(+itC}B3g|~OQVwjovFwypr!qp|f1-Eo!To3? z)9W+gIQE6BdBmY)MN@5xUmVWr;rgj=IZOrfsM$!1#o5z+TmzNNqnr4w7bx;{G)xfc za-mPrWf=d4-gD3YLhsfbA%&aVQ!WA*cd(KqsNVclN@PU0fox0C!NVY`G$$_&j*S zXJc&>AGlBiV$?&K%+&@RXu43K^^IzEFb9GIzS?F#X?}i=6%Iyp z!(}Ur2kP5U)48h~3x+|f>DoAz{sv5UmWdNGSKkp%J=B8thk^D>lQ6dMtumY!2Hy`( zSld+B{T&#!5s-i}rgVTi_wz_}3RzP=UrbzN99a`+?hv7~k+~P=QB}viL3`zt(Lo14 zuC=xE?RfG1t0IBgM-x{I$0eM^((Oo}WdB0y2qR_xR0|w)$0EhEb*JqKLf;7o!ayJ8 z`_6dNtS>-ST?A*NYv2^nq}vwE>xljg7qbJPRFyMhE1KyA#MjhbaDZ_wF-(uXPwhX@UCBPT-&9{}#;yup2M6 zviUt{%j>>~0{kKdTC6 z|Hb78Bx-MZ)E3s8^hf2%4n+|w)h#|M)v=2}s^JMXfElayO{%pv(1k4{t8FRQ?TUWQ z^cC>H{sbMk-UBNMRT5nj=xMVTN~CPo&$p)l%noEzeUrU&I`6x4N>j{*L%%63KF^(h zQa+fzQS8T4Rt}Tg52RIL)_8rtyM>F#GJbsN&fLFtpog|%=X8c-CvA^Bg=HKuH2_%& zhqUru%Voy;v1+A>1afjKGd8Ox*droMPJ8{^90Yv(_18#|X135y^cc9G6l2C7Xn*>Y zW7Xe2uKD*_YPVt3$Z`|_>DTIja}D(cvOt`e9s%eJc90hTrsMi01Rl7pR#pxxi1m4f z;@~2+Rbxk4&BEwMyc7=CE>~9qjK|`qMnvU^aIu(Z0Z0W*IoPgj-m|R(Z)FK$gh-!}}w#EU8x`VpN?K%#8{hCxizX zsY3q4%MEt|Q~NhBS6AMj}Fbo8IuG@BIinTS%%7y?1Dr#>c+mp-kbW~`jP!^X;b%! zJfjv-et)tu}7*(pRzHi+oC5?74U zqb%oCuo{Y~q*W3`LplmCU2&N6Fzs%<$gA27n)9W>DA4>rlys9#u6fK11wEnS`%D<2 zHF<`YI|?iIldXOz$41VfW>a#Fu6GtzcoiQ%Nlh*7cP*+!DrY#PD7uMWJXG^QprQDd z|Bt*L2!Otd#YEs7=rc)9uOEB`a|ozD?Cul1XqqdiHodwyeQNnB@r+2w+jhu6{fu=W zSn@=Xk)i7q^uBs2BDgVqxndd2>qrS*)x zh(6L3?dd$JjOd{y*+ z@=^4*TPshs0Y+{yzSV{;u3%j~UiBu|tK45yhh13O`DnPsPAYnpX0f%NbC6(R z;i$gliKjy&$-2gclpjY(&W%4Gn5{}@BN4IuMJhn0$B0jVzJ^kAw4XjpKQeurs+(*g zy&!BIEH)g(n&t&;ldN*X93;Dv=4Gp=j+BRgs+=GntweFjQPz zdcGvO)fxyBsfYyB0~Jp!^AR6VV9LhO43t=l(PdGH(q@Q$b5F(w3myFA%Tw(z0NB7$ zsB*ynCs@6t{Dx?Er@}?2x#{Jo zQTQTCk;HN@t{Ve}@L~U-NPZVeEM2)pjuN-c1V#0!RF=K0u!5I?&-_#1+P;#@rsi+T%P^hZjpH*BSL~NAEa`4%FcRya0ozj#)1}k{Cm8jh(cfCH_dm7X8@-M;0Bv(o z_u7|`YQk@=7d_X@{gcN`MOT0oiwg1W?5LsV1l}!mt6Y4~{#o*F>aDDR_&5iVTkVEl zJ}QTQj;#~Cn1z14i_A)fVKM*=flC@}{ef6#-VJ^&YGu0fAbF-=vnTF|`sZ0j%`?8% zjaqF|Wi_>?jXpriRR#^77GmV~$#}7$THFfkI4)1-#Ra7i_2+vH$Xiy z>9(0Q>5c~Otr`9(3grrH10NH2O2fofK#GArhU!h@X3Y0e(>JD#AySb(ua!V2OWZE6 zuoL>mjdbZUPLfV(1$sXbV7YD!Q)eN%xHhwd6EqE(xpAo3c`ik>@4c#OEeMHUA&Ds~ z;16*Axy@Q}t&uO8O(*0u)LHzb>l78-a`^cWZq;;f%Eo(uLTC^GcnkDM!$&@%;vI2~ znSza`YPQ*?(~fg{3+E0B>hEaB%`NVNn_(qP#u4+I!5^C}>*087$LiYhUAH15G=Ji& zAwU7Qj;m9TwgjWA{Gc35rs24hUptHhGkbXJqlns!A89`8!r{mHVVaEXLzou(c~zm)w>Yf z+~o6DP-hXYC-G&E#;daNe9z8E<(56n`Fb7KL>)yZc9}8jQlCBfU18ssyx2vnBAKb9 z{eG{H>9whb7NxwO5j>}X@2U8JrHy5`LZUK-s1Cf4s|?$5U|+S_1!Y9h;hRvwdNu~G z5M`qC4^248Q|dIlL1sNPQNHxvwKC;lK%ui;v8g%+Yd(KfG0or>Av z({J36PBArMN8ZDrU!b<@Mzm7#jJCBRs!Eevm_B7hS%fy&4e7Io;ckNE9}@}nXz+OV z?E#)vpF0U&*p|9_qt!!NDT9_>p=nO8Fk7wbcp6ogGO+?}>&*QqZ*Q-7#JqMwCxnLE z4y#;|*wcuyrk!W>*!rxA?;qu@8ACT4az*rxg2wS`6dL20%6Y@wkhSwM;ib2Vd416F zYKn+;dG&lV3sUd>q)GF#>JWLE%7zO##?C|U*j%*eHWXhtqR1ZR%H|VdzQF3@WVTjt ziRS&>{_$|yP&LJlF!UnWXo;)y>>Tmzn(#0Iz4NQ56H)ej%YQoghwiYcm?+uH>KRra zc*x;7iYpQsED)$+4Z(D*@N#Kyg5wA#>=~>B;BM(^v&;LkB4ZJEWzc}}I#{yWJggbI zsiy^EV~E_|mfhoTsS{1kPo?oAd+OHhOhC$gRtst@C*?X$m z3W$WL+F_;kF$4|HegFM~4`gWF`;7jIR(!E0%h3Z}P4d39apq(J6OdI;VQ0~>-Nb9m z+?Gn8k#de`!L4iuvDDP9W`7ky`J!Z$<#;FepVSQI>)qf5N^>JAWYWkaP&*>p-43Gzpqj++grnLIgO_YpMun}*d&P}Qe_ z+8Mecc%MJA65dQOSUtg&;IPwM7KmLt9TvFs2o2Y_rToDx=uRKZs&^inhGi*>i@Q>`NSLrZHcG75nw_J5{sS1~nQ6`jp-5q`m>*3KoNBsT;0u%S}y z#3EWpaMBh;S|@9E8t7Xa?wr6gVqVuoqf|Y5c(l04%2H=h_$iM7Pc^&YKE8dx{VGAsf0bL;GfRVOzFI z9;%P7l8tH@a&2Kcmi+iFp0eecTUdA|^63oTp@EH~i{H9KonmyvNx{bx_Qt2xJ;cy= z{oHtK?%GNiL&{{#QsY|2r5<1aXAD;BBB<>*F>I&3V7t0p(Y2AnTJ>g*%v=)u7ckPH z8*AnD{gq5IFu0uW+d88^m+(!~bct!=_x4F{p^FIgfxduFVV#Elmt?yToAp6rAG0~! z$q2Rf*IXnn!x(>P$m_=6+ovuMsE^&aWcXxzw}BuD{yEp+{9QdjHJE&2&Tjm%Zr4K? zj=c?6uDn|*BZcrug)00=s9>eF*s zTc036dYN~VQbji~?}Ls56IjA^T{mu1x9}h)rAH(XgmmDq^8U%Cu0!JMx@sW00>Y4r z0LK7X7GdUkz@?5TIel}N4>}|B7IcvC;7_u!hCRqOit8{>bCuamx`$-49t-B!`;}|- zs>HSKpxsNc6pzhuaJXZ$C>|$mtg;3gd6yD+wsQu3xYw$MA=jpFoobAetWApD#}e0s zzp0!H8MQBEV-gd*FQhW)8apNo*=}NMQ*!($q_rrtu=<)g2?oq*;*>LHr3E0JZfq^@ zG!dk%08NmiH;^j_Lo~1&fW5H8Cu}>2?sjQ26QAV zi)}YyBY0gvQGD^_2`~4+Ev#Z=BI9(pe4;tF+^wTskdxQz|Rct(e>jzPpt z>sGi<2MvhnN)axFUdz>5mkwo9qZA3PjUx&&Lg&MPG=)YxETERUn+w*@t|bPmYJ0ix5HRfC3zjSV7V^k_ zG>B{J1X9ExuTh2o)$al6Fv&0v7Hd^C+rkDpCo;W8s3rwMt#=V%gO|R(W1N>)lM3cM zL{}lvm9tIB66J1U7w%tsB#7rjEXee_6~E|65Rre2vRbfUCPXlCbnUgWP71E@0hY#r zZawy)Aie^Z{Zv4$DA|tPZjAnYM@io-yC{rbYO&l%gW&SZUx~AOZ8fHkL?~g)7t_aH z{INfjquZ?IRd^4S_;(_{z2%h!6z7O?bjLDh-{d&E*&LP5FpV2Y!sW>@6;AVd1Vg5XiAiygGrMh^eB1;%aj7=Dd`A}Kir}+iau2V=RikeF>IOVZ?WQ@B$6|GWf!*zjHHx zO)D0^rxkrsVrVZc6222dLqf^OK%Q?nQqRB@zAN*!rOF-k`0e!gX+1qz&>3#kIOJ_7 zl*(=6u}Uo#5l~zZoi7i5`Z)N&9>(^zh%-4E(II7B_L6SVfsdU+as5cb8B9&*_sza8 zM+`NFcv{EL_{YqAicSdX@Os*UL9`aZxZ|A+#tTN)0ck3@Rxzm?z^N+f+t!RNA#^od zW1RZdz^N$*+GhFN6I)<*HIbZc2^~icHHNfrZ5sX_#2Pb4*5ubomt-*=MQtjt!q+F( zh92<%zt^*^Bqr<)^-8s2mTM?%*<6P}p9ZsWH?|oT@!?bjc1a8bs<4a;lDH54+?ad? zs77`hP{ryVyxm(Ly5ebK@!-U_$2tj-sm;rHwrThCx28;E$wX5QEcYGD(9kTE>7hgh z08wOwGh^gVuRs?^u9s+rHarM&PV0$<8U65l;?}ZnMRVT!&Km?=H^E?|YixwKwK%w$ zfMDTOTJ>ye3b3DPO7xx((SNwHtV$y%#w9?#X;7y?=9;BM+=BpV&OYKoT9asnagaG& z#(mx178?2VMuF9+m_4uNS!j$%QX)nV7~I%aYupId7c6@OQ0qN%9w&cKFE-mYd=qnV zMK|_li}zf{1b;y+1*&VR!|Wc1YidS+Gr%HEnj-v5B&}-mh|NuKn2hT|LDdXq)$i0n zVOt@g&g~yo-X|HvT-@d>DogJIe^Ipta1@my5VCz@#(WYLiKG!Ctm2g@fYPH@d41nP zkICT&`aEAcR=00gO{4U4Q<2o*o~NqILvH--U@)ulhEMr*3~X0ke!^qfH_+o><`<~! zmv^gimefX7!@#QDbsSl}ydJNqjARJaUQweg(j7({-K;Rhnmg;)(qWf7s9U+An zSJL1%Qz*y?kPR*}b8 z?jn#-%i}RVlxvG`%CymiHv+TdCSVkPYS)7@tuUs4c!?l+$DtR9wQOevam<2A6QR|o z9}DAuaV!|kJaYyN)0d!NqD29NV6PIPkK~x5JD5jJ#Z|1!z77Z_=#;ZQhJX`noyE@` za|-stZ2Xo1Y~=7*PA+vDark*jpq01V#cNdIEVou)W&4t&iY^-u)kk7`rPV`(^A{ra zDNz`6B^e{}zQtSbkLXo$l?A%Zt&Ay1q{cQ~UGlKcP{T%7g>BsMy9w8dI-{H2p+=?3RuX7lUOUEhFXa`?pT2(xh? zz_x*iv#KEGF0JKLVp7tNj#_yy9I)rb)d(j+^OX&JS({Z?)LF4tgagJq#Kk`Leq|<( zE%3BsRKekRWqtCb2?Gd@jCy$jEMH}4^L8_s`Ur=CYDjXUaqYK3Ge2O)MY4+k=^4&T zB&;Zrj&PMT^0S@H&j|MAf=Vs=nr_S}qGK{nZ`zz4T^!jwcq-0OTaB*~8C^3;liWr3 zlD*N9OW6I3n6M#Nj*>_sj*>#wCsuF$nWzRikM^X49E|-?zdxCnB+Dc<0jwrHEhKA0 z1fA?@&4+oHeT<<}zQf1+xL0T+$53flaGibfh$Uhe6iIW?$kM<}T9dd>Eh$h734-fE z#QCdi_QWHqlhKhIPBRF0ysQoGofk5LCtGRfmc|}{(0b3gMrQSQ)}PoS@V1IF-w3-E z+`N3rRSR>1yg2>BD!lNSWO+UMXPQ7#cp1hMn<&)))AQf8gtv6mZ01Zu(d3j}JJ-Kr z2_vypvP|)WsvXO(>-t!6zw$VNSn{uTB|CnnS*)>y(32HVZpJ$sn(aB=j>-V9^@oDn zHY^NM6?)~p=(JIYqiE2}u^$1={KD?{ZVeT93JvYIe3b={beC6fvc>SK06xK>+=Hh) z_yy+PpHh)d&An>oN;?KyQIz@usB6uO)-dbbXfWa_g%Qp!6*P}U^h&sm#(EFE+Fo{B zr-9%;$ZHgcfJMP;FYaSEqC(UPw4A_6b97Jj>MY3vVVSvh$qub)vUfW-rHNuOl&<$f z0psTi<`lM6aFy#>+O`~72ToKMV)R+7K+;-$W1G)Nvih;Rcw=R+)4-jkrLwX|d7&;( zAwo=qrb_fDi>W2Q5_uP_Fh@&RE193aEiH>T&E09{6A%+>b!Ab0JzVkc%3`tc<-waW z8Z=)L+KlAK0}R1;l)=wj@u)F3x^WRFODVItZ|SCmD%EZ+8mt%!EHi}o3{#nTQwRl=V!W*tMS(|Lr<8MJ>b&E z_f=T5GY~llgLBoP77wrMdnqt3&u)d)H%muMBHm_Q8a1O$xr|}DmjD&;)3PICy8rQ~ z3*-c;R@#P-Yr;X~;KuUuXCu^Yd9gc5#u53vG@BVLqXLkY3Gzp>7EdRe7`UMc$>~qte!1+fcX> zV5+XQNan)5qBz!0lgZ9YVZE4g?OIp{Rog;XOxPd7RL@oFBAN);&=iDnSb1k9o5d}c z&!(?lS8X#1Lqy4L$4(t+7-JPDH8}*;9FyIX&pKkM*As7^R50m<995$0{$ru1(GXpW0 znKb17qNZo(Jm0uFcGkb&2z@MdEg`1q^4HS01h5V{SIdzuWfx|E!Po&!gj--c%#vJ( zb@p9AyO+WAPj%eCb~hlrqP|w<*lXzgjp~`{HEN>yol{tEW1P0t<&BA8nY^UJz>7t3 zNL|Ai6n$Ix9%t~x?ad9H#FocnxanDEvE!QxvXQ z>XYex04p2jZi9WF0CDJU|7URUZQnk{Tcmh8m$N-vGg^A=bO7rCFO)G|x|%itL+u*U zyjV+yCMR&kY<)6q`ovk$()-$P^wcA~FJtSI#N!=)tN#TxB{xhQy92^WV{YZOPNiPn zIS&Yz{V@CYXXdEskrfW#?SDUaAuA`=wJWh?BuP|T^+xHZ*X}GgIy;}*D*J$8 zf%L7H9xY-(H-I5x7`M#^SweA{b(Ios$h32`dqBkxUtW&mW=u9a7Kd#=jVWEPv)v*3>(b zJRN?90h905$y+*>6xHhOxzB~ynysV!VSOejJ3Xy{P@&W^%k)=CLHw)nhf}gq#y?96 zhNTA99M8Q?43Eu0zG_uiWLY#OhC`|gB-1BSbb)t&eb*H3{!vpHXCwLKtDg zBHgaRg!Cs#)ac6%#Q&H>0fUAk618PFQXq&jW5iYMw9wt05Zc9T*|YOe*BYtBiYLbT z)wx{zW|`8UFK$OZZ6aJa4<7Si{WK04NcH_9C0iC4?qG1=H{fDF*i?5wun0%iMetoy z@BbYOkx|UtNuUBT6t%cX$T*qVnv06eaf6l<1MCF=XXz+Uf{@RB+WFW#>%NO9OgWl5 zA&Q>`yM01n{d+z;5c`0iN#SKcL~2^v_Wm@0o9WpXVJbzk`U&~RLH$P)Jfnr9#|5&g z?6X48cXvy)ZR^{$`n#oG5t)x4rVV7$`d?e>O8;o7m)M4iI}iO;Q+TB6S@^Cg)a`No zT~m1atEMnEhSYD;isI0U<526Iepim-zuijZe;#dN zyr+?LNUn0Lw>4uRFb--9Oa9U2^e0NY&NPN9LHH~xss^dh8;mIm zf5+67*r9JvP3f8=751Z7LpLkkqSPQh4|UI8c5i^_GnwY^Bug^a;y`IhPu zC098*Z47XYkXdKJ$~To5CzxH0r>=TRg&m=5ZuynQdUzlC2~y}j-`mpDzI#YR0v`L;?IHU*xT`)64}EaSVZa1je83xhvt6{Fl}=i41?2&gx%If>*q z2>M5L-frzQ23-^p)~O0jSb06xAZ0UsmICVg1=?K1VPuzx3@tID)7W}#m<5R@wFrc9 zn+&JvhD`ky(a{+Kxq~UO)&mZV{4zTrAEe%$B}lhr4A^?S@n)quSjII=LERriSTEqZ z|H?cIR(Y_WtmOmOcayrZHJ{aK{RmU)Pt=FpN`lEm(zi2EG>S<5k^C~V`L_5$2Y>pg zI*|9>TgQiU@Rt6tfi+otkLJg+6RJA<8rkk}X0_JvIPkiX@jG~TuslhvH?cS4{30!x zc#>4FF(lD`{^=EWmcaM(XI?QxFu;}ELgvgT)g`PifDmFVwM_iNoVwNUk1)<>udnB| z3Xqam{Lb--W?QtT4J$IoN;lt@pE2JDA8}#fF$A8E{X}O{Ey7fw{kkeC@!2%q-AJDe zcePvhE93ETvJ#8_G~shzpS$nhGnw%Hsl8)RSwIYqXI0A?lj_olW&lbYgfB}o{! zf3yPve<1Yy{=7E>Xt@^*7{K60EKc3Ky8-Mxc}KMK+XfylR~L@ohF{3NPO}*$eleZJ zaSWjB*t(A;Zgj;Mj6Y%9eKpCoi@t@|J0s=siZyA%eA|I#V6SfhaSm;wmJ3Tp zohG9#8q}i`FaZOCZ;{C75A#+kwIT%c$;oy67y~`hun7o$mQW->4|=0EfI2=_Vv67; zmEkUdmq>_8vx48P7la?#-v?F#nI$34A$R5%Wd~2y=%UO1$4VmiM3uGTC zl_ZB}=tOrIK&6bs<#X~JoHS)bZsP)XG0>M8d~6-e))mOfW73}d6*a?OpU z2Rngi?Ha<_B4e;LorySxcfGoOD8RNfJZ`Cs3uqxveQf!im^GoIPlJ*a@st+{bD*4f z6`z%oNUPIeRJAtZ`_26>Y{1tcmnzg_lqr%wR8p4(GJO`wBjRBsXs{ zuM5YN$tO31D5!NcwX$v$3j_S)v+|Jtg}MA4NB z(A2|onV5`69ct(AP425l-wqJojiS)6rA)DQ>#FL-F(tNu!!|Ai1f#Uo9T-v04g7Jv z(px~E7q|SrAtmCb3rA$RcX{8B>tYcU1OxIOjq>Xly19_%Y=wMa@j);w^oR2l=2osr zXs1z>|LT?-=n`ff+KGa%K{fV%7xgWJa+toDN}=8^s0C$>5sc#|S2N(lduGMh6kacj z4HH-shaZG4k5!WCp;#Vh1Jc+DhSfc&3YCi0fVAlpW2$D5uEfMXFxn7D`F+&rK5OT? zX@dCH;rG2VmSty%j<6*~8MVjV?qhvuYu_7dMBfBB?52JjQhO>@?9D!iO^aT+$6A(C z%l_zkmW}Datp|VLScI0sUOJ_ctHk~ng~wqRc#LE*>+N<&k6}2f;#^3!uSLYU-8&nU!+a*B@#=W>sxc+;g)j`%%I*eAevy&9f#gA-&K5&&~Q3~}( zoEGXEYi?Kp92jDc`w9Y-m*BL8Mw~fhm!=G@2weF}CA-90ggiJxi^{5)Q8l4e4X?8D zwz>LhO7)2#S>;pq#N&vtHI|9D{*e)AuOJ*PZx3lWaHa4&Wg6o=8N`N$58WIZLD+{P zu3tkm6v8#RWlL<)o|X@JbJs#-Wvf|TSk-J%N`F#y1k6fn?kFEwBS^fIt8DqRJ+Q2N z4Nis=Z7Op|KJ{!3P9?*cM~LRQzo!`o3c&(Ip9f}FgnXj6`-67bP4CxtNpv09ow&up zFYfl_G8w`x&@*gRe{?YCgtc5YhI6vDwD~%gJ6J<_EBltq2uv+6^3~&WH$Ixde_VDb zK$XkEyW+1feO%rHi6GzHKnFn3z+}_ggjW_vsp|=>+0kKQNp&^M?$U$KdHYw@t>@Y_ zY_zU-U>ZSjsL_q*m8Oc|8i_A^fn9LF@)d?VqIUEwIl8Xah`1a^UR0!mg%)@iL(~#gE4q3Xs})Lkmw7`=*IqU34gtOO zb~W0L2u|Ze->oWzXs9FPLnAu zu1ppht0+Q^!gwJDv9F0ygA<8PwUdOeyo9L-P{rU-lFFj|cj5&<9#P5*hJ(|t9m*7Y zGXnGb9iBUM9f?2opCZ3^--|m5;N`B`eEeK+bwTdcn!Dsxe6K?-um>D(akk?D|MBFA zy{Vl_b2cSToERC>$eX5$<}y^+fOo<#tbJrY-eOW{bC`h`$t?irVG`b3{Eg7IT3P|pXy$^G!P%ae@te37)uib zd#2CsO*`5a!CX}R(a<#p2l23;LegNQ0>&5}tpM&66Mv;~*88cJI=K#9G9Isty1E8= znA}JjGQxdLB6Bkwp>uifhqYEbTJcE^sQ-aIv=peu5RdJehK_5| zDz7I2164>&fgICK9_`-do5c$Xjo&GRy5u_PkT>AuE7L}tC9c7DZSvUV$@Z;ojYCo7 zN@(ohHulTA<^R>e$bQsb1@@qI@f|Ig6DIe*cjf6`dorre4^7)7j? zBq5|k$?0tqPJMsWaqmC4Pdth$z(1D4rG0elt*ad-TeH#MX$^U&u27_^z)ke^ay#Yo zLCN{Lu(#(@vWEBdsS{#DavKv9{pt8f`!?c(gM)+X{c<$X)7kBL=i>cXb5ri@7Vtgf zyXAb|zX^-N#`!q=ih#TFLr>jcsHxGd(L#ZAsFPCU&=ROkPxVvYp}^Ce)?Cgyx%(c) zlKScmGptxG2aR9BWKImvcJkhS!GV8{3rjvlckUS(i0~+Nf>RGY4HN~O3$e+#1OoE3 z-PU7F8a>L=u5Pp+va1}8BmK_b@<@UQ$y+K`ryg!T5l%PAME8J3Rl=UM`SdO!xfKSa z^58QAD+Cb?2PFDlsxebWwlHgAIFuk5J36ww>Y{Hv(=@u%8Task6sg9ptS`ROhR7`x zqo$;JKidA*-xw@hbJ_9DbbdZ}dl%m#rDlfQxvXR*^6?~jT=@I}gur%y)uu<;*vH>w zjwD)zCw9q>$SOZHv&h+_kBJ1*ipweyGg*U69u4Xo+CL*F4~ z-fo77njH3TgX$9caKU73FhxN9LNqHY{;#f|pfqDbL903LVm~_UL4gX-M%BSMXQpIj zjJt%8s9pj%nQ{ENfqnXZ`o$kt*1Bac0@V}yZta#8Gy)}B{S2+Cn93EFsM zEF-r$49r9vt8g3h--#4jupr5kpxeE8aFCFgdXuv^CS$$WezTvWZ_|J)c?f-<; zxWXgdV}Jc+{FTqpO#}>NLgw4A+b>g;Pg1=buI9`Dw(& zDKIja)u?&tOjC`{OLHWZ-Madx+&%;JW|Tt`8Ww1^kGA3kS_2@2>SNqyI5b+zTb(eX zI9N?*mi!mm;rb(kQZ1+Rq1Svp%-at%@%Ol$Km@9Tk)C}L!Jx8vbgMsTk-?7jSkCw@lcayF4J9?AA;^Qkn8WE9 zr%V#dG|>fIbz*=+Opqqeh&$XLi~+@0%pkOeS2AUy$-Lrdk!}~XDoRFp#LSm?YJwHt z-?+^nyuyDBVM~enxw|2BQqeGa$ zVKM7an^C;Rea^_ayMI@3S}&^0M$8)~?Lh!Erl|Z5QXHOlpDsy78$jrg{GXO1Z3M3A zK3W3AMzXr36&|Jav3@~$$%=cAQ!A}AXhL_mK6s#(tf-cWZb49rW}LRk9imn>dC}<}!xS+-uXNes8 z003GNU`J~+DJwROw&;sgZ>lq&VnR1gFxD5xlY(QM8f~?ru$`gk3c1Cv&p@Mil2DCY+ zv5mI-UYq;3)#l9lM}%NgPYcqKjhnHg&D>^bc&0$Np(A+o_;CPWAXXw)t>wUPDlR)< zFceem$r)|*$5tqMY(nHeO<2E-dUZ5$2Md2n+6J*u{F67;#cZfaUkur@X-z5Dx*S{?%5gBZmI)5GICgnA2Ir47>B|x4 z4V{Wsp@|8W?luY?lo*6rQmHN*F=elLJORHq#o%3s7@+@s2XKi~T>faI-ie6^9NQWV znmT8?v*;UJM49Rtp*2zu=AKIuHV~|fL2bmjCajBcP1yoCTGBGkG>9$*w(|?G+LB30 z=i4rodCRWPqFvG|YZxt{wukvOVU0|bnkE(IE}7e+_rhDj_#$mF<%UriFKU0Ej0SAk z6gjB)k1aC+VqGN|s{h@nW3r_Af>(wqpvtV*&cyP8SU3ln5VdyQaKZ>o1z0?!2Xbv4 zHGSsFs8^EgTk^S&Jz68B&#Mx8-Av{!Dc|V^jz{)%pY1o$ganvl-9_{ScRwYu;vAg~ zuN!>?zM!RK$K)H7(oBHst+~mu%xG0)MuY7#EY~AfGGN`=?UR!ap8d}= z#onsVfmwa{^i<3~e0o~n=Gk#47Z?-!adwECb@buW^ADe%+UU4lZgfiZ{`+jRtxngk zzO&U9|KfYZ)Q3+`mH6=K>4#5$kDiKaMH|J651;;ik{yprF~>I5R(|;O)DYhfpPmBw z-Q6ChW#nY$swL`E>1!FB~y;;mh5qvO8dzXR!v3~k0 zfuB|}971lx@W8+n$!<2mU2O$+ELT3S68*NZ=^!e7QxJCa6hzMOdd&5%*81goG$81scJBfdXUJW_InTOXUO2oQ# zBNr+uXeiobX5;w5Cv9W;2Z~&8dsy+4yFxygSp+eDiO9y^0JkRH3Qi%BS)3Jt%1?) zd_NbAmTIxy;>emUMa7lSKdi0LZ+!b-Zl2kF_r6=KT^s{T82*Bw;_=GAgSyVwYpvMX zErmp)_Z_+R*wB7Q!T=BFokQ z(wel+v&#!pl5?;#&>`nV$in{5NwDr891(U~Q*_MjerK{MBrBRx8NQC7TscA#Yl9kW!Tw;VzSka{vcUoz% zU9Ar$eT_EB1%r57gZFstOFW~V@7ow1{cqao8g{VEY3WI45UO`=MsZ2i;u*0K*K1?b zt7EIu+ed4bPjb;#-9Yi}{&U!5z>W6&=bw?Ee%{NnY|ks`OlZy7Tg4y{NLu{s+b4Sf zqHd!1Y{1cTEe4?{&o33bRv5LrfZ3c?lbd$RrY$cE))X@G)6>Z*ys}{Bav~Qe zb}h47lssQOBR7oIdtnVxTGx}%Xlx1HGjj0LPh@h%N=7A{fS&R5&j%acLKwv&o348A zX+p;Hu~z}S9bPg?=wzSeHOh%e#}WVIWQZ%iVM-GSKT-=!fL!(l2`M#q|Mqq z_Vi^H`qn!bbgd0q@}}F#0x=1Sgr95usB*phLy9WAgDAL}%ZD2fe6>cyvYw1(RRqYX zvbT7>pHP(u`tx60XGXpLdh6X&rPlimf5#5P?*?Y*HRH-b11yV)8<2`F>!8Wb9gfWv zHf787_=J}Af@0D*)^xW-SJbRJyS(`J z5gzc*FH$FegJiK@PGo$09<%=aBUQbR*18|7aQ_R{ zwcoH?!!_(T*@4z-X^+u|>zd_cA<9DfmjB$pRWCe7*L~I~$gpCz*<^%n?}+Swa1Kv- zBka?+07V)Kjtpu0-X<>EDWp^w{(WM&XJ*;w$+Q&HlO^Sq@yt)UdM2x7d9aQ8+;j5U zqFtFWl4n@KZZHlN`yQ;G7T1o>?aN(+A`M}Cs8>?iqw&`)Z(Wnu@IwE)dotKIaSe`DIgPu zS&T*(d<`Rc$rN=KH){=Z2O7pa<`a2s?|{CpT~R2gY+BgNEV$LEe3I#kyg2_79=B22 zn3FLQG>{fDu%?!8eDEGnw&^a#wCJK4uV~5t$(l&dNyy7v4lWkcR3-od{~FdXUQsTw z$Hby9T{Qf6|JjePffU>LwuKfwQhy^&Bd{dKSvOlAx zWc#+nv{8sjDQJ;RO-DW;Sh*t6SZ%ik6X#OUlV?q*+qm+#-Fh8PZ5bHIt{KPYG2r?~ z$3y{6wQJa}dc!2zSC2`<=CmnFCZ$ugK}e0o!FuKR^qN6>pINws-EpiU(#upYI-^am z%r}<~CKp6oSEO@QM@r7&O`Zx-GCH}-qxSY+Txy!zxW#u@AJbMPX=Mww zsHwyx%t!|ftqQR$v77;|T;oBl=_Re8(PKm&$r?z6Jfr}l7wNzNnFiwB(XkyZ;+c|G zGN^Cl?zp?R3Gks#p8Nm3T1M8w)?X#)VMcj5>7U0+#BRC=wX7D6Xy*%;Jla-pAKY|h?^=+c?gW6$C>&sF%;w=zzZdr$^FGk4MP)gg?%SjNwBssT)<=C+dyp$nF zyqNV6jNDE}dV%@lB?LS!r}xb8g7^pRxVx>r>zQ7{}Tc z?$vOxtgEbRzdQNBoR*B&67x9lhfMD)j|7}1%CC-D>{L{9C#6^1tGiy9{SMs51=ySE znOav7NCC3OwLHF*%9tWO^x4+E7*n#iY1{<&VockKQO1D1En|w#q|dgtW=tuxJ78P) zU`#QJy3V%l! zn>4-^=S;EtH_o@n`UC;fr#sDtX2m61h-?8HRMGjP{!R9_Bby6R7Emk-ix=z7zY~O25LQ7B3(cxAV(j8l z9&1*B&|*Y11#6DtM4CyhteI(dA%~VT7@}dA0I$EGOAhzIEcl;A1bfkE_sF!mHuN2x zi(4(IxB?XB=hYs6GF~NE|yDCIY3Y-oooU*0z+M_3x|-WXJ6As+57CdOHs@mziGeG z^BvEPy59l!9jk6*JlC{d^@7V>Q@9mbGA$@_xs)j!uVJcfDyV!^5n6I8*UmOMWRv-X zQ1blMH93EE_VNV;0yV|aguIGr*G?F6Uajg@l(!)7yfo!JDdNI`bb9s0dG_SV(~rqQ zNL9s|-JvDKN{CWUI8(EUXyzviwJcAXS+3hU0)F5G^B?rK{$Q*{`@S5pzmp0Pc8gx) z^+X2q80RABz$?kV5O;>y6%ZFWZB?gNS)!p9(HfoxS&wMttONcwg4ls1`*tAZDx1+9 zkWf0pd+1E>F^T9!N66Q0E}EhqfdFeg3SWtwmRKhekC&-uXB5|X6_Rc-AYSi|nySoH zN-R9C{|G1`aTE~yQuKzAJg&xznR(MjhV*w~%G4c$I#v)^uO}}BVbriI?5$uWzm4)L z+a&lAj8vuD$g~b#I_0HrCqD*uAX?3?b-RHswC_y37t`^Z%V~*TGh0Pd1`2qpK{DnG12A7uzu_2qRoC6V@OAx`-iQ9m%mW zSel~`s+S5iYL?h!=ZRi4tvWdeJzQU|wzKr4+~r{pMI}fnsySw496Kg}|A5BWU80z40r9{A!u~wKAnGGc_WP!CPV#gh5 z+8sp}sc3nl|GP=Bu>+D?dxA?wk;K*_YNG>j!^&)SE&9OOJ-KQ!AezJ+sfmJ1Of-q< zNQr`rCz|Ynmv#oYogV8;XV&W*eP;FtBoY^wx1SvA|Nrc0%^#OWR|AqZ5KGcyB2y|c zD>}`%6h`>k`t^f$$@}}AJCC3T&cg~^E8yQQd8}s|iydCi#%c$vx#*n){?KFC8$5nn zsA|J}hRY6j5cXi%Dm|BHdH^__m^dyPh}y&&;0;@fTVz9$>6U4;az|^0qOo7Wl157~ z5|3E{@#D*&&7N94P{U(iALJOekKPUa;Ai`jfZ>UrPwCo5l^OSr?_Wv`yIa@M@f%na z-4&>x&K0-sBH6a!(+`PZcr3?$08I%--xvhJNlI314(ywm^$X%tN4%pl5vkn zq=Se1OOmX(+v1NJ^1lWte{o674~P1?=(`M*-%tyy`)FDe?L$FPjK;gml0jc`kYDWdsUyms}+~r5$+xGnQwy(QpS*6##V^pH?YsaUA1vpB2F$*vn zQ7g467{?YMe~sqE3T?sxx#rcpWY>Dcla8nw9K?O^*L`wGA@RIq9nn9EN`{wU-+$iH z(zc?>k}u?l%3HP0`suvJl0@pi5wboo-70=(+ck}0#K!&=Zbdh)nCQ9nsE<8KL9=_f z!7*axQ#RjkZnjpEg4L{Y6-x0Wgu&Xoim#LRj;~9k0;R`z0r_s1w{)#>hgu7N7+EDS ziT4V41$U54nbzNja*g|+i1m;QfkX!LJkYP1UPIriC?E#|z!HMb^qe0IBd3S}1~4fIC~p!wEfx zl^ysJ*ulgZ#0)g8(?s=V#SH8lw$d=nW1>U>P7=hwRjb-)JcX#33$epvBHF^z*apoY z20tn`hSt@7M;Q_X^J?Yh5suAT7eLeC(pVA-aBzhoL1! z^CMh|2|4q|_<(MWVJlcadDN@Vm@^HEW=z)Z9lJ=UUmNQhY?JOb z49|>3hjrxCgB>&8q^dWR&f%JV^1X6$3kOGG4o6v0%_n={BQB;T)GB*4c9{ zZi0dTSMU6Cnlh~99OPW zRO^zenP`@#dJLSchUvlQ%Cl?tc$Pb62?A1=xaegALi=8%yBnnOlV4oQL24JC`KZ>P zej{R{d0H@|qVh(b&^%{SW;(>WlO2vyVUi6fu0v{k*%on{ZlDh+0I)5|p5@7cql=j-qC5JFRX_Z7JNzq-EfI1&%Y*PtJCSKDZqn@h28D7T)}-Ex(SWlgJ9uOz$e zKIN)!QS&SX`~*MuCD9$Qm5uB10^LHlac8S~{_6Vsug?Db;;S^uc2<@~9x!b?EgW!9 zpj}7^!ZL}tEfcI!WNXT&)gB}PS|ElUxz3CL4c&p!10Fumy&YKhYrKxP{k$-pTqbj| zudM}-&(K;SDi+8I+#;hG!*05qM7BOwNx^{lx$n_}(gO}75#09$(s6-cf5cQDaXP4@Y z9(AT~nLZQ=y{AV2;wQacJTVH(*0jYD4Uo?5x$dcsX*V^UY(DZjY^7y^(ft{DeSZ0f zWclK9lP*TCtr>Oy_4(!gG1>p-x&9Bt;#{AI+T|2NZvqTb8-b06Eb9lZMIp`dc>FH?F1X&TsAuFr1lD+> zJN)d^Pe1;20i6{M|E)xlCK>A zgb5d1s}&2#CdT{kL7h1YVKiMu6`Qr?HB$$Y{MCZTbkc8v4VliVV&wYjTgZ>b%xG+% zE2$}|bopC#+i2Mg?EQ>2UD9^ShypX`lr7Ma{_wQW0pwob`bfWFK~IA2JluoLjI|YQdJ0mAA~nC``!N9O48G^d8nx zMT>y9CUyymZb(s=cIN}^)=e}Umo29ik#xpTNyfw#Kxaae`EFn{H&+GoKaYwtyd536 z5`&3D0;MaU6KLGmWEYO5vDv#onxupbTosT(5KRhm-iQe!Jr47_y?`KrwzAPhCtiZ1 zEf9zB9q7LIQu8c;ly~$%0*k|CVmb85mM~9SMTJ~=&SVoN_6ybM{7-N`2H)>I)(}tP=XFI> z8fRPXY`WVzH#;9!=7Sm9*B&q_GqLjr9^vhL^n@tBWTI8qkhqoT=e&=Jq2E(4gA~m-2mx|{%D`+H5Nkjnd{Y+NPNuHek!SwVoS%|iY=e6KxTZ`egHp4Bo#^{4agn4eWq6f>Z z`kyVMe%71E5DaOtXu9;H+Mzt560s0>c6gCqxS!Tt__3y5!tzBg7$g8K097f{i;FG6 z%t#CU*mEW zCPYXJ|7yJm^kTPyo|PFD8ZDNAc1%r-a7>HvjIPs_N$&=wST$|#m!Ru3TC64*)%ioU z7vDmoZ%}o?V)_QSx+w_C*4=6|-9yuXF-O^eHGK`m%zLJx3D`<%K`TPNaYavtJyiPy zN)v-?z?~KZ>-G+ebI}9R9wJ&L;4W)2#9XaRxbfcPWe71F9kPG&{b4)LDx|Q$A?@~=NSA|#e%sppSB`_vDoRdUFrN{$nQ=zQTf&JCBt8HXi zfTp`v+2GY2p3&d^_4Vrw=OeBppYcYjpmj^Hysx0Eht>m& zRmHTQ9aYD)pPf}$W994`g1gSQz7f|$?^?tc|H6(-^m+)H2{7}wr!(Ih0m&A#f9RGK zT+(S7b5I6TeQsXqd%_HO)h*Xrd|V)O8$3K?=XG{N+>ryJg(GlQ`Ze&A=6&tn)cj5H zTLvwJI7`=OucD3>L3ovyZQ(9rx4Tf`RMT{CDRvDbGCYr&1_Y%YDWw{IwhG7L1GQ`;qZ}>M_9(;LX#~N;grJch z`I62D=x(@n`Wd@?8!H$;7x@k3?dxv`-PN1Q8jmb$EsEEsrf+1Bm)(;#XtR8tASUX*kD52X0BmSyBem2ydfc6Ab%!}D9b6$Z!9_X62qUv@mR8I;3nR` z^7Soi0iV1K{0GGHHl-o zE#^(FH5sdaMczFF3b;y4WgTzBQjBJKzB9C!S(#yDaXlV$X zkkgV)aQ!D&X7r=AouDvz4rZZl1>A0RmEbLV(j62V%aT8!C_Df>$I8OPLv}1=$@)C0YDQCws}(Y>)^ z%7&jXG?F4vN*9akY;hY!f}kGu=*j);ldVqf=E$VJqKKAlb4*NTul=?)@ewnQwpHNA zTb=7P<}!GgJ&t3rcJrG~!Z7B|Qp+BdR`4d|IqI~gOVZZ!hC-!=Wm_s}baD!>ELgdm$i<0W!wd@@JR>)Z)q7^`O!Ks^C!s~y@}y_v z;HRI++0X+x#lz&caJpecxyKO=c}IS>67i~|lvYg3D|GO1zKSOFc$;F;N zaeB$;jcDujHrAdee%id&{pX@_l37NWC*I-l0$@Z83_`F=_^sqpeL4L5S6t$muFJNe z<>0*VIxa-xTXixba||PwyqdQqZ3gDEr?0HgcOTxYX$}ymmTu{mvLK!myrJi!Y?qbm zr>CR1h**c;Xzt`cq^QCh3t_y>G^wu=jdm^Cn;O zC6kIS>!882dDxtmDh9@*Db^k1^F=tLzxiLS^HF^0_6aTP1$}~>mM_?nT2d-%R-Ij5 zeEacr@O7WN_76|btTphn;ckIwA2=zD|E*&%!}^CuU^i<>Yiw6f$=rNjPcp|(D@rh3 zms9ViLp^8quo#Ylo%FmNx2yq?RLme}x%H!r~Lk~eoV z+=c}iy$cDk4Ys4m1lA^TzV@Owk@VsFQ-F(W-~3*gH#e8cO7hk`XlvaHfrs@XVWWrF zY2fv>ZQpjK;Mo02R_U=X*qljq$!k_>0Wj%?1#bjvt$!iiPjOy?-JjIvm0yCyV3fy8 ztp=q`|Jr*Tq9Z%~%=~6piz%nLVeV5#mbwkF8X6fmWXQwDHxhHZZyM|{bR(ULR(Vs{ zc!;H)n(&8i2F}(7zKO#m_}-yyQ0PW3YcR`~_6<_7N+_eo)cOl0988mq=NW00c#$98 z6ggzh4$pL?wIttoTG-O2pe294>yb-v4o9b}&uHqNK5V9m4*Shs|A*f3wqaXH&DX&T zqxan0t4-IDDry$ktEizwc-apmq~I#C2`+ovD~}k@POYan4x=KvVragpVdM5*k4C|z z+-Os=Dfxg$QXgKJ0#G$(OvOO}Vl-FS-Legs$Ugm##ak8XW{qZ|)rv0k3elei7%@t2iM3QfaBgo`c9m>-!y;M6Lo>84GCi9$ z2VY8HDA_JLs*W(cfl(%(DB6_uQ@T(O19ym9|} zIXYLXD^aqS6e_|d^Yz|qo(7}8Chq&V`eH|M(uk6Mzr+`R5hbRgwOj~wAM4Tergy!C zvCl+pNS8x4B>9WlknGxAv06y3#AaD!a9RAxa!^4jz2>W6PQqRts@B2`)xtVlskdTfz?jviB9l84kp`5QueA`Qilv&NvW` zvsceqF(GG_0o&`12Hw$Jy(~MRh%-{P<&bfI!^@R$?`|m*_J^DxN3G2=NNVhj(45WX z7;V61?w<3O?Sb;s2vuD>7TyR<6p#HSOgYEErDJ4{m_Y?Kaxuhm+=dTCn{~{ngK&I^ zNEYFV!HV2;+|WTub}6}T$_7($oUV@Ymn1T8S8Z3)q}zoclJADC4y0k2qLK??ZS?aA|H-vnHrq$t$TCEhYzR zt!*SZk7qyHY&(hxDG{4dDi3?7wxV}zCwf;lq6n*c9NW;n>_TZap{PA*=eD3kP9C=b zZD;@4we9Df+I^DNEN<@^xAi30d16vX+`h9j+fHOj#ug)D&q?5-Lo0xJSVQd4)CN1f zhw%k7xqR4DM1JCke%4k0gaj)no#)blU3j~xq~tIWt%YW2Y5&US3)Yy)SRqBx8{H|( zS%GM|KECSd?jQ-az{1!}-3q2C9};R)1=@7McQ6$Zlids+$5Irmls3a#f8(lvxpd6+ z&rCE>VYEwf>N(5qjXsE(+=IDu8z(jnKp3N>KwnNKVOX1!nhRcS78G>BtXY54a1HfJ4@NsE7~gaJ8y2z$$+B_uw%3sbjY~P>D{0z6(Q9Z( zsgm8}$aVLU>SAI;nnah%Nq;G6ZWl~5g=NMW=BN~xl+G2G;L==Iap^5pc1sZxqH`Gg}QZ86ol6fhnt`zHWXQc;2diOo8 zioFj=#pWpU9@Y(;@wcqN0=jsIhABVp;nf|jmf&aH(EaoTr|LmXgwmRt=n$rBHt&vsjeKe7G_1;I5 zDZSbIXrh+--=g93y^sE9?*sBJZMbM9xp@9U?oEtCYHz{|Mo;kZM*L%Maw~IDu#?{c zrAfR0S1-<|9A5F02uYxHs0a<>bWF;W#y6p z>f+wscmMI-S)=%j=8F9Fn?L{k&|+Tk<$NL+5a2rD;>03x{i$ur&+RkRyt!zn`k5&$ z=Io@giAbvxle~Y_wc2~blAaUIf9&Jy=ksW9?+ix`C)j`?C|Z^vqj*4d2;AueC(=Q8 zN^*F9_57%-JZSKL{pERvF-%032JR|z7Te8Dj4DwJ@Kjg)#!&MsdX zptEE00*j?{$;h>Nj8+BtGouPBbah>tSTCF~h-NJ<%N3!m5=*Lh4u6?t=%({su-)BG zKVS=vkY99NwbEj~*(!=w1(=X41}JVQ@_%REL5@&}ymbW=1.21.0-0' +maintainers: +- email: eck@elastic.co + name: Elastic +name: eck-operator +type: application +version: 3.3.2 diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/LICENSE b/packs/elastic-operator-3.3.2/charts/eck-operator/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/README.md b/packs/elastic-operator-3.3.2/charts/eck-operator/README.md new file mode 100644 index 00000000..86452e3d --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/README.md @@ -0,0 +1,20 @@ +# ECK Operator Helm Chart + +[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/elastic)](https://artifacthub.io/packages/helm/elastic/eck-operator) + +A Helm chart to install the ECK Operator: the official Kubernetes operator from Elastic to orchestrate Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats on Kubernetes. + +For more information about the ECK Operator, see: +- [Documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html) +- [GitHub repo](https://github.com/elastic/cloud-on-k8s) + + +## Requirements + +- Supported Kubernetes versions are listed in the documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html +- Helm >= 3.2.0 + + +## Usage + +Refer to the documentation at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/.helmignore b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/Chart.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/Chart.yaml new file mode 100644 index 00000000..269835c7 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/Chart.yaml @@ -0,0 +1,23 @@ +apiVersion: v2 +appVersion: 3.3.2 +description: ECK operator Custom Resource Definitions +home: https://github.com/elastic/cloud-on-k8s +icon: https://helm.elastic.co/icons/eck.png +keywords: +- AutoOps +- Package Registry +- Logstash +- Elasticsearch +- Kibana +- APM Server +- Beats +- Enterprise Search +- Elastic Stack +- Operator +kubeVersion: '>=1.21.0-0' +maintainers: +- email: eck@elastic.co + name: Elastic +name: eck-operator-crds +type: application +version: 3.3.2 diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/README.md b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/README.md new file mode 100644 index 00000000..698d6dd4 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/README.md @@ -0,0 +1,16 @@ +# ECK Operator CRDs Helm Chart + +[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/elastic)](https://artifacthub.io/packages/helm/elastic/eck-operator-crds) + +A Helm chart to install the Kubernetes Custom Resource Definitions (CRD) required by the ECK Operator: the official Kubernetes operator from Elastic to orchestrate Elasticsearch, Kibana, APM Server, Enterprise Search, and Beats on Kubernetes. This chart is usually automatically installed by the [ECK Operator Helm Chart](https://artifacthub.io/packages/helm/elastic/eck-operator) when installed using the default settings. Refer to the [installation documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html) for more information. + + +## Requirements + +- Supported Kubernetes versions are listed in the documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s_supported_versions.html +- Helm >= 3.2.0 + + +## Usage + +Refer to the documentation at https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/NOTES.txt b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/NOTES.txt new file mode 100644 index 00000000..1478c82b --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/NOTES.txt @@ -0,0 +1 @@ +ECK Custom Resource Definitions installed. diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/_helpers.tpl b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/_helpers.tpl new file mode 100644 index 00000000..548f1bc6 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "eck-operator-crds.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "eck-operator-crds.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "eck-operator-crds.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "eck-operator-crds.labels" -}} +helm.sh/chart: {{ include "eck-operator-crds.chart" . }} +{{ include "eck-operator-crds.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "eck-operator-crds.selectorLabels" -}} +app.kubernetes.io/name: {{ include "eck-operator-crds.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Determine effective Kubernetes version +*/}} +{{- define "eck-operator-crds.effectiveKubeVersion" -}} +{{- if .Values.global.manifestGen -}} +{{- semver .Values.global.kubeVersion -}} +{{- else -}} +{{- .Capabilities.KubeVersion.Version -}} +{{- end -}} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml new file mode 100644 index 00000000..f04176eb --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/templates/all-crds.yaml @@ -0,0 +1,11940 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: agents.agent.k8s.elastic.co +spec: + group: agent.k8s.elastic.co + names: + categories: + - elastic + kind: Agent + listKind: AgentList + plural: agents + shortNames: + - agent + singular: agent + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: available + type: integer + - description: Expected nodes + jsonPath: .status.expectedNodes + name: expected + type: integer + - description: Agent version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: Agent is the Schema for the Agents API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AgentSpec defines the desired state of the Agent + properties: + config: + description: Config holds the Agent configuration. At most one of + [`Config`, `ConfigRef`] can be specified. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Agent configuration. + Agent settings must be specified as yaml, under a single "agent.yml" entry. At most one of [`Config`, `ConfigRef`] + can be specified. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + daemonSet: + description: |- + DaemonSet specifies the Agent should be deployed as a DaemonSet, and allows providing its spec. + Cannot be used along with `deployment` or `statefulSet`. + properties: + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + updateStrategy: + description: DaemonSetUpdateStrategy is a struct used to control + the update strategy for a DaemonSet. + properties: + rollingUpdate: + description: Rolling update config params. Present only if + type = "RollingUpdate". + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of nodes with an existing available DaemonSet pod that + can have an updated DaemonSet pod during during an update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up to a minimum of 1. + Default value is 0. + Example: when this is set to 30%, at most 30% of the total number of nodes + that should be running the daemon pod (i.e. status.desiredNumberScheduled) + can have their a new pod created before the old pod is marked as deleted. + The update starts by launching new pods on 30% of nodes. Once an updated + pod is available (Ready for at least minReadySeconds) the old DaemonSet pod + on that node is marked deleted. If the old pod becomes unavailable for any + reason (Ready transitions to false, is evicted, or is drained) an updated + pod is immediately created on that node without considering surge limits. + Allowing surge implies the possibility that the resources consumed by the + daemonset on any given node can double if the readiness check fails, and + so resource intensive daemonsets should take into account that they may + cause evictions during disruption. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of DaemonSet pods that can be unavailable during the + update. Value can be an absolute number (ex: 5) or a percentage of total + number of DaemonSet pods at the start of the update (ex: 10%). Absolute + number is calculated from percentage by rounding up. + This cannot be 0 if MaxSurge is 0 + Default value is 1. + Example: when this is set to 30%, at most 30% of the total number of nodes + that should be running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. The update + starts by stopping at most 30% of those DaemonSet pods and then brings + up new DaemonSet pods in their place. Once the new pods are available, + it then proceeds onto other DaemonSet pods, thus ensuring that at least + 70% of original number of DaemonSet pods are available at all times during + the update. + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + type: object + deployment: + description: |- + Deployment specifies the Agent should be deployed as a Deployment, and allows providing its spec. + Cannot be used along with `daemonSet` or `statefulSet`. + properties: + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + replicas: + format: int32 + type: integer + strategy: + description: DeploymentStrategy describes how to replace existing + pods with new ones. + properties: + rollingUpdate: + description: |- + Rolling update config params. Present only if DeploymentStrategyType = + RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. + x-kubernetes-int-or-string: true + type: object + type: + description: Type of deployment. Can be "Recreate" or "RollingUpdate". + Default is RollingUpdate. + type: string + type: object + type: object + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single ES cluster is currently supported. + items: + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + outputName: + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + fleetServerEnabled: + description: FleetServerEnabled determines whether this Agent will + launch Fleet Server. Don't set unless `mode` is set to `fleet`. + type: boolean + fleetServerRef: + description: |- + FleetServerRef is a reference to Fleet Server that this Agent should connect to to obtain it's configuration. + Don't set unless `mode` is set to `fleet`. + References to Fleet servers running outside the Kubernetes cluster via the `secretName` attribute are not supported. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for the Agent + in Fleet mode with Fleet Server enabled. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Agent Docker image to deploy. Version has + to match the Agent in the image. + type: string + kibanaRef: + description: |- + KibanaRef is a reference to Kibana where Fleet should be set up and this Agent should be enrolled. Don't set + unless `mode` is set to `fleet`. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + mode: + description: |- + Mode specifies the runtime mode for the Agent. The configuration can be specified locally through + `config` or `configRef` (`standalone` mode), or come from Fleet during runtime (`fleet` mode). Starting with + version 8.13.0 Fleet-managed agents support advanced configuration via a local configuration file. + See https://www.elastic.co/docs/reference/fleet/advanced-kubernetes-managed-by-fleet + Defaults to `standalone` mode. + enum: + - standalone + - fleet + type: string + policyID: + description: |- + PolicyID determines into which Agent Policy this Agent will be enrolled. + This field will become mandatory in a future release, default policies are deprecated since 8.1.0. + type: string + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying DaemonSet or Deployment or StatefulSet. + format: int32 + type: integer + secureSettings: + description: |- + SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for the Agent. + Secrets data can be then referenced in the Agent config using the Secret's keys or as specified in `Entries` field of + each SecureSetting. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to an Elasticsearch resource in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + statefulSet: + description: |- + StatefulSet specifies the Agent should be deployed as a StatefulSet, and allows providing its spec. + Cannot be used along with `daemonSet` or `deployment`. + properties: + podManagementPolicy: + default: Parallel + description: |- + PodManagementPolicy controls how pods are created during initial scale up, + when replacing pods on nodes, or when scaling down. The default policy is + `Parallel`, where pods are created in parallel to match the desired scale + without waiting, and on scale down will delete all pods at once. + The alternative policy is `OrderedReady`, the default for vanilla kubernetes + StatefulSets, where pods are created in increasing order in increasing order + (pod-0, then pod-1, etc.) and the controller will wait until each pod is ready before + continuing. When scaling down, the pods are removed in the opposite order. + enum: + - OrderedReady + - Parallel + type: string + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + replicas: + format: int32 + type: integer + serviceName: + type: string + volumeClaimTemplates: + description: |- + VolumeClaimTemplates is a list of persistent volume claims to be used by each Pod. + Every claim in this list must have a matching volumeMount in one of the containers defined in the PodTemplate. + Items defined here take precedence over any default claims added by the operator with the same name. + items: + description: PersistentVolumeClaim is a user's request for and + claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + Users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string or nil value indicates that no + VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, + this field can be reset to its previous value (including nil) to cancel the modification. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + type: object + type: array + type: object + version: + description: Version of the Agent. + type: string + required: + - version + type: object + status: + description: AgentStatus defines the observed state of the Agent + properties: + availableNodes: + format: int32 + type: integer + elasticsearchAssociationsStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: |- + AssociationStatusMap is the map of association's namespaced name string to its AssociationStatus. For resources that + have a single Association of a given type (for ex. single ES reference), this map contains a single entry. + type: object + expectedNodes: + format: int32 + type: integer + fleetServerAssociationStatus: + description: AssociationStatus is the status of an association resource. + type: string + health: + type: string + kibanaAssociationStatus: + description: AssociationStatus is the status of an association resource. + type: string + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Elastic Agent. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Elastic + Agent controller has not yet processed the changes contained in the Elastic Agent specification. + format: int64 + type: integer + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: apmservers.apm.k8s.elastic.co +spec: + group: apm.k8s.elastic.co + names: + categories: + - elastic + kind: ApmServer + listKind: ApmServerList + plural: apmservers + shortNames: + - apm + singular: apmserver + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: APM version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1 + schema: + openAPIV3Schema: + description: ApmServer represents an APM Server resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ApmServerSpec holds the specification of an APM Server. + properties: + config: + description: 'Config holds the APM Server configuration. See: https://www.elastic.co/guide/en/apm/server/current/configuring-howto-apm-server.html' + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: Count of APM Server instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to the output Elasticsearch + cluster running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for the APM Server + resource. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the APM Server Docker image to deploy. + type: string + kibanaRef: + description: |- + KibanaRef is a reference to a Kibana instance running in the same Kubernetes cluster. + It allows APM agent central configuration management in Kibana. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the APM Server + pods. + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for APM Server. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of the APM Server. + type: string + required: + - version + type: object + status: + description: ApmServerStatus defines the observed state of ApmServer + properties: + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + elasticsearchAssociationStatus: + description: ElasticsearchAssociationStatus is the status of any auto-linking + to Elasticsearch clusters. + type: string + health: + description: Health of the deployment. + type: string + kibanaAssociationStatus: + description: KibanaAssociationStatus is the status of any auto-linking + to Kibana. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the status is based upon. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the APM Server + controller has not yet processed the changes contained in the APM Server specification. + format: int64 + type: integer + secretTokenSecret: + description: SecretTokenSecretName is the name of the Secret that + contains the secret token + type: string + selector: + description: Selector is the label selector used to find all pods. + type: string + service: + description: ExternalService is the name of the service the agents + should connect to. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: APM version + jsonPath: .spec.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: ApmServer represents an APM Server resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ApmServerSpec holds the specification of an APM Server. + properties: + config: + description: 'Config holds the APM Server configuration. See: https://www.elastic.co/guide/en/apm/server/current/configuring-howto-apm-server.html' + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: Count of APM Server instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to the output Elasticsearch + cluster running in the same Kubernetes cluster. + properties: + name: + description: Name of the Kubernetes object. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + required: + - name + type: object + http: + description: HTTP holds the HTTP layer configuration for the APM Server + resource. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certifcate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the APM Server Docker image to deploy. + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the APM Server + pods. + type: object + x-kubernetes-preserve-unknown-fields: true + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for APM Server. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + version: + description: Version of the APM Server. + type: string + type: object + status: + description: ApmServerStatus defines the observed state of ApmServer + properties: + associationStatus: + description: Association is the status of any auto-linking to Elasticsearch + clusters. + type: string + availableNodes: + format: int32 + type: integer + health: + description: ApmServerHealth expresses the status of the Apm Server + instances. + type: string + secretTokenSecret: + description: SecretTokenSecretName is the name of the Secret that + contains the secret token + type: string + service: + description: ExternalService is the name of the service the agents + should connect to. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: to not break compatibility when upgrading from previous versions + of the CRD + type: object + served: false + storage: false +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: autoopsagentpolicies.autoops.k8s.elastic.co +spec: + group: autoops.k8s.elastic.co + names: + categories: + - elastic + kind: AutoOpsAgentPolicy + listKind: AutoOpsAgentPolicyList + plural: autoopsagentpolicies + shortNames: + - aop + singular: autoopsagentpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Ready resources + jsonPath: .status.ready + name: Ready + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: AutoOpsAgentPolicy represents an Elastic AutoOps Policy resource + in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + autoOpsRef: + description: AutoOpsRef defines a reference to a secret containing + connection details for AutoOps via Cloud Connect. + properties: + secretName: + description: |- + SecretName references a Secret containing connection details for external AutoOps. + Required when connecting via Cloud Connect. The secret must contain: + - `cloud-connected-mode-api-key`: Cloud Connected Mode API key + - `autoops-otel-url`: AutoOps OpenTelemetry endpoint URL + - `autoops-token`: AutoOps authentication token + - `cloud-connected-mode-api-url`: (optional) Cloud Connected Mode API URL + This field cannot be used in combination with `name`. + type: string + type: object + image: + description: Image is the AutoOps Agent Docker image to deploy. + type: string + namespaceSelector: + description: |- + NamespaceSelector is a namespace selector for the resources to be configured. + Any Elasticsearch instances that belong to the selected namespaces will be configured to send data to AutoOps. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Agent pods + type: object + x-kubernetes-preserve-unknown-fields: true + resourceSelector: + description: |- + ResourceSelector is a label selector for the resources to be configured. + Any Elasticsearch instances that match the selector will be configured to send data to AutoOps. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + serviceAccountName: + description: |- + ServiceAccountName is used to check access to Elasticsearch resources in different namespaces. + Can only be used if ECK is enforcing RBAC on references (--enforce-rbac-on-refs flag). + The service account must have "get" permission on elasticsearch.k8s.elastic.co/elasticsearches + in the target namespaces. + type: string + version: + description: Version of the AutoOpsAgentPolicy. + type: string + required: + - version + type: object + status: + properties: + errors: + description: Errors is the number of resources that are in an error + state. + type: integer + observedGeneration: + description: ObservedGeneration is the most recent generation observed + for this AutoOpsAgentPolicy. + format: int64 + type: integer + phase: + description: Phase is the phase of the AutoOpsAgentPolicy. + type: string + ready: + description: Ready is the number of resources that are in a ready + state. + type: integer + resources: + description: Resources is the number of resources that match the ResourceSelector. + type: integer + required: + - errors + - ready + - resources + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: beats.beat.k8s.elastic.co +spec: + group: beat.k8s.elastic.co + names: + categories: + - elastic + kind: Beat + listKind: BeatList + plural: beats + shortNames: + - beat + singular: beat + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: available + type: integer + - description: Expected nodes + jsonPath: .status.expectedNodes + name: expected + type: integer + - description: Beat type + jsonPath: .spec.type + name: type + type: string + - description: Beat version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Beat is the Schema for the Beats API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BeatSpec defines the desired state of a Beat. + properties: + config: + description: Config holds the Beat configuration. At most one of [`Config`, + `ConfigRef`] can be specified. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Beat configuration. + Beat settings must be specified as yaml, under a single "beat.yml" entry. At most one of [`Config`, `ConfigRef`] + can be specified. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + daemonSet: + description: |- + DaemonSet specifies the Beat should be deployed as a DaemonSet, and allows providing its spec. + Cannot be used along with `deployment`. If both are absent a default for the Type is used. + properties: + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + updateStrategy: + description: DaemonSetUpdateStrategy is a struct used to control + the update strategy for a DaemonSet. + properties: + rollingUpdate: + description: Rolling update config params. Present only if + type = "RollingUpdate". + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of nodes with an existing available DaemonSet pod that + can have an updated DaemonSet pod during during an update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up to a minimum of 1. + Default value is 0. + Example: when this is set to 30%, at most 30% of the total number of nodes + that should be running the daemon pod (i.e. status.desiredNumberScheduled) + can have their a new pod created before the old pod is marked as deleted. + The update starts by launching new pods on 30% of nodes. Once an updated + pod is available (Ready for at least minReadySeconds) the old DaemonSet pod + on that node is marked deleted. If the old pod becomes unavailable for any + reason (Ready transitions to false, is evicted, or is drained) an updated + pod is immediately created on that node without considering surge limits. + Allowing surge implies the possibility that the resources consumed by the + daemonset on any given node can double if the readiness check fails, and + so resource intensive daemonsets should take into account that they may + cause evictions during disruption. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of DaemonSet pods that can be unavailable during the + update. Value can be an absolute number (ex: 5) or a percentage of total + number of DaemonSet pods at the start of the update (ex: 10%). Absolute + number is calculated from percentage by rounding up. + This cannot be 0 if MaxSurge is 0 + Default value is 1. + Example: when this is set to 30%, at most 30% of the total number of nodes + that should be running the daemon pod (i.e. status.desiredNumberScheduled) + can have their pods stopped for an update at any given time. The update + starts by stopping at most 30% of those DaemonSet pods and then brings + up new DaemonSet pods in their place. Once the new pods are available, + it then proceeds onto other DaemonSet pods, thus ensuring that at least + 70% of original number of DaemonSet pods are available at all times during + the update. + x-kubernetes-int-or-string: true + type: object + type: + description: Type of daemon set update. Can be "RollingUpdate" + or "OnDelete". Default is RollingUpdate. + type: string + type: object + type: object + deployment: + description: |- + Deployment specifies the Beat should be deployed as a Deployment, and allows providing its spec. + Cannot be used along with `daemonSet`. If both are absent a default for the Type is used. + properties: + podTemplate: + description: PodTemplateSpec describes the data a pod should have + when created from a template + type: object + x-kubernetes-preserve-unknown-fields: true + replicas: + format: int32 + type: integer + strategy: + description: DeploymentStrategy describes how to replace existing + pods with new ones. + properties: + rollingUpdate: + description: |- + Rolling update config params. Present only if DeploymentStrategyType = + RollingUpdate. + properties: + maxSurge: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be scheduled above the desired number of + pods. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + This can not be 0 if MaxUnavailable is 0. + Absolute number is calculated from percentage by rounding up. + Defaults to 25%. + Example: when this is set to 30%, the new ReplicaSet can be scaled up immediately when + the rolling update starts, such that the total number of old and new pods do not exceed + 130% of desired pods. Once old pods have been killed, + new ReplicaSet can be scaled up further, ensuring that total number of pods running + at any time during the update is at most 130% of desired pods. + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding down. + This can not be 0 if MaxSurge is 0. + Defaults to 25%. + Example: when this is set to 30%, the old ReplicaSet can be scaled down to 70% of desired pods + immediately when the rolling update starts. Once new pods are ready, old ReplicaSet + can be scaled down further, followed by scaling up the new ReplicaSet, ensuring + that the total number of pods available at all times during the update is at + least 70% of desired pods. + x-kubernetes-int-or-string: true + type: object + type: + description: Type of deployment. Can be "Recreate" or "RollingUpdate". + Default is RollingUpdate. + type: string + type: object + type: object + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + image: + description: Image is the Beat Docker image to deploy. Version and + Type have to match the Beat in the image. + type: string + kibanaRef: + description: |- + KibanaRef is a reference to a Kibana instance running in the same Kubernetes cluster. + It allows automatic setup of dashboards and visualizations. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + monitoring: + description: |- + Monitoring enables you to collect and ship logs and metrics for this Beat. + Metricbeat and/or Filebeat sidecars are configured and send monitoring data to an + Elasticsearch monitoring cluster running in the same Kubernetes cluster. + properties: + logs: + description: Logs holds references to Elasticsearch clusters which + receive log data from an associated resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + metrics: + description: Metrics holds references to Elasticsearch clusters + which receive monitoring data from this resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + type: object + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying DaemonSet or Deployment. + format: int32 + type: integer + secureSettings: + description: |- + SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for the Beat. + Secrets data can be then referenced in the Beat config using the Secret's keys or as specified in `Entries` field of + each SecureSetting. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to Elasticsearch resource in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + type: + description: |- + Type is the type of the Beat to deploy (filebeat, metricbeat, heartbeat, auditbeat, journalbeat, packetbeat, and so on). + Any string can be used, but well-known types will have the image field defaulted and have the appropriate + Elasticsearch roles created automatically. It also allows for dashboard setup when combined with a `KibanaRef`. + maxLength: 20 + pattern: '[a-zA-Z0-9-]+' + type: string + version: + description: Version of the Beat. + type: string + required: + - type + - version + type: object + status: + description: BeatStatus defines the observed state of a Beat. + properties: + availableNodes: + format: int32 + type: integer + elasticsearchAssociationStatus: + description: AssociationStatus is the status of an association resource. + type: string + expectedNodes: + format: int32 + type: integer + health: + type: string + kibanaAssociationStatus: + description: AssociationStatus is the status of an association resource. + type: string + monitoringAssociationStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: |- + AssociationStatusMap is the map of association's namespaced name string to its AssociationStatus. For resources that + have a single Association of a given type (for ex. single ES reference), this map contains a single entry. + type: object + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the status is based upon. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Beats + controller has not yet processed the changes contained in the Beats specification. + format: int64 + type: integer + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: elasticmapsservers.maps.k8s.elastic.co +spec: + group: maps.k8s.elastic.co + names: + categories: + - elastic + kind: ElasticMapsServer + listKind: ElasticMapsServerList + plural: elasticmapsservers + shortNames: + - ems + singular: elasticmapsserver + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: ElasticMapsServer version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: ElasticMapsServer represents an Elastic Map Server resource in + a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: MapsSpec holds the specification of an Elastic Maps Server + instance. + properties: + config: + description: 'Config holds the ElasticMapsServer configuration. See: + https://www.elastic.co/guide/en/kibana/current/maps-connect-to-ems.html#elastic-maps-server-configuration' + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Elastic Maps Server configuration. + Configuration settings are merged and have precedence over settings specified in `config`. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + description: Count of Elastic Maps Server instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for Elastic Maps + Server. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Elastic Maps Server Docker image to deploy. + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Elastic Maps + Server pods + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of Elastic Maps Server. + type: string + required: + - version + type: object + status: + description: MapsStatus defines the observed state of Elastic Maps Server + properties: + associationStatus: + description: AssociationStatus is the status of an association resource. + type: string + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + health: + description: Health of the deployment. + type: string + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Elastic Maps Server. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Elastic + Maps controller has not yet processed the changes contained in the Elastic Maps specification. + format: int64 + type: integer + selector: + description: Selector is the label selector used to find all pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: elasticsearchautoscalers.autoscaling.k8s.elastic.co +spec: + group: autoscaling.k8s.elastic.co + names: + categories: + - elastic + kind: ElasticsearchAutoscaler + listKind: ElasticsearchAutoscalerList + plural: elasticsearchautoscalers + shortNames: + - esa + singular: elasticsearchautoscaler + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.elasticsearchRef.name + name: Target + type: string + - jsonPath: .status.conditions[?(@.type=='Active')].status + name: Active + type: string + - jsonPath: .status.conditions[?(@.type=='Healthy')].status + name: Healthy + type: string + - jsonPath: .status.conditions[?(@.type=='Limited')].status + name: Limited + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ElasticsearchAutoscaler represents an ElasticsearchAutoscaler + resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ElasticsearchAutoscalerSpec holds the specification of an + Elasticsearch autoscaler resource. + properties: + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + that exists in the same namespace. + properties: + name: + description: Name is the name of the Elasticsearch resource to + scale automatically. + minLength: 1 + type: string + type: object + policies: + items: + description: AutoscalingPolicySpec holds a named autoscaling policy + and the associated resources limits (cpu, memory, storage). + properties: + deciders: + additionalProperties: + additionalProperties: + type: string + description: |- + DeciderSettings allow the user to tweak autoscaling deciders. + The map data structure complies with the format expected by Elasticsearch. + type: object + description: Deciders allow the user to override default settings + for autoscaling deciders. + type: object + name: + description: Name identifies the autoscaling policy in the autoscaling + specification. + type: string + resources: + description: |- + AutoscalingResources model the limits, submitted by the user, for the supported resources in an autoscaling policy. + Only the node count range is mandatory. For other resources, a limit range is required only + if the Elasticsearch autoscaling capacity API returns a requirement for a given resource. + For example, the memory limit range is only required if the autoscaling API response contains a memory requirement. + If there is no limit range for a resource, and if that resource is not mandatory, then the resources in the NodeSets + managed by the autoscaling policy are left untouched. + properties: + cpu: + description: QuantityRange models a resource limit range + for resources which can be expressed with resource.Quantity. + properties: + max: + anyOf: + - type: integer + - type: string + description: Max represents the upper limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + min: + anyOf: + - type: integer + - type: string + description: Min represents the lower limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + requestsToLimitsRatio: + anyOf: + - type: integer + - type: string + description: RequestsToLimitsRatio allows to customize + Kubernetes resource Limit based on the Request. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + required: + - max + - min + type: object + memory: + description: QuantityRange models a resource limit range + for resources which can be expressed with resource.Quantity. + properties: + max: + anyOf: + - type: integer + - type: string + description: Max represents the upper limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + min: + anyOf: + - type: integer + - type: string + description: Min represents the lower limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + requestsToLimitsRatio: + anyOf: + - type: integer + - type: string + description: RequestsToLimitsRatio allows to customize + Kubernetes resource Limit based on the Request. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + required: + - max + - min + type: object + nodeCount: + description: NodeCountRange is used to model the minimum + and the maximum number of nodes over all the NodeSets + managed by the same autoscaling policy. + properties: + max: + description: Max represents the maximum number of nodes + in a tier. + format: int32 + type: integer + min: + description: Min represents the minimum number of nodes + in a tier. + format: int32 + type: integer + required: + - max + - min + type: object + storage: + description: QuantityRange models a resource limit range + for resources which can be expressed with resource.Quantity. + properties: + max: + anyOf: + - type: integer + - type: string + description: Max represents the upper limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + min: + anyOf: + - type: integer + - type: string + description: Min represents the lower limit for the + resources managed by the autoscaler. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + requestsToLimitsRatio: + anyOf: + - type: integer + - type: string + description: RequestsToLimitsRatio allows to customize + Kubernetes resource Limit based on the Request. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + required: + - max + - min + type: object + required: + - nodeCount + type: object + roles: + description: An autoscaling policy must target a unique set + of roles. + items: + type: string + type: array + required: + - resources + type: object + type: array + pollingPeriod: + description: PollingPeriod is the period at which to synchronize with + the Elasticsearch autoscaling API. + type: string + required: + - elasticsearchRef + - policies + type: object + status: + properties: + conditions: + description: Conditions holds the current service state of the autoscaling + controller. + items: + description: |- + Condition represents Elasticsearch resource's condition. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + status: + type: string + type: + description: ConditionType defines the condition of an Elasticsearch + resource. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last observed generation by + the controller. + format: int64 + type: integer + policies: + description: AutoscalingPolicyStatuses is used to expose state messages + to user or external system. + items: + properties: + lastModificationTime: + description: LastModificationTime is the last time the resources + have been updated, used by the cooldown algorithm. + format: date-time + type: string + name: + description: Name is the name of the autoscaling policy + type: string + nodeSets: + description: NodeSetNodeCount holds the number of nodes for + each nodeSet. + items: + description: NodeSetNodeCount models the number of nodes expected + in a given NodeSet. + properties: + name: + description: Name of the Nodeset. + type: string + nodeCount: + description: NodeCount is the number of nodes, as computed + by the autoscaler, expected in this NodeSet. + format: int32 + type: integer + required: + - name + - nodeCount + type: object + type: array + resources: + description: |- + ResourcesSpecification holds the resource values common to all the nodeSets managed by a same autoscaling policy. + Only the resources managed by the autoscaling controller are saved in the Status. + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: ResourceList is a set of (resource name, quantity) + pairs. + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: ResourceList is a set of (resource name, quantity) + pairs. + type: object + type: object + state: + description: PolicyStates may contain various messages regarding + the current state of this autoscaling policy. + items: + properties: + messages: + items: + type: string + type: array + type: + type: string + required: + - messages + - type + type: object + type: array + required: + - name + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: elasticsearches.elasticsearch.k8s.elastic.co +spec: + group: elasticsearch.k8s.elastic.co + names: + categories: + - elastic + kind: Elasticsearch + listKind: ElasticsearchList + plural: elasticsearches + shortNames: + - es + singular: elasticsearch + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Elasticsearch version + jsonPath: .status.version + name: version + type: string + - jsonPath: .status.phase + name: phase + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Elasticsearch represents an Elasticsearch resource in a Kubernetes + cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ElasticsearchSpec holds the specification of an Elasticsearch + cluster. + properties: + auth: + description: Auth contains user authentication and authorization security + settings for Elasticsearch. + properties: + disableElasticUser: + description: DisableElasticUser disables the default elastic user + that is created by ECK. + type: boolean + fileRealm: + description: FileRealm to propagate to the Elasticsearch cluster. + items: + description: FileRealmSource references users to create in the + Elasticsearch cluster. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + type: array + roles: + description: Roles to propagate to the Elasticsearch cluster. + items: + description: RoleSource references roles to create in the Elasticsearch + cluster. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + type: array + type: object + http: + description: HTTP holds HTTP layer settings for Elasticsearch. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Elasticsearch Docker image to deploy. + type: string + monitoring: + description: |- + Monitoring enables you to collect and ship log and monitoring data of this Elasticsearch cluster. + See https://www.elastic.co/guide/en/elasticsearch/reference/current/monitor-elasticsearch-cluster.html. + Metricbeat and Filebeat are deployed in the same Pod as sidecars and each one sends data to one or two different + Elasticsearch monitoring clusters running in the same Kubernetes cluster. + properties: + logs: + description: Logs holds references to Elasticsearch clusters which + receive log data from an associated resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + metrics: + description: Metrics holds references to Elasticsearch clusters + which receive monitoring data from this resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + type: object + nodeSets: + description: NodeSets allow specifying groups of Elasticsearch nodes + sharing the same configuration and Pod templates. + items: + description: NodeSet is the specification for a group of Elasticsearch + nodes sharing the same configuration and a Pod template. + properties: + config: + description: Config holds the Elasticsearch configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: |- + Count of Elasticsearch nodes to deploy. + If the node set is managed by an autoscaling policy the initial value is automatically set by the autoscaling controller. + format: int32 + type: integer + name: + description: Name of this set of nodes. Becomes a part of the + Elasticsearch node.name setting. + maxLength: 23 + pattern: '[a-zA-Z0-9-]+' + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, + annotations, affinity rules, resource requests, and so on) + for the Pods belonging to this NodeSet. + type: object + x-kubernetes-preserve-unknown-fields: true + volumeClaimTemplates: + description: |- + VolumeClaimTemplates is a list of persistent volume claims to be used by each Pod in this NodeSet. + Every claim in this list must have a matching volumeMount in one of the containers defined in the PodTemplate. + Items defined here take precedence over any default claims added by the operator with the same name. + items: + description: PersistentVolumeClaim is a user's request for + and claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + Users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string or nil value indicates that no + VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, + this field can be reset to its previous value (including nil) to cancel the modification. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + type: object + type: array + required: + - name + type: object + minItems: 1 + type: array + podDisruptionBudget: + description: |- + PodDisruptionBudget provides access to the default Pod disruption budget(s) for the Elasticsearch cluster. + The behavior depends on the license level. + With a Basic license or if podDisruptionBudget.spec is not empty: + The default budget doesn't allow any Pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`. + In all other cases the default podDisruptionBudget sets `minAvailable` equal to the total number of nodes minus 1. + With an Enterprise license and if podDisruptionBudget.spec is empty: + The default budget is split into multiple budgets, each targeting a specific node role type allowing additional disruptions + for certain roles according to the health status of the cluster. + Example: + All data roles (excluding frozen): allows disruptions only when the cluster is green. + All other roles: allows disruptions only when the cluster is yellow or green. + To disable, set `podDisruptionBudget` to the empty value (`{}` in YAML). + properties: + metadata: + description: |- + ObjectMeta is the metadata of the PDB. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the PDB. + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selector: + description: |- + Label query over pods whose evictions are managed by the disruption + budget. + A null selector will match no pods, while an empty ({}) selector will select + all pods within the namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + unhealthyPodEvictionPolicy: + description: |- + UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods + should be considered for eviction. Current implementation considers healthy pods, + as pods that have status.conditions item with type="Ready",status="True". + + Valid policies are IfHealthyBudget and AlwaysAllow. + If no policy is specified, the default behavior will be used, + which corresponds to the IfHealthyBudget policy. + + IfHealthyBudget policy means that running pods (status.phase="Running"), + but not yet healthy can be evicted only if the guarded application is not + disrupted (status.currentHealthy is at least equal to status.desiredHealthy). + Healthy pods will be subject to the PDB for eviction. + + AlwaysAllow policy means that all running pods (status.phase="Running"), + but not yet healthy are considered disrupted and can be evicted regardless + of whether the criteria in a PDB is met. This means perspective running + pods of a disrupted application might not get a chance to become healthy. + Healthy pods will be subject to the PDB for eviction. + + Additional policies may be added in the future. + Clients making eviction decisions should disallow eviction of unhealthy pods + if they encounter an unrecognized policy in this field. + type: string + type: object + type: object + remoteClusterServer: + description: |- + RemoteClusterServer specifies if the remote cluster server should be enabled. + This must be enabled if this cluster is a remote cluster which is expected to be accessed using API key authentication. + properties: + enabled: + type: boolean + service: + description: Service defines the template for the remote cluster + server Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + type: object + remoteClusters: + description: RemoteClusters enables you to establish uni-directional + connections to a remote Elasticsearch cluster. + items: + description: RemoteCluster declares a remote Elasticsearch cluster + connection. + properties: + apiKey: + description: 'APIKey can be used to enable remote cluster access + using Cross-Cluster API keys: https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-cross-cluster-api-key.html' + properties: + access: + description: Access is the name of the API Key. It is automatically + generated if not set or empty. + properties: + replication: + properties: + names: + items: + type: string + type: array + required: + - names + type: object + search: + properties: + allow_restricted_indices: + type: boolean + field_security: + properties: + except: + items: + type: string + type: array + grant: + items: + type: string + type: array + required: + - except + - grant + type: object + names: + items: + type: string + type: array + query: + type: object + x-kubernetes-preserve-unknown-fields: true + required: + - names + type: object + type: object + required: + - access + type: object + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch + cluster running within the same k8s cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, + defaults to the current namespace. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + name: + description: |- + Name is the name of the remote cluster as it is set in the Elasticsearch settings. + The name is expected to be unique for each remote clusters. + minLength: 1 + type: string + required: + - name + type: object + type: array + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying StatefulSets. + format: int32 + type: integer + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for Elasticsearch. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + transport: + description: Transport holds transport layer settings for Elasticsearch. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS on the transport + layer. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the CA certificate + and private key for generating node certificates. + The referenced secret should contain the following: + + - `ca.crt`: The CA certificate in PEM format. + - `ca.key`: The private key for the CA certificate in PEM format. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + certificateAuthorities: + description: |- + CertificateAuthorities is a reference to a config map that contains one or more x509 certificates for + trusted authorities in PEM format. The certificates need to be in a file called `ca.crt`. + properties: + configMapName: + type: string + type: object + otherNameSuffix: + description: |- + OtherNameSuffix when defined will be prefixed with the Pod name and used as the common name, + and the first DNSName, as well as an OtherName required by Elasticsearch in the Subject Alternative Name + extension of each Elasticsearch node's transport TLS certificate. + Example: if set to "node.cluster.local", the generated certificate will have its otherName set to ".node.cluster.local". + type: string + selfSignedCertificates: + description: SelfSignedCertificates allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that provisioning of the + self-signed certificates should be disabled. + type: boolean + type: object + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs to + include in the generated node transport TLS certificates. + items: + description: SubjectAlternativeName represents a SAN entry + in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + updateStrategy: + description: UpdateStrategy specifies how updates to the cluster should + be performed. + properties: + changeBudget: + description: ChangeBudget defines the constraints to consider + when applying changes to the Elasticsearch cluster. + properties: + maxSurge: + description: |- + MaxSurge is the maximum number of new Pods that can be created exceeding the original number of Pods defined in + the specification. MaxSurge is only taken into consideration when scaling up. Setting a negative value will + disable the restriction. Defaults to unbounded if not specified. + format: int32 + type: integer + maxUnavailable: + description: |- + MaxUnavailable is the maximum number of Pods that can be unavailable (not ready) during the update due to + circumstances under the control of the operator. Setting a negative value will disable this restriction. + Defaults to 1 if not specified. + format: int32 + type: integer + type: object + type: object + version: + description: Version of Elasticsearch. + type: string + volumeClaimDeletePolicy: + description: |- + VolumeClaimDeletePolicy sets the policy for handling deletion of PersistentVolumeClaims for all NodeSets. + Possible values are DeleteOnScaledownOnly and DeleteOnScaledownAndClusterDeletion. Defaults to DeleteOnScaledownAndClusterDeletion. + enum: + - DeleteOnScaledownOnly + - DeleteOnScaledownAndClusterDeletion + type: string + required: + - nodeSets + - version + type: object + status: + description: ElasticsearchStatus represents the observed state of Elasticsearch. + properties: + availableNodes: + description: AvailableNodes is the number of available instances. + format: int32 + type: integer + conditions: + description: |- + Conditions holds the current service state of an Elasticsearch cluster. + **This API is in technical preview and may be changed or removed in a future release.** + items: + description: |- + Condition represents Elasticsearch resource's condition. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + status: + type: string + type: + description: ConditionType defines the condition of an Elasticsearch + resource. + type: string + required: + - status + - type + type: object + type: array + health: + description: ElasticsearchHealth is the health of the cluster as returned + by the health API. + type: string + inProgressOperations: + description: |- + InProgressOperations represents changes being applied by the operator to the Elasticsearch cluster. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + downscale: + description: |- + DownscaleOperation provides details about in progress downscale operations. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastUpdatedTime: + format: date-time + type: string + nodes: + description: Nodes which are scheduled to be removed from + the cluster. + items: + description: |- + DownscaledNode provides an overview of in progress changes applied by the operator to remove Elasticsearch nodes from the cluster. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + explanation: + description: |- + Explanation provides details about an in progress node shutdown. It is only available for clusters managed with the + Elasticsearch shutdown API. + type: string + name: + description: Name of the Elasticsearch node that should + be removed. + type: string + shutdownStatus: + description: |- + Shutdown status as returned by the Elasticsearch shutdown API. + If the Elasticsearch shutdown API is not available, the shutdown status is then inferred from the remaining + shards on the nodes, as observed by the operator. + type: string + required: + - name + - shutdownStatus + type: object + type: array + stalled: + description: |- + Stalled represents a state where no progress can be made. + It is only available for clusters managed with the Elasticsearch shutdown API. + type: boolean + type: object + upgrade: + description: |- + UpgradeOperation provides an overview of the pending or in progress changes applied by the operator to update the Elasticsearch nodes in the cluster. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastUpdatedTime: + format: date-time + type: string + nodes: + description: Nodes that must be restarted for upgrade. + items: + description: |- + UpgradedNode provides details about the status of nodes which are expected to be updated. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + message: + description: Optional message to explain why a node + may not be immediately restarted for upgrade. + type: string + name: + description: Name of the Elasticsearch node that should + be upgraded. + type: string + predicate: + description: Predicate is the name of the predicate + currently preventing this node from being deleted + for an upgrade. + type: string + status: + description: |- + Status states if the node is either in the process of being deleted for an upgrade, + or blocked by a predicate or another condition stated in the message field. + type: string + required: + - name + - status + type: object + type: array + type: object + upscale: + description: |- + UpscaleOperation provides an overview of in progress changes applied by the operator to add Elasticsearch nodes to the cluster. + **This API is in technical preview and may be changed or removed in a future release.** + properties: + lastUpdatedTime: + format: date-time + type: string + nodes: + description: Nodes expected to be added by the operator. + items: + properties: + message: + description: Optional message to explain why a node + may not be immediately added. + type: string + name: + description: Name of the Elasticsearch node that should + be added to the cluster. + type: string + status: + description: NewNodeStatus states if a new node is being + created, or if the upscale is delayed. + type: string + required: + - name + - status + type: object + type: array + type: object + required: + - downscale + - upgrade + - upscale + type: object + monitoringAssociationStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: |- + AssociationStatusMap is the map of association's namespaced name string to its AssociationStatus. For resources that + have a single Association of a given type (for ex. single ES reference), this map contains a single entry. + type: object + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Elasticsearch cluster. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Elasticsearch + controller has not yet processed the changes contained in the Elasticsearch specification. + format: int64 + type: integer + phase: + description: ElasticsearchOrchestrationPhase is the phase Elasticsearch + is in from the controller point of view. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Elasticsearch version + jsonPath: .spec.version + name: version + type: string + - jsonPath: .status.phase + name: phase + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Elasticsearch represents an Elasticsearch resource in a Kubernetes + cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ElasticsearchSpec holds the specification of an Elasticsearch + cluster. + properties: + http: + description: HTTP holds HTTP layer settings for Elasticsearch. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certifcate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Elasticsearch Docker image to deploy. + type: string + nodeSets: + description: NodeSets allow specifying groups of Elasticsearch nodes + sharing the same configuration and Pod templates. + items: + description: NodeSet is the specification for a group of Elasticsearch + nodes sharing the same configuration and a Pod template. + properties: + config: + description: Config holds the Elasticsearch configuration. + type: object + count: + description: Count of Elasticsearch nodes to deploy. + format: int32 + minimum: 1 + type: integer + name: + description: Name of this set of nodes. Becomes a part of the + Elasticsearch node.name setting. + maxLength: 23 + pattern: '[a-zA-Z0-9-]+' + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, + annotations, affinity rules, resource requests, and so on) + for the Pods belonging to this NodeSet. + type: object + volumeClaimTemplates: + description: |- + VolumeClaimTemplates is a list of persistent volume claims to be used by each Pod in this NodeSet. + Every claim in this list must have a matching volumeMount in one of the containers defined in the PodTemplate. + Items defined here take precedence over any default claims added by the operator with the same name. + items: + description: PersistentVolumeClaim is a user's request for + and claim to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being + referenced + type: string + name: + description: Name is the name of resource being + referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + Users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes + to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string or nil value indicates that no + VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, + this field can be reset to its previous value (including nil) to cancel the modification. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to + the PersistentVolume backing this claim. + type: string + type: object + type: object + type: array + required: + - count + - name + type: object + minItems: 1 + type: array + podDisruptionBudget: + description: |- + PodDisruptionBudget provides access to the default pod disruption budget for the Elasticsearch cluster. + The default budget selects all cluster pods and sets `maxUnavailable` to 1. To disable, set `PodDisruptionBudget` + to the empty value (`{}` in YAML). + properties: + metadata: + description: |- + ObjectMeta is the metadata of the PDB. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the PDB. + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at most "maxUnavailable" pods selected by + "selector" are unavailable after the eviction, i.e. even in absence of + the evicted pod. For example, one can prevent all voluntary evictions + by specifying 0. This is a mutually exclusive setting with "minAvailable". + x-kubernetes-int-or-string: true + minAvailable: + anyOf: + - type: integer + - type: string + description: |- + An eviction is allowed if at least "minAvailable" pods selected by + "selector" will still be available after the eviction, i.e. even in the + absence of the evicted pod. So for example you can prevent all voluntary + evictions by specifying "100%". + x-kubernetes-int-or-string: true + selector: + description: |- + Label query over pods whose evictions are managed by the disruption + budget. + A null selector selects no pods. + An empty selector ({}) also selects no pods, which differs from standard behavior of selecting all pods. + In policy/v1, an empty selector will select all pods in the namespace. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + unhealthyPodEvictionPolicy: + description: |- + UnhealthyPodEvictionPolicy defines the criteria for when unhealthy pods + should be considered for eviction. Current implementation considers healthy pods, + as pods that have status.conditions item with type="Ready",status="True". + + Valid policies are IfHealthyBudget and AlwaysAllow. + If no policy is specified, the default behavior will be used, + which corresponds to the IfHealthyBudget policy. + + IfHealthyBudget policy means that running pods (status.phase="Running"), + but not yet healthy can be evicted only if the guarded application is not + disrupted (status.currentHealthy is at least equal to status.desiredHealthy). + Healthy pods will be subject to the PDB for eviction. + + AlwaysAllow policy means that all running pods (status.phase="Running"), + but not yet healthy are considered disrupted and can be evicted regardless + of whether the criteria in a PDB is met. This means perspective running + pods of a disrupted application might not get a chance to become healthy. + Healthy pods will be subject to the PDB for eviction. + + Additional policies may be added in the future. + Clients making eviction decisions should disallow eviction of unhealthy pods + if they encounter an unrecognized policy in this field. + type: string + type: object + type: object + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for Elasticsearch. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + updateStrategy: + description: UpdateStrategy specifies how updates to the cluster should + be performed. + properties: + changeBudget: + description: ChangeBudget defines the constraints to consider + when applying changes to the Elasticsearch cluster. + properties: + maxSurge: + description: |- + MaxSurge is the maximum number of new pods that can be created exceeding the original number of pods defined in + the specification. MaxSurge is only taken into consideration when scaling up. Setting a negative value will + disable the restriction. Defaults to unbounded if not specified. + format: int32 + type: integer + maxUnavailable: + description: |- + MaxUnavailable is the maximum number of pods that can be unavailable (not ready) during the update due to + circumstances under the control of the operator. Setting a negative value will disable this restriction. + Defaults to 1 if not specified. + format: int32 + type: integer + type: object + type: object + version: + description: Version of Elasticsearch. + type: string + required: + - nodeSets + type: object + status: + description: ElasticsearchStatus defines the observed state of Elasticsearch + properties: + availableNodes: + format: int32 + type: integer + health: + description: ElasticsearchHealth is the health of the cluster as returned + by the health API. + type: string + phase: + description: ElasticsearchOrchestrationPhase is the phase Elasticsearch + is in from the controller point of view. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: to not break compatibility when upgrading from previous versions + of the CRD + type: object + served: false + storage: false +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: enterprisesearches.enterprisesearch.k8s.elastic.co +spec: + group: enterprisesearch.k8s.elastic.co + names: + categories: + - elastic + kind: EnterpriseSearch + listKind: EnterpriseSearchList + plural: enterprisesearches + shortNames: + - ent + singular: enterprisesearch + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Enterprise Search version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1 + schema: + openAPIV3Schema: + description: EnterpriseSearch is a Kubernetes CRD to represent Enterprise + Search. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EnterpriseSearchSpec holds the specification of an Enterprise + Search resource. + properties: + config: + description: Config holds the Enterprise Search configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Enterprise Search configuration. + Configuration settings are merged and have precedence over settings specified in `config`. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + description: Count of Enterprise Search instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to the Elasticsearch + cluster running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for Enterprise + Search resource. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Enterprise Search Docker image to deploy. + type: string + podTemplate: + description: |- + PodTemplate provides customisation options (labels, annotations, affinity rules, resource requests, and so on) + for the Enterprise Search pods. + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of Enterprise Search. + type: string + type: object + status: + description: EnterpriseSearchStatus defines the observed state of EnterpriseSearch + properties: + associationStatus: + description: Association is the status of any auto-linking to Elasticsearch + clusters. + type: string + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + health: + description: Health of the deployment. + type: string + observedGeneration: + description: |- + ObservedGeneration represents the .metadata.generation that the status is based upon. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Enterprise Search + controller has not yet processed the changes contained in the Enterprise Search specification. + format: int64 + type: integer + selector: + description: Selector is the label selector used to find all pods. + type: string + service: + description: ExternalService is the name of the service associated + to the Enterprise Search Pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Enterprise Search version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: EnterpriseSearch is a Kubernetes CRD to represent Enterprise + Search. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: EnterpriseSearchSpec holds the specification of an Enterprise + Search resource. + properties: + config: + description: Config holds the Enterprise Search configuration. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Enterprise Search configuration. + Configuration settings are merged and have precedence over settings specified in `config`. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + description: Count of Enterprise Search instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to the Elasticsearch + cluster running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for Enterprise + Search resource. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Enterprise Search Docker image to deploy. + type: string + podTemplate: + description: |- + PodTemplate provides customisation options (labels, annotations, affinity rules, resource requests, and so on) + for the Enterprise Search pods. + type: object + x-kubernetes-preserve-unknown-fields: true + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of Enterprise Search. + type: string + type: object + status: + description: EnterpriseSearchStatus defines the observed state of EnterpriseSearch + properties: + associationStatus: + description: Association is the status of any auto-linking to Elasticsearch + clusters. + type: string + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + health: + description: Health of the deployment. + type: string + selector: + description: Selector is the label selector used to find all pods. + type: string + service: + description: ExternalService is the name of the service associated + to the Enterprise Search Pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: kibanas.kibana.k8s.elastic.co +spec: + group: kibana.k8s.elastic.co + names: + categories: + - elastic + kind: Kibana + listKind: KibanaList + plural: kibanas + shortNames: + - kb + singular: kibana + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Kibana version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1 + schema: + openAPIV3Schema: + description: Kibana represents a Kibana resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: KibanaSpec holds the specification of a Kibana instance. + properties: + config: + description: 'Config holds the Kibana configuration. See: https://www.elastic.co/guide/en/kibana/current/settings.html' + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: Count of Kibana instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + enterpriseSearchRef: + description: |- + EnterpriseSearchRef is a reference to an EnterpriseSearch running in the same Kubernetes cluster. + Kibana provides the default Enterprise Search UI starting version 7.14. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + http: + description: HTTP holds the HTTP layer configuration for Kibana. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Kibana Docker image to deploy. + type: string + monitoring: + description: |- + Monitoring enables you to collect and ship log and monitoring data of this Kibana. + See https://www.elastic.co/guide/en/kibana/current/xpack-monitoring.html. + Metricbeat and Filebeat are deployed in the same Pod as sidecars and each one sends data to one or two different + Elasticsearch monitoring clusters running in the same Kubernetes cluster. + properties: + logs: + description: Logs holds references to Elasticsearch clusters which + receive log data from an associated resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + metrics: + description: Metrics holds references to Elasticsearch clusters + which receive monitoring data from this resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + type: object + packageRegistryRef: + description: PackageRegistryRef is a reference to an Elastic Package + Registry running in the same Kubernetes cluster. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Kibana pods + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for Kibana. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + version: + description: Version of Kibana. + type: string + required: + - version + type: object + status: + description: KibanaStatus defines the observed state of Kibana + properties: + associationStatus: + description: |- + AssociationStatus is the status of any auto-linking to Elasticsearch clusters. + This field is deprecated and will be removed in a future release. Use ElasticsearchAssociationStatus instead. + type: string + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + elasticsearchAssociationStatus: + description: ElasticsearchAssociationStatus is the status of any auto-linking + to Elasticsearch clusters. + type: string + enterpriseSearchAssociationStatus: + description: EnterpriseSearchAssociationStatus is the status of any + auto-linking to Enterprise Search. + type: string + health: + description: Health of the deployment. + type: string + monitoringAssociationStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: MonitoringAssociationStatus is the status of any auto-linking + to monitoring Elasticsearch clusters. + type: object + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Kibana instance. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Kibana + controller has not yet processed the changes contained in the Kibana specification. + format: int64 + type: integer + packageRegistryAssociationStatus: + description: PackageRegistryAssociationStatus is the status of any + auto-linking to Elastic Package Registry. + type: string + selector: + description: Selector is the label selector used to find all pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: Kibana version + jsonPath: .spec.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: Kibana represents a Kibana resource in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: KibanaSpec holds the specification of a Kibana instance. + properties: + config: + description: 'Config holds the Kibana configuration. See: https://www.elastic.co/guide/en/kibana/current/settings.html' + type: object + x-kubernetes-preserve-unknown-fields: true + count: + description: Count of Kibana instances to deploy. + format: int32 + type: integer + elasticsearchRef: + description: ElasticsearchRef is a reference to an Elasticsearch cluster + running in the same Kubernetes cluster. + properties: + name: + description: Name of the Kubernetes object. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + required: + - name + type: object + http: + description: HTTP holds the HTTP layer configuration for Kibana. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certifcate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Kibana Docker image to deploy. + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Kibana pods + type: object + x-kubernetes-preserve-unknown-fields: true + secureSettings: + description: SecureSettings is a list of references to Kubernetes + secrets containing sensitive configuration options for Kibana. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + version: + description: Version of Kibana. + type: string + type: object + status: + description: KibanaStatus defines the observed state of Kibana + properties: + associationStatus: + description: AssociationStatus is the status of an association resource. + type: string + availableNodes: + format: int32 + type: integer + health: + description: KibanaHealth expresses the status of the Kibana instances. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - name: v1alpha1 + schema: + openAPIV3Schema: + description: to not break compatibility when upgrading from previous versions + of the CRD + type: object + served: false + storage: false +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: logstashes.logstash.k8s.elastic.co +spec: + group: logstash.k8s.elastic.co + names: + categories: + - elastic + kind: Logstash + listKind: LogstashList + plural: logstashes + shortNames: + - ls + singular: logstash + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Health + jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: available + type: integer + - description: Expected nodes + jsonPath: .status.expectedNodes + name: expected + type: integer + - jsonPath: .metadata.creationTimestamp + name: age + type: date + - description: Logstash version + jsonPath: .status.version + name: version + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: Logstash is the Schema for the logstashes API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: LogstashSpec defines the desired state of Logstash + properties: + config: + description: Config holds the Logstash configuration. At most one + of [`Config`, `ConfigRef`] can be specified. + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Logstash configuration. + Logstash settings must be specified as yaml, under a single "logstash.yml" entry. At most one of [`Config`, `ConfigRef`] + can be specified. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + format: int32 + type: integer + elasticsearchRefs: + description: ElasticsearchRefs are references to Elasticsearch clusters + running in the same Kubernetes cluster. + items: + description: ElasticsearchCluster is a named reference to an Elasticsearch + cluster which can be used in a Logstash pipeline. + properties: + clusterName: + description: |- + ClusterName is an alias for the cluster to be used to refer to the Elasticsearch cluster in Logstash + configuration files, and will be used to identify "named clusters" in Logstash + minLength: 1 + type: string + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If empty, defaults + to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + required: + - clusterName + type: object + type: array + image: + description: Image is the Logstash Docker image to deploy. Version + and Type have to match the Logstash in the image. + type: string + monitoring: + description: |- + Monitoring enables you to collect and ship log and monitoring data of this Logstash. + Metricbeat and Filebeat are deployed in the same Pod as sidecars and each one sends data to one or two different + Elasticsearch monitoring clusters running in the same Kubernetes cluster. + properties: + logs: + description: Logs holds references to Elasticsearch clusters which + receive log data from an associated resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + metrics: + description: Metrics holds references to Elasticsearch clusters + which receive monitoring data from this resource. + properties: + elasticsearchRefs: + description: |- + ElasticsearchRefs is a reference to a list of monitoring Elasticsearch clusters running in the same Kubernetes cluster. + Due to existing limitations, only a single Elasticsearch cluster is currently supported. + items: + description: |- + ObjectSelector defines a reference to a Kubernetes object which can be an Elastic resource managed by the operator + or a Secret describing an external Elastic resource not managed by the operator. + properties: + name: + description: Name of an existing Kubernetes object corresponding + to an Elastic resource managed by ECK. + type: string + namespace: + description: Namespace of the Kubernetes object. If + empty, defaults to the current namespace. + type: string + secretName: + description: |- + SecretName is the name of an existing Kubernetes secret that contains connection information for associating an + Elastic resource not managed by the operator. + The referenced secret must contain the following: + - `url`: the URL to reach the Elastic resource + - `username`: the username of the user to be authenticated to the Elastic resource + - `password`: the password of the user to be authenticated to the Elastic resource + - `ca.crt`: the CA certificate in PEM format (optional) + - `api-key`: the key to authenticate against the Elastic resource instead of a username and password (supported only for `elasticsearchRefs` in AgentSpec and in BeatSpec) + This field cannot be used in combination with the other fields name, namespace or serviceName. + type: string + serviceName: + description: |- + ServiceName is the name of an existing Kubernetes service which is used to make requests to the referenced + object. It has to be in the same namespace as the referenced resource. If left empty, the default HTTP service of + the referenced resource is used. + type: string + type: object + type: array + type: object + type: object + pipelines: + description: Pipelines holds the Logstash Pipelines. At most one of + [`Pipelines`, `PipelinesRef`] can be specified. + items: + type: object + type: array + x-kubernetes-preserve-unknown-fields: true + pipelinesRef: + description: |- + PipelinesRef contains a reference to an existing Kubernetes Secret holding the Logstash Pipelines. + Logstash pipelines must be specified as yaml, under a single "pipelines.yml" entry. At most one of [`Pipelines`, `PipelinesRef`] + can be specified. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + podTemplate: + description: PodTemplate provides customisation options for the Logstash + pods. + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying StatefulSet. + format: int32 + type: integer + secureSettings: + description: |- + SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for the Logstash. + Secrets data can be then referenced in the Logstash config using the Secret's keys or as specified in `Entries` field of + each SecureSetting. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + serviceAccountName: + description: |- + ServiceAccountName is used to check access from the current resource to Elasticsearch resource in a different namespace. + Can only be used if ECK is enforcing RBAC on references. + type: string + services: + description: |- + Services contains details of services that Logstash should expose - similar to the HTTP layer configuration for the + rest of the stack, but also applicable for more use cases than the metrics API, as logstash may need to + be opened up for other services: Beats, TCP, UDP, etc, inputs. + items: + properties: + name: + type: string + service: + description: Service defines the template for the associated + Kubernetes Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + type: array + updateStrategy: + description: UpdateStrategy is a StatefulSetUpdateStrategy. The default + type is "RollingUpdate". + properties: + rollingUpdate: + description: RollingUpdate is used to communicate parameters when + Type is RollingUpdateStatefulSetStrategyType. + properties: + maxUnavailable: + anyOf: + - type: integer + - type: string + description: |- + The maximum number of pods that can be unavailable during the update. + Value can be an absolute number (ex: 5) or a percentage of desired pods (ex: 10%). + Absolute number is calculated from percentage by rounding up. This can not be 0. + Defaults to 1. This field is beta-level and is enabled by default. The field applies to all pods in the range 0 to + Replicas-1. That means if there is any unavailable pod in the range 0 to Replicas-1, it + will be counted towards MaxUnavailable. + This setting might not be effective for the OrderedReady podManagementPolicy. That policy ensures pods are created and become ready one at a time. + x-kubernetes-int-or-string: true + partition: + description: |- + Partition indicates the ordinal at which the StatefulSet should be partitioned + for updates. During a rolling update, all pods from ordinal Replicas-1 to + Partition are updated. All pods from ordinal Partition-1 to 0 remain untouched. + This is helpful in being able to do a canary based deployment. The default value is 0. + format: int32 + type: integer + type: object + type: + description: |- + Type indicates the type of the StatefulSetUpdateStrategy. + Default is RollingUpdate. + type: string + type: object + version: + description: Version of the Logstash. + type: string + volumeClaimTemplates: + description: |- + VolumeClaimTemplates is a list of persistent volume claims to be used by each Pod. + Every claim in this list must have a matching volumeMount in one of the containers defined in the PodTemplate. + Items defined here take precedence over any default claims added by the operator with the same name. + items: + description: PersistentVolumeClaim is a user's request for and claim + to a persistent volume + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + description: |- + Standard object's metadata. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: |- + spec defines the desired characteristics of a volume requested by a pod author. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource being referenced + type: string + name: + description: Name is the name of resource being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + Users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over volumes to consider + for binding. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string or nil value indicates that no + VolumeAttributesClass will be applied to the claim. If the claim enters an Infeasible error state, + this field can be reset to its previous value (including nil) to cancel the modification. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/volume-attributes-classes/ + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference to the + PersistentVolume backing this claim. + type: string + type: object + status: + description: |- + status represents the current information/status of a persistent volume claim. + Read-only. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + accessModes: + description: |- + accessModes contains the actual access modes the volume backing the PVC has. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + x-kubernetes-list-type: atomic + allocatedResourceStatuses: + additionalProperties: + description: |- + When a controller receives persistentvolume claim update with ClaimResourceStatus for a resource + that it does not recognizes, then it should ignore that update and let other controllers + handle it. + type: string + description: "allocatedResourceStatuses stores status of + resource being resized for the given PVC.\nKey names follow + standard Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nClaimResourceStatus + can be in any of following states:\n\t- ControllerResizeInProgress:\n\t\tState + set when resize controller starts resizing the volume + in control-plane.\n\t- ControllerResizeFailed:\n\t\tState + set when resize has failed in resize controller with a + terminal error.\n\t- NodeResizePending:\n\t\tState set + when resize controller has finished resizing the volume + but further resizing of\n\t\tvolume is needed on the node.\n\t- + NodeResizeInProgress:\n\t\tState set when kubelet starts + resizing the volume.\n\t- NodeResizeFailed:\n\t\tState + set when resizing has failed in kubelet with a terminal + error. Transient errors don't set\n\t\tNodeResizeFailed.\nFor + example: if expanding a PVC for more capacity - this field + can be one of the following states:\n\t- pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"ControllerResizeFailed\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizePending\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeInProgress\"\n - pvc.status.allocatedResourceStatus['storage'] + = \"NodeResizeFailed\"\nWhen this field is not set, it + means that no resize operation is in progress for the + given PVC.\n\nA controller that receives PVC update with + previously unknown resourceName or ClaimResourceStatus\nshould + ignore the update for the purpose it was designed. For + example - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC." + type: object + x-kubernetes-map-type: granular + allocatedResources: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: "allocatedResources tracks the resources allocated + to a PVC including its capacity.\nKey names follow standard + Kubernetes label syntax. Valid values are either:\n\t* + Un-prefixed keys:\n\t\t- storage - the capacity of the + volume.\n\t* Custom resources must use implementation-defined + prefixed names such as \"example.com/my-custom-resource\"\nApart + from above values - keys that are unprefixed or have kubernetes.io + prefix are considered\nreserved and hence may not be used.\n\nCapacity + reported here may be larger than the actual capacity when + a volume expansion operation\nis requested.\nFor storage + quota, the larger value from allocatedResources and PVC.spec.resources + is used.\nIf allocatedResources is not set, PVC.spec.resources + alone is used for quota calculation.\nIf a volume expansion + capacity request is lowered, allocatedResources is only\nlowered + if there are no expansion operations in progress and if + the actual volume capacity\nis equal or lower than the + requested capacity.\n\nA controller that receives PVC + update with previously unknown resourceName\nshould ignore + the update for the purpose it was designed. For example + - a controller that\nonly is responsible for resizing + capacity of the volume, should ignore PVC updates that + change other valid\nresources associated with PVC." + type: object + capacity: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: capacity represents the actual resources of + the underlying volume. + type: object + conditions: + description: |- + conditions is the current Condition of persistent volume claim. If underlying persistent volume is being + resized then the Condition will be set to 'Resizing'. + items: + description: PersistentVolumeClaimCondition contains details + about state of pvc + properties: + lastProbeTime: + description: lastProbeTime is the time we probed the + condition. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime is the time the condition + transitioned from one status to another. + format: date-time + type: string + message: + description: message is the human-readable message + indicating details about last transition. + type: string + reason: + description: |- + reason is a unique, this should be a short, machine understandable string that gives the reason + for condition's last transition. If it reports "Resizing" that means the underlying + persistent volume is being resized. + type: string + status: + description: |- + Status is the status of the condition. + Can be True, False, Unknown. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=state%20of%20pvc-,conditions.status,-(string)%2C%20required + type: string + type: + description: |- + Type is the type of the condition. + More info: https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/persistent-volume-claim-v1/#:~:text=set%20to%20%27ResizeStarted%27.-,PersistentVolumeClaimCondition,-contains%20details%20about + type: string + required: + - status + - type + type: object + type: array + x-kubernetes-list-map-keys: + - type + x-kubernetes-list-type: map + currentVolumeAttributesClassName: + description: |- + currentVolumeAttributesClassName is the current name of the VolumeAttributesClass the PVC is using. + When unset, there is no VolumeAttributeClass applied to this PersistentVolumeClaim + type: string + modifyVolumeStatus: + description: |- + ModifyVolumeStatus represents the status object of ControllerModifyVolume operation. + When this is unset, there is no ModifyVolume operation being attempted. + properties: + status: + description: "status is the status of the ControllerModifyVolume + operation. It can be in any of following states:\n + - Pending\n Pending indicates that the PersistentVolumeClaim + cannot be modified due to unmet requirements, such + as\n the specified VolumeAttributesClass not existing.\n + - InProgress\n InProgress indicates that the volume + is being modified.\n - Infeasible\n Infeasible indicates + that the request has been rejected as invalid by the + CSI driver. To\n\t resolve the error, a valid VolumeAttributesClass + needs to be specified.\nNote: New statuses can be + added in the future. Consumers should check for unknown + statuses and fail appropriately." + type: string + targetVolumeAttributesClassName: + description: targetVolumeAttributesClassName is the + name of the VolumeAttributesClass the PVC currently + being reconciled + type: string + required: + - status + type: object + phase: + description: phase represents the current phase of PersistentVolumeClaim. + type: string + type: object + type: object + type: array + required: + - version + type: object + status: + description: LogstashStatus defines the observed state of Logstash + properties: + availableNodes: + format: int32 + type: integer + elasticsearchAssociationsStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: ElasticsearchAssociationStatus is the status of any auto-linking + to Elasticsearch clusters. + type: object + expectedNodes: + format: int32 + type: integer + health: + type: string + monitoringAssociationStatus: + additionalProperties: + description: AssociationStatus is the status of an association resource. + type: string + description: MonitoringAssociationStatus is the status of any auto-linking + to monitoring Elasticsearch clusters. + type: object + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Logstash instance. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Logstash + controller has not yet processed the changes contained in the Logstash specification. + format: int64 + type: integer + selector: + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + required: + - selector + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.expectedNodes + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: packageregistries.packageregistry.k8s.elastic.co +spec: + group: packageregistry.k8s.elastic.co + names: + categories: + - elastic + kind: PackageRegistry + listKind: PackageRegistryList + plural: packageregistries + shortNames: + - epr + singular: packageregistry + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.health + name: health + type: string + - description: Available nodes + jsonPath: .status.availableNodes + name: nodes + type: integer + - description: PackageRegistry version + jsonPath: .status.version + name: version + type: string + - jsonPath: .metadata.creationTimestamp + name: age + type: date + name: v1alpha1 + schema: + openAPIV3Schema: + description: PackageRegistry represents an Elastic Package Registry resource + in a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: PackageRegistrySpec holds the specification of an Elastic + Package Registry instance. + properties: + config: + description: 'Config holds the PackageRegistry configuration. See: + https://github.com/elastic/package-registry/blob/main/config.reference.yml' + type: object + x-kubernetes-preserve-unknown-fields: true + configRef: + description: |- + ConfigRef contains a reference to an existing Kubernetes Secret holding the Elastic Package Registry configuration. + Configuration settings are merged and have precedence over settings specified in `config`. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + count: + description: Count of Elastic Package Registry instances to deploy. + format: int32 + type: integer + http: + description: HTTP holds the HTTP layer configuration for Elastic Package + Registry. + properties: + service: + description: Service defines the template for the associated Kubernetes + Service object. + properties: + metadata: + description: |- + ObjectMeta is the metadata of the service. + The name and namespace provided here are managed by ECK and will be ignored. + properties: + annotations: + additionalProperties: + type: string + type: object + finalizers: + items: + type: string + type: array + labels: + additionalProperties: + type: string + type: object + name: + type: string + namespace: + type: string + type: object + spec: + description: Spec is the specification of the service. + properties: + allocateLoadBalancerNodePorts: + description: |- + allocateLoadBalancerNodePorts defines if NodePorts will be automatically + allocated for services with type LoadBalancer. Default is "true". It + may be set to "false" if the cluster load-balancer does not rely on + NodePorts. If the caller requests specific NodePorts (by specifying a + value), those requests will be respected, regardless of this field. + This field may only be set for services with type LoadBalancer and will + be cleared if the type is changed to any other type. + type: boolean + clusterIP: + description: |- + clusterIP is the IP address of the service and is usually assigned + randomly. If an address is specified manually, is in-range (as per + system configuration), and is not in use, it will be allocated to the + service; otherwise creation of the service will fail. This field may not + be changed through updates unless the type field is also being changed + to ExternalName (which requires this field to be blank) or the type + field is being changed from ExternalName (in which case this field may + optionally be specified, as describe above). Valid values are "None", + empty string (""), or a valid IP address. Setting this to "None" makes a + "headless service" (no virtual IP), which is useful when direct endpoint + connections are preferred and proxying is not required. Only applies to + types ClusterIP, NodePort, and LoadBalancer. If this field is specified + when creating a Service of type ExternalName, creation will fail. This + field will be wiped when updating a Service to type ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + clusterIPs: + description: |- + ClusterIPs is a list of IP addresses assigned to this service, and are + usually assigned randomly. If an address is specified manually, is + in-range (as per system configuration), and is not in use, it will be + allocated to the service; otherwise creation of the service will fail. + This field may not be changed through updates unless the type field is + also being changed to ExternalName (which requires this field to be + empty) or the type field is being changed from ExternalName (in which + case this field may optionally be specified, as describe above). Valid + values are "None", empty string (""), or a valid IP address. Setting + this to "None" makes a "headless service" (no virtual IP), which is + useful when direct endpoint connections are preferred and proxying is + not required. Only applies to types ClusterIP, NodePort, and + LoadBalancer. If this field is specified when creating a Service of type + ExternalName, creation will fail. This field will be wiped when updating + a Service to type ExternalName. If this field is not specified, it will + be initialized from the clusterIP field. If this field is specified, + clients must ensure that clusterIPs[0] and clusterIP have the same + value. + + This field may hold a maximum of two entries (dual-stack IPs, in either order). + These IPs must correspond to the values of the ipFamilies field. Both + clusterIPs and ipFamilies are governed by the ipFamilyPolicy field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalIPs: + description: |- + externalIPs is a list of IP addresses for which nodes in the cluster + will also accept traffic for this service. These IPs are not managed by + Kubernetes. The user is responsible for ensuring that traffic arrives + at a node with this IP. A common example is external load-balancers + that are not part of the Kubernetes system. + items: + type: string + type: array + x-kubernetes-list-type: atomic + externalName: + description: |- + externalName is the external reference that discovery mechanisms will + return as an alias for this service (e.g. a DNS CNAME record). No + proxying will be involved. Must be a lowercase RFC-1123 hostname + (https://tools.ietf.org/html/rfc1123) and requires `type` to be "ExternalName". + type: string + externalTrafficPolicy: + description: |- + externalTrafficPolicy describes how nodes distribute service traffic they + receive on one of the Service's "externally-facing" addresses (NodePorts, + ExternalIPs, and LoadBalancer IPs). If set to "Local", the proxy will configure + the service in a way that assumes that external load balancers will take care + of balancing the service traffic between nodes, and so each node will deliver + traffic only to the node-local endpoints of the service, without masquerading + the client source IP. (Traffic mistakenly sent to a node with no endpoints will + be dropped.) The default value, "Cluster", uses the standard behavior of + routing to all endpoints evenly (possibly modified by topology and other + features). Note that traffic sent to an External IP or LoadBalancer IP from + within the cluster will always get "Cluster" semantics, but clients sending to + a NodePort from within the cluster may need to take traffic policy into account + when picking a node. + type: string + healthCheckNodePort: + description: |- + healthCheckNodePort specifies the healthcheck nodePort for the service. + This only applies when type is set to LoadBalancer and + externalTrafficPolicy is set to Local. If a value is specified, is + in-range, and is not in use, it will be used. If not specified, a value + will be automatically allocated. External systems (e.g. load-balancers) + can use this port to determine if a given node holds endpoints for this + service or not. If this field is specified when creating a Service + which does not need it, creation will fail. This field will be wiped + when updating a Service to no longer need it (e.g. changing type). + This field cannot be updated once set. + format: int32 + type: integer + internalTrafficPolicy: + description: |- + InternalTrafficPolicy describes how nodes distribute service traffic they + receive on the ClusterIP. If set to "Local", the proxy will assume that pods + only want to talk to endpoints of the service on the same node as the pod, + dropping the traffic if there are no local endpoints. The default value, + "Cluster", uses the standard behavior of routing to all endpoints evenly + (possibly modified by topology and other features). + type: string + ipFamilies: + description: |- + IPFamilies is a list of IP families (e.g. IPv4, IPv6) assigned to this + service. This field is usually assigned automatically based on cluster + configuration and the ipFamilyPolicy field. If this field is specified + manually, the requested family is available in the cluster, + and ipFamilyPolicy allows it, it will be used; otherwise creation of + the service will fail. This field is conditionally mutable: it allows + for adding or removing a secondary IP family, but it does not allow + changing the primary IP family of the Service. Valid values are "IPv4" + and "IPv6". This field only applies to Services of types ClusterIP, + NodePort, and LoadBalancer, and does apply to "headless" services. + This field will be wiped when updating a Service to type ExternalName. + + This field may hold a maximum of two entries (dual-stack families, in + either order). These families must correspond to the values of the + clusterIPs field, if specified. Both clusterIPs and ipFamilies are + governed by the ipFamilyPolicy field. + items: + description: |- + IPFamily represents the IP Family (IPv4 or IPv6). This type is used + to express the family of an IP expressed by a type (e.g. service.spec.ipFamilies). + type: string + type: array + x-kubernetes-list-type: atomic + ipFamilyPolicy: + description: |- + IPFamilyPolicy represents the dual-stack-ness requested or required by + this Service. If there is no value provided, then this field will be set + to SingleStack. Services can be "SingleStack" (a single IP family), + "PreferDualStack" (two IP families on dual-stack configured clusters or + a single IP family on single-stack clusters), or "RequireDualStack" + (two IP families on dual-stack configured clusters, otherwise fail). The + ipFamilies and clusterIPs fields depend on the value of this field. This + field will be wiped when updating a service to type ExternalName. + type: string + loadBalancerClass: + description: |- + loadBalancerClass is the class of the load balancer implementation this Service belongs to. + If specified, the value of this field must be a label-style identifier, with an optional prefix, + e.g. "internal-vip" or "example.com/internal-vip". Unprefixed names are reserved for end-users. + This field can only be set when the Service type is 'LoadBalancer'. If not set, the default load + balancer implementation is used, today this is typically done through the cloud provider integration, + but should apply for any default implementation. If set, it is assumed that a load balancer + implementation is watching for Services with a matching class. Any default load balancer + implementation (e.g. cloud providers) should ignore Services that set this field. + This field can only be set when creating or updating a Service to type 'LoadBalancer'. + Once set, it can not be changed. This field will be wiped when a service is updated to a non 'LoadBalancer' type. + type: string + loadBalancerIP: + description: |- + Only applies to Service Type: LoadBalancer. + This feature depends on whether the underlying cloud-provider supports specifying + the loadBalancerIP when a load balancer is created. + This field will be ignored if the cloud-provider does not support the feature. + Deprecated: This field was under-specified and its meaning varies across implementations. + Using it is non-portable and it may not support dual-stack. + Users are encouraged to use implementation-specific annotations when available. + type: string + loadBalancerSourceRanges: + description: |- + If specified and supported by the platform, this will restrict traffic through the cloud-provider + load-balancer will be restricted to the specified client IPs. This field will be ignored if the + cloud-provider does not support the feature." + More info: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/ + items: + type: string + type: array + x-kubernetes-list-type: atomic + ports: + description: |- + The list of ports that are exposed by this service. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this + service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + x-kubernetes-list-map-keys: + - port + - protocol + x-kubernetes-list-type: map + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses indicates that any agent which deals with endpoints for this + Service should disregard any indications of ready/not-ready. + The primary use case for setting this field is for a StatefulSet's Headless Service to + propagate SRV DNS records for its Pods for the purpose of peer discovery. + The Kubernetes controllers that generate Endpoints and EndpointSlice resources for + Services interpret this to mean that all endpoints are considered "ready" even if the + Pods themselves are not. Agents which consume only Kubernetes generated endpoints + through the Endpoints or EndpointSlice resources can safely assume this behavior. + type: boolean + selector: + additionalProperties: + type: string + description: |- + Route service traffic to pods with label keys and values matching this + selector. If empty or not present, the service is assumed to have an + external process managing its endpoints, which Kubernetes will not + modify. Only applies to types ClusterIP, NodePort, and LoadBalancer. + Ignored if type is ExternalName. + More info: https://kubernetes.io/docs/concepts/services-networking/service/ + type: object + x-kubernetes-map-type: atomic + sessionAffinity: + description: |- + Supports "ClientIP" and "None". Used to maintain session affinity. + Enable client IP based session affinity. + Must be ClientIP or None. + Defaults to None. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + type: string + sessionAffinityConfig: + description: sessionAffinityConfig contains the configurations + of session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + trafficDistribution: + description: |- + TrafficDistribution offers a way to express preferences for how traffic + is distributed to Service endpoints. Implementations can use this field + as a hint, but are not required to guarantee strict adherence. If the + field is not set, the implementation will apply its default routing + strategy. If set to "PreferClose", implementations should prioritize + endpoints that are in the same zone. + type: string + type: + description: |- + type determines how the Service is exposed. Defaults to ClusterIP. Valid + options are ExternalName, ClusterIP, NodePort, and LoadBalancer. + "ClusterIP" allocates a cluster-internal IP address for load-balancing + to endpoints. Endpoints are determined by the selector or if that is not + specified, by manual construction of an Endpoints object or + EndpointSlice objects. If clusterIP is "None", no virtual IP is + allocated and the endpoints are published as a set of endpoints rather + than a virtual IP. + "NodePort" builds on ClusterIP and allocates a port on every node which + routes to the same endpoints as the clusterIP. + "LoadBalancer" builds on NodePort and creates an external load-balancer + (if supported in the current cloud) which routes to the same endpoints + as the clusterIP. + "ExternalName" aliases this service to the specified externalName. + Several other fields do not apply to ExternalName services. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#publishing-services-service-types + type: string + type: object + type: object + tls: + description: TLS defines options for configuring TLS for HTTP. + properties: + certificate: + description: |- + Certificate is a reference to a Kubernetes secret that contains the certificate and private key for enabling TLS. + The referenced secret should contain the following: + + - `ca.crt`: The certificate authority (optional). + - `tls.crt`: The certificate (or a chain). + - `tls.key`: The private key to the first certificate in the certificate chain. + properties: + secretName: + description: SecretName is the name of the secret. + type: string + type: object + selfSignedCertificate: + description: SelfSignedCertificate allows configuring the + self-signed certificate generated by the operator. + properties: + disabled: + description: Disabled indicates that the provisioning + of the self-signed certificate should be disabled. + type: boolean + subjectAltNames: + description: SubjectAlternativeNames is a list of SANs + to include in the generated HTTP TLS certificate. + items: + description: SubjectAlternativeName represents a SAN + entry in a x509 certificate. + properties: + dns: + description: DNS is the DNS name of the subject. + type: string + ip: + description: IP is the IP address of the subject. + type: string + type: object + type: array + type: object + type: object + type: object + image: + description: Image is the Elastic Package Registry Docker image to + deploy. + type: string + podTemplate: + description: PodTemplate provides customisation options (labels, annotations, + affinity rules, resource requests, and so on) for the Elastic Package + Registry pods + type: object + x-kubernetes-preserve-unknown-fields: true + revisionHistoryLimit: + description: RevisionHistoryLimit is the number of revisions to retain + to allow rollback in the underlying Deployment. + format: int32 + type: integer + version: + description: Version of Elastic Package Registry. + type: string + required: + - version + type: object + status: + description: PackageRegistryStatus defines the observed state of Elastic + Package Registry + properties: + availableNodes: + description: AvailableNodes is the number of available replicas in + the deployment. + format: int32 + type: integer + count: + description: Count corresponds to Scale.Status.Replicas, which is + the actual number of observed instances of the scaled object. + format: int32 + type: integer + health: + description: Health of the deployment. + type: string + observedGeneration: + description: |- + ObservedGeneration is the most recent generation observed for this Elastic Package Registry. + It corresponds to the metadata generation, which is updated on mutation by the API Server. + If the generation observed in status diverges from the generation in metadata, the Elastic Package Registry + controller has not yet processed the changes contained in the Elastic Package Registry specification. + format: int64 + type: integer + selector: + description: Selector is the label selector used to find all pods. + type: string + version: + description: |- + Version of the stack resource currently running. During version upgrades, multiple versions may run + in parallel: this value specifies the lowest version currently running. + type: string + type: object + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.count + statusReplicasPath: .status.count + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.20.0 + helm.sh/resource-policy: keep + labels: + app.kubernetes.io/instance: '{{ .Release.Name }}' + app.kubernetes.io/managed-by: '{{ .Release.Service }}' + app.kubernetes.io/name: '{{ include "eck-operator-crds.name" . }}' + app.kubernetes.io/version: '{{ .Chart.AppVersion }}' + helm.sh/chart: '{{ include "eck-operator-crds.chart" . }}' + name: stackconfigpolicies.stackconfigpolicy.k8s.elastic.co +spec: + group: stackconfigpolicy.k8s.elastic.co + names: + categories: + - elastic + kind: StackConfigPolicy + listKind: StackConfigPolicyList + plural: stackconfigpolicies + shortNames: + - scp + singular: stackconfigpolicy + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Resources configured + jsonPath: .status.readyCount + name: Ready + type: string + - jsonPath: .status.phase + name: Phase + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .spec.weight + name: Weight + type: integer + name: v1alpha1 + schema: + openAPIV3Schema: + description: StackConfigPolicy represents a StackConfigPolicy resource in + a Kubernetes cluster. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + elasticsearch: + properties: + clusterSettings: + description: ClusterSettings holds the Elasticsearch cluster settings + (/_cluster/settings) + type: object + x-kubernetes-preserve-unknown-fields: true + config: + description: Config holds the settings that go into elasticsearch.yml. + type: object + x-kubernetes-preserve-unknown-fields: true + indexLifecyclePolicies: + description: IndexLifecyclePolicies holds the Index Lifecycle + policies settings (/_ilm/policy) + type: object + x-kubernetes-preserve-unknown-fields: true + indexTemplates: + description: IndexTemplates holds the Index and Component Templates + settings + properties: + componentTemplates: + description: ComponentTemplates holds the Component Templates + settings (/_component_template) + type: object + x-kubernetes-preserve-unknown-fields: true + composableIndexTemplates: + description: ComposableIndexTemplates holds the Index Templates + settings (/_index_template) + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + x-kubernetes-preserve-unknown-fields: true + ingestPipelines: + description: IngestPipelines holds the Ingest Pipelines settings + (/_ingest/pipeline) + type: object + x-kubernetes-preserve-unknown-fields: true + secretMounts: + description: SecretMounts are additional Secrets that need to + be mounted into the Elasticsearch pods. + items: + description: SecretMount contains information about additional + secrets to be mounted to the elasticsearch pods + properties: + mountPath: + description: MountPath denotes the path to which the secret + should be mounted to inside the elasticsearch pod + type: string + secretName: + description: SecretName denotes the name of the secret that + needs to be mounted to the elasticsearch pod + type: string + type: object + type: array + x-kubernetes-preserve-unknown-fields: true + secureSettings: + description: SecureSettings are additional Secrets that contain + data to be configured to Elasticsearch's keystore. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + x-kubernetes-preserve-unknown-fields: true + securityRoleMappings: + description: SecurityRoleMappings holds the Role Mappings settings + (/_security/role_mapping) + type: object + x-kubernetes-preserve-unknown-fields: true + snapshotLifecyclePolicies: + description: SnapshotLifecyclePolicies holds the Snapshot Lifecycle + Policies settings (/_slm/policy) + type: object + x-kubernetes-preserve-unknown-fields: true + snapshotRepositories: + description: SnapshotRepositories holds the Snapshot Repositories + settings (/_snapshot) + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + kibana: + properties: + config: + description: Config holds the settings that go into kibana.yml. + type: object + x-kubernetes-preserve-unknown-fields: true + secureSettings: + description: SecureSettings are additional Secrets that contain + data to be configured to Kibana's keystore. + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + x-kubernetes-preserve-unknown-fields: true + type: object + resourceSelector: + description: |- + A label selector is a label query over a set of resources. The result of matchLabels and + matchExpressions are ANDed. An empty label selector matches all objects. A null + label selector matches no objects. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + secureSettings: + description: 'Deprecated: SecureSettings only applies to Elasticsearch + and is deprecated. It must be set per application instead.' + items: + description: SecretSource defines a data source based on a Kubernetes + Secret. + properties: + entries: + description: |- + Entries define how to project each key-value pair in the secret to filesystem paths. + If not defined, all keys will be projected to similarly named paths in the filesystem. + If defined, only the specified keys will be projected to the corresponding paths. + items: + description: KeyToPath defines how to map a key in a Secret + object to a filesystem path. + properties: + key: + description: Key is the key contained in the secret. + type: string + path: + description: |- + Path is the relative file path to map the key to. + Path must not be an absolute file path and must not contain any ".." components. + type: string + required: + - key + type: object + type: array + secretName: + description: SecretName is the name of the secret. + type: string + required: + - secretName + type: object + type: array + weight: + default: 0 + description: |- + Weight determines the priority of this policy when multiple policies target the same resource. + Higher weight values take precedence. Defaults to 0. + format: int32 + type: integer + type: object + status: + properties: + details: + additionalProperties: + additionalProperties: + description: ResourcePolicyStatus models the status of the policy + for one resource to be configured. + properties: + currentVersion: + description: |- + CurrentVersion denotes the current version of filesettings applied to the Elasticsearch cluster + This field does not apply to Kibana resources + format: int64 + type: integer + error: + properties: + message: + type: string + version: + format: int64 + type: integer + type: object + expectedVersion: + description: |- + ExpectedVersion denotes the expected version of filesettings that should be applied to the Elasticsearch cluster + This field does not apply to Kibana resources + format: int64 + type: integer + phase: + type: string + type: object + type: object + description: Details holds the status details for each resource to + be configured. + type: object + errors: + description: Errors is the number of resources which have an incorrect + configuration + type: integer + observedGeneration: + description: ObservedGeneration is the most recent generation observed + for this StackConfigPolicy. + format: int64 + type: integer + phase: + description: Phase is the phase of the StackConfigPolicy. + type: string + ready: + description: Ready is the number of resources successfully configured. + type: integer + readyCount: + description: ReadyCount is a human representation of the number of + resources successfully configured. + type: string + resources: + description: Resources is the number of resources to be configured. + type: integer + resourcesStatuses: + additionalProperties: + description: ResourcePolicyStatus models the status of the policy + for one resource to be configured. + properties: + currentVersion: + description: |- + CurrentVersion denotes the current version of filesettings applied to the Elasticsearch cluster + This field does not apply to Kibana resources + format: int64 + type: integer + error: + properties: + message: + type: string + version: + format: int64 + type: integer + type: object + expectedVersion: + description: |- + ExpectedVersion denotes the expected version of filesettings that should be applied to the Elasticsearch cluster + This field does not apply to Kibana resources + format: int64 + type: integer + phase: + type: string + type: object + description: |- + ResourcesStatuses holds the status for each resource to be configured. + + Deprecated: Details is used to store the status of resources from ECK 2.11 + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/values.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/values.yaml new file mode 100644 index 00000000..f3fd8bd5 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/charts/eck-operator-crds/values.yaml @@ -0,0 +1,7 @@ +# Globals meant for internal use only +global: + # manifestGen specifies whether the chart is running under manifest generator. + # This is used for tasks specific to generating the all-in-one.yaml file. + manifestGen: false + # kubeVersion is the effective Kubernetes version we target when generating the all-in-one.yaml. + kubeVersion: 1.21.0 diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-disable-automounting-api.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-disable-automounting-api.yaml new file mode 100644 index 00000000..50f97157 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-disable-automounting-api.yaml @@ -0,0 +1,29 @@ +automountServiceAccountToken: false + +serviceAccount: + automountServiceAccountToken: false + +volumeMounts: +- mountPath: /var/run/secrets/kubernetes.io/serviceaccount + name: serviceaccount-token + readOnly: true + +volumes: +- name: serviceaccount-token + projected: + defaultMode: 0444 + sources: + - serviceAccountToken: + expirationSeconds: 3607 + path: token + - configMap: + name: kube-root-ca.crt + items: + - key: ca.crt + path: ca.crt + - downwardAPI: + items: + - path: namespace + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-global.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-global.yaml new file mode 100644 index 00000000..286f8c9e --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-global.yaml @@ -0,0 +1,6 @@ +managedNamespaces: [] + +createClusterScopedResources: true + +webhook: + enabled: true diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-istio.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-istio.yaml new file mode 100644 index 00000000..c968ba02 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-istio.yaml @@ -0,0 +1,11 @@ +managedNamespaces: [] + +createClusterScopedResources: true + +webhook: + enabled: true + +podAnnotations: + sidecar.istio.io/inject: "true" + traffic.sidecar.istio.io/includeInboundPorts: "*" + traffic.sidecar.istio.io/excludeInboundPorts: "9443" diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-restricted.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-restricted.yaml new file mode 100644 index 00000000..640d00f3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-restricted.yaml @@ -0,0 +1,12 @@ +managedNamespaces: ["elastic-system"] + +createClusterScopedResources: false + +config: + # no RBAC access to cluster-wide storage classes, hence disable storage class validation + validateStorageClass: false + +installCRDs: false + +webhook: + enabled: false diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/profile-soft-multi-tenancy.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-soft-multi-tenancy.yaml new file mode 100644 index 00000000..8ac79514 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/profile-soft-multi-tenancy.yaml @@ -0,0 +1,18 @@ +managedNamespaces: ["team-a", "team-b"] + +createClusterScopedResources: true + +refs: + enforceRBAC: true + +webhook: + enabled: true + namespaceSelector: + matchExpressions: + - key: "eck.k8s.elastic.co/tenant" + operator: In + values: ["team-a", "team-b"] + + +softMultiTenancy: + enabled: true diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/NOTES.txt b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/NOTES.txt new file mode 100644 index 00000000..e25ea9ea --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/NOTES.txt @@ -0,0 +1,2 @@ +1. Inspect the operator logs by running the following command: + kubectl logs -n {{ .Release.Namespace }} sts/{{ .Release.Name }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/_helpers.tpl b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/_helpers.tpl new file mode 100644 index 00000000..893cb31f --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/_helpers.tpl @@ -0,0 +1,418 @@ +{{/* +Expand the name of the chart. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "eck-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "eck-operator.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "eck-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "eck-operator.labels" -}} +{{- include "eck-operator.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +helm.sh/chart: {{ include "eck-operator.chart" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "eck-operator.selectorLabels" -}} +{{- if .Values.global.manifestGen -}} +control-plane: elastic-operator +{{- else -}} +app.kubernetes.io/name: {{ include "eck-operator.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "eck-operator.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "eck-operator.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Determine effective Kubernetes version +*/}} +{{- define "eck-operator.effectiveKubeVersion" -}} +{{- if .Values.global.manifestGen -}} +{{- semver .Values.global.kubeVersion -}} +{{- else -}} +{{- .Capabilities.KubeVersion.Version -}} +{{- end -}} +{{- end -}} + +{{/* +Determine the name for the webhook +*/}} +{{- define "eck-operator.webhookName" -}} +{{- if .Values.global.manifestGen -}} +elastic-webhook.k8s.elastic.co +{{- else -}} +{{- $name := include "eck-operator.name" . -}} +{{ printf "%s.%s.k8s.elastic.co" $name .Release.Namespace }} +{{- end -}} +{{- end -}} + +{{/* +Determine the name for the webhook secret +*/}} +{{- define "eck-operator.webhookSecretName" -}} +{{- if .Values.global.manifestGen -}} +elastic-webhook-server-cert +{{- else if .Values.webhook.certsSecret -}} +{{- .Values.webhook.certsSecret }} +{{- else -}} +{{- $name := include "eck-operator.name" . -}} +{{ printf "%s-webhook-cert" $name | trunc 63 }} +{{- end -}} +{{- end -}} + +{{/* +Determine the name for the webhook service +*/}} +{{- define "eck-operator.webhookServiceName" -}} +{{- if .Values.global.manifestGen -}} +elastic-webhook-server +{{- else -}} +{{- $name := include "eck-operator.name" . -}} +{{ printf "%s-webhook" $name | trunc 63 }} +{{- end -}} +{{- end -}} + +{{/* +Determine the metrics port +*/}} +{{- define "eck-operator.metrics.port" -}} +{{- if .Values.config.metrics.port -}} +{{- .Values.config.metrics.port -}} +{{- else if .Values.config.metricsPort -}} +{{- .Values.config.metricsPort -}} +{{- else -}} +0 +{{- end -}} +{{- end -}} + + + +{{/* +RBAC permissions +NOTE - any changes made to RBAC permissions below require +updating docs/operating-eck/eck-permissions.asciidoc file. +*/}} +{{- define "eck-operator.rbacRules" -}} +- apiGroups: + - "authorization.k8s.io" + resources: + - subjectaccessreviews + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create +- apiGroups: + - coordination.k8s.io + resources: + - leases + resourceNames: + - elastic-operator-leader + verbs: + - get + - watch + - update +- apiGroups: + - "" + resources: + - endpoints + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - pods + - events + - persistentvolumeclaims + - secrets + - services + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - apps + resources: + - deployments + - statefulsets + - daemonsets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - elasticsearch.k8s.elastic.co + resources: + - elasticsearches + - elasticsearches/status + - elasticsearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - autoscaling.k8s.elastic.co + resources: + - elasticsearchautoscalers + - elasticsearchautoscalers/status + - elasticsearchautoscalers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - kibana.k8s.elastic.co + resources: + - kibanas + - kibanas/status + - kibanas/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - apm.k8s.elastic.co + resources: + - apmservers + - apmservers/status + - apmservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - enterprisesearch.k8s.elastic.co + resources: + - enterprisesearches + - enterprisesearches/status + - enterprisesearches/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - beat.k8s.elastic.co + resources: + - beats + - beats/status + - beats/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - agent.k8s.elastic.co + resources: + - agents + - agents/status + - agents/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - maps.k8s.elastic.co + resources: + - elasticmapsservers + - elasticmapsservers/status + - elasticmapsservers/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - stackconfigpolicy.k8s.elastic.co + resources: + - stackconfigpolicies + - stackconfigpolicies/status + - stackconfigpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - logstash.k8s.elastic.co + resources: + - logstashes + - logstashes/status + - logstashes/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - autoops.k8s.elastic.co + resources: + - autoopsagentpolicies + - autoopsagentpolicies/status + - autoopsagentpolicies/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch +- apiGroups: + - packageregistry.k8s.elastic.co + resources: + - packageregistries + - packageregistries/status + - packageregistries/finalizers # needed for ownerReferences with blockOwnerDeletion on OCP + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - deletecollection +{{- end -}} + +{{/* +RBAC permissions on non-namespaced resources +*/}} +{{- define "eck-operator.clusterWideRbacRules" -}} +- apiGroups: [""] + resources: + - namespaces + verbs: + - get + - list + - watch +- apiGroups: + - storage.k8s.io + resources: + - storageclasses + verbs: + - get + - list + - watch +- apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +{{- end -}} + +{{/* +RBAC permissions to read node labels +*/}} +{{- define "eck-operator.readNodeLabelsRbacRule" -}} +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/cluster-roles.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/cluster-roles.yaml new file mode 100644 index 00000000..1dccae8c --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/cluster-roles.yaml @@ -0,0 +1,133 @@ +{{- if and (not .Values.createClusterScopedResources) (.Values.config.metrics.secureMode.enabled) -}} +{{ fail "createClusterScopedResources is required to set config.metrics.secureMode.enabled to true" }} +{{- end }} +{{- if .Values.createClusterScopedResources -}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ include "eck-operator.fullname" . }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +rules: +{{ template "eck-operator.rbacRules" . | toYaml | indent 2 }} +{{ template "eck-operator.clusterWideRbacRules" . | toYaml | indent 2 }} +{{ if .Values.config.exposedNodeLabels }} +{{ template "eck-operator.readNodeLabelsRbacRule" . | toYaml | indent 2 }} +{{ end -}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: "{{ include "eck-operator.name" . }}-view" + labels: + rbac.authorization.k8s.io/aggregate-to-view: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" + {{- include "eck-operator.labels" . | nindent 4 }} +rules: + - apiGroups: ["elasticsearch.k8s.elastic.co"] + resources: ["elasticsearches"] + verbs: ["get", "list", "watch"] + - apiGroups: ["autoscaling.k8s.elastic.co"] + resources: ["elasticsearchautoscalers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["apm.k8s.elastic.co"] + resources: ["apmservers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["kibana.k8s.elastic.co"] + resources: ["kibanas"] + verbs: ["get", "list", "watch"] + - apiGroups: ["enterprisesearch.k8s.elastic.co"] + resources: ["enterprisesearches"] + verbs: ["get", "list", "watch"] + - apiGroups: ["beat.k8s.elastic.co"] + resources: ["beats"] + verbs: ["get", "list", "watch"] + - apiGroups: ["agent.k8s.elastic.co"] + resources: ["agents"] + verbs: ["get", "list", "watch"] + - apiGroups: ["maps.k8s.elastic.co"] + resources: ["elasticmapsservers"] + verbs: ["get", "list", "watch"] + - apiGroups: ["stackconfigpolicy.k8s.elastic.co"] + resources: ["stackconfigpolicies"] + verbs: ["get", "list", "watch"] + - apiGroups: ["logstash.k8s.elastic.co"] + resources: ["logstashes"] + verbs: ["get", "list", "watch"] + - apiGroups: ["autoops.k8s.elastic.co"] + resources: ["autoopsagentpolicies"] + verbs: ["get", "list", "watch"] + - apiGroups: ["packageregistry.k8s.elastic.co"] + resources: ["packageregistries"] + verbs: ["get", "list", "watch"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: "{{ include "eck-operator.name" . }}-edit" + labels: + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-admin: "true" + {{- include "eck-operator.labels" . | nindent 4 }} +rules: + - apiGroups: ["elasticsearch.k8s.elastic.co"] + resources: ["elasticsearches"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["autoscaling.k8s.elastic.co"] + resources: ["elasticsearchautoscalers"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["apm.k8s.elastic.co"] + resources: ["apmservers"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["kibana.k8s.elastic.co"] + resources: ["kibanas"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["enterprisesearch.k8s.elastic.co"] + resources: ["enterprisesearches"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["beat.k8s.elastic.co"] + resources: ["beats"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["agent.k8s.elastic.co"] + resources: ["agents"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["maps.k8s.elastic.co"] + resources: ["elasticmapsservers"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["stackconfigpolicy.k8s.elastic.co"] + resources: ["stackconfigpolicies"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["logstash.k8s.elastic.co"] + resources: ["logstashes"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["autoops.k8s.elastic.co"] + resources: ["autoopsagentpolicies"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] + - apiGroups: ["packageregistry.k8s.elastic.co"] + resources: ["packageregistries"] + verbs: ["create", "delete", "deletecollection", "patch", "update"] +{{- if .Values.config.metrics.secureMode.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + {{- include "eck-operator.labels" . | nindent 4 }} + name: "{{ include "eck-operator.fullname" . }}-metrics-auth-role" +rules: +- apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create +- apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create +{{- end }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/configmap.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/configmap.yaml new file mode 100644 index 00000000..7582f8e6 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/configmap.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +data: + eck.yaml: |- + {{- $metricsPort := int (include "eck-operator.metrics.port" .)}} + log-verbosity: {{ int .Values.config.logVerbosity }} + {{- if and .Values.config.metrics.secureMode.enabled (eq $metricsPort 0) }} + {{- fail "config.metrics.port must be greater than 0 when config.metrics.secureMode.enabled is true" }} + {{- end }} + metrics-port: {{ $metricsPort }} + metrics-secure: {{ .Values.config.metrics.secureMode.enabled }} + container-registry: {{ .Values.config.containerRegistry }} + {{- with .Values.config.containerSuffix }} + container-suffix: {{ . }} + {{- end }} + {{- with .Values.config.containerRepository }} + container-repository: {{ . }} + {{- end }} + max-concurrent-reconciles: {{ int .Values.config.maxConcurrentReconciles }} + {{- with .Values.config.passwordHashCacheSize }} + password-hash-cache-size: {{ int . }} + {{- end }} + ca-cert-validity: {{ .Values.config.caValidity }} + ca-cert-rotate-before: {{ .Values.config.caRotateBefore }} + {{- with .Values.config.caDir }} + ca-dir: {{ . }} + {{- end }} + cert-validity: {{ .Values.config.certificatesValidity }} + cert-rotate-before: {{ .Values.config.certificatesRotateBefore }} + disable-config-watch: {{ .Values.config.disableConfigWatch }} + {{- with .Values.config.exposedNodeLabels }} + exposed-node-labels: [{{ join "," . }}] + {{- end }} + {{- with .Values.config.ipFamily }} + ip-family: {{ . }} + {{- end }} + set-default-security-context: {{ .Values.config.setDefaultSecurityContext }} + kube-client-timeout: {{ .Values.config.kubeClientTimeout }} + {{- with .Values.config.kubeClientQPS }} + kube-client-qps: {{ int . }} + {{- end }} + elasticsearch-client-timeout: {{ .Values.config.elasticsearchClientTimeout }} + disable-telemetry: {{ .Values.telemetry.disabled }} + distribution-channel: {{ .Values.telemetry.distributionChannel }} + {{- with .Values.telemetry.interval }} + telemetry-interval: {{ . }} + {{- end }} + validate-storage-class: {{ .Values.config.validateStorageClass }} + {{- if .Values.tracing.enabled }} + enable-tracing: true + {{- end }} + {{- if .Values.refs.enforceRBAC }} + enforce-rbac-on-refs: true + {{- end }} + enable-webhook: {{ .Values.webhook.enabled }} + {{- if .Values.webhook.enabled }} + webhook-name: {{ include "eck-operator.webhookName" . }} + {{- if not .Values.webhook.manageCerts }} + manage-webhook-certs: false + webhook-cert-dir: {{ .Values.webhook.certsDir }} + {{- end }} + webhook-port: {{ .Values.webhook.port }} + {{- end }} + {{- with .Values.managedNamespaces }} + namespaces: [{{ join "," . }}] + {{- end }} + operator-namespace: {{ .Release.Namespace }} + enable-leader-election: {{ .Values.config.enableLeaderElection }} + elasticsearch-observation-interval: {{ .Values.config.elasticsearchObservationInterval }} + {{- if not .Values.config.containerSuffix }} + ubi-only: {{ .Values.config.ubiOnly }} + {{- end }} + {{- with .Values.webhook.certsSecret }} + webhook-secret: {{ . }} + {{- end }} + {{- $passwordLength := int (dig "policies" "passwords" "length" 0 .Values.config) }} + {{- with $passwordLength }} + {{- if or (lt $passwordLength 6) (gt $passwordLength 72) }} + {{- fail "config.policies.passwords.length must be >= 6 and <= 72" }} + {{- end }} + password-length: {{ $passwordLength }} + {{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-namespaces.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-namespaces.yaml new file mode 100644 index 00000000..91deaf21 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-namespaces.yaml @@ -0,0 +1,13 @@ +{{- if .Values.softMultiTenancy.enabled -}} +{{- range .Values.managedNamespaces }} +{{- $namespace := . }} +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} + eck.k8s.elastic.co/tenant: {{ $namespace }} +{{- end -}} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-ns-network-policy.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-ns-network-policy.yaml new file mode 100644 index 00000000..23fc1e3a --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/managed-ns-network-policy.yaml @@ -0,0 +1,228 @@ +{{- if .Values.softMultiTenancy.enabled -}} +{{- $fullName := include "eck-operator.fullname" . -}} +{{- $name := include "eck-operator.name" . -}} +{{- range .Values.managedNamespaces -}} +{{- $namespace := . }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-elasticsearch" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + egress: + # Transport port + - ports: + - port: 9300 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + ingress: + # HTTP Port + - ports: + - port: 9200 + from: + # Operator + - namespaceSelector: + matchLabels: + name: "{{ $.Release.Namespace }}" + podSelector: + matchLabels: + {{- include "eck-operator.selectorLabels" $ | nindent 14 }} + # Within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + # Transport port + - ports: + - port: 9300 + from: + # Within namespace (from other Elasticsearch nodes) + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-kibana" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "kibana" + egress: + # Elasticsearch HTTP port + - ports: + - port: 9200 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + ingress: + # HTTP Port + - ports: + - port: 5601 + from: + # Within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-apm-server" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "apm-server" + egress: + # Elasticsearch HTTP port + - ports: + - port: 9200 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # Kibana HTTP port + - ports: + - port: 5601 + to: + # Kibana within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "kibana" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + ingress: + # HTTP Port + - ports: + - port: 8200 + from: + # Within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-enterprise-search" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "enterprise-search" + egress: + # Elasticsearch HTTP port + - ports: + - port: 9200 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + ingress: + # HTTP Port + - ports: + - port: 3002 + from: + # Within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: "{{ $name }}-beats" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +spec: + podSelector: + matchLabels: + common.k8s.elastic.co/type: "beat" + egress: + # Elasticsearch HTTP port + - ports: + - port: 9200 + to: + # Elasticsearch within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" + # Kibana HTTP port + - ports: + - port: 5601 + to: + # Kibana within namespace + - namespaceSelector: + matchLabels: + eck.k8s.elastic.co/tenant: {{ $namespace }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "kibana" + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] +{{- end }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/metrics-service.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/metrics-service.yaml new file mode 100644 index 00000000..53bdc02b --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/metrics-service.yaml @@ -0,0 +1,22 @@ +{{- if .Values.config.metrics.secureMode.enabled }} +{{- $metricsPort := int (include "eck-operator.metrics.port" .)}} +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/name: {{ include "eck-operator.name" . }}-metrics-service + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} + helm.sh/chart: {{ include "eck-operator.chart" . }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + name: "{{ include "eck-operator.fullname" . }}-metrics" + namespace: {{ .Release.Namespace }} +spec: + ports: + - name: https + port: {{ $metricsPort }} + protocol: TCP + targetPort: metrics + selector: + {{- include "eck-operator.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-namespace.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-namespace.yaml new file mode 100644 index 00000000..07123b70 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-namespace.yaml @@ -0,0 +1,9 @@ +{{- if (and .Values.global.manifestGen .Values.global.createOperatorNamespace) -}} +--- +apiVersion: v1 +kind: Namespace +metadata: + name: {{ .Release.Namespace }} + labels: + name: {{ .Release.Namespace }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-network-policy.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-network-policy.yaml new file mode 100644 index 00000000..ad74156d --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/operator-network-policy.yaml @@ -0,0 +1,59 @@ +{{- if .Values.softMultiTenancy.enabled -}} +{{- $kubeAPIServerIP := (required "kubeAPIServerIP is required" .Values.kubeAPIServerIP) -}} +{{- $metricsPort := int (include "eck-operator.metrics.port" .)}} +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ .Release.Namespace}} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +spec: + podSelector: + matchLabels: + {{- include "eck-operator.selectorLabels" . | nindent 6 }} + egress: + # DNS + - ports: + - port: 53 + protocol: UDP + to: [] + # API server + - ports: + - port: 443 + to: + - ipBlock: + cidr: "{{ $kubeAPIServerIP }}/32" + # Elasticsearch + - ports: + - port: 9200 + to: + - namespaceSelector: + matchExpressions: + - key: "eck.k8s.elastic.co/tenant" + operator: In + values: + {{- range .Values.managedNamespaces }} + - {{ . }} + {{- end }} + podSelector: + matchLabels: + common.k8s.elastic.co/type: "elasticsearch" +{{- if or .Values.webhook.enabled (gt $metricsPort 0) }} + ingress: +{{- if .Values.webhook.enabled }} + - ports: + - port: {{ .Values.webhook.port }} + from: + - ipBlock: + cidr: "{{ $kubeAPIServerIP }}/32" +{{- end }} +{{- if gt $metricsPort 0 }} + # Metrics + - ports: + - port: {{ $metricsPort }} + from: [] +{{- end }} +{{- end }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/pdb.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/pdb.yaml new file mode 100644 index 00000000..42b494a3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/pdb.yaml @@ -0,0 +1,19 @@ +{{- if .Values.podDisruptionBudget.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +spec: + {{- with .Values.podDisruptionBudget.minAvailable }} + minAvailable: {{ . }} + {{- end }} + {{- with .Values.podDisruptionBudget.maxUnavailable }} + maxUnavailable: {{ . }} + {{- end }} + selector: + matchLabels: + {{- include "eck-operator.selectorLabels" . | nindent 6 }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/podMonitor.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/podMonitor.yaml new file mode 100644 index 00000000..8e073cd3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/podMonitor.yaml @@ -0,0 +1,42 @@ +{{- $metricsPort := int (include "eck-operator.metrics.port" .)}} +{{- if and .Values.config.metrics.secureMode.enabled (eq $metricsPort 0) }} +{{- fail "config.metrics.port must be greater than 0 when config.metrics.secureMode.enabled is true" }} +{{- end }} +{{- if and .Values.podMonitor.enabled (gt $metricsPort 0) }} +{{- if and .Values.podMonitor.enabled .Values.config.metrics.secureMode.enabled }} +{{- fail "podMonitor and config.metrics.secureMode are mutually exclusive" }} +{{- end }} +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ ternary .Values.podMonitor.namespace .Release.Namespace (not (and (.Values.podMonitor) (empty .Values.podMonitor.namespace))) }} + labels: {{- include "eck-operator.labels" . | nindent 4 }} + {{- with .Values.podMonitor.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.podMonitor.annotations }} + annotations: {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.podMonitor.podTargetLabels }} + podTargetLabels: {{- toYaml . | nindent 4 }} + {{- end }} + podMetricsEndpoints: + - port: metrics + path: /metrics + {{- with .Values.podMonitor.interval }} + interval: {{ . }} + {{- end }} + {{- with .Values.podMonitor.scrapeTimeout }} + scrapeTimeout: {{ . }} + {{- end }} + {{- with .Values.podMonitor.podMetricsEndpointConfig }} + {{- toYaml . | nindent 6 }} + {{- end }} + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: {{- include "eck-operator.selectorLabels" . | nindent 6 }} +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/role-bindings.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/role-bindings.yaml new file mode 100644 index 00000000..0db9f278 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/role-bindings.yaml @@ -0,0 +1,98 @@ +{{- $operatorNSIsManaged := has .Release.Namespace .Values.managedNamespaces -}} +{{- $fullName := include "eck-operator.fullname" . -}} +{{- $svcAccount := include "eck-operator.serviceAccountName" . }} +{{- $enableSecureMetrics := .Values.config.metrics.secureMode.enabled -}} + +{{- if not .Values.createClusterScopedResources }} +{{- range .Values.managedNamespaces }} +{{- $namespace := . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: "{{ $fullName }}" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +rules: +{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ $fullName }}" + namespace: {{ $namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ $fullName }}" +subjects: +- kind: ServiceAccount + name: {{ $svcAccount }} + namespace: {{ $.Release.Namespace }} +{{- end }} {{- /* end of range over managed namespaces */}} +{{- /* If createClusterScopedResources is false and operator namespace is not in the managed namespaces list, create additional role binding */}} +{{- if not $operatorNSIsManaged }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ $fullName }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +rules: +{{ template "eck-operator.rbacRules" $ | toYaml | indent 2 }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: "{{ $fullName }}" + namespace: {{ $.Release.Namespace }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: "{{ $fullName }}" +subjects: +- kind: ServiceAccount + name: {{ $svcAccount }} + namespace: {{ $.Release.Namespace }} +{{- end }} {{- /* end of operator role binding if operator namespace is not managed */}} +{{- else }} {{- /* we can create cluster-scoped resources so just create a cluster role binding */}} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ $fullName }} + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: {{ $fullName }} +subjects: +- kind: ServiceAccount + name: {{ $svcAccount }} + namespace: {{ $.Release.Namespace }} +{{- if $enableSecureMetrics }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + {{- include "eck-operator.labels" $ | nindent 4 }} + name: "{{ include "eck-operator.fullname" . }}-metrics-auth-rolebinding" +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: "{{ include "eck-operator.fullname" . }}-metrics-auth-role" +subjects: +- kind: ServiceAccount + name: {{ $svcAccount }} + namespace: {{ $.Release.Namespace }} +{{- end }} +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-account.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-account.yaml new file mode 100644 index 00000000..f91acdcc --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-account.yaml @@ -0,0 +1,15 @@ +{{- if .Values.serviceAccount.create }} +--- +apiVersion: v1 +kind: ServiceAccount +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +metadata: + name: {{ include "eck-operator.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +{{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-monitor.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-monitor.yaml new file mode 100644 index 00000000..0d4a3d9c --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/service-monitor.yaml @@ -0,0 +1,34 @@ +{{- if and .Values.config.metrics.secureMode.enabled .Values.serviceMonitor.enabled }} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ ternary .Values.serviceMonitor.namespace .Release.Namespace (not (and (.Values.serviceMonitor) (empty .Values.serviceMonitor.namespace))) }} + labels: {{- include "eck-operator.labels" . | nindent 4 }} +spec: + namespaceSelector: + matchNames: + - {{ .Release.Namespace }} + selector: + matchLabels: + app.kubernetes.io/name: {{ include "eck-operator.name" . }}-metrics-service + app.kubernetes.io/instance: {{ .Release.Name }} + endpoints: + - port: https + path: /metrics + scheme: https + interval: 30s + tlsConfig: + {{- $insecureSkipVerify := (ternary .Values.config.metrics.secureMode.tls.insecureSkipVerify .Values.serviceMonitor.insecureSkipVerify (hasKey .Values.config.metrics.secureMode.tls "insecureSkipVerify")) }} + insecureSkipVerify: {{ $insecureSkipVerify }} + {{- if (not $insecureSkipVerify) }} + {{- $caMountDirectory := or (.Values.config.metrics.secureMode.tls.caMountDirectory) (.Values.serviceMonitor.caMountDirectory) -}} + {{- $leading_path := trimSuffix "/" $caMountDirectory }} + {{- $caSecret := or (.Values.config.metrics.secureMode.tls.caSecret) (.Values.serviceMonitor.caSecret) -}} + {{- with $caSecret }} + caFile: "{{ $leading_path }}/{{ . }}/ca.crt" + {{- end }} + serverName: "{{ include "eck-operator.fullname" . }}-metrics.{{ .Release.Namespace }}.svc" + {{- end }} + bearerTokenFile: /var/run/secrets/kubernetes.io/serviceaccount/token +{{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/statefulset.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/statefulset.yaml new file mode 100644 index 00000000..3fcc1575 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/statefulset.yaml @@ -0,0 +1,166 @@ +--- +{{- $metricsPort := int (include "eck-operator.metrics.port" .)}} +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: {{ include "eck-operator.fullname" . }} + namespace: {{ .Release.Namespace }} + {{- with .Values.statefulsetAnnotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} + {{- with .Values.statefulsetLabels }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + selector: + matchLabels: + {{- include "eck-operator.selectorLabels" . | nindent 6 }} + serviceName: {{ include "eck-operator.fullname" . }} + replicas: {{ .Values.replicaCount }} + template: + metadata: + annotations: + # Rename the fields "error" to "error.message" and "source" to "event.source" + # This is to avoid a conflict with the ECS "error" and "source" documents. + "co.elastic.logs/raw": "[{\"type\":\"filestream\",\"enabled\":true,\"id\":\"eck-container-logs-${data.kubernetes.container.id}\",\"paths\":[\"/var/log/containers/*${data.kubernetes.container.id}.log\"],\"parsers\":[{\"container\":{}},{\"ndjson\":{\"keys_under_root\":true}}],\"prospector.scanner.symlinks\":true,\"processors\":[{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"error\",\"to\":\"_error\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_error\",\"to\":\"error.message\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"source\",\"to\":\"_source\"}]}},{\"convert\":{\"mode\":\"rename\",\"ignore_missing\":true,\"fields\":[{\"from\":\"_source\",\"to\":\"event.source\"}]}}]}]" + "checksum/config": {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }} + {{- with .Values.podAnnotations }} + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- if .Values.global.manifestGen }} + {{- include "eck-operator.selectorLabels" . | nindent 8 }} + {{- else }} + {{- include "eck-operator.labels" . | nindent 8 }} + {{- end }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + terminationGracePeriodSeconds: 10 + serviceAccountName: {{ include "eck-operator.serviceAccountName" . }} + automountServiceAccountToken: {{ .Values.automountServiceAccountToken }} + {{- with .Values.priorityClassName }} + priorityClassName: {{ . }} + {{- end }} + {{- with .Values.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - image: "{{ .Values.image.repository }}{{- if .Values.config.ubiOnly -}}-ubi{{- end -}}{{- if .Values.image.fips -}}-fips{{- end -}}:{{ default .Chart.AppVersion .Values.image.tag }}" + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: manager + args: + - "manager" + - "--config=/conf/eck.yaml" + {{- with .Values.securityContext }} + securityContext: + {{- toYaml . | nindent 12 }} + {{- end }} + env: + - name: OPERATOR_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + {{- if .Values.webhook.enabled }} + - name: WEBHOOK_SECRET + value: {{ include "eck-operator.webhookSecretName" . }} + {{- end }} + {{- with .Values.env }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if .Values.tracing.enabled -}} + {{- range $name, $value := .Values.tracing.config }} + - name: {{ $name }} + value: {{ $value }} + {{- end }} + {{- end }} + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- if or .Values.webhook.enabled (gt $metricsPort 0) }} + ports: + {{- if (gt $metricsPort 0) }} + - containerPort: {{ $metricsPort }} + name: metrics + protocol: TCP + {{- end }} + {{- if .Values.webhook.enabled }} + - containerPort: {{ .Values.webhook.port }} + name: https-webhook + protocol: TCP + {{- end }} + {{- end }} + volumeMounts: + - mountPath: "/conf" + name: conf + readOnly: true + {{- if .Values.webhook.enabled }} + - mountPath: {{ .Values.webhook.certsDir }} + name: cert + readOnly: true + {{- end }} + {{- if .Values.config.metrics.secureMode.tls.certificateSecret }} + - mountPath: "/tmp/k8s-metrics-server/serving-certs" + name: tls-certificate + readOnly: true + {{- end }} + {{- with .Values.volumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + volumes: + - name: conf + configMap: + name: {{ include "eck-operator.fullname" . }} + {{- if .Values.webhook.enabled }} + - name: cert + secret: + defaultMode: 420 + secretName: {{ include "eck-operator.webhookSecretName" . }} + {{- end }} + {{- if .Values.config.metrics.secureMode.tls.certificateSecret }} + - name: tls-certificate + secret: + defaultMode: 420 + secretName: {{ .Values.config.metrics.secureMode.tls.certificateSecret }} + {{- end }} + {{- with .Values.volumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.hostNetwork }} + hostNetwork: true + {{- end }} + {{- if .Values.dnsPolicy }} + dnsPolicy: {{ .Values.dnsPolicy }} + {{- else if .Values.hostNetwork }} + dnsPolicy: ClusterFirstWithHostNet + {{- end }} + {{- with .Values.dnsConfig }} + dnsConfig: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/validate-chart.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/validate-chart.yaml new file mode 100644 index 00000000..326b70bc --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/validate-chart.yaml @@ -0,0 +1,29 @@ +{{- if .Values.softMultiTenancy.enabled -}} + {{- if has .Release.Namespace .Values.managedNamespaces -}} + {{- fail "Operator namespace cannot be in managed namespaces when soft multi-tenancy is enabled" -}} + {{- end -}} + + {{- if empty .Values.managedNamespaces -}} + {{- fail "Managed namespaces must be defined when soft multi-tenancy is enabled" -}} + {{- end -}} + + {{- if empty .Values.kubeAPIServerIP -}} + {{- fail "Soft multi-tenancy requires kubeAPIServerIP to be defined" -}} + {{- end -}} +{{- end -}} + +{{- if (not .Values.createClusterScopedResources) -}} + {{- if .Values.webhook.enabled -}} + {{- fail "Webhook cannot be enabled when cluster-scoped resource creation is disabled" -}} + {{- end -}} + + {{- if .Values.config.validateStorageClass -}} + {{- fail "Storage class validation cannot be enabled when cluster-scoped resource creation is disabled" -}} + {{- end -}} +{{- end -}} + +{{- if (not .Values.config.enableLeaderElection) -}} + {{- if gt (int .Values.replicaCount) 1 -}} + {{- fail "Leader election must be enabled with more than one replica" -}} + {{- end -}} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/templates/webhook.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/webhook.yaml new file mode 100644 index 00000000..55a859ce --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/templates/webhook.yaml @@ -0,0 +1,535 @@ +{{- if .Values.webhook.enabled -}} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: {{ include "eck-operator.webhookName" . }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +{{- with .Values.webhook.certManagerCert }} + annotations: + cert-manager.io/inject-ca-from: "{{ $.Release.Namespace }}/{{ . }}" +{{- end }} +webhooks: +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-agent-k8s-elastic-co-v1alpha1-agent + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-agent-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - agent.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - agents +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-apm-k8s-elastic-co-v1-apmserver + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-apm-validation-v1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - apm.k8s.elastic.co + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - apmservers +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-apm-k8s-elastic-co-v1beta1-apmserver + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-apm-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - apm.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - apmservers +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-beat-k8s-elastic-co-v1beta1-beat + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-beat-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - beat.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - beats +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-enterprisesearch-k8s-elastic-co-v1-enterprisesearch + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-ent-validation-v1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - enterprisesearch.k8s.elastic.co + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - enterprisesearches +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-enterprisesearch-k8s-elastic-co-v1beta1-enterprisesearch + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-ent-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - enterprisesearch.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - enterprisesearches +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-elasticsearch-k8s-elastic-co-v1-elasticsearch + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-es-validation-v1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - elasticsearch.k8s.elastic.co + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - elasticsearches +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-elasticsearch-k8s-elastic-co-v1beta1-elasticsearch + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-es-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - elasticsearch.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - elasticsearches +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-ems-k8s-elastic-co-v1alpha1-mapsservers + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-ems-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - maps.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - mapsservers +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-kibana-k8s-elastic-co-v1-kibana + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-kb-validation-v1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - kibana.k8s.elastic.co + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - kibanas +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-kibana-k8s-elastic-co-v1beta1-kibana + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-kb-validation-v1beta1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - kibana.k8s.elastic.co + apiVersions: + - v1beta1 + operations: + - CREATE + - UPDATE + resources: + - kibanas +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-autoscaling-k8s-elastic-co-v1alpha1-elasticsearchautoscaler + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-esa-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - autoscaling.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - elasticsearchautoscalers +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-scp-k8s-elastic-co-v1alpha1-stackconfigpolicies + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-scp-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - stackconfigpolicy.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - stackconfigpolicies +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-logstash-k8s-elastic-co-v1alpha1-logstash + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-logstash-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - logstash.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - logstashes +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-autoops-k8s-elastic-co-v1alpha1-autoopsagentpolicies + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-autoops-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1] + sideEffects: None + rules: + - apiGroups: + - autoops.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - autoopsagentpolicies +- clientConfig: + {{- if and (not .Values.webhook.manageCerts) (not .Values.webhook.certManagerCert) }} + caBundle: {{ .Values.webhook.caBundle }} + {{- end }} + service: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + path: /validate-epr-k8s-elastic-co-v1alpha1-elasticpackageregistry + failurePolicy: {{ .Values.webhook.failurePolicy }} +{{- with .Values.webhook.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} +{{- end }} +{{- with .Values.webhook.objectSelector }} + objectSelector: + {{- toYaml . | nindent 4 }} +{{- end }} + name: elastic-epr-validation-v1alpha1.k8s.elastic.co + matchPolicy: Exact + admissionReviewVersions: [v1,v1beta1] + sideEffects: None + rules: + - apiGroups: + - packageregistry.k8s.elastic.co + apiVersions: + - v1alpha1 + operations: + - CREATE + - UPDATE + resources: + - packageregistries +--- +apiVersion: v1 +kind: Service +metadata: + name: {{ include "eck-operator.webhookServiceName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +spec: + ports: + - name: https + port: 443 + targetPort: {{ .Values.webhook.port }} + selector: + {{- include "eck-operator.selectorLabels" . | nindent 4 }} +{{- if .Values.webhook.manageCerts }} +--- +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "eck-operator.webhookSecretName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "eck-operator.labels" . | nindent 4 }} +{{- end }} +{{- end -}} diff --git a/packs/elastic-operator-3.3.2/charts/eck-operator/values.yaml b/packs/elastic-operator-3.3.2/charts/eck-operator/values.yaml new file mode 100644 index 00000000..adc48be3 --- /dev/null +++ b/packs/elastic-operator-3.3.2/charts/eck-operator/values.yaml @@ -0,0 +1,377 @@ +# nameOverride is the short name for the deployment. Leave empty to let Helm generate a name using chart values. +nameOverride: "elastic-operator" + +# fullnameOverride is the full name for the deployment. Leave empty to let Helm generate a name using chart values. +fullnameOverride: "elastic-operator" + +# managedNamespaces is the set of namespaces that the operator manages. Leave empty to manage all namespaces. +managedNamespaces: [] + +# installCRDs determines whether Custom Resource Definitions (CRD) are installed by the chart. +# Note that CRDs are global resources and require cluster admin privileges to install. +# If you are sharing a cluster with other users who may want to install ECK on their own namespaces, setting this to true can have unintended consequences. +# 1. Upgrades will overwrite the global CRDs and could disrupt the other users of ECK who may be running a different version. +# 2. Uninstalling the chart will delete the CRDs and potentially cause Elastic resources deployed by other users to be removed as well. +installCRDs: true + +# replicaCount is the number of operator pods to run. +replicaCount: 1 + +image: + # repository is the container image prefixed by the registry name. + repository: docker.elastic.co/eck/eck-operator + # pullPolicy is the container image pull policy. + pullPolicy: IfNotPresent + # tag is the container image tag. If not defined, defaults to chart appVersion. + tag: null + # fips specifies whether the operator will use a FIPS compliant container image for its own StatefulSet image. + # This setting does not apply to Elastic Stack applications images. + # Can be combined with config.ubiOnly. + fips: false + +# priorityClassName defines the PriorityClass to be used by the operator pods. +priorityClassName: "" + +# imagePullSecrets defines the secrets to use when pulling the operator container image. +imagePullSecrets: [] + +# resources define the container resource limits for the operator. +resources: + limits: + cpu: 1 + memory: 1Gi + requests: + cpu: 100m + memory: 150Mi + +# statefulsetAnnotations define the annotations that should be added to the operator StatefulSet. +statefulsetAnnotations: {} + +# statefulsetLabels define additional labels that should be added to the operator StatefulSet. +statefulsetLabels: {} + +# podAnnotations define the annotations that should be added to the operator pod. +podAnnotations: {} + +## podLabels define additional labels that should be added to the operator pod. +podLabels: {} + +# podSecurityContext defines the pod security context for the operator pod. +podSecurityContext: + runAsNonRoot: true + +# securityContext defines the security context of the operator container. +securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + +# nodeSelector defines the node selector for the operator pod. +nodeSelector: {} + +# tolerations defines the node tolerations for the operator pod. +tolerations: [] + +# affinity defines the node affinity rules for the operator pod. +affinity: {} + +# podDisruptionBudget configures the minimum or the maxium available pods for voluntary disruptions, +# set to either an integer (e.g. 1) or a percentage value (e.g. 25%). +podDisruptionBudget: + enabled: false + minAvailable: 1 + # maxUnavailable: 3 + +# additional environment variables for the operator container. +env: [] + +# additional volume mounts for the operator container. +volumeMounts: [] + +# additional volumes to add to the operator pod. +volumes: [] + +# createClusterScopedResources determines whether cluster-scoped resources (ClusterRoles, ClusterRoleBindings) should be created. +createClusterScopedResources: true + +# Automount API credentials for the Service Account into the pod. +automountServiceAccountToken: true + +serviceAccount: + # create specifies whether a service account should be created for the operator. + create: true + # Specifies whether a service account should automount API credentials. + automountServiceAccountToken: true + # annotations to add to the service account + annotations: {} + # name of the service account to use. If not set and create is true, a name is generated using the fullname template. + name: "" + +tracing: + # enabled specifies whether APM tracing is enabled for the operator. + enabled: false + # config is a map of APM Server configuration variables that should be set in the environment. + config: + ELASTIC_APM_SERVER_URL: http://localhost:8200 + ELASTIC_APM_SERVER_TIMEOUT: 30s + +refs: + # enforceRBAC specifies whether RBAC should be enforced for cross-namespace associations between resources. + enforceRBAC: false + +webhook: + # enabled determines whether the webhook is installed. + enabled: true + # caBundle is the PEM-encoded CA trust bundle for the webhook certificate. Only required if manageCerts is false and certManagerCert is null. + caBundle: Cg== + # certManagerCert is the name of the cert-manager certificate to use with the webhook. + certManagerCert: null + # certsDir is the directory to mount the certificates. + certsDir: "/tmp/k8s-webhook-server/serving-certs" + # failurePolicy of the webhook. + failurePolicy: Ignore + # manageCerts determines whether the operator manages the webhook certificates automatically. + manageCerts: true + # namespaceSelector corresponds to the namespaceSelector property of the webhook. + # Setting this restricts the webhook to act only on objects submitted to namespaces that match the selector. + namespaceSelector: {} + # objectSelector corresponds to the objectSelector property of the webhook. + # Setting this restricts the webhook to act only on objects that match the selector. + objectSelector: {} + # port is the port that the validating webhook binds to. + port: 9443 + # secret specifies the Kubernetes secret to be mounted into the path designated by the certsDir value to be used for webhook certificates. + certsSecret: "" + +# hostNetwork allows a Pod to use the Node network namespace. +# This is required to allow for communication with the kube API when using some alternate CNIs in conjunction with webhook enabled. +# If hostNetwork is enabled, dnsPolicy defaults to ClusterFirstWithHostNet unless explicitly set. +# CAUTION: Proceed at your own risk. This setting has security concerns such as allowing malicious users to access workloads running on the host. +hostNetwork: false + +# dnsPolicy defines the DNS policy for the operator pod. +# Check https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy for more details. +dnsPolicy: "" + +# dnsConfig defines the DNS configuration for the operator pod. +# Check https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config for more details. +# dnsConfig: +# nameservers: +# - 169.254.20.10 +# searches: +# - svc.cluster.local +# options: +# - name: ndots +# value: "2" +dnsConfig: {} + +softMultiTenancy: + # enabled determines whether the operator is installed with soft multi-tenancy extensions. + # This requires network policies to be enabled on the Kubernetes cluster. + enabled: false + +# kubeAPIServerIP is required when softMultiTenancy is enabled. +kubeAPIServerIP: null + +telemetry: + # disabled determines whether the operator periodically updates ECK telemetry data for Kibana to consume. + disabled: false + # distributionChannel denotes which distribution channel was used to install the operator. + distributionChannel: "helm" + +# config values for the operator. +config: + # logVerbosity defines the logging level. Valid values are as follows: + # -2: Errors only + # -1: Errors and warnings + # 0: Errors, warnings, and information + # number greater than 0: Errors, warnings, information, and debug details. + logVerbosity: "0" + + # (Deprecated: use metrics.port: will be removed in v2.14.0) metricsPort defines the port to expose operator metrics. Set to 0 to disable metrics reporting. + metricsPort: 0 + + metrics: + # port defines the port to expose operator metrics. Set to 0 to disable metrics reporting. + port: "0" + # secureMode contains the options for enabling and configuring RBAC and TLS/HTTPs for the metrics endpoint. + secureMode: + # secureMode.enabled specifies whether to enable RBAC and TLS/HTTPs for the metrics endpoint. + # * This option makes most sense when using a ServiceMonitor to scrape the metrics and is therefore mutually exclusive with the podMonitor.enabled option. + # * This option also requires using cluster scoped resources (ClusterRole, ClusterRoleBinding) to + # grant access to the /metrics endpoint. (createClusterScopedResources: true is required) + # + enabled: false + tls: + # certificateSecret is the name of the tls secret containing the custom TLS certificate and key for the secure metrics endpoint. + # + # * This is an optional setting and is only required if you are using a custom TLS certificate. A self-signed certificate will be generated by default. + # * TLS secret key must be named tls.crt. + # * TLS key's secret key must be named tls.key. + # * It is assumed to be in the same namespace as the ServiceMonitor. + # + # example: kubectl create secret tls eck-metrics-tls-certificate -n elastic-system \ + # --cert=/path/to/tls.crt --key=/path/to/tls.key + certificateSecret: "" + + # containerRegistry to use for pulling Elasticsearch and other application container images. + containerRegistry: docker.elastic.co + + # containerRepository to use for pulling Elasticsearch and other application container images. + # containerRepository: "" + + # containerSuffix suffix to be appended to container images by default. Cannot be combined with -ubiOnly flag + # containerSuffix: "" + + # maxConcurrentReconciles is the number of concurrent reconciliation operations to perform per controller. + maxConcurrentReconciles: "3" + + # caValidity defines the validity period of the CA certificates generated by the operator. + caValidity: 8760h + + # caRotateBefore defines when to rotate a CA certificate that is due to expire. + caRotateBefore: 24h + + # caDir defines the directory containing a CA certificate (tls.crt) and its associated private key (tls.key) to be used for all managed resources. + # Setting this makes caRotateBefore and caValidity values ineffective. + caDir: "" + + # certificatesValidity defines the validity period of certificates generated by the operator. + certificatesValidity: 8760h + + # certificatesRotateBefore defines when to rotate a certificate that is due to expire. + certificatesRotateBefore: 24h + + # disableConfigWatch specifies whether the operator watches the configuration file for changes. + disableConfigWatch: false + + # exposedNodeLabels is an array of regular expressions of node labels which are allowed to be copied as annotations on Elasticsearch Pods. + exposedNodeLabels: + ["topology.kubernetes.io/.*", "failure-domain.beta.kubernetes.io/.*"] + + # ipFamily specifies the IP family to use. Possible values: IPv4, IPv6 and "" (auto-detect) + ipFamily: "" + + # setDefaultSecurityContext determines whether a default security context is set on application containers created by the operator. + # *note* that the default option now is "auto-detect" to attempt to set this properly automatically when both running + # in an openshift cluster, and a standard kubernetes cluster. Valid values are as follows: + # "auto-detect" : auto detect + # "true" : set pod security context when creating resources. + # "false" : do not set pod security context when creating resources. + setDefaultSecurityContext: "auto-detect" + + # kubeClientTimeout sets the request timeout for Kubernetes API calls made by the operator. + kubeClientTimeout: 60s + + # elasticsearchClientTimeout sets the request timeout for Elasticsearch API calls made by the operator. + elasticsearchClientTimeout: 180s + + # policies contains policies for the operator, currently only password generation policies are supported. + policies: {} + # passwords: + # length: 24 + + # validateStorageClass specifies whether storage classes volume expansion support should be verified. + # Can be disabled if cluster-wide storage class RBAC access is not available. + validateStorageClass: true + + # enableLeaderElection specifies whether leader election should be enabled + enableLeaderElection: true + + # Interval between observations of Elasticsearch health, non-positive values disable asynchronous observation. + elasticsearchObservationInterval: 10s + + # ubiOnly specifies whether the operator will use only UBI container images to deploy Elastic Stack applications as well as for its own StatefulSet image. UBI images are only available from 7.10.0 onward. + # Cannot be combined with the containerSuffix value. + ubiOnly: false + +# Prometheus PodMonitor configuration +# Reference: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#podmonitor +podMonitor: + # enabled determines whether a podMonitor should deployed to scrape the eck metrics. + # This requires the prometheus operator and the config.metrics.port not to be 0 + enabled: false + + # labels adds additional labels to the podMonitor + labels: {} + + # annotations adds additional annotations to the podMonitor + annotations: {} + + # namespace determines in which namespace the podMonitor will be deployed. + # If not set the podMonitor will be created in the namespace where the Helm release is installed into + # namespace: monitoring + + # interval specifies the interval at which metrics should be scraped + interval: 5m + + # scrapeTimeout specifies the timeout after which the scrape is ended + scrapeTimeout: 30s + + # podTargetLabels transfers labels on the Kubernetes Pod onto the target. + podTargetLabels: [] + + # podMetricsEndpointConfig allows to add an extended configuration to the podMonitor + podMetricsEndpointConfig: {} + # honorTimestamps: true + +# Prometheus ServiceMonitor configuration +# Only used when config.enableSecureMetrics is true +# Reference: https://github.com/prometheus-operator/prometheus-operator/blob/master/Documentation/api.md#servicemonitor +serviceMonitor: + # This option requires the following settings within Prometheus to function: + # 1. RBAC settings for the Prometheus instance to access the metrics endpoint. + # + # - nonResourceURLs: + # - /metrics + # verbs: + # - get + # + # 2. If using the Prometheus Operator and your Prometheus instance is not in the same namespace as the operator you will need + # the Prometheus Operator configured with the following Helm values: + # + # prometheus: + # prometheusSpec: + # serviceMonitorNamespaceSelector: {} + # serviceMonitorSelectorNilUsesHelmValues: false + # + # allows to disable the serviceMonitor, enabled by default for backwards compatibility + enabled: true + # namespace determines in which namespace the serviceMonitor will be deployed. + # If not set the serviceMonitor will be created in the namespace where the Helm release is installed into + # namespace: monitoring + # caSecret is the name of the secret containing the custom CA certificate used to generate the custom TLS certificate for the secure metrics endpoint. + # + # * This *must* be the name of the secret containing the CA certificate used to sign the custom TLS certificate for the metrics endpoint. + # * This secret *must* be in the same namespace as the Prometheus instance that will scrape the metrics. + # * If using the Prometheus operator this secret must be within the `spec.secrets` field of the `Prometheus` custom resource such that it is mounted into the Prometheus pod at `caMountDirectory`, which defaults to /etc/prometheus/secrets/{secret-name}. + # * This is an optional setting and is only required if you are using a custom TLS certificate. + # * Key must be named ca.crt. + # + # example: kubectl create secret generic eck-metrics-tls-ca -n monitoring \ + # --from-file=ca.crt=/path/to/ca.pem + caSecret: "" + # caMountDirectory is the directory at which the CA certificate is mounted within the Prometheus pod. + # + # * You should only need to adjust this if you are *not* using the Prometheus operator. + caMountDirectory: "/etc/prometheus/secrets/" + # insecureSkipVerify specifies whether to skip verification of the TLS certificate for the secure metrics endpoint. + # + # * If this setting is set to false, then the following settings are required: + # - certificateSecret + # - caSecret + insecureSkipVerify: true + +# Globals meant for internal use only +global: + # manifestGen specifies whether the chart is running under manifest generator. + # This is used for tasks specific to generating the all-in-one.yaml file. + manifestGen: false + # createOperatorNamespace defines whether the operator namespace manifest should be generated when in manifestGen mode. + # Usually we do want that to happen (e.g. all-in-one.yaml) but, sometimes we don't (e.g. E2E tests). + createOperatorNamespace: true + # kubeVersion is the effective Kubernetes version we target when generating the all-in-one.yaml. + kubeVersion: 1.21.0 diff --git a/packs/elastic-operator-3.3.2/logo.png b/packs/elastic-operator-3.3.2/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..fa70b78daa45585ec0f802dfe637e4ce2172d6f8 GIT binary patch literal 5810 zcmV;j7ES4iP)) zEw)vQ)`8Z7U<(>65YRj(4Mo6Nreakf33Yf32_SRsaMt@Hh#~jfCBW^ant1RI-2$F+Ls!$`IZMeGSXJF1;$Zc-LF^Xx0Xx8|Z+YmWN0# zFa&7fqWH}y&!gsf>35{eMY*ohEDb<6ruRVYNvMnm+IX!F^fj=4BUwjY_gGiGX;ucH z8`FDW>r~(}z$Cr{tih6e>0P-j;ku*HEDS)`(2~~v$-rdX9p)R#EBLHirPtwqC%Yp} z-T-uci}S&L7RXF?Uuv)))qA9G@R?+GqRAS7D#C{JiJ-p+e97)lRD}721J_GG_9jPt z6GT6vEtUS6z~#yAON?wr`vWUk>z3c3|N1A^r@I9BinrIFoc8>H3y_pDQ2{Qn_vcTFMsK_yJg;sgpdN?#*?F z;#zfV@IQd^%Q(83ifra^puY@YpO;EJHGsV%rk`nxJp&;t4ly?H%MOJ%KO~6OtUS8T zUkX@p=txywl&ruQFBN!Z02L#jzEOlHfOI$Hsq#Oa7EUrx zxft0HQ6`+_x}H=+IRRhjVXwryY5)}@o*IDgsGBmsLdCZ(vecaEg|3uCxklIf&hw`C=P3mIIJ+6y%Lx}j(#u9q~ zW&KeH128m~;lDb=byMrEZVGhk6X2<{Le<_FS!$a83Lp|6;m}w&1;%Xv+lS3=4GeUl zFVP4eZc+Kq$YO0CD}b7)UhAf~xD6mJ{XlQP??PXq@yRJK{p@h{f}<0_|MF00D$~!+ z&p_M;AVNqeKq>&3gj)H5$xtLrmNT(Ein1_JD(@ z&IQyExdYfdJ%EuItF0?y+z=wL!VNhQ*pZt+&C~-JiRuY%h;d~GZ~SS$3I#%MgANoS z8>NpMvMn5fK+r}Q^X~=f%CUA=4B%)i|BFZe*gkA_Yk%v*{jkG>P{~FZ2-MeK5Z<4D zXjAoqsu)0eyV2(+KtzCSLrBQE0KKxn+I?i_>BjiZQe_aL*}!+}cuDoGb)57KJ|C}`gq)g{m-52ErlWte0d`$B{XeX*_6G)mW&>w){GP%$9>CfV z3A!OBJ_Aq{9ze*KdM^XJ%)9CTfJI0D*m>oXZTvy&9JMuDMFxuUR>VVM&U9(yYy1d@ z>uwZ_mA)HF)Uh4p4Mdk)Mwac!%P6hq^8o0^wEo!gZbP1Jf~=FQfGf-4x(%SX z*w<-C=A)u|TTJcirUbMYF~z7UE+2d97qL8~>(al2=!Z1TGl2C#R^zYCl{2VtMOtl@ zoeMu|%b^x?KreMeSrkfu)X!aG#QmB21R7;H0Q8KYwO}b00>I z00nAw4wuaXMmAKai@aVwHuJdfC*9P#E1}?4pjDFklt?O3#!25mLDUvgW}av>c;-eMwR1n3;zHkH(P`2gp4e4%te^#bX2a68Hq$?8x7*^SycwY_}n-seUd zkrlv+3WHRnz?^nyqwl_%Lt|BP+z8O=g{^0cnm0+UnRa3M*vwJY3v?~*G5!*~JdKoG zNb-mb30r1LL}^;!F;M6Kq{fP}fM8%q)R%wzBiANvjlfV_ypF@t-_s;5MwLM`uP~WqGZETT3 z>)z)a=XD04lf5mMXnFfm14}J)XGCec%BO%&BbzrW6nH?gf|Dc<=h^$uXJ;C8l`7c{ z)Ztfnfho^LY^NIlvGukF3Qio#kE)zgUn7|uLG{XHjo0#{2`AU|r0DKpPDVf#(s z^f-03G$Jo^?~LP;YMHJDo4X(kj#GFdNJm0Hizp2RXMj8dL}n37Z7NVZN3sGhL~Bre zndgp5?IvQTS1&Q4kS~YSTJ}Xp%}s4*eb%XZk@P1hS(OtA2TlbZ0Ev5xGy#+%WJ}-B zs%QPvC(1v{xcsxcQ)=A_lhde_ ztl(_=1ilM05=cna?HE~tKX8HcKDfiNHh*RdbMLGdQ2B39d!d|Rbxt1(Rg=I}yGy4g zs>gdl%mci>Vvo&Ap0Q~uV$3dj;5FF_r; z5kNZ6Dcy(Q$}uAk2q1EO`IwBq)vV}QRCI!!c0fvo=EZzESvRHkBxK(XawE{v)t=U( z7I?7Mnf}jbXPU5GMEo=TdSQ#{EuH6<1i|Ao{taWF8vF8!t9mT2S&>ovYF7yci-6OB z86wsrB|}HVdIkqM zkxR&>L%I{PP-bFyQnfIH`#;Oqoq&i zAJH0ElV|0s(K#e(Yg^zA=`^>rR3IZ69f-nKvBDSa%Ig_%`EvJV3wo=v7^v-R{A!ek zONZsY5^H#R)r}+Rmw?_6oYTO5SEmfaaOoZRSF{G^zUOX5nMQJ#;76qM+_HC5DCh3m zJ}We0d){fgYF2bxTsXuST>!*(DpuKm;gOCVcFcXh|4lKUqS1A}Y{X0kE}>yTup7X- zM6wP$ZfW!Y6k!H|z|GPh z=g}tr*^XAgH(xci-0t$N7q<P*#br0Lg#-U*yiy^0iF=EZ{aEZUsD_e^ri(-91-y;pbe-v;xN*2nGrElP`Q6EU^GOum~p!3|a=fT|^v~_S$ zY{}boO-518ik?M9>0w`RHfW+eVgTz99_!|7H)n;zXUGXvgnza?S$ZFi8jq0dWnL@@ z96R^7GC?|bV4F+Iuj%%F&5B;d1#J!m)8>K19M$SFWeU$22|QCD52F()vdpWKW6PY* zb4oWMb!P2|m(513i+7GWb!*LvYTmt6h)diDJQuXA-+p$%h^R-^97(ZdUR@kBfG%@O zu2AG94|Tn31;dx_7}ql*;4zAKFBJ#?FNO_M|D7}H!#Z2%&un2TWfqCs(21Ml935Te zmM&2k=7Ex>+N$!3^4!xScEV!x?j@U}u4bK9k~1n|Z{isF&vrDGzEWa!RwbX3)3`O^6ajzWtTX<{H60RP*_cBzkC3L>ZNM4EOW_%H9eNhcg|Imf5UFz@x*p5 z4n!9pX8^me?zTyhpSmU=9xfk~aif!ir`ys6qZN4tO}UMz+7Z5QBQwa)cXUkI>7mEK z+Y6uF!q{eh#6O~9Y{rua)14lu2Vr2suCbYs2Rf+o?iu(y4RP(J0z#k6fmv5O)-|3{ z;KR_=aj!XAak)7(QD9jE1s_E0QRQPZpK+?pSh`@c3QywEy~T+`e$}(6$T3fWovx1n zG4DGh13~`)qRuZNuUBA~b?8zcdLV-{yNxjymXGQ2N<>XTfz^HKf~P%j?Iw$EwiUR= zu_k}~Uf_?3?M}Ve89vhbuTa~sFt1mjd`!l*AipQJ6z`* z=Onp;!+-IgrOlwe>bso~o7k`}f^iQ`YL6+zI5xss{l%c>VP zIPYK2qRr`BF76p{io0th-aR)7TeivCa?!|55jFWU+nY)$1==URTgOlly*~WV_~&X? zGZRvv1 zrfTWfI2}B3V%u{5wu^F$qc)f_qq}8Hw!$E)&iZ@3`+7u_>%&ujG&foU*9^e5*uBQh zJEcQ&2gIB${r*|swp0hHG6={9vT!ec;8R=ma;A>2^_+w&29U9&aEypXwX)`fqW#K- zjgGwSEEevX-5QI2Ms$#hW(y3W{+ZBhglBEP?{4z1t#bw9&XF)<4@DDl`%J2%b|7tA zgP;EWxP!nd8&&}iYkskhKxrSNCL4~85>e+?BCHIHxszXydoNa%uDrF(WeZlKoa=_H zM$Wd<{ijxTS)J%2gLGG>s9WD5*Z=!M84TkJ>q_4vqJR_eel z1NaE#Ki!bk$XQrAY*cQ|!l&NI?hy2u3ab9U_kq3xvRW{!+8$xm_#rDAp57+E*hhYB zfvirr^9j(@je1Qi;&_8<(2_Ix`p0$xNDh#r*z9XTXxf`USg+`6R92agy<+0vHzJP4 zMJ0}x5ALNPNyX#k2}i`~rgK2dS+(q^`9RMSI1ABFV{T|Y<+8OiBpBZ znQ{JnYkoE=r@b}!?H0a+IXCrxKdu-~x12TyU6RvyQ8tpFACbf8sW-AasQX!1(@_Q= zs%#VYv3|DHT6LI?MZc;n07=RHgBAr{aLdEg>?`vgyHUT_J+>>ut44`D# zh|NGVo(G8I_OIF=4*vi`%*ipM;ac#9K=eqMCXYt(0D2q{tJHmDy$)P60J|y(v{|CI zZged7asmh_vLap?t{Fh6ZD1iOdJ@KC_Lf~VD&q5(fC*sO3Wr{eSBPr{@Y%q;!yqra zC9m-y>z!f%y`BInEWJH@^%wEVaW#O`sLpUxUZX&rJ%C@ya(yCuwZ11KFfdMQ3m8CE<%ZkOSy}3qKu->Fh%f<&D^{&BAn&AaQ< zR!&9D#Xwmc8bT<4@|m>nP8_guX&iED#q;xAnac`qL-h%-^&}F357Q3IfRA%?Yu$~T z{@z(>heNGKipovE`NVeca|g&A+ZX=hPtRWE`3Rbj1AQ4w3ZD`=J~c@rW{((qKuOMJ zpVa4}hgS`1+rpUdshD#F{kA|SMLU6f3G5Q&Ut(mcxf(`71bk)hj$<~qmzHBu6m z%wfy$;gy{_?id9;pD3L!vIE<`psBrlNZ<%?3{~mAY~fTz?@o&TdZMr5MZ@xSvk#4^u=W+$^BH4*q6k%=Wk zbLS6kwtN~Q#q(zHbrKg9o z1vy`p!3bv%d+yysDC;q-1>O#b{p#mAmsNP!-9|;DFaReqmlvK$NWX)Tt|Hn-(Kezc w4beTet$PsNgQo2$`||K+^70bqTW@UqKfDL0=G%K elastic/eck-stack + +## Usage + +The chart currently supports the deployment of the following resources: + +- Elasticsearch & Kibana: Enabled by default for immediate cluster setup. +- Agents & Servers: Optional deployment of Elastic Agent, Fleet Server, Beats, Logstash, and APM Server. +- Security: Features include automated TLS Certificates management and secure settings via keystore updates. +- Persistence: Utilizes Persistent Volumes for data storage across cluster changes. + +## Prerequisites + +- Kubernetes 1.27+ +- Elastic ECK Operator + +## Parameters + +The following table lists the configurable parameters of the eck-stack chart and their default values. + +| Parameter | Description | Default | +| --------- | ----------- | ------- | +| `eck-elasticsearch.enabled` | If `true`, create an Elasticsearch resource (using the eck-elasticsearch Chart) | `true` | +| `eck-kibana.enabled` | If `true`, create a Kibana resource (using the eck-kibana Chart) | `true` | +| `eck-agent.enabled` | If `true`, create an Elastic Agent resource (using the eck-agent Chart) | `false` | +| `eck-fleet-server.enabled` | If `true`, create a Fleet Server resource (using the eck-fleet-server Chart) | `false` | +| `eck-logstash.enabled` | If `true`, create a Logstash resource (using the eck-logstash Chart) | `false` | +| `eck-apm-server.enabled` | If `true`, create a standalone Elastic APM Server resource (using the eck-apm-server Chart) | `false` | + +## References + +Quickstart Guide: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-quickstart.html +Official Documentation: https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html +Community Support: https://discuss.elastic.co/c/eck + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack-0.18.2.tgz b/packs/elastic-stack-0.18.2/charts/eck-stack-0.18.2.tgz new file mode 100644 index 0000000000000000000000000000000000000000..afc46c4bc9d6de35939ba3033351fb06b823ac9d GIT binary patch literal 45047 zcma%?Lv&?d)a~P>f{JZbY}>YNJE1(ksmZCJWp8WZ zXzr!1;v^t#VebHT*?aMmfNPQD{j0uWU@h0l!bN8VTeY-&?oNC@byQP3y|tJh-IbsP zqZ@u3sRfT3l3LY42LA)^!~27RDzOved=cAFex1#LjkKl4S%xBTTAYlDqBpi|=*$9S zA0H;0?wJG{6A%g+G)?43@+ z-TA7t^guIbKwoyqM+kpsVF0

g?#LErvxY2|YP|nRt8&PFb#n`k+>?s&sr=aTSGj z=|d7UzRx70`!w9>s~TE=v<$S{t3RsAj z2V<3204zOH2y@|$=*W;84?<07Sq@Oxrt z+=3lOE;o~yg~pIo(5!xmE8z68Cv6JQ75o6rd3k&7`q}S+hKGk$VnD=%*RLQkeueM= zDn)-jML#-CU+f<~bd275L|#5X53BND#P;X$(-E_g>Sh!G&&MNA`FzC)C0I3nf$Z3P zf{G9-8XkUL#R7t|;ctTe_eW4xQWShyh)UlJ6kB3re@J--QlYcr@hebKNiD=O&lE^= zO7<=oyAdGA9}M1Z-_9LUy@Mw9@9u6-kIt4VKt@huZtdQ*?*U;C$>X~RV4Xog;$QQi z;r$fCuYgFZ_(N-C0dh6{6ZkBSz;b={djqtqA`e$u)HJw~fL!1$YyQus0of!(1sla= z>J2fb@^RT(*wgG29$HH9s^$?{HLzx(ZTMJ(AOZ0~Bl+%QI!a8w@W2pIF#swBV zZx~vtOqfoXU8R=T69ypJ{*o!xqPzUL;hm3{Yc~g-K(kL`mjuDx{T<2I`Wa@#X(28p zzuVjUtdE1wHO+Csh|=Btsj`A$n8yk#ukXzS)3S!s5nNc#^CI}Liz#$gYkt6ztz%Fk z0_Sg6x02k55%yxOV?tQ`Mh93ijnuEA!#J9doo-eIdv^S@z(YCLRiRO}iGXPOXaYL2 zj|RhjAOHMH2|pfVzcY~cxtJbFCzzR#?yw;=~}0WhcX2#F1)Vo9NaB*=9T ze7ITE`~Vh-tbyhybsttHMPq3#I-ivPGj7qKfuo~ z@9zQy&CQ%_c9NjU7dyZL%N5H=Fzu@qBba%mf}Wf>xl8xRC|lnB3KYXLfk0+n9PPsc z@7N9U`RTj$7o-#)FV*t}LYW&&`1(41ix`^N-8Y$lU;g--D=0}IHe>KolT>ct#XDaV zz|h(iVeJTod^Wx3D$#^X;5|(d^lHQ)Bpxbob1_t`c!WG35is8*qYv>zyv_R-j4AT> z1?&;#OZ6aEk!Avg5k8PV3aBW*scd*g^hnLVF58qYN@0ZZ*jqti`CCo)UY?8|Zt^Vn zJcJ?lXQjB&`c#rt!>qfGA8j(U3^CP03=LZNd8VZ5EJpcs)ckEcEjdU&5-W%`^a*u? zSaz*=H4mBYaj|O5^5OQhvHkvo6KAf>37`b_^?Gqt(HgvPILN+8HUnmLb&M252W4R! z?G2(l1SR)M>Xk2DVQaq>v{_(JSL{$~j#UBBPL>%_)M&@hlN<81sI?SqU71PqFFs$; z(MrcTlrFzsh|Ucj9sA;5O$W1rRO&+(QkjKkW%{I#ej__4aAcIz&rH?YDMy{P*Mw5= z$Y5eKIV>r+&a7Oene*$!+d%{gW-g?>U}%R{oPGjH4j(!abd?58j(1Gs<96 z4*r@^{=TAi2NIuS&tqX67kFvX0XnUNV&fBjeS%2y1s-AOB%o5VkF(CC)?A0?OG~}V z-|__P10oLgc-*k=BW@&N=t;-`Zd&w#XY>9r4(Z@Wakh75|1Zcpq zmJv&bw>rlGA6$YBTYRIqL$dKG)KP+dPD-Ou&doB-Vq#Nlh^5DVU0o7bsE<=;sjNf< zAib)vzG*z}8@-qcUR(rhDS3^&Ylxxe8m2>6He0k7j9-v#DE)Y4-B4N<1aJv(IccG4aa)PfWYk2N_1zmTLEpi* zhG)UtWSOKXQBTQXCBYN`p*lW3mR8`Mb zt|cK0k%!(}l{@HU--`EQnJJOypK{Ax8FZwO>`DrT&|ii6yAN63T`;b$id@AqrB}gD z>z0JY7kat`mjFEdtEF{@({!|Z6vliL8Sy(w^dc%4Yd6)!e|I|6iDOsUqwO}{sX4tL zsh@SPslU6;s<>t2`Y;n%%YU8?h7{fjF=)_4^7%=->X&Hxn1o6SkKv0zy_JabEZp|PGOxwC|p z6&SRWs*WI;}X#G zuChiEJ!@^OqCciIR?Z#AOyt?5h!cKX7oDxqBgfJ$li3NvWSP2o&;fT?irRE8o)U6f z`;Z-qFSeU)n)}G`tTCeWV`!;s96p}Oi%4GV0Hecn*GdWA{aHKY9jvYE()B4hd*eCh zX9Y-Q@lmyfCTw=veB0ztc}6%TSL{}$$k&(4-zx;4#x9@!)$YyWce!gYJ`vZsqg+pf z6w)YKgwTZ&BYrF*juQ#98ke=}&O`EkayQ}x|OY9oE6RkKgXfKF#Pf-@{+t<0HIXb$MT%CVk+*` z2Yl3xSd}^LtLc}1tjSkdu1x-BRMQpA!(uLU$j{y{wLa}rN|NzlBb%&2hB^(_uvGps z?JjhsGImz20-jsWuhnOVTbI%G)LB^*`WpODseKtmWyLa94mB<9e#XWDgyP7=o%b?F zy8T$jO6$ZjifF+iu6o}0(0mQaquVJAAcmi4laKPP$18$tuhAL*J&~U%Q~7Bx8l_i2 zplZ#Tfdy)4U$wN&W+YVlq}k&HrQf9Yk|?BL|OUjb3O?0-|0AyLha4 zx~atPB*hQGrEcBgP!$ihOwhHTegtyG^OQRNNSh}WkRX82E;+rWFad{)AF=A!iws8I zNi-acZL+VI@yxj}q{-zx#iIg)09@_;qZ0qVR@=5ilq=~g<_x=6)Bac$`FGztj;8;EUI_$<07Zf`N;u)GEsQBAnC#ayDTT= z%12L8{BaBzsB>g3mY0&Lol3mhq_JLyMLXD2Hx2L+$pe;5Ed!2&YV*j(uo+tld&7YtTS=7zJ4-L ziUULcBD6^O#{%hSrn5Z)Z=ckjuduGje=}L zG?&rv0{5OGSo-vF(D3YbF7+c)W{ff2CU=_t7xK}1H6yZ`IT=we_`yGR!X?Mv$4}fM zw`*>|7GeilgKt51)liWPX{`x66F`o-(s)Pc+v}FzFz9w1V#3@IK5F2u~ zQ-km$a{TotnilL1!}qcqyP4ihm~K8pS{b%}sO*y4OqS}wb9uI4I^rlCQe53z`I03( zy)#2W3}eEgE;Z9GHL;ArvShPIwYjUL4M66&c7U|)9>qN^A;^mz=MmUdjsEIla=f5P zT=Z&>WUlpi@5X+9K4Q?E_2vS#K)rnF|2V7R>{@CI?I46b8{(+;=FF~#(NN#DhT%wh zg)~=nM~ApsO(?|;X%YG&y@Wi&OZc(X$8Pn4*B~4@i6DpnTPwsLD_3O%+M)$Ps^~HU z=L|g()I=gXzx>sn;-az)GauLMX)S~|pyk`l5dVeHYD=b1{N#GT%OBk7PW=Wh9y%*Lt)ANlL`E#Yk0Hh&?s37atupRxNu(y5XWwRK zFy*hP^o2{*8GD5fa^S=PycHZvZKj3RUd-CnVp`5SEE721Z7-{(8-k{L6Hq3Zb)0`G zrdFxnUgq`I{)$}Vug`|Ep?6hOLvb(+Tdr(pMO_qsz*NyKt*#RZW&N>>;{j2z2c*MP z{mQF;^C(Ydik2I}?yh*y?Z0`YG>Oxsl#vrzQAG$k3V~mXqh7E2R6%2r^j@#`C~zTD z(9=B&bNB9+FAHSf{sy6fdW3`IlrZ~Uv=fuevArC>cgw9vlEKpaxSYvvXkFkUzy6_r zE#`?zd+~9WaWLnyKO!V$^bPcSWDWq`k<49x_Va;2z*&&WIM#)7ogll$1srx7^E!W3 zt?OxRpiqd{!P2`x@cyy)`}9f(euP2I@aYfTn8~uc^6W^3X&t8T4}-Gk+r=<{oi&9B z@7=D1)fdY~PtV4uUfxx-rz5@9{N5MM?O(R;b>=_;qvkN>BDUY(W4V!>N;)tRIqyIv zCc_|CH_xA~OCX`~mO~I9u>TPBG7b{6)-k|0ErP$qL-bRyES63wm$bDQoT2;vQYwxDq=u6+{7<#ue)Tx!xWJv(BZ3fBj3NT zAHIS{_ZZV@P0(>iZvtdgMQZb#0eCD-J}9K~%6Nbh8`>bX%)3E1@c~W3p6?}fWoV83 z5Nk>^1%s4YF6R6KYmv0ZipK|A%H`wouX>~WV0B1;Gtk1q`BY9lXyEY?)9s6oKKvA!{V9)q&A6NsNgp|c ztLeGbInl6rdy19^fJa=Y^xwm+%46I?%l$G?mN0B-?IwP%$8F0oxtEhEt?m_*Muwdm z$3cP(ajF8fMktbMmglEXGKJAaEE33}>y^{uFE@|Oy3vsH9`lcQ+3)UNJNuRRStAhz z=UMCOG(i`6hMn*EUh>`W;%iMWBQUoEk&vso+AduQJ&5hMi{Z~yJ*4I69~c05J3)M;#@B7@FiO#&sX$C_!Tb6cb6BFminxy>i-&54G87m5-J>5c7v>FNo`aRv>haVb?v$E4w=7X&)h|Z&@W73~gM4*ndcFxmylG^;q z+{+|%QwNz8&O!>pg~K<#nZ2X^rh!^Js{T3=O^<>8ZoBzH`fP8XjW7~}pec1>?v;df zj3Z#v$H5#%Y(MP&GwaeRu4DuTLqs{wdmBfgOkJD9Wbf%X`J17BBAt`WA<@j>g%kTi zeiE|814FZN$8HH&eSL#>Q>wfHMy_r5lhB9JMA>KREEH3W65f^)Zr8iG`nycbXu(fj zug{eN!6)L5`Bjsw)wbWO^j2mzc#h;#ox_WV`y}d43UFBB`qch1f5V8*aGn|(Ph*mw zW)}3HFM?ufo4@1Z7Yi;w&d6j%NOzMBk6#YlOdYkh7}Qilf&n4cZ< z>CN-Lga0s*tF6+4< z2p*nMqDCE^SxAwe*d3ZtaeL3Wv(I}f{MGO?E>GR9Zo>)`0cqS~Aq9Je26ZmJnu0Ca zu`O(#YfxM645T(&Bvc*iFf@ha8hdf0vFD+KhxNJGG~khPSUW<)tB5iPglVsp<*p4zaa7r33y% zd4-Lpvzv=dIZ;5CS(w?`=oVWX%~*Apn~w4AYc-e-cO3)@ypkINMzPZ5G0FAkoj8gi zNoxRq+E;C+ZbK)BwsPvV8Unwxgb?zffv_osWm!h6EaOeUF%C^ZCnFe%clUr0i3K@4Kz3(M;#MBG@APnzDOHF98u_V^T<8H_q$?*N^?k zceSmcw~$KTi03iIW1oK7U1ql>MZm``?`~f7OP|JXM>5S$Y0Y#whRw2*Xvmrn3-A`R z7#Pyl)<{DW-pZo6yYg6ZoaHdvO|i+{%J^&SZ3_Xww~^B!%N(9d>@b&-7q780B%r&pV$Gl^7B*-9}^rbP(-G(;v0& zpRAo9TeZj$371VVdxgiVv?9Q}8i#2oS@0;_!{|%#wAaU}y%x8pzsl9F6G66o)j|N; zzEM-u3jR5Ngf}NoU*F|c5YcyJkLO+F``T1c_YspTGCkLX5ed@i5^AV4bDI5lNS^aE zAI9vpcv{Z$Aig!gyZFTobHY{VW&X^qI%BvwU=ky)=}UuVoa1BV7T$0~(1!v+#94Cv zQsn{)josi@o-7xhk&=wKaw5nkwjfxw?X23U#GF6vE43vR10GoEYw@lv%WLK`*rKf@ z9WWO}WR^a{O)y-d|~`B&Kp*peCj63>Ke9ELWfkMa<>3HkM}==%D3ZcnT96&nEd z5hSk=-M=x*b@vVdZotV%2qe6y`m#}b6`8<->nHU`v_0m}X!PS-geXc0xkCnc-FKb% zg;46>WLi?SW##eNa9wa?W{<({Sk7lCC%>oJ*hx8EtEY&>Y4y~$BLpj*!8>??r^4!m zY4sf2Z>w9U9&tQH2lqLL&%aVQq9GN=svLQrvk$iYzXd|4?YmVWC?`SzD5tNun*gpIkQ(RGW(BImZeN^LhIxy^z>kkP6E@(~ z>4Y;j=*omhp=jt5K|NTiQbBRB!cMhG2W81PV8LxZ+p%*9R^kZ1$d49V^{>cI6CVfP_&F6A9^0^(+ z*lY?PZ3z`Jmc<2Q>usD`rTWi=Q$lJin;6V-QbQ))*vJ2%(Y zfOwk@?L`2^-N1xBIn+iahR&P$Za(@pjZ^)En-#ZEk|4mxCcuVYKwKAL;KJtvR&+i6 z90l1tisO3Vjb=>J%v1hGhnlU7nRSvY#cLUqyrckfbCEI%uT zsY3ETUr^>4fj99o+u<@_CwBo(shJJDuUdaDes7YON^IMgPMlmgJO?&}%y#U+UR^t} zuKMhP^cDglL5|y^PN?AikYB_|1?+PmDXEbE^%AV4Kpu|)QlNh3uLdcPhj;eS7>ISk z^tpN+!1nDA{1-i(`uJtex_Db=GLgDd=4Pv#I;~ zZP%BI5KxZ5-+sTojFXnLPY-rp$9$0DKUL9$XbdDa_i)AEf0O%qK6=)@Ah(wkenXp# zD>6VaQLm~VveU6sQg(Psr@ULjW2vK98dVFku+dmt6@J9x_CPL|*E)D#b~dsF)tQgj zp7`S#cb11dG6n`tSJ@^T_0nB+N-411cW&gZCAig+4eW_AdT{N@*}1lY{1W2jb$ky%&i~gS z0+8?R`#=sb#9o0uMw^E>mqTmUF?zd?JBQ$SMMAeLEbt{st&NX2eoekP2)lW##|icF zE*H-UKMy}PX#?!{su`5f>(}uMemGW}!2?<*3E}?KNg6A`tGsquql9 zrd>;3m3mU;>NoQs=Nt$8#yGJG~NG#Ld8=+*;Bh3?k$SxJ`*P`7hZsD@Nm@?a)dM#BPO-L74T z?g8VFQdJ+12@n=N4r@BrCp#NqxW{qQR2HPyTZsxKDNA0EoC#TzEMaKr{%E+DqCxdQ zv9jZrtct?_>BdvgYq_3&zLsZPN)xgaJHR!pE>@4as5*$h$^ONE94do9c04y$+ zP(jYQ$8yK`pT7;&tM_`|6bR1^`R7p7ZTkC(CbAdhiQ4wgHpqmJgoo(=h5d;7ge5M^PcHD) z@?u2%)OE2wvVKAA@A-9peBmVYBIxlPIUnn+%f8WOYqY(nbaE2_3~iAo-T|)Hq_Ok- zwWIXG54WVEzig_)p4gscYJ*VWq}__F3yzyU9pWmLLiuo5_l4=a79BJB;l023@Xmsu6`Ag0{{&B0s+)RQ2@HfkfKmpHmzzO2 z*PlYfM=k)+NvVe%QjzXUTvgD{2A&?Zr@`SS)ywYj`tEizf9%BB&Eu*Gk~kfgF}8Bp zDa6RN_nIhVrfmc;M1qY~Y^k{IP)lo$Pe{_mF&0L!HfB464@fz81Wo(b%0 zIx^P2+&>!aC|sy%lwi@g)naOP*CVZXG37YPmi{!HQu{2f^Nj{Lq};Lt>nIGKCl9sR zan_E{sF%exY)juj__u7u3KUgjDK^Y|cTu^-BD&X600Ndquk?ig&bEI>Yj% zfgOnGDo!%HhgKhGpBF^-Pp?C%7`$sCcR&(VH`I<+USfdpXpdKwR7_v9asid(hs-IC zN~quqb3GrJxJS-t`ZqI#1ES)izz)7w)+{^+-bZksm4XOmBO1SN^>Vs*&9<(%eCZv7 zU1!$Sr49)1C_QCf(ZXFDKgDw~8S!7}qv!D)3NT%$*ScLi^tVEF`}7^D<$-=qs@oq( zZQu2EyxDVukitW#;y!ju7E(&K-)=~WNP5Z+ekZ1T;a9UgvldXX{BZwG>LoDqZu(H( zK~5U5Rk5_VvU{0#=HXEelk*H(_$SMFc>1#P?p%Q)Je@^ACr}$TDygVh@bF1QW2a>X zFyndLRB|PeJRds|g0a@sG2O#~g6d%#;9qUsG>Y(?F|EQ^J-+`pSHR+Ne4u4~#DI9< zP}jAV@rZ=~#KkBKgtW6}`iq>rzjWlkbou32@bm%l{}Y7t0W#+%V87}QAB*_U4pkx; zTOjhbtP`E_4PmkA{GMFd%{+QaTp{#3wnCr2QI#TO^OYj{IZ?o45R)}mGY>etltdeF zMf7fYHroU%Nhhwr-P%C`TUPD}USGt){0><=7h*kkE{DkDjS>7t9ra9>vbT~4zQ8f# z`e&P|BI9QwcmUf;Juv0kRS{~zKqg-Ecuhcf4P}|*_%a$!xl!=_bs?xgSgk+^mbOfa zVQ;ij%kO#+aDv+o4hq$imI$OQ;eDWHy&)?(2s;Op1BjE{gICZRkBIv)0sYFM2TW1@gdDtGM zb!;jcnolcIU&*fELJ>KXssV)lC#6DFWGE)-HpfO1Y#GjBYMSew0K_LwfMsfbIv4o> zV174G7VjP6!$E^F7cYFYnAlSpKNtt4Aw5>%MrZgNq2~%)de)V^m(a6Jw`C;O_E=4s zs<$%Z_;NquZLe=&4PQz7Qy<|0f3|8~SJUVJ5_vzpZ$GfGKkl&K5ASOp8eXixI*tfeV2MDT#mdu=;|{@_lvZw^FVap23De)Am35{$*6EAjECh_P+e%^~u$(n(emi~G@9*%WbD1o5yG@3nn#go_a z;D58Mc@3=#sE!)vae{q!7F-a=RIQzI$Di>F^_;5 z1Bi?IWXHYdF1hq%>D1Vun@&``QYKwC2>c%!-^VJ>}c?vWGJuX+| z;QpPbAL&NM2WFWcoH7gATdou%s_{|@#wyyhhyE+ma@%rr|1QK;trV{J7PViBi>fF} z`}@x6YE`kB*oykh_?C0hRuIUwfy^@htm`-dOE&*k^h|(Z^D0Z=L)lzY58&6F_g8|_ z=E9o%1-}aMGQ<1dN)TcD0f>n3`VvHR6czrBHzcJU+op7=Iu%tk0OBx0{n%Pk-JSaV z6;&nu#6ps`1~|}3Em9yu1m~Ke5pBO9_A& zzCskSt)!7G*}5O}=K6SNX0L=fc*25DRWBHV#>3JPZXBESIkQEw?3P`Sh(;;5a7X$n zgAF)#lNBm7L@bZ$W*A~6!35jE{gW&9_oa~Q3hf_FL4c8tLZ$YSC>}sn?m*q(hU|@k zrVz<VBV!nA#YrSmInr*I=UWjHHN!z9d?Mx%2yCVm(DD{ zEOH`Jx~Q->U#;_>j2-|*Wd=h&mdHCxIj4%f6S=O?{qI$#+52A^xNUI*OqqWFm#Xpbu> zfDr=Z61mCdNp=c&GpsrtAQDRt(Xa2%?lrR4XCqX9sHfo6PRG?9!z9SgEYSCI%R^;Y zCHHzyK7x7-r6_}c$q$#umQY^B&v^9U=9x71-+sO}-K$*ZX;$Emu|W`@CUm{bq_q9)|ne90^~Ui&&}clfmpo?X1%5t4Vc zVdMt?*(nNII9%z}b&6N8~f()reO$L0m?nq#-v)3#%^M&-6**|ek9%ismC?Fz@7fxDgTog{)$_BQZ3 z|LNYSSP2Y6_2+I;g2MYQl~VRIh-$dR;1dAr^*oPXi-9^yG%nxflAD{#9-)6UD>SDE zzTtU|Ho-ID%0Bh>XKO=+lTSGK2!}BR9&v5@TEJ4LH3BCqYpSdP9&Y)xSOEw)+!O6# zCMgPrGiQ8HwgO-Sq7l$=`|W4vcV}l+B*S8paW(v2*8+(tQ;Z~tf$mHvEq%bTuT-sC zBM$b#GYg%}O3?*>vW6IIp{%_rYatbcFD`61tSeB1HS!k{!lYc3A-@k}Nh!*wRdO|T z5$>R$n*MD;$&qY1KlxWBuOJOs+NXf(f8)V%Obei4wqUm@LE*VyswDjjWZd}x@=6>t zJS)jK=?s;eAc^+({rGuY*3F}(!s+_ssY$>_Vqu4fS3ylRkdZvPPe<1Wof&>l%{>m9 zM_A5~j2}HzyG5+RK~tQ*6n$F3*VCq$lXCtMmnl7X_GEGpPr|qcR;W{$EhsCw-0Kf_ zOs}~|Ae7O8KEq)Z$q|@=Ym(I(J2`9;BNeGHlL?yA&!1o#X#?_#QDAzOe1iB#K(Mmk z+C+u1vXrN#>PKJ#7N2w9^wuTC;lscAQ*?HI=tC3E<<4($?D zyC5`;&Q?jJ zThd11WOrq?X)>b_1a?vyqf-rQvAH)Vl#{Duf;gfxxP5s zMVl}-3c11@tvYkRO#8NDh>bzZCfJ}l?$ttzdeQuCd3Br=i z@_%{QsBJRMVP@lzMX2j~H72596d9i#^TO2ka=1Ni0cwl+3LQ*wrjcOpgzRV_ zMlcgKBr*&eD{~36{8~MCi;q4Z5*`AzNJCKj@0He3dp98q+z1N=Y>7U^)0A+i^Gcpo z{E!QtH)S|7i@ry?z~;*Mpk9H;_(*7r(fwJI(p04H61d&P{2iLs9Q;Hi+JxQk9D1{& zsf6O`g)#8boqlx|ufdw^V3znR)F}X4Z$Tub7HjvIDu^0WVwx>*JCSm5S7BnDgh!r% zgA36m#;UqK*Xb|$*XZMA6)aYp6AUY)Q`h%$lU8*e*db9ct*N$Xcux#gT z2T0o(th<+~Yw>gkc2-kjYJT(A+&b+stJlI5o)8mtAmxVei~oVRNX!1Hi!@Yq((DbO zUBE!VXOn9oK1?>fs{UGR{4MHQ4_RP^WKD$Sz0QETrnj?rHOVol)O;6tAp5VG@Rpa{ zmDxl((hQ@>;F^eVkjHygWlJ~0Bn=oto02TGLia=y8mgw-pi)z@<>C*eUqWK#C(&3e zM>}SZT;K31zr5rr5tvLyN~@983L9L(at(d?t+h1ZOwxeE2TqbPHMG+_1yPE1GZp&k z4}>49iEE%qe0<0mUfc+((Lqs0Bk)v6kbLL){gY)l7HErATj4u^Qm#)>NXAsgV+RGzpp~DK8@v|`mH!Ji zX*5$x_Q?TWK#N$dM96u!4xdz$!x^o$-%0NBrUZI0yT^zPLM({hH?6d`LpEQmLOb{c zqcMM+beORx*vM|4d$MwV5kX@S{%WArq+|V7K)1Q`0A7(n{#$M^GcNdZeO0Z;phL6Z9U7?9fB2Ac zfZaL>$>Y5s!ZQ}s@${kCg(8lX?SmKX;7IflT-pl9Htg9C*FmOh*iQ$c>^{1Bjp(P1 zP}@se`y5@kF_XA)6}XYN-)azP@v^H)a;1rLwF$jY5444y-{JIq-q>5832Gg(Z1|qt z>pp(T0AaaHqW|0rGgTi>9OlxzsnWc5GGTy8+=EHzV_|>Umeiy*HsU{D`B!f-fXr<0 zLC-R9TO1_i@NqMkVgRgw^}3b?g}C4K9DzsrlF+=LHt&J4&>%=)mqt*liR#$|7-B2^ah$blxlVNiWO!?92f!7JASh^XzL zKOy{I8Ni!=RZa%%cU#K@rtz82TFEHZOAAV-DtLv?Gf~pWn2xI!UC2l@kC)mh?wK)I zwB2;QQbywm#+U$KEOniveuVIkp6H~d@EInt@j(?TVBs@C53bv#GmSA=07g$*e%E}R zY+AzFgs!Vsfb^{)A;gmSiJ|Y^z3Fb7)}CH$e<`cbKMszxinfcEca-OmfI$!n;trH8t-Rle;4@|?HXv3g+zU82dk(Y9mQ z{G>pwKc@_X>$}hzM;vm5buLM#A;H0)s%Sb^Y^pBc`#9ktPG@+=TeJZr*7?42C3%*Q zyJv-qG$1juMju&VYaHlhqVWvGgLirT?;lMk12pj#o{f>VNfi_<&4w}pr9VajqC5Vo z8SZPcy;k}uQLe+8$*1P5Hh(A;UX)%Yust`g}Y(&3sIdg3OJNAHTc1qaK0u zIx>=Ma*hD|SIE*HW zCelR`nxc~TrtEo882v4yjw_)Q#|oRi^Om(IL(xwAW!Pi@TK$HU8#H~1%cOw6fF%mm zDT%l^kg`h@!g_I)!t_*_<$jp08t(ciV4l1xU!WMJ9z_KnTaw$7^%O@t04<-0XmDr& z2krTGDq(JR(LCL0kW<9n;e{_V>V?1-ys|Zj;Ah~2QnT`H0B@PcyQ~U@mo19$zHFT; zEXFPb`Wx@!AM@a)DLZ;ro8NO7ZHAFP)~dDyMPy^sM`OW>V0BfE*Uw9;X%N=91g6dbe{M3tO4`#MqVF)f zm^rcBvm_5_&7>|-!SHKjFN?V@)?b=ZXs&EsU6f}y5m|F@G`P(2Aw=r)*TP03`e|!e zjf4+kEQh-n5pwFM8K|9EEb^fuY{dAhoi}q?k~eaNC7D^Y zYJDu1q$kvD^$%F=5ChCltQ1SBG^FPikM_dBGy&BAYQ!5mi$~C*Lw#@rE z%X#7M?qSb4B14<%@OX&gnz*yrb0Fn9P9kl>N&$#3pc6 zjSi8?5o`k0DT>bhXJc@^t7K929z#5oc8Pq6-o%s~L%q1jg{ysfTH0Xn1jPiHZwnjx z=7Tl$x3(p7oEwvZeD98KO%;y3F%SJ;_A7)N;)}xw4?|TAPAreocPCo7_VjGO>bPe$ z$)tuL_M{X7ch$e*3|k?8in(WT8S!?YX!Vb*^VB?|Avx=CSGdJsi_f^H2H?O!li1wW z+#+AdxPFv@L@y_PfkJ0xsh;I{!EX51y39%i--rq_r}P{YZ*7BLRBglLjeIBT&Evf3 zbo2Z7waf*hQAcByJW>9R9WGoJR9=!Eye4q{t$KHSjnrw0eK?jBs4j&5g{jZpGt}-T zzS`}wt}UMg92Q?Q)x1+XYpw!dWabTCOK&Py&0UYj%}yZ!QI zEEit9V7orDW;hJSJ(t*N)Nzc}zHP|x@qc-Mp1(W7q^^-QOhQ9Yb5~@}3Sr)x|KeK1 z=7Z}zDzGM+rf>;&i1BwQFvDsZ3HAY&yaw*m2WpRMnr-=StKUiLldsMSy5qFADx``Q z%gQ)0P6lo@dn-HC8D6SVDU-fZN)`$NoYaH>$$xAW58&||aS=u84e_G&TV~b~7+;?+ z1@x>-S^ziqv8Se%o(8gonYGv?BbAsRRs)Ql{^_?c{@kCK+C)0C=BR9pBV_Zo*>0@ZXC%+ry3fj8? z5SR5J$`K%P6@xz_WvcYWONHrnxZ69I?9y^kn%D6+!#en>c9orEx-3opo{B|tt*W`x z9lW7i{0PaC|Mo8$;v>EOX`GVQe%tIlWUsGiCv2)ZyPUMdDR`H5Vz zSLa`fYD06eqbwj#iZwc5W0Z`UoD=mJJ5K54qGIcnjQJwbi?Gpf5&uN z+XU(=INIGj0y(~e5S0{RdOrJ+@73S>FRW59*E>xtmQ_D>VC*q&J0>9vZ(jRUgYW}6 zkHL)~zxrX_*KPk<@NX|zcL9pwGp|k|hk2mgVg8N@kijN<55e9`E~GEC%*HV|=nw$j zpm24=h3$zn&F~Q9fmD}<{#)}jAs5^CO1OOnX-7noSWxIy^K;kMu=dv|^^M~mc4H6- zIUzp#tsgm}=QRNNq16?+V`c51q&maCPsfq*MVCSLyAJk75$oFic#RVJrc^pWH?3eZ zwqoP_)Y7ZhPt%ZbzMxw*tm7fP11;HynHRqkNq&F+dP6hhIZHBcmQXdv=c@39^y4aH|8p zQx=KX-^1xfUK>O*7k36?_#EV101Ynu<2Ev=dR}*tA8JcL9#o%v(V&l#*OTyCO+rIx zhghINlB)GExg7wON>{WB{=lJ8rG8R7&Qrwr*>QtuP z58J#;)=$xEFY1sI9EVELV2iTsQ?$V77WLx(_1eVRcAD2bx)Q#G3k`!S@Q8_hTGK$l zFWF>`ASem!^?B$d0|eY-C0Kv9*;vLOznDjz*A?Y6{q?z=`b*Z9&^AgZwxLk>k(@UJ zYc%`}$u^-t2qn?uUFqkqZwAP;IHeoa2&@^q4vU!T{kCyeS4dONbG~vJ_J-k}4Hts1 z%v`-e&z02(%aS<)_NIDRYGx8T>}(Y5F)wNicad%vu-kLP=ji+C3UnpFA1r4YPV03r~|0}+kjCS-qoS9y;2 z_~LLFNzcJ+2}Z!pH{@BZZ_t@5?tqU~L;FY>!MZg@vFtcf!0&+x6P04=+2zsLI;Q) z%{yf$t^$QjNUKgCeKLgnFrWF)P~Fk}3oO3IEAo}z`_HkH^M`zmj#J-ybyPPie^G|R zX19b&SD>tj#|mAgffxI>DTRAQbRrVFAdaH4$6)82%dakRs6DrUaLt}Pn)V?H1l*#k z2eWw^f$yYOpN=f({@%wcsthQ7kNcP4`E|1(EE5(^oSrHe;}YPD%)_S;9^v<2fPdzv zF4e*N$*C&1kA%}Oxmim6%e99HpWhvJH|gg~Q3S|w4)48STBfg%Z4|mokN6*9U%-9_ zx_!0oYytTvS|RtkxGZ8wS+*-^$I8gKGJ~j{y}yAQ7?4Qg%PWxaPUk=t?aVf+0gi_QczRkd0=Ntrs2q?8!k8#hW(xA#B)$d=Vh1M=X z8UMiwyaE0%f}EG2loFMHfc?bjt7iv@_`rn=gK5U%8y;l{_50n`RND8V6V0&ZtbWYa z7kZV}jtIr2RE!_5YL7FEk`lpS5x&*+O(d|^6LO(e!6+AlH?{wO4TLi{23(G2giv|; z!ZS8Qdg#2Fv=ENyotbZ}y{C|i z``MhEDS1ml1*@#_ZTct`4$jJM%nI@wVPPuv6lAJO6;xhoG(jPB9|daP5IfiZFmg^o zng#8eE!*s}tIM`++qP}nT{gRH+qP|Y+2%KO{);m+apqzo@@hxyh<&v)^Ld}OWCi*d z1z~BAkP(@B(wPS=O8oNnX3=FM!idBk^4`7ISrz^)h zNGH7@6Jik*_jM1Qu^tVBeVqbdMM{bZ$&;<%r4}Vr_7@X<4l1I>LgR}sBtOikurk`y+;;|vM#}yDb)IkcF zi3og5>sZPKuk$c;uLrglTtJs4U}|8~{jH4zwXx(j%n)&@C&U_#I+A9Oe}^(L`CIVo zw3FMm1&qjo#Zy!(m&7?+p7pZB%4CzR@-1bX-%LDJiDzwSr!cvQdR`xrLR7D5aQ@%%>uuLS@d0d=jgP1)FvDh8kPw@9rV4=qi7ZwLq8ledB0f1qeB0T4NMZcyPV4L;-5%*zRHyuZ3$g%$`mENU5O>2vU~CD1uO zJVL_&f^p%q!&|aGwhQknPl{!D09HR6KS z{>%*>XIH)fI?`UK=id?|UMxKn=2R-hV0Lcs<|xExcTn}cJ$sb5hInvM6i$zz$`8MIgo7ay7PWS6=b921C`O--&=_WDmS?uMzQyy2*MV z5WLsj3cEIR7vwjTvA>mxB#r=dh;4??8Od8PpY>7GoMu$u0Prli(|RPQMSG`%gL(hnBiF@ zg2oc(iHCit#~y;=L`cZ;P!(2UTaFn7f*GN7)>5{i3TPg1-}D%JxROc0&8w=FX(=+h9^V<7Ra0IXpB;OUAjD*I23 zqA>Hxf@I!_SKT-bU6gw*NAmZ36vcGRsG-_Uj3g@fnm6263QYO8-0~;4@-PONrqYXI zuf5+WJ#=OB8cbZ&r7~>Hd$If0&Bc1y_v8;|jSM+2VLt-S_U_N}1Sp)pJ2esi+3(tk zzSx%<)r-kafeoP}x@yqPmVi)99)#93u=+UIknVAc`_^+Us%MZ0602B?iUei0Ca+!Y zn_CXysBxPXbD(;}1V1{YzEpWUq{M;?dnh#H_4CY(T^=7Pv1D=)4h9bg3q3eUlU~m( zZdv@C?jL8v<;DF+7D-Sv_G0HLgdmteZ-baC+UguN`%B4V_U(655_Qsb77STbzK(pz ztwn9Sga8OiPMd4lK(~3}zd1;`@sy@xVV+NIqNZ~Iu%iJD- z9ITLMLj4Y!8VmoM`qBxl2_ka#cQ3h|@jdUW_DIQ3$~-7-`1kg3X^f69G1XU5Xooy! zj!z;S=AYj8#nSJ?X^SK!LsydIP*%Hunz{|%LYT~N+4*GW>}@bf!M7_#G?k9=3H^9* z%*iYP^~!o)pJpre!1#=$5m|vM^>zFauWs`AF<*H?9st@ZezSob%?~DKG-(I^GxPu@Q&sed3@Rr$LfR{ zVa?hS-lRqwaw|LdT!z1z=k2mBG^{@DFbucHqJ__J1r&y@}vXKwRb7^VI{q8&C)AEIKe>Hbuxb&fs* z6`&}jJj|BAgmkbWc6V8Xpns%Q3!{7CgQ+@w68O5V1)I##Q^SyWD}vw0imob#$sh_5 zul-nSon@|l{d11Je;BV!*>UUYP{}dGIaUiE<(ZlYAmIUV0{#wQj+555irX^qtzSd1)s`36E1IngQN}^P5R+`2Se+@Mmu_Ao>;!Ox9832lyH1H0EyhjHp z50-N-FWWkEPt3FwFsLiQHduQINF6K%_%3e*#f-lth!g{w8N#gDewB?2sl*PHJhb%o z1etykX{H=(igkF~EUcNiz+l~}6b~#)Kf*PJq4>b)AlfaI=m_-Ox9(==63qk^c|o}A zs+*9@R!5@Sz$y5InM?;wd0coj$^AJ!H19Lq+i2DOntPdJbAp)3X~ufUa0J>%dgKbU z=_6A%W^p-_35MA;HLJ0RkeuyOZK2emc~1px*HNxvpD?@2)~Ci#EEPL9VwT8zQ$QTc zY@d2_5;8+?~zi_^>appI$lqW}&pmk6H%v|4*}S5imQ`he;I(9ADMTPNE= z!)B3+PT&U-N>8cSKzg%%3Y`cCaZv8l9C{E0^b|tC=jF#x$uMGF4ku9m-#!qFDuON3 z{Wa4odQm&(XTa-oaU@Mh^|}bNXm71i(!-_~pL%Z&!PlnNc=$Si+1$FVLNo2(F589Q zPV+k2?{bBf`9|erl!BOMzF*Y6p5LHMNufPXl0*dB$x4<^()nm(4%_KwjP)&ZDUXJ5 zIJR6cgKNRd)VTc~;Nv7)C^ko`tcwJwSfxQGU^cKsg%$c0M$3NR_){`eoLJZD2!8^9fdoLpfFDVkBR8Y$JL}D`=|VWiB&o76u^Mn7zvet;`T@ zg>|rvnbHO5K_ zW6UGA#D1$30OQfyzI``pcx1|+y8k;(?WH;Q>IHC>)MvW}C_GFu`)=J&`k7_6LVDUI z0ch8_Ixp>CvcIa6Xs(=kzwVrS!BIaxrav)&+D&&_pX;GihFVNA?yx*dSBwQAAtRzshwf2+IM)%>E$7BE(UC+p+??^VY5Xyd4MtG z*%_4bE9CeGQnn>m5+BO~SDV9(!=jQs?2HIGnz=bFpOpD1;q>-~?B7y%NMPS%VGlbz z&ep9`!=h42R_I{E)!z2A+JfWzRvubA-|DB~(F^@<4V)H>^%5cV^F`MAtG{=Dq$A9RKv z@$MI37N_lYd&Ie_BgOcMAz_$Us31ID(_~x*&61jGEXv54Zu!>}1oWpp4-Ymk*5mc0 zX*ot<<8}4XH8?0_jaM1xP2lpr|MI?X^T11mp6;JEMLdWt&0U}Me3$DjKy$(lFW6AY zm%q!_J%A7E`m&ecXr1^wc$>l<{!2kyWfL;6?55)*4pdS93=mdN*s=z2M*yz(0}$l$ zU?F6E6AT`1f6WH-SRe8)wO(!u2~-_*ykLRke#p1x(|v9#@FEUx7e`FY}jO4h9dk^Ti<}_;Dn0&_1q<2wCF-SSFIIER=AJ`Aa>n4`9cB zNj4C0p9Pu8K)fg&*J$q$rzr*Iqok_*oOs0o89cA00HYPtJeP(`F5bT>W8dVNp--;% zkuS>j!F$_Piw*N-1wZ5%wJHi!E`Qi-gA`BuFYIX1nah}z`$Fgv-)pqGHl^EH{6;U= zTkLbY)7@SnE^P#|D{Kjrbbo=uLJGwh9y$z`jUvb_>D>n~rWX-BqS@F+2qSc`S;qjT zC~);zt7TZZvi4QOBu;o>=)=nzDrliIr(Z3|`#=7YqGot#ffIGtt!eVoKn8d5&g{tAgqL)VnN zUg2O!r2|*F#*U=IZ!wv&)>A(}G9q?0lDUOB1)U9y_E3*Ps+-(C5Ob@fm4so<)+i>? zQ@EvIqLH9M6^Ncei-*iqJA0)q9|tG1o4h_{q5_l|!k?XHBsOwd=k-AHkS4(rWh`GHQGsn(-VGqsIuK=QYZ4-aI@I?GSY3yedsALGw5 zt3Hu-j5UggdTgdmKdBG!mC0PAb7$*9i-?QW@H>(+-G01m10#_tT^@s};?oX`FfaD> zc=dc4^sUejC<|lUZ*q93VP;|bD!1DOlvP1!gK$h^c`z3PhSa_~L0B*g8UOo`X4K^_ z=12rN31n>em5_}Q)h3VA42z~nCanqWG?q_9LNpyFlW9}-Ay%Dd5e%{H3WtttnPxKA zs-AGnV#2U^6j{ z@q5L8WAedQP-qsJ2G14U;V}xK=ir^YCO8r<6B-;1rc|B4H-hxn1tiwA0>EHZUl>s{ z^(-8*pM!z25U;C-nvvjtznBWndDAj?R@=9M#ai+&+p|zMXgUlklQ?bam zRC~nO+6yoRW!vFhnr|P7l9}8}C{^{YzmR)BM~fBbGpK%z-HaV z0FfpNRcH*n9XQ_lug~T5Ow(f7!m(k~8AozNByeq`axn8BD;t<3aM9Ey<%E(TZgJO= zHR%gsOP?}sY@GODA<1UBnImVvx)~X%7jy#H%H^<8Agl_LWODGW-J+9dD883XB7Zt% zpxgfL%ylKG?qqRYM!pOxA4$zGTC$Mr%9bfCOt3H8GRaQslP(g8gBVglHkf>A$`ayS2|2yk_#r_|op`z~!?_ra zGLihaY**_#UenZB3q)}BWuShf$Y*zyn5RuWYo=x(EvH~8Y)z|p%bNOMz0brS_Q?~|&j z1430Uq$Qe&1g9314uV*vQ3*XRzEpl@mXy`&=V)uZ&Wa#&1d_M}iu9HL%Ktr3Gtw{5 zzO-Xhjx(R)-EYpl{*U`}9rn&)1XHve%FBAVgUTw95ih^Nx=ju$*>Hi@SLVBzR7sUc zBo?SQKZb4sd;r!wHhDu&v{Jq9;rZ$mbSNm3TiVyG%7C-XRVD=$%ivmIqv6Eq@J^V| zB1CyQ2!!|qp1N8n{MuCzJu(iLHtok?d=qOM`~LQ>GygwT@raEhG(Wl0kOCrbIuM#M7cD~wy0 zS;{@TB|BAKdwaR2I+*Z6HI|*nS_Q@n`n?e!e{x{`1lD<0w{_!2$6YX0UEJ64xsfl; zR1oqT22UtQm&q?D$>!h9`nZdflJPcNj|M}Koq~3xhPCq33unC@1(B+tvkjWAMl`fm z{68IVNi}2{tS%B9jBV_b8AklW;K<`k{@^yLcBkb)7ZD3rQnY)E-zxb zv_{G7xYDYEi()y+DGS;lFAEuW$}WuFk3#|%4#E{kuMVz;(&YG`sw?EX06gYiupM^u==hxjZGmC)!nIFO6 zL52}b1=<`j%U-eaDp&yI7?8YT>?`O{+q|actIV1WNj!##OnV*jCQh68a7M0VX_1B8 z?w{859&=#pfb@f01ZxC)g@1N;mrZJ^XtY4GO#4=LFLSWl16fS7x->?&u>y20uTj57 z7SIur&s0OKK&c$M|FU3vO?BLGfVj$#TUIKug8Wf za-~4uEu713Iaw^D>Sw@1IwyJGFY1wa#jU_jM~=?+tCqScsw-Qu<;S;+Fs)}kNAFPr zE?98@^whKKK#I=xM2Xlq)g92}`>-cYFXz3_{);iHR$D8q)|x7e(B7%S3DCft($cMs z`WW@kL~ZiR0~YFc@-i)_aj@pe0^X=7B@4PShrSe*ac1f%KvQ>G?pM@dB%jRkIV*&9 z^hV~rTA^F?tExjAvpcI?xV5X>wV(Lvy%%_;VxCec2Pjis0$7gwl1_TRK&1ErHag2@ z29k;{7Kc5R#eGDv-J!SfBh(nFoRncDWT?2?ryD7=|78@VDU zT_s{rLuqG$K=Pp+JDkuoI~aM^ZT34bmOl=Y6FG9^(uc#qG$7seDYH&AWCtULJ0Bex z94*_NCck#bcHwtaO@QahYH964%&ZG8Ixr&Gy&StM^!TE%4u5k=3P!i!)M{2Qr)-8BhtBc}n zq=RExDp0;I&BJ|r>VR~Wj+pcA?*7R7v$~tndEffr^GHD^cVD3ld@ggWsYTY3lqbjF zP@D=)Prg|&Ip}nmcE$3E<1g*6JNTnaUiRrf^ZNpB%9&9;6uGGLOxnYu3G}*1IRXpN zkIS3;ZdYOp)l>|e)%gw@@Ou?SuyeG}0YEUhNnvjFBlgtzc5)%cOWwoPQpqX=)XT;< zZ;(_ekEky*6%4bmzGmE&$>V`N7BjWTV)0^H^ipj^C&xB5G2lrx5e`%wLp6-k1u^sv zWa&hZiBI_MpYu)NX$h+yXG+I1gdqXZ(7J)i`HMU+x=lnYI(v`H%nR{S)0*3gC={kD z-wqC~W|M9cfm~hgY5M$M%rR@PJq>M@7;>ils`|?grB^q>_(A%$L(&pX*~#`YWS4q% zm>K!dO;gs?<^G*`1#NxI3$480fXnVTC!EoR-|zgnf5VpG(hQ9c$w>xY^fC|b6eUv8 z|9$vzIdc85b>TE#=(k$+d$q;FTLvQ1a z3*}9(J(_4&Vm?xWPu`z8qW!CvzdVFjVf|396jf(v2FfxyCcT(w&1Xs)xu|_*2zy`a z@o9>fO#ki3OE~n*m2ETcJzt{y&MnVKb)n|6moMeERD*4fAsZHW#>KNk2K;t+U#NcbQm=-s0Q5G5# zK~3XbvQZ0^_90AgnRe@(ELlJlHzn1OGZ^jn=sPmM}uOpiE)Zj}o??rwkcM(dw%VNb0pUe-z*?3h=NJ zS)qEBIKH$O-n{iN+dusZHcPe|iKdyReSD5#+L8{`ju3^Ch@QjG*d6A`5d=WJG4kap z*knz3mK|!Xtl4KZ=BL_UFmAP8a20Q22a!0RyT~q228zOcG&w*!SA1&-jLP3fm&LI= zx-!A(lZ%D4M%BP5lU{gwV;AesmS$@H{s!`L=|6|q0CL$@Sl?}*<4T`IVh{A*0Q!a1 zSaG&6M*MRwibn?%!_mqmt;YP9w(W&(Ggg!td{yPoNs<96Z*cp1`vBZ&0RU zN-kf{=}8WUl+TtWe1X`G>^cs5EAg?|T?@AR!%AujgdgJPec{k3sJ{G}Tct}HBeRr( zCml$r{d~K=)py0!{_5U~-f|gb3#IVP$3M+^E~r+1Yf&2|Ls%M(H6AQ6dgK z>8MDi4!X925_vc@0VV=zpD$koA*wwEX!oeF2u?->kUh$zUn7r041J{vz%q6h=+Ji^sc5p8)<-mL_<`^IGV1@`P%C$}N zVjHg{CJh!iNYEw~DW#HvZ3TD}1?knjjUnClq`8XKvrlColJy=x4;T2U)n}U1_w0^j zZ@>TA#PPj9odBpt{GX&qp@}>rxc=b#0JWcQusR2>u+=0Y zG`+60W+S_JO0USmXpPFYreV5}yy=s=+6uIx-vf%=)g}PT{Ct-8{`MzSCjgxa`c0X9 za9v+fwz=Yt$Hb8QCz{jBS!gXd)tw_^CWk602&4@y_2Pb*aI)fS7#xL1nyM4x{7A$@{H<{~gT>tAoBNDkqG9c)CPm z02!b5YXxNPzm7vSHGd^bH_U!ZZkUu}fSH`^8N5lWE+ITcnu7gWt80u{n+qnJ8+-C@ zcDY2(UFE4*>1kCS48@;Yy^E;xPy7lgmMdJv7lACY-dUXPj2EHATL5v;X;d;gup*=T zrT?NLiNid5Vd?ufW`tD$+s~hJc%ExIeX9li2!051LG>&L3SYkcosiGh5c;;`4@!?g z-At5dnpo@Hls!ZALz9^Tb07@i$cZY)`< z>XMTxD$F8%%;YLZg=!tJ35!2qg05xiy{_`K={VWzc*5T?IYDU{zxHc&6T%Tu5 z8NG96oaV9dA`$ujOPqja}n zM%2qld|2yL2>5}jM6XfJQ~L;Wtuw4>TTYoejX?nXn0tD9u>tp|nras7k-zsqB4q~> zZ&jS?2_WSY@MTxKn+>o%wz>zfzX8;%0IT%$wL3ccyj^kV7ro>FfM@IGDL}hD^AjNZ z4Il^jCjolL0lP;4`~SR<_5XMbxX`y=^LI(kI+baIySC(m7s?gE!3Cjj1w77lY$r7U z%x{jm>H#)~FhTj`+7SP~k)j(-fd~nUP_g3mWh>%$c?hS;6U4||USNMO+;+#UgtoH( z)^9$&blp36y4}P!>#ViELP^3da88)uV1P!$olwP+kUZHL!&2oM*8{g)#(=92#Ga1! z4N=F6DB_k+Jgjo zDD!D$5)9?+bQ;6LZrLiY)!-9iTwplzEJ9bGV+2cTtg6||^qy=mlsUK~9k~ohABYQR zElaCEgXVxl!|f9zsVh|o3%Kag)1Nub$lRm1t!-)Mw z@`vn$6MnjE*&&I`!!Nd*jj;Qr{t%bJ%1+@H53#Sb0ql`Fw-aVB3hccn#S^uMlv_n{ zXWd3ayjVnCob9K_2#cdxW@>m-CHE_rWuOi@ESAA0WM7>UZkf%W#Io$?LaayfmC$dWqn_NrHCC&-rv7TCjYG`Cv=bqW#u# zg+!#ob3q7QNy)!rWSBO2f$8)b(Y6{E8QVxSRntGezCK!4$;r`GX#zf5_M1hqYV_e6 zvZe9wO$6NXLvoas-d*_mc3sEo zS{U>VKpXp?kBK%Q-}`9RJ1$a5wdB%o@yfWvRg+9|-SeCBI! zwT^xOK%et_cVl^7vF}Omv=0Y094tnV5uB-MJ$fYtlLc!98jMx&V!d(0$SBb=M}_v6 zA{n-unoru05K}YjO!2SyZhd~s8a@tA&hLlTZghQmRG7)0Bo+c@=uJUUC$mJdp4J@y zyLU*JyzUO46*l{UN?VX z7TC3ti)`7QH1C0sXwZhy?_(SZ^W6sTt&JVx@U{~^(n5{SGt9Db5lI0ZY08@ekStlk zgZezTkez4&+SERp)V|`1^R1`N+2%ba9UWvRW6CSE3LTz1o_o;DQqYFN@8TCDfx$Ba zauBglIIrNEPKX`$oc;B)_?+CApp!2@b`Gp3&08Ma=b#%ouicz%{5-MQ*;$;}viXRf zY_Z4Hj$Ac>G{IlMllSkhsBd?#jZ^>4HooX@%zB!AXCdGl@Y|gzE8KPehxhQ{3a&M^ z_h?n{1(k+^RiW9j5XTo`g+-Z|1x=2HmTqadUVeO1j(>4qlk z{7Mio)pZY@d4WjKYO7U^_ev#PSDqyQM?=%1aR!RA7{}+jpqNx0r9=WX4b`{d5GT<} zE|kyA#jzs>TQGN$wyX=wn$je|q4qPwhd-c5dj{aP!+pbc?~k*(a>XBi?85utFX~ni zo8S4S=^pvbcefwp*Z(#M34i>3e+8*rM)+X?%{>3krha=&jnh~qvL6WXCoo&sV2^Pd zx72S}s}xa)YF$H_4L`nHUafurAK+|{wVilz*Kc!FTVsW?lvzKTgbaV2U(Ca(tfa5l;|8m@|Hyd`;`k6X>#MTCMOWl!{8!Q7mu67>W z0Qw=eRqfyN!5VC zKjK80s(8WX5RC9RLJk5(iJ*Z6$D)dg#L=xq_kM8e)JZ%dw`9I{=M75@JPAVs%Is3n zTHRhZp5SU3rKhw7yR#_10xiC;?M+qA4;Ez>7-@atHw|QA!CvSB#8F-&N0(}nBz}Uo zLleBG*QnFn?lYe+(^UZ4pQBlR(3gI_&^F+8$3O0Sj$~=p3ExDk$?wpXcwFhydR8>K zP$6NIUup2M8&F|P8PuT~CNyBU{cg09WEI+-L!>mvg;wwyBM)vj+_TJB{ktKgiyX)8 z(hXr^nNLpi1wOsk$9cao*m?9;@g*&`3;BLp3PY+ISnX?kW1YfHl{5fCQI=Zh&+BB>R~+jEt|V)7P=Y4GagcIfXGxB z$7ioKH-px?Umq>zRfNFK^7Se*e%ENHxk7uFbU;H&Iv>UlJQIV71FMF`KF){5pSy<| zM37Y8msQ{4$^NpNub6VG@v`d{tdP=SRtoK4d@pdIt}96smydu!7HoD(hrvu#Xcjm; zvpIiDC3F`^nafs>*Wc-eaC@M_UqCY~sb4fijKo@YlaI+x;fW*o^BPHVO zdr^acjxsFon$NL^YRfo|yhu9Zfif4mw?uL*c1MWo-2NV<=!58QZM`+exsqB@2DMkS z;^Dm*P-$FeT{c-F^g;F0Xa2f00=fp9da0jhRZz-~i!EnoFr#1|Gk9PsEJVG%#MsuE zsy33sS=LLH_V|Z2a)H%l?;uN5|RF6CelB}P#H3);Yso=SSMU8`=m5_xGpod+abU>ADLtxHW;g%CdisfPNH}!#EbG84> z#Vq|5)$X%|$MBO^Bx0)DA()tY1Xt)0DzjeX>{Bu~z<8wvORwrOK{(b+( zHx=P_QCFDMcTT$?*KLV}N(FJPTSw7ycLar|ly$q=YV;*&!Y3{4h2SRoVbDsh{( zb8DxTRrem3re+iRnix2_cmX5^=M0XVKHcIrYcBbv$O;OhoNLOPAO(3OXuD4Rlo1+vbS74sQwt+jO-+ zXLqXx;t0=UMUHHLQE(DAS5k=k+_pfoH6{Rr|W0bFC7F*sOIQ zvq3h4Et7WZ4wP;_RWso{7-fBuX|fNidW>GWIjc?USd)4>v;vn;GmhV3jyZU$6Ci}MS)-EWS zz*tJi;ZLMIbe6r)(YIvju5(-MWy~WRpeiR5XRk{+s7Wi{4H~2x`|**hsR4hIc?5*G z!vz}ekfGkt@GLZ3M8cRQ!HgIGDqBjJayXW*5~nh6^V40O(q?s{MH`Hge{fl(i-yb| z1#+LN-3(BJP%ZULEy~P{C!1Yi5QXC*{bqaUeRs+`F(LR)SGbFsmIWP;W3{=&jrV<) zUm*K{mhMKF`-6ypFxK+{w6g{jzq?O^a$`*0=OCk8eau&3U3ebZVlp%IuI6tYFAdVUU==_E`7>(>FAx> z11)8Mb)_v{$?R@doa%RPX=y1sp!X00U`>rl>XAw_s!WS(7?bvE<^W89kQsYtfzb<> zDDH>`v<;P*oJMktV_!IAI-qHpQ<`DhQ|x%CQ+^TZAaK-UqAgF*Bo5l>jULkW-Z^th z5XDpiWn7~MuV;h4#=eFO@;9dK-`CbjYn0)3i{{b#%f4O-ze?Uu-kZMOe4)hY|A#J-H76i{=}VF_IO_cHJZsp{Uw~!=Iy*EnGe}&EcF952IEWqE7SoEcG|Q z{P*uz06>kdw3;UYbp_M0e`5<+dif+S+%gr}_WGLIJ7Z}&Va^u z+Z;jLPqOuZ@~wUI*|b^(sMfg{0({EKLOQ`O0>@P=IWek9n`r);(<^dz zwI)$*qVsPS5U*RP1kr1~Mtf!KRgTWtE~K7kN9Aks`r@a0gsefo;~zEuU3&cF@8`8p z1+dkTKJ@?eyd9g%13`R~QRL@qm+hO43dq|4_H59|!yYe)s+YO#d}a*0s*1wXRG0%D z5XVSXK^0V@eo;6`35wj%V@X)Rwb#6cjUg&jLOY)8Yx%s5?=sMwVVOC@p*xIE7!<|} zO+3Ctc+TvYeUypwC0a``2wL4-lelWl$RwzkFLzVHAEuP8^X3Z0&st!?XC&H8wJ*vh<-udt89S}a zY>e1iY?nvwqbs8<)pcBm2Wl?7YRA$gS5M~@ z*}#)=*f0?z8}e_eQldVe2;Tn25`TXmBIS-j&ZykWghTmDv>~MAl!)ipy^4!w#MPJF zoYO&oV|iZrCg;JkRgyRW3Kx4BUBEzdepGJ&ZlDkwj2l@DurK>-pvd8N--SMuwv zI^&kud_lDq0vn9PVFnO*1*KsF8!YG&kZ@;kd#qaUdjig2)paw!+4{kk<6n!KjYRRY zY_O2k+ug_=;f465&6a!$B|Bm7_sWLrdQvW7$vcKAO_NG1!H3Am<&Djt+}$wTwo;4<&JD^m_=AlW6irC{fG6^IZ|p zi&}3{q}B#Z*e2tP1JKc%wM)9Nl>=4+zrVk~v=iqzC!>kl+~^g`1ig2BO+lu?vEOJ} z?otW;=X9Vp8Bi&UATG3&#>E+_1LG_JvsIf@r$+T7Z+(W@>eG4*cy%Eg$I#{^|0_1z#!O(u(w;m%ljP zC4*IM-XvJ_(K^N=7fK;xn&?jrK&P{tC*tV%G$ZgDmGWeg#mHn#r9h<~08xabgcUQ~3KJJX2{j1N;0=dHAA!I_PY*KheXECLwjlN#69BhJ-du7q+l=gqe5>tyVQQqd(EUq`cN z8-T~dS-^Dob4PoPZ?^a_uhP>-da+*L1NAu$-e?#jX=Uw&&y8~G+mfT00%#iE<+<0M zA^tq>y3-JB$dAaJ_gy! zC|tc^dn0IZYWA{qf?iVxpBAOeV`i1lOW0hG4`otRP6o=NdVRu-i-@}ZB$c366lp{K zdYDzK)YrBjDHL@T_PXe!gxIC0$^w%Ngiif>RE6HHT@R~0PJeFH&8h-GhWHIO8-2aZ zdYczN?cTU%{rt&w5F-I}RcYjxACZGSm=1;H8y}m0p6TGOR&kDW37x0ct~*Lpg*ssA zm&Kg;Ic7GrG3cgl7JuVFD?QlU#n;9x>TSfk4mMh^of;Q5u%7_3#{9dtm$a3dSgH;& zTZFz}p4p}j$oR_b)0!VHbMZH zD@TiWfTTsK&lATVRX|rx<lsHba z1Wy1&qrISfUsaht58(${Ha_Ss({Tdli7oOc!9^Pt+1!#6Jk|Uu!*It~9F_G+J`8^F z3u5-8K;JLdO=mH<-&WQN!4QpV+o}^66y@F*`66mhIj#{)y}6#bY9_Z|N{QX-7Z$WU z&s;Yd4|Lk9!QPEEAb>OA^88=r7$4K~a{_u#l}G`fJ$vmZ=&iV4qlt>AGOK<>DxKEk z-U%8XQ@zn`{5|a1nqfJE8$89F(j<7sL4ERkvL8S9>7xJ>&RLDzDd@FlnZPKyR_53P zg+zWhW{ohV!^|634bMl+#{hn|XGPOKpO+!oteg3!uBXhI@E4%ll}t9FkmOaKFK;rY zrF$i6WN1Bj)>*6hxS=o)kx9yi1X6sm9p2ZSXg1G*%vk1T_4>|Y#`KuZC(sTrV$*-< zvHS#4vdvu;T;cMy=kKFgK^`fR6wbv#t82hE8i+np)_L|23eUx?{9Qlt0@pRd?oxXIhzkPx znto%FK=gZFe*_&hIcdKIt zQ0A%y4cV7l>+<{Y_C@GEy@l$}_;#3e-fczA+C5DtglMu)y?puIP|gg*sF^$liZAhn z#XP+@HqLp(1*+hVErlkJI7W0#d5WeKS#m?+k!<##Cr_?~uyy5=-vHFgj5E`WB^5Y^ zJR$q~C__f%YaCue_N*oGNk4`8WyID4PvrGs1YYx!w-MWr&?$qV_-*-=C6yQrBreG| zU(WDBL`H^)1PqW@wl<%orY9dqVQilnlnt9%qaCdJ;Grgvk%&^5l394a>zTR zML`)rw8WmUN`{rZRV#-W?$g#UYL!nnK4K*<2=%F&GdFN63FQhO&Hs?cE$EEN=g3?K zzyr!pAjJBHZty$>F3Ib|>C`nO#5ft(9|>)Db()1GVEPY{?#9LE@NsO%AC%^d%e6O# z!(`gA#hQ+Uc8$d!vO^s4XG+}TLp%>4E>fqX(VJX6DlXiY^PFoD;MWG62f~TLG{%}# zBH|ov+k2J_STtwIV2ho>o=z!PL&+15#XDLGom|~K_j!V$|IiCs_`^^L{w?;Nl>1gX z+&Cfz*C15#x&wUH0%#+qEQd-|WX0nDF&t`H?IG17kn=7(U(lw|q!_ImE!y%9%;{T* zLFgwi6x^wxNy1xhH0a-E!)cC{T45kCcFgi6;bN>HXUuVnm9QwWmO%!QjU(?DB2SJ- zoX`p`>qL}FQ3fi8BHp$_@M^Vh7-*zbu?1rnl`lGWnkCyhfxuyxoOP*Q15>&BO=K_# z#yE0K9IBAG$#|N8ej0kFKV}Zxg0Q!79sgd9c%rrwbL2;(EA{RqesImmly>I=SV(sslx9Wn357B3~d(P zQU8W)`9l@g*ne;iD}h4lvm83SCD|x{Lg|S3LG3+DJ>cnFxJ|f>zl$gW?T%F{ri8l_ExcVbV0kO zA!cS~=9ul6nVIdF9Wygy98=896f<*TW@e@sVrFK0_w4WdI-}8Obgt%NOG~ZpzSvT) zT2=2;Z=v>4rN-+c5G{NnFnB}v-Gw0bMr7=T8L#c>}fJI6!!PNSNG0`G^u^eWz zyIWYX7I=KdV1x&e{-92(!}pMADFN@nO(&mF2{R!>opzypcI`ZE6%i4MN`*YDo+Eu@ zNIYc?wPv1RIeX7-B9TZSN|E+JHPvfc5Py9~Md=Oom36|L)`ykW<*-7c)YwP3wBk|5 zJqPVmf8>!2wSpzo6X8~jJ|lF{BKt#dtbCoxt4AwZV3k zi4RBxH?pi7`zmxV*|mI(lm>d2zippB15K`=9?+T(7SNPh^?lU9o%4ph-ZqJk;Hj;p zzHC`KukvPA7nxnpxzw3$_u^F$S$GM4p_XLXxZ4n|@mK+EE!n8$jI84dfkR}c#q~qy zqG#lT78Jy^()f->xZtUm7Qv^hX9QKw2SsyN=;l!fK$ zbc;RMXXg&uXksPk>b%oWT?nvw4{CK~nF0!QF84S@tXXd}U4_Y`lv*Qj)=1^Ut~Gr~ zjWQ9`lh?#_UZ5H&Q?TfmXR-@k&_KMpygJ{hEbq?IFE_IM(TyESVINEe1W}YrSB@;L zIXIa|C!G;46FjFkx-jBzGqowvOV>V$@9Eg z<-_I3cT$(qeqUU?-m2N43CVe{@PEF5_IpA+x_hWu3F^>-soDfHj{Hz`uJE zvc&Ge3khPmFL%21#pJs$hlsdj>T3v>7O6BTerjh5nT23FmhYhnpL_IQ(6oDq=F zsux*fDP;}&r^9<41oFt8m>zH)0@`G=@b~oExRNaw`sha?GNpm4@FP1COMz~Uab= zY5s=akjF5dz@l!yzk^QEg$h3Ambtqm<>L??smQK}T7?Pw+Jg#0Ka%LkB8^yg=*_*P zY?*T5pUeWnJpnEITI#QC}}3&#htLWET~Dj?$97(@1te?qQE(4 zNlivu#W?hwzP!_IB%9QbsQNrvrR}qG{sLmS13Z&c>+%|`TP}-CY|HnA@@*@A zw{J8*4{iJiBlz+BsS~TYGNMqm*gTJGj%S&XT!l3PAf-A9Mowhd5L%%z7kSirvA#1x zOHGd`+qIQAA(IES4Wr}FN!H_5AA5Mt+O{8uIQt>D=q$&4Qq`Ff=c&p&_?_6)L*+|iYf;l4J7p!mme9*Rwx z&DI`O8kC#*Wc0h3HOC<6^GBK*KgQ5|N>VWv>QHIa&$2JqvJUr$1a?Hw+}96XZRq^X zN0Gj0sHc^a<}m z=*1x?PN~e(6GsSgwirp9cWb~UrIv{CO#ly5AX2;=fm<8vcUgc$P2sq^jYYs{Tr*Rk zp-d$MO4PbwpJQXfODXYUT@eqWl~z*)S~&*R=fJ9PwZ5HY__av`QQJ&vugOV6!{0Qy zVSvY5l%M`wfm`Y3(4U++YSoKbMB5mXpsY=z(-8=k;}B0z8#=*XQJ$EpUA*KZ#JNv( zb=-*cs``YwzwrFSrd3FKH=(gNY~mvG<2DWoBu?PhL5A+!Pi)PF&m1H%mC!5#r0L0VfSCeXE*I-Z)K3;fD-}v7TQ0 zoD^7U_@=C1QISPtt^B0R`l!a3~hc33A#x4vD85K3(chD2#Xw zTrFAkUj=!ZXX@aw*CzDWv1u^UC6+VA#JFj>064y(88LkXwSNP89NTVywdsRf06(=r z_zhJ#3TiOFm0X1WB%ZTXSgxH+X}nTWqy-yjc@G$0@jU|yGlQ=68$fSXBM0vyfA98; z{>#yXsDXGRX{Ez_y6JZfQx&D@d?%5kc+$l>-i>%#=P5yvp+ilM_v4XmSI2x9C0*Vs zl@NYMk^Gs`72n%!d|0wW#7=ooeon6DJ}@Rn1+=-OE~gV%n-6ompJp~_G0v$5t_iz| z1`1fuaZL;l;q$$T(l~wRp{;?yty|emCx=dZ-Vi_UfI=*?S>L08nxJtEM*e-f5E1s8 zNnQ>ksn68&<9KKzefqKPdAZ*SF*5e-K1y-(XV_D7F1_;)eKs_;6Z7WSvqxA_0{j{> z$?&73a)o;(Htw3*w^1Df+h|?k)UXZH&xssJ;%N$|@yDm@CPAyj+jb9_)m9I0EU8$! zGtR<0EL(A~&pfR+ufh)vL38q#2eZ<}FJ&r5O0QIR9C`lbyv)G$7XJKoTFG3&L7Y00 zn*X7Gn3&+5Z_BmAu$vxpYyx&?C+z-x^#;?P35coRq?QhdZQ2>24ACA1lJ^#j^g#KK zgfBg*RmhhHPI65ggcqJ0cyrs*-DnO=)l>Is;|IICE=TB*VnodcH0w*kt6EOF~kW0pR{Fjx+*Q>*Q!X}R`k)VW7pSFfsp zgVeEDe9Zjk!QD?Zu8`#D9ZXulk1Kc8;Ux8Z_M5m^Txx6jHxbq`4(A;QJq=d&IXK)n z@|(+a4Mau;{`u&M5}t{Jz|p~If8tctByH2mGu)N_dlB;rcP+N#luCt;Z8i@TBp(h$ zE%H7OeDC2#e;1@m(!0RR?^zL2uMO6d)v9}b#+1a{f!^w$?zNdFojMEY z_`J95JRh*-@LMyk`tF+8sOzpTPv3E9o}UJE;~oN(9N)*L`~h_7b;m^gTevLqQ?}LN?Pt zt1I{O6$?sye zhy1jUaI@_<(uD|m10Ql*a*=L~SH9o-!$Z(fbl74EifWFG?73)9yq%B!l%bBpcea{+ z6bYad2w(7+SvZ&xIa4J@TD{kT7$K}4OdWmb_#}9k@;-|^Wmbh-zjVGKPcn2=giP@( zY=Q#5%VKvd_F<%-ag`DY{k4ui7P%g-SxZ7`ec@a{Of(>Pf(H^GcB)7`yyX2k3(b&dWN+Ld!Vu#(dHp1L9{U-hun- zF`zxwu5I5NR-SK;Dt?vg+qt#*9Ty^`t9=Vzkqu4~95Mj}Lg6kW4yWTq60cE#DZ;Q) zms)t?^7F@8lat0KR^t`anWqsieA$ocKfxd#asgZ+F*s!#JI%pMPyLqP1___S?O~fW zjwnt*vFp+JkvD>5%>%1%rGOM;Y$fsS=R8z{DuoaU|@HJfwS(PAH?$-Hiie(`t z5zd^9kiF;GV8N9Pv_GeK^rmI|IA3znuDwXU#KCQt5ifY1`Yw^Tp1XSzX4aqj!UI++ z6F|I*%EZm~$HLt(;K#I*_6%qZ0A$mE4M(;4H5UP^NgHL(XVH4@=d!*?M(v)ae;w4g zNhOecPspQNb@^QBq+pW+;ALYgx-Oml<=eJgR(vM1GgSkYm4LMWnw$q159ER|H0-{e zmY+P~(emr#qr^*>f+&dba)O^JL{sRQ%!GNF(ye*T2 z!aTFoGmD;N(9g z6v`wnx3ft^Zb#tTpJA{QwA}w+h@eQvkL24(L(Y?LV{R|F%~N};MVbAXmx@JU`C_wL zR6e{8Dkme^3{#FfRKcdP3%W*x=uK1sTvW~_idL?$R1RJC=&F}a-f_57pBV;(W}KEp z5usJ-ET$J+IM}F`hHNqh#IlMGwNcc~5URoBM^Ey>1fn&LsvC>xeH_LTo&$x?^t!XR zJ7@0v&q?(@^uSBV=S_`D3*25eBKkgt>|6i1>mI%-f8b4@5P5nnJ?(MnjN*0sIZfyU z1XSk$Rofy$4!1#$2kX%wxa*|YR~^f}7HK1qX3YE2#`QJ}C!o)gStMAH)3G>~rF*ME?* zKhe?QJ}$NlEL;-nfVcKY#`kdhUv!{0W3V`WT5gE8D)`>YXc2Mcx1@Gd5T@;O(pgU$ zU>6UNuV6UDPk!nM1-w*zKV09RZsZ1lHdmGjz}A1jL!Z*@4wGd9zC$~D<@S@`twmib zVpenA!+%lTCDQ~9i-UaHLILMxhkrf)E8o@6g9E?KK+fsWN4>w1+3B{gb`-9|nm&(_ z-CoZkp`pYtmTy_G$nIR(>Fmd6sf13$&AG3n<~dBy=PU2Z4Z9^)I}nCCJ7;wvi9)h~?;(bUAuRv^^C9E1<+U(#PD9=5WuV#`uxvRlRS zd}a^JV+f#$g&LOt`5sJQ#F_5H^22G*7ar81&xZ2+h85O>m#G@|4!WS~slxd1HQmPX zururSL#cr1uCm(ZSob6OI1}#@5Pp8x>tt)^Nd+pWva=v{a)G=&FQ!+(#~j!g*BTBo zEEL#&uuf7c4+&$*Ow``#Up`(_5H$^eeVC%`XKi+N_<@0hEdtB_5c0eHz$qWq?e?UQ zMugLSAB##n@WjKZ_Td@WOMuW>3u1f@3i!Qr4X}Jg0U3t@ZD7?K6~TGvwXP2k5V5%h z9FAF1{!gE>q4drBryukoA_!}p`q35*EDP{EE(6-NB{w1- zcRPvfqAh|4oG?&JiQAH}HIc~rUqn@KNHulF!pN=gaGHIZr;CypF$9DmAVp~gp^#a_ zdt*QAaDLx|tlX}V!v1#r2gwWe-|lBw9vo?gBZ*#WtK-q1Q?fii5$46cQ|G!Rn`!T-^ zk9If81r(E&dD5aGZB+dZYH~8w>a$l}Y(<|zsH~wrmh2$>9ZD|n+=)>YL9_jT7Yg-t z27#ZtGtpBxx+=a+XDTb3u9F( zQkr!8e5Aas=g8q1bD=uB;<4&Ah@eWUP)DP@Tx|u1(%BmxQ#7N9V<*#^$h{~qdn=~( zH`3pPs^JT4BAOQ#1&^2=C%)3mv8Z*uqLKTI%A2q9r{A|XtlAiQMg)>JD%5RS9Dn|k z^x{e_fxK=TW3m*#2xiW~e#0k&P419N{O4tFaZ_xFdjPq%)`u_H!fZMeO~|7gYszF6 z`@8y=wji#Eng(?$?!_p_nc~UUQX$`F$CNZ~C3ggktO|}g0t3QUD^zo_Wz$I`?_qi& z)Sfd^8M=|OqnS6lxtlQt^AE?i?K86YqB-l){wrS+$*5vEx(<>7t}}R)_vFEobMrD; z9lP{*uae`iAovM5Jz<3<{lIKa2=NyhEjOwUBJbrk&)DLO!(29sU!1jP`>zEvtuZf~ z6|e!g*$#ny>Igoej$M61D$+L)lH;hiSC!dm6bu3G8QU@98QVqmT{GxMzb#X!Jb8xs zab++~4hydPW_%$XzO2HibQs3y#o3c{>6-O#QVa&C;ka|ZrL6M!)>%c{jS?N=DMN0@FjZ^z=>&17-DY|iervR29%Z|+ zV=jor$}{;i`zo$-VZWz=AsPfa=1!dBz=%uiN}_0zZzdVo28wdn@uGi|jO^A6B6dCD zxMcHa-9qWJkq{-C9#}owPH5~HOJq4SRUt?C8X$y>*d^{?R(oO?)`&R&$Xx0Q3tD%u z(EJ4Aw&pHYWvx2AM9W0d;=F4$hrKOoLmGbrgerD=?q{a6o@Z*lvVuB1_j<^Q4O9}u-6Oi6>UFQz$Eix( zX@=J4M1?F=r2ErJgW3FrEIynFp}YT+yp_ivxAzukL3RQw690OpIPA=N^Z8&q$9uB) zuAM|sH-Db45Ft6zf8`|YTr7}R{Oto`83|{z9cXXZl_GsveZHP4D-o0gosC>;k|DAR z;TX{X9Y+W6@m7CnK~4fX{Gg4=jRTi$eM2}0lGF#B!tIBwm&WTW4i$a6PyQW!e{DW$ z4ZNk{;J`)R2#~+yk@Y>vH*4~L!L1bc;68C+ee(aHK%O)do#x2 zNtqx@&};TKX4>8Z#ZmSQX*s~SrH%3N>^k1= z$uP7Fc#EHcMKY<(9)zsD1-_i6-vIF)A9ur`rdXssfD}9H;k&7-6jQg;0Ivqd71&R+ zwv89mauzgNjvWu47GuctAu{n2(Y=SXAdl zqbgQVV|rrvE~wJ|PgV z@aO^wj0y^Cd>27q{eE8uf5L{^r!jPm_iG?5^ofbap0vf7p@{Y?@IU-i!jc`;XMVv& z$TPj^ONd2-1-9ys%PZ#0(?686u+i*WSkl7fd2hkB1D_q-M>K@QS_0r7PgcjQMVGpV zoju{u+$VN|mEL+KeTniWDTWm`bfjJ6vFM`rFtCiSea7X$A6~1Tg-MoL<%v-48+Grc z0ZOx{k1~}YYM*Du0CVh>WA!sbv8$Orvd3Qo#J|Y>-dxAL15(&dMfb$x2E^UvrKv0@ffI~fH+%wsMv2;y?E`x+)6++sY;ndD; z-PfPzD)Ny`QHGGHBZctjsf49Rb>sR5=H{Q>`mI@a*}lY>y)zZ>vJ8j-VKcWWw5M0w z>j(B#CCT?U%yGIAB`^;qSY|;Uj`>I?PGT-qT!{-7E5ZZlC%rj?Retpe+sK;NuSbJBZs5(70PK%g9Vj4ZS5Z$e|DBj|DGn&Y>P{5lh6o=Lz0-9 zi2TMJJG)ryW#XDfg25O?sfT&!w7J!wR#;*(^)T%i0%AdqgxoO6kX&|1#Hnld$HAw0 z)e`*0(6XU)K5FnAA$!NrtdpJu8ul0pE8}8l>oAZeHFQa4=~;*0v?4V?S5eF;`)b#1 z!Ye#ODYcs10*`bx9!|QbEseW9u&PG-Kvii~LaMAXPz7B$c}+3R6l-{M@1-4|Tc^Oq ze|*+AW3cUK=b<@8MFz2$rX6$T0u1WrkDrr`k?R@pMS1lJJKBG^kXQ$ZfW;>!&+Q3Wo$8XRp5yTybueze(b`Z#_;y2KT>GI`=z|~RMECz> z)88>ZQ%HTns7IN()tzSZVO*0r+4J0Qx)*<^)D8Th?z9-q~_HASgKMWGOQ&lx-C6+Aqg8pj~q%L&h<7TCjB0zkkynM*ucDB+-ryYPsY)rgW$f*TXI*e!=vYwlj>Qc0mzh|$xnqGP9S}@mQV|L63E``SZ5xw7H8g9KLyF{o5Y|wM(Twz;H`)aI z4JDN&9PaNB|9HQtTXV|KE$HA`I9L?I1yBi#42=2ohf?4$BhEH_nRTQFcR0N|TeN8* z4}_NdQHb_KXP(aB5FGgBvrvsua|-iFD*NRVyzdCsqr}gRn*;NTTn1`3B}l8&7I~E% zGr?|nJ^8zg7?$gshj#AjW?#9LS57Yce`lv!7luFi)FAtM$IQwKq8mWYiR~;KtZHXD zdKka#ZlxVfxrI-jF{l2Kxd~6eQj^Ws*Kqme5gC_m92Jq=%{M>COhs_hLH!(OHnqH0 z>S6rR({xAV=}EA`N`8*odGWv&J7+aS-0!z0AjlyCKAgCR|IFkH+R`9UooPjnAjXCY*q4(HnZQsAaLSh-+{w+J|6ZyIk-xLs_VZD5BiN%bPtfyOH>d344rtjI zc?}U-#c&RP7ZDOZ)43*7CVU^M`TFg>>`UxxEw9DAnFs?+Ak4Z(?r_(q(~91Rkb18e+^>Hp#EPh8bm+49vDTF zRny2Rx5x&7+U=E4z*MRK9y(@=kdVU8c4@^_}?90U-muaxotw*2L6!Vfx$u`^G(er zI=I?yn471JR=U1S{Zmvp!qhej^T8SLQ9DdMS9ca^cqU&TxgnOHeY#UCY#MY8k!JH4 z*PHLGtoUoPvwJZA8Yl0kh^f})^=j2@4+4$1%#Mnl&yCd`1uj@flzRjJLQPJWRIfLu4SWg1pKzCth5Uul) ztvvjOPhnlzp)K+MH^ik!ld4sMfX^0a)Ix4u#HjX*_n4h?BG92uBzg5q$I@uGq1<)eHd-Ta2?& zglk*jWC7B_O9OI7Git?{;gnww)5&O z2;(*Knnsoy#(}5%`{qz!!S1%l@c=5)OL9LUXUEzc%2xJ;w9Gtd?m8_l6B=s1o+LC9 zK>?FP`59g80-{ye3ZYbBlwJ}q>y0ZGoS=U*M^0Ryapj2?X@nB6di;leC%&6c!nixxB^a9#I@oxp2R`R`a4^R9k}>%7<7{RI79eeSMyZ~luipMBm)O* z;NO3s+h2=d8;)Ks0+TG{&q}Zvw9tylkfmb~3;+9aC-Ue2;aj3UMri#TWZQUclYje= zuOhz9tjX1#19MloTrc3_T*;S-XwqGd$hPSe6S9?X$lp0AQmYH0Bi()oPHj1O?JQlf zk;=}>xYpifkgMOE{%JP4#Lb#~VxD;AVj(BtW{@f3{JAinn>lKC8U2c9=g1iqVqqd1 zy^5k6snp{41~~a&i){P@t)y7>2yJk-0Sg~%FZtlV@+tpgj=$HB^4AGUDlfz_Cpkwx zyO&5=(q9Ya9t>vUgay_Y1`uSP@`+6OtMp(`6Xc1<-(m!uWFpa8(gfq7?~j3Y6!nUH z6H@*o_9V3eg>6*1UbN8%v5!bE#o@XU9s8$LNLJ;EJ2kWadJ~J|NxzHXA?(S{0 z8D&{#rBxZ+tp=+1czMjt{+cwFtMtWZq=r%5sPYv1EIF~q6Rs};6oN{JaCTZFoN1)t z{KdDUl5b?O=f zii|W$>D>yfq6a#N-y6Ojx|CxJJ#etIEW-4XhRvw!xl4G@IO*9ce42&JqxYCXo0S}l zz#R5QPVj<9D1U4W79c3wf8-AZHN^jTMAWusQK#Q(-y5^Hef}ZA%ymBO$&resgL?ZL z^5pl*WCUko-Am03u=!**RVU@JbQWl6Qc?S9KwZcG!ibaXu!(CHAB#DDnSm<5BsYsq z(f$xg)zL>7;FlSMi#KK%+QLu4NF-I3ywl4%9Rqs>Rq_0>wEtF10p0fY-W-HXc$0E8 zIa%6Tv0zt1Q#{}L*KBXnuqB|A>!NvK5|_Xgqg>}J1=ICw4IinX6IomQUoXDIAay%M zZ?2_zW%%mJHXK`o^DJvZhEi%;KN$-)_@$n6stl((;N$gUNrlbP2=sh-(1&fF4!tnj}-@#k9mku7= z<0;w4-rtEQ9i%)%(EH&>N4{}KnFnV zRE@PJzm|{xhe3W|tE$yJy5FQZtYP_C%VjvY0@tc~pEg0=sznZ;f$>R~kBp)u^4Zba zUZ>qQ;f*)EZI3Hku8Y9+0Wp*FOU>HD_FQN3b%Vi5k=v^Bvu;lo5>pQJh$!s7 z$c@kR60HoK1&uFKtx^4?DR!B88nnKS!O=IC8y)t1S{GlY&JF9T$XTO}$LQYZvq%3J zUQh0hzK17=DqfjasT0)wz)73YtwzDaIc_AMO3%2Fzcp89xJ){plJe!V>mm(I+pcO!g6z zgFxu){MpY0TDd{j0zH&RMUeP+$uEYIT=ciHuKi-Me@?QjQ_Fb*WeL?+&aPiR&riM~ z)OzgqO!;^X3{G8KTlQO1(w&h(S4RUUxg_a(fJ%GpM-USpE2=>M17fgWXB6y?Md!y> zK_&KJCo-o4O#bI)wX2Vy^SA>yS4QV6oA+thqu>-*fHu#pV0sJxgPEQOU2sq1H`QUh9~p-bt(Q zA31p*egZu$(UE%m&}E|RMA@XOg)`ixVFx7dhx@j%75{}!D=A{1#HLG33N>f{CMoH; zTBT!%Ukw&~yFWa_)8Tbu4QzKMGd1R8-o~{Ze@s{x(UHo|qQK=*gPuPlL|OR8;Cdgi zHVMjgCR`)a;5m5NWT^k0-PrTM)A;@-Jz1(@+q2+h2w1Po6OA=xFJ86ozSB-xLc8jB zMri)tXcslUaU!c-LRz57-8oOZOhcb{yp8s=^rsm2@r3@P{%*OcqN~r9b!0y&Y&qm7 zxuDyvAShosa}Rq$yH}qH00M7jtRVOi{`_x2^q4^8>R&R&A3^k}FEW^DXgixdi$Wz8 zn!IYb$}-sh9BROFUT}Q(ur&3X;agA1s1g+xp_<3uqO(p-1wni`Kx)3g(}I1$ACYVU zeG5llpb@4Q*=yooC*B$=#DQLnc z%1Trp0VztaJ$|s9U_~2ALaDxnXpQH_M0Z6}w*iUejSk+8s8%0J_+(Qq9OdCa2a4mTRZ(^d7${h6P4M4Q-F*hn1-^(Z--}jxq1BckewyQ zQ}y8{DIS9@AD_XBh$_&GGZomm2BRu0cQpbjgIS!B|_Et zMyRyTrj`=wZ0v&N-R+X$NZtBuY`f`O@&U=qYW9QSB=rJ*SAuro z3&`ia0XF_LCp1x2KLJ~@Ea!lsgM;j%fO=9H3Hy*LEV`0`H{HaaeF_ys?S0t}CTNba z;CEl&pVRu5D^+^1zxDrM3BD~#cO%SL=^ONvOd?8&T#+Uo{bhZx0)fCEAxN9r<(DS= zzAHx_hj6mI$~-piqrbuCN_EwUR>}lh&w-u+yOF>5xspxsu0x=IXUK?==+@V+o= 1.21.0-0' +name: eck-stack +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/README.md b/packs/elastic-stack-0.18.2/charts/eck-stack/README.md new file mode 100644 index 00000000..f301bd12 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/README.md @@ -0,0 +1,93 @@ +# ECK-Stack + +ECK Stack is a Helm chart to assist in the deployment of Elastic Stack components, which are +managed by the [ECK Operator](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html) + +## Supported Elastic Stack Resources + +The following Elastic Stack resources are currently supported. + +- Elasticsearch +- Kibana +- Elastic Agent +- Fleet Server +- Beats +- Logstash +- APM Server + +Additional resources will be supported in future releases of this Helm Chart. + +## Prerequisites + +- Kubernetes 1.21+ +- Elastic ECK Operator + +## Installing the Chart + +### Installing the ECK Operator + +Before using this chart, the Elastic ECK Operator is required to be installed within the Kubernetes cluster. +Full installation instructions can be found within [our documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-installing-eck.html) + +To install the ECK Operator using Helm. + +```sh +# Add the Elastic Helm Repository +helm repo add elastic https://helm.elastic.co && helm repo update + +# Install the ECK Operator cluster-wide +helm install elastic-operator elastic/eck-operator -n elastic-system --create-namespace +``` + +Additional ECK Operator Helm installation options can be found within [our documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-install-helm.html) + +### Installing the ECK Stack Chart + +The following will install the ECK-Stack chart using the default values, which will deploy an Elasticsearch [Quickstart Cluster](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-elasticsearch.html), and a Kibana [Quickstart Instance](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-kibana.html) + +```sh +# Add the Elastic Helm Repository +helm repo add elastic https://helm.elastic.co && helm repo update + +# Install the ECK-Stack helm chart +# This will setup a 'quickstart' Elasticsearch and Kibana resource in the 'elastic-stack' namespace +helm install my-release elastic/eck-stack -n elastic-stack --create-namespace +``` + +More information on the different ways to use the ECK Stack chart to deploy Elastic Stack resources +can be found in [our documentation](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html). + +## Uninstalling the Chart + +To uninstall/delete the `my-release` deployment from the 'elastic-stack' namespace: + +```console +helm delete my-release -n elastic-stack +``` + +The command removes all the Elastic Stack resources associated with the chart and deletes the release. + +## Configuration + +The following table lists the configurable parameters of the eck-stack chart and their default values. + +| Parameter | Description | Default | +| --------- | ----------- | ------- | +| `eck-elasticsearch.enabled` | If `true`, create an Elasticsearch resource (using the eck-elasticsearch Chart) | `true` | +| `eck-kibana.enabled` | If `true`, create a Kibana resource (using the eck-kibana Chart) | `true` | +| `eck-agent.enabled` | If `true`, create an Elastic Agent resource (using the eck-agent Chart) | `false` | +| `eck-fleet-server.enabled` | If `true`, create a Fleet Server resource (using the eck-fleet-server Chart) | `false` | +| `eck-logstash.enabled` | If `true`, create a Logstash resource (using the eck-logstash Chart) | `false` | +| `eck-apm-server.enabled` | If `true`, create a standalone Elastic APM Server resource (using the eck-apm-server Chart) | `false` | + +Specify each parameter using the `--set key=value[,key=value]` argument to `helm install`. + +Alternatively, a YAML file that specifies the values for the above parameters can be provided while installing the chart. For example, + +```console +helm install my-release -f values.yaml . +``` + +## Contributing + +This chart is maintained at [github.com/elastic/cloud-on-k8s](https://github.com/elastic/cloud-on-k8s/tree/main/deploy/eck-stack). diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/Chart.yaml new file mode 100644 index 00000000..839cb5bf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Elastic Agent managed by the ECK operator +icon: https://images.contentstack.io/v3/assets/bltefdd0b53724fa2ce/blt77c2da6e0198746e/620ac24e6662ca0a6f617114/icon-agent-32-color.svg +kubeVersion: '>= 1.21.0-0' +name: eck-agent +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/elastic-agent +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/fleet-agents.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/fleet-agents.yaml new file mode 100644 index 00000000..252ff850 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/fleet-agents.yaml @@ -0,0 +1,24 @@ +# The following example should only be used in conjunction with the 'eck-fleet-server' Helm Chart, +# and shows how the Agents can be deployed as a daemonset, and controlled by Fleet Server. +# +version: 9.3.0 + +# This must match the name of an Agent policy. +policyID: eck-agent +# This must match the name of the fleet server installed from eck-fleet-server chart. +fleetServerRef: + name: eck-fleet-server +kibanaRef: + name: eck-kibana +mode: fleet +# elasticsearchRefs must be empty when fleet mode is enabled. +elasticsearchRefs: [] +daemonSet: + podTemplate: + spec: + serviceAccountName: elastic-agent + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + automountServiceAccountToken: true + securityContext: + runAsUser: 0 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/system-integration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/system-integration.yaml new file mode 100644 index 00000000..a08dd175 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/examples/system-integration.yaml @@ -0,0 +1,133 @@ +# The following example should only be used in Agent "standalone" mode, +# and should not be used when Agent is used with Fleet Server. +# +version: 9.3.0 +elasticsearchRefs: +- name: eck-elasticsearch +daemonSet: + podTemplate: + spec: + containers: + - name: agent + securityContext: + runAsUser: 0 + volumeMounts: + - name: agent-data + mountPath: /usr/share/elastic-agent/data/elastic-agent-08e204/run +config: + id: 488e0b80-3634-11eb-8208-57893829af4e + revision: 2 + agent: + monitoring: + enabled: true + use_output: default + logs: true + metrics: true + inputs: + - id: 4917ade0-3634-11eb-8208-57893829af4e + name: system-1 + revision: 1 + type: system/metrics + use_output: default + meta: + package: + name: system + version: 9.3.0 + data_stream: + namespace: default + streams: + - id: system/metrics-system.cpu + data_stream: + dataset: system.cpu + type: metrics + metricsets: + - cpu + cpu.metrics: + - percentages + - normalized_percentages + period: 10s + - id: system/metrics-system.diskio + data_stream: + dataset: system.diskio + type: metrics + metricsets: + - diskio + diskio.include_devices: null + period: 10s + - id: system/metrics-system.filesystem + data_stream: + dataset: system.filesystem + type: metrics + metricsets: + - filesystem + period: 1m + processors: + - drop_event.when.regexp: + system.filesystem.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/) + - id: system/metrics-system.fsstat + data_stream: + dataset: system.fsstat + type: metrics + metricsets: + - fsstat + period: 1m + processors: + - drop_event.when.regexp: + system.fsstat.mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib|snap)($|/) + - id: system/metrics-system.load + data_stream: + dataset: system.load + type: metrics + metricsets: + - load + period: 10s + - id: system/metrics-system.memory + data_stream: + dataset: system.memory + type: metrics + metricsets: + - memory + period: 10s + - id: system/metrics-system.network + data_stream: + dataset: system.network + type: metrics + metricsets: + - network + period: 10s + network.interfaces: null + - id: system/metrics-system.process + data_stream: + dataset: system.process + type: metrics + metricsets: + - process + period: 10s + process.include_top_n.by_cpu: 5 + process.include_top_n.by_memory: 5 + process.cmdline.cache.enabled: true + process.cgroups.enabled: false + process.include_cpu_ticks: false + processes: + - .* + - id: system/metrics-system.process_summary + data_stream: + dataset: system.process_summary + type: metrics + metricsets: + - process_summary + period: 10s + - id: system/metrics-system.socket_summary + data_stream: + dataset: system.socket_summary + type: metrics + metricsets: + - socket_summary + period: 10s + - id: system/metrics-system.uptime + data_stream: + dataset: system.uptime + type: metrics + metricsets: + - uptime + period: 10s diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/NOTES.txt new file mode 100644 index 00000000..cfd41883 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Elastic Agent status + $ kubectl get agent {{ include "elasticagent.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Elastic Agent pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l agent.k8s.elastic.co/name={{ include "elasticagent.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/_helpers.tpl new file mode 100644 index 00000000..748ca7dd --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "elasticagent.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "elasticagent.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "elasticagent.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "elasticagent.labels" -}} +helm.sh/chart: {{ include "elasticagent.chart" . }} +{{ include "elasticagent.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "elasticagent.selectorLabels" -}} +app.kubernetes.io/name: {{ include "elasticagent.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role-binding.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role-binding.yaml new file mode 100644 index 00000000..762a59dc --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role-binding.yaml @@ -0,0 +1,33 @@ +{{- with .Values.clusterRoleBinding }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .name }} + labels: + {{- include "elasticagent.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- with .subjects }} +subjects: +{{- range . }} + - kind: {{ .kind }} + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} +{{- end }} +{{- end }} +roleRef: + kind: {{ .roleRef.kind }} + name: {{ .roleRef.name }} + apiGroup: {{ .roleRef.apiGroup }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role.yaml new file mode 100644 index 00000000..5d97ec7a --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/cluster-role.yaml @@ -0,0 +1,22 @@ +{{- with .Values.clusterRole }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .name }} + labels: + {{- include "elasticagent.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +rules: {{- toYaml .rules | nindent 2 }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/elastic-agent.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/elastic-agent.yaml new file mode 100644 index 00000000..9017e5bb --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/elastic-agent.yaml @@ -0,0 +1,89 @@ +--- +apiVersion: agent.k8s.elastic.co/v1alpha1 +kind: Agent +metadata: + name: {{ include "elasticagent.fullname" . }} + labels: + {{- include "elasticagent.labels" $ | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "An Elastic Agent version is required" (or ((.Values.spec).version) (.Values.version)) }} + {{- $daemonSet := (or (hasKey (.Values.spec) "daemonSet") (hasKey .Values "daemonSet")) }} + {{- $deployment := (or (hasKey (.Values.spec) "deployment") (hasKey .Values "deployment")) }} + {{- $statefulSet := (or (hasKey (.Values.spec) "statefulSet") (hasKey .Values "statefulSet")) }} + {{- if and (not $daemonSet) (not $deployment) (not $statefulSet) }} + {{ fail "At least one of daemonSet, deployment or statefulSet is required" }} + {{- end }} + {{- if $daemonSet }} + {{- $ds := or ((.Values.spec).daemonSet) (.Values.daemonSet) }} + daemonSet: + {{- /* This is required to render the empty daemonset ( {} ) properly */}} + {{- $ds | default dict | toYaml | nindent 4 }} + {{- end }} + {{- if $deployment }} + {{- $deploy := or ((.Values.spec).deployment) (.Values.deployment) }} + deployment: + {{- /* This is required to render the empty deployment ( {} ) properly */}} + {{- $deploy | default dict | toYaml | nindent 4 }} + {{- end }} + {{- if $statefulSet }} + {{- $sts := or ((.Values.spec).statefulSet) (.Values.statefulSet) }} + statefulSet: + {{- /* This is required to render the empty statefulSet ( {} ) properly */}} + {{- $sts | default dict | toYaml | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).image) (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with or ((.Values.spec).elasticsearchRefs) (.Values.elasticsearchRefs) }} + elasticsearchRefs: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).kibanaRef) (.Values.kibanaRef) }} + kibanaRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).fleetServerRef) (.Values.fleetServerRef) }} + fleetServerRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- $config := or ((.Values.spec).config) (.Values.config) }} + {{- $configRef := or ((.Values.spec).configRef) (.Values.configRef) }} + {{- if and $config $configRef }} + {{ fail "Only one of config and configRef can be specified" }} + {{- end }} + {{- with $config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $configRef }} + configRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).mode) (.Values.mode) }} + mode: {{ . }} + {{- end }} + {{- with or ((.Values.spec).fleetServerEnabled) (.Values.fleetServerEnabled) }} + fleetServerEnabled: {{ . }} + {{- end }} + {{- with or ((.Values.spec).http) (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).policyID) (.Values.policyID) }} + policyID: {{ . }} + {{- end }} + {{- with or ((.Values.spec).secureSettings) (.Values.secureSettings) }} + secureSettings: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).revisionHistoryLimit) (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with or (((.Values.spec).serviceAccount).name) ((.Values.serviceAccount).name) }} + serviceAccountName: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/service-account.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/service-account.yaml new file mode 100644 index 00000000..e8bdf0b5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/templates/service-account.yaml @@ -0,0 +1,22 @@ +{{- with .Values.serviceAccount }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} + labels: + {{- include "elasticagent.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/values.yaml new file mode 100644 index 00000000..6e3fb400 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-agent/values.yaml @@ -0,0 +1,257 @@ +--- +# Default values for eck-agent. +# This is a YAML-formatted file. + +# Overridable names of the Elastic Agent resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-agent'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Fleet Agent resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Elastic Agent. +# +version: 9.3.0 + +# Labels that will be applied to Elastic Agent. +# +labels: {} + +# Annotations that will be applied to Elastic Agent. +# +annotations: {} + +# Elastic Agent image to deploy. +# +# image: docker.elastic.co/beats/elastic-agent:9.3.0 + +# ** Deprecation Notice ** +# The previous versions of this Helm Chart simply used the `spec` field here +# and allowed the user to specify any fields below `spec` that were templated directly +# into the final Kibana manifest. This is no longer the preferred way to specify these +# fields and each field that is supported underneath `spec` is now directly specified +# in this values file. Currently both patterns are supported for backwards compatibility +# but we plan to remove the `spec` field in the future. +# spec: {} + +# Referenced resources are below and depending on the setup, at least one is required for a functional Agent. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-setting-referenced-resources +# +# Reference to ECK-managed Kibana instance. +# +# kibanaRef: +# name: quickstart + # Optional namespace reference to Kibana instance. + # If not specified, then the namespace of the Agent instance + # will be assumed. + # + # namespace: default + +# Reference to ECK-managed Elasticsearch instance. +# +elasticsearchRefs: +- name: eck-elasticsearch + # Optional namespace reference to Elasticsearch instance. + # If not specified, then the namespace of the Agent instance + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating an Agent instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Reference to ECK-managed Fleet Server instance. +# +# fleetServerRef: +# name: eck-fleet-server + # Optional namespace reference to Fleet Server instance. + # If not specified, then the namespace of the Agent instance + # will be assumed. + # + # namespace: default + +# The Elastic Agent configuration, the ECK equivalent to agent.yml +# NOTE: The `config` and `configRef` fields are mutually exclusive. Only one of them should be defined at a time, +# as using both may cause conflicts. +# +# Configuration of Agent, specifically used in Agent standalone mode. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-configuration.html +# +config: null + +# Reference a configuration in a Secret. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-configuration.html +# +# configRef: +# secretName: "" + +# The mode of Agent to use. Only set to "fleet" when Fleet Server is enabled. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-fleet-mode-and-fleet-server +# +# mode: "fleet" + +# fleetServerEnabled determines whether the Agent will be run as the Fleet Server. +# +# NOTE: Both `mode: fleet` and `fleetServerEnabled: true` need to be set for Fleet Server to be enabled. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-fleet-mode-and-fleet-server +# +fleetServerEnabled: false + +# The HTTP layer configuration for the Fleet Server Service. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-customize-fleet-server-service +# +# http: + +# policyID determines into which Agent Policy this Agent will be enrolled. +# policyID: eck-agent + +# DaemonSet, StatefulSet, or Deployment specification for Agent. +# At least one is required of [daemonSet, deployment, statefulSet]. +# No default is currently set, refer to https://github.com/elastic/cloud-on-k8s/issues/7429. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-chose-the-deployment-model +# +# deployment: +# podTemplate: +# spec: +# containers: +# - name: agent +# securityContext: +# runAsUser: 0 +# daemonSet: +# podTemplate: +# spec: +# containers: +# - name: agent +# securityContext: +# runAsUser: 0 +# statefulSet: +# podTemplate: +# spec: +# containers: +# - name: agent +# securityContext: +# runAsUser: 0 + +# SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for Elastic Agent. +secureSettings: [] +# - secretName: my-secret-with-secure-settings + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# ServiceAccount to be used by Elastic Agent. Some Elastic Agent features, such as the Kubernetes integration, +# require that Agent Pods interact with Kubernetes APIs. This functionality requires specific permissions +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +serviceAccount: + name: elastic-agent + # { .Release.Namespace } is used here by default, but can be specified. + # namespace: optional-namespace + +# ClusterRoleBinding to be used by Elastic Agent. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +clusterRoleBinding: + name: elastic-agent + subjects: + - kind: ServiceAccount + name: elastic-agent + # { .Release.Namespace } is used here by default, but can be specified. + # namespace: default + roleRef: + kind: ClusterRole + name: elastic-agent + apiGroup: rbac.authorization.k8s.io + +# ClusterRole to be used by Elastic Agent. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +clusterRole: + name: elastic-agent + rules: + - apiGroups: [""] + resources: + - pods + - nodes + - namespaces + - events + - services + - configmaps + verbs: + - get + - watch + - list + - apiGroups: ["coordination.k8s.io"] + resources: + - leases + verbs: + - get + - create + - update + - nonResourceURLs: + - "/metrics" + verbs: + - get + - apiGroups: ["extensions"] + resources: + - replicasets + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "apps" + resources: + - statefulsets + - deployments + - replicasets + - daemonsets + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "" + resources: + - nodes/stats + verbs: + - get + - nonResourceURLs: + - "/metrics" + verbs: + - get + - apiGroups: + - "batch" + resources: + - jobs + - cronjobs + verbs: + - "get" + - "list" + - "watch" + - apiGroups: + - "storage.k8s.io" + resources: + - storageclasses + verbs: + - "get" + - "list" + - "watch" diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/Chart.yaml new file mode 100644 index 00000000..a9123a5d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Elastic APM Server managed by the ECK operator +icon: https://helm.elastic.co/icons/apm.png +kubeVersion: '>= 1.21.0-0' +name: eck-apm-server +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/apm-server +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml new file mode 100644 index 00000000..6ecab18e --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/examples/jaeger-with-http-configuration.yaml @@ -0,0 +1,29 @@ +--- +# Version of APM Server. +# +version: 9.3.0 + +# Count of APM Server replicas to create. +# +count: 1 + +config: + name: elastic-apm + apm-server.jaeger.grpc.enabled: true + apm-server.jaeger.grpc.host: "0.0.0.0:14250" + +# Reference to ECK-managed Elasticsearch resource. +# +elasticsearchRef: + name: eck-elasticsearch +http: + service: + spec: + ports: + - name: http + port: 8200 + targetPort: 8200 + - name: grpc + port: 14250 + targetPort: 14250 + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/NOTES.txt new file mode 100644 index 00000000..42ab52cb --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check APM Server status + $ kubectl get apmserver {{ include "apm-server.fullname" . }} -n {{ .Release.Namespace }} + +2. Check APM Server pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l apm.k8s.elastic.co/name={{ include "apm-server.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/_helpers.tpl new file mode 100644 index 00000000..d06ca3f4 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "apm-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "apm-server.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "apm-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "apm-server.labels" -}} +helm.sh/chart: {{ include "apm-server.chart" . }} +{{ include "apm-server.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "apm-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "apm-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/apmserver.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/apmserver.yaml new file mode 100644 index 00000000..f3dd5ba9 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/templates/apmserver.yaml @@ -0,0 +1,53 @@ +--- +apiVersion: apm.k8s.elastic.co/v1 +kind: ApmServer +metadata: + name: {{ include "apm-server.fullname" . }} + labels: + {{- include "apm-server.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "An APM Server version is required" .Values.version }} + count: {{ required "A pod count is required" .Values.count }} + {{- with .Values.image }} + image: {{ . }} + {{- end }} + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} + + {{- with .Values.config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.http }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.elasticsearchRef }} + elasticsearchRef: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.kibanaRef }} + kibanaRef: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.podTemplate }} + podTemplate: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.secureSettings }} + secureSettings: + {{- toYaml . | nindent 2 }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/values.yaml new file mode 100644 index 00000000..7443da53 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-apm-server/values.yaml @@ -0,0 +1,108 @@ +--- +# Default values for eck-apm-server. +# This is a YAML-formatted file. + +# Overridable names of the APM Server resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-apm-server'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the APM Server resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of APM Server. +# +version: 9.3.0 + +# APM Server Docker image to deploy +# +# image: + +# Used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# +# serviceAccountName: "" + +# Labels that will be applied to APM Server. +# +labels: {} + +# Annotations that will be applied to APM Server. +# +annotations: {} + +# Count of APM Server replicas to create. +# +count: 1 + +# The APM Server configuration, the ECK equivalent to apm-server.yml +# ref: https://www.elastic.co/guide/en/apm/server/current/configuring-howto-apm-server.html +# +config: {} + +# Settings to control how APM Server will be accessed. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html +# +http: {} + # service: + # metadata: + # labels: + # my-custom: label + # spec: + # ports: + # - name: http + # port: 8200 + # targetPort: 8200 + +# Reference to ECK-managed Elasticsearch resource. +# +elasticsearchRef: {} + # name: eck-elasticsearch + # Optional namespace reference to Elasticsearch resource. + # If not specified, then the namespace of the APM Server resource + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating an APM Server instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Optional reference to ECK-managed Kibana resource which allows ECK to +# automatically configure the Kibana endpoint as described in +# https://www.elastic.co/guide/en/apm/server/current/setup-kibana-endpoint.html +# +# kibanaRef: +# name: eck-kibana +# # Optional namespace reference to Kibana resource. +# # If not specified, then the namespace of the APM Server resource +# # will be assumed. +# # +# # namespace: default + +# Set podTemplate to customize the pod used by APM Server +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-customize-pods.html +# +podTemplate: {} + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for APM Server. +secureSettings: [] +# - secretName: my-secret-with-secure-settings diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/Chart.yaml new file mode 100644 index 00000000..70f0fbc2 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/Chart.yaml @@ -0,0 +1,8 @@ +apiVersion: v2 +description: AutoOps Agent Policy managed by the ECK operator +kubeVersion: '>= 1.21.0-0' +name: eck-autoops-agent-policy +sources: +- https://github.com/elastic/cloud-on-k8s +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/LICENSE new file mode 100644 index 00000000..7be32fc6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/LICENSE @@ -0,0 +1,94 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor's trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/examples/basic.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/examples/basic.yaml new file mode 100644 index 00000000..b41bd6e0 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/examples/basic.yaml @@ -0,0 +1,16 @@ +--- +# Version of AutoOps Agent Policy. +# +version: 9.3.0 + +# Reference an existing Kubernetes secret holding the AutoOps configuration. +autoOpsRef: + secretName: autoops-secret + +# ResourceSelector is a label selector for the resources to be configured. +# Any Elasticsearch instances that match the selector will be configured to send data to AutoOps. +# +resourceSelector: + matchLabels: + autoops: enabled + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/NOTES.txt new file mode 100644 index 00000000..a2eaeece --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/NOTES.txt @@ -0,0 +1,7 @@ + +1. Check AutoOps Agent Policy status + $ kubectl get autoops {{ include "autoops.fullname" . }} -n {{ .Release.Namespace }} + +2. Check AutoOps Agent Policy details + $ kubectl describe autoops {{ include "autoops.fullname" . }} -n {{ .Release.Namespace }} + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/_helpers.tpl new file mode 100644 index 00000000..c19efe59 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/_helpers.tpl @@ -0,0 +1,52 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "autoops.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "autoops.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "autoops.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "autoops.labels" -}} +helm.sh/chart: {{ include "autoops.chart" . }} +{{ include "autoops.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "autoops.selectorLabels" -}} +app.kubernetes.io/name: {{ include "autoops.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/autoopsagentpolicy.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/autoopsagentpolicy.yaml new file mode 100644 index 00000000..81a67b55 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/templates/autoopsagentpolicy.yaml @@ -0,0 +1,35 @@ +--- +apiVersion: autoops.k8s.elastic.co/v1alpha1 +kind: AutoOpsAgentPolicy +metadata: + name: {{ include "autoops.fullname" . }} + labels: + {{- include "autoops.labels" . | nindent 4 }} + annotations: + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "An AutoOps Agent Policy version is required" .Values.version }} + {{- with .Values.image }} + image: {{ . }} + {{- end }} + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + {{- with .Values.podTemplate }} + podTemplate: + {{- toYaml . | nindent 4 }} + {{- end }} + autoOpsRef: + secretName: {{ required "autoOpsRef.secretName is required to reference the AutoOps configuration secret" .Values.autoOpsRef.secretName }} + resourceSelector: + {{- required "resourceSelector is required" .Values.resourceSelector | toYaml | nindent 4 }} + {{- with .Values.namespaceSelector }} + namespaceSelector: + {{- toYaml . | nindent 4 }} + {{- end }} + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/values.yaml new file mode 100644 index 00000000..6a48ddf5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-autoops-agent-policy/values.yaml @@ -0,0 +1,95 @@ +--- +# Default values for eck-autoops-agent-policy. +# This is a YAML-formatted file. + +# Overridable names of the AutoOps Agent Policy resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-autoops-agent-policy'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the AutoOps Agent Policy resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of AutoOps Agent Policy. +# +version: 9.3.0 + +# Labels that will be applied to AutoOps Agent Policy. +# +labels: {} + +# Annotations that will be applied to AutoOps Agent Policy. +# +annotations: {} + +# Reference an existing Kubernetes secret holding the AutoOps configuration. +# +# All of the following items can be obtained the Elastic Cloud Console (https://cloud.elastic.co/connect-cluster-services-portal) +# by selecting the ECK connect wizard and following the instructions. +# +# The referenced secret must contain the following: +# - `cloud-connected-mode-api-key`: the Cloud Connected Mode API key. This is used to register the Agent with Elastic Cloud AutoOps. +# - `autoops-otel-url`: the URL of the AutoOps OTel endpoint. This is used to send Agent data to the AutoOps platform and is region specific. +# Example: "https://otel-auto-ops.us-east-2.aws.svc.elastic.cloud" +# - `autoops-token`: the token to authenticate against the AutoOps platform and is how AutoOps knows how to connect Agent data to the +# relevant Elastic Cloud organization +# - `cloud-connected-mode-api-url`: the URL of the Cloud Connected Mode API (optional) +# +autoOpsRef: {} + # secretName: "" + +# Config holds the AutoOps Agent configuration for Elasticsearch monitoring. +# This configuration is intended to override parts of the autoops_es.yml configmap. +# See: https://github.com/elastic/elastic-agent/blob/c6eaa3c903d4357824d345ee2002123fdffbec91/internal/pkg/otel/samples/linux/autoops_es.yml +# +kubebuilder:pruning:PreserveUnknownFields +# config: {} + +# Image is the AutoOps Agent Docker image to deploy. +# image: "docker.elastic.co/elastic-agent/elastic-otel-collector-wolfi:9.3.0" + +# RevisionHistoryLimit is the number of revisions to retain to allow rollback in the underlying Deployment. +# revisionHistoryLimit: 2 + +# PodTemplate provides customisation options (labels, annotations, affinity rules, resource requests, and so on) for the Agent pods +# +kubebuilder:validation:Optional +# +kubebuilder:pruning:PreserveUnknownFields +# podTemplate: +# spec: +# containers: +# - name: autoops-agent +# resources: +# limits: +# memory: 400Mi +# cpu: 200m +# requests: +# memory: 400Mi +# cpu: 200m + +# ResourceSelector is a label selector for the resources to be configured. +# Any Elasticsearch instances that match the selector will be configured to send data to AutoOps. +# +resourceSelector: + matchLabels: + autoops: enabled + +# NamespaceSelector is a namespace selector for the resources to be configured. +# Any Elasticsearch instances belonging to the selected namespaces will be configured to send data to AutoOps. +# If not specified, all namespaces are selected. +# +# namespaceSelector: +# matchLabels: +# kubernetes.io/metadata.name: team-a + +# ServiceAccountName is used for RBAC checks when accessing Elasticsearch clusters +# in different namespaces. The policy can only target Elasticsearch clusters that +# the specified service account has permission to access (via 'get' verb). +# Defaults to "default" if not specified. Only enforced if operator is running with --enforce-rbac-on-refs. +# +# serviceAccountName: "" + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/Chart.yaml new file mode 100644 index 00000000..1809956f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Elastic Beats managed by the ECK operator +icon: https://helm.elastic.co/icons/beats.png +kubeVersion: '>= 1.20.0-0' +name: eck-beats +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/beats +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml new file mode 100644 index 00000000..0b1438b5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/auditbeat_hosts.yaml @@ -0,0 +1,110 @@ +name: auditbeat +version: 9.3.0 +type: auditbeat +elasticsearchRef: + name: eck-elasticsearch +kibanaRef: + name: eck-kibana +config: + auditbeat.modules: + - module: file_integrity + paths: + - /hostfs/bin + - /hostfs/usr/bin + - /hostfs/sbin + - /hostfs/usr/sbin + - /hostfs/etc + exclude_files: + - '(?i)\.sw[nop]$' + - '~$' + - '/\.git($|/)' + scan_at_start: true + scan_rate_per_sec: 50 MiB + max_file_size: 100 MiB + hash_types: [sha1] + recursive: true + - module: auditd + audit_rules: | + # Executions + -a always,exit -F arch=b64 -S execve,execveat -k exec + + # Unauthorized access attempts (amd64 only) + -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EACCES -k access + -a always,exit -F arch=b64 -S open,creat,truncate,ftruncate,openat,open_by_handle_at -F exit=-EPERM -k access + + processors: + - add_cloud_metadata: {} + - add_host_metadata: {} + - add_process_metadata: + match_pids: ['process.pid'] +daemonSet: + podTemplate: + spec: + hostPID: true # Required by auditd module + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true # Allows to provide richer host metadata + automountServiceAccountToken: true # some older Beat versions are depending on this settings presence in k8s context + securityContext: + runAsUser: 0 + volumes: + - name: bin + hostPath: + path: /bin + - name: usrbin + hostPath: + path: /usr/bin + - name: sbin + hostPath: + path: /sbin + - name: usrsbin + hostPath: + path: /usr/sbin + - name: etc + hostPath: + path: /etc + - name: run-containerd + hostPath: + path: /run/containerd + type: DirectoryOrCreate + # Uncomment the below when running on GKE. See https://github.com/elastic/beats/issues/8523 for more context. + #- name: run + # hostPath: + # path: /run + #initContainers: + #- name: cos-init + # image: docker.elastic.co/beats/auditbeat:8.3.3 + # volumeMounts: + # - name: run + # mountPath: /run + # command: ['sh', '-c', 'export SYSTEMD_IGNORE_CHROOT=1 && systemctl stop systemd-journald-audit.socket && systemctl mask systemd-journald-audit.socket && systemctl restart systemd-journald'] + containers: + - name: auditbeat + securityContext: + capabilities: + add: + # Capabilities needed for auditd module + - 'AUDIT_READ' + - 'AUDIT_WRITE' + - 'AUDIT_CONTROL' + volumeMounts: + - name: bin + mountPath: /hostfs/bin + readOnly: true + - name: sbin + mountPath: /hostfs/sbin + readOnly: true + - name: usrbin + mountPath: /hostfs/usr/bin + readOnly: true + - name: usrsbin + mountPath: /hostfs/usr/sbin + readOnly: true + - name: etc + mountPath: /hostfs/etc + readOnly: true + # Directory with root filesystems of containers executed with containerd, this can be + # different with other runtimes. This volume is needed to monitor the file integrity + # of files in containers. + - name: run-containerd + mountPath: /run/containerd + readOnly: true diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml new file mode 100644 index 00000000..c46960da --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/filebeat_no_autodiscover.yaml @@ -0,0 +1,52 @@ +name: filebeat +version: 9.3.0 +type: filebeat +elasticsearchRef: + name: eck-elasticsearch +kibanaRef: + name: eck-kibana +config: + filebeat.inputs: + - type: filestream + paths: + - /var/log/containers/*.log + parsers: + - container: ~ + prospector: + scanner: + fingerprint.enabled: true + symlinks: true + file_identity.fingerprint: ~ + processors: + - add_host_metadata: {} + - add_cloud_metadata: {} +daemonSet: + podTemplate: + spec: + automountServiceAccountToken: true + terminationGracePeriodSeconds: 30 + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true # Allows to provide richer host metadata + containers: + - name: filebeat + securityContext: + runAsUser: 0 + # If using Red Hat OpenShift uncomment this: + #privileged: true + volumeMounts: + - name: varlogcontainers + mountPath: /var/log/containers + - name: varlogpods + mountPath: /var/log/pods + - name: varlibdockercontainers + mountPath: /var/lib/docker/containers + volumes: + - name: varlogcontainers + hostPath: + path: /var/log/containers + - name: varlogpods + hostPath: + path: /var/log/pods + - name: varlibdockercontainers + hostPath: + path: /var/lib/docker/containers diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml new file mode 100644 index 00000000..2521232f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/heartbeat_es_kb_health.yaml @@ -0,0 +1,23 @@ +name: heartbeat +version: 9.3.0 +type: heartbeat +elasticsearchRef: + name: eck-elasticsearch +config: + heartbeat.monitors: + - type: tcp + schedule: '@every 5s' + # This should directly match the name of the Elasticsearch instance + # with "-es-http" appended to the name. + hosts: ["elasticsearch-es-http.default.svc:9200"] + - type: tcp + schedule: '@every 5s' + # This should directly match the names of the Kibana instance + # with "-kb-http" appended to the name. + hosts: ["eck-kibana-kb-http.default.svc:5601"] +deployment: + replicas: 1 + podTemplate: + spec: + securityContext: + runAsUser: 0 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml new file mode 100644 index 00000000..ea2058b3 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/metricbeat_hosts.yaml @@ -0,0 +1,158 @@ +name: metricbeat +type: metricbeat +version: 9.3.0 +elasticsearchRef: + name: eck-elasticsearch +kibanaRef: + name: eck-kibana +config: + metricbeat: + autodiscover: + providers: + - hints: + default_config: {} + enabled: "true" + node: ${NODE_NAME} + type: kubernetes + modules: + - module: system + period: 10s + metricsets: + - cpu + - load + - memory + - network + - process + - process_summary + process: + include_top_n: + by_cpu: 5 + by_memory: 5 + processes: + - .* + - module: system + period: 1m + metricsets: + - filesystem + - fsstat + processors: + - drop_event: + when: + regexp: + system: + filesystem: + mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib)($|/) + - module: kubernetes + period: 10s + node: ${NODE_NAME} + hosts: + - https://${NODE_NAME}:10250 + bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token + ssl: + verification_mode: none + metricsets: + - node + - system + - pod + - container + - volume + processors: + - add_cloud_metadata: {} + - add_host_metadata: {} +daemonSet: + podTemplate: + spec: + serviceAccountName: metricbeat + automountServiceAccountToken: true # some older Beat versions are depending on this settings presence in k8s context + containers: + - args: + - -e + - -c + - /etc/beat.yml + - --system.hostfs=/hostfs + name: metricbeat + volumeMounts: + - mountPath: /hostfs/sys/fs/cgroup + name: cgroup + - mountPath: /var/run/docker.sock + name: dockersock + - mountPath: /hostfs/proc + name: proc + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true # Allows to provide richer host metadata + securityContext: + runAsUser: 0 + terminationGracePeriodSeconds: 30 + volumes: + - hostPath: + path: /sys/fs/cgroup + name: cgroup + - hostPath: + path: /var/run/docker.sock + name: dockersock + - hostPath: + path: /proc + name: proc + +clusterRole: + # permissions needed for metricbeat + # source: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-kubernetes.html + name: metricbeat + rules: + - apiGroups: + - "" + resources: + - nodes + - namespaces + - events + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "extensions" + resources: + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - apps + resources: + - statefulsets + - deployments + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes/stats + verbs: + - get + - nonResourceURLs: + - /metrics + verbs: + - get + +serviceAccount: + name: metricbeat + +clusterRoleBinding: + name: metricbeat + subjects: + - kind: ServiceAccount + name: metricbeat + roleRef: + kind: ClusterRole + name: metricbeat + apiGroup: rbac.authorization.k8s.io diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml new file mode 100644 index 00000000..4db8df62 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/examples/packetbeat_dns_http.yaml @@ -0,0 +1,37 @@ +name: packetbeat +type: packetbeat +version: 9.3.0 +elasticsearchRef: + name: eck-elasticsearch +kibanaRef: + name: eck-kibana +config: + packetbeat.interfaces.device: any + packetbeat.protocols: + - type: dns + ports: [53] + include_authorities: true + include_additionals: true + - type: http + ports: [80, 8000, 8080, 9200] + packetbeat.flows: + timeout: 30s + period: 10s + processors: + - add_cloud_metadata: {} + - add_host_metadata: {} +daemonSet: + podTemplate: + spec: + terminationGracePeriodSeconds: 30 + hostNetwork: true + automountServiceAccountToken: true # some older Beat versions are depending on this settings presence in k8s context + dnsPolicy: ClusterFirstWithHostNet + containers: + - name: packetbeat + securityContext: + runAsUser: 0 + capabilities: + add: + - NET_ADMIN + volumes: [] diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/NOTES.txt new file mode 100644 index 00000000..10d2dac5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Beat status + $ kubectl get beat {{ include "beat.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Beat pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l beat.k8s.elastic.co/name={{ include "beat.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/_helpers.tpl new file mode 100644 index 00000000..5e20af14 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "beat.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "beat.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "beat.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "beat.labels" -}} +helm.sh/chart: {{ include "beat.chart" . }} +{{ include "beat.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "beat.selectorLabels" -}} +app.kubernetes.io/name: {{ include "beat.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/beats.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/beats.yaml new file mode 100644 index 00000000..a70ac9a6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/beats.yaml @@ -0,0 +1,75 @@ +--- +apiVersion: beat.k8s.elastic.co/v1beta1 +kind: Beat +metadata: + name: {{ include "beat.fullname" . }} + labels: + {{- include "beat.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Beat version is required" (or ((.Values.spec).version) (.Values.version)) }} + {{- $daemonSet := (or (hasKey (.Values.spec) "daemonSet") (hasKey .Values "daemonSet")) }} + {{- $deployment := (or (hasKey (.Values.spec) "deployment") (hasKey .Values "deployment")) }} + {{- if and (not $daemonSet) (not $deployment) }} + {{ fail "At least one of daemonSet or deployment is required for a functional Beat" }} + {{- end }} + {{- if not (or ((.Values.spec).type) (.Values.type)) }}{{ fail "A Beat type is required" }}{{- end }} + type: {{ or ((.Values.spec).type) (.Values.type) }} + {{- if $daemonSet }} + {{- $ds := or ((.Values.spec).daemonSet) (.Values.daemonSet) }} + daemonSet: + {{- /* This is required to render the empty daemonset ( {} ) properly */}} + {{- $ds | default dict | toYaml | nindent 4 }} + {{- end }} + {{- if $deployment }} + {{- $deploy := or ((.Values.spec).deployment) (.Values.deployment) }} + deployment: + {{- /* This is required to render the empty deployment ( {} ) properly */}} + {{- $deploy | default dict | toYaml | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).image) (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with or ((.Values.spec).elasticsearchRef) (.Values.elasticsearchRef) }} + elasticsearchRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).kibanaRef) (.Values.kibanaRef) }} + kibanaRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- $config := or ((.Values.spec).config) (.Values.config) }} + {{- $configRef := or ((.Values.spec).configRef) (.Values.configRef) }} + {{- if and $config $configRef }} + {{ fail "Only one of config and configRef can be specified" }} + {{- end }} + {{- with $config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $configRef }} + configRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).http) (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).monitoring) (.Values.monitoring) }} + monitoring: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).secureSettings) (.Values.secureSettings) }} + secureSettings: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).revisionHistoryLimit) (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with or (((.Values.spec).serviceAccount).name) ((.Values.serviceAccount).name) }} + serviceAccountName: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role-binding.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role-binding.yaml new file mode 100644 index 00000000..d8fca15f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role-binding.yaml @@ -0,0 +1,35 @@ +{{- with .Values.clusterRoleBinding }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .name }} + labels: + {{- include "beat.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- with .subjects }} +subjects: +{{- range . }} + - kind: {{ .kind }} + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} +{{- end }} +{{- end }} +{{- with .roleRef }} +roleRef: + kind: {{ .kind }} + name: {{ .name }} + apiGroup: {{ .apiGroup }} +{{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role.yaml new file mode 100644 index 00000000..66406f63 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/cluster-role.yaml @@ -0,0 +1,22 @@ +{{- with .Values.clusterRole }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .name }} + labels: + {{- include "beat.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +rules: {{- toYaml .rules | nindent 2 }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/service-account.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/service-account.yaml new file mode 100644 index 00000000..08f21f7e --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/templates/service-account.yaml @@ -0,0 +1,23 @@ + +{{- with .Values.serviceAccount }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} + labels: + {{- include "beat.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/values.yaml new file mode 100644 index 00000000..20415276 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-beats/values.yaml @@ -0,0 +1,181 @@ +--- +# Default values for eck-beats. +# This is a YAML-formatted file. + +# Overridable names of the Beats resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-beats'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Beats resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Elastic Beats. +# +version: 9.3.0 + +# Labels that will be applied to Elastic Beats. +# +labels: {} + +# Annotations that will be applied to Elastic Beats. +# +annotations: {} + +# ** Deprecation Notice ** +# The previous versions of this Helm Chart simply used the `spec` field here +# and allowed the user to specify any fields below spec that were templated directly +# into the final Beats manifest. This is no longer the preferred way to specify these +# fields and each field that is supported underneath `spec` is now directly specified +# in this values file. Currently both patterns are supported for backwards compatibility +# but we plan to remove the `spec` field in the future. +# spec: {} + +# Type of Elastic Beats. Standard types of Beat are [filebeat,metricbeat,heartbeat,auditbeat,packetbeat,journalbeat]. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-deploy-elastic-beat +# +# Note: This is required to be set, or the release install will fail. +# +type: "" + +# Beats image to deploy. +# +# image: docker.elastic.co/beats/metricbeat:9.3.0 + +# Referenced resources are below and depending on the setup, at least elasticsearchRef is required for a functional Beat. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-connect-es +# +# Reference to ECK-managed Kibana instance. +# +# kibanaRef: +# name: quickstart + # Optional namespace reference to Kibana instance. + # If not specified, then the namespace of the Beats instance + # will be assumed. + # + # namespace: default + +# Reference to ECK-managed Elasticsearch instance. +# *Note* If Beat's output is intended to go to Elasticsearch and not something like Logstash, +# this elasticsearchRef must be updated to the name of the Elasticsearch instance. +# +elasticsearchRef: {} + # name: elasticsearch + # Optional namespace reference to Elasticsearch instance. + # If not specified, then the namespace of the Beats instance + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating a Beat instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Daemonset, or Deployment specification for the type of Beat specified. +# At least one is required of [daemonSet, deployment]. +# No default is currently set, refer to https://github.com/elastic/cloud-on-k8s/issues/7429. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-chose-the-deployment-model +# +# deployment: +# podTemplate: +# spec: +# securityContext: +# runAsUser: 0 +# daemonSet: +# podTemplate: +# spec: +# securityContext: +# runAsUser: 0 + +# Configuration of Beat, which is dependent on the `type` of Beat specified. +# NOTE: The `config` and `configRef` fields are mutually exclusive. Only one of them should be defined at a time, +# as using both may cause conflicts. +# +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-custom-configuration +# +config: {} + +# Reference a configuration in a Secret. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-custom-configuration +# +# configRef: +# secretName: "" + +# The HTTP layer configuration for the Beats Service. +# +# http: + +# Settings for configuring stack monitoring. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-stack-monitoring.html +# +# monitoring: {} + # metrics: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + # logs: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + +# SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for Elastic Beats. +secureSettings: [] +# - secretName: my-secret-with-secure-settings + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# ServiceAccount to be used by Elastic Beats. Some Beats features (such as autodiscover or Kubernetes module metricsets) +# require that Beat Pods interact with Kubernetes APIs. This functionality requires specific permissions +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-role-based-access-control-for-beats +# +serviceAccount: {} +# name: elastic-beat-filebeat-quickstart +# namespace: optional-namespace + +# ClusterRoleBinding to be used by Elastic Beats. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-role-based-access-control-for-beats +# +clusterRoleBinding: {} +# name: elastic-beat-autodiscover-binding +# subjects: +# - kind: ServiceAccount +# name: elastic-beat-filebeat-quickstart +# namespace: default +# roleRef: +# kind: ClusterRole +# name: elastic-beat-autodiscover +# apiGroup: rbac.authorization.k8s.io + +# ClusterRole to be used by Elastic Beats. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-beat-configuration.html#k8s-beat-role-based-access-control-for-beats +# +clusterRole: {} +# name: elastic-beat-autodiscover +# rules: +# - apiGroups: [""] +# resources: +# - events +# - pods +# - namespaces +# - nodes +# verbs: +# - get +# - watch +# - list diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/Chart.yaml new file mode 100644 index 00000000..d4cbc925 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Elasticsearch managed by the ECK operator +icon: https://helm.elastic.co/icons/elasticsearch.png +kubeVersion: '>= 1.21.0-0' +name: eck-elasticsearch +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/elasticsearch/ +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml new file mode 100644 index 00000000..4eb99e60 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/hot-warm-cold.yaml @@ -0,0 +1,198 @@ +--- +nodeSets: +- name: masters + count: 1 + config: + node.roles: ["master"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 8Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highio + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Ti + # Adjust to your storage class name + # + # storageClassName: local-storage +- name: hot + count: 1 + config: + node.roles: ["data_hot", "data_content", "ingest"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 16Gi + cpu: 4 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highio + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Ti + # Adjust to your storage class name + # + # storageClassName: local-storage +- name: warm + count: 1 + config: + node.roles: ["data_warm"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 16Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highstorage + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Ti + # Adjust to your storage class name + # + # storageClassName: local-storage +- name: cold + count: 1 + config: + node.roles: ["data_cold"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 8Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highstorage + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Ti + # Adjust to your storage class name + # + # storageClassName: local-storage diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml new file mode 100644 index 00000000..0ca310c3 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-aks.yaml @@ -0,0 +1,26 @@ +--- +# The following is an example of an Elasticsearch resource that is configured to use an Ingress resource in an AKS cluster. +# +ingress: + enabled: true + className: webapprouting.kubernetes.azure.com + annotations: + # This is required for AKS Loadbalancing to understand that it's communicating with + # an HTTPS backend. + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml new file mode 100644 index 00000000..d3cc4041 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-alb.yaml @@ -0,0 +1,37 @@ +--- +# The following is an example of an Elasticsearch resource that is configured to use an Ingress resource in an EKS cluster +# which provisions an application load balancer. +# +ingress: + enabled: true + className: alb + annotations: + alb.ingress.kubernetes.io/scheme: "internet-facing" + alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' + alb.ingress.kubernetes.io/backend-protocol: "HTTPS" + alb.ingress.kubernetes.io/target-type: "ip" + # To use an ALB with ECK, you must provide a valid ACM certificate ARN or use certificate discovery. + # There are 2 options for EKS: + # 1. Create a valid ACM certificate, and uncomment the following annotation and update it to the correct ARN. + # 2. Create a valid ACM certificate and ensure that the hosts[0].host matches the certificate's Common Name (CN) and + # certificate discovery *should* find the certificate automatically and use it. + # + # ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/guide/ingress/cert_discovery/ + # + # alb.ingress.kubernetes.io/certificate-arn: "arn:aws:acm:us-east-1:00000000000:certificate/b65be571-8220-4f2e-8cb1-94194535d877" + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml new file mode 100644 index 00000000..3809e871 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-eks-nlb.yaml @@ -0,0 +1,27 @@ +--- +# The following is an example of an Elasticsearch resource that is configured to deploy a +# network load balancer (NLB) in an EKS cluster. To provision an NLB "ingress" for the +# Elasticsearch cluster, you are required to set annotations on the service, +# and not an Ingress resource. +ingress: + enabled: false +http: + service: + metadata: + annotations: + service.beta.kubernetes.io/aws-load-balancer-type: external + service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: ip + service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing + service.beta.kubernetes.io/aws-load-balancer-backend-protocol: ssl + spec: + type: LoadBalancer +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml new file mode 100644 index 00000000..3adbd29c --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/examples/ingress/elasticsearch-ingress-gke.yaml @@ -0,0 +1,36 @@ +--- +# The following is an example of an Elasticsearch resource that is configured to use an Ingress resource in a GKE cluster. +# +ingress: + enabled: true + annotations: + my: annotation + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" +http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + # This is required to enable the GKE Ingress Controller to use HTTPS as the backend protocol. + cloud.google.com/app-protocols: '{"https":"HTTPS"}' +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + # Enable anonymous access to allow GCLB health probes to succeed + xpack.security.authc: + anonymous: + username: anon + roles: monitoring_user diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/NOTES.txt new file mode 100644 index 00000000..f6ab0020 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Elasticsearch resource status + $ kubectl get es {{ include "elasticsearch.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Elasticsearch pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l elasticsearch.k8s.elastic.co/cluster-name={{ include "elasticsearch.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/_helpers.tpl new file mode 100644 index 00000000..8fbf57b3 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "elasticsearch.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "elasticsearch.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "elasticsearch.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "elasticsearch.labels" -}} +helm.sh/chart: {{ include "elasticsearch.chart" . }} +{{ include "elasticsearch.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "elasticsearch.selectorLabels" -}} +app.kubernetes.io/name: {{ include "elasticsearch.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/elasticsearch.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/elasticsearch.yaml new file mode 100644 index 00000000..4a4d7465 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/elasticsearch.yaml @@ -0,0 +1,78 @@ +--- +apiVersion: elasticsearch.k8s.elastic.co/v1 +kind: Elasticsearch +metadata: + name: {{ include "elasticsearch.fullname" . }} + labels: + {{- include "elasticsearch.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.auth }} + auth: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.updateStrategy }} + updateStrategy: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.secureSettings }} + secureSettings: + {{- toYaml . | nindent 2 }} + {{- end }} + {{- with .Values.transport }} + transport: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.http }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + version: {{ required "An Elasticsearch version is required" .Values.version }} + {{- with .Values.monitoring }} + monitoring: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.remoteClusters }} + remoteClusters: + {{- toYaml . | nindent 2 }} + {{- end }} + {{- with .Values.remoteClusterServer }} + remoteClusterServer: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.volumeClaimDeletePolicy }} + volumeClaimDeletePolicy: + {{- if and (not (eq . "DeleteOnScaledownOnly")) (not (eq . "DeleteOnScaledownAndClusterDeletion")) }} + {{ fail "volumeClaimDeletePolicy can only be one of 'DeleteOnScaledownOnly' or 'DeleteOnScaledownAndClusterDeletion'" }} + {{- end }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if eq (len .Values.nodeSets) 0 }} + {{ fail "At least one nodeSet is required" }} + {{- end }} + nodeSets: + {{ toYaml .Values.nodeSets | nindent 4 }} + {{- with .Values.image }} + image: {{ . }} + {{- end }} + {{- with .Values.podDisruptionBudget }} + {{- if .disabled }} + podDisruptionBudget: {} + {{- else }} + {{- with .spec }} + podDisruptionBudget: + spec: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- end }} + {{- end }} + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/ingress.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/ingress.yaml new file mode 100644 index 00000000..99aa1813 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/templates/ingress.yaml @@ -0,0 +1,48 @@ +{{- if .Values.ingress.enabled -}} +{{- $pathType := .Values.ingress.pathType | default "Prefix" -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "elasticsearch.fullname" . }} + labels: + {{- include "elasticsearch.labels" . | nindent 4 }} + {{- with .Values.ingress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if .Values.ingress.annotations }} + annotations: + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +spec: + {{- if .Values.ingress.className }} + ingressClassName: {{ .Values.ingress.className | quote }} + {{- end }} + {{- if .Values.ingress.tls.enabled }} + tls: + - hosts: + {{- range .Values.ingress.hosts }} + - {{ .host | quote }} + {{- end }} + {{- if .Values.ingress.tls.secretName }} + secretName: {{ .Values.ingress.tls.secretName }} + {{- else }} + secretName: {{ include "elasticsearch.fullname" . }}-es-http-certs-internal + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + {{- $hostPath := .path | default "/" }} + - host: {{ .host | quote }} + http: + paths: + - path: {{ $hostPath }} + pathType: {{ $pathType }} + backend: + service: + name: {{ include "elasticsearch.fullname" $ }}-es-http + port: + number: 9200 + {{- end }} +{{ end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/values.yaml new file mode 100644 index 00000000..19abaf35 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-elasticsearch/values.yaml @@ -0,0 +1,393 @@ +--- +# Default values for eck-elasticsearch. +# This is a YAML-formatted file. + +# Overridable names of the Elasticsearch resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-elasticsearch'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Elasticsearch resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Elasticsearch. +# +version: 9.3.0 + +# Elasticsearch Docker image to deploy +# +# image: + +# Labels that will be applied to Elasticsearch. +# +labels: {} + +# Annotations that will be applied to Elasticsearch. +# +annotations: {} + +# Settings for configuring Elasticsearch users and roles. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-users-and-roles.html +# +auth: {} + +# Settings for configuring stack monitoring. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-stack-monitoring.html +# +monitoring: {} + # metrics: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + # logs: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + +# Control the Elasticsearch transport module used for internal communication between nodes. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-transport-settings.html +# +transport: {} + # service: + # metadata: + # labels: + # my-custom: label + # spec: + # type: LoadBalancer + # tls: + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: hulk.example.com + # certificate: + # secretName: custom-ca + +# Settings to control how Elasticsearch will be accessed. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html +# +http: {} + # service: + # metadata: + # labels: + # my-custom: label + # spec: + # type: LoadBalancer + # tls: + # selfSignedCertificate: + # # To fully disable TLS for the HTTP layer of Elasticsearch, simply + # # set the below field to 'true', removing all other fields. + # disabled: false + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: hulk.example.com + # certificate: + # secretName: custom-ca + +# Control Elasticsearch Secure Settings. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-es-secure-settings.html#k8s-es-secure-settings +# +secureSettings: [] + # - secretName: one-secure-settings-secret + # Projection of secret keys to specific paths + # - secretName: gcs-secure-settings + # entries: + # - key: gcs.client.default.credentials_file + # - key: gcs_client_1 + # path: gcs.client.client_1.credentials_file + # - key: gcs_client_2 + # path: gcs.client.client_2.credentials_file + +# Settings for limiting the number of simultaneous changes to an Elasticsearch resource. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-update-strategy.html +# +updateStrategy: {} + # changeBudget: + # maxSurge: 3 + # maxUnavailable: 1 + +# Controlling of connectivity between remote clusters within the same kubernetes cluster. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-remote-clusters.html +# +remoteClusters: {} + # - name: cluster-two + # elasticsearchRef: + # name: cluster-two + # namespace: ns-two + +# RemoteClusterServer specifies if the remote cluster server should be enabled. +# This must be enabled if this cluster is a remote cluster which is expected to be accessed using API key authentication. +# +remoteClusterServer: {} +# enabled: true + +# VolumeClaimDeletePolicy sets the policy for handling deletion of PersistentVolumeClaims for all NodeSets. +# Possible values are DeleteOnScaledownOnly and DeleteOnScaledownAndClusterDeletion. +# By default, if not set or empty, the operator sets DeleteOnScaledownAndClusterDeletion. +# +volumeClaimDeletePolicy: "" + +# Settings to limit the disruption when pods need to be rescheduled for some reason such as upgrades or routine maintenance. +# By default, if not set, the operator sets a budget that doesn't allow any pod to be removed in case the cluster is not green or if there is only one node of type `data` or `master`. +# In all other cases the default PodDisruptionBudget sets `minAvailable` equal to the total number of nodes minus 1. +# To completely disable the pod disruption budget set `disabled` to true. +# +# podDisruptionBudget: +# spec: +# minAvailable: 2 +# selector: +# matchLabels: +# elasticsearch.k8s.elastic.co/cluster-name: quickstart +# disabled: true + +# Used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# +# serviceAccountName: "" + +# Number of revisions to retain to allow rollback in the underlying StatefulSets. +# By default, if not set, Kubernetes sets 10. +# +# revisionHistoryLimit: 2 + +# Node configuration settings. +# The node roles which can be configured here are: +# - "master" +# - "data_hot" +# - "data_cold" +# - "data_frozen" +# - "data_content" +# - "ml" +# - "ingest" +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-node-configuration.html +# +nodeSets: +- name: default + count: 1 + config: + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + # The following spec is exactly the Kubernetes Core V1 PodTemplateSpec. Any fields within the PodTemplateSpec + # are supported within the 'spec' field below. Please see below documentation for the exhaustive list of fields. + # + # https://v1-24.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#podtemplatespec-v1-core + # + # Only the commonly overridden/used fields will be noted below. + # + spec: + + # If specified, the pod's scheduling constraints + # https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html + # https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: topology.kubernetes.io/zone + # operator: In + # values: + # - antarctica-east1 + # - antarctica-west1 + + # Containers array. Should only be used to customize the 'elasticsearch' container using the following fields. + containers: + - name: elasticsearch + + # List of environment variables to set in the 'elasticsearch' container. + # https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/ + # env: + # - name: "my-env-var" + # value: "my-value" + + # Compute Resources required by this container. + resources: + # Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, + # it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. + # + # Defaults used by the ECK Operator, if not specified, are below + limits: + # cpu: 1 + memory: 2Gi + requests: + # cpu: 1 + memory: 2Gi + + # Example increasing both the requests and limits values: + # limits: + # cpu: 4 + # memory: 8Gi + # requests: + # cpu: 1 + # memory: 8Gi + + # SecurityContext defines the security options the container should be run with. + # If set, the fields of SecurityContext override the equivalent fields of PodSecurityContext. + # + # These typically are set automatically by the ECK Operator, and should only be adjusted + # with the full knowledge of the effects of each field. + # + # securityContext: + + # Whether this container has a read-only root filesystem. Default is false. + # readOnlyRootFilesystem: false + + # The GID to run the entrypoint of the container process. Uses runtime default if unset. + # runAsGroup: 1000 + + # Indicates that the container must run as a non-root user. If true, the Kubelet will validate the image at runtime to ensure + # that it does not run as UID 0 (root) and fail to start the container if it does. If unset or false, no such validation will be performed. + # runAsNonRoot: true + + # The UID to run the entrypoint of the container process. Defaults to user specified in image metadata if unspecified. + # runAsUser: 1000 + + # ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. + # https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod + # imagePullSecrets: + # - name: "image-pull-secret" + + # List of initialization containers belonging to the pod. + # + # Common initContainers include setting sysctl, or in 7.x versions of Elasticsearch, + # installing Elasticsearch plugins. + # + # https://kubernetes.io/docs/concepts/workloads/pods/init-containers/ + # initContainers: + # - command: + # - sh + # - "-c" + # - sysctl -w vm.max_map_count=262144 + # name: sysctl + # securityContext: + # privileged: true + # - command: + # - sh + # - "-c" + # - bin/elasticsearch-plugin remove --purge analysis-icu ; bin/elasticsearch-plugin install --batch analysis-icu + # name: install-plugins + # securityContext: + # privileged: true + + + # NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node's labels for the pod to be scheduled on that node. + # https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + # https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html + # nodeSelector: + # diskType: ssd + # environment: production + + # If specified, indicates the pod's priority. "system-node-critical" and "system-cluster-critical" are two special keywords which indicate the highest priorities with the former being the highest priority. + # Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority will be default or zero if there is no default. + # https://kubernetes.io/docs/concepts/scheduling-eviction/pod-priority-preemption/ + # priorityClassName: "" + + # SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty. See type description for default values of each field. + # See previously defined 'securityContext' within 'podTemplate' for all available fields. + # securityContext: {} + + # ServiceAccountName is the name of the ServiceAccount to use to run this pod. + # https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/ + # serviceAccountName: "" + + # Optional duration in seconds to wait for the Elasticsearch pod to terminate gracefully. + # terminationGracePeriodSeconds: 30s + + # If specified, the pod's tolerations that will apply to all containers within the pod. + # https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ + # tolerations: + # - key: "node-role.kubernetes.io/elasticsearch" + # effect: "NoSchedule" + # operator: "Exists" + + # TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. + # Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed. + # + # These settings are generally applied within each `nodeSets[].podTemplate` field to apply to a specific Elasticsearch nodeset. + # + # https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html + # topologySpreadConstraints: {} + + # List of volumes that can be mounted by containers belonging to the pod. + # https://kubernetes.io/docs/concepts/storage/volumes + # volumes: [] + +# Settings for controlling Elasticsearch ingress. Enabling ingress will expose your Elasticsearch instance +# to the public internet, and as such is disabled by default. +# +# Each Cloud Service Provider has different requirements for setting up Ingress. Some links to common documentation are: +# - AWS: https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html +# - GCP: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress +# - Azure: https://learn.microsoft.com/en-us/azure/aks/app-routing +# - Nginx: https://kubernetes.github.io/ingress-nginx/ +# +ingress: + enabled: false + + # Annotations that will be applied to the Ingress resource. Note that some ingress controllers are controlled via annotations. + # + # Nginx Annotations: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/ + # + # Common annotations: + # kubernetes.io/ingress.class: gce # Configures the Ingress resource to use the GCE ingress controller and create an external Application Load Balancer. + # kubernetes.io/ingress.class: gce-internal # Configures the Ingress resource to use the GCE ingress controller and create an internal Application Load Balancer. + # kubernetes.io/ingress.class: nginx # Configures the Ingress resource to use the NGINX ingress controller. + # + annotations: {} + + # Labels that will be applied to the Ingress resource. + # + labels: {} + + # Some ingress controllers require the use of a specific class name to route traffic to the correct controller, notably AKS and EKS, which + # replaces the use of the 'kubernetes.io/ingress.class' annotation. + # + # className: webapprouting.kubernetes.azure.com | alb + + # Ingress paths are required to have a corresponding path type. Defaults to 'Prefix'. + # + # There are 3 supported path types: + # - ImplementationSpecific + # - Prefix + # - Exact + # + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types + # + pathType: Prefix + + # Hosts are a list of hosts included in the Ingress definition, with a corresponding path at which the default Elasticsearch service + # will be exposed. Each host in the list should be a fully qualified DNS name that will resolve to the exposed Ingress object. + # + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#name-based-virtual-hosting + # + hosts: + - host: chart-example.local + path: / + + # TLS defines whether TLS will be enabled on the Ingress resource. + # + # *NOTE* Many Cloud Service Providers handle TLS in a custom manner, and as such, it is recommended to consult their documentation. + # Notably GKE and Nginx Ingress Controllers seems to respect the Ingress TLS settings, AKS and EKS ignore it. + # + # - AKS: https://learn.microsoft.com/en-us/azure/aks/app-routing-dns-ssl + # - GKE: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress#options_for_providing_ssl_certificates + # - EKS: https://aws.amazon.com/blogs/containers/serve-distinct-domains-with-tls-powered-by-acm-on-amazon-eks/ + # - Nginx: https://kubernetes.github.io/ingress-nginx/user-guide/tls/ + # + # Kubernetes ingress TLS documentation: + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + # + tls: + enabled: false + # Optional Kubernetes secret name that contains a base64 encoded PEM certificate and private key that corresponds to the above 'hosts' definitions. + # If tls is enabled, but this field is not set, the self-signed certificate and key created by the ECK operator will be used. + # secretName: chart-example-tls diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/Chart.yaml new file mode 100644 index 00000000..0f4240b7 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +description: Elastic Enterprise Search managed by the ECK operator +icon: https://github.com/elastic/ent-search/blob/main/public/app-search-favicon-196x196.png +kubeVersion: '>= 1.21.0-0' +name: eck-enterprise-search +sources: +- https://github.com/elastic/cloud-on-k8s +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/examples/with-custom-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/examples/with-custom-configuration.yaml new file mode 100644 index 00000000..4216a112 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/examples/with-custom-configuration.yaml @@ -0,0 +1,19 @@ +config: + # define the exposed URL at which users will reach Enterprise Search + ent_search.external_url: https://my-custom-domain:3002 + # define the exposed URL at which users will reach Kibana + kibana.host: https://kibana.my-custom-domain:5601 + # configure app search document size limit + app_search.engine.document_size.limit: 100kb + +http: + service: + metadata: + labels: + my-custom: label + tls: + certificate: + secretName: my-cert + +elasticsearchRef: + name: eck-elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/_helpers.tpl new file mode 100644 index 00000000..21025dc7 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/_helpers.tpl @@ -0,0 +1,62 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "eck-enterprise-search.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "eck-enterprise-search.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "eck-enterprise-search.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "eck-enterprise-search.labels" -}} +helm.sh/chart: {{ include "eck-enterprise-search.chart" . }} +{{ include "eck-enterprise-search.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "eck-enterprise-search.selectorLabels" -}} +app.kubernetes.io/name: {{ include "eck-enterprise-search.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "eck-enterprise-search.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "eck-enterprise-search.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/enterprisesearch.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/enterprisesearch.yaml new file mode 100644 index 00000000..af224e35 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/templates/enterprisesearch.yaml @@ -0,0 +1,62 @@ +--- +apiVersion: enterprisesearch.k8s.elastic.co/v1 +kind: EnterpriseSearch +metadata: + name: {{ include "eck-enterprise-search.fullname" . }} + labels: + {{- include "eck-enterprise-search.labels" . | nindent 4 }} + {{- with .Values.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "An Enterprise Search version is required" .Values.version }} + count: {{ required "A pod count is required" .Values.count }} + + {{- /* + This is complicated, but seems required to catch both the situations where the key does not exist (commented out), and the key exists but is an empty map. + */ -}} + {{- if and (or (and (hasKey .Values "configRef") (eq 0 (len .Values.configRef))) (not (hasKey .Values "configRef"))) (or (and (hasKey .Values "elasticsearchRef") (eq 0 (len .Values.elasticsearchRef))) (not (hasKey .Values "elasticsearchRef"))) }} + {{ fail "At least one of configRef or elasticsearchRef is required" }} + {{- end }} + + {{- with .Values.image }} + image: {{ . }} + {{- end }} + + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} + + {{- with .Values.config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.http }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.elasticsearchRef }} + elasticsearchRef: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.podTemplate }} + podTemplate: + {{- toYaml . | nindent 4 }} + {{- end }} + + {{- with .Values.configRef }} + configRef: + {{- toYaml . | nindent 2 }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/values.yaml new file mode 100644 index 00000000..24162c68 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-enterprise-search/values.yaml @@ -0,0 +1,108 @@ +--- +# Default values for eck-enterprise-search. +# This is a YAML-formatted file. + +# Overridable names of the Enterprise Search resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-enterprise-search'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Enterprise Search resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Enterprise Search. +# +# 8.19 should be the last minor version in the 8 line. +version: 8.19.0 + +# Enterprise Search Docker image to deploy +# +# image: + +# Used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-restrict-cross-namespace-associations.html +# +# serviceAccountName: "" + +# Labels that will be applied to Enterprise Search. +# +labels: {} + +# Annotations that will be applied to Enterprise Search. +# +annotations: {} + +# Count of Enterprise Search replicas to create. +# +count: 1 + +# The Enterprise Search configuration, the ECK equivalent to enterprise-search.yml +# ref: https://www.elastic.co/guide/en/enterprise-search/current/configuration.html#configuration-configure +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-enterprise-search-configuration.html +# +# At a minimum, you must specify the external URL and Kibana host. +# +config: {} + # define the exposed URL at which users will reach Enterprise Search + # ent_search.external_url: https://my-custom-domain:3002 + # define the exposed URL at which users will reach Kibana + # kibana.host: https://kibana.my-custom-domain:5601 + +# Settings to control how Enterprise Search will be accessed. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-accessing-elastic-services.html +# +http: {} + # tls: + # certificate: + # secretName: my-cert + # service: + # metadata: + # labels: + # my-custom: label + +# Reference to ECK-managed Elasticsearch resource. +# +elasticsearchRef: {} + # name: eck-elasticsearch + # Optional namespace reference to Elasticsearch resource. + # If not specified, then the namespace of the Enterprise Search resource + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating an Enterprise Search instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Set podTemplate to customize the pod used by Enterprise Search +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-customize-pods.html +# +podTemplate: {} + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# If you would prefer your sensitive data to be stored in a Secret, you can specify the name of the Secret reference. +# In addition, if you do not want to use the `elasticsearchRef` mechanism or if you want to connect to an Elasticsearch +# cluster not managed by ECK, you can manually configure Enterprise Search to access any available Elasticsearch cluster: +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-enterprise-search-configuration.html#k8s-enterprise-search-secret-configuration +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-enterprise-search-configuration.html#k8s-enterprise-search-connect-non-eck-es +# +configRef: {} + # secretName: enterprise-search-config diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/Chart.yaml new file mode 100644 index 00000000..31a8412a --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/Chart.yaml @@ -0,0 +1,11 @@ +apiVersion: v2 +description: Elastic Fleet Server as an Agent managed by the ECK operator +kubeVersion: '>= 1.21.0-0' +name: eck-fleet-server +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/elastic-agent +- https://github.com/elastic/fleet-server +- https://www.elastic.co/guide/en/fleet/current/fleet-overview.html +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml new file mode 100644 index 00000000..2a87a639 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/examples/fleet-server.yaml @@ -0,0 +1,17 @@ +version: 9.3.0 +deployment: + replicas: 1 + podTemplate: + spec: + serviceAccountName: fleet-server + automountServiceAccountToken: true +elasticsearchRefs: +- name: eck-elasticsearch +kibanaRef: + name: eck-kibana +http: + service: + spec: + type: ClusterIP +serviceAccount: + name: fleet-server diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/NOTES.txt new file mode 100644 index 00000000..eb3c879d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Fleet Server status + $ kubectl get agent {{ include "fleet-server.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Fleet Server pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l fleet-server.k8s.elastic.co/name={{ include "fleet-server.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/_helpers.tpl new file mode 100644 index 00000000..173f5089 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "fleet-server.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "fleet-server.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "fleet-server.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "fleet-server.labels" -}} +helm.sh/chart: {{ include "fleet-server.chart" . }} +{{ include "fleet-server.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "fleet-server.selectorLabels" -}} +app.kubernetes.io/name: {{ include "fleet-server.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role-binding.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role-binding.yaml new file mode 100644 index 00000000..e5fee457 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role-binding.yaml @@ -0,0 +1,33 @@ +{{- with .Values.clusterRoleBinding }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: {{ .name }} + labels: + {{- include "fleet-server.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- with .subjects }} +subjects: +{{- range . }} + - kind: {{ .kind }} + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} +{{- end }} +{{- end }} +roleRef: + kind: {{ .roleRef.kind }} + name: {{ .roleRef.name }} + apiGroup: {{ .roleRef.apiGroup }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role.yaml new file mode 100644 index 00000000..f067b628 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/cluster-role.yaml @@ -0,0 +1,22 @@ +{{- with .Values.clusterRole }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: {{ .name }} + labels: + {{- include "fleet-server.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +rules: {{- toYaml .rules | nindent 2 }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/fleet-server.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/fleet-server.yaml new file mode 100644 index 00000000..2eb3b0d3 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/fleet-server.yaml @@ -0,0 +1,64 @@ +--- +apiVersion: agent.k8s.elastic.co/v1alpha1 +kind: Agent +metadata: + name: {{ include "fleet-server.fullname" . }} + labels: + {{- include "fleet-server.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Fleet Server version is required" (or ((.Values.spec).version) (.Values.version)) }} + mode: fleet + fleetServerEnabled: true + {{- if (or (hasKey (.Values.spec) "mode") (hasKey .Values "mode")) }} + {{- fail "mode cannot be changed" }} + {{- end }} + {{- if (or (hasKey (.Values.spec) "fleetServerEnabled") (hasKey .Values "fleetServerEnabled"))}} + {{- fail "fleetServerEnabled cannot be changed" }} + {{- end }} + + {{- $statefulSet := (or (hasKey (.Values.spec) "statefulSet") (hasKey .Values "statefulSet")) }} + {{- $deployment := (or (hasKey (.Values.spec) "deployment") (hasKey .Values "deployment")) }} + {{- if and (not $statefulSet) (not $deployment) }} + {{ fail "At least one of statefulSet or deployment is required" }} + {{- end }} + {{- if $statefulSet }} + {{- $ss := or ((.Values.spec).statefulSet) (.Values.statefulSet) }} + statefulSet: + {{- /* This is required to render the empty statefulSet ( {} ) properly */}} + {{- $ss | default dict | toYaml | nindent 4 }} + {{- end }} + {{- if $deployment }} + {{- $deploy := or ((.Values.spec).deployment) (.Values.deployment) }} + deployment: + {{- /* This is required to render the empty deployment ( {} ) properly */}} + {{- $deploy | default dict | toYaml | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).image) (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with or ((.Values.spec).elasticsearchRefs) (.Values.elasticsearchRefs) }} + elasticsearchRefs: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).kibanaRef) (.Values.kibanaRef) }} + kibanaRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).policyID) (.Values.policyID) }} + policyID: {{ . }} + {{- end }} + {{- with or ((.Values.spec).http) (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).revisionHistoryLimit) (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with or (((.Values.spec).serviceAccount).name) ((.Values.serviceAccount).name) }} + serviceAccountName: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/service-account.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/service-account.yaml new file mode 100644 index 00000000..0f8901d9 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/templates/service-account.yaml @@ -0,0 +1,22 @@ +{{- with .Values.serviceAccount }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ .name }} + namespace: {{ .namespace | default $.Release.Namespace | quote }} + labels: + {{- include "fleet-server.labels" $ | nindent 4 }} + {{- with .labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if or $.Values.annotations .annotations }} + annotations: + {{- with $.Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/values.yaml new file mode 100644 index 00000000..f7aaf62d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-fleet-server/values.yaml @@ -0,0 +1,169 @@ +--- +# Default values for eck-fleet-server. +# This is a YAML-formatted file. + +# Overridable names of the Fleet Server resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-fleet-server'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Fleet Server resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Elastic Fleet Server. +# +version: 9.3.0 + +# Labels that will be applied to Elastic Fleet Server. +# +labels: {} + +# Annotations that will be applied to Elastic Fleet Server. +# +annotations: {} + +# Elastic Fleet Server Agent image to deploy. +# +# image: docker.elastic.co/beats/elastic-agent:9.3.0 + +# ** Deprecation Notice ** +# The previous versions of this Helm Chart simply used the `spec` field here +# and allowed the user to specify any fields below `spec` that were templated directly +# into the final Agent/Fleet Server manifest. This is no longer the preferred way to specify these +# fields and each field that is supported underneath `spec` is now directly specified +# in this values file. Currently both patterns are supported for backwards compatibility +# but we plan to remove the `spec` field in the future. +# spec: {} + +# Referenced resources are below and both elasticsearchRefs and kibanaRef are required for a functional Fleet Server. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-setting-referenced-resources +# +# Reference to ECK-managed Kibana instance. +# This is required for Fleet Server. +# +# kibanaRef: +# name: quickstart + # Optional namespace reference to Kibana instance. + # If not specified, then the namespace of the Fleet Server resource + # will be assumed. + # + # namespace: default + +# Reference to ECK-managed Elasticsearch instance. +# This is required for Fleet Server. +# +elasticsearchRefs: [] +# - name: eck-elasticsearch + # Optional namespace reference to Elasticsearch instance. + # If not specified, then the namespace of the Fleet Server resource + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating a Fleet Server instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # - `api-key`: the key to authenticate against the Elastic resource instead of a username and password + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# policyID determines into which Agent Policy this Fleet Server will be enrolled. +policyID: eck-fleet-server + +# The HTTP layer configuration for the Fleet Server Service. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-customize-fleet-server-service +# +# http: + +# Deployment or StatefulSet specification for Fleet Server. +# At least one is required of [deployment, statefulSet]. +# No default is currently set, refer to https://github.com/elastic/cloud-on-k8s/issues/7429. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-chose-the-deployment-model +# +# deployment: +# replicas: 1 +# podTemplate: +# spec: +# serviceAccountName: fleet-server +# automountServiceAccountToken: true +# +# statefulSet: +# podTemplate: +# spec: +# serviceAccountName: fleet-server +# automountServiceAccountToken: true + +# Number of revisions to retain to allow rollback in the underlying Deployment. +# If not set Kubernetes sets this to 10 by default. +# +# revisionHistoryLimit: 2 + +# ServiceAccount to be used by Elastic Fleet Server. Some Fleet Server features (such as autodiscover or Kubernetes module metricsets) +# require that Fleet Server Pods interact with Kubernetes APIs. This functionality requires specific permissions +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +serviceAccount: + name: fleet-server + # namespace: optional-namespace + +# ClusterRoleBinding to be used by Elastic Fleet Server. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +clusterRoleBinding: + name: fleet-server + subjects: + - kind: ServiceAccount + name: fleet-server + # namespace: default + roleRef: + kind: ClusterRole + name: fleet-server + apiGroup: rbac.authorization.k8s.io + +# ClusterRole to be used by Elastic Fleet Server. Similar to ServiceAccount, this is required in some scenarios. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-elastic-agent-fleet-configuration.html#k8s-elastic-agent-fleet-configuration-role-based-access-control +# +clusterRole: + name: fleet-server + rules: + - apiGroups: [""] + resources: + - pods + - namespaces + - nodes + verbs: + - get + - watch + - list + - apiGroups: ["apps"] + resources: + - replicasets + verbs: + - get + - watch + - list + - apiGroups: ["batch"] + resources: + - jobs + verbs: + - get + - watch + - list + - apiGroups: ["coordination.k8s.io"] + resources: + - leases + verbs: + - get + - create + - update diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/Chart.yaml new file mode 100644 index 00000000..434e6589 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Kibana managed by the ECK operator +icon: https://helm.elastic.co/icons/kibana.png +kubeVersion: '>= 1.21.0-0' +name: eck-kibana +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/kibana +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/http-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/http-configuration.yaml new file mode 100644 index 00000000..644d8ea7 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/http-configuration.yaml @@ -0,0 +1,36 @@ +--- +# Version of Kibana. +# +version: 9.3.0 + +# Labels that will be applied to Kibana. +# +labels: {} + # key: value + +# Annotations that will be applied to Kibana. +# +annotations: {} + # key: value + +# Count of Kibana replicas to create. +# +count: 1 + +# Reference to ECK-managed Elasticsearch resource, ideally from {{ "elasticsearch.fullname" }} +# +elasticsearchRef: + name: eck-elasticsearch + # namespace: default +http: + service: + spec: + # Type of service to deploy for Kibana. + # This deploys a load balancer in a cloud service provider, where supported. + # + type: LoadBalancer + # tls: + # selfSignedCertificate: + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: kibana.example.com diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-aks.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-aks.yaml new file mode 100644 index 00000000..b7363dd0 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-aks.yaml @@ -0,0 +1,28 @@ +# The following is an example of a Kibana resource that is configured to use an Ingress resource in an AKS cluster. +# + +# Name of the Kibana instance. +# +fullnameOverride: kibana + +# Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} +# +elasticsearchRef: + name: elasticsearch +config: + server: + publicBaseUrl: "https://kibana.company.dev" + +ingress: + enabled: true + className: webapprouting.kubernetes.azure.com + annotations: + # This is required for AKS Loadbalancing to understand that it's communicating with + # an HTTPS backend. + nginx.ingress.kubernetes.io/backend-protocol: "HTTPS" + labels: + my: label + pathType: Prefix + hosts: + - host: "kibana.company.dev" + path: "/" diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml new file mode 100644 index 00000000..c5f2f43b --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-eks.yaml @@ -0,0 +1,48 @@ +# The following is an example of a Kibana resource that is configured to use an Ingress resource in an EKS cluster. +# + +# Name of the Kibana instance. +# +fullnameOverride: kibana + +# Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} +# +elasticsearchRef: + name: elasticsearch +config: + server: + publicBaseUrl: "https://kibana.company.dev" + +ingress: + enabled: true + className: alb + annotations: + alb.ingress.kubernetes.io/scheme: "internet-facing" + alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]' + alb.ingress.kubernetes.io/backend-protocol: "HTTPS" + alb.ingress.kubernetes.io/target-type: "ip" + # To use an ALB with ECK, you must provide a valid ACM certificate ARN or use certificate discovery. + # There are 2 options for EKS: + # 1. Create a valid ACM certificate, and uncomment the following annotation and update it to the correct ARN. + # 2. Create a valid ACM certificate and ensure that the hosts[0].host matches the certificate's Common Name (CN) and + # certificate discovery *should* find the certificate automatically and use it. + # + # ref: https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.8/guide/ingress/cert_discovery/ + # + # alb.ingress.kubernetes.io/certificate-arn: "arn:aws:acm:us-east-1:00000000000:certificate/b65be571-8220-4f2e-8cb1-94194535d877" + labels: + my: label + pathType: Prefix + hosts: + - host: "kibana.company.dev" + path: "/" +nodeSets: +- name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-gke.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-gke.yaml new file mode 100644 index 00000000..61427581 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/examples/ingress/kibana-gke.yaml @@ -0,0 +1,31 @@ +# The following is an example of a Kibana resource that is configured to use an Ingress resource in a GKE cluster. +# + +# Name of the Kibana instance. +# +fullnameOverride: kibana + +# Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} +# +elasticsearchRef: + name: elasticsearch +config: + server: + publicBaseUrl: "https://kibana.company.dev" +http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + # This is required to enable the GKE Ingress Controller to use HTTPS as the backend protocol. + cloud.google.com/app-protocols: '{"https":"HTTPS"}' + +ingress: + enabled: true + pathType: Prefix + hosts: + - host: "kibana.company.dev" + path: "/" + tls: + enabled: true diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/NOTES.txt new file mode 100644 index 00000000..9652161c --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Kibana status + $ kubectl get kibana {{ include "kibana.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Kibana pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l kibana.k8s.elastic.co/name={{ include "kibana.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/_helpers.tpl new file mode 100644 index 00000000..eba5497d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "kibana.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "kibana.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "kibana.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "kibana.labels" -}} +helm.sh/chart: {{ include "kibana.chart" . }} +{{ include "kibana.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "kibana.selectorLabels" -}} +app.kubernetes.io/name: {{ include "kibana.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/ingress.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/ingress.yaml new file mode 100644 index 00000000..171463c0 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/ingress.yaml @@ -0,0 +1,48 @@ +{{- if .Values.ingress.enabled -}} +{{- $pathType := .Values.ingress.pathType | default "Prefix" -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "kibana.fullname" . }} + labels: + {{- include "kibana.labels" . | nindent 4 }} + {{- with .Values.ingress.labels }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if .Values.ingress.annotations }} + annotations: + {{- with .Values.ingress.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} +spec: + {{- if .Values.ingress.className }} + ingressClassName: {{ .Values.ingress.className | quote }} + {{- end }} + {{- if .Values.ingress.tls.enabled }} + tls: + - hosts: + {{- range .Values.ingress.hosts }} + - {{ .host | quote }} + {{- end }} + {{- if .Values.ingress.tls.secretName }} + secretName: {{ .Values.ingress.tls.secretName }} + {{- else }} + secretName: {{ include "kibana.fullname" . }}-kb-http-certs-internal + {{- end }} + {{- end }} + rules: + {{- range .Values.ingress.hosts }} + {{- $hostPath := .path | default "/" }} + - host: {{ .host | quote }} + http: + paths: + - path: {{ $hostPath }} + pathType: {{ $pathType }} + backend: + service: + name: {{ include "kibana.fullname" $ }}-kb-http + port: + number: 5601 + {{- end }} +{{ end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/kibana.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/kibana.yaml new file mode 100644 index 00000000..81a6293f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/templates/kibana.yaml @@ -0,0 +1,66 @@ +--- +apiVersion: kibana.k8s.elastic.co/v1 +kind: Kibana +metadata: + name: {{ include "kibana.fullname" . }} + labels: + {{- include "kibana.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Kibana version is required" .Values.version }} + {{- /* + The following templates with 'or' are to allow both .spec.field and .field to be set for backwards + compatibility purposes. See https://github.com/elastic/cloud-on-k8s/pull/8192 for details. + */ -}} + {{- with or ((.Values.spec).image) (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with or ((.Values.spec).count) (.Values.count) }} + count: {{ . }} + {{- end }} + {{- $esRef := or ((.Values.spec).elasticsearchRef) (.Values.elasticsearchRef) }} +{{- if not (or ($esRef).name ($esRef).secretName) }} + {{ fail "An elasticsearchRef name or secretName is required" }} + {{- end }} + elasticsearchRef: + {{- toYaml $esRef | nindent 4 }} + {{- $entsearchRef := or ((.Values.spec).enterpriseSearchRef) (.Values.enterpriseSearchRef) }} + {{- if $entsearchRef }} + enterpriseSearchRef: + {{- toYaml $entsearchRef | nindent 4 }} + {{- end }} + {{- $eprRef := or ((.Values.spec).packageRegistryRef) (.Values.packageRegistryRef) }} + {{- if $eprRef }} + packageRegistryRef: + {{- toYaml $eprRef | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).config) (.Values.config) }} + config: + {{ toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).http) (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).podTemplate) (.Values.podTemplate) }} + podTemplate: + {{ toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).revisionHistoryLimit) (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} + {{- with or ((.Values.spec).secureSettings) (.Values.secureSettings) }} + secureSettings: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with or ((.Values.spec).serviceAccountName) (.Values.serviceAccountName) }} + serviceAccountName: {{ . }} + {{- end }} + {{- with or ((.Values.spec).monitoring) (.Values.monitoring) }} + monitoring: + {{- toYaml . | nindent 4 }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/values.yaml new file mode 100644 index 00000000..f25c7055 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-kibana/values.yaml @@ -0,0 +1,194 @@ +--- +# Default values for eck-kibana. +# This is a YAML-formatted file. + +# Overridable names of the Kibana resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-kibana'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Kibana resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Kibana. +# +version: 9.3.0 + +# Kibana Docker image to deploy +# +# image: docker.elastic.co/kibana/kibana:9.3.0 + +# Labels that will be applied to Kibana. +# +labels: {} + +# Annotations that will be applied to Kibana. +# +annotations: {} + +# ** Deprecation Notice ** +# The previous versions of this Helm Chart simply used the `spec` field here +# and allowed the user to specify any fields below spec that were templated directly +# into the final Kibana manifest. This is no long the preferred way to specify these +# fields and each field that is supported underneath `spec` is now directly specified +# in this values file. Currently both patterns are supported for backwards compatibility +# but we plan to remove the `spec` field in the future. +# spec: {} + +# Count of Kibana replicas to create. +# +count: 1 + +# Reference to ECK-managed Elasticsearch resource. +# +elasticsearchRef: {} + # name: eck-elasticsearch + # Optional namespace reference to Elasticsearch resource. + # If not specified, then the namespace of the Kibana resource + # will be assumed. + # + # namespace: default + # + # Optional secretName referencing an existing Kubernetes secret that contains connection information + # for associating a Kibana instance to a remote Elasticsearch instance not managed by ECK. + # The referenced secret must contain the following: + # - `url`: the URL to reach the Elastic resource + # - `username`: the username of the user to be authenticated to the Elastic resource + # - `password`: the password of the user to be authenticated to the Elastic resource + # - `ca.crt`: the CA certificate in PEM format (optional) + # This field cannot be used in combination with the other fields name, namespace or serviceName. + # + # secretName: my-remote-es-credentials + +# Reference to an EnterpriseSearch running in the same Kubernetes cluster +# +# enterpriseSearchRef: + +# Reference to an PackageRegistry running in the same Kubernetes cluster +# +# packageRegistryRef: + +# The Kibana configuration (kibana.yml) +# ref: https://www.elastic.co/guide/en/kibana/current/settings.html +# +config: null + +# The HTTP layer configuration for Kibana. +# +# http: + +# PodTemplate provides customisation options (labels, annotations, affinity rules, +# resource requests, and so on) for the Kibana pods +# +# podTemplate: + +# Number of revisions to retain to allow rollback in the underlying deployment. +# By default, if not set, Kubernetes sets 10. +# +# revisionHistoryLimit: 2 + +# Control Kibana Secure Settings. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-kibana-secure-settings.html +# +secureSettings: [] + +# Used to check access from the current resource to a resource (for ex. Elasticsearch) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# +# serviceAccountName: "" + +# Settings for configuring stack monitoring. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-stack-monitoring.html +# +monitoring: {} + # metrics: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + # logs: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + +# Settings for controlling Kibana ingress. Enabling ingress will expose your Kibana instance +# to the public internet, and as such is disabled by default. +# +# *NOTE* when configuring Kibana Ingress, ensure that `config.server.publicBaseUrl` setting for +# Kibana is also set, as it is required when exposing Kibana behind a load balancer/ingress. +# Also of note are `server.basePath`, and `server.rewriteBasePath` settings in the Kibana configuration. +# +# ref: https://www.elastic.co/guide/en/kibana/current/settings.html +# +# Each Cloud Service Provider has different requirements for setting up Ingress. Some links to common documentation are: +# - AWS: https://docs.aws.amazon.com/eks/latest/userguide/alb-ingress.html +# - GCP: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress +# - Azure: https://learn.microsoft.com/en-us/azure/aks/app-routing +# - Nginx: https://kubernetes.github.io/ingress-nginx/ +# +ingress: + enabled: false + + # Annotations that will be applied to the Ingress resource. Note that some ingress controllers are controlled via annotations. + # + # Nginx Annotations: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/ + # + # Common annotations: + # kubernetes.io/ingress.class: gce # Configures the Ingress resource to use the GCE ingress controller and create an external Application Load Balancer. + # kubernetes.io/ingress.class: gce-internal # Configures the Ingress resource to use the GCE ingress controller and create an internal Application Load Balancer. + # kubernetes.io/ingress.class: nginx # Configures the Ingress resource to use the NGINX ingress controller. + # + annotations: {} + + # Labels that will be applied to the Ingress resource. + # + labels: {} + + # Some ingress controllers require the use of a specific class name to route traffic to the correct controller, notably AKS and EKS, which + # replaces the use of the 'kubernetes.io/ingress.class' annotation. + # + # className: webapprouting.kubernetes.azure.com | alb + + # Ingress paths are required to have a corresponding path type. Defaults to 'Prefix'. + # + # There are 3 supported path types: + # - ImplementationSpecific + # - Prefix + # - Exact + # + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types + # + pathType: Prefix + + # Hosts are a list of hosts included in the Ingress definition, with a corresponding path at which the Kibana service + # will be exposed. Each host in the list should be a fully qualified DNS name that will resolve to the exposed Ingress object. + # + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#name-based-virtual-hosting + # + hosts: + - host: chart-example.local + path: / + + # TLS defines whether TLS will be enabled on the Ingress resource. + # + # *NOTE* Many Cloud Service Providers handle TLS in a custom manner, and as such, it is recommended to consult their documentation. + # Notably GKE and Nginx Ingress Controllers seems to respect the Ingress TLS settings, AKS and EKS ignore it. + # + # - AKS: https://learn.microsoft.com/en-us/azure/aks/app-routing-dns-ssl + # - GKE: https://cloud.google.com/kubernetes-engine/docs/concepts/ingress#options_for_providing_ssl_certificates + # - EKS: https://aws.amazon.com/blogs/containers/serve-distinct-domains-with-tls-powered-by-acm-on-amazon-eks/ + # - Nginx: https://kubernetes.github.io/ingress-nginx/user-guide/tls/ + # + # Kubernetes ingress TLS documentation: + # ref: https://kubernetes.io/docs/concepts/services-networking/ingress/#tls + # + tls: + enabled: false + # Optional Kubernetes secret name that contains a base64 encoded PEM certificate and private key that corresponds to the above 'hosts' definitions. + # If tls is enabled, but this field is not set, the self-signed certificate and key created by the ECK operator will be used. + # secretName: chart-example-tls diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/Chart.yaml new file mode 100644 index 00000000..1f848b4d --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/Chart.yaml @@ -0,0 +1,10 @@ +apiVersion: v2 +description: Logstash managed by the ECK operator +icon: https://helm.elastic.co/icons/logstash.png +kubeVersion: '>= 1.21.0-0' +name: eck-logstash +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/logstash +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/basic-eck.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/basic-eck.yaml new file mode 100644 index 00000000..3809ee61 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/basic-eck.yaml @@ -0,0 +1,44 @@ +--- +# values corresponding to config/recipes/logstash/logstash-eck.yaml +version: 9.3.0 + +elasticsearchRefs: + - clusterName: eck + name: elasticsearch + +pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + +services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/es-role.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/es-role.yaml new file mode 100644 index 00000000..151a0a79 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/es-role.yaml @@ -0,0 +1,25 @@ +--- +# values corresponding to config/recipes/logstash/logstash-es-role.yaml +version: 9.3.0 + +elasticsearchRefs: + - clusterName: eck + name: elasticsearch + +pipelines: + - pipeline.id: main + config.string: | + input { exec { command => "uptime" interval => 10 } } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + ssl_enabled => true + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + index => "my-index" + data_stream => false + ilm_enabled => false + manage_template => false + } + } diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/monitored.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/monitored.yaml new file mode 100644 index 00000000..2082558e --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/monitored.yaml @@ -0,0 +1,49 @@ +--- +# values corresponding to config/recipes/logstash/logstash-monitored.yaml +version: 9.3.0 + +monitoring: + metrics: + elasticsearchRefs: + - name: elasticsearch-monitoring + +pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + +elasticsearchRefs: + - clusterName: eck + name: elasticsearch + +services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/multi.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/multi.yaml new file mode 100644 index 00000000..82011d9a --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/multi.yaml @@ -0,0 +1,78 @@ +--- +# values corresponding to config/recipes/logstash/logstash-multi.yaml +version: 9.3.0 + +pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + pipeline { + send_to => 'prod' + } + pipeline { + send_to => 'qa' + } + } + - pipeline.id: production + config.string: | + input { + pipeline { + address => 'prod' + } + } + output { + elasticsearch { + hosts => [ "${PROD_ES_ES_HOSTS}" ] + user => "${PROD_ES_ES_USER}" + password => "${PROD_ES_ES_PASSWORD}" + ssl_certificate_authorities => "${PROD_ES_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + - pipeline.id: qa + config.string: | + input { + pipeline { + address => 'qa' + } + } + output { + elasticsearch { + hosts => [ "${QA_ES_ES_HOSTS}" ] + user => "${QA_ES_ES_USER}" + password => "${QA_ES_ES_PASSWORD}" + ssl_certificate_authorities => "${QA_ES_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + +elasticsearchRefs: + - clusterName: prod-es + name: production + - clusterName: qa-es + name: qa + namespace: qa + +services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/volumes.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/volumes.yaml new file mode 100644 index 00000000..ab6c1911 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/examples/volumes.yaml @@ -0,0 +1,107 @@ +--- +# values corresponding to config/recipes/logstash/logstash-volumes.yaml +version: 9.3.0 + +config: + log.level: info + queue.type: persisted + path.queue: /usr/share/logstash/pq + +podTemplate: + spec: + containers: + - name: logstash + volumeMounts: + - mountPath: /usr/share/logstash/pq + name: pq + readOnly: false + - mountPath: /usr/share/logstash/dlq + name: dlq + readOnly: false + +pipelines: + - pipeline.id: dlq_read + dead_letter_queue.enable: false + config.string: | + input { + dead_letter_queue { + path => "/usr/share/logstash/dlq" + commit_offsets => true + pipeline_id => "beats" + clean_consumed => true + } + } + filter { + mutate { + remove_field => "[geoip][location]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + - pipeline.id: beats + dead_letter_queue.enable: true + path.dead_letter_queue: /usr/share/logstash/dlq + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + +volumeClaimTemplates: + - metadata: + name: pq + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Gi + - metadata: + name: dlq + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 5Gi + + +elasticsearchRefs: + - clusterName: eck + name: elasticsearch + +services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 + diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/NOTES.txt new file mode 100644 index 00000000..c2f255af --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Logstash status + $ kubectl get logstash {{ include "logstash.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Logstash pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l logstash.k8s.elastic.co/name={{ include "logstash.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/_helpers.tpl new file mode 100644 index 00000000..7efd669f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "logstash.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "logstash.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "logstash.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "logstash.labels" -}} +helm.sh/chart: {{ include "logstash.chart" . }} +{{ include "logstash.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "logstash.selectorLabels" -}} +app.kubernetes.io/name: {{ include "logstash.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/logstash.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/logstash.yaml new file mode 100644 index 00000000..8ba52ef6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/templates/logstash.yaml @@ -0,0 +1,58 @@ +--- +apiVersion: logstash.k8s.elastic.co/v1alpha1 +kind: Logstash +metadata: + name: {{ include "logstash.fullname" . }} + labels: + {{- include "logstash.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Logstash version is required" .Values.version }} + count: {{ required "A pod count is required" .Values.count }} + {{- with .Values.image }} + image: {{ . }} + {{- end }} + {{- with .Values.serviceAccountName }} + serviceAccountName: {{ . }} + {{- end }} + {{- with .Values.revisionHistoryLimit }} + revisionHistoryLimit: {{ . }} + {{- end }} + + {{- if and .Values.config .Values.configRef }} + {{- fail "config and configRef are mutually exclusive!" }} + {{- end }} + {{- with .Values.config }} + config: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.configRef }} + configRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.podTemplate }} + podTemplate: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with .Values.monitoring }} + monitoring: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if and .Values.pipelines .Values.pipelinesRef }} + {{- fail "pipelines and pipelinesRef are mutually exclusive!" }} + {{- end }} + {{- with .Values.pipelinesRef }} + pipelinesRef: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if .Values.pipelines }} + pipelines: {{ toYaml .Values.pipelines | nindent 4 }} + {{- end }} + volumeClaimTemplates: {{ toYaml .Values.volumeClaimTemplates | nindent 4 }} + elasticsearchRefs: {{ toYaml .Values.elasticsearchRefs | nindent 4 }} + services: {{ toYaml .Values.services | nindent 4 }} + secureSettings: {{ toYaml .Values.secureSettings | nindent 4 }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/values.yaml new file mode 100644 index 00000000..db949b46 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-logstash/values.yaml @@ -0,0 +1,115 @@ +--- +# Default values for eck-logstash. +# This is a YAML-formatted file. + +# Overridable names of the Logstash resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-logstash'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the Logstash resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Logstash. +# +version: 9.3.0 + +# Logstash Docker image to deploy +# +# image: + +# Used to check access from the current resource to a resource (for ex. a remote Elasticsearch cluster) in a different namespace. +# Can only be used if ECK is enforcing RBAC on references. +# +# serviceAccountName: "" + +# Labels that will be applied to Logstash. +# +labels: {} + +# Annotations that will be applied to Logstash. +# +annotations: {} + +# Number of revisions to retain to allow rollback in the underlying StatefulSets. +# By default, if not set, Kubernetes sets 10. +# +# revisionHistoryLimit: 2 + +# Controlling the number of pods. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-scaling-logstash.html +# +count: 1 + +# The logstash configuration, the ECK equivalent to logstash.yml +# +# NOTE: The `config` and `configRef` fields are mutually exclusive. Only one of them should be defined at a time, +# as using both may cause conflicts. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-configuring-logstash +# +config: {} + +# Reference a configuration in a Secret. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-configuring-logstash +# +# configRef: +# secretName: '' + +# Set podTemplate to customize the pod used by Logstash +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-customize-pods.html +# +podTemplate: {} + +# Settings for configuring stack monitoring. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-stack-monitoring.html +# +monitoring: {} + # metrics: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + # logs: + # elasticsearchRefs: + # - name: monitoring + # namespace: observability + +# The Logstash pipelines, the ECK equivalent to pipelines.yml +# +# NOTE: The `pipelines` and `pipelinesRef` fields are mutually exclusive. Only one of them should be defined at a time, +# as using both may cause conflicts. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-pipelines +# +pipelines: [] + +# Reference a pipelines configuration in a Secret. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-pipelines +# +# pipelinesRef: +# secretName: '' + +# volumeClaimTemplates +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-volume-claim-settings +# +volumeClaimTemplates: [] + +# ElasticsearchRefs are references to Elasticsearch clusters running in the same Kubernetes cluster. +# Ensure that the 'clusterName' field matches what is referenced in the pipeline. +# ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-logstash-configuration.html#k8s-logstash-pipelines-es +# +elasticsearchRefs: [] +# - namespace: '' +# name: '' +# clusterName: '' +# serviceName: '' +# secretName: '' + +services: [] + +# SecureSettings is a list of references to Kubernetes Secrets containing sensitive configuration options for the Logstash +secureSettings: [] diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/.helmignore b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/.helmignore new file mode 100644 index 00000000..f1568daf --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +templates/tests diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/Chart.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/Chart.yaml new file mode 100644 index 00000000..d22d653a --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/Chart.yaml @@ -0,0 +1,9 @@ +apiVersion: v2 +description: Elastic Package Registry managed by the ECK operator +kubeVersion: '>= 1.21.0-0' +name: eck-package-registry +sources: +- https://github.com/elastic/cloud-on-k8s +- https://github.com/elastic/package-registry +type: application +version: 0.18.2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/LICENSE b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/LICENSE new file mode 100644 index 00000000..92503a72 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/LICENSE @@ -0,0 +1,93 @@ +Elastic License 2.0 + +URL: https://www.elastic.co/licensing/elastic-license + +## Acceptance + +By using the software, you agree to all of the terms and conditions below. + +## Copyright License + +The licensor grants you a non-exclusive, royalty-free, worldwide, +non-sublicensable, non-transferable license to use, copy, distribute, make +available, and prepare derivative works of the software, in each case subject to +the limitations and conditions below. + +## Limitations + +You may not provide the software to third parties as a hosted or managed +service, where the service provides users with access to any substantial set of +the features or functionality of the software. + +You may not move, change, disable, or circumvent the license key functionality +in the software, and you may not remove or obscure any functionality in the +software that is protected by the license key. + +You may not alter, remove, or obscure any licensing, copyright, or other notices +of the licensor in the software. Any use of the licensor’s trademarks is subject +to applicable law. + +## Patents + +The licensor grants you a license, under any patent claims the licensor can +license, or becomes able to license, to make, have made, use, sell, offer for +sale, import and have imported the software, in each case subject to the +limitations and conditions in this license. This license does not cover any +patent claims that you cause to be infringed by modifications or additions to +the software. If you or your company make any written claim that the software +infringes or contributes to infringement of any patent, your patent license for +the software granted under these terms ends immediately. If your company makes +such a claim, your patent license ends immediately for work on behalf of your +company. + +## Notices + +You must ensure that anyone who gets a copy of any part of the software from you +also gets a copy of these terms. + +If you modify the software, you must include in any modified copies of the +software prominent notices stating that you have modified the software. + +## No Other Rights + +These terms do not imply any licenses other than those expressly granted in +these terms. + +## Termination + +If you use the software in violation of these terms, such use is not licensed, +and your licenses will automatically terminate. If the licensor provides you +with a notice of your violation, and you cease all violation of this license no +later than 30 days after you receive that notice, your licenses will be +reinstated retroactively. However, if you violate these terms after such +reinstatement, any additional violation of these terms will cause your licenses +to terminate automatically and permanently. + +## No Liability + +*As far as the law allows, the software comes as is, without any warranty or +condition, and the licensor will not be liable to you for any damages arising +out of these terms or the use or nature of the software, under any kind of +legal claim.* + +## Definitions + +The **licensor** is the entity offering these terms, and the **software** is the +software the licensor makes available under these terms, including any portion +of it. + +**you** refers to the individual or entity agreeing to these terms. + +**your company** is any legal entity, sole proprietorship, or other kind of +organization that you work for, plus all organizations that have control over, +are under the control of, or are under common control with that +organization. **control** means ownership of substantially all the assets of an +entity, or the power to direct its management and policies by vote, contract, or +otherwise. Control can be direct or indirect. + +**your licenses** are all the licenses granted to you for the software under +these terms. + +**use** means anything you do with the software requiring one of your licenses. + +**trademark** means trademarks, service marks, and similar rights. \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/NOTES.txt new file mode 100644 index 00000000..51943d84 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/NOTES.txt @@ -0,0 +1,6 @@ + +1. Check Package Registry status + $ kubectl get epr {{ include "epr.fullname" . }} -n {{ .Release.Namespace }} + +2. Check Package Registry pod status + $ kubectl get pods --namespace={{ .Release.Namespace }} -l packageregistry.k8s.elastic.co/name={{ include "epr.fullname" . }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/_helpers.tpl new file mode 100644 index 00000000..1bb771b1 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "epr.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "epr.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "epr.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "epr.labels" -}} +helm.sh/chart: {{ include "epr.chart" . }} +{{ include "epr.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- if .Values.labels }} +{{ toYaml .Values.labels }} +{{- end }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "epr.selectorLabels" -}} +app.kubernetes.io/name: {{ include "epr.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/epr.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/epr.yaml new file mode 100644 index 00000000..2cfb90c1 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/templates/epr.yaml @@ -0,0 +1,35 @@ +--- +apiVersion: packageregistry.k8s.elastic.co/v1alpha1 +kind: PackageRegistry +metadata: + name: {{ include "epr.fullname" . }} + labels: + {{- include "epr.labels" . | nindent 4 }} + annotations: + eck.k8s.elastic.co/license: basic + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + version: {{ required "A Elastic Package Registry version is required" .Values.version }} + {{- with (.Values.image) }} + image: {{ . }} + {{- end }} + {{- with (.Values.count) }} + count: {{ . }} + {{- end }} + {{- with (.Values.config) }} + config: + {{ toYaml . | nindent 4 }} + {{- end }} + {{- with (.Values.http) }} + http: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- with (.Values.podTemplate) }} + podTemplate: + {{ toYaml . | nindent 4 }} + {{- end }} + {{- with (.Values.revisionHistoryLimit) }} + revisionHistoryLimit: {{ . }} + {{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/values.yaml new file mode 100644 index 00000000..48da0948 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/charts/eck-package-registry/values.yaml @@ -0,0 +1,57 @@ +--- +# Default values for eck-package-registry. +# This is a YAML-formatted file. + +# Overridable names of the PackageRegistry resource. +# By default, this is the Release name set for the chart, +# followed by 'eck-epr'. +# +# nameOverride will override the name of the Chart with the name set here, +# so nameOverride: quickstart, would convert to '{{ Release.name }}-quickstart' +# +# nameOverride: "quickstart" +# +# fullnameOverride will override both the release name, and the chart name, +# and will name the PackageRegistry resource exactly as specified. +# +# fullnameOverride: "quickstart" + +# Version of Package Registry. +# +version: 9.2.2 + +# Elastic Package Registry Docker image to deploy +# +# image: docker.elastic.co/package-registry/distribution:lite-9.2.2 + +# Labels that will be applied to Package Registry. +# +labels: {} + +# Annotations that will be applied to Package Registry. +# +annotations: {} + + +# Count of Package Registry replicas to create. +# +count: 1 + +# The Package Registry configuration (config.yml) +# ref: https://github.com/elastic/package-registry/blob/main/config.reference.yml +# +config: null + +# The HTTP layer configuration for Package Registry. +# +# http: + +# PodTemplate provides customisation options (labels, annotations, affinity rules, +# resource requests, and so on) for the EPR pods +# +# podTemplate: + +# Number of revisions to retain to allow rollback in the underlying deployment. +# By default, if not set, Kubernetes sets 10. +# +# revisionHistoryLimit: 2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/agent/fleet-agents.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/agent/fleet-agents.yaml new file mode 100644 index 00000000..4358b6f6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/agent/fleet-agents.yaml @@ -0,0 +1,122 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + # Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: elasticsearch + + config: + # Note that these are specific to the namespace into which this example is installed, and are + # using `elastic-stack` as configured here and detailed in the README when installing: + # + # `helm install es-kb-quickstart elastic/eck-stack -n elastic-stack` + # + # If installed outside of the `elastic-stack` namespace, the following 2 lines need modification. + xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-es-http.elastic-stack.svc:9200"] + xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.elastic-stack.svc:8220"] + xpack.fleet.packages: + - name: system + version: latest + - name: elastic_agent + version: latest + - name: fleet_server + version: latest + - name: kubernetes + version: latest + xpack.fleet.agentPolicies: + - name: Fleet Server on ECK policy + id: eck-fleet-server + namespace: default + is_managed: true + monitoring_enabled: + - logs + - metrics + package_policies: + - name: fleet_server-1 + id: fleet_server-1 + package: + name: fleet_server + - name: Elastic Agent on ECK policy + id: eck-agent + namespace: default + is_managed: true + monitoring_enabled: + - logs + - metrics + unenroll_timeout: 900 + package_policies: + - package: + name: system + name: system-1 + - package: + name: kubernetes + name: kubernetes-1 + +eck-agent: + enabled: true + + # Agent policy to be used. + policyID: eck-agent + # Reference to ECK-managed Kibana instance. + # + kibanaRef: + name: kibana + elasticsearchRefs: [] + # Reference to ECK-managed Fleet instance. + # + fleetServerRef: + name: fleet-server + + mode: fleet + daemonSet: + podTemplate: + spec: + serviceAccountName: elastic-agent + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + automountServiceAccountToken: true + securityContext: + runAsUser: 0 + +eck-fleet-server: + enabled: true + + fullnameOverride: "fleet-server" + + deployment: + replicas: 1 + podTemplate: + spec: + serviceAccountName: fleet-server + automountServiceAccountToken: true + + # Agent policy to be used. + policyID: eck-fleet-server + kibanaRef: + name: kibana + elasticsearchRefs: + - name: elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/basic.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/basic.yaml new file mode 100644 index 00000000..227b5825 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/basic.yaml @@ -0,0 +1,52 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + spec: + config: + xpack.fleet.packages: + - name: apm + version: latest + +eck-apm-server: + enabled: true + + # Count of APM Server replicas to create. + # + count: 1 + + # Reference to ECK-managed Elasticsearch resource. + # + elasticsearchRef: + name: elasticsearch + kibanaRef: + name: kibana + http: + service: + spec: + ports: + - name: http + port: 8200 + targetPort: 8200 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml new file mode 100644 index 00000000..b694955f --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/apm-server/jaeger-with-http-configuration.yaml @@ -0,0 +1,60 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + spec: + config: + xpack.fleet.packages: + - name: apm + version: latest + +eck-apm-server: + enabled: true + + # Count of APM Server replicas to create. + # + count: 1 + + config: + name: elastic-apm + apm-server.jaeger.grpc.enabled: true + apm-server.jaeger.grpc.host: "0.0.0.0:14250" + + # Reference to ECK-managed Elasticsearch resource. + # + elasticsearchRef: + name: elasticsearch + kibanaRef: + name: kibana + http: + service: + spec: + ports: + - name: http + port: 8200 + targetPort: 8200 + - name: grpc + port: 14250 + targetPort: 14250 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/autoops/basic.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/autoops/basic.yaml new file mode 100644 index 00000000..cea15ba1 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/autoops/basic.yaml @@ -0,0 +1,30 @@ +--- +eck-autoops-agent-policy: + enabled: true + autoOpsRef: + secretName: "autoops-secret" + resourceSelector: + matchLabels: + autoops: enabled + +eck-elasticsearch: + enabled: true + + # This label is used to select the Elasticsearch instance for AutoOps integration. + labels: + autoops: enabled + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 1 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/beats/metricbeat_hosts.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/beats/metricbeat_hosts.yaml new file mode 100644 index 00000000..ed071837 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/beats/metricbeat_hosts.yaml @@ -0,0 +1,217 @@ +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch resource. + # + fullnameOverride: quickstart + + # Version of Elasticsearch. + # + version: 9.3.0 + + nodeSets: + - name: default + count: 3 + config: + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + node.store.allow_mmap: false + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100Gi + # Adjust to your storage class name + # + # storageClassName: local-storage + +eck-kibana: + enabled: true + + # Name of the Kibana resource. + # + fullnameOverride: quickstart + + # Version of Kibana. + # + version: 9.3.0 + + spec: + # Count of Kibana replicas to create. + # + count: 1 + + # Reference to ECK-managed Elasticsearch resource, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: quickstart + +eck-beats: + enabled: true + name: metricbeat + type: metricbeat + version: 9.3.0 + elasticsearchRef: + name: quickstart + kibanaRef: + name: quickstart + config: + # Since filebeat is used in the default values, this needs to be removed with an empty list. + filebeat.inputs: [] + metricbeat: + autodiscover: + providers: + - hints: + default_config: {} + enabled: "true" + node: ${NODE_NAME} + type: kubernetes + modules: + - module: system + period: 10s + metricsets: + - cpu + - load + - memory + - network + - process + - process_summary + process: + include_top_n: + by_cpu: 5 + by_memory: 5 + processes: + - .* + - module: system + period: 1m + metricsets: + - filesystem + - fsstat + processors: + - drop_event: + when: + regexp: + system: + filesystem: + mount_point: ^/(sys|cgroup|proc|dev|etc|host|lib)($|/) + - module: kubernetes + period: 10s + node: ${NODE_NAME} + hosts: + - https://${NODE_NAME}:10250 + bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token + ssl: + verification_mode: none + metricsets: + - node + - system + - pod + - container + - volume + processors: + - add_cloud_metadata: {} + - add_host_metadata: {} + daemonSet: + podTemplate: + spec: + serviceAccountName: metricbeat + automountServiceAccountToken: true # some older Beat versions are depending on this settings presence in k8s context + containers: + - args: + - -e + - -c + - /etc/beat.yml + - --system.hostfs=/hostfs + name: metricbeat + volumeMounts: + - mountPath: /hostfs/sys/fs/cgroup + name: cgroup + - mountPath: /var/run/docker.sock + name: dockersock + - mountPath: /hostfs/proc + name: proc + env: + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + dnsPolicy: ClusterFirstWithHostNet + hostNetwork: true # Allows to provide richer host metadata + securityContext: + runAsUser: 0 + terminationGracePeriodSeconds: 30 + volumes: + - hostPath: + path: /sys/fs/cgroup + name: cgroup + - hostPath: + path: /var/run/docker.sock + name: dockersock + - hostPath: + path: /proc + name: proc + + clusterRole: + # permissions needed for metricbeat + # source: https://www.elastic.co/guide/en/beats/metricbeat/current/metricbeat-module-kubernetes.html + name: metricbeat + rules: + - apiGroups: + - "" + resources: + - nodes + - namespaces + - events + - pods + verbs: + - get + - list + - watch + - apiGroups: + - "extensions" + resources: + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - apps + resources: + - statefulsets + - deployments + - replicasets + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - nodes/stats + verbs: + - get + - nonResourceURLs: + - /metrics + verbs: + - get + + serviceAccount: + name: metricbeat + + clusterRoleBinding: + name: metricbeat + subjects: + - kind: ServiceAccount + name: metricbeat + roleRef: + kind: ClusterRole + name: metricbeat + apiGroup: rbac.authorization.k8s.io diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/custom-elasticsearch-kibana.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/custom-elasticsearch-kibana.yaml new file mode 100644 index 00000000..6e58df07 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/custom-elasticsearch-kibana.yaml @@ -0,0 +1,78 @@ +--- +eck-elasticsearch: + # Name of the Elasticsearch resource. + # + fullnameOverride: quickstart + + # Version of Elasticsearch. + # + version: 9.3.0 + + nodeSets: + - name: default + count: 1 + config: + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 100Gi + # Adjust to your storage class name + # + # storageClassName: local-storage + +eck-kibana: + # Name of the Kibana resource. + # + fullnameOverride: quickstart + + # Version of Kibana. + # + version: 9.3.0 + + spec: + # Count of Kibana replicas to create. + # + count: 1 + + # Reference to ECK-managed Elasticsearch resource, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: quickstart + # namespace: default + http: + service: + spec: + # Type of service to deploy for Kibana. + # This deploys a load balancer in a cloud service provider, where supported. + # + type: LoadBalancer + # tls: + # selfSignedCertificate: + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: kibana.example.com + podTemplate: + spec: + containers: + - name: kibana + env: + - name: NODE_OPTIONS + value: "--max-old-space-size=2048" + resources: + requests: + memory: 1Gi + cpu: 0.5 + limits: + memory: 2.5Gi + cpu: 2 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/hot-warm-cold.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/hot-warm-cold.yaml new file mode 100644 index 00000000..919cb4c7 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/hot-warm-cold.yaml @@ -0,0 +1,199 @@ +--- +eck-elasticsearch: + nodeSets: + - name: masters + count: 1 + config: + node.roles: ["master"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 8Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highio + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Ti + # Adjust to your storage class name + # + # storageClassName: local-storage + - name: hot + count: 1 + config: + node.roles: ["data_hot", "data_content", "ingest"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 16Gi + cpu: 4 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highio + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 1Ti + # Adjust to your storage class name + # + # storageClassName: local-storage + - name: warm + count: 1 + config: + node.roles: ["data_warm"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 16Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highstorage + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 10Ti + # Adjust to your storage class name + # + # storageClassName: local-storage + - name: cold + count: 1 + config: + node.roles: ["data_cold"] + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 8Gi + cpu: 2 + # Affinity/Anti-affinity settings for controlling the 'spreading' of Elasticsearch + # pods across existing hosts. + # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-advanced-node-scheduling.html#k8s-affinity-options + # + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: beta.kubernetes.io/instance-type + # operator: In + # # This should be adjusted to the instance type according to your setup + # # + # values: + # - highstorage + # Volume Claim settings. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-volume-claim-templates.html + # + volumeClaimTemplates: + - metadata: + name: elasticsearch-data + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Ti + # Adjust to your storage class name + # + # storageClassName: local-storage diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml new file mode 100644 index 00000000..0ca2e8a5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/elasticsearch/ingress/elasticsearch-ingress-gke.yaml @@ -0,0 +1,40 @@ +# The following is an example of an Elasticsearch resource that is configured to use an Ingress resource in a GKE cluster. +# Additional examples of exposing Elasticsearch with Ingress resources can be found in the following location: +# https://github.com/elastic/cloud-on-k8s/tree/main/deploy/eck-stack/charts/eck-elasticsearch/examples/ingress +# +eck-elasticsearch: + enabled: true + + ingress: + enabled: true + annotations: + my: annotation + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" + http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + # This is required to enable the GKE Ingress Controller to use HTTPS as the backend protocol. + cloud.google.com/app-protocols: '{"https":"HTTPS"}' + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + # Enable anonymous access to allow GCLB health probes to succeed + xpack.security.authc: + anonymous: + username: anon + roles: monitoring_user diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/basic.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/basic.yaml new file mode 100644 index 00000000..aeb61b06 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/basic.yaml @@ -0,0 +1,42 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + elasticsearchRef: + name: elasticsearch + + spec: + enterpriseSearchRef: + name: enterprise-search + +eck-enterprise-search: + enabled: true + + # Name of the Enterprise Search instance. + # + fullnameOverride: enterprise-search + + elasticsearchRef: + name: elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/with-custom-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/with-custom-configuration.yaml new file mode 100644 index 00000000..a7c3ad49 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/enterprise-search/with-custom-configuration.yaml @@ -0,0 +1,52 @@ +--- +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + elasticsearchRef: + name: elasticsearch + + spec: + enterpriseSearchRef: + name: enterprise-search + +eck-enterprise-search: + enabled: true + + # Name of the Enterprise Search instance. + # + fullnameOverride: enterprise-search + + config: + # configure app search document size limit + app_search.engine.document_size.limit: 100kb + + http: + service: + metadata: + labels: + my-custom: label + + elasticsearchRef: + name: elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/http-configuration.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/http-configuration.yaml new file mode 100644 index 00000000..e3798a28 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/http-configuration.yaml @@ -0,0 +1,24 @@ +--- +eck-kibana: + # Count of Kibana replicas to create. + # + count: 1 + + # Reference to ECK-managed Elasticsearch resource, ideally from {{ "elasticsearch.fullname" }} + # Leave commented when using eck-stack with Elasticsearch enabled (chart handles this automatically) + # Uncomment only when deploying eck-kibana standalone or eck-stack without Elasticsearch + # elasticsearchRef: + # name: + # namespace: default + http: + service: + spec: + # Type of service to deploy for Kibana. + # This deploys a load balancer in a cloud service provider, where supported. + # + type: LoadBalancer + # tls: + # selfSignedCertificate: + # subjectAltNames: + # - ip: 1.2.3.4 + # - dns: kibana.example.com diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/ingress/kibana-gke.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/ingress/kibana-gke.yaml new file mode 100644 index 00000000..4aa1dc06 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/kibana/ingress/kibana-gke.yaml @@ -0,0 +1,80 @@ +# The following is an example of a Kibana resource that is configured to use an Ingress resource in a GKE cluster. +# Additional examples of exposing Kibana with Ingress resources can be found in the following location: +# https://github.com/elastic/cloud-on-k8s/tree/main/deploy/eck-stack/charts/eck-kibana/examples/ingress +# +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + ingress: + enabled: true + annotations: + my: annotation + labels: + my: label + pathType: Prefix + hosts: + - host: "elasticsearch.company.dev" + path: "/" + tls: + enabled: true + + http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + cloud.google.com/app-protocols: '{"https":"HTTPS"}' + + nodeSets: + - name: default + count: 3 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + # Enable anonymous access to allow GCLB health probes to succeed + xpack.security.authc: + anonymous: + username: anon + roles: monitoring_user + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + # Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: elasticsearch + + config: + server: + publicBaseUrl: "https://kibana.company.dev" + + http: + service: + metadata: + annotations: + # This is required for `ClusterIP` services (which are the default ECK service type) to be used with Ingress in GKE clusters. + cloud.google.com/neg: '{"ingress": true}' + cloud.google.com/app-protocols: '{"https":"HTTPS"}' + + ingress: + enabled: true + pathType: Prefix + hosts: + - host: "kibana.company.dev" + path: "/" + tls: + enabled: true diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/logstash/basic-eck.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/logstash/basic-eck.yaml new file mode 100644 index 00000000..8c2afa22 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/logstash/basic-eck.yaml @@ -0,0 +1,113 @@ +--- +eck-elasticsearch: + nodeSets: + - name: default + count: 3 + config: + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-virtual-memory.html + # + node.store.allow_mmap: false + podTemplate: + spec: + containers: + - name: elasticsearch + resources: + limits: + memory: 2Gi + requests: + memory: 2Gi +eck-kibana: + enabled: true + spec: + count: 1 + elasticsearchRef: + name: elasticsearch +eck-beats: + enabled: true + deployment: + podTemplate: + spec: + automountServiceAccountToken: true + initContainers: + - name: download-tutorial + image: curlimages/curl + command: ["/bin/sh"] + args: ["-c", "curl -L https://download.elastic.co/demos/logstash/gettingstarted/logstash-tutorial.log.gz | gunzip -c > /data/logstash-tutorial.log"] + volumeMounts: + - name: data + mountPath: /data + containers: + - name: filebeat + securityContext: + runAsUser: 1000 + volumeMounts: + - name: data + mountPath: /data + - name: beat-data + mountPath: /usr/share/filebeat/data + volumes: + - name: data + emptydir: {} + - name: beat-data + emptydir: {} + type: filebeat + config: + filebeat.inputs: + - type: filestream + id: logstash-tutorial + paths: + - /data/logstash-tutorial.log + processors: + - add_host_metadata: {} + - add_cloud_metadata: {} + output.logstash: + # This needs to be {{logstash-name}}-ls-beats:5044 + hosts: ["logstash-ls-beats-ls-beats:5044"] +eck-logstash: + enabled: true + # This is required to be able to set the logstash + # output of beats in a consistent manner. + fullnameOverride: "logstash-ls-beats" + elasticsearchRefs: + # This clusterName is required to match the environment variables + # used in the below config.string output section. + - clusterName: eck + name: elasticsearch + pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/examples/package-registry/basic-eck.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/package-registry/basic-eck.yaml new file mode 100644 index 00000000..c9ffd8e6 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/examples/package-registry/basic-eck.yaml @@ -0,0 +1,95 @@ +--- +eck-package-registry: + enabled: true + # Name of the Package Registry instance. + # + fullnameOverride: registry + +eck-elasticsearch: + enabled: true + + # Name of the Elasticsearch instance. + # + fullnameOverride: elasticsearch + + nodeSets: + - name: default + count: 1 + # Comment out when setting the vm.max_map_count via initContainer, as these are mutually exclusive. + # For production workloads, it is strongly recommended to increase the kernel setting vm.max_map_count to 262144 + # and leave node.store.allow_mmap unset. + # ref: https://www.elastic.co/guide/en/cloud-on-k8s/master/k8s-virtual-memory.html + # + config: + node.store.allow_mmap: false + +eck-kibana: + enabled: true + + # Name of the Kibana instance. + # + fullnameOverride: kibana + + # Reference to ECK-managed Elasticsearch instance, ideally from {{ "elasticsearch.fullname" }} + # + elasticsearchRef: + name: elasticsearch + + # Reference to ECK-managed Package Registry instance, ideally from {{ "epr.fullname" }} + # + packageRegistryRef: + name: registry + + config: + # Note that these are specific to the namespace into which this example is installed, and are + # using `elastic-stack` as configured here and detailed in the README when installing: + # + # `helm install es-kb-quickstart elastic/eck-stack -n elastic-stack` + # + # If installed outside of the `elastic-stack` namespace, the following 2 lines need modification. + xpack.fleet.agents.elasticsearch.hosts: ["https://elasticsearch-es-http.elastic-stack.svc:9200"] + xpack.fleet.agents.fleet_server.hosts: ["https://fleet-server-agent-http.elastic-stack.svc:8220"] + xpack.fleet.packages: + - name: system + version: latest + - name: elastic_agent + version: latest + - name: fleet_server + version: latest + - name: kubernetes + version: latest + xpack.fleet.agentPolicies: + - name: Fleet Server on ECK policy + id: eck-fleet-server + namespace: default + is_managed: true + monitoring_enabled: + - logs + - metrics + package_policies: + - name: fleet_server-1 + id: fleet_server-1 + package: + name: fleet_server + +eck-agent: + enabled: false + +eck-fleet-server: + enabled: true + + fullnameOverride: "fleet-server" + + deployment: + replicas: 1 + podTemplate: + spec: + serviceAccountName: fleet-server + automountServiceAccountToken: true + + # Agent policy to be used. + policyID: eck-fleet-server + kibanaRef: + name: kibana + elasticsearchRefs: + - name: elasticsearch diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/lint-values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/lint-values.yaml new file mode 100644 index 00000000..88136bd5 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/lint-values.yaml @@ -0,0 +1,3 @@ +eck-autoops-agent-policy: + configRef: + secretName: "test-secret" diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/templates/NOTES.txt b/packs/elastic-stack-0.18.2/charts/eck-stack/templates/NOTES.txt new file mode 100644 index 00000000..65cdae60 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/templates/NOTES.txt @@ -0,0 +1,10 @@ +Elasticsearch ECK-Stack {{ .Chart.Version }} has been deployed successfully! + +To see status of all resources, run + +kubectl get elastic -n {{ .Release.Namespace }} -l "app.kubernetes.io/instance"={{ .Release.Name }} + +More information on the Elastic ECK Operator, and its Helm chart can be found +within our documentation. + +https://www.elastic.co/guide/en/cloud-on-k8s/current/index.html diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/templates/_helpers.tpl b/packs/elastic-stack-0.18.2/charts/eck-stack/templates/_helpers.tpl new file mode 100644 index 00000000..cef61bdb --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/templates/_helpers.tpl @@ -0,0 +1,48 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "eck-stack.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "eck-stack.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "eck-stack.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "eck-stack.labels" -}} +helm.sh/chart: {{ include "eck-stack.chart" . }} +{{ include "eck-stack.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "eck-stack.selectorLabels" -}} +app.kubernetes.io/name: {{ include "eck-stack.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/packs/elastic-stack-0.18.2/charts/eck-stack/values.yaml b/packs/elastic-stack-0.18.2/charts/eck-stack/values.yaml new file mode 100644 index 00000000..66941316 --- /dev/null +++ b/packs/elastic-stack-0.18.2/charts/eck-stack/values.yaml @@ -0,0 +1,60 @@ +--- +# Default values for eck-stack. +# This is a YAML-formatted file. + +# If enabled, will use the eck-elasticsearch chart and deploy an Elasticsearch resource. +# +eck-elasticsearch: + enabled: true + # This is adjusting the full name of the elasticsearch resource so that both the eck-elasticsearch + # and the eck-kibana chart work together by default in the eck-stack chart. + fullnameOverride: elasticsearch + +# If enabled, will use the eck-kibana chart and deploy a Kibana resource. +# +eck-kibana: + enabled: true + # This is also adjusting the kibana reference to the elasticsearch resource named previously so that + # both the eck-elasticsearch and the eck-kibana chart work together by default in the eck-stack chart. + elasticsearchRef: + name: elasticsearch + +# If enabled, will use the eck-agent chart and deploy an Elastic Agent instance. +# +eck-agent: + enabled: false + +# If enabled, will use the eck-fleet-server chart and deploy a Fleet Server resource. +# +eck-fleet-server: + enabled: false + +# If enabled, will use the eck-beats chart and deploy a Beats resource. +# +eck-beats: + enabled: false + +# If enabled, will use the eck-logstash chart and deploy a Logstash resource. +# +eck-logstash: + enabled: false + +# If enabled, will use the eck-apm-server chart and deploy a standalone APM Server resource. +# +eck-apm-server: + enabled: false + +# If enabled, will use the eck-enterprise-search chart and deploy a Enterprise Search resource. +# +eck-enterprise-search: + enabled: false + +# If enabled, will use the eck-autoops-agent-policy chart and deploy an AutoOps Agent. +# +eck-autoops-agent-policy: + enabled: false + +# If enabled, will use the eck-package-registry chart and deploy a Package Registry resource. +# +eck-package-registry: + enabled: false diff --git a/packs/elastic-stack-0.18.2/logo.png b/packs/elastic-stack-0.18.2/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..fa70b78daa45585ec0f802dfe637e4ce2172d6f8 GIT binary patch literal 5810 zcmV;j7ES4iP)) zEw)vQ)`8Z7U<(>65YRj(4Mo6Nreakf33Yf32_SRsaMt@Hh#~jfCBW^ant1RI-2$F+Ls!$`IZMeGSXJF1;$Zc-LF^Xx0Xx8|Z+YmWN0# zFa&7fqWH}y&!gsf>35{eMY*ohEDb<6ruRVYNvMnm+IX!F^fj=4BUwjY_gGiGX;ucH z8`FDW>r~(}z$Cr{tih6e>0P-j;ku*HEDS)`(2~~v$-rdX9p)R#EBLHirPtwqC%Yp} z-T-uci}S&L7RXF?Uuv)))qA9G@R?+GqRAS7D#C{JiJ-p+e97)lRD}721J_GG_9jPt z6GT6vEtUS6z~#yAON?wr`vWUk>z3c3|N1A^r@I9BinrIFoc8>H3y_pDQ2{Qn_vcTFMsK_yJg;sgpdN?#*?F z;#zfV@IQd^%Q(83ifra^puY@YpO;EJHGsV%rk`nxJp&;t4ly?H%MOJ%KO~6OtUS8T zUkX@p=txywl&ruQFBN!Z02L#jzEOlHfOI$Hsq#Oa7EUrx zxft0HQ6`+_x}H=+IRRhjVXwryY5)}@o*IDgsGBmsLdCZ(vecaEg|3uCxklIf&hw`C=P3mIIJ+6y%Lx}j(#u9q~ zW&KeH128m~;lDb=byMrEZVGhk6X2<{Le<_FS!$a83Lp|6;m}w&1;%Xv+lS3=4GeUl zFVP4eZc+Kq$YO0CD}b7)UhAf~xD6mJ{XlQP??PXq@yRJK{p@h{f}<0_|MF00D$~!+ z&p_M;AVNqeKq>&3gj)H5$xtLrmNT(Ein1_JD(@ z&IQyExdYfdJ%EuItF0?y+z=wL!VNhQ*pZt+&C~-JiRuY%h;d~GZ~SS$3I#%MgANoS z8>NpMvMn5fK+r}Q^X~=f%CUA=4B%)i|BFZe*gkA_Yk%v*{jkG>P{~FZ2-MeK5Z<4D zXjAoqsu)0eyV2(+KtzCSLrBQE0KKxn+I?i_>BjiZQe_aL*}!+}cuDoGb)57KJ|C}`gq)g{m-52ErlWte0d`$B{XeX*_6G)mW&>w){GP%$9>CfV z3A!OBJ_Aq{9ze*KdM^XJ%)9CTfJI0D*m>oXZTvy&9JMuDMFxuUR>VVM&U9(yYy1d@ z>uwZ_mA)HF)Uh4p4Mdk)Mwac!%P6hq^8o0^wEo!gZbP1Jf~=FQfGf-4x(%SX z*w<-C=A)u|TTJcirUbMYF~z7UE+2d97qL8~>(al2=!Z1TGl2C#R^zYCl{2VtMOtl@ zoeMu|%b^x?KreMeSrkfu)X!aG#QmB21R7;H0Q8KYwO}b00>I z00nAw4wuaXMmAKai@aVwHuJdfC*9P#E1}?4pjDFklt?O3#!25mLDUvgW}av>c;-eMwR1n3;zHkH(P`2gp4e4%te^#bX2a68Hq$?8x7*^SycwY_}n-seUd zkrlv+3WHRnz?^nyqwl_%Lt|BP+z8O=g{^0cnm0+UnRa3M*vwJY3v?~*G5!*~JdKoG zNb-mb30r1LL}^;!F;M6Kq{fP}fM8%q)R%wzBiANvjlfV_ypF@t-_s;5MwLM`uP~WqGZETT3 z>)z)a=XD04lf5mMXnFfm14}J)XGCec%BO%&BbzrW6nH?gf|Dc<=h^$uXJ;C8l`7c{ z)Ztfnfho^LY^NIlvGukF3Qio#kE)zgUn7|uLG{XHjo0#{2`AU|r0DKpPDVf#(s z^f-03G$Jo^?~LP;YMHJDo4X(kj#GFdNJm0Hizp2RXMj8dL}n37Z7NVZN3sGhL~Bre zndgp5?IvQTS1&Q4kS~YSTJ}Xp%}s4*eb%XZk@P1hS(OtA2TlbZ0Ev5xGy#+%WJ}-B zs%QPvC(1v{xcsxcQ)=A_lhde_ ztl(_=1ilM05=cna?HE~tKX8HcKDfiNHh*RdbMLGdQ2B39d!d|Rbxt1(Rg=I}yGy4g zs>gdl%mci>Vvo&Ap0Q~uV$3dj;5FF_r; z5kNZ6Dcy(Q$}uAk2q1EO`IwBq)vV}QRCI!!c0fvo=EZzESvRHkBxK(XawE{v)t=U( z7I?7Mnf}jbXPU5GMEo=TdSQ#{EuH6<1i|Ao{taWF8vF8!t9mT2S&>ovYF7yci-6OB z86wsrB|}HVdIkqM zkxR&>L%I{PP-bFyQnfIH`#;Oqoq&i zAJH0ElV|0s(K#e(Yg^zA=`^>rR3IZ69f-nKvBDSa%Ig_%`EvJV3wo=v7^v-R{A!ek zONZsY5^H#R)r}+Rmw?_6oYTO5SEmfaaOoZRSF{G^zUOX5nMQJ#;76qM+_HC5DCh3m zJ}We0d){fgYF2bxTsXuST>!*(DpuKm;gOCVcFcXh|4lKUqS1A}Y{X0kE}>yTup7X- zM6wP$ZfW!Y6k!H|z|GPh z=g}tr*^XAgH(xci-0t$N7q<P*#br0Lg#-U*yiy^0iF=EZ{aEZUsD_e^ri(-91-y;pbe-v;xN*2nGrElP`Q6EU^GOum~p!3|a=fT|^v~_S$ zY{}boO-518ik?M9>0w`RHfW+eVgTz99_!|7H)n;zXUGXvgnza?S$ZFi8jq0dWnL@@ z96R^7GC?|bV4F+Iuj%%F&5B;d1#J!m)8>K19M$SFWeU$22|QCD52F()vdpWKW6PY* zb4oWMb!P2|m(513i+7GWb!*LvYTmt6h)diDJQuXA-+p$%h^R-^97(ZdUR@kBfG%@O zu2AG94|Tn31;dx_7}ql*;4zAKFBJ#?FNO_M|D7}H!#Z2%&un2TWfqCs(21Ml935Te zmM&2k=7Ex>+N$!3^4!xScEV!x?j@U}u4bK9k~1n|Z{isF&vrDGzEWa!RwbX3)3`O^6ajzWtTX<{H60RP*_cBzkC3L>ZNM4EOW_%H9eNhcg|Imf5UFz@x*p5 z4n!9pX8^me?zTyhpSmU=9xfk~aif!ir`ys6qZN4tO}UMz+7Z5QBQwa)cXUkI>7mEK z+Y6uF!q{eh#6O~9Y{rua)14lu2Vr2suCbYs2Rf+o?iu(y4RP(J0z#k6fmv5O)-|3{ z;KR_=aj!XAak)7(QD9jE1s_E0QRQPZpK+?pSh`@c3QywEy~T+`e$}(6$T3fWovx1n zG4DGh13~`)qRuZNuUBA~b?8zcdLV-{yNxjymXGQ2N<>XTfz^HKf~P%j?Iw$EwiUR= zu_k}~Uf_?3?M}Ve89vhbuTa~sFt1mjd`!l*AipQJ6z`* z=Onp;!+-IgrOlwe>bso~o7k`}f^iQ`YL6+zI5xss{l%c>VP zIPYK2qRr`BF76p{io0th-aR)7TeivCa?!|55jFWU+nY)$1==URTgOlly*~WV_~&X? zGZRvv1 zrfTWfI2}B3V%u{5wu^F$qc)f_qq}8Hw!$E)&iZ@3`+7u_>%&ujG&foU*9^e5*uBQh zJEcQ&2gIB${r*|swp0hHG6={9vT!ec;8R=ma;A>2^_+w&29U9&aEypXwX)`fqW#K- zjgGwSEEevX-5QI2Ms$#hW(y3W{+ZBhglBEP?{4z1t#bw9&XF)<4@DDl`%J2%b|7tA zgP;EWxP!nd8&&}iYkskhKxrSNCL4~85>e+?BCHIHxszXydoNa%uDrF(WeZlKoa=_H zM$Wd<{ijxTS)J%2gLGG>s9WD5*Z=!M84TkJ>q_4vqJR_eel z1NaE#Ki!bk$XQrAY*cQ|!l&NI?hy2u3ab9U_kq3xvRW{!+8$xm_#rDAp57+E*hhYB zfvirr^9j(@je1Qi;&_8<(2_Ix`p0$xNDh#r*z9XTXxf`USg+`6R92agy<+0vHzJP4 zMJ0}x5ALNPNyX#k2}i`~rgK2dS+(q^`9RMSI1ABFV{T|Y<+8OiBpBZ znQ{JnYkoE=r@b}!?H0a+IXCrxKdu-~x12TyU6RvyQ8tpFACbf8sW-AasQX!1(@_Q= zs%#VYv3|DHT6LI?MZc;n07=RHgBAr{aLdEg>?`vgyHUT_J+>>ut44`D# zh|NGVo(G8I_OIF=4*vi`%*ipM;ac#9K=eqMCXYt(0D2q{tJHmDy$)P60J|y(v{|CI zZged7asmh_vLap?t{Fh6ZD1iOdJ@KC_Lf~VD&q5(fC*sO3Wr{eSBPr{@Y%q;!yqra zC9m-y>z!f%y`BInEWJH@^%wEVaW#O`sLpUxUZX&rJ%C@ya(yCuwZ11KFfdMQ3m8CE<%ZkOSy}3qKu->Fh%f<&D^{&BAn&AaQ< zR!&9D#Xwmc8bT<4@|m>nP8_guX&iED#q;xAnac`qL-h%-^&}F357Q3IfRA%?Yu$~T z{@z(>heNGKipovE`NVeca|g&A+ZX=hPtRWE`3Rbj1AQ4w3ZD`=J~c@rW{((qKuOMJ zpVa4}hgS`1+rpUdshD#F{kA|SMLU6f3G5Q&Ut(mcxf(`71bk)hj$<~qmzHBu6m z%wfy$;gy{_?id9;pD3L!vIE<`psBrlNZ<%?3{~mAY~fTz?@o&TdZMr5MZ@xSvk#4^u=W+$^BH4*q6k%=Wk zbLS6kwtN~Q#q(zHbrKg9o z1vy`p!3bv%d+yysDC;q-1>O#b{p#mAmsNP!-9|;DFaReqmlvK$NWX)Tt|Hn-(Kezc w4beTet$PsNgQo2$`||K+^70bqTW@UqKfDL0=G%K /data/logstash-tutorial.log"] + volumeMounts: + - name: data + mountPath: /data + containers: + - name: filebeat + securityContext: + runAsUser: 1000 + volumeMounts: + - name: data + mountPath: /data + - name: beat-data + mountPath: /usr/share/filebeat/data + volumes: + - name: data + emptydir: {} + - name: beat-data + emptydir: {} + eck-logstash: + enabled: true + # This is required to be able to set the logstash + # output of beats in a consistent manner. + fullnameOverride: "logstash-ls-beats" + elasticsearchRefs: + # This clusterName is required to match the environment variables + # used in the below config.string output section. + - clusterName: eck + name: elasticsearch + pipelines: + - pipeline.id: main + config.string: | + input { + beats { + port => 5044 + } + } + filter { + grok { + match => { "message" => "%{HTTPD_COMMONLOG}"} + } + geoip { + source => "[source][address]" + target => "[source]" + } + } + output { + elasticsearch { + hosts => [ "${ECK_ES_HOSTS}" ] + user => "${ECK_ES_USER}" + password => "${ECK_ES_PASSWORD}" + ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}" + } + } + services: + - name: beats + service: + spec: + type: ClusterIP + ports: + - port: 5044 + name: "filebeat" + protocol: TCP + targetPort: 5044 \ No newline at end of file diff --git a/packs/elastic-stack-0.18.2/values.yaml b/packs/elastic-stack-0.18.2/values.yaml new file mode 100644 index 00000000..1356e345 --- /dev/null +++ b/packs/elastic-stack-0.18.2/values.yaml @@ -0,0 +1,80 @@ +# Default values for eck-elastic-operator +# This is a YAML-formatted file +pack: + content: + images: + - image: docker.elastic.co/kibana/kibana:9.3.0 + - image: docker.elastic.co/elasticsearch/elasticsearch:9.3.0 + - image: docker.elastic.co/logstash/logstash:9.3.0 + - image: docker.elastic.co/beats/filebeat:9.3.0 + - image: docker.io/curlimages/curl:8.19.0 + + charts: + - repo: https://helm.elastic.co/ + name: eck-stack + version: 0.18.2 + #The namespace (on the target cluster) to install this chart + #When not found, a new namespace will be created + namespace: "elastic-stack" + +charts: + eck-stack: + # Default values for eck-stack. + # This is a YAML-formatted file. + + # If enabled, will use the eck-elasticsearch chart and deploy an Elasticsearch resource. + # + eck-elasticsearch: + enabled: true + # This is adjusting the full name of the elasticsearch resource so that both the eck-elasticsearch + # and the eck-kibana chart work together by default in the eck-stack chart. + fullnameOverride: elasticsearch + + # If enabled, will use the eck-kibana chart and deploy a Kibana resource. + # + eck-kibana: + enabled: true + # This is also adjusting the kibana reference to the elasticsearch resource named previously so that + # both the eck-elasticsearch and the eck-kibana chart work together by default in the eck-stack chart. + elasticsearchRef: + name: elasticsearch + + # If enabled, will use the eck-agent chart and deploy an Elastic Agent instance. + # + eck-agent: + enabled: false + + # If enabled, will use the eck-fleet-server chart and deploy a Fleet Server resource. + # + eck-fleet-server: + enabled: false + + # If enabled, will use the eck-beats chart and deploy a Beats resource. + # + eck-beats: + enabled: false + + # If enabled, will use the eck-logstash chart and deploy a Logstash resource. + # + eck-logstash: + enabled: false + + # If enabled, will use the eck-apm-server chart and deploy a standalone APM Server resource. + # + eck-apm-server: + enabled: false + + # If enabled, will use the eck-enterprise-search chart and deploy a Enterprise Search resource. + # + eck-enterprise-search: + enabled: false + + # If enabled, will use the eck-autoops-agent-policy chart and deploy an AutoOps Agent. + # + eck-autoops-agent-policy: + enabled: false + + # If enabled, will use the eck-package-registry chart and deploy a Package Registry resource. + # + eck-package-registry: + enabled: false From e16631a09bd646d452c4651217a56bac9d7a14a5 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Wed, 24 Jun 2026 16:19:55 -0500 Subject: [PATCH 7/9] new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes-2604.4.0.tgz new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/.helmignore new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/Chart.lock new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/Chart.yaml new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/charts/collectord-2604.4.0.tgz new file: packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml new file: packs/outcold-26.04.4/logo.png new file: packs/outcold-26.04.4/pack.json new file: packs/outcold-26.04.4/readme.md new file: packs/outcold-26.04.4/values.yaml --- .../collectord-splunk-kubernetes-2604.4.0.tgz | Bin 0 -> 23532 bytes .../collectord-splunk-kubernetes/.helmignore | 2 + .../collectord-splunk-kubernetes/Chart.lock | 6 + .../collectord-splunk-kubernetes/Chart.yaml | 23 + .../collectord-splunk-kubernetes/LICENSE | 2 + .../collectord-splunk-kubernetes/README.md | 227 ++++++ .../artifacthub-repo.yml | 6 + .../charts/collectord-2604.4.0.tgz | Bin 0 -> 16849 bytes .../collectord-splunk-kubernetes/values.yaml | 690 +++++++++++++++++ packs/outcold-26.04.4/logo.png | Bin 0 -> 8716 bytes packs/outcold-26.04.4/pack.json | 30 + packs/outcold-26.04.4/readme.md | 227 ++++++ packs/outcold-26.04.4/values.yaml | 698 ++++++++++++++++++ 13 files changed, 1911 insertions(+) create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes-2604.4.0.tgz create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/.helmignore create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/Chart.lock create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/Chart.yaml create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/charts/collectord-2604.4.0.tgz create mode 100644 packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml create mode 100644 packs/outcold-26.04.4/logo.png create mode 100644 packs/outcold-26.04.4/pack.json create mode 100644 packs/outcold-26.04.4/readme.md create mode 100644 packs/outcold-26.04.4/values.yaml diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes-2604.4.0.tgz b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes-2604.4.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..aad6b5008c4e2c21572b313ae7cf45c4c298d771 GIT binary patch literal 23532 zcmV)eK&HPRiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POvFcN96&C=Sox^(l0Uehzlyti>1uHBHYo#xzVD>}#9p_qjkD zRi>&+i@B4lw)Ldkd(h%C<2v*0Wr z5}p!CM0a_cr_6_wV29_wN3!*T3KE z_x^@@H)?gsUoIr(f9u`2t?J;ulON9LzX%tUr2}-n*}_@oJ~y{Jy{*nxDzeRLF=%jH4GURc+C9jDB~>ifD?C0fW(ADhbax6$Ifl zGN~p*9sV{h_v9xpKy)%C6uik6&aWPos%#WcjKW~;ugUmMd`zoy?3 z^gm|d*^Sy*K>vGp@7=4>|K8?`{(p(zmnQCXOoSXDF~OVnwg(UI-@n_7@YePy+Q$9< z!+Q_={n6;|!|49qyLU$q@7~`WJ>1?T+Zgxm_P4h%d3Yah-RnKve9*(;gK*dylaz2Q zNi;z1&EDpA(Ay6B_fGm-gRS0R^I>Q6LBD^uAM~~cy z+wc)`f+ZOs$#bGx%wt7^)Sm&u8U2m3JQD-;jb7g-my)E4nuyzPp^WOHU^x$oE0eKE zkTB;|PBRu$Mblj2bHazFpe~#XQiJpoCkoo@+Zm_lG$vybL75gpx6nR4Cn*u4%L$IC z`U_>84T%7zR89!$P6&?W=q$2kXfu%qd8touk}c7fJZy<@2Mn5L0p=I@{)ZO_hHN6)FAO_;a{rcDs3aV0j( za;UmGFbisiZ$A+Xa8OKyOV6;J4BWyM$&9Pw{Ra;om^7MFNpbvy#CUp4LY78C!Rwjq zjBv^#m$7ZrB~1v+rOUWy(npxaIVUF*PQ--8(E!~w+s@$DjfSI9@5-Z@F_`|nYYoP& z(+jM~z-qO=?bRY#%%%xRue7bc(*^lZrSP^GM>VY3b zlA)i~q5ZR|sw?g5Is-Jqu^=WZwu$Dj1?HYaA|eR59X0ix-Mc`H{s zBnGJM_R#>A%GPhsK0MkUmocLtpu!U6jIyR(9%p0GEaPlcDOi--XXA2~Br#FYrxwCM zgH@|)=FzTfr{KR_tzsT^*(*UYIaL_Cr-z(fPG9lZTg7_*V=QR6lf%N=Qi|-ASUyE% zMmUeVCte8>N21v3 z1yg!z_|XAs2evc`H(wBm6(SDMhmRJc)09crj^a2UMl8WJ^#&m)JkN4@NVwkOeimZ~ zakO_%QYp&GFUdtM8RwE6pV92M_cVJ-757`hza)<(WiVA8ET(DLUXWi*TU(JSOQ(t{ zD5ga*Y&0aVj`qF&Ae6EQnBY>PWM?GRo3?w7d6(yDSCEhsDY^x0B_0^4I1E{y$}UuN zU_!#>b)bZ}6LMMfMpM@Ty4y=!VqzBY$1ruWbfl4iOV?`Sca2gf|U?+`@G*(8$e_@B)7|1ILk!$ zyx%R(-AVyZrA(PBSvn_fm)m`wWHHcleTbk9a$|VFQ_= zDF}U)qbJ1rkaxvGT%ko-ovvlgq%5Nu`6r{P?NdYr$T{T}6MXqRm4u(;7@8S3jJX?c20N*S>s>6j>F1l-~{jaU*~P&o-W%hM>}Y)DhDJnZ`l*ydG&$)M@U z{;|98DAh{v<;=X$G7{y)8u>yf1dQ5s^rs>7cQS3r8*%cVoTTA&fbIz|eW>=FUcvj@ z4}SM@h@tWKdR}4!rlHx`rhhm*tJlzp)#btA*V?$D`WW&=mPbztu zP@ZN?NZsJ6$dk^`b4uxbehM7Q!oo`MBhe`k6Cta8^-Cri2~QJzc^c#Ksn9ay=`at^ zh@9Jqh3@Js>J?XbLd2=rB~h)yFvj5-tY7JnQTTZ15CxdnAfh5<=Y&s-gVf~jH|$h(_{UQrNrHsL(t;6?bgWVuhU-xT ztqiJCkZ{ado>kKo3$r^mdT`5EiK*z0L|4}+6+PrEEXrk^g$2K_I##eJ{_tV$YaR60 z0xF-LZ=R~Gc0;cl3+v44>eU-+1lX>w&K2wVm>LoxN^7NNX4XnItiTPXwTjZAo1Pob zi$QXYiYNBiEcgC;bBEA`Mr4PNYw*k;DUn}c`cfi4-R#{6tJL_JBFHCd&|hH|pz%|w z8v9B!fsjclkykST`;48{iJAE$QAg&I=yRo+N%UE)s?0kwYSg~v`f&C+x~1S=qgSq9 zPJG^H<7+W>F&leL8>zUe2hmr&g{&^RMU{|KcGysjjk_6({E``qW15bOsoA_&h`|V5 z;P|YR?Fm)qgb$f;e0+IO_4)cYqv;{$lH%B^)k>HsB&XR4;R#J~yeC4Okz*~(ks9=Q zWvx8E_U5ubeDnHE^r63T_v6~%%^&MOC+mN$y}9h&hkyFRw{N05Yj4DxX#F35fBmP* zczefWcYf9|eqS$?Hv%V_nz2K|Lz2n?3i`FY-^p|ls?56J24yo{Q0qH(blMA8F2ZBvo$l-GB0MSfNI4m3ZYtlRXy~r zqDq1{@G z19t}I|LbprDy*mF)LxPP3WrK1Gh|7|Qj*GFU;jCH^ZM;D*_ zwa%UOpO)FDWt6OJ(6&oxE@d`o`=2;Po5=3X#d*Ll z-qbbD;mTY4MyKVc-q>re-(0*2I&bg1Q77kG=k=TDP4M>4`ajnHTGP_R`udNx%WuB9 z=I^O5v5WqzH&B@={Wr^bisNWG{f)ovGQtHF66UPBe+<;FkDe^XlE$Pc%=5Il@PdsX zB9aZY)5EW^`yq29e>5bnjAMrWq~q43$+x z@i=8dmTuKbmvSLa!D60EL`PsngE$#7CJ`0(8Zts_c^a}LA*n=?p=>^@;(?rcfAI7(<5jB^^1 z?&Kmk&*QWUnAG7ydO&y5XnCMJkDqrX5t63ku9%9E2qJP$Lm~owj}nAg?qG*m4$Tsd zhcu>=`i4x^c@b05HL$uGRyWM@Zl!*=d7eC6c8gzJMEPsKhr;kN41sY)?5w>^dC}ucX_tyux=8j_;k^zF&I=`giSA+sZ!GnxNXoS;%)fq-I}~l)+D^glXK>7KhIdH^2xl0E-XkY%s(zPD3IZ`@AOB z2Vf8-3CA&db+o@G)=_{`=D&D$9oEk}$R&jhRf4$a7b~t>ofUzckkoW=gyVRK!!tx9 z$`TK0&>s_$mSq?rqaF1aAl1`^f_@|bYM308kAtY!Ilf-ss89K}R< zQ;Ckvx_YqM4n%NHadFq(E+gCm1=X!N492acufPHI;H}cY>sLA7qx;*vN?msWUeBs* z7(m!!c7#kJ)Yzgb4n*LAml`tbX!$9qRF_fGbXPhTE9*?YP3 zV(+8REIYihy>I3fN{BHNV+wq!^6b_C-k%$=Xtmrysi((#NB?@hyLbBR;P~X@pfT(4 z;OOLI7iYA4-tQ_dNpzbB+XeDvG3Rzu`-5)Rdq2?IymxPIaZxMZyBhe$;yxN*!=k!$ zFKOw$_x(%0{&2~P2t@MUWY$v7T+GjQ_>Ae=KU zP9>8#zS`U`sL6?try9u$OSV~sGcB#1hFR`LvZyR4f<_8@LK4QO#;$O7`E$x;j^jne z8~T0KS=LV!jA={f&h;l}*d+XVXG(xGy5PjBY~XL{!1BiMWzVg4{UF%h+PZ5AdwW*# z>m73qP*=yrXFM)&t^^;cjowdlL3m-O+fdrxBfHK1W7DV`QJz9P`7Vi0gLL&}=?yTD z59iXE8o$~9as=cDBnEEDPst`ZHD5FxFU@he`a}I(`RWzDMzMYGvMiKuh~|7Y@Xe&g zX(@SNnB?!1<}{4sYZ9OPS0g@~E8=ql;`0sd-jqe;)M@-q-?NmQ3i_TbSyX#nSX?+y zb;;=|Xmw6$3iX%R??i^t_qoHN=U;12Z{EGXke^t#(1V4n#w@|Z+|&^ndi%edol%t( zEhB2o0pU3GKmiMM)n*7_(hsBO z867o{J@bhF1+cu4wd3<>Y0Q4|K7X1UGx9kzqj)L z{3U)w+ewLT3v)?FIFyro7;uuY&h&<1Usk{G;5T>w??2z&dwINf(>50E|Nd4r{=;_f zet)(9zr^q0)yeL`{u6Y3u>b1h`N7L$bbRpix%hAVTB>rAo@3dOCZlOa?;3zQh&&-kPOwB% zmZJ$iCw7=5y2?N|U~X-c2Q&C*Cntvp6h_5TqP1sxyXzfPnfTW0=Eef_Tz3cByV*oi z4^nsCTiA%f6m(jxBkeog^LYN+x;%G>))JkV#lpFa^DVX$S(Rb6ZqU$0PE}+YB=U zLC7OldW6a-Zqlz19<4i%^FqJQ=q)s+*YTt{s$gfSLv{lK2`x2$w(jSizRx^UdM<7$ zHpU|tt(MPJhyqO`55?Zml)iIlm|)pK7FS199S!=}B56o80aMeJF(K$MCKac>pMnE$ zttnoh$~|GVoC3D3WGKvqWC?w*c^!66IH!?1;hCuRtkZf0Bd*b8tT-{di#7nV8hQcR z(CY%0YFXq|YFdyI5{cRg54B!*{Lpc4*Gix3X47jrQEmX<^w}9Ub=2zKLV6I!Y^c@J z=PSCv`oI#Bae@R(YU@H%giW;#G@@K+7D#m-Ceof>x=3+Q8RP)G*wCy~?YTFO(1^37 zgPt;u3~k>)bfkE$a?ji;uLcOjTy@N}sW5P(rTeC8Dym%V7hq{)=K$n8cmVtkxgcq} ztlEs|UBA~4%*m;Xb$}Gml(t@*^tUZb*&m_$f!S)kHsoAyzqc(tghyzZ^GNT|S7zH$ zVa7rTcf?CI z@kBdmf^n(i9S*0Oped3rLT&DY z7>@`?Lo!liR!9GWl}kFUU(s_#{6lp-u~8wP2=uO3C5f7f)+pr$49x6Pnl_ZsopdL# zSG3lKImxsi6wIfVW!AxvN-T?s=q(V0_{n0&UYng$a4H1@j#DM9QMHsfE|*tRr}EM< z!YCydiZa*(eKuL~kG0PurF}HW_D`nA_7pmAH9#`@Q>n5ANN69PHlh_k*q7 z`*k%pz0a@5*6}bje3% z?FMR)@2cCv+XsbcSlS*F#k+zl7tkY)7{9c{-Ry&2Tc3dJ9p_MdI%*8RDI=&QChw_3o zFOt{*$1rBpsy7jqShdltq{S&yLxGX9tA)*fTon8atQc85KgIb@R zrmZwjbGfX_no=WjeKqC8Jbd{qEL1_~YO-Dh!L5GG-x?OdL-kR@?G1DRq{KnhiXkd| zBKmHI7Z(8cPK&1nZLc!1#wblwLhJL#Jl5Gj8K;aZiX6sR2%{d<*o-(+BCdr4E1q$3 zPFe1Eud~$dG!5_Qb~W1DSmK4%UPahxh)!<%yQ{i;9WX)2siYx9wQi1gew}VDLwp*; zQ{MJ4*EkV~Hgh_l?Yo=%id`HV_6;U2>+*hYr-x9$pQ^5z<~i4 z7+~wr7qk6Zt=CsEwze-+1E*J;E%3Yz2MfP9!x9^wjKQ=eFwpR9E zU*uOZVBc)vEOVdQf#X&yA|m88(+-4vB{*D645#QoBPTkx*x8ye>)CA{0=H;5^2>YSEt+xX7AC4o;L8GrRW`kl?KPA}-)ZmEOVgwIjEf*bUKr7-`eaSAL; zP@h9{J}#WZs#>?DUlVxt8?EzVN!5yWdM&s9SKR*|>0Tbk7TAB?+q%D9-T(J{o2&i* zC4RS%iPLITmx^8Rc3SHef~!a>%)Nb}ubsg31TG&GgfPaOpmWSA9>zqgI*2-Bg`_eE z1$b)hO6-**-0Y!UmLx1iF~rmMwGxU4vG15fD}-V;>NW&wcRoG`@IlgZ%2}F#8|#d- zCVd zpk+9e5#t3hQuPayr=)}{N-NydaCrPJ&6T;lNnwat;zR^nG4$A>JY;dFp@;tM<#YU&Lej0_*# zstbEw5N|790oUHTg$}I*3L;&rCg9DgiZt#+#3u7o;Eo>e>=sy15$UGdUBG!t-4r3zPNspS37vlnmbM4z zua@;*{GnC&F>arcX?uX$uv%@Gp@_lEMl`K(*)PCd_KZSKCThxW-9rBYM}0bgp(d2O zJK)#=WGyh7Oe3UKnlMu>?b`1JR2cYE(^T8yj5*M8;AfiALfav7^#D!Jwa1^rX_){ z&@dpK(bdJu&AKk?@0X46+$x(_kCj!oscxAe0q6$%Hwo1#rPoWZEsoA{8j`4@mJ=aK zF{ez?7gJ5+MR|cMi^-B9O-ZzH><(tjcl9ia@dr)o=4+NzX1|m}B}qiNu!3_&rnbDc zDyupS*M67{#B!0Kwk|~%bk6c!$gmKKk)P4N&F;ucdEGTu&{{Ct5Jc#NCYHWI;t@Fi z*bzqrM^(qoioLN~mxddN3&zg~htLh8RrIZPIH|Gi({qv%A-ejSnh2rzl%YX4MMb;X z9nO28BT#JmzHsY;);!_MoTPWarT;Comt=CPWHF;=`@665(QG_8Wrv$_bfkkt2q@&@ z$ty_%X;%)`#2a9r(~4@kV-%9wANw)XFp4a62Nh}7sk`Xtap@63k7F|zhiU>0{dLn) zBtrXtFn$Iu^J8*O;?kX*nkU0Lu6ev;v10aoU2m1trl!TpeudMjP>hv*Q*m-`!uPlP zZLO+}eRi|~mW$s7j=jv%wN0j^3R~NSfZEohJ!BCQ#8}bWvE@Qrdh75@nhn+#WV+yb z%fxXI#MW^aecDpoC!iAQB4klObtdqjwE>QC(?CWe5~{_0$;?~;UM*8zPZDXj792M^+DrAgF-PC( z&{-WiGY%aSCg_Jgd-M=jXV2Boo?Fh1kNBoeB7?O*_JO2Ngat=YWhTD#iBvq$svk)> zidfq61g>xV7&@5{-Dkw}R3J9e0na8(NMwA|Z6Lt_GL^2IxzLyUiU2%6L~AL7Gv_xV zJF2P_vOLK-f>4> z%EfIg^#9YZ-v4g(H&^~YzR0iSe8YHz=(NBP)7UL+z@vQ}N|b|n_&jrluRWU8@2bCR z@Bh;Yi8I1QM`nvmK^ED6)cpT#-s`RQ|CjlF_|W~iwRf4p!{mv!TeU%eVfj0)pSvGF zwmy6a6n{-q;<0m4M-^|QpeO*QBpq!g_)@{@Xh)<_^1wcm`%8%iX^6J(!k;ub&POA9 ziP}LM8CWEZ)SoTrpmQ=}TNvevmHSVQV{HI|vkbc4Y5hSoY$z{P3u+hw4M~U<6A$la zJl8WYU~TDKJj1aU+f<;n;S?t0$;)F^7G9xeBwX*bo{tbG+PoBi0GXtzFotpZt)g^X zC@`?_=w5Z+^mg9ds$%8&r6V_;Hq%Y1DKayEnJJHjgYy$~fADDeH7)w+CPD-09O+ro zb!|UOiC64g#%U@?sQo`8_#e@(z|xH_k73P!mhjG7P_<7CgR2%37S&*gE(PrR{Dp;r z#i~|E<4?5y+gKZ-zYr%`j6;IjciO0Z+P?ZmTF%^RUhj2X-TeuPla83^gJOU_d~oh! z8phkvJ!&jc7QI|qjq-XDcAROd%Bzc3PVD&bp`prO=s!7=q%tXWC_3s+6bz>tkVP$P zm}Kh16BfG-eB(4TM#=scCvh>1SqOGq5p%6J#1fV@4co5Jg;58H^|?z_oz0+esQS8o z#)4?V(`lY0;1tu4l&8qw-lahnn(>NMKX(vCO#G(dTm_Goxw5P+>a6CkxWL8O^)1cy zra;&Iyc1#c=d&lGu@hIFjzT+irHLpMQ=fGXwDP7t1+$vJ;^=>~F0jsPmSouN?YR@- z8ixlvO6Q0bjBGPPOOBF^Py4oCd1K~};dQe>$wuU9i9u25gOM(OHH(pZ;laKyh)@cN?DVOdLnO!?}}>EtRgsTt;)i)GixYPAwonFqg& zUKQM&g`bOo%*E4%xVive7vgLKW?n6cj?e^)-^sLLLE0?S#`|r*mQ9?o95#DS+a-Er z0Qdx{Y!*EO0n83su=-7u>hBTwOPVthsTHb$STyJJ}y#^eptO-D} zYOAM>1Fzfs>3INb!raNM)r#mj6^vIandEux&8RthPMZ=x z?>=uPsQ!b$6Yw+YQP)~#v79)MD6vYZIp8|Bpx-lcnNfZFul@6gg-~iWd~n5%oddz& z$IEeTCH`a?u5D3;MQZS`eLJ=KeeU12?|;pESg?9r;0|Dc{m15Jf2(@`dw+9#b^rS% zewAxQ@0D}McpuW22gM1_hdAuuTuvA_fh{^`5A+R8zoo-odJc|S36VI$5*LrAKYVCx z&RpBM`^M_Ef-^ZRNMeJ|H+H(-zfh{A%2c8)Roy+yu06^QZ1~Io+;W;fhggOa^S5(j zYcprgf#nCO2-!K|Q$M+4(iT{2UhvHfFFH&oV#1}qhvGIZJR*FW4)KsGR`ii^}%ogu1CD?nG`iq#wI#0#wLtua^!W$ zy8J4MRqo69zVaH#6m|+pQmNI2VT@@~wC;t&bu(JfFP-E)st?fE_{9!TOojdP!k|P0 z29?}`Hm|lOuf}??q%yG1>aX05l%>{Y^3~D4t5sU7MtDX4?eo~8yE7%VnlpP;pX(WWutWa?8*(96p?EmshZKy;LENZVPv&7%JSh7yih5acy%hZOU9*W z>-G0P99;>{7CQr*yZ`&!{oZ!J%KzWJyW0O>nRR35WYW6cMb;m$*K!BXEc5RP&$+)GphwVnRXudV2cH8JYh2=oe__S5s?8Ks-X@w8*-~7es<*cTf(~6uB@$ zF0h1Qvn$O$**V!c+&Ovn$do@lwNM`I4&J;GEFo{+WLQq#yipmQXy{gr3Y1}v6Cw$R zJ`71cs#ieL^T5vA26U5x>wE%F1cijSlaeXyDlN$26onIm`pPSc7>i!8bu?z8AY%*IH+ ze_PX?B#}jU%pu@GNH$PJhWU5{(R9Q%&;{n{22w02-#{ZQal8(|Vm96fNV+liSv2;% z$@_p7I*oq<`$iM3*>|by#yPruzPe`KsID8B`kiQ}a04K~Su{%kWtQkq720)rlx3Wa=Jp3lEYX`XB;RVTAW`;Nsr7s45s*sz`>c+PDy@JgNlerX zOu@M(mu`D6b#mFt0L*>a(U_*|>E3Y6DG*Lbc;?#H6jWzbfK^lLpbRCI6VCGS1QqH* zbAmTBTrBmx)YtqVyFkUq#Vp@~&{UOHd7h>a5iAWdP7*4J*nnsI$C5DOZjlIRKV*!jRZwOjwLXXmjR-%jq1 z^?4=g$Z|%eKHM@4ul!yEr;C32{ng{WqnCRpd&j3Q51#BPX4Xwv;R*sg{S%pIaE>Vf z!~lIIEYmb3v5pAf_-z|K0lD(Fvfa@3v*_fLQrKfyFRg3e(6OJ?$?0olZ>iR)WpM^Z zISj=ja-QaK>~++n_~SC6p>!-l8z71k9YGJ+E&oDTN0_tBS1GMNgke4!5sn0Xuf3F- z_>)<#X@mNFuD%{axnosK18&MGz`wwkG|3YUmyIA$R7_Lim`C8P40EskEVs5#Q}O~| zHZ|vG`8=MM8?}>A`@&B$gr!uBhoY_LgirN4DW1}aIT|IrTo)MKI2Ey>uuM~Ms(?Ri z5=SVRo_fOBqllb$&{N&Ijy@_5ygq;fv zLC%Ume-Md{!dRS;S-c+do;JQ@krOV_-^~y_*tBP*u!x1CgD*q}C-^ZOG zVtaB$QZsnv6|z+8l1wx_Vxj=9S@u|MsFX>o;BvgcsEC1O_nu-0-x=_SglmH%^a$PS zZ~i`fXTnnhQG(aY2SA!|^)u*9wZQYtpM(+WK&Tqpck#O+CSt|yE|DV=H6_G_?)gTa73cCPV z|4h(yp`Y8R22U@!WHQY~L@MTG{GMi+i7ufTCviqIt;SdzV$Bnqz@64CL$^CtJX@X& z2^V@ZsaB59X!hHCnt>;GyR&QQ9-pGlv%v6iSWMFpW%)3sVnWk#2mPUjY8+LfHN#7- zZ`f()EZ5Eh478M`K~&-m^~N_K!6U#l4JVwX5R_CaN-zYbQcMWrU|VcaPWLKeL}(A| zF;k+OZaN}D($pxhwG(<9X%wo%L2cr=>v5Gu;#z*&o0Z2ErV!|}o*c#JyO}`!UT?jF zc7}rSq0n(kl?Z``ITz9~BQT4gd^Oyrbw8oozbz2ENYQ_ClIz&05TbOH$FZAe%q=Ug zFkj&dO%f7OEJ-{C@r&hVf~=A>qZv^g=Zxv7^0TuirYJc}bFqXj*$6tjAYnOcibl!n z7SaN@IsUAO1UC!CZg_Tba)>U-&`5k62p;t*S*37M;K%JY0wER^Q4yNVo#2~ur|-Vy zNwl7waPgpQB*HxLB}jhgK&LJy#G!u6ljxKy)|`V2((=>YET zAW$s3pm$pO^?*Xb5NCxp+I;vh;L>WuiA$S*UzWDrFA4^5O(T+EPLTT3)1KG0*)y*{4<=K>d&I=M3L-~B&n9zpy}pzA@Ll?4wKEN#}E^z zPFOSQ0d*Q^UBE`62@u6SR7tegsK9*DpOs~PMdU{I?Og}8;g9yZw;oo$G;%K#Fx^*m z%5+j!_i(}5_7^Rb;;g|nkdU0Ht#TIj#B4Co++wlul#z%M#v%DIGVz;FIsg2LDI?=UwId=ijjix@ zMpEydy7)F&q<8=?-+k7#sFEgx8BH);5^*9jmI@;DRjVdfG#z)roVU1Gib$pqo*Dkw zz|lOb1!{U{zKX`5u?rM4t)Fw3#vu+T#B(eZf*)rb$Dlzh)&Z?aX7mSIh(c^+$^kBT zC#f}W7a*o)EHd(zRgs;XSlsnfihgo3CYP%95ly4Qa$NnfJLW7`LYX8SJwktW*IxhG zeIwr9>8}5*utJqtd(#1{_Vs^s*Vb%eu>OxV5Hi$G_-janB%=}Ia@{Mv{tpH1?a%8O zi`HKEf`>R5z5Q@^^W$IU<4th-_QT!nk6xvpnmb)6nUr{KwNe^MT-G-?nC_a6-52~7 za?0Sp!JCUa!TLWOfbFf1s(i>Yvi^^?H{H%1Zw{==(!a~+jLE{vNwK5m>e6CKO<|z* z7)d6lPbhbG4j|BHIu4gPDXBp3)O2(|WGo73^s#H)kCX|-{~url5#`+vx&Q>G{@4Zc zqV79r!PGorOg^F9pl2nqz)-8>GM5DS?w2CY&Y9 zEUBrceLr1eHEpwMHBHlBW+BTRpTCCXvR7QbQf0@}m#6Kji>41q&=yZrivq2ATVdVO zU#2auOH!<^I+JxZHyNc;@G+~CjTacR#En~3rKhnA)Vec4$0>-ao;NRzS?(FWM{`~$EaIC`IAoN1k6ceq0&9w;sl=)$FMQ0xC29l z3q19Q=BkXXU#YF$-GZTEDKHtHfr4jHZ>Dw$Q~RH47R9DZJ28mYlAdeFwIq(!h`bKs zp<+i-GkvmcEel5cs*;_DaSmnK0}9l5r+k$YMKDJruYo z8BP)^*I(PTr+wcmtie@^+DmShNt)32My(B(R*52?1&eCeV(s6#P*p@uz__3w8>+l1 zW!vApe)}=zW75=qhQ~Bj=x?=sT3M^FqircLkcB=L{nJoI5wOF0m|ZU@Qe`DH`_hy% zSO2kCw^tksJGo?6(d(6KdV+T`P#tfhpxqlr3@xf!DTBHg8fJoo$6!N9V#Q0si%+01 zhb%%bwUw$B#0ooHT}~By#)K@DGm6Bb1E)BbtfocuI;irC_q}ddpIn)^QqFxx%DG0p zuZJ{O)BIYd-&zVxNSqZn-I7rbJmW3Xzhe1Nnl|B`RXs2G*5A%IeTA_Qip)Yarc8#Cw?c>M`vW( zH!W3O5t6Cmq#qN^2}e&44i+8O<%=7GOl6o?I;0otN~;}#ZZr~cdsS?f*=;|w?R2&# zndT}~m(<%f)s3LGS$?%u27_WSYCl5H-j>djD&MaNK;|}3#VPBdpk#=hh8{EeqSB!TONE!P)5Tu5}`a(^dE&-p9RiV(dfk2i}@^|KT@NL zSn?NVc^U~9Bp(i}~tF{UY>?UT6FQMtl{&B@QUpdie`I`#P0*Wsi zfR+*s(58YjfQI<6WWsT1^whgMYAVWB8~*)GsoG4~FH5E!);vTqZJ#nVa9{e?AXRU} zO>lu9+x4!HP@!W7ZI@=)e1n)ZI&wiy*NrZv1jV%92zqWmekarU-B1VltmbWHzx4{h z8I6xXO_YYyqTxMf;H7;q5$}z4;y)r#-05(t3xU}d*a}KKRm6^_&fW_~k-{ZKI(A$m z7;YL6t{0G3^vOIlsP=KjSc;C=J8+j^4WKFoW&k425EB_=qJ&Co!c{09OtH0|dC4-t z0;To}&lrVOOY2o5zVTS`MpFYp;b!aabI6Ed~RZ2>{cxDpq!(A?`tO9&fU$6KjMMWHk?_U$+=s=1IP>623Vk#B5Y!epZ^GTs& zKt}wpH&fD4c$Hjp6)3aVvuazmnt6dh1j5jiA(;wg+^t1|Bkg9Pcr;?6Oo&sQ7l1DCAHrzWQ8HP zop1-FqA3{@a7S6lNbssnY@iF`E->*qqY?Oi7}A)^sXAD!jkVo6aqIw#4HtF~l=BdK z&zv`~A!r&h&b5)G)n3jRgnPZ%oI4*CTsu(sF`3|VTKGo3RXi56?=g?eqMa~f(6fP_ zaF%VLBlqTd227`io73PdPK+fs%DnSfq5C&}Pc!6YTUQw=^AepxZUgl@oz6qUp;dtz zCT&Jrv-Z+N;jMQR6^w;j5qk(36`!rLrp*{QxJEJT0=%slvU7sA-1~*%p^@&mt?%Cb z_#K$v&7FA6IF*y6=&!ZQ!Y*q_8{%Ky|XcExgc~rk>)Yg z-%+i}N97U?`QCVHJ)Ol8>MQi8rMHu}X4x0OKFc^MJxn!b4y89tC9s~|<7vjCQ<|Yi zI)p#+wTaDrDML~t)CZJT|4K)b5i|BKvzUfdR_WN|(o<+TA)J^8b(U_q3vj~;CqxK5 zCZ(51f~1isl*_5z5ZEA zh1vHJ)%RWc`M05@sv$dOVy4Z!t@=A^nofUpX5_1NY|L6H<0~=kg`V<#l8$|rzH*~p z!C@D?)hw9zlnriP&6B(S3w4&o8uS|6N&vJe%Q-wAQX-;x|G9Z@`}cJ-5sh7Yg!(V6 z9-=ANs3T^MX|d`CHV0tM^Cun}KV`far!}95^hVWB>+D@np3?v11igdhKc&$-%lkrt z8Cwz@-}Sb92UV%yC!x;_x0Fo!1{iIbdvWJM#H&!aKr2I-fqzB8rHMKRPgWw@-#=;zj6Os^ZcA*ZqL&o(oL8Zc*$`Va1r3TRjYd3a~ zTvB`x(HlJ6?Da|o`lSN>dV$SSfz6`83?aVMZw=y;+=eMo3$DYSLDSd05L?}00h1eS z1=_SCYsSS39wC`Mli!pqND%P)BpWogjCYIV(QXzuO(g65X)=b_Q|Iwjfc z60_Q_f|#}8z!t?LK{$%22_I(is&t@y##I2A&qi~PYwGg8{Pp1cOEZZfKcoKLQ=u+!ptAj3=v7I~CGg3UKi`OBqe@#9gX zh)4m`j8gld@+1ON&amL+T348RJt>U4xpqO&Y^;h}#tSSY;Witf^m?0tSFscu!aW(8 z6Bz=0YQiC)fs2m+Tw}glijY(0#mx$qab;1e)9qHgSnM7>*H-7Rz4Afvenp9^s@JL< z+Btl_p&tJKaTpZlcxxswISbp~H zv;64FYf!KGx}Il!bsgm?FeD~O1xrzvGbTr(%k#AB!CKR^AuPwZPt*JoMN~*mhv42> zpMqQi^f-M##dOHM7_@u1993nB8C?7}OiYC&$+5)pY962bdY(TPaE{=47B+9Obm>!} ziq{@u=}f}{K@limUs`oMy<$1dH0u&g>y@G=)pPO*2?C9Tb8(o1 z=#)|;rKHdE5XtY8pJF;?l1jZQr+vB&rLg1b+o`BkY$m|7+E!AjGd7Y&%o*Eg_WQ+8 zhR*=#Q(|-F4J9fbF@G5pg#m%jQca?qSn2s)GFgRK1a=Gdpg1QS^?N<@$~y5JqX?oW z2t`c4%`ZI&WJ95*NLyrC9l@n_w+nt#wfBK24~g;nt9`J0b`BZg@X9d_U5*wu47ZaD zJSIg9DwIf9WM!{AOzB3onDx4W%Px1K@NEk4d6_?Q0zF(d*4CvcL*ICL)zpFMx_ zWbfta&e3njYcF5Dc)WLHRP!_5)ZcK)0y&3_L!VRQ{}*C2 zQApCBBy=2|;(W$BpqZfK6t0Zocxp~tZCqHmYi0`zld4%Vc>7y8!!yD^ z6*^F&QDhs^1of^b+0G_Uja0_#;b){XD<36|qx?2~lzdia9?g4oiCq^_aaP@QDot;$ z>c;D;v$*T>OPfojuJ+byZ~f?dYt95N<9y$!pZD3=-*OO0&E0FeQe9xdw9i%>GzfGY z{>FoZ2FLq;WS=GXTiKT^8`*1xn2o)5Z<&~S-18VqQ?(D%2!lgHsN}`KMju>voO4Ccbs)j_>c(~`i-W}Vg~{Z zve8Hov*%1v^O#9DP)=JB?;o6a8*(ACm`Y(Wl5` zLD0XMeyWoo$;Jc%GkH2;ti!}X*pni{Bo<)bTs-bkKn^jN6vri#{dzj`eXBW3Z+I8w zIW0FKhuz~NtxYC8p(gAK;}BI#2a+Np#2G1sq- zj6-70uuOzY?TOU@vGE72B^Twy^R`}Sy}^GnD#!GL4g_`-f$nwSdi}^fcY}f_rraJB zJGP}92REmPL+~ST{aly_KrJmxm*=wVTvte%xk;Kaxkrk8Po&HS-EM-@`yIx|-I%8N zrTPpqwQTCIt!~It!D4b6LcGr{2vDhC2r*6|Siaf;R&Oko$VW_LAm0qa1KO-7{CRl*6 zB8iH;wW2xgx4S^86eq;SWzDcc%@n;mBhz=~?)*-sm9G2__BdbCYhn?5(Z%$b8GTZ} zj41JAo;GO7P?P=52cII;WYG)BG|XCn$yMOTuNV07+G4yH;-Mm0?0CT+_N^pfBnO;j zrwVQ62oJT`5hm`ibvSVinF26Ypfv!kt(TOT1AMf}Q*>&5!#pi7a<%^!b(RUm1{S?^ zXb$oLOQ8z153L)k9rfo7rr5ZKx89=hIi@kpgo#jLn4L7N>KXhbPXivap(bR&{To`Q zu&69aK{=y?R)4O2|{XBR?V{UR+G~zh4X@6*-Hx`diE`!nnb3xcQ653t|4L01wFUx zUwoHAeN%FT*RKNp=Mg2mraqTA;WcqJljxOL@jZwYrAVE@hS*cAlSf7c^$sG#^?evC@4#{*w1A+W=_trz|f^I;O^Os*YiZXsGt9 zer^pObVFj^Xj_kWnwfa_f~Dx6I7OSNe{ay+8uad=pm)F5Lobd`&}Of<{jM?wZ)rN! z)bc2HBJg1vfe9fUp@gM!(v2|O5T&;zFqJg*V@5iF$3(tR#j6dubo=VY%XosP4aHUJ ztTifvu$m*$PR?*@dbM6|W#3k)wByn%4=KK`{8R18SCoPLu6%COkE_Z;pjj{nC1-i| z<)t9qI5m$vwQ=jG5QLB)S@Zi4hL-N~S6BO+UV1mv1OnVSrIX#k;EPKyHtc+OWGbe~ zki|9aN`qRZ(%$13hi5SrQU~UW(8YvGViPR&uqrm22fp0?)Vum8+j9%4o>|BmzIQfP z!LbAdh=p$2ntcNJ;9X}O_@et)1b+qp1SMf+t|;|ymh%+HQB^>)>9tFlD~dp~#GmpF z#B4DT1R>iu@Rz?RI9gR9TSyh~=zN6i&^F5AMV80$)dUI4*=stg-SAomw$_-#&99@2 zLo%jmO4IR%cXq%FzBnR6nr%i^r(+$@76xdH!-D?SL>(=`-Ckn;6=-eJO}gF-esg}Q zE&7zR zYHvHTFVEunbGlM+e{1~Qm*nLvALlvbx6$RT!fP_k2tUh*hQ6$+VLpHP^uXQtt$!{q zZHDWnPsXNI>Fx`5PS8K?-hk0^9mZBNgpnW_h5-5IDLF(Z%D7$7%SG%50N>|cJaSdI8TDyl%N_Wpm z?Y`MMtg~k#c+u02*I+AKfNQ1QtTr;>5bWl4%RW~v0oNA1Qj8{*iw zKp=?cF)4f`Xf)VRdnlYhMetPt2Xdk|hajn-z}qT5%s*BDUxsAFAWoMtycR?=)z*_5 zI+=hsW@yyJ?9w)3S_fE)KBWD*mJo6Sxfd;#39nh0DJfKs!`dl7PmNYGjJwHFL!xXU2f zGu6QohUs2h6}@I&R(ictdG2%e`F4#9XD{r0{mOaaWph#c>Nn0_%l5iHA(GQ@S+PMV3!oA$r?$|DQ79fOgzV&Dh$wB&B7p zi`H2#;~KIQ@^PjoNK@z0qetkEXM0C`0|;xOsA4F=NCEg{l131A=QySz*|0t{Hk6!h zv)07Af@0v6Dxj{dF+jg4I`wPk7w1gz*A6;RVzP6q0Roev|Kl+yW5t+-aV{j`!3B*- z$H%yGD;Dv}sYb*qrOgy(0F8B59XR`K*3Nv*1z}sOb*a*u<)Dl&iFM{m3XD zRy;fSW1#)DtZ6SK>uS|i!b_Zx4V1;X&{ikfYrVF+F^FJB0@a<~S$$YFFkdhSww+RK zFF=9&oWG>Hdu~Pbr&&<_F~1j8y?KLSQGNDwD0;=Xw0C^J?gR9gU`{ytX)VN37dymq zvfehz2=nbU5%$|xnN@>MXa>pqh6ojfv07LOtl))Iuqv{8lm=~9Mb zoyqG&Tri#e6md8VC~He(h-}3ZU`fAa+zRG`jPh7Vhskl`-AacRZ_Cu#sJDZo2|S z5GiRoZjNo!bX(Uv@t)i7nh)^h{CwXn{Co$ADd4&LzOgt^AsSUlU?m8w1c8+xuo473 zL7-@$^Acs802d(4#cPOTwIYFHU;>DdgGM-xhd4Y#G@>k72@@+}VkJy`H^RhH^1@0$ zSP2MUUqEn=sv4w&)qASdOQzLJrj=3R>Lt^U^OETcz8G3Pj;wDk7K@x$0|2w zDnBzze1(9Hl@DLFOR|_v6Ozh`R(C7FQN+@cD%a5tGr3SgSowzMDVXeGj^mibnk~g+ zhrm!8Jwnbo2pwoDc(*=c!QakaHtuqnB(T!64CUbTiI| zM4;}3;8;%H19o*4qd9$Vw^?eUQ9!td01asxpSnq{7>PKjlpK5}F>MZI1> z@In`k)-|1}kLHmDJ?QrzJa{mVBU${^=*;;$E^jL%LKNAjdc(f;H(lWq4m6DLo}lob z>`|iS#D`BCJ*<&|{5of#4*5k;f>S&O|JA@=yMreo51n{RxUKk8?C2ajS2wOiA^DQ7&wk$^e*a>lio%rp zCncJuaJBVQ$WlpCSwF{L;H-n=cqfXe!a5v31$ow5XE+$><447wt0W8SFQ8(nL|eAq z>vzGKc6>7((KaYwy*o~B`s6)Pe+C~v{%!U9k$y!0g+Q|iK|wmZ;RJIjx<#3;BuN%y zl~*&an&KpGZll-h^|rUR;NM=aSNXT!+wN`st$%N`zkUDyy?*cR-+G(d+jsB%4fVdn z1mr?u{A0 zjz~I34l4D86(}5G*2IxrN6uyE2ErbNo zUDjpb%5&cv-|P`q`)mR2H;jB+ch!;x)0T$`RwP}34NFa4#-g3-a)Yp3UGh0|`=F>+ z;gQPA|EVU(Yj3#`?w2rRxslYyVzEX2GENz%a=II1Azr$rFg+;c>bH4+Iq7gM<202c z)czk4gq%tm;<#O2#r2{WQ7R5uOvC8_?P~kCr<4o%2bGg&OvsnU53V*ue5rMzgF^M{ zY|eJVkmaeYb+w#b?Q0dcmPIN&8qt)>sfSJ``>?I2( zn7s>KLo~tT@{~hLhm(v6Dj8RkG^k}uJgz}G%;VT1L#;yQGOx5bVtP(eBE%tQ!&1LX z8O6NKoVk8)&emC~D>_(WQ(wwCpQ1Bh=B0M1V$?6C50dBUj(8;qAE2I>oN;mHA#knL!-FTMpR6gTY)Sp5w2$l;5HF@a?52YbqK|vc zz=g4HqU+RSi-2fRZw3^d+4Zr5;OHQYrxhgdB+Htbx6ky zM<>&av{Ac48QQ3=HLq{*fXc?)|FOw_S(*AqG_RPt9b=-;S@!FTZ@?jgs3D*>BI=o8JP}h z_sJzHss}Nrhy$`&yw#cwW={#W z?JFHZi;o~(#m7;d@^Wsy#$L^)jGu-mZkN@oUsL~cbN$~O#h>{t(*NDbyHWOiUuwS3sNh?u4EgqSdY?j@x6Q@6%m5%Of>*)SVlxZt9noGEe8tn=Sw3Sif4Sv_x z{}nIv7AXMd>;HQ9H@ELs^?&!adn^6lm-sDwcey|T=*ll?`v>nLZ=eS(`uD9X0*jvB zSQE$zxQZ78)W4CoujtZewCA%cyl7Uw8Li)Pv$8<#R~py%tM~gHYP%mpndNQguc*x` zdhw&Hv;2{+^jRx?*0-$B`q9)zZts1sdZU%v=aZ>@e1|KIAZ8T!!PPzU-&uan9{*VS zo+U}mO5yXFe%IFjSfL{Xp<}KJXo3Exx3%4`zW?03zqQi;e2HJ>h%AeeGgLq#oRBDw zX*%wlJrEtr3VqO_Uw?*5=+jEAH`3ey#hKG9=LX~3FxLDGziaP*qYA)A6)=wgEZ+Zj ztNVYex7z<-0^qj$ajAG|zu!=!TGIlyCnQcfV$!`JbUcym0cr;id+jF5 za%C;mGRo*5lmc9F|98|XK!9(ud>f1QfA4P9{(E!#?#llAi~NiSRncu>F6jt|a*_`N zPBPY+E->p~{eFPo75D%C^WD9d$9q?6W6}QaZ{4fx|Ngz+{nh^e62F62C%XsxPtftf z{;QMc2QQD&@xjxRKX#7xkXdWA^V`wh-iy7LC#{K;nHY4t7Z(>DmdlXEkzjGI-Oq(A z=|(IR-I#_X6(qo8PKXliyI*^dtKZDu75D$q-p-R3dz~b@N*fFIe}Aj?{;Pj~dvmq_ zzr^nr+I6doo{=~~yRhi3)?+LP0t^68w?(m5>((vwO5ibRwF2~%arAMJ_gUUXzl+V;Ry5fnQH*W zYBLY1-F3jNeSLtmTCcBiI=x+6cs#{qjN^v$Y5i;O!mszcBK;3}B)Vmf-V2}qE~Njx z?aiwFUw?bW|9z2P*|d+6OG#1z8>Xt--OYt$$&oR}ctYTL9c5{QmbZi;YU??T4`t4% z4MLv`P&pF-IBlsxF_mB*WLmwIt`$=u zf7k2ePyW7jH=o5h$8mLOw4oVI$9ar-B@^<_>L9;1#;$&!@^>BjuM28d@Jo>YMf88O zzg4sU?r*O6|1a|UEcD+;kpFJ-KMRcd+7vzp88>#+arWR=c^0r<^6nHH(vSV~rD8Z|taupT`jP#S`5?y$AD` z12r1MTwyK{82enkE=$Ql%?ecEz738rK(E_+Qr|99s+eOaZ@30`nH9}q9JK7LLx0rx rhSHX0P00960=1.24.0-0" +home: https://www.outcoldsolutions.com +icon: https://www.outcoldsolutions.com/images/collectord.svg +keywords: + - kubernetes + - monitoring + - logs + - metrics + - splunk +dependencies: + - name: collectord + version: 2604.4.0 + repository: "oci://registry-1.docker.io/outcoldsolutions" +maintainers: + - name: Outcold Solutions + url: https://www.outcoldsolutions.com + email: support@outcoldsolutions.com \ No newline at end of file diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE new file mode 100644 index 00000000..3b5b96d9 --- /dev/null +++ b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/LICENSE @@ -0,0 +1,2 @@ +OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT +https://www.outcoldsolutions.com/docs/license-agreement/ \ No newline at end of file diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md new file mode 100644 index 00000000..c1eeaee5 --- /dev/null +++ b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/README.md @@ -0,0 +1,227 @@ +# Collectord Helm Charts for Monitoring Kubernetes in Splunk Enterprise and Splunk Cloud + +This helm chart provides a way to deploy Collectord in Kubernetes clusters for monitoring Kubernetes in Splunk Enterprise and Splunk Cloud. +Please refer to the documentation on how to install Monitoring Kubernetes application in Splunk [here](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/). + +## Prerequisites + +- Kubernetes 1.24+ +- Helm 3.8+ + +## Getting Started + +At this point we assume that you have installed Monitoring Kubernetes application in Splunk, and enabled Splunk HTTP Event Collector (HEC). Please refer to +[Monitoring Kubernetes - Installation](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/installation/) on how to do that. + +Review and accept [license agreement](https://www.outcoldsolutions.com/legal/license-agreement/). If your organization has not purchased a license, +request an evaluation license key with [this automated form](https://www.outcoldsolutions.com/trial/request/). License key will be sent to your email address immediately on request. + +Create a file named `my_values.yaml` with the content similar to: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true +``` + +Where you will agree to the license agreement, include your license key, and configure Splunk default output. + +You can generate a YAML file for deployment using the following command: + +```bash +helm template collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + --include-crds \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes > collectorforkubernetes.yaml +``` + +To install the chart, run the following command: + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +## Configuration + +Collectord is configured using the `ini` file format. You can find a reference with all possible configurations [here](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/reference/). +This helm chart allows you to customize and override those configurations. +Using `my_values.yaml` as a template, you can customize the configuration to suit your needs. Please refer to the [./values.yaml](./values.yaml) for default configuration and possible values. + +### Using secrets + +If you want to store some configurations in a secret, first you need to create a secret with the `ini` format, that Collectord can read from. For example, if we want to store license, and token in secret file, +first we will create a secret file with the `ini` format and `.conf` extension with name `101-general.conf`. + +```ini +[general] +license = + +[output.splunk] +token = B5A79AAD-D822-46CC-80D1-819F80D7BFB0 +``` + +Using this file we can create a secret using the `ini` file: + +```bash +kubectl create namespace collectorforkubernetes +kubectl create secret generic collectord-secret \ + --from-file=101-general.conf=101-general.conf \ + -n collectorforkubernetes +``` + +After that we can remove values that we provided in the secret file in the `my_values.yaml` file. + +```yaml +collectord: + secrets: + - name: collectord-secret + + configuration: + general: + acceptLicense: true + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + insecure: true +``` + +And install it using the following command (don't need to create namespace as we already created it): + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +> NOTE: Collectord reads all files with `.conf` extension from the `/config` directory and subdirectories. It will sort them by name in ascending order before reading them. +> In a case of file names `001-general.conf` and `101-general.conf`, all values in `101-general.conf` will override values in `001-general.conf`. + +### Secondary Splunk Output + +Collectord supports multiple Splunk outputs. You can configure an additional Splunk output by adding a new section to the `my_values.yaml` file. For example: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true + apps: + url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' + token: '107E857B-C311-4C72-97E4-FBE601A6B39E' + insecure: true +``` + +After that you can reference this output in annotations like `collectord.io/output=splunk::apps` + +### Secondary Collectord deployment + +Collectord has ability to forward logs to multiple Splunk outputs simultaneously. In the example above, you can use annotations like `collectord.io/output=splunk,splunk::apps` +to forward logs to both outputs. But there are limitations about if you want to apply some transofrmation logic using the annotations, as this logic will be applied to both outputs at the same time. + +Say we will have two Collectord deployments, one forwarding data to Splunk Enterprise and another to Splunk Cloud. First we will deploy configuration for Splunk Enterprise `splunkenterprise_values.yaml`. +For example: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true +``` + +And we will deploy it with + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + -f splunkenterprise_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +Secondary we will create a configuration file for Splunk Cloud `splunkcloud_values.yaml`, where we will call this deployment +`collectorforkubernetes-cloud`, and reference already created objects like service account, priority class, and cluster role, +created with previous deployment. +For example: + +```yaml +collectord: + serviceAccount: + create: false + name: collectorforkubernetes + + priorityClass: + create: false + name: collectorforkubernetes-critical + + clusterRole: + create: false + name: collectorforkubernetes + + configuration: + general: + annotationsSubdomain: 'splunkcloud' + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' + token: '107E857B-C311-4C72-97E4-FBE601A6B39E' + insecure: true +``` + +To deploy it, you will run command, where we reference the same namespace (and ClusterRole, ClusterRoleBinding, ServiceAccount), but create separate DaemonSet, StatefulSets and Deployments specifically for the Splunk Cloud deployment. + +```bash +helm install collectorforkubernetes-cloud \ + --namespace collectorforkubernetes \ + -f splunkcloud_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +## Support + +Please refer to [How to submit a support request?](https://www.outcoldsolutions.com/docs/faq/#how-to-submit-a-support-request) + +## License + +[OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT](https://www.outcoldsolutions.com/legal/license-agreement/) \ No newline at end of file diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml new file mode 100644 index 00000000..38587428 --- /dev/null +++ b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/artifacthub-repo.yml @@ -0,0 +1,6 @@ +repositoryID: b6cbcd8f-34b6-40dd-ba51-f0cf09a8c7eb +owners: + - name: Denis Gladkikh + email: denis@outcoldsolutions.com + - name: Outcold Solutions LLC + email: contact@outcoldsolutions.com diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/charts/collectord-2604.4.0.tgz b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/charts/collectord-2604.4.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..81b5d2bf1401279b6e3bc8f3bf4da3ab7960d092 GIT binary patch literal 16849 zcmV)MK)AmjiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYccigrSDDJ=YDRAWUL`tfbURt-nf0%AwgUlodmCwY!1K(tYmkcl&$Yy^WNJgws+&;-RA#lqh;ZqZvA>WWur( zowKY`rNqXRs?=8cbP6DY>{rl@(r3OkjskoXpSdD^gO9{#noivlFY6d zPsMPfgD$HP;RTUIY;+JSNg<|mEH^qRX9bmv(_*sGK^dE<{G3Qm6ZMxUv#Pk<=pd3| zA!#BA=E>B8upeS3GN$VPkK+{c4b_+%q_6+>aM0b|>-IbSuQzf`3yEn#IABF`OtT>p zRar7F|G(BDK&ZfKteRtpP{p$q22t1dgR>!LB^e@ImKja3Dz|avr&P^ox4+@$KUn`) zIID;N(IYa(RVI<1el%u0Ag1odU34*} z0#Si5`uD-JLOVP6VrXLc~S_#g3uW5WRl0fzVxa^a|%? zMuzY~iYv-lk&{9WQOQ|aB|!TsPZFFDk!n>T4@n6VvXhWP5ZFF)-psXOD+lTQr4@lO3$dqjC*FJ>i^*Q)XD$?)}|m_FjNVG z&Ym0{qeH?a9jo!u7^|ss815iZl7x}OJJ=l4n-lBMG7Fri>62~w^IAH_8$L`D@dD&mA| zER*Tidc_rEI(df6pl>#5*zC?-bdaW0%`VPh#oN`5(^RiiIVB!wb77{KjGdcaw+EYxfsIo0nv^IYgT87-+VVH09TE^(WL8fj*8O{pDJFo{M?PU9|BLbAN0E3|Y-XY_QjxLJpy{(jyH&&~1>{q#$7 z)@`brW=H_O!Tw7UwM*&w(sPT`D_kTbH65%t$Wlloq`;gq#a~P{O&9S5*CvzYBU+Gj zY2O`8+kMX+bpJbT^A^kxoQl;BKGe*-=O z#b&=DQlurLisNhr%9q(m|GeGRRF{`>rgX7XOLKn#c;}$sXhlsZcCS+NE;=Lst0-5T zd`gsLMz~_`O4C4U!zCP%LJ4wuPOd19d)}Rpf^eLnEmh?lYJ5+Nlok{8XXMk4EaqL^ zFWn=+I5T5$ss_ODUpFj15!(Ne@ym?iw3Cr5k|A6aOadO7-x|?zE07)ijM@Eldjo|P zO^dbl3cHn~oUWH&l&HhW71c`A=0NQ|suQ6&+5#(KdC3YO!c8X_ZJJC;6}4`91$9&R z_LQYa5M9>wtrAMyW*p^e8`okmqJ=BCt!2Y05yaNHrdbBtbR}7iB~5Ua%|ZcN2^k0r zbWJj~uq~+LC7r@$SsR(4n|e9SEm>kNJ8T?jtG3gt&u+<5r$nfZmn=P4Wok>#aw4as z0$fDGvC@+_)dJmYEuyscA=><||6SkAc*)Xb z<^_bImW#>N02PNjh*ETul#}#PrReuOnUb{1Xfb&@DVR$>dPNdY4s0zA>)epr1>w2y zSshK`N3Tjwgn;?nXzUoOeuuM+GzhVfoMoLd!v)z0w-QzojwRzm^oSAhoXMkCRLBjZ zQDuZ1ifbJR=?f@iIsvpzfFtxAlku1&YI2`5GZsKstCZJ+L^d~;Y&SVpOZaK7lhM|W|(_uPE%xr@%6q3u)Ji44_#*&CAH5teL4wUPMHJCb8hEn5;! zQ&wyQ3fCvT4P8u$#u@Rd5QvS(P<+aSLPBDO|r)aBSu;=`P z$gZlo4QTiKdmVt?RpW$4v`7W&cj3R`VDRm?-+q8?$WPWMxDUbTe9_yGUJvVC=)Lbk zgO*+B{$O{}CbZkEv9ETmjfkzODn{5eouoxsN!w#qN%!@!Pw(FS7o7jPgSp=GlZ&JC zu6!kLr;TO)AA`aEox%P7gZumay}^V2o&Ml{|6YH6{`(<*!L~{ZA#s+Gw7aqKm~rd3 zu%kA8i4%z`fv{ZY&hW8&v;N)m*Sh{+PDxf0F1oV34Oft5{vZ8&YW*t>V!yw)_du=x z2fJ(kj}P*D{kr$f#?h-%Ng7JNEpSc{(=sv0&fSe~dT-urynfwL@-;0;AkL*-ReTe5 zd;xGJ>1tQP=L%N$U)rrml{~p3oYRz`-<4`mBxwI0{7LikYCNW|&}L^78Cax9)t?)H z;2|g!2)h=>l@jItSK&-MK;W_j)Vmu$5)B*5OVxtvhCm~dU?s#0mXp8_Lw9&gNv1?W zPPC+954Nd5Tca5a#-r!wsw^!g;8?NU-FP}ioMZ$GGitylX(5bb9Hdd{q)-rGu|OD* zH`p#3TU9I`UpjWfX*1oBnj&-aR~hn5I5=Mc`oo8-&#A}J4TJ{LJ=3G4>smac#2X@4 za$3kS+WeE~{7G!qVChCzr?B=vBf1MFRIL*u;Ht@lNi`IrOM$q)cw(WTpVfMA!hzO* z8*fAOJL06wa6-`LpEuFw%gviFq}AN57GbaJYV@Zh%e!LQgB}gh>(_`DNmiw;{q1Uu zT8qT0mn*ADUJt^7b4^uwP1VY&9j{-vRQVnKuVRwa2Birl#|55{v@@D%K$f(uW0I+V zP36=rgU~t6^ii^Z<2>`-m`7meH8s~-Lo8$2(y;9eT^nTgGcz{lZQ-<5z2UZbC<^99cFdbzbu~oM7K~eM<9oL!j%v z-+?gp^Z5hOio{Ka!&|3rG!Wh}^(>SZ zun(0JIXU@km#E7aMsG5W*P709E^NMXlpl<-wxVhW9$(s~q2HY-BY9P4RKXa8Ze1-y zQTO^8LgmIKHK_l z$nRMIIY??B*Ood_YfkD9SOfSL8qVN65M!^A~q!KkY%{@GT}QsNObX zH=7c$WuB37T*RghBR3RCJ&nQJl3kY>Lz>fE*WV%5(z zh8O-W*d-}K?%K%o(}}B;5^I!N0Iq8bhM198CDo_@=Okf8DwaZN)Cj@(6}tdJxQ&k9|6|{=M&C>-n#_>k1x?w-63siT}s$?qKiE;Qns^-rj?IyMw`< z{$PK9ckTc2L4LJk#o(56S9@`q!vnvA^AS$ExRO)G>2KOK|MFXX0yEgSq(wSJhaSpC zP9#pT#QxIs>({N#nPWS5-dI0Ya4v_QCAQdnGiU4l9TiHeEF{`f)!nu1#-;3zzQ(O{ zN@4ySVVO+L-{h4fg)mV$RKnabu<{@k3A-YE7ADtR+B(*oSN*APbQmNu!lgck;x;Ye ztoSb**-vMacL~lyZBv}w*7Y#Uyqk z>Uo?_3NF=m(1b|yS4M^X^V*O^3k3xfIB&Lfuo>e$7?})=-{H;CC|F^ACSRN#yIRp) zwZilG+v~9&U7fOkFThFywxAcHJN}qk)-T0fQ*SM8d?LSP`~OH^v3e&lU}^lX`~7(T z-|Y|Xul>J1$nSmc|K^I`95LXw_jr~OqvBf*w*cP_gqq^YI|?bH8YzX#2pSsvd8GS6 z&l+vS`r!()5b}F=b0{HsHQw63{$X3nad|tzz!t9m!TzAXKXCE?9^Bhk^8fBS{@;iB z)z`l>h|gL5evP|`KdUb7RS5PS8GuEj-yd|$6%OcbnNQSycq$o^}+GQ-a1Bo*)SD0#1T9`c}rY-0Pfb;~R7|BcdC@|2L~pf(yi~W2Hhy z)ilTEm7v8Wyi60sUGvC5kT#UjOJcwxba--nd~|qma`y7&Uk{%D`}x7MqrW};s~~U* z=Wj1x{`Hc~{`T;%(9GXVtpkB@frtrOG&86PB9R(uFb>lK{bWY;7i6FzBWBl{eRObf zaC&g@!=%^DS`#2n{D5)L?w{7{nA3`&O- zR~LjjU-7e!DCL44Z|O7rj}$%q<(83fnl(k<_mb}m~PfVnT*8`E?%J?M_v1(GRAE?wK2gX*jruzG3} zl;Nau%2_p;B5xivJ9xXm#fog^Hl9WtWMp@%b3e*=(PPHzt@5fU)F82i6*gJl355hh7puMYLRr&S3kV?{^;!a(Z$jE%jYMLj+8L# zhRlb8P%B0dS(UJlDFws;eIcySG$I+hR^^<$ttEGwAXna2whP*RdL(TSWo_Pt`O>!b z9f&#(J7;K>y{lTMR>T<^<1iFU$yHH7JOYcTNeTN!#~_TStoT}@Yg|B2IY}ueiI&a7 z1K|^ml@Y$8v}PAZ)p$%e67)A6rBn%a`UX4{RG&}P*Y{BFTou!R+j2bkXZRJ(t6aln zW5fz2WfjB;k04ta;a>e2w{}bm@(jOfYc9+RWjw7n>L8)^hM!~zOQ{48#apikpXqs0 zGNn^6_v!(-iC~5D%MVDavOr1Lf>tO0K%-v2GnSU?irjQsuDJ zX#D3V-1+U7pI+k5Z~e}9zkKtR0sB3XO4+%_GgZndJ4jBkRJ5*W+bWs<_E2!O@i|MK za*6(8hM*hchaM{OvSX$+X$21yRc-dNq^6|sGQ*mSNM;cgF%U$XZ?5dM#frld!b-HyHM)Ujrc?o{TPW!&d_ zE=OvGSf!gJyB4MH>y!w}N%|77c&P{gdRXxcoJ91p#i`fgY*3953Q2ZfT0CCT6g@;1 zSA|qZm2r2nIy7AdLC#9D7=|jbY#syfcAlc1-*84nHA-2Isn5`>l$KQq9 z363ujM6b7xFzkQ<#4y)xbVk?f>V*+Ba_%rN%5qzlN7ygONybJvQ({l0SZWEkyb@Mu zThf^EYs?k;uoG-q@mMXWf=O%Oa5)djpd2Qxif%!!m!Lac zgrf&G01Mr?awaax*mH7S$IvHv43!uO8$ax|VmSOi+7{(s7J*sYLDy4Kz$!pCJ`*(U z?Q=WPyD_+kLo%7>QX-Y`GWm^`rFmUK3r^yamfDQ5HNsjZ*5(lBmZ967D4DIwM}!N# zm{cq0m$dxHZ?uF+?sjE2(gQg~?Pnb$$6+xm5>!^BjEX5OCSCNS>Z%D;iMEU^wY_79 zowG^@4=~UQR&>%xHq;B>fP{zuvm%*tRFD&T!P_+4%$GOU|=gtYAwviq0WuSk9ZGRr9)w zw8Cw+KdU0a$%0=EPcAM_(KQ(vjc*6Rr9P#r_z(rbDzpkA7By87nyj4STXARaz8h$? zfv#)m0T2jajB4uPC{zZG~;PKAvkCY)#sn|w&ZhPnp}4jW9?)~ zDBBpIAtY1IiWlzFvp#1Ra6++>pJC@zfBLdh#j?ke6k210rrX>IVx3Dx|CMmXTK1^qp*1+ce-3l%j^y zbb!91k*>DDCf@?zBV@|Cgtvg-{<#8&u}A(szC$p}=JhM8qp1W%aH&H^{?x4Q*oljB zWE^$Si?idpxn(O@l3%?J43y_bXa9P7c=Yng$@#^bVQbdu$=Ssly<$xZssTfHKH;{l zq6JII^Vlj12Xab;QX-mCJ`18XZ^s9z@nJG`4VLb+so`Kd=r~D;&Olg+Z9cl9?dCLK8?9bD3m(tA6&Q?fKrwNoN7&8+fv zNs8c{+J74=QZhi0?>?JWR7rEfj3pQji8v7@D+Cexs8zEoT1t`sqKt zpT#eK?rndgs6v(5`nd~U?c0CvZEe}a&i3E8K*>-m;r9^{l8ncU%k7}__TLq>U%uHc zS-SO8zw;gLjDLB3Z}-jb=Huti%U@pK+kX>O`l=miZ)8&HwY5rVB5_%tTxWV)`t82X z?+K?2{@?le`p=#1zdHc?dv8?vgq39b?^{3jx_=JFz?v+>vwY5&^j=O%95qLmmP#51 z18v91OF4T)x$|=Xg}&79aG9Nw3iPWQj^68%r5&2S>6!2&F@yNO0IQQy-g~VJbimNs z1NWlduh4?2dB&K0M7bf)TB4^=YvVG91(7LIAnYi8$9NujpDP0ZS-V~kn7RA;ULd6uHBSzHf^(NHcitXW+G$67tdi__J-3JRdzCcJZv|eG`&HBwRoyp6lg10 z3fq?dGVOUCX|cNMT+!8>WJIOlV;+*N2N?6zjk|TDr|}EawlhH|1xZ8Sb8Q6USZ%Dt zk)zwWPgyEz-T>Ey+NFbj-}QE19lI&DqZ71a%q?L2DQ0pC?xdMe>49x=im!+h*qAlk zfuq7To`qd=RVFsB)L#Fd7id@kLPp@A5IEGEpC&WSQzw zfFK?zF{w5R<^(mzg+8uu+LRg3`e}!Wg>^lp$<&sK{37*9pqoFCnW$7^to#* z(Wz6agTa^stcU1o&~x8)!mS^|H9%PkY__rTfm}eqPt~$lI!5Hetk+A)nPdse>_GKV z$Gwu_G@-cu)~?;{2SH&Cu2$3@aoc?Ca+Hh!?%+rmL5*-h+vam_&S_8rylZFt_jW7JSz)oK~ky`f`2 zY)rK~m}QW`Xu`uarSo?DQClZ8O9BrA$X9>Cpaq5tE!l^Pl-dLWiF?qAkobYj9$u2! zz_e7mMM!2!lK!4xPB?mea>ANR`;woZA6rv?-B)3W-^85$<+QjsKCcDmixZ8Nzpdarp!ih_ z&?wOWZ7VnjXo6287mib7r#?JTLlJvzgy%O=wYjjLN3I>#Jw!6?pE5IWpNHNc^=QLw za6ukB433bHx3Pn@OABnFL(CQ(yGKs9jV&dDV%l#7y%3Kd$ZRnhY9pW5ysaFzUIRF% z@iCZ*ie%;+K5`CTItCL7?pWvHB?2X#j%K}cWqy`UEb98we$CpCiO zrUBuwfIN?rxoA+waZX=6BK8d2C0GZjT7fx$h;zh5#+fLm(z^dXq1Pm{* zvu$;|-8Rt+Czr+>CKcXjV*K6BD_s^}xMIn|iPlOe zo@ETD-S;m>*XG_1;B5%gUZlXu<&kz}4ulGwVr(FO02HBHR7@pL%Qj&tJzsbm12XD= zvzf?75ma)`)u7B1&+2X2YUTz45eP$5hGi;}aiG3FK#ITz8K z>>ylNw|09gPwWH{1SZBAL;HlF5ld%FTs&5p&y=JfC#2e|_>}Ock=gGqvdR#gPPh$H z@syGYIHUAB65MJNJLsCY15A9yXbQ0(Ml_>xrZyJqV{MmCmN~#;$343T#(8*q&+Ip_ zAZU>=&b5=IwO-EYguA`ip1YV7Tsu(sdosmW)W=4?>o1Gh`$`hDAp(oh zJjf=DQ#s8&zSb`byQ~qB*95L1XvkD(#S`?-9W<(>J8IYG&c?0fn$XEqn#)vwL5(IK z#wA+vgZ?xyohK6NBlO47-O0Q2{0m^6m7GKuQ;nNLbcZPd8~8oGELr-Jmgu2=!XJg! z#CBX_NUDc=g9_^3XlpWR#?h-XqY0IDKK6Zd6Y@dl4HgmV?FQ{!e!`YdWuja8eYpIT})U;=M$d5@e2}SzaiF%EO-Q%rh z!h)-8aPn%d+zp`G#qFSn zXpA#qEkL!b;IzmlE}m4ljTLIIim6)GudixF*TeKS5S^%Cq?~U#(kRpY|d3nl7LPcbM ze!{L%j*A&e>4Zw*%$REZCp5>IzqkeNxG*#pp3>Yq-)+bH6ZoXuLt8n`GOBk&=d*BV z*abuT04b*lXQoV}$amW6fs3fbUrn7;dd4>{)mR3TQ*{7 zH}YV9^>>?7E#%y~y}}NQ!$2mbQY@;pgan&!uJXsF=gH$~s+fp}X?m&SPz4%+DQ86R zxYiBEUJnZ6ZmiuSX!fm&M#eKNB;ht2p!EB@ouFd$HiWw}vfyP1h^YyifCetQ;dPD0 zVJQ+$S@3RFXO&PEQJr3|7RBQ5?5XxT|0yWn@%LAhx~i~N<{x+j*N24dAjj+$%S7X)VOTI|escOc<+=zP*;8-gpk0HGgX6*;rj? zRRIEtd8C3BsK*(TW6|SP(FCq5YVmzir^$Mj_NKQu(-dXR0TmuXw{V>HK1zZ)iILX!MkVtKQOPhq_v9t#9V2qFucyI8vPOQDK4E@J6SBLYDYC}3|| zbpyL%oMxJJiKg{hQIi@3`Gf?4#=?a-&^s%Z(?gSI#M&Um*DpCsnl(>Vs;>s0OD+=` z%zT&Oucz@{qBw2Yt+Q~j{I?k>NQee0ObMYJm#RPQLSV}5&&O*|JIcFKozrT2E^bCM*lbUOHD3QO!{9#BG zIs`FGHH&g;We|7CWO=m+{1)s+aYZ;9^!w(Pbshvp5kwCVN}0Z!A6*D!BcX;!dt_M~ z!7CeX7viSs=mTk$5EJ)T$6ycq97@9BmSd5)9Ib2^X{Qo+Li`(6Mxi!i1U)^6&Rs+* zTWi**yQ~dbPvF%pKB?gGukZ$9LIgaVz)6|m#N9A_^7PT8qvtOV&i-+}_58)N?~l%m zX`ZI!fKTjbxX+b@-<7#YLFCPuh^ypzh!y+&sx)k*AaV{DDd4rC8?q0uaoz?GiCe!V z7E%xCxZdF2VS`gt25QCykjqU8G^pA_rdof25Lpdsg}j%L_eUVwMj+BZCe<3W^tacP zVGou`2~3Raz%*tDY04EN&zU6ZZ#ZOuoKwaD=fcGQg}0d~BlkAyLM#bE))UeRlMMu7^e`S!#mbm}PaWv5J1%7j0Im{z-W7oyCl6qZu1^$SI0*1UPt?+p6=%f|7Y0TYF8yo;_0`Y+R0b#f%xguug0flV0e zXX4=56aT^_7U19PFZU=Qra$a-X;Xjg^%7PHmXVhU zy!W{W4^-+KLW~o5EMKhvYqwg|G3d?;1E9+V@{bO8ZAGBYAm}P&?V#O0>gbu>?f=Oh zBmlejmlWJncjhGwRh1T#Q^FJCo}sR%*04}xe@Qg`OtAoGMUwiwE#I7u+wDoJz&Ww+ zvX)qpW`TaaB(q;*bbcVS8Y(}4KhB4Yn&{tNbZ>gheSK2jjELm1z#6pTQcY|vm=68Xp6^pcLK@di-0sk3(Ra;W?avN>I8Hr@*8k;*CL4=N_ zjsB=AwKfPjjm8XI@Oo*37x;#^<*cRLwUoP-a=#=gw}Ii*zMI#4&&55X2U~thM8at) z!8lS9Em8r$H#DPf0!lO@I@7%TKO>fBL$G?iH=O?KP@mP)vA;1%1V}? zF=FSkA3bI7uhBGb&s4!pC##X@gAh1CT;)6idH2(X{s9KEDy7mxnsdU?D$OsH-otib zo3ASYW)cMYM=WmLl>>Diy+VbpL6ESC?SN)FqgxWk5TP(otsIu#5bp zQP7lS(?V#q#2Wg#|55ZS+W=VdXRL}f9aCd8Q`<1SXsFh!zHSW>bQ5CkXxoT)TA29t z87t5~ae;Qx;Qp|`H|*a>o&JM2%h&YL6u2&>r=?cj`N2CMD3 zm1A3>){aZBU8MN9`cEB`kEjEMsJw62kDKa3U|BF5C1+Ln;k6*$I5n3%wR7ujC_*TF zS@ZKyhE_)TqnrH=mchw1fd}rK(aEl0h{dHR8&*DCG8MCY#IlBUrNyjLYw!CECzlx& zQa{Xk5)hZyd_pPz9Q&{=_E`^VL95ge-0lFMrwNXmx|E z*DB!B`54)*?ZoOuS!LPH6bUQYYd)&O@Y(>j)|tbNuj7j&GNDC5i^)!~cfbw4EG0sk zWkwa!nSRd}I%u53I)lBb+FCmI`nma6psi^y?*%vb&Hkm9=wr_EGZHwY`lR()#Fwfx zd>WEko0RtcEz-3ERj`pM@NOZh#mNaQw}1oblC?EoOZ-I5-nM5SUc?K>bZy}N)a1Dj zDa%_OW$>DXPlItlkX?ivij>Xi(Q?#+I62^H|N|M$@C{g0;;^-B; zf}folD27qCWxbW3Pf1JiPezMiCp@Jk9O8n1t2JfDZvWbmMoX6p0=TO-1WT2u`s&ZN zmy4A*I!h?^xJoAEK`Y5qKXLaQ;F*GnK947vuBV zgpYD(V@uAtRwOQuu@_S)_ul;6-F|)VjrsW66dG5BJz$98u0mu_6oL_jX)JC^UULsC1MF0u z`<%bOy~TlZ@a%l^$a(2uv#)*g6X&31dt9Fr$!W5x&AM`uSvc-BI3#YBRW0?5gvNa5L?^Nc2B$HvUqQF^+~+7jCeih&nZKs{Syi2kbh z)Ze;)b-@(>)3K~OsM`? zj78mU-r`u)96kLMy%JnD55lx_8y~#dz6=1bl$=fD|Ci!E1su zH6tA*z;xh^95lvRHp0mzqA6whTA5fY6KiGSvr#5i(iheW!dgN2_zHr%RMny#tnX8; zZ!)cKGOe8w*EgBIoSRG^@W#;ka*S=lssNWg%yE{HOpB#>;s_W@qld@^hg|r^fPMFG zDrKqPKKPy%5R)NzDRD{+R9+QAi9;@on0>uu2MGp=)}mW-HX;J`rUYkl`WsMJPYIf{ z-|R9g%xe_z+(QSAXpy3R7yd)=2*H*Wo~%uYm0&({Y_>rC{-6^)T{zy>e5To(hZgj3 zF!=V{Zx=}<%dZ+;x_HO&vN9@!&wi;F>@VS>^D*JT!U*>XeEj5q6RoB`-0tgPtpeo7 z*#q^HUj*g2z!QjH4dS)icyc1K^L;agpXsuZbl#fPdTR3yDyN^pA48X}Ml=sMiJiG5 z1FxejRX{rp4fMv8b8c>H$?zdmr+n#0TC5e@c;s?2=0s>+@OsKJ0ulZIp3SoEkoqfZ z5tsB|I+(C26eO5(m(_WTVE3AF-_SRdB&UE-uxFVHi>_8+vyuPS2B2c ze|P;rqk@O5>vo7sSLXpqcE3RnHDEEtyZ84O6t^SVh4@XtSp`(rt;USG8+G1{X9P8{ zlUWl@d{)26Ior;@8Sv38U_Zctz39q#Xt*ulnJg3G+tm>b2|3{PA!GZG`{;kw5V_~o z+1hfSgYDn_$L{uaUHXpScV8@jul~Y*JM_ik_dC4bzuc+9yK;Y}RMP^Ew!TVOAxR;d z`}i|lc5#*+q$yQYhqK3^&sy&c2Lru%qr`KSWMTadT&$32&$j#aC^*-SPX-a~gYwbQ zaeC9OW1{}-ym@nH{ri%B{sD!aBzc)(Nkp&VI5oq0_V#V``~Cj@-X8qh@Aqr}4*L83 zy*q>ZyMw*{?t=&S_wMuu5AN^v@1Xu|c68pa5)$(}{daDw-nq}@SGT*gyVNP+*J~d` zgv(O&t_B-Q=@_C%Q0bh=4J(%nH?$Hm1YzQgWCRP+HSP+As5SyUrCBaeR}_kojiHWY zAOz_eLBh~&g_8Xn=Namv-%$~=x!Ohv?}`M~?3veQ@YIMdv)Kk~1$1@ou=sq`BIK0f zp%Bw2hUb!FNhY(QQ{0B=OrI3KfC3u`38GQfW#Gv3IOyN}9@cTTfR0;wzOPZW?8CGb zP=ZxSmr%n>gIBWjpg!H8EZ3)e!PtK5tJP$rc=~T^fP(f`>)~-kA*=PI(HBcC>Q{2g zIF+-*3=8qxO@+ZA%GG!Ces|j8R>^50$7u6UqLXkcX@axOcow%k7HJ_)Sw@rD5FKj& zx5tzV`6HFnCrrraCJwH4M0~Dop+j$abv|bYNy4f^Hc*YT>$uiwYgMAc<1sC$oCV}$ zQr?M{mbNQdMtGf)gT$q+?=NWGzrAF^bmp%@*AUI|Bpz}|>2gvsK_%mAkcN$Hi6;#x zr&X3&VrWz-UFMAzM@FwmL4-KvY!u-gW%zNMJ92~mf~B((D*Ca+HeBMI+du}~ywnO+ zg8C~Ng5*_kAYKT8Dsuhrr#s1xtw{;6|&bCy!p< zT2s#0QiM(E7}?L@y_jaV+cr9QeLQFe4vcjZJ!c+U21KiRbD-$VUPv7Trzb@=s}Vt< zSvKtTf+U>CX!i*aGIsf*#x^26d@+~UwxL*b|0Fg;u-h@*1wE)O5{o5gOpe8zA<~)c zLliJ6sB#8n55$=%(bi$kN<1;nt!jt6V276P#xle>hJDNuoL$g(6m1W{8(h+S9<>me z^xDd-K34O@nvkkD(N;!$7DcKiNlo-$ftH>xca z`~Fh6MoT>sSD5!QI_k9mfi)FQv=)&cQ4W2bo$y0YZZ;ND&w{o$ZZx~|=XOC8Z4=#? z%^R=_XDABWS}qhIL?y|i9ixLT$!yp-PmZ{#?!v{k8q?L;U91|K5w`?-opcpN+Ba^D^_jM+4td zW5}mx)4L68-rA1$0quAn-h#Kb-K}oB`y{M(e;9k++ETZ+)U7RbYfD|Il&)=bYa89i zw$c4TjA?5#noD>WGujOdXltj$clfp2|NQN{+b{qww*U1X?CwAC_P_nXo&I2dZ-211 z|9yzx(tDRn41liuioSnvFY+DifF8e3-4N(8eP>G`ClD%L4AJ17tbHD(_vp`OXL#AD zd@@$Q)kbBB*)QtX=WF+SA7;BR!qQ7=B%)%YkSt(p7kl)v%WO5kz0G8 ztKDdA_PI5)PZ)5e6~vqZU%0tv@jc7;iSd_Z?^%)6tPMWz>DOxiu?j^33dK8{fR@;Q z`g{9>JA?bX{d;>4?(Gf+clv_|gZ=%r{pUmcYFlKiO3pC>iDXLBDx<}ud-<*CQs(VJ zr(yj$CZXHaTHncX0~}`oRxS+2r{S#m9)7Ls->CW6sQK^80G6-+d-e6d`(VBPKgh4P z{%Z!FISjxp_w%TDwBFy*qS~+mZca&-cg3`KP3UAQH-~7m^Id;L|Ke{b+Wt^eJ%PN_$ zEEO!PbojZ1<-L?8qL*$!I9UrUlm#uEMx2QmGyV>GNNs99+ z9m|y)WF;wtsxhZMm*3W0(7`QSq`vuW)&5Z!Xm%bNQ8d~*4pHXK5rD6StwZlxoAx<3 zY!}X`&ml4`+WP;`aEkf%+&O?^jgg1c-Zs$IvED#7Hh#Lv?)1yn((NfD6P&f|Pum}R z6@I*5!2c7Tie4P8`&O?1F6ICI{oNY>-|w&e|2_eV0d@Y&FLv#t}{oy^gY?#mXBIky?7r;zOBpYJ;awhA7U22cv|y`q=ZUt3lwPRC6j3l5y}A z3e(^{E`O?}Slhwr(|_GNuVvVyV;xvI@?c>l;gZIlDzRJE5)eqgE@6%bPd&i+^j`hO zj3=ZW?1-_9;9^5{im3#1A=BEebghgE`GcOPaPW_9xcM@xIL_)*qaDp?F{v`lYnhOD z*#!BqDR%w4&0n4WYY|9?dA}w0zl{Iy4)z{2`2S!n|9_C*d*S~f5&f~*|2#12SMjWw zXrT$IgzlDX{qn;QRh%|*?R&8E!TQalmdh?l@fO&mL?oP+`c~!UX@+T`VQscI@tCvx zyy0;YH`Y3k&Bo6B`*{rEP(9HNG%;8_9jMhA<_2Sdz}e^Kby-198eX7^_U+>cL-f<8 z9@Jk}Ddoo)${VS{9cHET1P84<>!&{&aznJFYhpu~7f1~uypPT1*1z>{{agRmzuNEr Q1pom5|5>_A;Q*Kc0344l#{d8T literal 0 HcmV?d00001 diff --git a/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml new file mode 100644 index 00000000..3fcf75cb --- /dev/null +++ b/packs/outcold-26.04.4/charts/collectord-splunk-kubernetes/values.yaml @@ -0,0 +1,690 @@ +collectord: + image: + repository: docker.io/outcoldsolutions/collectorforkubernetes + + clusterRole: + name: "" + create: true + rules: + - apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: ['privileged'] + + # Liveness/readiness probes for the /healthz and /readyz endpoints (26.04.4+). + # DaemonSets run on the host network, so the kubelet probes them on the loopback + # bind via httpGet.host 127.0.0.1; the addon runs off the host network and is + # probed on the pod IP. Requires the http server enabled in configuration.general + # below (httpServerBinding + httpServerEndpoints.health/ready). + daemonset: + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + host: 127.0.0.1 + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + daemonsetMaster: + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + host: 127.0.0.1 + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + deployment: + livenessProbe: + httpGet: + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + + configuration: + general: + # IMPORTANT: Please review license https://www.outcoldsolutions.com/legal/license-agreement/ + # and accept license by changing the value to *true* + acceptLicense: false + license: "" + dataPath: "./data/" + logLevel: info + httpServerBinding: "127.0.0.1:11888" + "httpServerEndpoints.health": true + "httpServerEndpoints.ready": true + "httpServerEndpoints.metrics": false + "httpServerEndpoints.pprof": false + httpServerLog: false + telemetryEndpoint: "https://license.outcold.solutions/telemetry/" + licenseEndpoint: "https://license.outcold.solutions/license/" + licenseServerProxyUrl: "" + licenseServerProxyBasicAuth: "" + hostname: "" + defaultOutput: "splunk" + fileInputBufferSize: "256b" + fileInputLineMaxSize: "1mb" + fields: + kubernetes_cluster: "-" + ec2Metadata: {} + annotationsSubdomain: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + autoSkipGzipFiles: true + "multioutput.async": true + "multioutput.asyncBufferSize": 100 + kubernetes: + serviceURL: "" + nodeName: "" + tokenPath: /var/run/secrets/kubernetes.io/serviceaccount/token + certPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + timeout: 30m + metadataTTL: 30s + volumesRootDir: /rootfs/var/lib/kubelet/ + includeAnnotations: [] + excludeLabels: [] + watch: + - 'v1/namespace' + - 'apps/v1/deployment' + - 'collectord.io/v1/configuration' + watchImplementation: 2 + crio: + url: unix:///rootfs/var/run/crio/crio.sock + timeout: 1m + containerd: + runtimePath: /rootfs/var/run/containerd + namespace: k8s.io + licenseClient: + url: "" + basicAuth: "" + insecure: false + capath: "" + caname: "" + proxyUrl: "" + proxyBasicAuth: "" + pipeJoin: + disabled: false + maxInterval: 100ms + maxWait: 1s + maxSize: 1MB + patternRegex: '^[^\s]' + pipeReplace: [] + pipeHash: [] + + outputs: + splunk: + default: + url: "" + urls: [] + urlSelection: random-with-round-robin + token: "" + insecure: false + minTLSVersion: "" + maxTLSVersion: "" + caPath: "" + caName: "" + clientCertPath: "" + clientKeyPath: "" + frequency: 5s + batchSize: 768K + events: 50 + proxyUrl: "" + proxyBasicAuth: "" + ackUrl: "" + ackUrls: [] + ackEnabled: false + ackTimeout: 3m + timeout: 30s + dedicatedClientPerIndex: true + incorrectIndexBehavior: RedirectToDefault + compressionLevel: default + threads: 2 + threadsAlgorithm: + excludeFields: [] + requireExplicitIndex: false + maximumMessageLength: "" + includeEventID: false + queueSize: 1024 + timestampPrecision: + + # Input configurations + inputs: + # Collectord internal metrics + collectordMetrics: + disabled: false + type: "kubernetes_prometheus" + interval: 1m + output: "" + index: "" + whitelist: + - "^file_input_open$" + - "^file_input_read_bytes$" + - "^kubernetes_handlers$" + - "^pipe$" + - "^pipelines_num$" + - "^splunk_post_bytes_sum.*$" + - "^splunk_post_events_count_sum.*$" + - "^splunk_post_failed_requests$" + - "^splunk_post_message_max_lag_seconds_bucket.*$" + - "^splunk_post_requests_seconds_sum.*$" + - "^splunk_post_retries_required_sum.*$" + blacklist: [] + + # Prometheus auto-discovery + prometheusAuto: + disabled: false + type: "kubernetes_prometheus" + index: "" + interval: 60s + includeHelp: true + timeout: 30s + output: "" + authorization: [] + + # System stats + systemStats: + disabled: + host: false + cgroup: false + pathCgroups: /rootfs/sys/fs/cgroup + pathProc: /rootfs/proc + statsInterval: 30s + type: + host: "kubernetes_stats_v2_host" + cgroup: "kubernetes_stats_v2_cgroup" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + + # Process stats + procStats: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_proc_stats_v2" + index: + host: "" + cgroup: "" + includeSystemThreads: false + output: + host: "" + cgroup: "" + hideArgs: false + + netStats: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_net_stats_v2" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + + netSocketTable: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_net_socket_table" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + group: true + disableLookup: false + + mountStats: + disabled: false + statsInterval: 30s + type: "kubernetes_mount_stats" + index: "" + output: "" + + diskStats: + disabled: false + statsInterval: 30s + type: "kubernetes_disk_stats" + index: "" + output: "" + + containerLogs: + disabled: false + type: "kubernetes_logs" + path: "/rootfs/var/lib/docker/containers/" + crioPath: "/rootfs/var/log/pods/" + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + index: "" + joinPartialEvents: true + stripTerminalEscapeSequences: false + stripTerminalEscapeSequencesRegex: '(\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)' + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + + applicationLogs: + disabled: false + root: /rootfs/ + syncInterval: 5s + glob: "*.log*" + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_logs" + index: "" + eventPatternRegex: '^[^\s]' + eventPatternMaxInterval: 100ms + eventPatternMaxWait: 1s + eventPatternMaxSize: 1MB + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + maxHoldAfterClose: 1800s + + hostLogs: + "audit-logs": + disabled: false + controlPlaneOnly: true + path: '/rootfs/var/log/kube-apiserver/' + glob: 'audit*.log' + match: "" + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '(?P.*"stageTimestamp":"(?P[^"]+)".*)' + extractionMessageField: 'message' + timestampField: 'timestamp' + timestampFormat: '2006-01-02T15:04:05.999999999Z07:00' + timestampLocation: "" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: "" + blacklist: [] + whitelist: [] + "syslog": + disabled: false + controlPlaneOnly: false + path: '/rootfs/var/log/' + glob: "" + match: '^(syslog|messages)(.\d+)?$' + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '^(?P[A-Za-z]+\s+\d+\s\d+:\d+:\d+)\s(?P[^\s]+)\s(?P[^:\[]+)(\[(?P\d+)\])?: (.+)$' + extractionMessageField: "" + timestampField: "timestamp" + timestampFormat: "Jan 2 15:04:05" + timestampSetMonth: false + timestampSetDay: false + timestampLocation: "Local" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + "logs": + disabled: false + controlPlaneOnly: false + path: '/rootfs/var/log/' + glob: "" + match: '^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$' + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '' + extractionMessageField: "" + timestampField: "" + timestampFormat: "" + timestampSetMonth: false + timestampSetDay: false + timestampLocation: "" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + + + journald: + disabled: false + path: + persistent: /rootfs/var/log/journal/ + volatile: /rootfs/run/log/journal/ + pollingInterval: 250ms + startFromRel: "" + type: "kubernetes_host_logs" + index: "" + samplingPercent: -1 + samplingKey: "" + reopenInterval: 1h + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + spawnExternalProcess: false + + diagnostics: + # Collectord can report if node reboot is required (uncomment to use it) + node-reboot-required: + path: /rootfs/var/run/reboot-required* + interval: "1h" + # See https://www.kernel.org/doc/Documentation/admin-guide/hw-vuln/index.rst + # And https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-system-cpu + cpu-vulnerabilities: + path: /rootfs/sys/devices/system/cpu/vulnerabilities/* + interval: 1h + + prometheus: + # Each entry below renders a [input.prometheus::] stanza in + # 002-daemonset.conf (controlPlaneOnly: false) or 003-daemonset-master.conf + # (controlPlaneOnly: true). + # + # The "WHERE" of the scrape is controlled by exactly one of three keys + # (since 26.04.2 - legacy endpoint-http://:/path syntax was + # removed and now fails fast at config load): + # endpointSlice: . - per-pod fan-out via discovery.k8s.io/v1.EndpointSlice + # service: . - hit the ClusterIP, kube-proxy load-balances + # endpoint(s): literal URL(s) - no Kubernetes discovery; the existing + # localhost-then-proxy fallback idiom. + # When endpointSlice or service is used, set port (number) or portName + # (matches EndpointSlice port name), plus scheme (http/https) and path. + # + # Example - scheduler reached through a headless discovery Service: + # "scheduler-via-discovery": + # controlPlaneOnly: true + # disabled: false + # type: "kubernetes_prometheus" + # source: "scheduler" + # interval: "60s" + # timeout: "60s" + # endpointSlice: kube-scheduler-collectorforkubernetes-discovery.kube-system + # port: 10251 + # scheme: http + # path: /metrics + # tokenPath: "" + # certPath: "" + # clientCertPath: "" + # insecure: false + # includeHelp: true + "kubelet": + controlPlaneOnly: false + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "kubelet" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - 'https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/${KUBERNETES_NODENAME}/proxy/metrics' + - 'http://127.0.0.1:10255/metrics' + - 'https://127.0.0.1:10250/metrics' + - 'http://127.0.0.1:10250/metrics' + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^kubelet_runtime_operations_duration_seconds_sum$' + - '^kubelet_docker_operations_duration_seconds_sum$' + - '^kubelet_network_plugin_operations_duration_seconds_sum$' + - '^kubelet_cgroup_manager_duration_seconds_sum$' + - '^storage_operation_duration_seconds_sum$' + - '^kubelet_docker_operations_errors_total$' + - '^kubelet_runtime_operations_errors_total$' + - '^rest_client_requests_total$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^rest_client_request_duration_seconds_sum$' + - '^kubelet_volume_stats_.+$' + - '^rest_client_requests_total$' + backlist: [] + "kubernetes-api": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "kubernetes-api" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://127.0.0.1:6443/metrics" + - "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^authenticated_user_requests$' + - '^apiserver_request_total$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^rest_client_request_duration_seconds_sum$' + - '^rest_client_requests_total$' + backlist: [] + "scheduler": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "scheduler" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:10259/metrics" + - "http://127.0.0.1:10251/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^scheduler_e2e_scheduling_duration_seconds_sum$' + - '^scheduler_binding_duration_seconds_sum$' + - '^scheduler_scheduling_algorithm_duration_seconds_sum$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + backlist: [] + "controller-manager": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "controller-manager" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:10257/metrics" + - "http://127.0.0.1:10252/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^node_collector_zone_size$' + - '^node_collector_zone_health$' + - '^node_collector_unhealthy_nodes_in_zone$' + backlist: [] + "etcd": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "etcd" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:2379/metrics" + - "http://:2379/metrics" + - "http://:2381/metrics" + tokenPath: "" + certPath: "/rootfs/etc/kubernetes/pki/etcd/ca.crt" + clientCertPath: "/rootfs/etc/kubernetes/pki/apiserver-etcd-client.crt" + clientKeyPath: "/rootfs/etc/kubernetes/pki/apiserver-etcd-client.key" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^etcd_server_leader_changes_seen_total$' + - '^etcd_server_has_leader$' + - '^etcd_server_proposals_committed_total$' + - '^etcd_server_proposals_applied_total$' + - '^etcd_server_proposals_committed_total$' + - '^etcd_server_proposals_pending$' + - '^etcd_server_proposals_failed_total$' + - '^etcd_disk_wal_fsync_duration_seconds_sum$' + - '^etcd_disk_wal_fsync_duration_seconds_count$' + - '^etcd_disk_backend_commit_duration_seconds_sum$' + - '^etcd_disk_backend_commit_duration_seconds_count$' + - '^etcd_network_client_grpc_.*$' + - '^grpc_server_handled_total$' + - '^etcd_network_peer_round_trip_time_seconds_bucket$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^process_open_fds$' + - '^process_max_fds$' + - '^etcd_disk_backend_commit_duration_seconds_bucket$' + - '^etcd_disk_wal_fsync_duration_seconds_bucket$' + backlist: [] + kubernetesEvents: + disabled: false + type: "kubernetes_events" + index: "" + output: "" + excludeManagedFields: true + kubernetesWatch: + "pods": + disabled: false + refresh: 10m + apiVersion: v1 + kind: Pod + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true + "resourcequota": + disabled: false + refresh: 10m + apiVersion: v1 + kind: ResourceQuota + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true + "nodes": + disabled: false + refresh: 10m + apiVersion: v1 + kind: Node + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true \ No newline at end of file diff --git a/packs/outcold-26.04.4/logo.png b/packs/outcold-26.04.4/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..de0588e3eefc9cbc6bd339de5d3745b8251c6e47 GIT binary patch literal 8716 zcmV+nBJ004R>004l5008;`004mK004C`008P>0026e000+ooVrmw00002 zVoOIv0RM-N%)bBt00(qQO+^Rd0}uoR4|6+BF8}}`6iGxuRCr$Poq4!kMV0PVw5_T&5HN%DNV_TKf@TD8`yRl_#oe+F!$ z0{_3@Z$$pu@HZlVZTKHUBxzKjWe8FH0~ib#Q&}h?q3pWJx!yX=!1)nH8C$DLikPgv ziY7-50yS@K4g*9)iZ-iW>|C+(wJlpVZrt7#O#5C8#8I#*geJ>AejD0W&ntEH}R$y*St9I<@HNn@v*#s9n>*t=eO-KxdZSC58wOX z!WTkmfsuPnIby%*qado!a_Kjb7!zRmArpzh+$nWj!Xtu2YYG=fQ;yAG=uq z#uyAp$_lvY2cL4xXb6rzp?^f89Bi03`;U)r0I*g!o-VYvb2z`=De~2hL!knMpzW~5mMU=@RYil6;HzQ|^jS)zKGE1ch7+VyI zu>`P(UvS2dzDY%WMex!~R~-bH#2Uc5q>fi|&H}bZ5#yWztrLv;m4G0chKQ*J-t0&4 z;`x^VW1}!uk^R1OM(g_3S0ce}`S)4tNn!+RqJSMbChWKOxLtQCR8>K1o?rIB{DrT8 zCE~(6ZW>i6y}sp{`S(2eY>|sKfp=fIcgyIR+Br*nf*c@M-FOZ-F(lKeZd+0B0F=snnW!^^J(vuOKmC9kBaH zZe5oBoQB?dmm&tAMoCLA?|_8ikC)dn2JaK#TB=UJOB_H>h=Oy`O z+b*WkeG?e@Xs+HwAEo>Mu16>rbSlj$mXAIWkv{~BVfe>ikfLv)-4wd?^za>CuF=-f zN9m^>V8L3BS*5PrayjS=k*ICEU<^a%NNH|2%Uay{t zvEXpOYLZFIM1rK>ojx1`xWw_kM%AiDYD92XmBdm1tAMJnAsCG%F+z%J+CzOYNu)<*aB z6{((@KmrNxYN8)DO(dpTdv<2uoq@xzTPI1OS)bk)qMP?JH9K7z>U)HaBut%@Ofh z{{e7d3}dhCe1m96N_8;~5-w>ZlBS5Hnzv_nNP61KtqytmgQ)bdEQpxfKqSo&@w#UW z1t4L>4R4$@BuQRRCKw#=Y+$(>6N#yAE|7pV9P+ecA404CAk}3g7~3dNYGGep2`Cjfi+%Q4FYex?kZ9 zR;vtA@4(?WrmoLwKqS?FU<@Sev!tM*HC#OsNXS%mP8*WQe7-ixhMFj!{Q zsYRVQKe)B;-Izp@aMUk`wwj3@P{hIifWz{eda3G~6r=QR3g9?!-J2^9c|B6V7)H#i zU6I-niG1m|Ns0@*{c5y-GvxtR2Oox0vgz?UWoljU?zfi_u%Z3-N$J4P#%?HXb7lS^WjhDalCif3XQq*gcF<>69 z8O+y^NVLDa(F78I{H1>l%T)|R55RyH)s#qnE#sUPowgGVgUk5$66#3 z_}UT|fp6_L00ygt)LAV=4n!ChP^(#UiG<|2ZzGa;`dP8R1}lc3vh^B$f?-4wjMyqy zqgir^7{0kBiPn$2qMxl91J*g)f1w(7+yMidH`XeVM#nz zXv6$)AV&H@>-HsCc1Xz?Vh!T!0AsvV@CjLxQmxFV!MAoc&@itxvo%HqVM%Ca>vZ z;2=rw!eaSanWw8%tuCFN*`0)|6&k!NsPjaU-zj8?;!>Z~wn%ztPssHX2JY;mJS2JD zKtjR^Wxc)H{63rjI6l|VqD1KfB>YlAsV*<&VHmtbHx4SJRszQd`XLXm`J*tFiHk~^ zR1^8L1sumVUac5(5e3Jm)fF^5IjyXDv}795t{UTI_a&=U zH&4Vm&MgVpN{OWUEDp!V8;x>AN~uRs>qelfp~cs(%;<2Yb*1J#P!G^ro9 zw+sfZkQ9BIX4~c#y`RrDYRI=?!C;>$sc4C&iDEpGyP4z_&gf zyS!YIB+d~1v|B$|u^qk=kyEi4xN3Urt!PPSusnr998hPOgmE%N`yjT#+nR(8M}H#P zHt^Yy*jk@lzqr03iS}(oW5eMWm#Rg{ErvA+v13iOky&xKi84GeP&O;@*zU)CTc197oRI@@m|e~ItvHfT~kH99vgnAI<@8C0qg4-3j2Nh&ry;> z>SLp|tl1hzWBGlp5n?69;gW!w5(9;WB7CLsU`j3qqy;OOyVNA9)%p8K}B`a>+k zAvZ?EyqP71dWp!yO#nmNtM2TEVG)J&(%Jj;9_C;%l8RO8`KwhZ80XCT^>8P4k3-&l za81> ztpiBh@*8eA_49|-I%L2wF-d`qv4%t%zMgamf`|)&WWW92K6UiYV;bI+hm5MDZRpsN zUpFjUx8$LDk92w3yKcYp!mkeXHDbPrV^~GSV*3%kwpndU=71o)gTh3GjWEqw-l#0UpGYW zr7NM0_NVf->s?rIr5ngfZIm4gqH`_zhF4{gp} z`Pk^E0~a75D*);2R=| z|9o0#kF)YzbS8_ke$o41F$#lWGx_+{ra`>#us1@lG8p)JdnZ3%l(T8X1KHtE-6$h6 z6@YcQs^#Ksbn?;0-hbd==vL%0687%3c(o^_07CuTM6A2WyyvR%Bc@SUxs1xEg>?wV4y&bF<95Wr zh7IIl1CgD3D5}0obak^Vq5dLs>$-0?9EM?eg|3SYtHCg)^eLs2<6(HmlO~$wFHOyB z?bq-_dlD=%ci*z1W_MBh(H|UDd!JlzD{gqQcJ3@rI_Dr|R}H%pSy)NLtk{kW!^$d9 z62NrnW4IdgRbC%}vGa>pysn}?_N={;-s`Rj4eq|acyrL*SkA8q{(@#3u$)}_W2slL zOhUjbxi;27EQ&n1$1b5zN6(FY{yh)8CI2v!=pH#S*1H*(UU1ZuqD|Toq>@)!bD^}+D_7T`#`_b6H8-AACs)o7P2Hr?)>@Kqf%eac_7#3noWMXZJ44Huu zTOX(Q`Czv4ID(@{t+&p?(R(+8P6!*YbWWgV;Z-qj&;JyjSt+idT?f*IjE85r+~n{5enf zyN(u5Z9#zJxcwSM!G__(F(`&C%iaw!rJ-WRwo|ZxEK3OOqsng(OBN%;go!nYz|=9( zip49dh!{p5gI)b+1Q+bAtnoe13mn);Eeo8xM>K%!ikFDfrd1MI z6`Ty?%eF|CJ<~F6cZ|%U`PE7hID!IqWlERCnde38Ol??k7M8>=d-zX(e$FSR+Xq=r z-8pTmcV{8pyA;*+l`C(a^`WUi^2u%8jT7{^faY3fd|zl?!l3o3{Ny^93LFUq@46_G~< zV+=#HVOn8;jJ51gL9lvB`B5a@ zb}K5L@co|hUQdspz{!o)C6poPUn#CKa~!X7b*PJ=X9t0OsN!|0ZpV>Sog`G*M^ash z#n7=;lGnfSc<+OPPQp2^Yhg9G*Kc}00bwk^XkH{S=oAXPz3O-UFC3OHR7k3lNYtt< z-*~;!s8yrP6Dm>KpJ6P+o^QCot{YLCCinVW%f8JEvr9j~7WnrH>QP&=(;ptFkW`h` ziaMVJ$AMky)TI>4L>u0UaU8m(S?%(=xHK!^xU$(cNcHRx9HT2It%B|X4AUw%5?2xN znga&Mwep>ZVDBucboV}iGt?XtueoLOqL$H%o4xb318|O+mBhPrE)K^dNI}JQ*c;@K36UHzbm@+%7^3-@me?> zi(&lUBph5e$?Ns}a4aMoG_QerrFx~KQXt^iYg2uhgrJ3okU&x$_eL#fgX%z1xkQxe zTO?q>7{<&mt8c37aDZd*EY&<*HhM2D-iw@3WWwQV>l`%iy>#s;927XF>S~uhfx~iS z^^JK%6m=>ISPKa^mN!e#IV6CC8TTt^nmPubN{T<9n8yPWrp%G#bN0SOAEYNw0SAs9 z7gvfrX!#^83D;LELoSh^wR@9&w8C*tdAADMek2KC9OjJsf~4rv)cfp<4_TqkC$2uM zd_8Xo9LYI<%#JUJA-mIiU;LuM6aO?AYrs;dJ{s5SN(xvyUahu$xkTjkVh1D^4CA+{ z3_&a3lC`x14!>%C#WOcPc*8#)IuvTJxU#^0=id0pYpTGqAD%oUd#r_%qedrsM*&{jxdSJ(EXPdxkh`r;)Q_`yF^rSsFmtWVhpgBNsE4g0DGRz-Me z?#;(wahzA#G^v(MFY15q7Tl7Jli7D_>Y}tr+t882+D-9i1CY>mbG1Bz)_34YI6u#+ z)*_-1rQc(XW!lQh8&j=3vbW~eCE5FpOA_0{rWj*gl5`ihN%y`O>)82^Ii}s~s}wM_ zKapqmYZ6iH(yMR5;rMA)>!jNH59O0Y#RN#}D9N5=NZ_=kIsGH(rI8q1g^TV+Z6Z=v zG4y{=^>8RiH|~(PE4rUB4tBgc*VTG`7zYe`HaA?WM8Pz!(xfnIBNpBO=9vu{b`K7gTuZcPBvK6eV|n{`UoNK+_3YWj6ArrcV~oLZRIT(yebq{JAr8a1b@}&4A9Pz% zD;8-1)^LGTv4K8l4w)TJ_2@7xmbS<9o3s&;sD$glCd{yeIXslG9 ztE%XAHe98&OREl|00}$S*|FMyh`i3n zf$5n~kQ6HthFy;G}F&d_cq6*Ybu&1rrL4| z`A3J;MFK}XotGsG>N=P<4&8kF(cr+sf7CKqlA0hAv~{0Mxo*!IBx)fSR&_cr%{dxc zIwaFNnDAYnSHB>gPQlP|1Xu$J%&Py*mWD)>>TV2JMlDj8q@erQtzy(DDR_k+PRRm| zreG3iyLee{fEc6;vewI@xdg6j@a>t#MCA2}EIQchRi#qUT*rUssH>MYUpbYgxEN<) z$TJP7M z0_^mud8&3ElH{fHuvs=L8!F6PUB_N!Xo85m=8eFDBahg-A?eE2!-t5JU-!{kvO3e{bs-KhP7k9l!>eP9-S{ovQm-LtG zP8|b)OKf($nK8!N?(fwW4*l}nP#IYDAk_;8;0y-#8Ht^G-aWCI&ulbBL|)&;T5#~` zRnjfAvEy^Kthx`9mjCjTN9|fA5Ey;X-+zBzkZOG(Cj`yji3E)0TrK?F+-+(?9BTR# zX~BK%U$GGz*?Hz!BaU8DNT>d3e697DQ4V0q(iQVwT(@cc`fc77MvNUXa?(E2#!VXn zwLg~a6TWjvns^L4|N8(aHkZ$6#56+;nw1Sa9M~f#ViKmWsM7;u&#{c5YtyP_E7oo6 z7D1g4j0UeY?}MV~r4Va;6*dP=5>fQJby)8gXblvYQvXAkG5Ct3F{7{hsaG%EwMX}7 zroNu%@9UshB9hl*2NZpTEvC`N&2FX}DqC{ds8k5r{HZKpOKAI1tKVL0o`_O)T{apL zXNrm4g!b#2nYn5PF_rGx0~{E~TUz`&uv#J_FTH%>r0&jT!NNJ4`*yZpIii;qpOuNj z!KrInZ=P0&D0*q>^&i|LVcf|U2iCIRef<}Tm$qF#raP=^zp5`!Y>7xlMV(JSxKh6w z(rv^pSy#(P*Yp;ph+c{}P4BUZ`#jWQH_y-_ksf~>G=F-xfthmcww#$OW%L>`NhST_ zNQz$;htF+qILn%gmWfDG3{k1pp3EOevFyBxc8a5Oni{S&yUH5WX8c^ z_c!OqtI;PSlB87nW_#vYEKL9MQ&Eya_Eq*MNn7tc_H8R`6N%nSo349%am?Xh)D@k5 zHXVH@q98qZ06k8!aO7ow_)AY~u6yj}3wGn!4YkxgJJ(^s|JkiLKz0_+S=3i?sOeZM z7Ya%Gjc>e$3*Z!iNs~wJG`>A-ux(laJpvufs3u4EsNbJoPzyHx>a zG8Q&Q*yY62j~dkU2(SSLhzKA>XSm^9r-(5aBdPdsV=NL97-NV6c0cTt<41$<--JXj z295}se>nfTOn0Dk(U|~)F(wEYwC~Z!9XPJ};dnC`P$D41cfP&?$l5;RBIpqgJ9SJy z=HTgoHv`9l0Vjem%YS|MvoBO{&@+X}yX}1Fo|C3JAjZ}+_w_N*M8GGIzPNP5%9UHU zccu~J3hjf2PTFzQ&Xcnfaze|8xHf}=f@}MX?a4QVT@H!9yx@}aq)grTF_3!B) zUMC`NJO;SSy?OW>k-s+ljmTdc{>Kpce?1~n_-mu?t^fc4C3HntbYx+4WjbSWWnpw> z05UK!I4v+UEipD!Ff=+aG&(UgD=;uRFfikrxD)^Y03~!qSaf7zbY(hiZ)9m^c>ppn qF*q$SGc7STR4_C;Ff=+bH7hVMIxsMj#sH`Q0000' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true +``` + +Where you will agree to the license agreement, include your license key, and configure Splunk default output. + +You can generate a YAML file for deployment using the following command: + +```bash +helm template collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + --include-crds \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes > collectorforkubernetes.yaml +``` + +To install the chart, run the following command: + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +## Configuration + +Collectord is configured using the `ini` file format. You can find a reference with all possible configurations [here](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/reference/). +This helm chart allows you to customize and override those configurations. +Using `my_values.yaml` as a template, you can customize the configuration to suit your needs. Please refer to the [./values.yaml](./values.yaml) for default configuration and possible values. + +### Using secrets + +If you want to store some configurations in a secret, first you need to create a secret with the `ini` format, that Collectord can read from. For example, if we want to store license, and token in secret file, +first we will create a secret file with the `ini` format and `.conf` extension with name `101-general.conf`. + +```ini +[general] +license = + +[output.splunk] +token = B5A79AAD-D822-46CC-80D1-819F80D7BFB0 +``` + +Using this file we can create a secret using the `ini` file: + +```bash +kubectl create namespace collectorforkubernetes +kubectl create secret generic collectord-secret \ + --from-file=101-general.conf=101-general.conf \ + -n collectorforkubernetes +``` + +After that we can remove values that we provided in the secret file in the `my_values.yaml` file. + +```yaml +collectord: + secrets: + - name: collectord-secret + + configuration: + general: + acceptLicense: true + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + insecure: true +``` + +And install it using the following command (don't need to create namespace as we already created it): + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + -f my_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +> NOTE: Collectord reads all files with `.conf` extension from the `/config` directory and subdirectories. It will sort them by name in ascending order before reading them. +> In a case of file names `001-general.conf` and `101-general.conf`, all values in `101-general.conf` will override values in `001-general.conf`. + +### Secondary Splunk Output + +Collectord supports multiple Splunk outputs. You can configure an additional Splunk output by adding a new section to the `my_values.yaml` file. For example: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true + apps: + url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' + token: '107E857B-C311-4C72-97E4-FBE601A6B39E' + insecure: true +``` + +After that you can reference this output in annotations like `collectord.io/output=splunk::apps` + +### Secondary Collectord deployment + +Collectord has ability to forward logs to multiple Splunk outputs simultaneously. In the example above, you can use annotations like `collectord.io/output=splunk,splunk::apps` +to forward logs to both outputs. But there are limitations about if you want to apply some transofrmation logic using the annotations, as this logic will be applied to both outputs at the same time. + +Say we will have two Collectord deployments, one forwarding data to Splunk Enterprise and another to Splunk Cloud. First we will deploy configuration for Splunk Enterprise `splunkenterprise_values.yaml`. +For example: + +```yaml +collectord: + configuration: + general: + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec.example.com:8088/services/collector/event/1.0' + token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' + insecure: true +``` + +And we will deploy it with + +```bash +helm install collectorforkubernetes \ + --namespace collectorforkubernetes \ + --create-namespace \ + -f splunkenterprise_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +Secondary we will create a configuration file for Splunk Cloud `splunkcloud_values.yaml`, where we will call this deployment +`collectorforkubernetes-cloud`, and reference already created objects like service account, priority class, and cluster role, +created with previous deployment. +For example: + +```yaml +collectord: + serviceAccount: + create: false + name: collectorforkubernetes + + priorityClass: + create: false + name: collectorforkubernetes-critical + + clusterRole: + create: false + name: collectorforkubernetes + + configuration: + general: + annotationsSubdomain: 'splunkcloud' + acceptLicense: true + license: '' + fields: + kubernetes_cluster: 'dev' + outputs: + splunk: + default: + url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' + token: '107E857B-C311-4C72-97E4-FBE601A6B39E' + insecure: true +``` + +To deploy it, you will run command, where we reference the same namespace (and ClusterRole, ClusterRoleBinding, ServiceAccount), but create separate DaemonSet, StatefulSets and Deployments specifically for the Splunk Cloud deployment. + +```bash +helm install collectorforkubernetes-cloud \ + --namespace collectorforkubernetes \ + -f splunkcloud_values.yaml \ + oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes +``` + +## Support + +Please refer to [How to submit a support request?](https://www.outcoldsolutions.com/docs/faq/#how-to-submit-a-support-request) + +## License + +[OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT](https://www.outcoldsolutions.com/legal/license-agreement/) \ No newline at end of file diff --git a/packs/outcold-26.04.4/values.yaml b/packs/outcold-26.04.4/values.yaml new file mode 100644 index 00000000..9ec2c3a1 --- /dev/null +++ b/packs/outcold-26.04.4/values.yaml @@ -0,0 +1,698 @@ +pack: + content: + images: + - image: docker.io/outcoldsolutions/collectorforkubernetes:26.04.4 + namespace: collectorforkubernetes + namespaceLabels: + "collectorforkubernetes": "pod-security.kubernetes.io/enforce=privileged" + +charts: + collectord-splunk-kubernetes: + collectord: + image: + repository: docker.io/outcoldsolutions/collectorforkubernetes + tag: 26.04.4 + + clusterRole: + name: "" + create: true + rules: + - apiGroups: ['extensions'] + resources: ['podsecuritypolicies'] + verbs: ['use'] + resourceNames: ['privileged'] + + # Liveness/readiness probes for the /healthz and /readyz endpoints (26.04.4+). + # DaemonSets run on the host network, so the kubelet probes them on the loopback + # bind via httpGet.host 127.0.0.1; the addon runs off the host network and is + # probed on the pod IP. Requires the http server enabled in configuration.general + # below (httpServerBinding + httpServerEndpoints.health/ready). + daemonset: + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + host: 127.0.0.1 + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + daemonsetMaster: + livenessProbe: + httpGet: + host: 127.0.0.1 + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + host: 127.0.0.1 + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + deployment: + livenessProbe: + httpGet: + path: /healthz + port: 11888 + initialDelaySeconds: 120 + periodSeconds: 60 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /readyz + port: 11888 + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + + configuration: + general: + # IMPORTANT: Please review license https://www.outcoldsolutions.com/legal/license-agreement/ + # and accept license by changing the value to *true* + acceptLicense: false + license: "" + dataPath: "./data/" + logLevel: info + httpServerBinding: "127.0.0.1:11888" + "httpServerEndpoints.health": true + "httpServerEndpoints.ready": true + "httpServerEndpoints.metrics": false + "httpServerEndpoints.pprof": false + httpServerLog: false + telemetryEndpoint: "https://license.outcold.solutions/telemetry/" + licenseEndpoint: "https://license.outcold.solutions/license/" + licenseServerProxyUrl: "" + licenseServerProxyBasicAuth: "" + hostname: "" + defaultOutput: "splunk" + fileInputBufferSize: "256b" + fileInputLineMaxSize: "1mb" + fields: + kubernetes_cluster: "-" + ec2Metadata: {} + annotationsSubdomain: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + autoSkipGzipFiles: true + "multioutput.async": true + "multioutput.asyncBufferSize": 100 + kubernetes: + serviceURL: "" + nodeName: "" + tokenPath: /var/run/secrets/kubernetes.io/serviceaccount/token + certPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + timeout: 30m + metadataTTL: 30s + volumesRootDir: /rootfs/var/lib/kubelet/ + includeAnnotations: [] + excludeLabels: [] + watch: + - 'v1/namespace' + - 'apps/v1/deployment' + - 'collectord.io/v1/configuration' + watchImplementation: 2 + crio: + url: unix:///rootfs/var/run/crio/crio.sock + timeout: 1m + containerd: + runtimePath: /rootfs/var/run/containerd + namespace: k8s.io + licenseClient: + url: "" + basicAuth: "" + insecure: false + capath: "" + caname: "" + proxyUrl: "" + proxyBasicAuth: "" + pipeJoin: + disabled: false + maxInterval: 100ms + maxWait: 1s + maxSize: 1MB + patternRegex: '^[^\s]' + pipeReplace: [] + pipeHash: [] + + outputs: + splunk: + default: + url: "" + urls: [] + urlSelection: random-with-round-robin + token: "" + insecure: false + minTLSVersion: "" + maxTLSVersion: "" + caPath: "" + caName: "" + clientCertPath: "" + clientKeyPath: "" + frequency: 5s + batchSize: 768K + events: 50 + proxyUrl: "" + proxyBasicAuth: "" + ackUrl: "" + ackUrls: [] + ackEnabled: false + ackTimeout: 3m + timeout: 30s + dedicatedClientPerIndex: true + incorrectIndexBehavior: RedirectToDefault + compressionLevel: default + threads: 2 + threadsAlgorithm: + excludeFields: [] + requireExplicitIndex: false + maximumMessageLength: "" + includeEventID: false + queueSize: 1024 + timestampPrecision: + + # Input configurations + inputs: + # Collectord internal metrics + collectordMetrics: + disabled: false + type: "kubernetes_prometheus" + interval: 1m + output: "" + index: "" + whitelist: + - "^file_input_open$" + - "^file_input_read_bytes$" + - "^kubernetes_handlers$" + - "^pipe$" + - "^pipelines_num$" + - "^splunk_post_bytes_sum.*$" + - "^splunk_post_events_count_sum.*$" + - "^splunk_post_failed_requests$" + - "^splunk_post_message_max_lag_seconds_bucket.*$" + - "^splunk_post_requests_seconds_sum.*$" + - "^splunk_post_retries_required_sum.*$" + blacklist: [] + + # Prometheus auto-discovery + prometheusAuto: + disabled: false + type: "kubernetes_prometheus" + index: "" + interval: 60s + includeHelp: true + timeout: 30s + output: "" + authorization: [] + + # System stats + systemStats: + disabled: + host: false + cgroup: false + pathCgroups: /rootfs/sys/fs/cgroup + pathProc: /rootfs/proc + statsInterval: 30s + type: + host: "kubernetes_stats_v2_host" + cgroup: "kubernetes_stats_v2_cgroup" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + + # Process stats + procStats: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_proc_stats_v2" + index: + host: "" + cgroup: "" + includeSystemThreads: false + output: + host: "" + cgroup: "" + hideArgs: false + + netStats: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_net_stats_v2" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + + netSocketTable: + disabled: false + pathProc: /rootfs/proc + statsInterval: 30s + type: "kubernetes_net_socket_table" + index: + host: "" + cgroup: "" + output: + host: "" + cgroup: "" + group: true + disableLookup: false + + mountStats: + disabled: false + statsInterval: 30s + type: "kubernetes_mount_stats" + index: "" + output: "" + + diskStats: + disabled: false + statsInterval: 30s + type: "kubernetes_disk_stats" + index: "" + output: "" + + containerLogs: + disabled: false + type: "kubernetes_logs" + path: "/rootfs/var/lib/docker/containers/" + crioPath: "/rootfs/var/log/pods/" + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + index: "" + joinPartialEvents: true + stripTerminalEscapeSequences: false + stripTerminalEscapeSequencesRegex: '(\x1b\[\d{1,3}(;\d{1,3})*m)|(\x07)|(\x1b]\d+(\s\d)?;[^\x07]+\x07)|(.*\x1b\[K)' + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + + applicationLogs: + disabled: false + root: /rootfs/ + syncInterval: 5s + glob: "*.log*" + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_logs" + index: "" + eventPatternRegex: '^[^\s]' + eventPatternMaxInterval: 100ms + eventPatternMaxWait: 1s + eventPatternMaxSize: 1MB + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + maxHoldAfterClose: 1800s + + hostLogs: + "audit-logs": + disabled: false + controlPlaneOnly: true + path: '/rootfs/var/log/kube-apiserver/' + glob: 'audit*.log' + match: "" + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '(?P.*"stageTimestamp":"(?P[^"]+)".*)' + extractionMessageField: 'message' + timestampField: 'timestamp' + timestampFormat: '2006-01-02T15:04:05.999999999Z07:00' + timestampLocation: "" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: "" + blacklist: [] + whitelist: [] + "syslog": + disabled: false + controlPlaneOnly: false + path: '/rootfs/var/log/' + glob: "" + match: '^(syslog|messages)(.\d+)?$' + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '^(?P[A-Za-z]+\s+\d+\s\d+:\d+:\d+)\s(?P[^\s]+)\s(?P[^:\[]+)(\[(?P\d+)\])?: (.+)$' + extractionMessageField: "" + timestampField: "timestamp" + timestampFormat: "Jan 2 15:04:05" + timestampSetMonth: false + timestampSetDay: false + timestampLocation: "Local" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + "logs": + disabled: false + controlPlaneOnly: false + path: '/rootfs/var/log/' + glob: "" + match: '^(([\w\-.]+\.log(.[\d\-]+)?)|(docker))$' + recursive: false + pollingInterval: 250ms + walkingInterval: 5s + verboseFields: false + type: "kubernetes_host_logs" + index: "" + extraction: '' + extractionMessageField: "" + timestampField: "" + timestampFormat: "" + timestampSetMonth: false + timestampSetDay: false + timestampLocation: "" + samplingPercent: -1 + samplingKey: "" + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + + + journald: + disabled: false + path: + persistent: /rootfs/var/log/journal/ + volatile: /rootfs/run/log/journal/ + pollingInterval: 250ms + startFromRel: "" + type: "kubernetes_host_logs" + index: "" + samplingPercent: -1 + samplingKey: "" + reopenInterval: 1h + output: "" + thruputPerSecond: "" + tooOldEvents: "" + tooNewEvents: "" + eventPattern: '^[^\s]' + blacklist: [] + whitelist: [] + spawnExternalProcess: false + + diagnostics: + # Collectord can report if node reboot is required (uncomment to use it) + node-reboot-required: + path: /rootfs/var/run/reboot-required* + interval: "1h" + # See https://www.kernel.org/doc/Documentation/admin-guide/hw-vuln/index.rst + # And https://www.kernel.org/doc/Documentation/ABI/testing/sysfs-devices-system-cpu + cpu-vulnerabilities: + path: /rootfs/sys/devices/system/cpu/vulnerabilities/* + interval: 1h + + prometheus: + # Each entry below renders a [input.prometheus::] stanza in + # 002-daemonset.conf (controlPlaneOnly: false) or 003-daemonset-master.conf + # (controlPlaneOnly: true). + # + # The "WHERE" of the scrape is controlled by exactly one of three keys + # (since 26.04.2 - legacy endpoint-http://:/path syntax was + # removed and now fails fast at config load): + # endpointSlice: . - per-pod fan-out via discovery.k8s.io/v1.EndpointSlice + # service: . - hit the ClusterIP, kube-proxy load-balances + # endpoint(s): literal URL(s) - no Kubernetes discovery; the existing + # localhost-then-proxy fallback idiom. + # When endpointSlice or service is used, set port (number) or portName + # (matches EndpointSlice port name), plus scheme (http/https) and path. + # + # Example - scheduler reached through a headless discovery Service: + # "scheduler-via-discovery": + # controlPlaneOnly: true + # disabled: false + # type: "kubernetes_prometheus" + # source: "scheduler" + # interval: "60s" + # timeout: "60s" + # endpointSlice: kube-scheduler-collectorforkubernetes-discovery.kube-system + # port: 10251 + # scheme: http + # path: /metrics + # tokenPath: "" + # certPath: "" + # clientCertPath: "" + # insecure: false + # includeHelp: true + "kubelet": + controlPlaneOnly: false + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "kubelet" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - 'https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/${KUBERNETES_NODENAME}/proxy/metrics' + - 'http://127.0.0.1:10255/metrics' + - 'https://127.0.0.1:10250/metrics' + - 'http://127.0.0.1:10250/metrics' + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^kubelet_runtime_operations_duration_seconds_sum$' + - '^kubelet_docker_operations_duration_seconds_sum$' + - '^kubelet_network_plugin_operations_duration_seconds_sum$' + - '^kubelet_cgroup_manager_duration_seconds_sum$' + - '^storage_operation_duration_seconds_sum$' + - '^kubelet_docker_operations_errors_total$' + - '^kubelet_runtime_operations_errors_total$' + - '^rest_client_requests_total$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^rest_client_request_duration_seconds_sum$' + - '^kubelet_volume_stats_.+$' + - '^rest_client_requests_total$' + backlist: [] + "kubernetes-api": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "kubernetes-api" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://127.0.0.1:6443/metrics" + - "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^authenticated_user_requests$' + - '^apiserver_request_total$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^rest_client_request_duration_seconds_sum$' + - '^rest_client_requests_total$' + backlist: [] + "scheduler": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "scheduler" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:10259/metrics" + - "http://127.0.0.1:10251/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^scheduler_e2e_scheduling_duration_seconds_sum$' + - '^scheduler_binding_duration_seconds_sum$' + - '^scheduler_scheduling_algorithm_duration_seconds_sum$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + backlist: [] + "controller-manager": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "controller-manager" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:10257/metrics" + - "http://127.0.0.1:10252/metrics" + tokenPath: "/var/run/secrets/kubernetes.io/serviceaccount/token" + certPath: "" + clientCertPath: "" + clientKeyPath: "" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^kubernetes_build_info$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^node_collector_zone_size$' + - '^node_collector_zone_health$' + - '^node_collector_unhealthy_nodes_in_zone$' + backlist: [] + "etcd": + controlPlaneOnly: true + disabled: false + type: "kubernetes_prometheus" + index: "" + host: '${KUBERNETES_NODENAME}' + source: "etcd" + interval: "60s" + timeout: "60s" + endpoint: "" + endpoints: + - "https://:2379/metrics" + - "http://:2379/metrics" + - "http://:2381/metrics" + tokenPath: "" + certPath: "/rootfs/etc/kubernetes/pki/etcd/ca.crt" + clientCertPath: "/rootfs/etc/kubernetes/pki/apiserver-etcd-client.crt" + clientKeyPath: "/rootfs/etc/kubernetes/pki/apiserver-etcd-client.key" + insecure: true + includeHelp: false + output: "" + whitelist: + - '^etcd_server_leader_changes_seen_total$' + - '^etcd_server_has_leader$' + - '^etcd_server_proposals_committed_total$' + - '^etcd_server_proposals_applied_total$' + - '^etcd_server_proposals_pending$' + - '^etcd_server_proposals_failed_total$' + - '^etcd_disk_wal_fsync_duration_seconds_sum$' + - '^etcd_disk_wal_fsync_duration_seconds_count$' + - '^etcd_disk_backend_commit_duration_seconds_sum$' + - '^etcd_disk_backend_commit_duration_seconds_count$' + - '^etcd_network_client_grpc_.*$' + - '^grpc_server_handled_total$' + - '^etcd_network_peer_round_trip_time_seconds_bucket$' + - '^process_cpu_seconds_total$' + - '^process_resident_memory_bytes$' + - '^process_virtual_memory_bytes$' + - '^process_open_fds$' + - '^process_max_fds$' + - '^etcd_disk_backend_commit_duration_seconds_bucket$' + - '^etcd_disk_wal_fsync_duration_seconds_bucket$' + backlist: [] + kubernetesEvents: + disabled: false + type: "kubernetes_events" + index: "" + output: "" + excludeManagedFields: true + kubernetesWatch: + "pods": + disabled: false + refresh: 10m + apiVersion: v1 + kind: Pod + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true + "resourcequota": + disabled: false + refresh: 10m + apiVersion: v1 + kind: ResourceQuota + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true + "nodes": + disabled: false + refresh: 10m + apiVersion: v1 + kind: Node + namespace: "" + type: "kubernetes_objects" + index: "" + output: "" + modifyValues: [] + excludeManagedFields: true \ No newline at end of file From 74ffa49b2cdf8d894b64cd42fc5fcad143c21ae6 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Thu, 9 Jul 2026 15:46:09 -0500 Subject: [PATCH 8/9] new file: packs/tekton-operator-0.80.0/README.md new file: packs/tekton-operator-0.80.0/logo.png new file: packs/tekton-operator-0.80.0/manifests/tekton-config.yaml new file: packs/tekton-operator-0.80.0/manifests/tekton-config.yaml.orig new file: packs/tekton-operator-0.80.0/manifests/tekton-operator.yaml new file: packs/tekton-operator-0.80.0/manifests/tekton-operator.yaml.orig new file: packs/tekton-operator-0.80.0/pack.json new file: packs/tekton-operator-0.80.0/values.yaml --- packs/tekton-operator-0.80.0/README.md | 103 + packs/tekton-operator-0.80.0/logo.png | Bin 0 -> 10170 bytes .../manifests/tekton-config.yaml | 1 + .../manifests/tekton-config.yaml.orig | 27 + .../manifests/tekton-operator.yaml | 1 + .../manifests/tekton-operator.yaml.orig | 5341 ++++++++++++++++ packs/tekton-operator-0.80.0/pack.json | 31 + packs/tekton-operator-0.80.0/values.yaml | 5387 +++++++++++++++++ 8 files changed, 10891 insertions(+) create mode 100644 packs/tekton-operator-0.80.0/README.md create mode 100644 packs/tekton-operator-0.80.0/logo.png create mode 100644 packs/tekton-operator-0.80.0/manifests/tekton-config.yaml create mode 100644 packs/tekton-operator-0.80.0/manifests/tekton-config.yaml.orig create mode 100644 packs/tekton-operator-0.80.0/manifests/tekton-operator.yaml create mode 100644 packs/tekton-operator-0.80.0/manifests/tekton-operator.yaml.orig create mode 100644 packs/tekton-operator-0.80.0/pack.json create mode 100644 packs/tekton-operator-0.80.0/values.yaml diff --git a/packs/tekton-operator-0.80.0/README.md b/packs/tekton-operator-0.80.0/README.md new file mode 100644 index 00000000..bf65260c --- /dev/null +++ b/packs/tekton-operator-0.80.0/README.md @@ -0,0 +1,103 @@ + +```markdown +# Tektoncd Operator + +The Tektoncd Operator provides a declarative way to install, upgrade, and manage the lifecycle of Tekton components (Pipelines, Triggers, Dashboard, etc.) on Kubernetes and OpenShift clusters. + +--- + +## Prerequisites + +Before deploying the operator, ensure your environment meets the following requirements: + +* **Kubernetes:** v1.29+ (or a compatible OpenShift environment). +* **Tools:** `kubectl` CLI installed and configured. +* **Cluster Permissions:** Cluster-admin privileges are required to deploy the cluster-wide Custom Resource Definitions (CRDs), Roles, and Operator deployments. + +--- + +## Parameters + +When configuring the operator via its main Custom Resource (`TektonConfig`), you can manage components through **Installation Profiles**. The available profiles and the components they install are: + +| Platform | Profile | Installed Components | +| :--- | :--- | :--- | +| Kubernetes, OpenShift | `lite` | Pipeline | +| Kubernetes, OpenShift | `basic` | Pipeline, Trigger, Chains | +| Kubernetes | `all` | Pipeline, Trigger, Chains, Dashboard | +| OpenShift | `all` | Pipeline, Trigger, Chains, Pipelines as Code, Addons | + +--- + +## Upgrade + +To upgrade the Tektoncd Operator to the latest LTS version, re-apply the official release manifest. The operator will automatically handle the lifecycle and rolling updates of the underlying Tekton components based on your active profile. + +1. **Backup existing configurations:** + ```bash + kubectl get tektonconfigs.operator.tekton.dev -o yaml > tektonconfig-backup.yaml + +``` + +2. **Apply the updated manifest:** +```bash +kubectl apply -f [https://infra.tekton.dev/tekton-releases/operator/latest/release.yaml](https://infra.tekton.dev/tekton-releases/operator/latest/release.yaml) + +``` + + + +--- + +## Usage + +### 1. Install the Operator + +Deploy the operator using the official release manifest. This single command sets up the operator alongside the default components (Pipelines, Triggers, Chains, and Dashboard): + +```bash +kubectl apply -f [https://infra.tekton.dev/tekton-releases/operator/latest/release.yaml](https://infra.tekton.dev/tekton-releases/operator/latest/release.yaml) + +``` + +### 2. Configure Installation Profiles (Optional) + +If you prefer a different subset of components instead of the default stack, you can apply a specific configuration profile (e.g., the `all` profile for Kubernetes): + +```bash +kubectl apply -f [https://raw.githubusercontent.com/tektoncd/operator/main/config/crs/kubernetes/config/all/operator_v1alpha1_config_cr.yaml](https://raw.githubusercontent.com/tektoncd/operator/main/config/crs/kubernetes/config/all/operator_v1alpha1_config_cr.yaml) + +``` + +### 3. Verify the Installation + +Ensure the operator and its custom resources are successfully deployed in the cluster: + +```bash +kubectl get deployments -n tekton-operator +kubectl get tektonconfig + +``` + +### 4. Uninstalling + +The tekton-operator pack acts as an orchestrator for other components; therefore, it creates resources that cannot be removed when the operator is uninstalled. In this case, the user must manually remove all remaining resources. The tekton pack is designed this way to protect user data, separate the infrastructure from workloads, prevent dangerous cascading removals, and for other reasons. + +To remove the operator from your cluster: + +```bash +kubectl delete -f [https://infra.tekton.dev/tekton-releases/operator/latest/release.yaml](https://infra.tekton.dev/tekton-releases/operator/latest/release.yaml) + +``` + +--- + +## References + +* [Official Tekton Operator Installation Guide](https://tekton.dev/docs/operator/install/) +* [Tektoncd Operator GitHub Repository](https://github.com/tektoncd/operator) +* [Air Gap Image Configuration Guide](https://www.google.com/search?q=https://tekton.dev/docs/operator/air-gap/) + +``` + +``` \ No newline at end of file diff --git a/packs/tekton-operator-0.80.0/logo.png b/packs/tekton-operator-0.80.0/logo.png new file mode 100644 index 0000000000000000000000000000000000000000..125cb26470d8aa5f93ca70bdbbfc15967af745fe GIT binary patch literal 10170 zcmY*`s?^<1Z z)vBugvv)_SD$5`t;3I&6fg#DsN~(Wa!OtlU2lM$xTx=fvG~hsW8F8?hX~N^rMVN(- zoTZWy82u-P1A_)f2ZQ{F^7(*)#s3KthF!bs;G5(q0U|Bi1pK7``nmTSe zN{akuP7cf_=1!&-%w7)8|3rZadhvfk2Mae7QZEO4Ml%YU^$Lk0iw@~gPoSbS#wM_-st@ITD| z&-ZU0L6(1#|3Ah2PpAL!ezq!%AjtCHZ4*YoGu(v*1EaE)lN8gmhHmzSHP+NxyXWwy zPFD0GgN7h;6F&;W7LA4oiQHLpH<;+CwlkVAHGy_F_!VN{A_j#RNe-tDMZiRv7)B|| zf84ED+IlN;i2V3;-Vt)~Kr%L&>pLU#(A902y3;p<Vs>1=6o(fSk4S%EJo^w&(gH%lS0TGzO(?{tp?jT z9Q#OJA zkuC{VdE8My#ll7EDz&wVsOrGJUz3LNvA^OIgv(^dHyH#u$A3K>_%i?oL<;PKL?X#~ zupvWs5=L%Du7jFn&AK~s@g(=Kri4jQkobMYc~q!G8AU*^E>W}q$^7o*AS0u|u#xKS z+~nD}z5w}S6gJl|E-{idjEbf|F$oFL&E$f4%U ziu2u;CnA9`Z2l&B<-?852T4VAWHLz>PXHB;BY#&B%eH4G^zBq*)_)sDs}kXv7sCx( zNH@iF=XyYQIcnM|YgYw@)c(L&hdDE7Oiq_oN@mc|4dz_HbKq(NbmhL1A7DJk= z5h!f>;mtG2Et2JEgk)vGGyum+h8#UV(+3m_D)AF530*i2uNnjg*2)%J{uMu~vp)-X zP>?UeQuuHan#Rl%A5AM7^Zg4}T9`PMsV&+bq$&S$c!kk3-i=OA3*niDA*> zc8@A6Wpwf=aYre|IZSB*h>f#8>we{1kAUfPk3NwCoOvTZxC}1n;AzLbt#@{Hl3x6| z#zy$GeBwEcXWxQRTaA1y!LpzVS~=o3s7V|s9WgwSS8$dtW*%`jO%!}4z6~VzV(i;@ zFC^i|TU$z+(f$<%m>*b6tQzqk5g#scQ1QSF4KGB1b$M|y`#k7~^o*YO)lr9$zo7*- z;3OcFA1rk^Buq}D0FM*%JiE2%Y3c9L(UD}zX2kE&Jn2_=GgO`j^+&(OlQ3y1i{Dak zgoc$9w|hdpyB}BnVnO@-^EyY(wi)G88wQ*6HGSn=eN0`fR3MYB20OL309Z|A9`b=$ z+?T7rSEZ72b}&CEz&NIovTd~`gz{TD$#NXS(7jAN#mzWLhs<{)N+NzE8G@_0F^XSy zVIN;#)Ak&?>pT#K29I_-=`gY=sA4%oY=MEdh*|Mk(YM#`1f))gJh^;UF%RyzY0N%= zZY8Y(6sRBwQY(t+KLkzWOKH+$MNC1O+?Q zpQFbMfGEI*E7Lp6VPLkCXhZS&@Axx(^;wCdTP5B)8)9*Q~L*`9H z6$G|HXBif!Evqbu3yjAR$QtCX!_UpfPhTi!*faBvSM9RY260E9tt`R-B`G=U)n=u_ z=HpKv1=mc;$0UkJX0qbGdw%)7h%_TEAdHms21-nh!J_3Icw(_IcldRW@&voptESwwaK16?dh0x@%IhzdK{}kOZRW z9n6St?9Ey8eoN?>K{k6NKuOeKY$7y2MC2txkN8mZ_0~d$5YtN<2M;Tjrm$FZcDtmL z0tV3eX)ztGss{-p(t!I^qQh59hfe2^FK#_>7gntq6QV;pRb#`j7-+Pj1n>m!*GopP ziA`O449Y>>g_RqtpnwWg;MTMQ!wR*WB$k!=PmxfI-6Tg?!?xJ5%6bLhQ~?OWTXGt| z2;NF>SNk34w{f0l1%J8}$f*}V9Zf0#M&{j8^7x}f-6;rDx%Pk@&jwuC%aF5)Z-OOD zyv?s#89w?)`11+(3*ms-JybmWEE=I)2%*5!r|exwH%>O&_ZB$HJ;_*NrqjTG7@OkJb%4b>P;5 z7(!E4*Z>#({Ta5n`w`49Jub9%4w?zeC`eu&;RD+= zd9l)9?u?{wQ3TvW5&cTq$;4ta{eR#VV8QWSXPojA5M(f#ZC>LPNSU+Y+|6jfiyK9u zC6uK*)sRS(d6m-CC%(ko_ zsAy#4hLZq^kK}DX;xUpyBg{U4UFcUPrubK}%#+Gm8S5@+7zN(?8L&;cz#CW_Z%S)sh^gfFG{ z5xkpSBuCBUY7H{FvvMdFijA8Mji_8)->j-BU=eLTwCB+U%`z%R{;T}rSgJSehIwr~ zb2;8g1(!)QP02mS9gXN+N&dOD)I;`g9i?7=ZhF)`h7_we(G^l;C}`~FArXV49;spo7&yfzHNkYb9LP@pyrvpTQ=?W(Uq75X* z?)w281Z>O>T}7~fGIVZSMV1MjY|n4xjKV_WvNQGedCEDQvb736!`PO;+hS&F1)ZxA zqVkmDhvvpB(e+0nezdPiWKGM$xD^7{IbI3L-Zi9BnGL(tk-0I1y?`Cynkp_QT#Wfa zWi|XX2Nx@nd_@1)B7ns9A{Y7A2^ZUNYmiY&U@`Ap+*3_x{(Cn{oO?5EfRg~ZZO3fU z&4AJ{4z~%f^oBDPJqSsB&g_)+eg6ebYPdKiGCwT^7fC)jiF<4PK%C;uxj%7Ma$A^} zvhJf7>|kDgD{@QaY)s8s?~Qr-9SC_R0VAG@8-5hvkN0N;0*$)Ci;{;3y2_HL(9sZX zXn62`SQzHsNlYuwSN+kdqD-ZU*lic}uMQwIe)>pnY z#Z>KfSD2G#w6LNm4qlMO&y9az;n{d7EQ)t!#Eyo*c|n8IL^Bcq!qYV*%oi)Z(kQhF zJihXN8)tg|ZK}rlM6c#ElNVNAr8UjhjZBs$5Z+j>$hl8~(R|rOGrjRxj(YAOzP10Y zG0R8t?RsJS^_Ik&An7eEASS&EtvPWQqkKtZA6+_g zi_o%|c%|&{)^3e4q|P?3yak#JM2y_+!{}}u+O0vb`poPPLf|kp0Iil(?M&xybX{vp zvN?b#lD3`Eg?>$0Gg2wgPkJL7P=DP1cVJnHl&}AS28ZtGAYIVaCv5uwP1yIU)iqw= z$~hF=f*423gVI`+H(=+|$c5A?O?|JjMtqQfVD@PPJM7I7ITo>$!o(crb~fq`d$D}Q z8|=sE%^Zsz=b~cI%drI-SzTVGm{tH<>D&Ipq~C0f=aWlIG}>~_rL*Zd&yfjcv-!Rg zo9UJ$mDG@EmJ~RVpa+XQqC#RG5FP7jGLXdHLVhLWeZiOFrC|;?nG4tQVA&5K#D(v} zsAyVVPVsIRL=|uDMUAt--l_BW{=(Yh3}#U8W68h;m&*x=N{^LT9qmlybpXucObQ>u z!U{!+S`Y|(-FXAD_=4+eu|eFI(qBrjVCWg}%r~BY6-DOGk|;~->+v)2=ixWQGF(3+ zI{kiZ!7nyPmKlhIW9)H32Ogf&7K*?6C~*A-Mf|CGsTKQ3qJzr%P8Nz;vHh+BmL~dg zbnIPn`b8~1nMW}E0#zi!P#DKuu_M>dnTQ-stW^VLiBR27RIo`e&1TKsdi+Ot{aj2( zjXW+3L9qAo2aE;HH0j~zrUY&}vF&Ez)j<=Eck6XxcX9_takV-QgkUW=pHC^&pC=RH z@_7@okKX-Z9&;kb;_hlk;n{j)3-tVb6+FsjvPS9!;lZA@G5E2Re@Z!FD1>xg*WyNY zRshXwupZt2Wm@9nroDW6O2W*AZm`FP_ddOUL_C9;ig0fA%@{8$8m~x(oV%IF6=g5K zvKo!-U6pbkyg&km;!PgQf6CKP57aBtgXa0}0-m;ctDgou3h-!QlfkYOCBrqU^>%@T zBqSPF5s9h2Cz1Je_oAv&@MrLkTfdfgj>GKaC z*CwdHXh#L<+fwA!dFqD$DA00S;z5)Ff>1TNUEMfaA|;H@u)JXt;AC=@81r0vA73vC zO4cwO%Z%*(p8eTEf92m<|IqP%uq$k6(`$D+1icKy)}HM&hVy#2NefyN}gB&4Ds0P+DS;6Krt$K$yaF?aW-o%9T zsMEt*%rA<5a(hG-I}pSsK>5^jEGvdJuQz0uBiX2itKnfy9CP2y^g_Z`_rZ=T2r@_? z2G7Tg>FcL%#e9O}m#m5n-UP9D8Et@ISO1igt$|2$RQQtktjq&zFO!V;hp;t6YoYbB zoZrpzOwxB=Y;IkToulLp9Cv5~uj5h_ms7|EHLq8dwv*@M$9GjaSL81)N~H-plehKu z>s1NRy`AppH#f@k5AR>t8A(`_zWv@nb4UK=&jpy#LaU~B9@}WjiW00)Sd_m}jvFMo z6rCR{sB1J|nA1#D0PWXTErZh_Q)@f^a#cVFT< zy)l$v(8zBWT)z{_D@%^zW`B@p;v2dFxlLh@>P?3+#x^C^JG+Tzy6)kE<5HxM9}TEI z2)tM=zf#xeauR=heWB~nZEd&*BXQyjYBdTZSg%X#elY(V;?Lu%`HXq z(Ag+XHgt`Jr$HRQ+G-K^bFqd-*HFU55m;smv7kL6M>?9=+3o!bLMzJam> z6n?$KizUt;`m-aP5*qVHS}uRZeCWA=h(JTDWJEN;b4xO?sH9Rv_Lp>uq>-$v#!^Y1 zqAG0u>NM_%+&Q2$96+Ynm*g*1PRtbNAWPAwjI~a=m?J~aAru)=sywO3jhKnSepR;J zE$Z>k@&3M|uhVWzHllb0*_!Tv!7jo;6@j9G77Wf$GsuB4yK*HMZ3A(fWpb5RkT^}u zHr1PGuKWzd8KuS+d4;7wT z0+mMQ72&Lpynn)?mK8g*8Zcxa$sJi77_n0BLmA$>Xgj|d4bR_QU?Rvz@cHkxsgn_U zO?_?WHZ}dDs{b`u+v5e3&x{3Me*musaFiOIph?EE$r}QK#&PVtuN*cHOa8y>8Ku9UjDovUCmbY zD5LVFeP{^7Kt3uG*f6Zyi(t%Tk`rsF5{9|erotS=YQml68Y zBn0JgmDL7(pcGpHq(R+?7*1J5_VGf(k!A)@D`oB04!SWpPAa6pd0IXCV3l95M1N`Q z+m7ppa}XE5A>K(WJ|1Liv_1c#Q)CJMW;@RQnuz{EVL_&%V2_U0PuI_hHbeX83pisc zUDPBw(=DbD@engHh=L_>a=e>3^UsJF4?po2kq1(rIGXUs#V610up(cS-9-wLqBCc_ z4I##U_4?Gkv;x6a{6950LHZY+Shna&u3Ht}7CP_i&9u{Y{o8rllJ`91zRK7wH3EtP zOyLsoB%}xRVOJZEyQ<{Bw?Pe;fg*3WR<8&M79?0$bM?poV`!)AQx$T%dqT{{=h@`t z0&DXMuTI_WU(!dc`{Tz)BA%p2i?a7K4A1J!-w z!LLYD5$B!1e4+Rra;}F~La6qynoXMkm>51a~n3 zgP~W{Oo>9J!IF|FXf;`_K^R5J!YZ@VG9jI_0h0>RmrbvdAImZ2E$wf$XqK*WlEgms z#c@tb8fKq`yNMv8$9GXsS4hJ=^2WnXy0w{1Km3}hQJ?5T5;JYK?H*jABwyFgC<{ym zaa$qgjVDQ;F9lBDICA^mu-WzBHKw}n4k5p)q^Qn!hG7H zcV-FhJDs{X*|b}f1bLOj5Vi$MZl}uV@`7lcbYtYRyd9}coWXbTo|B1`yEYpr zt}nJkBKG%!&&9$Zyd&Dux#c5%y@ef{CJrxmE}{GOfDtOjHGYW*pt9^3O9+bf<~sq( z4>kT=Ms$LOoDRgJ>19H1{e!ONU#%C3P3G#kAN}LBb@u*65@^ubhPfO$!d_)veSwy~ z<1sfUnI5dR*YSlX#@{zO{Kv#-M%(wWPKlIMcJo&gsJx{WMx^=6p(MeY88o=Dv4^q{ z<^7vp|5wr7+iEhc0hJ116c3+_A+Q0XPybMKwblD7;~0*8F`3FSFcR8VWG#5u&QW4K zL-;PtAJ_lbno_ekKb%RSUXD%YW(Z5?X-I)m7B1knRW~vgHfxoEFUB=*OdB?#7O9Au z+LWu-L8libeG(5QJx0Y6j*gRAr*ltPNB%F=pe%gPWEnJQqkzyg{o9G_mGFBmD5}fL z5q)Ot{d6Z~=iy1^KAKKKn#;8q88@hDzwvtRhUb{3@h4-76mvQvzc20@!%EtnIcL@V zSvK;nw3mvyUe52gv3-t)2(wKMqbu2jb(HDkiTYj6h>{HB*Zg0Sg&?exW1TV31eV|9Ed~dh8)_(cMCv?NDwS7UqGR=4TRD*howkc$G34YQpr<^JBo?X2 zbv84eh|bq{aIBlXcC>trTE(6H9dpw-lia+0<+yl!4eguqTqQkK*o3+8Isi0blFlNL%PL{2}p!*ka! zr0-+Voa>1Ur4~v}Pf<7)SnErxv2)J~t+18MN>|P3waK(u-&5IguI55_6PZKhA!urE zLGr9fyA)=fV-W1{I9*biFEJv1UnSU=)wqEqAEmfR%|uPhXXmVSF)V@+Z<(=fe~A@y zg%!XrCWJcSs)F%Q(=;~k*4oG{b4>u?mWm{?c&oY}z9{Iv8*L(@JW5kLyMi>yfOjxR zKWQ0tpk32s18tgEK?Uc!7)_Rlmb^p6&8``wj)oi_+o&OeHf+gx{t!c?8V7HBHOt2} zCEK`88Z-w9l53D=l1WN1FaUyB zpB5p$Tt65IL2ZY&u1UA6R;UoQw4e576Ai_fW>&edYIk|Qb8~Z*t0S^~Rdy=~bAw#E zWxrk|W_z8`IbjI$tVCt9Nm7* zzuXH?_^AURxUsej8?o%ZuYfqphrbBq$qeJPx0(L5-CB(awAG<45<=IZ3mhknN)4&_ zYA|B{O0*m$bBQ0-nPw1$+fg||q8o}L!aryi+f&YJM?fM$9;^X;uMv82S%}m3+KS$M zxsdYFgNPb1Wd1%kuBuWQHV`^$jg(z*_yXI(>9|-1Y3FHej^Rlw;69lqd$0Blfu2Nf zLO=)3s?|OPVTou-$LmA=s2fJ}vPx!q)j#P6ag8DHOc*@?a1-X=WiVV1qj^taa^poAas_eAH-I~@w3Dn*z-mX;uh6K zjTIe`yI;){j_F9YQoVj+UH;xOun)O-v=z8r&!m{?I zw3{mw{>fUs&!*IN$2tEHwdBrmnMXm_ukc+njq9Z?dJjl% zU898HT+{M`hLo>~zQq6z8kE7+EPQ*vR=JRfbtn9&ayU!zG4O^-auB~HJ*y=t%w%rt z9Ybl~&vwi>$NPUmAVEnjDx%3DuFaI4u&|7l@O}sN%7h(2%5?cyjKENY5}O_ zP0rk3#ROR4+&zovG2cQgyWTFCbec#ZlSk`$xtXxAXz(yVI&&)*eIqK$q-0bn2NN(n zh^PKAc-Q;sW&P9UdySnuV~xs+-}!aG)q6}RDi}f9w)P?-go0E$ziB@X!7~RwE-;xp&!_o+;7fZ7e6EkB~xX&do zJS~pW(_+B~%`(N$A**6mk+H|lJTO{rwDMgj&=WOOqd|F{$dm{*23^P)R;7PB{i(bz z!r|Q*l6PDiUcQUD0)Ygrl$iG^x-GcE|ITZeLI^+17_RF8KV6YcjIosp9U3>nU)^Og0K3lB$Jv1Hg;;t*Cn z&XSBexPVlP5O3?e(-1l6o zNTQ&WFvUvBK>7*-GzBfQ5bx#EbL~w6R-#z%jmBLVYculr30XY;1p9(01Q`j}J-R?W zcxZsDT%9I!u;-s}<90V>&sRr$Kj)D zXK6JVv_h-6%u|&N-o$NU^t_;Pa}uDz5S74#SM&~hlU->$Z5aI;gnlj}Bwj+aHq8ys zp_ot!k8R3gXoJCY zE)cadiq^{(>B#^&I)pHqh8|^HS84PZ%-$YL-hdy<1@fDkYb9KKk%veBlgTt(2_T}V zz9Dsg5{6T=sp!IuXa9wDBwkU*UkfK~g9GA0qyg%9uuzR&0iya+wyEXDAC`}vVdi%- zQyeR3;#SW*wm7F@U#Fo_kN*TJKkb;PYALMdLbdDqVEM6fcA6iPV2A=KgPjU`(?BSv zwjYyTk&m4gU7kF)r|COUw^j*K+gWr$bjt&*qF;wwZAcUZpV4WN0T(ZvoiZ7thS{9f zueezK#?%KyM3mex4_UZPQ4u9sLPNuMVlIZ&R2vnsb~hjykc7kZk$z_G+`;Q8#i>2ZQD*V;Y1A>1jLt*Sr4Jm21F-DPmc z6As8;SQ2QJyN3%$ZfLM~zv0!YKFK*$iZA^X-`9714+f2Kp$J8utnqg}eT!{CX9XVM zhTRS)g82%Y4GdQNNUpp2x!Hvse4IW%bw-0|gQ+$Ah<-!@Ufm?9iIZBS>Cttfc&CLl z*5QX=nO&)N=Kw!R{mc2tSk_@Wh5KU8;( zqFOksIsz&8h^#Jwtb-y*dXSnk4=a6oT7B==%(qfw|MJ2H#BFtOE}oW!L#*PjoVo$1 z^Yf;uJhsUDIi`g@ppApU6dRkPbix^O{LFRPusqx0s4n>nso|%&48edzbjk9Raj4e2 zq5{{(c3GC6HHji#;n-TAJI using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + options: + description: Options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + type: object + status: + description: SyncerServiceStatus defines the observed state of SyncerService + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + syncerServiceInstallerSet: + description: The current installer set name for SyncerService + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonchains.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonChain + listKind: TektonChainList + plural: tektonchains + singular: tektonchain + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonChain is the Schema for the tektonchain API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonChainSpec defines the desired state of TektonChain + properties: + artifacts.oci.format: + description: oci artifacts config + type: string + artifacts.oci.signer: + type: string + artifacts.oci.storage: + type: string + artifacts.pipelinerun.enable-deep-inspection: + type: string + artifacts.pipelinerun.format: + description: pipelinerun artifacts config + type: string + artifacts.pipelinerun.signer: + type: string + artifacts.pipelinerun.storage: + type: string + artifacts.taskrun.format: + description: taskrun artifacts config + type: string + artifacts.taskrun.signer: + type: string + artifacts.taskrun.storage: + type: string + builddefinition.buildtype: + type: string + builder.id: + description: builder config + type: string + config: + description: Config holds the configuration for resources created by TektonChain + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + controllerEnvs: + items: + description: EnvVar represents an environment variable present in a Container. + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + default: false + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing the env file. + type: string + required: + - key + - path + - volumeName + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + disabled: + description: enable or disable chains feature + type: boolean + generateSigningSecret: + description: generate signing key + type: boolean + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + signers.kms.auth.address: + type: string + signers.kms.auth.oidc.path: + type: string + signers.kms.auth.oidc.role: + type: string + signers.kms.auth.spire.audience: + type: string + signers.kms.auth.spire.sock: + type: string + signers.kms.auth.token: + type: string + signers.kms.auth.token-path: + type: string + signers.kms.kmsref: + description: kms signer config + type: string + signers.x509.fulcio.address: + type: string + signers.x509.fulcio.enabled: + description: x509 signer config + type: boolean + signers.x509.fulcio.issuer: + type: string + signers.x509.fulcio.provider: + type: string + signers.x509.identity.token.file: + type: string + signers.x509.tuf.mirror.url: + type: string + storage.docdb.mongo-server-url: + type: string + storage.docdb.mongo-server-url-dir: + type: string + storage.docdb.url: + type: string + storage.gcs.bucket: + description: storage configs + type: string + storage.grafeas.notehint: + type: string + storage.grafeas.noteid: + type: string + storage.grafeas.projectid: + type: string + storage.oci.repository: + type: string + storage.oci.repository.insecure: + type: boolean + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + transparency.enabled: + type: string + transparency.url: + type: string + required: + - disabled + - options + type: object + status: + description: TektonChainStatus defines the observed state of TektonChain + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonChain + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonconfigs.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonConfig + listKind: TektonConfigList + plural: tektonconfigs + singular: tektonconfig + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonConfig is the Schema for the TektonConfigs API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonConfigSpec defines the desired state of TektonConfig + properties: + addon: + description: Addon holds the addons config + properties: + enablePipelinesAsCode: + description: |- + Deprecated, will be removed in further release + EnablePAC field defines whether to install PAC + type: boolean + params: + description: Params is the list of params passed for Addon customization + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + type: object + chain: + description: Chain holds the customizable option for chains component + properties: + artifacts.oci.format: + description: oci artifacts config + type: string + artifacts.oci.signer: + type: string + artifacts.oci.storage: + type: string + artifacts.pipelinerun.enable-deep-inspection: + type: string + artifacts.pipelinerun.format: + description: pipelinerun artifacts config + type: string + artifacts.pipelinerun.signer: + type: string + artifacts.pipelinerun.storage: + type: string + artifacts.taskrun.format: + description: taskrun artifacts config + type: string + artifacts.taskrun.signer: + type: string + artifacts.taskrun.storage: + type: string + builddefinition.buildtype: + type: string + builder.id: + description: builder config + type: string + controllerEnvs: + items: + description: EnvVar represents an environment variable present in a Container. + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + default: false + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing the env file. + type: string + required: + - key + - path + - volumeName + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + disabled: + description: enable or disable chains feature + type: boolean + generateSigningSecret: + description: generate signing key + type: boolean + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + signers.kms.auth.address: + type: string + signers.kms.auth.oidc.path: + type: string + signers.kms.auth.oidc.role: + type: string + signers.kms.auth.spire.audience: + type: string + signers.kms.auth.spire.sock: + type: string + signers.kms.auth.token: + type: string + signers.kms.auth.token-path: + type: string + signers.kms.kmsref: + description: kms signer config + type: string + signers.x509.fulcio.address: + type: string + signers.x509.fulcio.enabled: + description: x509 signer config + type: boolean + signers.x509.fulcio.issuer: + type: string + signers.x509.fulcio.provider: + type: string + signers.x509.identity.token.file: + type: string + signers.x509.tuf.mirror.url: + type: string + storage.docdb.mongo-server-url: + type: string + storage.docdb.mongo-server-url-dir: + type: string + storage.docdb.url: + type: string + storage.gcs.bucket: + description: storage configs + type: string + storage.grafeas.notehint: + type: string + storage.grafeas.noteid: + type: string + storage.grafeas.projectid: + type: string + storage.oci.repository: + type: string + storage.oci.repository.insecure: + type: boolean + transparency.enabled: + type: string + transparency.url: + type: string + required: + - disabled + - options + type: object + config: + description: Config holds the configuration for resources created by TektonConfig + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + dashboard: + description: Dashboard holds the customizable options for dashboards component + properties: + external-logs: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + readonly: + description: Readonly when set to true configures the Tekton dashboard in read-only mode + type: boolean + required: + - options + - readonly + type: object + hub: + description: Hub holds the hub config + properties: + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + params: + description: Params is the list of params passed for Hub customization + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + required: + - options + type: object + multiclusterProxyAAE: + description: MulticlusterProxyAAE holds the customizable options for the multicluster-proxy-aae component + properties: + options: + description: options holds additional fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + required: + - options + type: object + params: + description: Params is the list of params passed for all platforms + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + pipeline: + description: Pipeline holds the customizable option for pipeline component + properties: + await-sidecar-readiness: + type: boolean + bundles-resolver-config: + additionalProperties: + type: string + type: object + cluster-resolver-config: + additionalProperties: + type: string + type: object + coschedule: + type: string + default-affinity-assistant-pod-template: + type: string + default-cloud-events-sink: + type: string + default-forbidden-env: + type: string + default-managed-by-label-value: + type: string + default-max-matrix-combinations-count: + type: string + default-pod-template: + type: string + default-resolver-type: + type: string + default-service-account: + type: string + default-task-run-workspace-binding: + type: string + default-timeout-minutes: + type: integer + disable-affinity-assistant: + description: |- + Deprecated: DisableAffinityAssistant is deprecated and no longer used. + This field is removed from pipeline component. + Keeping here to maintain API compatibility during upgrades. + type: boolean + disable-creds-init: + type: boolean + disable-inline-spec: + type: string + embedded-status: + type: string + enable-api-fields: + type: string + enable-bundles-resolver: + type: boolean + enable-cel-in-whenexpression: + type: boolean + enable-cluster-resolver: + type: boolean + enable-custom-tasks: + type: boolean + enable-git-resolver: + type: boolean + enable-hub-resolver: + type: boolean + enable-param-enum: + type: boolean + enable-provenance-in-status: + type: boolean + enable-step-actions: + type: boolean + enable-tekton-oci-bundles: + description: |- + not in use, see: https://github.com/tektoncd/pipeline/pull/7789 + this field is removed from pipeline component + keeping here to maintain the API compatibility + type: boolean + enforce-nonfalsifiability: + type: string + git-resolver-config: + additionalProperties: + type: string + type: object + hub-resolver-config: + additionalProperties: + type: string + type: object + keep-pod-on-cancel: + type: boolean + max-result-size: + format: int32 + type: integer + metrics.count.enable-reason: + type: boolean + metrics.pipelinerun.duration-type: + type: string + metrics.pipelinerun.level: + type: string + metrics.taskrun.duration-type: + type: string + metrics.taskrun.level: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + params: + description: The params to customize different components of Pipelines + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + require-git-ssh-secret-known-hosts: + type: boolean + results-from: + type: string + running-in-environment-with-injected-sidecars: + type: boolean + scope-when-expressions-to-task: + description: ScopeWhenExpressionsToTask is deprecated and never used. + type: boolean + send-cloudevents-for-runs: + type: boolean + set-security-context: + type: boolean + traces.credentialsSecret: + description: CredentialsSecret is the name of the secret containing credentials for the tracing endpoint + type: string + traces.enabled: + description: Enabled controls whether tracing is enabled or not + type: boolean + traces.endpoint: + description: Endpoint is the URL for the OpenTelemetry trace collector + type: string + trusted-resources-verification-no-match-policy: + type: string + verification-mode: + type: string + required: + - options + type: object + platforms: + description: Platforms allows configuring platform specific configurations + properties: + kubernetes: + description: Kubernetes allows configuring kubernetes specific components and configurations + properties: + pipelinesAsCode: + description: PipelinesAsCode allows configuring PipelinesAsCode configurations + properties: + additionalPACControllers: + additionalProperties: + description: AdditionalPACControllerConfig contains config for additionalPACControllers + properties: + configMapName: + description: Name of the additional controller configMap + type: string + enable: + description: Enable or disable this additional pipelines as code instance by changing this bool + type: boolean + secretName: + description: Name of the additional controller Secret + type: string + settings: + additionalProperties: + type: string + description: Setting will contains the configMap data + type: object + type: object + description: AdditionalPACControllers allows to deploy additional PAC controller + type: object + enable: + description: Enable or disable pipelines as code by changing this bool + type: boolean + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + settings: + additionalProperties: + type: string + type: object + required: + - options + type: object + type: object + openshift: + description: OpenShift allows configuring openshift specific components and configurations + properties: + enableCentralTLSConfig: + description: |- + EnableCentralTLSConfig enables TLS configuration inheritance from + the cluster's APIServer TLS security profile. When enabled, TLS settings + (minimum version, cipher suites, curve preferences) are automatically + derived from the cluster-wide security policy and injected into Tekton + component containers that support TLS configuration. + If the APIServer does not have a TLS profile configured, user-specified + TLS settings in component configurations will be used as fallback. + Default: false (opt-in) + type: boolean + pipelinesAsCode: + description: PipelinesAsCode allows configuring PipelinesAsCode configurations + properties: + additionalPACControllers: + additionalProperties: + description: AdditionalPACControllerConfig contains config for additionalPACControllers + properties: + configMapName: + description: Name of the additional controller configMap + type: string + enable: + description: Enable or disable this additional pipelines as code instance by changing this bool + type: boolean + secretName: + description: Name of the additional controller Secret + type: string + settings: + additionalProperties: + type: string + description: Setting will contains the configMap data + type: object + type: object + description: AdditionalPACControllers allows to deploy additional PAC controller + type: object + enable: + description: Enable or disable pipelines as code by changing this bool + type: boolean + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + settings: + additionalProperties: + type: string + type: object + required: + - options + type: object + scc: + description: SCC allows configuring security context constraints used by workloads + properties: + default: + description: |- + Default contains the default SCC that will be attached to the service + account used for workloads (`pipeline` SA by default) and defined in + PipelineProperties.OptionalPipelineProperties.DefaultServiceAccount + type: string + maxAllowed: + description: |- + MaxAllowed specifies the highest SCC that can be requested for in a + namespace or in the Default field. + type: string + type: object + type: object + type: object + profile: + type: string + pruner: + description: Pruner holds the prune config + properties: + disabled: + description: enable or disable pruner feature + type: boolean + keep: + description: |- + The number of resource to keep + You dont want to delete all the pipelinerun/taskrun's by a cron + type: integer + keep-since: + description: |- + KeepSince keeps the resources younger than the specified value + Its value is taken in minutes + type: integer + prune-per-resource: + description: apply the prune job to the individual resources + type: boolean + resources: + description: The resources which need to be pruned + items: + type: string + type: array + schedule: + description: How frequent pruning should happen + type: string + startingDeadlineSeconds: + description: |- + Optional deadline in seconds for starting the job if it misses scheduled time for any reason. + Missed jobs executions will be counted as failed ones. + format: int64 + type: integer + required: + - disabled + type: object + result: + description: Result holds the customize option for results component + properties: + auth_disable: + type: boolean + auth_impersonate: + type: boolean + db_enable_auto_migration: + type: boolean + db_host: + type: string + db_name: + type: string + db_port: + format: int64 + type: integer + db_secret_name: + type: string + db_secret_password_key: + type: string + db_secret_user_key: + type: string + db_sslmode: + type: string + db_sslrootcert: + type: string + disabled: + description: enable or disable Result Component + type: boolean + gcs_bucket_name: + type: string + gcs_creds_secret_key: + type: string + gcs_creds_secret_name: + type: string + is_external_db: + type: boolean + log_level: + type: string + logging_plugin_api_url: + type: string + logging_plugin_ca_cert: + type: string + logging_plugin_forwarder_delay_duration: + type: integer + logging_plugin_multipart_regex: + type: string + logging_plugin_namespace_key: + type: string + logging_plugin_proxy_path: + type: string + logging_plugin_query_limit: + type: integer + logging_plugin_query_params: + type: string + logging_plugin_static_labels: + type: string + logging_plugin_tls_verification_disable: + type: boolean + logging_plugin_token_path: + type: string + logging_pvc_name: + type: string + logs_api: + type: boolean + logs_buffer_size: + format: int64 + type: integer + logs_path: + type: string + logs_type: + type: string + loki_stack_name: + type: string + loki_stack_namespace: + type: string + options: + description: Options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + prometheus_histogram: + type: boolean + prometheus_port: + format: int64 + type: integer + route_enabled: + description: Route configuration for Results API service exposure + type: boolean + route_host: + type: string + route_path: + type: string + route_tls_termination: + type: string + secret_name: + description: |- + name of the secret used to get S3 credentials and + pass it as environment variables to the "tekton-results-api" deployment under "api" container + type: string + server_port: + format: int64 + type: integer + storage_emulator_host: + type: string + tls_hostname_override: + type: string + required: + - disabled + - is_external_db + - options + type: object + scheduler: + description: To enable Pipeline Scheduling on Single Cluster or Multiple Clusters + properties: + config.yaml: + description: |- + This hold the config data from tekton-kueue. ConfigMap in tekton kueue is loaded as config.yaml so we need to + match the key here + x-kubernetes-preserve-unknown-fields: true + disabled: + description: enable or disable TektonScheduler Component + type: boolean + multi-cluster-disabled: + type: boolean + multi-cluster-role: + description: |- + MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole + can be one of Hub or Spoke + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + required: + - config.yaml + - disabled + - multi-cluster-disabled + - multi-cluster-role + - options + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + targetNamespaceMetadata: + description: holds target namespace metadata + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + tektonpruner: + description: New EventBasedPruner which provides more granular control over TaskRun and PipelineRuns + properties: + disabled: + description: enable or disable TektonPruner Component + type: boolean + global-config: + x-kubernetes-preserve-unknown-fields: true + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + required: + - disabled + - global-config + - options + type: object + trigger: + description: Trigger holds the customizable option for triggers component + properties: + default-service-account: + type: string + disabled: + description: enable or disable Trigger Component + type: boolean + enable-api-fields: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + required: + - disabled + - options + type: object + type: object + status: + description: TektonConfigStatus defines the observed state of TektonConfig + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + profile: + description: The profile installed + type: string + tektonInstallerSets: + additionalProperties: + type: string + description: The current installer set name + type: object + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektondashboards.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonDashboard + listKind: TektonDashboardList + plural: tektondashboards + singular: tektondashboard + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonDashboard is the Schema for the tektondashboards API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonDashboardSpec defines the desired state of TektonDashboard + properties: + config: + description: Config holds the configuration for resources created by TektonDashboard + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + external-logs: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + readonly: + description: Readonly when set to true configures the Tekton dashboard in read-only mode + type: boolean + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - options + - readonly + type: object + status: + description: TektonDashboardStatus defines the observed state of TektonDashboard + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonDashboard + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonhubs.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonHub + listKind: TektonHubList + plural: tektonhubs + singular: tektonhub + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + - jsonPath: .status.apiUrl + name: ApiUrl + type: string + - jsonPath: .status.uiUrl + name: UiUrl + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonHub is the Schema for the tektonhub API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + api: + properties: + catalogRefreshInterval: + type: string + hubConfigUrl: + description: Deprecated, will be removed in further release + type: string + routeHostUrl: + type: string + secret: + type: string + type: object + catalogs: + items: + properties: + contextDir: + type: string + name: + type: string + org: + type: string + provider: + type: string + revision: + type: string + sshUrl: + type: string + type: + type: string + url: + type: string + type: object + type: array + categories: + items: + type: string + type: array + customLogo: + description: The Base64 Encode data and mediaType of the Custom Logo + properties: + base64Data: + type: string + mediaType: + type: string + type: object + db: + properties: + secret: + type: string + type: object + default: + properties: + scopes: + items: + type: string + type: array + type: object + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + params: + description: Params is the list of params passed for Hub customization + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + scopes: + items: + properties: + name: + type: string + users: + items: + type: string + type: array + type: object + type: array + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - options + type: object + status: + description: TektonHubStatus defines the observed state of TektonHub + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + apiUrl: + description: The URL route for API which needs to be exposed + type: string + authUrl: + description: The URL route for Auth server + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + hubInstallerSets: + additionalProperties: + type: string + description: The current installer set name + type: object + manifests: + description: The url links of the manifests, separated by comma + items: + type: string + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + uiUrl: + description: The URL route for UI which needs to be exposed + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektoninstallersets.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonInstallerSet + listKind: TektonInstallerSetList + plural: tektoninstallersets + singular: tektoninstallerset + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonInstallerSet is the Schema for the TektonInstallerSet API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonInstallerSetSpec defines the desired state of TektonInstallerSet + properties: + manifests: + x-kubernetes-preserve-unknown-fields: true + type: object + status: + description: TektonInstallerSetStatus defines the observed state of TektonInstallerSet + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonmulticlusterproxyaaes.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonMulticlusterProxyAAE + listKind: TektonMulticlusterProxyAAEList + plural: tektonmulticlusterproxyaaes + singular: tektonmulticlusterproxyaae + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonMulticlusterProxyAAE is the Schema for the TektonMulticlusterProxyAAE API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + options: + description: options holds additional fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - options + type: object + status: + description: TektonMulticlusterProxyAAEStatus defines the observed state of TektonMulticlusterProxyAAE + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonMulticlusterProxyAAE + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonpipelines.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonPipeline + listKind: TektonPipelineList + plural: tektonpipelines + singular: tektonpipeline + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonPipeline is the Schema for the tektonpipelines API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonPipelineSpec defines the desired state of TektonPipeline + properties: + await-sidecar-readiness: + type: boolean + bundles-resolver-config: + additionalProperties: + type: string + type: object + cluster-resolver-config: + additionalProperties: + type: string + type: object + config: + description: Config holds the configuration for resources created by TektonPipeline + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + coschedule: + type: string + default-affinity-assistant-pod-template: + type: string + default-cloud-events-sink: + type: string + default-forbidden-env: + type: string + default-managed-by-label-value: + type: string + default-max-matrix-combinations-count: + type: string + default-pod-template: + type: string + default-resolver-type: + type: string + default-service-account: + type: string + default-task-run-workspace-binding: + type: string + default-timeout-minutes: + type: integer + disable-affinity-assistant: + description: |- + Deprecated: DisableAffinityAssistant is deprecated and no longer used. + This field is removed from pipeline component. + Keeping here to maintain API compatibility during upgrades. + type: boolean + disable-creds-init: + type: boolean + disable-inline-spec: + type: string + embedded-status: + type: string + enable-api-fields: + type: string + enable-bundles-resolver: + type: boolean + enable-cel-in-whenexpression: + type: boolean + enable-cluster-resolver: + type: boolean + enable-custom-tasks: + type: boolean + enable-git-resolver: + type: boolean + enable-hub-resolver: + type: boolean + enable-param-enum: + type: boolean + enable-provenance-in-status: + type: boolean + enable-step-actions: + type: boolean + enable-tekton-oci-bundles: + description: |- + not in use, see: https://github.com/tektoncd/pipeline/pull/7789 + this field is removed from pipeline component + keeping here to maintain the API compatibility + type: boolean + enforce-nonfalsifiability: + type: string + git-resolver-config: + additionalProperties: + type: string + type: object + hub-resolver-config: + additionalProperties: + type: string + type: object + keep-pod-on-cancel: + type: boolean + max-result-size: + format: int32 + type: integer + metrics.count.enable-reason: + type: boolean + metrics.pipelinerun.duration-type: + type: string + metrics.pipelinerun.level: + type: string + metrics.taskrun.duration-type: + type: string + metrics.taskrun.level: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + params: + description: The params to customize different components of Pipelines + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + require-git-ssh-secret-known-hosts: + type: boolean + results-from: + type: string + running-in-environment-with-injected-sidecars: + type: boolean + scope-when-expressions-to-task: + description: ScopeWhenExpressionsToTask is deprecated and never used. + type: boolean + send-cloudevents-for-runs: + type: boolean + set-security-context: + type: boolean + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + traces.credentialsSecret: + description: CredentialsSecret is the name of the secret containing credentials for the tracing endpoint + type: string + traces.enabled: + description: Enabled controls whether tracing is enabled or not + type: boolean + traces.endpoint: + description: Endpoint is the URL for the OpenTelemetry trace collector + type: string + trusted-resources-verification-no-match-policy: + type: string + verification-mode: + type: string + required: + - options + type: object + status: + description: TektonPipelineStatus defines the observed state of TektonPipeline + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + extTektonInstallerSets: + additionalProperties: + type: string + description: The installer sets created for extension components + type: object + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonPipeline + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonpruners.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonPruner + listKind: TektonPrunerList + plural: tektonpruners + singular: tektonpruner + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonPruner is the Schema for the TektonPruner API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + config: + description: Config holds the configuration for resources created by TektonPruner + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + disabled: + description: enable or disable TektonPruner Component + type: boolean + global-config: + x-kubernetes-preserve-unknown-fields: true + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - disabled + - global-config + - options + type: object + status: + description: TektonPrunerStatus defines the observed state of TektonPruner + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonPruner + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonresults.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonResult + listKind: TektonResultList + plural: tektonresults + singular: tektonresult + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonResult is the Schema for the tektonresults API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonResultSpec defines the desired state of TektonResult + properties: + auth_disable: + type: boolean + auth_impersonate: + type: boolean + config: + description: Config holds the configuration for resources created by TektonResult + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + db_enable_auto_migration: + type: boolean + db_host: + type: string + db_name: + type: string + db_port: + format: int64 + type: integer + db_secret_name: + type: string + db_secret_password_key: + type: string + db_secret_user_key: + type: string + db_sslmode: + type: string + db_sslrootcert: + type: string + disabled: + description: enable or disable Result Component + type: boolean + gcs_bucket_name: + type: string + gcs_creds_secret_key: + type: string + gcs_creds_secret_name: + type: string + is_external_db: + type: boolean + log_level: + type: string + logging_plugin_api_url: + type: string + logging_plugin_ca_cert: + type: string + logging_plugin_forwarder_delay_duration: + type: integer + logging_plugin_multipart_regex: + type: string + logging_plugin_namespace_key: + type: string + logging_plugin_proxy_path: + type: string + logging_plugin_query_limit: + type: integer + logging_plugin_query_params: + type: string + logging_plugin_static_labels: + type: string + logging_plugin_tls_verification_disable: + type: boolean + logging_plugin_token_path: + type: string + logging_pvc_name: + type: string + logs_api: + type: boolean + logs_buffer_size: + format: int64 + type: integer + logs_path: + type: string + logs_type: + type: string + loki_stack_name: + type: string + loki_stack_namespace: + type: string + options: + description: Options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + prometheus_histogram: + type: boolean + prometheus_port: + format: int64 + type: integer + route_enabled: + description: Route configuration for Results API service exposure + type: boolean + route_host: + type: string + route_path: + type: string + route_tls_termination: + type: string + secret_name: + description: |- + name of the secret used to get S3 credentials and + pass it as environment variables to the "tekton-results-api" deployment under "api" container + type: string + server_port: + format: int64 + type: integer + storage_emulator_host: + type: string + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + tls_hostname_override: + type: string + required: + - disabled + - is_external_db + - options + type: object + status: + description: TektonResultStatus defines the observed state of TektonResult + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonResult + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonschedulers.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonScheduler + listKind: TektonSchedulerList + plural: tektonschedulers + singular: tektonscheduler + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonScheduler is the Schema for the TektonScheduler API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + config.yaml: + description: |- + This hold the config data from tekton-kueue. ConfigMap in tekton kueue is loaded as config.yaml so we need to + match the key here + x-kubernetes-preserve-unknown-fields: true + disabled: + description: enable or disable TektonScheduler Component + type: boolean + multi-cluster-disabled: + type: boolean + multi-cluster-role: + description: |- + MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole + can be one of Hub or Spoke + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - config.yaml + - disabled + - multi-cluster-disabled + - multi-cluster-role + - options + type: object + status: + description: TektonSchedulerStatus defines the observed state of TektonScheduler + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tekton-scheduler: + description: The current installer set name for TektonScheduler + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektontriggers.operator.tekton.dev +spec: + group: operator.tekton.dev + names: + kind: TektonTrigger + listKind: TektonTriggerList + plural: tektontriggers + singular: tektontrigger + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonTrigger is the Schema for the tektontriggers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonTriggerSpec defines the desired state of TektonTrigger + properties: + config: + description: Config holds the configuration for resources created by TektonTrigger + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + default-service-account: + type: string + disabled: + description: enable or disable Trigger Component + type: boolean + enable-api-fields: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - disabled + - options + type: object + status: + description: TektonTriggerStatus defines the observed state of TektonTrigger + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: tekton-operator + namespace: tekton-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-operator-info + namespace: tekton-operator +rules: + - apiGroups: + - "" + resourceNames: + - tekton-operator-info + resources: + - configmaps + verbs: + - get + - describe +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-config-read-role +rules: + - apiGroups: + - operator.tekton.dev + resources: + - tektonconfigs + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-multicluster-proxy-aae-role +rules: + - apiGroups: + - kueue.x-k8s.io + resources: + - workloads + - multikueueclusters + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-operator +rules: + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - apiGroups: + - "" + resources: + - pods + - services + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + - pods/log + - limitranges + verbs: + - delete + - deletecollection + - create + - patch + - get + - list + - update + - watch + - describe + - apiGroups: + - extensions + - apps + - networking.k8s.io + resources: + - ingresses + - ingresses/status + verbs: + - delete + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - "" + resources: + - namespaces/finalizers + verbs: + - update + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + - deployments/finalizers + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - delete + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - roles + verbs: + - get + - create + - update + - delete + - list + - watch + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - impersonate + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - rolebindings + verbs: + - get + - create + - update + - delete + - list + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + - customresourcedefinitions/status + verbs: + - get + - create + - update + - delete + - list + - patch + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - build.knative.dev + resources: + - builds + - buildtemplates + - clusterbuildtemplates + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - extensions + resources: + - deployments + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - extensions + resources: + - deployments/finalizers + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - operator.tekton.dev + resources: + - '*' + - tektonaddons + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - tekton.dev + resources: + - tasks + - clustertasks + - taskruns + - pipelines + - pipelineruns + - pipelineresources + - conditions + - tasks/status + - clustertasks/status + - taskruns/status + - pipelines/status + - pipelineruns/status + - pipelineresources/status + - taskruns/finalizers + - pipelineruns/finalizers + - runs + - runs/status + - runs/finalizers + - customruns + - customruns/status + - customruns/finalizers + - verificationpolicies + - verificationpolicies/status + - stepactions + - stepactions/status + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - triggers.tekton.dev + - operator.tekton.dev + resources: + - '*' + verbs: + - add + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - dashboard.tekton.dev + resources: + - '*' + - tektonaddons + - extensions + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - use + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - delete + - deletecollection + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - delete + - deletecollection + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - serving.knative.dev + resources: + - '*' + - '*/status' + - '*/finalizers' + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - delete + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - delete + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - results.tekton.dev + resources: + - '*' + verbs: + - delete + - deletecollection + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - resolution.tekton.dev + resources: + - resolutionrequests + - resolutionrequests/status + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - openshift-pipelines.org + resources: + - approvaltasks + - approvaltasks/status + verbs: + - add + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-pac-controller-role +rules: + - apiGroups: + - pipelinesascode.tekton.dev + resources: + - repositories + - webhooks + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - deletecollection +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-result-read-role +rules: + - apiGroups: + - operator.tekton.dev + resources: + - tektonresults + verbs: + - get + - watch + - list +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tekton-scheduler-role +rules: + - apiGroups: + - kueue.x-k8s.io + resources: + - resourceflavors + - workloads + - workloads/finalizers + - workloads/status + - workloadpriorityclasses + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - cert-manager.io + resources: + - certificates + - issuers + verbs: + - get + - create + - update + - list + - nonResourceURLs: + - /metrics + verbs: + - get +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-operator-info + namespace: tekton-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: tekton-operator-info +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-config-read-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-config-read-role +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-multicluster-proxy-aae-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-multicluster-proxy-aae-role +subjects: + - kind: ServiceAccount + name: tekton-operator + namespace: tekton-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-operator +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-operator +subjects: + - kind: ServiceAccount + name: tekton-operator + namespace: tekton-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-pac-controller-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-pac-controller-role +subjects: + - kind: ServiceAccount + name: tekton-operator + namespace: tekton-operator +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-result-read-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-result-read-role +subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tekton-scheduler-rolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-scheduler-role +subjects: + - kind: ServiceAccount + name: tekton-operator + namespace: tekton-operator +--- +apiVersion: v1 +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Common configuration for all Knative codebase + zap-logger-config: | + { + "level": "info", + "development": false, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "ts", + "levelKey": "level", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "msg", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + loglevel.tekton-operator-cluster-operations: info + loglevel.tekton-operator-lifecycle: info + loglevel.tekton-operator-webhook: info + zap-logger-config: | + { + "level": "info", + "development": false, + "sampling": { + "initial": 100, + "thereafter": 100 + }, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "level", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "msg", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } +kind: ConfigMap +metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + name: config-logging + namespace: tekton-operator +--- +apiVersion: v1 +data: + AUTOINSTALL_COMPONENTS: "true" + DEFAULT_TARGET_NAMESPACE: tekton-pipelines +kind: ConfigMap +metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + name: tekton-config-defaults + namespace: tekton-operator +--- +apiVersion: v1 +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # OpenTelemetry Metrics Configuration + # Protocol for metrics export (prometheus, grpc, http/protobuf, none) + # Default: prometheus + metrics-protocol: prometheus + + # Metrics endpoint (for grpc/http protocols) + # Default: empty (uses default OTLP endpoint) + metrics-endpoint: "" + + # Metrics export interval (e.g., "30s", "1m") + # Default: empty (uses SDK default) + metrics-export-interval: "" + + # OpenTelemetry Tracing Configuration + # Protocol for tracing export (grpc, http/protobuf, none, stdout) + # Default: none + tracing-protocol: none + + # Tracing endpoint (for grpc/http protocols) + # Default: empty + tracing-endpoint: "" + + # Tracing sampling rate (0.0 to 1.0) + # Default: 1.0 (100% sampling) + tracing-sampling-rate: "1.0" + + # Runtime Configuration + # Enable profiling (enabled, disabled) + # Default: disabled + runtime-profiling: disabled + + # Runtime export interval (e.g., "15s") + # Default: 15s + runtime-export-interval: "15s" + + # Note: Legacy OpenCensus configuration keys (metrics.backend-destination, + # metrics.stackdriver-project-id, metrics.allow-stackdriver-custom-metrics) + # are no longer recognized. Use the OpenTelemetry options above. + metrics-protocol: prometheus +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-config-observability + namespace: tekton-operator +--- +apiVersion: v1 +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/instance: default + operator.tekton.dev/release: "v0.80.0" + name: tekton-operator-controller-config-leader-election + namespace: tekton-operator +--- +apiVersion: v1 +data: + version: "v0.80.0" +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-operator-info + namespace: tekton-operator +--- +apiVersion: v1 +data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" +kind: ConfigMap +metadata: + labels: + app.kubernetes.io/instance: default + operator.tekton.dev/release: "v0.80.0" + name: tekton-operator-webhook-config-leader-election + namespace: tekton-operator +--- +apiVersion: v1 +kind: Secret +metadata: + labels: + app: tekton-operator + name: tekton-operator-webhook + name: tekton-operator-webhook-certs + namespace: tekton-operator +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: tekton-pipelines-controller + version: "v0.80.0" + name: tekton-operator + namespace: tekton-operator +spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + selector: + app: tekton-operator + name: tekton-operator +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app: tekton-operator + name: tekton-operator-webhook + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tekton-operator-webhook + namespace: tekton-operator +spec: + ports: + - name: https-webhook + port: 443 + targetPort: 8443 + selector: + app: tekton-operator + name: tekton-operator-webhook +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tekton-operator + namespace: tekton-operator +spec: + replicas: 1 + selector: + matchLabels: + name: tekton-operator + template: + metadata: + labels: + app: tekton-operator + name: tekton-operator + spec: + containers: + - args: + - -controllers + - tektonconfig,tektonpipeline,tektontrigger,tektonhub,tektonchain,tektonresult,tektondashboard,manualapprovalgate,tektonpruner,tektonscheduler,tektonmulticlusterproxyaae,openshiftpipelinesascode + - -unique-process-name + - tekton-operator-lifecycle + env: + - name: KUBERNETES_MIN_VERSION + value: v1.0.0 + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: tekton-operator + - name: IMAGE_PIPELINES_PROXY + value: ghcr.io/tektoncd/operator/proxy-webhook-f6167da7bc41b96a27c5529f850e63d1:v0.80.0@sha256:2260f9bdf1699253a47e5d2664f70465f1a8c59ad7651cede2469a7586774341 + - name: IMAGE_JOB_PRUNER_TKN + value: ghcr.io/tektoncd/plumbing/tkn@sha256:233de6c8b8583a34c2379fa98d42dba739146c9336e8d41b66030484357481ed + - name: METRICS_DOMAIN + value: tekton.dev/operator + - name: VERSION + value: v0.80.0 + - name: CONFIG_OBSERVABILITY_NAME + value: tekton-config-observability + - name: CONFIG_LEADERELECTION_NAME + value: tekton-operator-controller-config-leader-election + - name: AUTOINSTALL_COMPONENTS + valueFrom: + configMapKeyRef: + key: AUTOINSTALL_COMPONENTS + name: tekton-config-defaults + - name: DEFAULT_TARGET_NAMESPACE + valueFrom: + configMapKeyRef: + key: DEFAULT_TARGET_NAMESPACE + name: tekton-config-defaults + image: ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77:v0.80.0@sha256:49f9f258920f77ca9db8031f8ee93b6abef0ff6a1a23254d937fd347601f4853 + imagePullPolicy: IfNotPresent + name: tekton-operator-lifecycle + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + - args: + - -controllers + - tektoninstallerset + - -unique-process-name + - tekton-operator-cluster-operations + env: + - name: KUBERNETES_MIN_VERSION + value: v1.0.0 + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: tekton-operator + - name: PROFILING_PORT + value: "9009" + - name: VERSION + value: v0.80.0 + - name: METRICS_DOMAIN + value: tekton.dev/operator + - name: CONFIG_LEADERELECTION_NAME + value: tekton-operator-controller-config-leader-election + image: ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77:v0.80.0@sha256:49f9f258920f77ca9db8031f8ee93b6abef0ff6a1a23254d937fd347601f4853 + imagePullPolicy: IfNotPresent + name: tekton-operator-cluster-operations + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: tekton-operator +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tekton-operator-webhook + namespace: tekton-operator +spec: + replicas: 1 + selector: + matchLabels: + name: tekton-operator-webhook + template: + metadata: + labels: + app: tekton-operator + name: tekton-operator-webhook + spec: + containers: + - env: + - name: KUBERNETES_MIN_VERSION + value: v1.0.0 + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: WEBHOOK_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_LEADERELECTION_NAME + value: tekton-operator-webhook-config-leader-election + - name: WEBHOOK_SERVICE_NAME + value: tekton-operator-webhook + - name: WEBHOOK_SECRET_NAME + value: tekton-operator-webhook-certs + - name: METRICS_DOMAIN + value: tekton.dev/operator + image: ghcr.io/tektoncd/operator/webhook-f2bb711aa8f0c0892856a4cbf6d9ddd8:v0.80.0@sha256:e4ec282861616a364dd8ad02cadec0fdabe26087605852ec85de3b7c084e5c50 + name: tekton-operator-webhook + ports: + - containerPort: 8443 + name: https-webhook + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: tekton-operator + +--- diff --git a/packs/tekton-operator-0.80.0/pack.json b/packs/tekton-operator-0.80.0/pack.json new file mode 100644 index 00000000..5668d73a --- /dev/null +++ b/packs/tekton-operator-0.80.0/pack.json @@ -0,0 +1,31 @@ +{ + "name": "tekton-operator", + "displayName": "Tekton Operator", + "annotations": { + "docsURL": "https://github.com/tektoncd/operator", + "description": "Tekton Operator", + "source": "community", + "contributor" : "spectrocloud" + }, + "version": "0.80.0", + "kubeManifests": [ + "manifests/tekton-operator.yaml", + "manifests/tekton-config.yaml" + ], + "layer": "addon", + "addonType": "system app", + "cloudTypes": [ + "all" + ], + "constraints": { + "dependencies": [ + { + "packName": "kubernetes", + "layer": "k8s", + "minVersion": "1.29", + "maxVersion": "", + "type": "optional" + } + ] + } +} \ No newline at end of file diff --git a/packs/tekton-operator-0.80.0/values.yaml b/packs/tekton-operator-0.80.0/values.yaml new file mode 100644 index 00000000..bf83d628 --- /dev/null +++ b/packs/tekton-operator-0.80.0/values.yaml @@ -0,0 +1,5387 @@ +pack: + content: + images: + - image: ghcr.io/tektoncd/operator/proxy-webhook-f6167da7bc41b96a27c5529f850e63d1:v0.80.0@sha256:2260f9bdf1699253a47e5d2664f70465f1a8c59ad7651cede2469a7586774341 + - image: ghcr.io/tektoncd/plumbing/tkn@sha256:233de6c8b8583a34c2379fa98d42dba739146c9336e8d41b66030484357481ed + - image: ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77:v0.80.0@sha256:49f9f258920f77ca9db8031f8ee93b6abef0ff6a1a23254d937fd347601f4853 + - image: ghcr.io/tektoncd/operator/webhook-f2bb711aa8f0c0892856a4cbf6d9ddd8:v0.80.0@sha256:e4ec282861616a364dd8ad02cadec0fdabe26087605852ec85de3b7c084e5c50 + + namespace: "tekton-operator" + +manifests: + tekton-config: + contents: | + # Copyright 2020 The Tekton Authors + # + # Licensed under the Apache License, Version 2.0 (the "License"); + # you may not use this file except in compliance with the License. + # You may obtain a copy of the License at + # + # http://www.apache.org/licenses/LICENSE-2.0 + # + # Unless required by applicable law or agreed to in writing, software + # distributed under the License is distributed on an "AS IS" BASIS, + # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + # See the License for the specific language governing permissions and + # limitations under the License. + + apiVersion: operator.tekton.dev/v1alpha1 + kind: TektonConfig + metadata: + name: config + spec: + profile: all + targetNamespace: tekton-pipelines + pruner: + resources: + - pipelinerun + - taskrun + keep: 100 + schedule: "0 8 * * *" + + tekton-operator: + contents: | + apiVersion: v1 + kind: Namespace + metadata: + name: tekton-operator + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: manualapprovalgates.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: ManualApprovalGate + listKind: ManualApprovalGateList + plural: manualapprovalgates + shortNames: + - mag + singular: manualapprovalgate + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ManualApprovalGate is the Schema for the ManualApprovalGate API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - options + type: object + status: + description: ManualApprovalGateStatus defines the observed state of ManualApprovalGate + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for ManualApprovalGate + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: openshiftpipelinesascodes.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: OpenShiftPipelinesAsCode + listKind: OpenShiftPipelinesAsCodeList + plural: openshiftpipelinesascodes + shortNames: + - opac + - pac + singular: openshiftpipelinesascode + preserveUnknownFields: false + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: Schema for the OpenShiftPipelinesAsCode API + type: object + x-kubernetes-preserve-unknown-fields: true + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: syncerservices.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: SyncerService + listKind: SyncerServiceList + plural: syncerservices + singular: syncerservice + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: SyncerService is the Schema for the syncerservices API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: SyncerServiceSpec defines the desired state of SyncerService + properties: + config: + description: Config holds the configuration for resources created by SyncerService + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + options: + description: Options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + type: object + status: + description: SyncerServiceStatus defines the observed state of SyncerService + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + syncerServiceInstallerSet: + description: The current installer set name for SyncerService + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonchains.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonChain + listKind: TektonChainList + plural: tektonchains + singular: tektonchain + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonChain is the Schema for the tektonchain API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonChainSpec defines the desired state of TektonChain + properties: + artifacts.oci.format: + description: oci artifacts config + type: string + artifacts.oci.signer: + type: string + artifacts.oci.storage: + type: string + artifacts.pipelinerun.enable-deep-inspection: + type: string + artifacts.pipelinerun.format: + description: pipelinerun artifacts config + type: string + artifacts.pipelinerun.signer: + type: string + artifacts.pipelinerun.storage: + type: string + artifacts.taskrun.format: + description: taskrun artifacts config + type: string + artifacts.taskrun.signer: + type: string + artifacts.taskrun.storage: + type: string + builddefinition.buildtype: + type: string + builder.id: + description: builder config + type: string + config: + description: Config holds the configuration for resources created by TektonChain + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + controllerEnvs: + items: + description: EnvVar represents an environment variable present in a Container. + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + default: false + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing the env file. + type: string + required: + - key + - path + - volumeName + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + disabled: + description: enable or disable chains feature + type: boolean + generateSigningSecret: + description: generate signing key + type: boolean + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + signers.kms.auth.address: + type: string + signers.kms.auth.oidc.path: + type: string + signers.kms.auth.oidc.role: + type: string + signers.kms.auth.spire.audience: + type: string + signers.kms.auth.spire.sock: + type: string + signers.kms.auth.token: + type: string + signers.kms.auth.token-path: + type: string + signers.kms.kmsref: + description: kms signer config + type: string + signers.x509.fulcio.address: + type: string + signers.x509.fulcio.enabled: + description: x509 signer config + type: boolean + signers.x509.fulcio.issuer: + type: string + signers.x509.fulcio.provider: + type: string + signers.x509.identity.token.file: + type: string + signers.x509.tuf.mirror.url: + type: string + storage.docdb.mongo-server-url: + type: string + storage.docdb.mongo-server-url-dir: + type: string + storage.docdb.url: + type: string + storage.gcs.bucket: + description: storage configs + type: string + storage.grafeas.notehint: + type: string + storage.grafeas.noteid: + type: string + storage.grafeas.projectid: + type: string + storage.oci.repository: + type: string + storage.oci.repository.insecure: + type: boolean + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + transparency.enabled: + type: string + transparency.url: + type: string + required: + - disabled + - options + type: object + status: + description: TektonChainStatus defines the observed state of TektonChain + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonChain + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonconfigs.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonConfig + listKind: TektonConfigList + plural: tektonconfigs + singular: tektonconfig + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonConfig is the Schema for the TektonConfigs API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonConfigSpec defines the desired state of TektonConfig + properties: + addon: + description: Addon holds the addons config + properties: + enablePipelinesAsCode: + description: |- + Deprecated, will be removed in further release + EnablePAC field defines whether to install PAC + type: boolean + params: + description: Params is the list of params passed for Addon customization + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + type: object + chain: + description: Chain holds the customizable option for chains component + properties: + artifacts.oci.format: + description: oci artifacts config + type: string + artifacts.oci.signer: + type: string + artifacts.oci.storage: + type: string + artifacts.pipelinerun.enable-deep-inspection: + type: string + artifacts.pipelinerun.format: + description: pipelinerun artifacts config + type: string + artifacts.pipelinerun.signer: + type: string + artifacts.pipelinerun.storage: + type: string + artifacts.taskrun.format: + description: taskrun artifacts config + type: string + artifacts.taskrun.signer: + type: string + artifacts.taskrun.storage: + type: string + builddefinition.buildtype: + type: string + builder.id: + description: builder config + type: string + controllerEnvs: + items: + description: EnvVar represents an environment variable present in a Container. + properties: + name: + description: |- + Name of the environment variable. + May consist of any printable ASCII characters except '='. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the ConfigMap or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + fileKeyRef: + description: |- + FileKeyRef selects a key of the env file. + Requires the EnvFiles feature gate to be enabled. + properties: + key: + description: |- + The key within the env file. An invalid key will prevent the pod from starting. + The keys defined within a source may consist of any printable ASCII characters except '='. + During Alpha stage of the EnvFiles feature gate, the key size is limited to 128 characters. + type: string + optional: + default: false + description: |- + Specify whether the file or its key must be defined. If the file or key + does not exist, then the env var is not published. + If optional is set to true and the specified key does not exist, + the environment variable will not be set in the Pod's containers. + + If optional is set to false and the specified key does not exist, + an error will be returned during Pod creation. + type: boolean + path: + description: |- + The path within the volume from which to select the file. + Must be relative and may not contain the '..' path or start with '..'. + type: string + volumeName: + description: The name of the volume mount containing the env file. + type: string + required: + - key + - path + - volumeName + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must be a valid secret key. + type: string + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + optional: + description: Specify whether the Secret or its key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + disabled: + description: enable or disable chains feature + type: boolean + generateSigningSecret: + description: generate signing key + type: boolean + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + signers.kms.auth.address: + type: string + signers.kms.auth.oidc.path: + type: string + signers.kms.auth.oidc.role: + type: string + signers.kms.auth.spire.audience: + type: string + signers.kms.auth.spire.sock: + type: string + signers.kms.auth.token: + type: string + signers.kms.auth.token-path: + type: string + signers.kms.kmsref: + description: kms signer config + type: string + signers.x509.fulcio.address: + type: string + signers.x509.fulcio.enabled: + description: x509 signer config + type: boolean + signers.x509.fulcio.issuer: + type: string + signers.x509.fulcio.provider: + type: string + signers.x509.identity.token.file: + type: string + signers.x509.tuf.mirror.url: + type: string + storage.docdb.mongo-server-url: + type: string + storage.docdb.mongo-server-url-dir: + type: string + storage.docdb.url: + type: string + storage.gcs.bucket: + description: storage configs + type: string + storage.grafeas.notehint: + type: string + storage.grafeas.noteid: + type: string + storage.grafeas.projectid: + type: string + storage.oci.repository: + type: string + storage.oci.repository.insecure: + type: boolean + transparency.enabled: + type: string + transparency.url: + type: string + required: + - disabled + - options + type: object + config: + description: Config holds the configuration for resources created by TektonConfig + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + dashboard: + description: Dashboard holds the customizable options for dashboards component + properties: + external-logs: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + readonly: + description: Readonly when set to true configures the Tekton dashboard in read-only mode + type: boolean + required: + - options + - readonly + type: object + hub: + description: Hub holds the hub config + properties: + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + params: + description: Params is the list of params passed for Hub customization + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + required: + - options + type: object + multiclusterProxyAAE: + description: MulticlusterProxyAAE holds the customizable options for the multicluster-proxy-aae component + properties: + options: + description: options holds additional fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + required: + - options + type: object + params: + description: Params is the list of params passed for all platforms + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + pipeline: + description: Pipeline holds the customizable option for pipeline component + properties: + await-sidecar-readiness: + type: boolean + bundles-resolver-config: + additionalProperties: + type: string + type: object + cluster-resolver-config: + additionalProperties: + type: string + type: object + coschedule: + type: string + default-affinity-assistant-pod-template: + type: string + default-cloud-events-sink: + type: string + default-forbidden-env: + type: string + default-managed-by-label-value: + type: string + default-max-matrix-combinations-count: + type: string + default-pod-template: + type: string + default-resolver-type: + type: string + default-service-account: + type: string + default-task-run-workspace-binding: + type: string + default-timeout-minutes: + type: integer + disable-affinity-assistant: + description: |- + Deprecated: DisableAffinityAssistant is deprecated and no longer used. + This field is removed from pipeline component. + Keeping here to maintain API compatibility during upgrades. + type: boolean + disable-creds-init: + type: boolean + disable-inline-spec: + type: string + embedded-status: + type: string + enable-api-fields: + type: string + enable-bundles-resolver: + type: boolean + enable-cel-in-whenexpression: + type: boolean + enable-cluster-resolver: + type: boolean + enable-custom-tasks: + type: boolean + enable-git-resolver: + type: boolean + enable-hub-resolver: + type: boolean + enable-param-enum: + type: boolean + enable-provenance-in-status: + type: boolean + enable-step-actions: + type: boolean + enable-tekton-oci-bundles: + description: |- + not in use, see: https://github.com/tektoncd/pipeline/pull/7789 + this field is removed from pipeline component + keeping here to maintain the API compatibility + type: boolean + enforce-nonfalsifiability: + type: string + git-resolver-config: + additionalProperties: + type: string + type: object + hub-resolver-config: + additionalProperties: + type: string + type: object + keep-pod-on-cancel: + type: boolean + max-result-size: + format: int32 + type: integer + metrics.count.enable-reason: + type: boolean + metrics.pipelinerun.duration-type: + type: string + metrics.pipelinerun.level: + type: string + metrics.taskrun.duration-type: + type: string + metrics.taskrun.level: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + params: + description: The params to customize different components of Pipelines + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + require-git-ssh-secret-known-hosts: + type: boolean + results-from: + type: string + running-in-environment-with-injected-sidecars: + type: boolean + scope-when-expressions-to-task: + description: ScopeWhenExpressionsToTask is deprecated and never used. + type: boolean + send-cloudevents-for-runs: + type: boolean + set-security-context: + type: boolean + traces.credentialsSecret: + description: CredentialsSecret is the name of the secret containing credentials for the tracing endpoint + type: string + traces.enabled: + description: Enabled controls whether tracing is enabled or not + type: boolean + traces.endpoint: + description: Endpoint is the URL for the OpenTelemetry trace collector + type: string + trusted-resources-verification-no-match-policy: + type: string + verification-mode: + type: string + required: + - options + type: object + platforms: + description: Platforms allows configuring platform specific configurations + properties: + kubernetes: + description: Kubernetes allows configuring kubernetes specific components and configurations + properties: + pipelinesAsCode: + description: PipelinesAsCode allows configuring PipelinesAsCode configurations + properties: + additionalPACControllers: + additionalProperties: + description: AdditionalPACControllerConfig contains config for additionalPACControllers + properties: + configMapName: + description: Name of the additional controller configMap + type: string + enable: + description: Enable or disable this additional pipelines as code instance by changing this bool + type: boolean + secretName: + description: Name of the additional controller Secret + type: string + settings: + additionalProperties: + type: string + description: Setting will contains the configMap data + type: object + type: object + description: AdditionalPACControllers allows to deploy additional PAC controller + type: object + enable: + description: Enable or disable pipelines as code by changing this bool + type: boolean + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + settings: + additionalProperties: + type: string + type: object + required: + - options + type: object + type: object + openshift: + description: OpenShift allows configuring openshift specific components and configurations + properties: + enableCentralTLSConfig: + description: |- + EnableCentralTLSConfig enables TLS configuration inheritance from + the cluster's APIServer TLS security profile. When enabled, TLS settings + (minimum version, cipher suites, curve preferences) are automatically + derived from the cluster-wide security policy and injected into Tekton + component containers that support TLS configuration. + If the APIServer does not have a TLS profile configured, user-specified + TLS settings in component configurations will be used as fallback. + Default: false (opt-in) + type: boolean + pipelinesAsCode: + description: PipelinesAsCode allows configuring PipelinesAsCode configurations + properties: + additionalPACControllers: + additionalProperties: + description: AdditionalPACControllerConfig contains config for additionalPACControllers + properties: + configMapName: + description: Name of the additional controller configMap + type: string + enable: + description: Enable or disable this additional pipelines as code instance by changing this bool + type: boolean + secretName: + description: Name of the additional controller Secret + type: string + settings: + additionalProperties: + type: string + description: Setting will contains the configMap data + type: object + type: object + description: AdditionalPACControllers allows to deploy additional PAC controller + type: object + enable: + description: Enable or disable pipelines as code by changing this bool + type: boolean + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + settings: + additionalProperties: + type: string + type: object + required: + - options + type: object + scc: + description: SCC allows configuring security context constraints used by workloads + properties: + default: + description: |- + Default contains the default SCC that will be attached to the service + account used for workloads (`pipeline` SA by default) and defined in + PipelineProperties.OptionalPipelineProperties.DefaultServiceAccount + type: string + maxAllowed: + description: |- + MaxAllowed specifies the highest SCC that can be requested for in a + namespace or in the Default field. + type: string + type: object + type: object + type: object + profile: + type: string + pruner: + description: Pruner holds the prune config + properties: + disabled: + description: enable or disable pruner feature + type: boolean + keep: + description: |- + The number of resource to keep + You dont want to delete all the pipelinerun/taskrun's by a cron + type: integer + keep-since: + description: |- + KeepSince keeps the resources younger than the specified value + Its value is taken in minutes + type: integer + prune-per-resource: + description: apply the prune job to the individual resources + type: boolean + resources: + description: The resources which need to be pruned + items: + type: string + type: array + schedule: + description: How frequent pruning should happen + type: string + startingDeadlineSeconds: + description: |- + Optional deadline in seconds for starting the job if it misses scheduled time for any reason. + Missed jobs executions will be counted as failed ones. + format: int64 + type: integer + required: + - disabled + type: object + result: + description: Result holds the customize option for results component + properties: + auth_disable: + type: boolean + auth_impersonate: + type: boolean + db_enable_auto_migration: + type: boolean + db_host: + type: string + db_name: + type: string + db_port: + format: int64 + type: integer + db_secret_name: + type: string + db_secret_password_key: + type: string + db_secret_user_key: + type: string + db_sslmode: + type: string + db_sslrootcert: + type: string + disabled: + description: enable or disable Result Component + type: boolean + gcs_bucket_name: + type: string + gcs_creds_secret_key: + type: string + gcs_creds_secret_name: + type: string + is_external_db: + type: boolean + log_level: + type: string + logging_plugin_api_url: + type: string + logging_plugin_ca_cert: + type: string + logging_plugin_forwarder_delay_duration: + type: integer + logging_plugin_multipart_regex: + type: string + logging_plugin_namespace_key: + type: string + logging_plugin_proxy_path: + type: string + logging_plugin_query_limit: + type: integer + logging_plugin_query_params: + type: string + logging_plugin_static_labels: + type: string + logging_plugin_tls_verification_disable: + type: boolean + logging_plugin_token_path: + type: string + logging_pvc_name: + type: string + logs_api: + type: boolean + logs_buffer_size: + format: int64 + type: integer + logs_path: + type: string + logs_type: + type: string + loki_stack_name: + type: string + loki_stack_namespace: + type: string + options: + description: Options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + prometheus_histogram: + type: boolean + prometheus_port: + format: int64 + type: integer + route_enabled: + description: Route configuration for Results API service exposure + type: boolean + route_host: + type: string + route_path: + type: string + route_tls_termination: + type: string + secret_name: + description: |- + name of the secret used to get S3 credentials and + pass it as environment variables to the "tekton-results-api" deployment under "api" container + type: string + server_port: + format: int64 + type: integer + storage_emulator_host: + type: string + tls_hostname_override: + type: string + required: + - disabled + - is_external_db + - options + type: object + scheduler: + description: To enable Pipeline Scheduling on Single Cluster or Multiple Clusters + properties: + config.yaml: + description: |- + This hold the config data from tekton-kueue. ConfigMap in tekton kueue is loaded as config.yaml so we need to + match the key here + x-kubernetes-preserve-unknown-fields: true + disabled: + description: enable or disable TektonScheduler Component + type: boolean + multi-cluster-disabled: + type: boolean + multi-cluster-role: + description: |- + MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole + can be one of Hub or Spoke + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + required: + - config.yaml + - disabled + - multi-cluster-disabled + - multi-cluster-role + - options + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + targetNamespaceMetadata: + description: holds target namespace metadata + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + tektonpruner: + description: New EventBasedPruner which provides more granular control over TaskRun and PipelineRuns + properties: + disabled: + description: enable or disable TektonPruner Component + type: boolean + global-config: + x-kubernetes-preserve-unknown-fields: true + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + required: + - disabled + - global-config + - options + type: object + trigger: + description: Trigger holds the customizable option for triggers component + properties: + default-service-account: + type: string + disabled: + description: enable or disable Trigger Component + type: boolean + enable-api-fields: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + required: + - disabled + - options + type: object + type: object + status: + description: TektonConfigStatus defines the observed state of TektonConfig + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + profile: + description: The profile installed + type: string + tektonInstallerSets: + additionalProperties: + type: string + description: The current installer set name + type: object + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektondashboards.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonDashboard + listKind: TektonDashboardList + plural: tektondashboards + singular: tektondashboard + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonDashboard is the Schema for the tektondashboards API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonDashboardSpec defines the desired state of TektonDashboard + properties: + config: + description: Config holds the configuration for resources created by TektonDashboard + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + external-logs: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + readonly: + description: Readonly when set to true configures the Tekton dashboard in read-only mode + type: boolean + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - options + - readonly + type: object + status: + description: TektonDashboardStatus defines the observed state of TektonDashboard + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonDashboard + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonhubs.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonHub + listKind: TektonHubList + plural: tektonhubs + singular: tektonhub + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + - jsonPath: .status.apiUrl + name: ApiUrl + type: string + - jsonPath: .status.uiUrl + name: UiUrl + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonHub is the Schema for the tektonhub API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + api: + properties: + catalogRefreshInterval: + type: string + hubConfigUrl: + description: Deprecated, will be removed in further release + type: string + routeHostUrl: + type: string + secret: + type: string + type: object + catalogs: + items: + properties: + contextDir: + type: string + name: + type: string + org: + type: string + provider: + type: string + revision: + type: string + sshUrl: + type: string + type: + type: string + url: + type: string + type: object + type: array + categories: + items: + type: string + type: array + customLogo: + description: The Base64 Encode data and mediaType of the Custom Logo + properties: + base64Data: + type: string + mediaType: + type: string + type: object + db: + properties: + secret: + type: string + type: object + default: + properties: + scopes: + items: + type: string + type: array + type: object + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + params: + description: Params is the list of params passed for Hub customization + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + scopes: + items: + properties: + name: + type: string + users: + items: + type: string + type: array + type: object + type: array + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - options + type: object + status: + description: TektonHubStatus defines the observed state of TektonHub + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + apiUrl: + description: The URL route for API which needs to be exposed + type: string + authUrl: + description: The URL route for Auth server + type: string + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + hubInstallerSets: + additionalProperties: + type: string + description: The current installer set name + type: object + manifests: + description: The url links of the manifests, separated by comma + items: + type: string + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + uiUrl: + description: The URL route for UI which needs to be exposed + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektoninstallersets.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonInstallerSet + listKind: TektonInstallerSetList + plural: tektoninstallersets + singular: tektoninstallerset + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonInstallerSet is the Schema for the TektonInstallerSet API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonInstallerSetSpec defines the desired state of TektonInstallerSet + properties: + manifests: + x-kubernetes-preserve-unknown-fields: true + type: object + status: + description: TektonInstallerSetStatus defines the observed state of TektonInstallerSet + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonmulticlusterproxyaaes.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonMulticlusterProxyAAE + listKind: TektonMulticlusterProxyAAEList + plural: tektonmulticlusterproxyaaes + singular: tektonmulticlusterproxyaae + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonMulticlusterProxyAAE is the Schema for the TektonMulticlusterProxyAAE API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + options: + description: options holds additional fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - options + type: object + status: + description: TektonMulticlusterProxyAAEStatus defines the observed state of TektonMulticlusterProxyAAE + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonMulticlusterProxyAAE + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonpipelines.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonPipeline + listKind: TektonPipelineList + plural: tektonpipelines + singular: tektonpipeline + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonPipeline is the Schema for the tektonpipelines API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonPipelineSpec defines the desired state of TektonPipeline + properties: + await-sidecar-readiness: + type: boolean + bundles-resolver-config: + additionalProperties: + type: string + type: object + cluster-resolver-config: + additionalProperties: + type: string + type: object + config: + description: Config holds the configuration for resources created by TektonPipeline + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + coschedule: + type: string + default-affinity-assistant-pod-template: + type: string + default-cloud-events-sink: + type: string + default-forbidden-env: + type: string + default-managed-by-label-value: + type: string + default-max-matrix-combinations-count: + type: string + default-pod-template: + type: string + default-resolver-type: + type: string + default-service-account: + type: string + default-task-run-workspace-binding: + type: string + default-timeout-minutes: + type: integer + disable-affinity-assistant: + description: |- + Deprecated: DisableAffinityAssistant is deprecated and no longer used. + This field is removed from pipeline component. + Keeping here to maintain API compatibility during upgrades. + type: boolean + disable-creds-init: + type: boolean + disable-inline-spec: + type: string + embedded-status: + type: string + enable-api-fields: + type: string + enable-bundles-resolver: + type: boolean + enable-cel-in-whenexpression: + type: boolean + enable-cluster-resolver: + type: boolean + enable-custom-tasks: + type: boolean + enable-git-resolver: + type: boolean + enable-hub-resolver: + type: boolean + enable-param-enum: + type: boolean + enable-provenance-in-status: + type: boolean + enable-step-actions: + type: boolean + enable-tekton-oci-bundles: + description: |- + not in use, see: https://github.com/tektoncd/pipeline/pull/7789 + this field is removed from pipeline component + keeping here to maintain the API compatibility + type: boolean + enforce-nonfalsifiability: + type: string + git-resolver-config: + additionalProperties: + type: string + type: object + hub-resolver-config: + additionalProperties: + type: string + type: object + keep-pod-on-cancel: + type: boolean + max-result-size: + format: int32 + type: integer + metrics.count.enable-reason: + type: boolean + metrics.pipelinerun.duration-type: + type: string + metrics.pipelinerun.level: + type: string + metrics.taskrun.duration-type: + type: string + metrics.taskrun.level: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + params: + description: The params to customize different components of Pipelines + items: + description: Param declares an string value to use for the parameter called name. + properties: + name: + type: string + value: + type: string + type: object + type: array + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + require-git-ssh-secret-known-hosts: + type: boolean + results-from: + type: string + running-in-environment-with-injected-sidecars: + type: boolean + scope-when-expressions-to-task: + description: ScopeWhenExpressionsToTask is deprecated and never used. + type: boolean + send-cloudevents-for-runs: + type: boolean + set-security-context: + type: boolean + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + traces.credentialsSecret: + description: CredentialsSecret is the name of the secret containing credentials for the tracing endpoint + type: string + traces.enabled: + description: Enabled controls whether tracing is enabled or not + type: boolean + traces.endpoint: + description: Endpoint is the URL for the OpenTelemetry trace collector + type: string + trusted-resources-verification-no-match-policy: + type: string + verification-mode: + type: string + required: + - options + type: object + status: + description: TektonPipelineStatus defines the observed state of TektonPipeline + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + extTektonInstallerSets: + additionalProperties: + type: string + description: The installer sets created for extension components + type: object + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonPipeline + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonpruners.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonPruner + listKind: TektonPrunerList + plural: tektonpruners + singular: tektonpruner + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonPruner is the Schema for the TektonPruner API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + config: + description: Config holds the configuration for resources created by TektonPruner + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + disabled: + description: enable or disable TektonPruner Component + type: boolean + global-config: + x-kubernetes-preserve-unknown-fields: true + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - disabled + - global-config + - options + type: object + status: + description: TektonPrunerStatus defines the observed state of TektonPruner + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonPruner + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonresults.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonResult + listKind: TektonResultList + plural: tektonresults + singular: tektonresult + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonResult is the Schema for the tektonresults API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonResultSpec defines the desired state of TektonResult + properties: + auth_disable: + type: boolean + auth_impersonate: + type: boolean + config: + description: Config holds the configuration for resources created by TektonResult + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + db_enable_auto_migration: + type: boolean + db_host: + type: string + db_name: + type: string + db_port: + format: int64 + type: integer + db_secret_name: + type: string + db_secret_password_key: + type: string + db_secret_user_key: + type: string + db_sslmode: + type: string + db_sslrootcert: + type: string + disabled: + description: enable or disable Result Component + type: boolean + gcs_bucket_name: + type: string + gcs_creds_secret_key: + type: string + gcs_creds_secret_name: + type: string + is_external_db: + type: boolean + log_level: + type: string + logging_plugin_api_url: + type: string + logging_plugin_ca_cert: + type: string + logging_plugin_forwarder_delay_duration: + type: integer + logging_plugin_multipart_regex: + type: string + logging_plugin_namespace_key: + type: string + logging_plugin_proxy_path: + type: string + logging_plugin_query_limit: + type: integer + logging_plugin_query_params: + type: string + logging_plugin_static_labels: + type: string + logging_plugin_tls_verification_disable: + type: boolean + logging_plugin_token_path: + type: string + logging_pvc_name: + type: string + logs_api: + type: boolean + logs_buffer_size: + format: int64 + type: integer + logs_path: + type: string + logs_type: + type: string + loki_stack_name: + type: string + loki_stack_namespace: + type: string + options: + description: Options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + performance: + description: |- + PerformanceProperties defines the fields which are configurable + to tune the performance of component controller + properties: + buckets: + type: integer + disable-ha: + description: if it is true, disables the HA feature + type: boolean + kube-api-burst: + type: integer + kube-api-qps: + description: |- + queries per second (QPS) and burst to the master from rest API client + actually the number multiplied by 2 + https://github.com/pierretasci/pipeline/blob/05d67e427c722a2a57e58328d7097e21429b7524/cmd/controller/main.go#L85-L87 + defaults: https://github.com/tektoncd/pipeline/blob/34618964300620dca44d10a595e4af84e9903a55/vendor/k8s.io/client-go/rest/config.go#L45-L46 + type: number + replicas: + format: int32 + type: integer + statefulset-ordinals: + description: if is true, enable StatefulsetOrdinals mode + type: boolean + threads-per-controller: + description: The number of workers to use when processing the component controller's work queue + type: integer + required: + - disable-ha + type: object + prometheus_histogram: + type: boolean + prometheus_port: + format: int64 + type: integer + route_enabled: + description: Route configuration for Results API service exposure + type: boolean + route_host: + type: string + route_path: + type: string + route_tls_termination: + type: string + secret_name: + description: |- + name of the secret used to get S3 credentials and + pass it as environment variables to the "tekton-results-api" deployment under "api" container + type: string + server_port: + format: int64 + type: integer + storage_emulator_host: + type: string + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + tls_hostname_override: + type: string + required: + - disabled + - is_external_db + - options + type: object + status: + description: TektonResultStatus defines the observed state of TektonResult + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name for TektonResult + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektonschedulers.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonScheduler + listKind: TektonSchedulerList + plural: tektonschedulers + singular: tektonscheduler + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonScheduler is the Schema for the TektonScheduler API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + properties: + config.yaml: + description: |- + This hold the config data from tekton-kueue. ConfigMap in tekton kueue is loaded as config.yaml so we need to + match the key here + x-kubernetes-preserve-unknown-fields: true + disabled: + description: enable or disable TektonScheduler Component + type: boolean + multi-cluster-disabled: + type: boolean + multi-cluster-role: + description: |- + MultiClusterRole Define the role of current cluster in multi-cluster environment. The MultiClusterRole + can be one of Hub or Spoke + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - config.yaml + - disabled + - multi-cluster-disabled + - multi-cluster-role + - options + type: object + status: + description: TektonSchedulerStatus defines the observed state of TektonScheduler + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tekton-scheduler: + description: The current installer set name for TektonScheduler + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: apiextensions.k8s.io/v1 + kind: CustomResourceDefinition + metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.18.0 + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tektontriggers.operator.tekton.dev + spec: + group: operator.tekton.dev + names: + kind: TektonTrigger + listKind: TektonTriggerList + plural: tektontriggers + singular: tektontrigger + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Reason + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: TektonTrigger is the Schema for the tektontriggers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TektonTriggerSpec defines the desired state of TektonTrigger + properties: + config: + description: Config holds the configuration for resources created by TektonTrigger + properties: + nodeSelector: + additionalProperties: + type: string + type: object + priorityClassName: + description: PriorityClassName holds the priority class to be set to pod template + type: string + tolerations: + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators). + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + type: object + default-service-account: + type: string + disabled: + description: enable or disable Trigger Component + type: boolean + enable-api-fields: + type: string + options: + description: options holds additions fields and these fields will be updated on the manifests + properties: + configMaps: + x-kubernetes-preserve-unknown-fields: true + deployments: + x-kubernetes-preserve-unknown-fields: true + disabled: + type: boolean + horizontalPodAutoscalers: + x-kubernetes-preserve-unknown-fields: true + statefulSets: + x-kubernetes-preserve-unknown-fields: true + webhookConfigurationOptions: + additionalProperties: + description: WebhookOptions defines options for webhooks + properties: + failurePolicy: + description: FailurePolicyType specifies a failure policy that defines how unrecognized errors from the admission endpoint are handled. + type: string + sideEffects: + description: SideEffectClass specifies the types of side effects a webhook may have. + type: string + timeoutSeconds: + format: int32 + type: integer + type: object + type: object + type: object + targetNamespace: + description: TargetNamespace is where resources will be installed + type: string + required: + - disabled + - options + type: object + status: + description: TektonTriggerStatus defines the observed state of TektonTrigger + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is additional Status fields for the Resource to save some + additional State as well as convey more information to the user. This is + roughly akin to Annotations on any k8s resource, just the reconciler conveying + richer information outwards. + type: object + conditions: + description: Conditions the latest available observations of a resource's current state. + items: + description: |- + Condition defines a readiness condition for a Knative resource. + See: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#typical-status-properties + properties: + lastTransitionTime: + description: |- + LastTransitionTime is the last time the condition transitioned from one status to another. + We use VolatileTime in place of metav1.Time to exclude this from creating equality.Semantic + differences (all other things held constant). + type: string + message: + description: A human readable message indicating details about the transition. + type: string + reason: + description: The reason for the condition's last transition. + type: string + severity: + description: |- + Severity with which to treat failures of this type of condition. + When this is not specified, it defaults to Error. + type: string + status: + description: Status of the condition, one of True, False, Unknown. + type: string + type: + description: Type of condition. + type: string + required: + - status + - type + type: object + type: array + observedGeneration: + description: |- + ObservedGeneration is the 'Generation' of the Service that + was last processed by the controller. + format: int64 + type: integer + tektonInstallerSet: + description: The current installer set name + type: string + version: + description: The version of the installed release + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + --- + apiVersion: v1 + kind: ServiceAccount + metadata: + name: tekton-operator + namespace: tekton-operator + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-operator-info + namespace: tekton-operator + rules: + - apiGroups: + - "" + resourceNames: + - tekton-operator-info + resources: + - configmaps + verbs: + - get + - describe + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: tekton-config-read-role + rules: + - apiGroups: + - operator.tekton.dev + resources: + - tektonconfigs + verbs: + - get + - watch + - list + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: tekton-multicluster-proxy-aae-role + rules: + - apiGroups: + - kueue.x-k8s.io + resources: + - workloads + - multikueueclusters + verbs: + - get + - list + - watch + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: tekton-operator + rules: + - apiGroups: + - "" + resources: + - nodes + verbs: + - list + - apiGroups: + - "" + resources: + - pods + - services + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + - pods/log + - limitranges + verbs: + - delete + - deletecollection + - create + - patch + - get + - list + - update + - watch + - describe + - apiGroups: + - extensions + - apps + - networking.k8s.io + resources: + - ingresses + - ingresses/status + verbs: + - delete + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - "" + resources: + - namespaces/finalizers + verbs: + - update + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + - deployments/finalizers + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - get + - create + - delete + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - roles + verbs: + - get + - create + - update + - delete + - list + - watch + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - impersonate + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - rolebindings + verbs: + - get + - create + - update + - delete + - list + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + - customresourcedefinitions/status + verbs: + - get + - create + - update + - delete + - list + - patch + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - build.knative.dev + resources: + - builds + - buildtemplates + - clusterbuildtemplates + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - extensions + resources: + - deployments + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - extensions + resources: + - deployments/finalizers + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - operator.tekton.dev + resources: + - '*' + - tektonaddons + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - tekton.dev + resources: + - tasks + - clustertasks + - taskruns + - pipelines + - pipelineruns + - pipelineresources + - conditions + - tasks/status + - clustertasks/status + - taskruns/status + - pipelines/status + - pipelineruns/status + - pipelineresources/status + - taskruns/finalizers + - pipelineruns/finalizers + - runs + - runs/status + - runs/finalizers + - customruns + - customruns/status + - customruns/finalizers + - verificationpolicies + - verificationpolicies/status + - stepactions + - stepactions/status + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - triggers.tekton.dev + - operator.tekton.dev + resources: + - '*' + verbs: + - add + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - dashboard.tekton.dev + resources: + - '*' + - tektonaddons + - extensions + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - security.openshift.io + resources: + - securitycontextconstraints + verbs: + - use + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - autoscaling + resources: + - horizontalpodautoscalers + verbs: + - delete + - deletecollection + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - delete + - deletecollection + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - serving.knative.dev + resources: + - '*' + - '*/status' + - '*/finalizers' + verbs: + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + - apiGroups: + - batch + resources: + - cronjobs + - jobs + verbs: + - delete + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - delete + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - authentication.k8s.io + resources: + - tokenreviews + verbs: + - create + - apiGroups: + - authorization.k8s.io + resources: + - subjectaccessreviews + verbs: + - create + - apiGroups: + - results.tekton.dev + resources: + - '*' + verbs: + - delete + - deletecollection + - create + - patch + - get + - list + - update + - watch + - apiGroups: + - resolution.tekton.dev + resources: + - resolutionrequests + - resolutionrequests/status + verbs: + - get + - list + - watch + - create + - delete + - update + - patch + - apiGroups: + - openshift-pipelines.org + resources: + - approvaltasks + - approvaltasks/status + verbs: + - add + - get + - list + - create + - update + - delete + - deletecollection + - patch + - watch + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: tekton-pac-controller-role + rules: + - apiGroups: + - pipelinesascode.tekton.dev + resources: + - repositories + - webhooks + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - deletecollection + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: tekton-result-read-role + rules: + - apiGroups: + - operator.tekton.dev + resources: + - tektonresults + verbs: + - get + - watch + - list + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRole + metadata: + name: tekton-scheduler-role + rules: + - apiGroups: + - kueue.x-k8s.io + resources: + - resourceflavors + - workloads + - workloads/finalizers + - workloads/status + - workloadpriorityclasses + verbs: + - get + - list + - create + - update + - delete + - patch + - watch + - apiGroups: + - scheduling.k8s.io + resources: + - priorityclasses + verbs: + - get + - list + - watch + - apiGroups: + - cert-manager.io + resources: + - certificates + - issuers + verbs: + - get + - create + - update + - list + - nonResourceURLs: + - /metrics + verbs: + - get + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-operator-info + namespace: tekton-operator + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: tekton-operator-info + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: tekton-config-read-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-config-read-role + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: tekton-multicluster-proxy-aae-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-multicluster-proxy-aae-role + subjects: + - kind: ServiceAccount + name: tekton-operator + namespace: tekton-operator + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: tekton-operator + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-operator + subjects: + - kind: ServiceAccount + name: tekton-operator + namespace: tekton-operator + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: tekton-pac-controller-role-binding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-pac-controller-role + subjects: + - kind: ServiceAccount + name: tekton-operator + namespace: tekton-operator + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: tekton-result-read-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-result-read-role + subjects: + - apiGroup: rbac.authorization.k8s.io + kind: Group + name: system:authenticated + --- + apiVersion: rbac.authorization.k8s.io/v1 + kind: ClusterRoleBinding + metadata: + name: tekton-scheduler-rolebinding + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tekton-scheduler-role + subjects: + - kind: ServiceAccount + name: tekton-operator + namespace: tekton-operator + --- + apiVersion: v1 + data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # Common configuration for all Knative codebase + zap-logger-config: | + { + "level": "info", + "development": false, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "ts", + "levelKey": "level", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "msg", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + loglevel.tekton-operator-cluster-operations: info + loglevel.tekton-operator-lifecycle: info + loglevel.tekton-operator-webhook: info + zap-logger-config: | + { + "level": "info", + "development": false, + "sampling": { + "initial": 100, + "thereafter": 100 + }, + "outputPaths": ["stdout"], + "errorOutputPaths": ["stderr"], + "encoding": "json", + "encoderConfig": { + "timeKey": "timestamp", + "levelKey": "level", + "nameKey": "logger", + "callerKey": "caller", + "messageKey": "msg", + "stacktraceKey": "stacktrace", + "lineEnding": "", + "levelEncoder": "", + "timeEncoder": "iso8601", + "durationEncoder": "", + "callerEncoder": "" + } + } + kind: ConfigMap + metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + name: config-logging + namespace: tekton-operator + --- + apiVersion: v1 + data: + AUTOINSTALL_COMPONENTS: "true" + DEFAULT_TARGET_NAMESPACE: tekton-pipelines + kind: ConfigMap + metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + name: tekton-config-defaults + namespace: tekton-operator + --- + apiVersion: v1 + data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + + # OpenTelemetry Metrics Configuration + # Protocol for metrics export (prometheus, grpc, http/protobuf, none) + # Default: prometheus + metrics-protocol: prometheus + + # Metrics endpoint (for grpc/http protocols) + # Default: empty (uses default OTLP endpoint) + metrics-endpoint: "" + + # Metrics export interval (e.g., "30s", "1m") + # Default: empty (uses SDK default) + metrics-export-interval: "" + + # OpenTelemetry Tracing Configuration + # Protocol for tracing export (grpc, http/protobuf, none, stdout) + # Default: none + tracing-protocol: none + + # Tracing endpoint (for grpc/http protocols) + # Default: empty + tracing-endpoint: "" + + # Tracing sampling rate (0.0 to 1.0) + # Default: 1.0 (100% sampling) + tracing-sampling-rate: "1.0" + + # Runtime Configuration + # Enable profiling (enabled, disabled) + # Default: disabled + runtime-profiling: disabled + + # Runtime export interval (e.g., "15s") + # Default: 15s + runtime-export-interval: "15s" + + # Note: Legacy OpenCensus configuration keys (metrics.backend-destination, + # metrics.stackdriver-project-id, metrics.allow-stackdriver-custom-metrics) + # are no longer recognized. Use the OpenTelemetry options above. + metrics-protocol: prometheus + kind: ConfigMap + metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-config-observability + namespace: tekton-operator + --- + apiVersion: v1 + data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" + kind: ConfigMap + metadata: + labels: + app.kubernetes.io/instance: default + operator.tekton.dev/release: "v0.80.0" + name: tekton-operator-controller-config-leader-election + namespace: tekton-operator + --- + apiVersion: v1 + data: + version: "v0.80.0" + kind: ConfigMap + metadata: + labels: + app.kubernetes.io/instance: default + name: tekton-operator-info + namespace: tekton-operator + --- + apiVersion: v1 + data: + _example: | + ################################ + # # + # EXAMPLE CONFIGURATION # + # # + ################################ + # This block is not actually functional configuration, + # but serves to illustrate the available configuration + # options and document them in a way that is accessible + # to users that `kubectl edit` this config map. + # + # These sample configuration options may be copied out of + # this example block and unindented to be in the data block + # to actually change the configuration. + # lease-duration is how long non-leaders will wait to try to acquire the + # lock; 15 seconds is the value used by core kubernetes controllers. + lease-duration: "60s" + # renew-deadline is how long a leader will try to renew the lease before + # giving up; 10 seconds is the value used by core kubernetes controllers. + renew-deadline: "40s" + # retry-period is how long the leader election client waits between tries of + # actions; 2 seconds is the value used by core kubernetes controllers. + retry-period: "10s" + # buckets is the number of buckets used to partition key space of each + # Reconciler. If this number is M and the replica number of the controller + # is N, the N replicas will compete for the M buckets. The owner of a + # bucket will take care of the reconciling for the keys partitioned into + # that bucket. + buckets: "1" + kind: ConfigMap + metadata: + labels: + app.kubernetes.io/instance: default + operator.tekton.dev/release: "v0.80.0" + name: tekton-operator-webhook-config-leader-election + namespace: tekton-operator + --- + apiVersion: v1 + kind: Secret + metadata: + labels: + app: tekton-operator + name: tekton-operator-webhook + name: tekton-operator-webhook-certs + namespace: tekton-operator + --- + apiVersion: v1 + kind: Service + metadata: + labels: + app: tekton-pipelines-controller + version: "v0.80.0" + name: tekton-operator + namespace: tekton-operator + spec: + ports: + - name: http-metrics + port: 9090 + protocol: TCP + targetPort: 9090 + selector: + app: tekton-operator + name: tekton-operator + --- + apiVersion: v1 + kind: Service + metadata: + labels: + app: tekton-operator + name: tekton-operator-webhook + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tekton-operator-webhook + namespace: tekton-operator + spec: + ports: + - name: https-webhook + port: 443 + targetPort: 8443 + selector: + app: tekton-operator + name: tekton-operator-webhook + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tekton-operator + namespace: tekton-operator + spec: + replicas: 1 + selector: + matchLabels: + name: tekton-operator + template: + metadata: + labels: + app: tekton-operator + name: tekton-operator + spec: + containers: + - args: + - -controllers + - tektonconfig,tektonpipeline,tektontrigger,tektonhub,tektonchain,tektonresult,tektondashboard,manualapprovalgate,tektonpruner,tektonscheduler,tektonmulticlusterproxyaae,openshiftpipelinesascode + - -unique-process-name + - tekton-operator-lifecycle + env: + - name: KUBERNETES_MIN_VERSION + value: v1.0.0 + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: tekton-operator + - name: IMAGE_PIPELINES_PROXY + value: ghcr.io/tektoncd/operator/proxy-webhook-f6167da7bc41b96a27c5529f850e63d1:v0.80.0@sha256:2260f9bdf1699253a47e5d2664f70465f1a8c59ad7651cede2469a7586774341 + - name: IMAGE_JOB_PRUNER_TKN + value: ghcr.io/tektoncd/plumbing/tkn@sha256:233de6c8b8583a34c2379fa98d42dba739146c9336e8d41b66030484357481ed + - name: METRICS_DOMAIN + value: tekton.dev/operator + - name: VERSION + value: v0.80.0 + - name: CONFIG_OBSERVABILITY_NAME + value: tekton-config-observability + - name: CONFIG_LEADERELECTION_NAME + value: tekton-operator-controller-config-leader-election + - name: AUTOINSTALL_COMPONENTS + valueFrom: + configMapKeyRef: + key: AUTOINSTALL_COMPONENTS + name: tekton-config-defaults + - name: DEFAULT_TARGET_NAMESPACE + valueFrom: + configMapKeyRef: + key: DEFAULT_TARGET_NAMESPACE + name: tekton-config-defaults + image: ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77:v0.80.0@sha256:49f9f258920f77ca9db8031f8ee93b6abef0ff6a1a23254d937fd347601f4853 + imagePullPolicy: IfNotPresent + name: tekton-operator-lifecycle + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + - args: + - -controllers + - tektoninstallerset + - -unique-process-name + - tekton-operator-cluster-operations + env: + - name: KUBERNETES_MIN_VERSION + value: v1.0.0 + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: OPERATOR_NAME + value: tekton-operator + - name: PROFILING_PORT + value: "9009" + - name: VERSION + value: v0.80.0 + - name: METRICS_DOMAIN + value: tekton.dev/operator + - name: CONFIG_LEADERELECTION_NAME + value: tekton-operator-controller-config-leader-election + image: ghcr.io/tektoncd/operator/operator-303303c315a48490ba6517859ef65b77:v0.80.0@sha256:49f9f258920f77ca9db8031f8ee93b6abef0ff6a1a23254d937fd347601f4853 + imagePullPolicy: IfNotPresent + name: tekton-operator-cluster-operations + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: tekton-operator + --- + apiVersion: apps/v1 + kind: Deployment + metadata: + labels: + operator.tekton.dev/release: "v0.80.0" + version: "v0.80.0" + name: tekton-operator-webhook + namespace: tekton-operator + spec: + replicas: 1 + selector: + matchLabels: + name: tekton-operator-webhook + template: + metadata: + labels: + app: tekton-operator + name: tekton-operator-webhook + spec: + containers: + - env: + - name: KUBERNETES_MIN_VERSION + value: v1.0.0 + - name: SYSTEM_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: WEBHOOK_POD_NAME + valueFrom: + fieldRef: + fieldPath: metadata.name + - name: CONFIG_LOGGING_NAME + value: config-logging + - name: CONFIG_LEADERELECTION_NAME + value: tekton-operator-webhook-config-leader-election + - name: WEBHOOK_SERVICE_NAME + value: tekton-operator-webhook + - name: WEBHOOK_SECRET_NAME + value: tekton-operator-webhook-certs + - name: METRICS_DOMAIN + value: tekton.dev/operator + image: ghcr.io/tektoncd/operator/webhook-f2bb711aa8f0c0892856a4cbf6d9ddd8:v0.80.0@sha256:e4ec282861616a364dd8ad02cadec0fdabe26087605852ec85de3b7c084e5c50 + name: tekton-operator-webhook + ports: + - containerPort: 8443 + name: https-webhook + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + serviceAccountName: tekton-operator + + --- + + + \ No newline at end of file From a7ca932f0c953eb89789a2a67ac475e8bc8d3e09 Mon Sep 17 00:00:00 2001 From: jaimegomez-source Date: Thu, 9 Jul 2026 16:13:01 -0500 Subject: [PATCH 9/9] Delete packs/outcold-26.04.4/readme.md --- packs/outcold-26.04.4/readme.md | 227 -------------------------------- 1 file changed, 227 deletions(-) delete mode 100644 packs/outcold-26.04.4/readme.md diff --git a/packs/outcold-26.04.4/readme.md b/packs/outcold-26.04.4/readme.md deleted file mode 100644 index 4c615a93..00000000 --- a/packs/outcold-26.04.4/readme.md +++ /dev/null @@ -1,227 +0,0 @@ -# Collectord Helm Charts for Monitoring Kubernetes in Splunk Enterprise and Splunk Cloud - -This helm chart provides a way to deploy Collectord in Kubernetes clusters for monitoring Kubernetes in Splunk Enterprise and Splunk Cloud. -Please refer to the documentation on how to install Monitoring Kubernetes application in Splunk [here](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/). - -## Prerequisites - -- Kubernetes 1.29+ -- Helm 3.8+ - -## Getting Started - -At this point we assume that you have installed Monitoring Kubernetes application in Splunk, and enabled Splunk HTTP Event Collector (HEC). Please refer to -[Monitoring Kubernetes - Installation](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/installation/) on how to do that. - -Review and accept [license agreement](https://www.outcoldsolutions.com/legal/license-agreement/). If your organization has not purchased a license, -request an evaluation license key with [this automated form](https://www.outcoldsolutions.com/trial/request/). License key will be sent to your email address immediately on request. - -Create a file named `my_values.yaml` with the content similar to: - -```yaml -collectord: - configuration: - general: - acceptLicense: true - license: '' - fields: - kubernetes_cluster: 'dev' - outputs: - splunk: - default: - url: 'https://hec.example.com:8088/services/collector/event/1.0' - token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' - insecure: true -``` - -Where you will agree to the license agreement, include your license key, and configure Splunk default output. - -You can generate a YAML file for deployment using the following command: - -```bash -helm template collectorforkubernetes \ - --namespace collectorforkubernetes \ - --create-namespace \ - --include-crds \ - -f my_values.yaml \ - oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes > collectorforkubernetes.yaml -``` - -To install the chart, run the following command: - -```bash -helm install collectorforkubernetes \ - --namespace collectorforkubernetes \ - --create-namespace \ - -f my_values.yaml \ - oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes -``` - -## Configuration - -Collectord is configured using the `ini` file format. You can find a reference with all possible configurations [here](https://www.outcoldsolutions.com/docs/monitoring-kubernetes/reference/). -This helm chart allows you to customize and override those configurations. -Using `my_values.yaml` as a template, you can customize the configuration to suit your needs. Please refer to the [./values.yaml](./values.yaml) for default configuration and possible values. - -### Using secrets - -If you want to store some configurations in a secret, first you need to create a secret with the `ini` format, that Collectord can read from. For example, if we want to store license, and token in secret file, -first we will create a secret file with the `ini` format and `.conf` extension with name `101-general.conf`. - -```ini -[general] -license = - -[output.splunk] -token = B5A79AAD-D822-46CC-80D1-819F80D7BFB0 -``` - -Using this file we can create a secret using the `ini` file: - -```bash -kubectl create namespace collectorforkubernetes -kubectl create secret generic collectord-secret \ - --from-file=101-general.conf=101-general.conf \ - -n collectorforkubernetes -``` - -After that we can remove values that we provided in the secret file in the `my_values.yaml` file. - -```yaml -collectord: - secrets: - - name: collectord-secret - - configuration: - general: - acceptLicense: true - fields: - kubernetes_cluster: 'dev' - outputs: - splunk: - default: - url: 'https://hec.example.com:8088/services/collector/event/1.0' - insecure: true -``` - -And install it using the following command (don't need to create namespace as we already created it): - -```bash -helm install collectorforkubernetes \ - --namespace collectorforkubernetes \ - -f my_values.yaml \ - oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes -``` - -> NOTE: Collectord reads all files with `.conf` extension from the `/config` directory and subdirectories. It will sort them by name in ascending order before reading them. -> In a case of file names `001-general.conf` and `101-general.conf`, all values in `101-general.conf` will override values in `001-general.conf`. - -### Secondary Splunk Output - -Collectord supports multiple Splunk outputs. You can configure an additional Splunk output by adding a new section to the `my_values.yaml` file. For example: - -```yaml -collectord: - configuration: - general: - acceptLicense: true - fields: - kubernetes_cluster: 'dev' - outputs: - splunk: - default: - url: 'https://hec.example.com:8088/services/collector/event/1.0' - token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' - insecure: true - apps: - url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' - token: '107E857B-C311-4C72-97E4-FBE601A6B39E' - insecure: true -``` - -After that you can reference this output in annotations like `collectord.io/output=splunk::apps` - -### Secondary Collectord deployment - -Collectord has ability to forward logs to multiple Splunk outputs simultaneously. In the example above, you can use annotations like `collectord.io/output=splunk,splunk::apps` -to forward logs to both outputs. But there are limitations about if you want to apply some transofrmation logic using the annotations, as this logic will be applied to both outputs at the same time. - -Say we will have two Collectord deployments, one forwarding data to Splunk Enterprise and another to Splunk Cloud. First we will deploy configuration for Splunk Enterprise `splunkenterprise_values.yaml`. -For example: - -```yaml -collectord: - configuration: - general: - acceptLicense: true - license: '' - fields: - kubernetes_cluster: 'dev' - outputs: - splunk: - default: - url: 'https://hec.example.com:8088/services/collector/event/1.0' - token: 'B5A79AAD-D822-46CC-80D1-819F80D7BFB0' - insecure: true -``` - -And we will deploy it with - -```bash -helm install collectorforkubernetes \ - --namespace collectorforkubernetes \ - --create-namespace \ - -f splunkenterprise_values.yaml \ - oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes -``` - -Secondary we will create a configuration file for Splunk Cloud `splunkcloud_values.yaml`, where we will call this deployment -`collectorforkubernetes-cloud`, and reference already created objects like service account, priority class, and cluster role, -created with previous deployment. -For example: - -```yaml -collectord: - serviceAccount: - create: false - name: collectorforkubernetes - - priorityClass: - create: false - name: collectorforkubernetes-critical - - clusterRole: - create: false - name: collectorforkubernetes - - configuration: - general: - annotationsSubdomain: 'splunkcloud' - acceptLicense: true - license: '' - fields: - kubernetes_cluster: 'dev' - outputs: - splunk: - default: - url: 'https://hec-apps.example.com:8088/services/collector/event/1.0' - token: '107E857B-C311-4C72-97E4-FBE601A6B39E' - insecure: true -``` - -To deploy it, you will run command, where we reference the same namespace (and ClusterRole, ClusterRoleBinding, ServiceAccount), but create separate DaemonSet, StatefulSets and Deployments specifically for the Splunk Cloud deployment. - -```bash -helm install collectorforkubernetes-cloud \ - --namespace collectorforkubernetes \ - -f splunkcloud_values.yaml \ - oci://registry-1.docker.io/outcoldsolutions/collectord-splunk-kubernetes -``` - -## Support - -Please refer to [How to submit a support request?](https://www.outcoldsolutions.com/docs/faq/#how-to-submit-a-support-request) - -## License - -[OUTCOLD SOLUTIONS SOFTWARE LICENSE AGREEMENT](https://www.outcoldsolutions.com/legal/license-agreement/) \ No newline at end of file