From 0474c970b0c746737f95ec166cae12fbd45b13ab Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:01:01 -0300 Subject: [PATCH 01/14] cleaning release.yaml --- release.yaml | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/release.yaml b/release.yaml index 1f75ffe36f..8b13789179 100644 --- a/release.yaml +++ b/release.yaml @@ -1,4 +1 @@ -rancher-vsphere-cpi: - - 104.0.1+up1.8.1 -rancher-vsphere-csi: - - 104.0.1+up3.3.0-rancher2 + From 839b739036e2c5b93f05c3d14b93f56f703b1074 Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:01:20 -0300 Subject: [PATCH 02/14] release chart: rancher-webhook - version: 104.0.1+up0.5.1 --- .../rancher-webhook-104.0.1+up0.5.1.tgz | Bin 0 -> 2794 bytes .../104.0.1+up0.5.1/Chart.yaml | 14 +++ .../104.0.1+up0.5.1/templates/_helpers.tpl | 22 +++++ .../104.0.1+up0.5.1/templates/deployment.yaml | 82 ++++++++++++++++++ .../104.0.1+up0.5.1/templates/rbac.yaml | 12 +++ .../104.0.1+up0.5.1/templates/secret.yaml | 11 +++ .../104.0.1+up0.5.1/templates/service.yaml | 13 +++ .../templates/serviceaccount.yaml | 11 +++ .../104.0.1+up0.5.1/templates/webhook.yaml | 9 ++ .../104.0.1+up0.5.1/tests/README.md | 16 ++++ .../tests/deployment_test.yaml | 73 ++++++++++++++++ .../104.0.1+up0.5.1/tests/service_test.yaml | 18 ++++ .../104.0.1+up0.5.1/values.yaml | 30 +++++++ index.yaml | 18 ++++ release.yaml | 3 +- 15 files changed, 331 insertions(+), 1 deletion(-) create mode 100644 assets/rancher-webhook/rancher-webhook-104.0.1+up0.5.1.tgz create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/Chart.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/templates/_helpers.tpl create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/templates/deployment.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/templates/rbac.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/templates/secret.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/templates/service.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/templates/serviceaccount.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/templates/webhook.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/tests/README.md create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/tests/deployment_test.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/tests/service_test.yaml create mode 100644 charts/rancher-webhook/104.0.1+up0.5.1/values.yaml diff --git a/assets/rancher-webhook/rancher-webhook-104.0.1+up0.5.1.tgz b/assets/rancher-webhook/rancher-webhook-104.0.1+up0.5.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..28aadc2ed7d110f945fbcc7d55baa978e38fafbe GIT binary patch literal 2794 zcmVDc zVQyr3R8em|NM&qo0PGuKZ`-!ApY-+keCdfmav3-F&#gzb<@MUof(qj}XQ z_csB;xllw=!R62a2#6v~%)Njp#n7Xo9bls9jAA&1OjjDw7Bmcz522-!6kClbH|Z4J zB_@&zK7{X~;~jTA-}M`jIf+olB)}oqMpv$+!l)5h$RRMw(?1$}V@x8dq+4LUx}`i6 zx3UpCH;6*em;e3&y54IoDSQuIujA`~Up5a$hD4&Pr7zYiw=IXn^g~W{*>y-97oWb@ z_c~69GDv8wOw$L#Xh;<0^HCU4squcXgkUBTxUj@Qtzwi;Gs9vI9lz)KUguwFY#FWh zzi$6a!cvq^>i~Axf2V)!*X_UGIX>9`K7dAKj@t4QjD@61B&$M?+I4*bP-H%YrBxyT zGx$7Z>|8J!tcLJ*HWBJPL5W;B&YX!UVVPS|%&-BlcKilsBxULX=Ts`qv!$KJLP#}1 zbt{saA4C_}lxZ)d9gO1~ff5W8>$!|Us0BhMD1;a@v5Jr@4=xd5p;Rn~ zZR3IxjtZr=)=&hp9S9y^tYljT3k*|6`P{`N4K(4lB9tqa@X%dzYa4EnNDwHW38y5- z5Ptp5;UdIKWEd!s4B_tHagL7QJfR|?YBgp=$_a@Oh?I2BF$5*b;yQ61(=3g11hGg| zHcGl9Y4G=NpbdBM#wpuXn5|os)z_s4%e$M^d#wu4rJKjaf(I zs!2>GCQD2_N2BOXID+x0X-pL#0!EQ5&_{>#;Oz`Biq+~>(Jna0!0y~FWem7bFvT)a z3_Zi{ES08fN+b??F7iNxw$IWUk21|Uf)QilmQkrd%wRmRbNfQU2w#~-$o6EqGRrU? zL7a#s4KW1D3zk-BEpVV!$I3%Adkn`Ds|C+(*Ix>C|F1BL8Br+P*9&AZCel;!Baece z@n64N^Z$cEzkl%m`+&PU7ebs-j?l86`8u?&`8vsba|_)2dq*SE8F(LTfM9)l9{M!; z^kP_?P_Aas`loESzKQ@ciN!~2Ef4Z=j{O-a2_W@c#{-Fs|_$MpzJavx!+mHy{Nwi9v#D z%{*_JG~$<>O+}2Fi!24jYt%}lY(nBKG;87L9Z(*yG~DJ)JopTp@=%9K-))twOcaa* z1||MWBG!!Y8Ja0p1g*r;TjZ?x-m<8Jt)iCGgholr2!)`72LufS*LeXZC51q~TAfqb4fj(bd(v)9ds1 z7gw8P)>KRyu{L*|CctO-lnRB#q}N0zqqEb?^U?UUPV%QjL}k?nm{DZm1&zPN?}r=Rip(oQG&{|TJmr+TwL!3k0%gt6TP-&=)#S&e zl`B;I+$4@A7EQWRS}uKtLq=%PTpK!o?d)-Tk=dB z@<}ViCRp5`8SSN`8S?$q=D zPS-!g|NDS)OmB8v`x=qZKTSmB-F#;f$|BGovs5ZfE(Aku)0EG@AmC2~!z>CQG5t9a zY5V{)2VjF&K{~K)E(s&b9hpu)VxV20n~k}w*!Nb6Y;ba&@n*moOmlDBS4m;diz zyZzhD|-s z>szo|#W;lbG5M6D^DUgFe?NH0{*5br0tc|u{s;B<-@%}Nxc}P=RF2KMA@4rgA281R zeyvD3-7Gok^^Q#dtVl9P^;a^?I1x$&f(_wnY%f-->1*{yvGL~bx!3z!gPrzIY$){@ zH?TAQ_iOKeUBBDy9qfM}P_y{PD0;UWa9y|VJHC#RE7MSC0JXBTyn@73ZIp|oT9>1& z79t=VrU*2OF_D53WlJljtC&bxX9LTuxJvNWbML_O!gl-5-%R&#{`Y&E=l`MpYcEiF z)644&vkUF!D}Z%fVpfhg7JNqMsYTyz;_EWW4R`TnjL%Z_IJVEd*54v*+P_q?eQ`Q^ zb9U-Q;gj&#dH$c&?Z0=@Kh%Hk1)QTJU?Lz4LR^C0eah!Rxl~DNOY|J)y*X^5GlZW~ z#voXbM8WtiBq@hmsun=Z3rc=D=QzLr{`-{3h2ypDQ7zkMjBE!KbZ0@bJA^BgN>h?R z=0x)~m3Nkh;A{nJaz{ok!k9r>Ad4Vo>6~(y(L^e6D{VP$Ui&$xYLQO8Ktyeg=BAt~ zJ>Tk=H>b+c-1K_5x%gESxv-OX?!9{oXtw`#?a#HD@#A8E9rk~G(mSr#{|x*?{oh_d zrc_~Og{3NYb#Y9|{^kQYmFAJ%tMB{xWvA8uxHKvc*f;=8Z=nVp}>!64V&=O{=_n3~Rq* za04t%tX7v)uI8xzh@sT+Q9Q-&SJ!KYH8vH8G}S%Aj@rjZX=r7e9wGKu7Q<{QhuM!i zY%X;x++kH$UTF<^@ceI%|FXN^rwIPOAph$hZ`6PLgTwvLUZ5QR<*z`s;II4;xVOl! w2uIehL|a0;hXN@(_{rm_FA~m>e(vo(zyS_$fUWSq00030|1}}}Jpe=i00eS;XaE2J literal 0 HcmV?d00001 diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/Chart.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/Chart.yaml new file mode 100644 index 0000000000..0640c09583 --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/Chart.yaml @@ -0,0 +1,14 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: < 1.31.0-0 + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-webhook +apiVersion: v2 +appVersion: 0.5.1 +description: ValidatingAdmissionWebhook for Rancher types +name: rancher-webhook +version: 104.0.1+up0.5.1 diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/templates/_helpers.tpl b/charts/rancher-webhook/104.0.1+up0.5.1/templates/_helpers.tpl new file mode 100644 index 0000000000..c37a65c6f3 --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{- define "rancher-webhook.labels" -}} +app: rancher-webhook +{{- end }} + +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} \ No newline at end of file diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/templates/deployment.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/templates/deployment.yaml new file mode 100644 index 0000000000..b8a7201dac --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/templates/deployment.yaml @@ -0,0 +1,82 @@ +{{- $auth := .Values.auth | default dict }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: rancher-webhook +spec: + selector: + matchLabels: + app: rancher-webhook + template: + metadata: + labels: + app: rancher-webhook + spec: + {{- if $auth.clientCA }} + volumes: + - name: client-ca + secret: + secretName: client-ca + {{- end }} + {{- if .Values.global.hostNetwork }} + hostNetwork: true + {{- end }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + {{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} + {{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 6 }} + {{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 6 }} + {{- end }} + containers: + - env: + - name: STAMP + value: "{{.Values.stamp}}" + - name: ENABLE_MCM + value: "{{.Values.mcm.enabled}}" + - name: CATTLE_PORT + value: {{.Values.port | default 9443 | quote}} + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if $auth.allowedCNs }} + - name: ALLOWED_CNS + value: '{{ join "," $auth.allowedCNs }}' + {{- end }} + image: '{{ template "system_default_registry" . }}{{ .Values.image.repository }}:{{ .Values.image.tag }}' + name: rancher-webhook + imagePullPolicy: "{{ .Values.image.imagePullPolicy }}" + ports: + - name: https + containerPort: {{ .Values.port | default 9443 }} + startupProbe: + httpGet: + path: "/healthz" + port: "https" + scheme: "HTTPS" + failureThreshold: 60 + periodSeconds: 5 + livenessProbe: + httpGet: + path: "/healthz" + port: "https" + scheme: "HTTPS" + periodSeconds: 5 + {{- if $auth.clientCA }} + volumeMounts: + - name: client-ca + mountPath: /tmp/k8s-webhook-server/client-ca + readOnly: true + {{- end }} + {{- if .Values.capNetBindService }} + securityContext: + capabilities: + add: + - NET_BIND_SERVICE + {{- end }} + serviceAccountName: rancher-webhook + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/templates/rbac.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/templates/rbac.yaml new file mode 100644 index 0000000000..f4364995c0 --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/templates/rbac.yaml @@ -0,0 +1,12 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: rancher-webhook +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: rancher-webhook + namespace: {{.Release.Namespace}} \ No newline at end of file diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/templates/secret.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/templates/secret.yaml new file mode 100644 index 0000000000..9fd331dc1e --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/templates/secret.yaml @@ -0,0 +1,11 @@ +{{- $auth := .Values.auth | default dict }} +{{- if $auth.clientCA }} +apiVersion: v1 +data: + ca.crt: {{ $auth.clientCA }} +kind: Secret +metadata: + name: client-ca + namespace: cattle-system +type: Opaque +{{- end }} diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/templates/service.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/templates/service.yaml new file mode 100644 index 0000000000..220afebeae --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/templates/service.yaml @@ -0,0 +1,13 @@ +kind: Service +apiVersion: v1 +metadata: + name: rancher-webhook + namespace: cattle-system +spec: + ports: + - port: 443 + targetPort: {{ .Values.port | default 9443 }} + protocol: TCP + name: https + selector: + app: rancher-webhook diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/templates/serviceaccount.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/templates/serviceaccount.yaml new file mode 100644 index 0000000000..9e7ad7e1fe --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/templates/serviceaccount.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: rancher-webhook-sudo + annotations: + cattle.io/description: "SA which can be impersonated to bypass rancher-webhook validation" \ No newline at end of file diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/templates/webhook.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/templates/webhook.yaml new file mode 100644 index 0000000000..53a0687b6f --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/templates/webhook.yaml @@ -0,0 +1,9 @@ +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + name: rancher.cattle.io +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + name: rancher.cattle.io diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/tests/README.md b/charts/rancher-webhook/104.0.1+up0.5.1/tests/README.md new file mode 100644 index 0000000000..6d3059a005 --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/tests/README.md @@ -0,0 +1,16 @@ + +## local dev testing instructions + +Option 1: Full chart CI run with a live cluster + +```bash +./scripts/charts/ci +``` + +Option 2: Test runs against the chart only + +```bash +# install the helm plugin first - helm plugin install https://github.com/helm-unittest/helm-unittest.git +bash dev-scripts/helm-unittest.sh +``` + diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/tests/deployment_test.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/tests/deployment_test.yaml new file mode 100644 index 0000000000..bbd6e30444 --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/tests/deployment_test.yaml @@ -0,0 +1,73 @@ +suite: Test Deployment +templates: + - deployment.yaml + +tests: + - it: should set webhook default port values + asserts: + - equal: + path: spec.template.spec.containers[0].ports[0].containerPort + value: 9443 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_PORT + value: "9443" + + - it: should set updated webhook port + set: + port: 2319 + asserts: + - equal: + path: spec.template.spec.containers[0].ports[0].containerPort + value: 2319 + - contains: + path: spec.template.spec.containers[0].env + content: + name: CATTLE_PORT + value: "2319" + + - it: should not set capabilities by default. + asserts: + - isNull: + path: spec.template.spec.containers[0].securityContext + + - it: should set net capabilities when capNetBindService is true. + set: + capNetBindService: true + asserts: + - contains: + path: spec.template.spec.containers[0].securityContext.capabilities.add + content: NET_BIND_SERVICE + + - it: should not set volumes or volumeMounts by default + asserts: + - isNull: + path: spec.template.spec.volumes + - isNull: + path: spec.template.spec.volumeMounts + + - it: should set CA fields when CA options are set + set: + auth.clientCA: base64-encoded-cert + auth.allowedCNs: + - kube-apiserver + - joe + asserts: + - contains: + path: spec.template.spec.volumes + content: + name: client-ca + secret: + secretName: client-ca + - contains: + path: spec.template.spec.containers[0].volumeMounts + content: + name: client-ca + mountPath: /tmp/k8s-webhook-server/client-ca + readOnly: true + - contains: + path: spec.template.spec.containers[0].env + content: + name: ALLOWED_CNS + value: kube-apiserver,joe diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/tests/service_test.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/tests/service_test.yaml new file mode 100644 index 0000000000..03172ad033 --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/tests/service_test.yaml @@ -0,0 +1,18 @@ +suite: Test Service +templates: + - service.yaml + +tests: + - it: should set webhook default port values + asserts: + - equal: + path: spec.ports[0].targetPort + value: 9443 + + - it: should set updated target port + set: + port: 2319 + asserts: + - equal: + path: spec.ports[0].targetPort + value: 2319 diff --git a/charts/rancher-webhook/104.0.1+up0.5.1/values.yaml b/charts/rancher-webhook/104.0.1+up0.5.1/values.yaml new file mode 100644 index 0000000000..cbba056cb2 --- /dev/null +++ b/charts/rancher-webhook/104.0.1+up0.5.1/values.yaml @@ -0,0 +1,30 @@ +image: + repository: rancher/rancher-webhook + tag: v0.5.1 + imagePullPolicy: IfNotPresent + +global: + cattle: + systemDefaultRegistry: "" + hostNetwork: false + +mcm: + enabled: true + +# tolerations for the webhook deployment. See https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ for more info +tolerations: [] +nodeSelector: {} + +## PriorityClassName assigned to deployment. +priorityClassName: "" + +# port assigns which port to use when running rancher-webhook +port: 9443 + +# Parameters for authenticating the kube-apiserver. +auth: + # CA for authenticating kube-apiserver client certs. If empty, client connections will not be authenticated. + # Must be base64-encoded. + clientCA: "" + # Allowlist of CNs for kube-apiserver client certs. If empty, any cert signed by the CA provided in clientCA will be accepted. + allowedCNs: [] diff --git a/index.yaml b/index.yaml index 034c4d7be9..b1a987e3e6 100755 --- a/index.yaml +++ b/index.yaml @@ -13745,6 +13745,24 @@ entries: - assets/rancher-vsphere-csi/rancher-vsphere-csi-101.0.0+up2.5.1-rancher1.tgz version: 101.0.0+up2.5.1-rancher1 rancher-webhook: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: < 1.31.0-0 + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-webhook + apiVersion: v2 + appVersion: 0.5.1 + created: "2024-08-17T19:01:19.061422213-03:00" + description: ValidatingAdmissionWebhook for Rancher types + digest: ba11d2137f5d7cdcc68f88e2fd3abce21bdf71b2a8aace0d7d9a653e827f8380 + name: rancher-webhook + urls: + - assets/rancher-webhook/rancher-webhook-104.0.1+up0.5.1.tgz + version: 104.0.1+up0.5.1 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/release.yaml b/release.yaml index 8b13789179..d1bf5af678 100644 --- a/release.yaml +++ b/release.yaml @@ -1 +1,2 @@ - +rancher-webhook: + - 104.0.1+up0.5.1 From 1ec8aa17a8de5de9fa28ba7b61df34f345022d39 Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:01:48 -0300 Subject: [PATCH 03/14] release chart: rancher-aks-operator - version: 104.1.0+up1.9.1 --- .../rancher-aks-operator-104.1.0+up1.9.1.tgz | Bin 0 -> 2116 bytes .../104.1.0+up1.9.1/Chart.yaml | 20 ++++++ .../104.1.0+up1.9.1/templates/NOTES.txt | 4 ++ .../104.1.0+up1.9.1/templates/_helpers.tpl | 25 +++++++ .../templates/clusterrole.yaml | 15 ++++ .../templates/clusterrolebinding.yaml | 13 ++++ .../104.1.0+up1.9.1/templates/deployment.yaml | 68 ++++++++++++++++++ .../templates/serviceaccount.yaml | 5 ++ .../104.1.0+up1.9.1/values.yaml | 23 ++++++ index.yaml | 24 +++++++ release.yaml | 2 + 11 files changed, 199 insertions(+) create mode 100644 assets/rancher-aks-operator/rancher-aks-operator-104.1.0+up1.9.1.tgz create mode 100644 charts/rancher-aks-operator/104.1.0+up1.9.1/Chart.yaml create mode 100644 charts/rancher-aks-operator/104.1.0+up1.9.1/templates/NOTES.txt create mode 100644 charts/rancher-aks-operator/104.1.0+up1.9.1/templates/_helpers.tpl create mode 100644 charts/rancher-aks-operator/104.1.0+up1.9.1/templates/clusterrole.yaml create mode 100644 charts/rancher-aks-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml create mode 100644 charts/rancher-aks-operator/104.1.0+up1.9.1/templates/deployment.yaml create mode 100644 charts/rancher-aks-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml create mode 100644 charts/rancher-aks-operator/104.1.0+up1.9.1/values.yaml diff --git a/assets/rancher-aks-operator/rancher-aks-operator-104.1.0+up1.9.1.tgz b/assets/rancher-aks-operator/rancher-aks-operator-104.1.0+up1.9.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5240670b03dd147e4d362faed9d26ef8267f37d9 GIT binary patch literal 2116 zcmV-K2)p+miwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PH$#bK|zr_nE(9N6s^TnjR_2lI?`kbjEeAO(z%IV_(zWWNvOC za3!LG2nGwv=PLT|9S{^nQnckdSG%2RzlZ`Ci`@nG71S){32L9s$X6L^W|Z!qCrq2* zj?Lw(&jDc=h9{#@@f(I=`*$!J4qgpLC&#D9r=wwb@+ur0AC1CS5Pp``cR)^t=~v;e zUaKwKe+jTORfZX%Qi?nP&J2@k8gOQe#6YM%%Z>6yN`^@pLDzBdxsJb?GsBZk0vxpw z6M=CxyAv%Dag1pMJ)?8%b)wAjG5QPCBvcx~;qSkJL2xt-LO+Dx!5|n8?BikQ)RfJU zGR83iH|WzH8Ju?_D~dphH2>83HbXrZhWrZa^{q%_bxYmYS}jD3_`dok!FvetS-_M_nIQuL!>5Z*7kMv08jw<_q~z|LvJRfZAFS<0q3$JBT% z6F;sQSR8pQ%c{SF;Ok)E#YkL>%oIas@EyuIaO+B7qBInmu;?P4!rAvXP-=p_L|M)f zV={{R{i!fXJ`T8=ujTGHn0-JFQn}_xk>@{}TBXuKI0^9OLL7=K}O$2(Cc{~o6%)? zPAsmNvuQa=W2Q(LWidN#%_12#jbPzS%(F&%rPU`#x-i+z-&Ad$SsV-NR+xOJt<#9l z&nSWklZ2jkZ~zx7Mv!cblANzmF)$)AO$*O;Z~)gh*|-=RNOXz@$$Gk2aq8!U+Mnhk z#(t_|^a&+$yJX)xIPmPyO);W$1k07B_*ResH39n$3=^p#Fba&4R$PSt*Z6ZTG!lGY zEeA!+I{A%PVijQ*e)>=daixXQ!rYxpMs&gESc-tLr5j@=)twb5@Uk{$p`<76f2aK$ zoM)05r2fU_yEiw1`DA|08QW$5N5i9*{hyrf^S|eT_bP{kEwDUa_N*lc*X~plVY)Kk zD%vlX5V#WItjYmkwer5L$NzVUpla?W_)|0VPqdobk#je2USvgZeoevuN&tRg*kS)4 z6O3+eiqLb(!N=HT2Oo8r9`wLptqMdjf#64%Lb~)~T~>6a71gv%i_}b@_kYyy zJ&6EH!s<_N!w;tM*0W~?_x|cCx3xclTOlQ|IEGR<7uSoFqA2x>U{9}YJ_2Ku>b4xN zg>xILZhTfZC+HbSZ&2z zr0r2T*AC!hg4{&VyHGdf`gVA2=MnVY{G2n{Yip*H4Jz{=$3ruP+EmO9N-ur5_plRo z`2W%{w37Jra&TAvcXHaw|Bk}r(aGNbKL^Z28b?s3U)M@vqs^noj0Y??iPGX9g$oL1 zUs2hqnxkPcGt5?ht|`;1_U>)E>0DybZuEg=;!j%TnJt434?mQJ!o+;-v>MFzt(kndN+87 z{f|b&upR%0$ESPye-5bIKg%-OnEJQX*54E9U7UK9{ZNM7PS%)7!5Kv`@Br2og=-%d zH;8YG9LS;et}e^ zF{TE-g6$HxPR_jsqu#T*?8f*7+O%vrwOWrqePtWKtgt{@# zRce?>QCA1c?+zpm+}#KqTAh}M^?~lm7qD6_m+-|}y4pocP*4gs7c8(^MGxZ|Higyd zu*u6+F6EVyg5O2(=gEaKR~iY6c<2Dr#YQu0*}i-C?&{;!_2u8*SFfsG!*W?|V|AIc zQF@cc%_E7>y;LqPA3>tLH>%ISck=<5l= 1.23.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: aksclusterconfigs.aks.cattle.io/v1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-aks-operator + catalog.cattle.io/scope: management +apiVersion: v2 +appVersion: 1.9.1 +description: A Helm chart for provisioning AKS clusters +home: https://github.com/rancher/aks-operator +name: rancher-aks-operator +sources: +- https://github.com/rancher/aks-operator +version: 104.1.0+up1.9.1 diff --git a/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/NOTES.txt b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/NOTES.txt new file mode 100644 index 0000000000..5ba05b482c --- /dev/null +++ b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/NOTES.txt @@ -0,0 +1,4 @@ +You have deployed the Rancher AKS operator +Version: {{ .Chart.AppVersion }} +Description: This operator provisions AKS clusters +from AKSClusterConfig CRs. diff --git a/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/_helpers.tpl b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/_helpers.tpl new file mode 100644 index 0000000000..de3b332f6a --- /dev/null +++ b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/_helpers.tpl @@ -0,0 +1,25 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} + diff --git a/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/clusterrole.yaml b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/clusterrole.yaml new file mode 100644 index 0000000000..5e2ce97567 --- /dev/null +++ b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/clusterrole.yaml @@ -0,0 +1,15 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: aks-operator + namespace: cattle-system +rules: + - apiGroups: [''] + resources: ['secrets'] + verbs: ['get', 'list', 'create', 'watch', 'update'] + - apiGroups: ['aks.cattle.io'] + resources: ['aksclusterconfigs'] + verbs: ['get', 'list', 'update', 'watch'] + - apiGroups: ['aks.cattle.io'] + resources: ['aksclusterconfigs/status'] + verbs: ['update'] diff --git a/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml new file mode 100644 index 0000000000..7aa7e785a4 --- /dev/null +++ b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: aks-operator + namespace: cattle-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: aks-operator +subjects: +- kind: ServiceAccount + name: aks-operator + namespace: cattle-system diff --git a/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/deployment.yaml b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/deployment.yaml new file mode 100644 index 0000000000..e929a85cdc --- /dev/null +++ b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/deployment.yaml @@ -0,0 +1,68 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: aks-config-operator + namespace: cattle-system +spec: + replicas: 1 + selector: + matchLabels: + ke.cattle.io/operator: aks + template: + metadata: + labels: + ke.cattle.io/operator: aks + spec: + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + serviceAccountName: aks-operator + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} + securityContext: + fsGroup: 1007 + runAsUser: 1007 + containers: + - name: aks-operator + image: '{{ template "system_default_registry" $ }}{{ $.Values.aksOperator.image.repository }}:{{ $.Values.aksOperator.image.tag }}' + imagePullPolicy: IfNotPresent + env: + - name: HTTP_PROXY + value: {{ .Values.httpProxy }} + - name: HTTPS_PROXY + value: {{ .Values.httpsProxy }} + - name: NO_PROXY + value: {{ .Values.noProxy }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL +{{- if .Values.additionalTrustedCAs }} + # aks-operator mounts the additional CAs in two places: + volumeMounts: + # This directory is owned by the aks-operator user so c_rehash works here. + - mountPath: /etc/rancher/ssl/ca-additional.pem + name: tls-ca-additional-volume + subPath: ca-additional.pem + readOnly: true + # This directory is root-owned so c_rehash doesn't work here, + # but the cert is here in case update-ca-certificates is called in the future or by the OS. + - mountPath: /etc/pki/trust/anchors/ca-additional.pem + name: tls-ca-additional-volume + subPath: ca-additional.pem + readOnly: true + volumes: + - name: tls-ca-additional-volume + secret: + defaultMode: 0400 + secretName: tls-ca-additional + {{- end }} diff --git a/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml new file mode 100644 index 0000000000..9c40a152f5 --- /dev/null +++ b/charts/rancher-aks-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: cattle-system + name: aks-operator diff --git a/charts/rancher-aks-operator/104.1.0+up1.9.1/values.yaml b/charts/rancher-aks-operator/104.1.0+up1.9.1/values.yaml new file mode 100644 index 0000000000..fd450ecbce --- /dev/null +++ b/charts/rancher-aks-operator/104.1.0+up1.9.1/values.yaml @@ -0,0 +1,23 @@ +global: + cattle: + systemDefaultRegistry: "" + +aksOperator: + image: + repository: rancher/aks-operator + tag: v1.9.1 + +httpProxy: "" +httpsProxy: "" +noProxy: "" +additionalTrustedCAs: false + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +## PriorityClassName assigned to deployment. +priorityClassName: "" diff --git a/index.yaml b/index.yaml index b1a987e3e6..dcc17b2093 100755 --- a/index.yaml +++ b/index.yaml @@ -5400,6 +5400,30 @@ entries: - assets/prometheus-federator/prometheus-federator-0.1.0.tgz version: 0.1.0 rancher-aks-operator: + - annotations: + catalog.cattle.io/auto-install: rancher-aks-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: aksclusterconfigs.aks.cattle.io/v1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-aks-operator + catalog.cattle.io/scope: management + apiVersion: v2 + appVersion: 1.9.1 + created: "2024-08-17T19:01:46.670697843-03:00" + description: A Helm chart for provisioning AKS clusters + digest: 03fe48b31e806f5e0938cba3d8c4c7fb7a9f9953807c2db4848c6bde789ef4af + home: https://github.com/rancher/aks-operator + name: rancher-aks-operator + sources: + - https://github.com/rancher/aks-operator + urls: + - assets/rancher-aks-operator/rancher-aks-operator-104.1.0+up1.9.1.tgz + version: 104.1.0+up1.9.1 - annotations: catalog.cattle.io/auto-install: rancher-aks-operator-crd=match catalog.cattle.io/certified: rancher diff --git a/release.yaml b/release.yaml index d1bf5af678..1f881085b2 100644 --- a/release.yaml +++ b/release.yaml @@ -1,2 +1,4 @@ +rancher-aks-operator: + - 104.1.0+up1.9.1 rancher-webhook: - 104.0.1+up0.5.1 From 1c50c70e538d66744c21873278b21b1b49b15a30 Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:02:02 -0300 Subject: [PATCH 04/14] release chart: rancher-aks-operator-crd - version: 104.1.0+up1.9.1 --- ...ncher-aks-operator-crd-104.1.0+up1.9.1.tgz | Bin 0 -> 1249 bytes .../104.1.0+up1.9.1/Chart.yaml | 12 + .../104.1.0+up1.9.1/templates/crds.yaml | 211 ++++++++++++++++++ index.yaml | 16 ++ release.yaml | 2 + 5 files changed, 241 insertions(+) create mode 100644 assets/rancher-aks-operator-crd/rancher-aks-operator-crd-104.1.0+up1.9.1.tgz create mode 100644 charts/rancher-aks-operator-crd/104.1.0+up1.9.1/Chart.yaml create mode 100644 charts/rancher-aks-operator-crd/104.1.0+up1.9.1/templates/crds.yaml diff --git a/assets/rancher-aks-operator-crd/rancher-aks-operator-crd-104.1.0+up1.9.1.tgz b/assets/rancher-aks-operator-crd/rancher-aks-operator-crd-104.1.0+up1.9.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..fdb23e22760a0ed49e2a859551cb4febdda30d39 GIT binary patch literal 1249 zcmV<71RnbziwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI;$ZyUE0^;w^S$o2P=ys8zu)lIhBz(|@3QIZ0^jmYteT`oy* zhO(8S-@Vvf$#JEXBHNUK2A+!{lKUQKIP>_&0j!*1=t4nV=P>}g(3L?QU(6tIZvmw_ zda7kvmYog;_1`SZ*8gUwC)rVdaQgb}_1WO0KRC+zr&;#;NMuiD-oqj>grn@qT3Csq2+8s*_tgkhyp;+ch>#&(t3hhw5;t=sw>ktbik_U-H z(KL2xL5yYVU`In?w2il|y&glUnYwqQ{(qybayQgEI-o%y>{b)F^I{|8JK*(a45XbM ziun&6@c!;+zxPwG-%&_1XwP-i=Fl-6sRsppt>6xMloehcT=ezudz}r)lCPQT=Mn0$0MkNN_tMM-e*YDy zTaS}XpSF245H`Q<2;l<~hB^Uf7mY^IP+Wr{>_+R^yx^U362%@t`?tgKhFZEO{$uhu@UGKf4o2f|Omtak}vqcJcw zI24tfZ*=pba)~%-o43HapueEH@*lwFo5VtB#^w>_^@k zEo(LV;38|AKayeUoI$W_y}I-+Fse<^U0)S(ioqfyt#mt~*Y#Oyq)Kf+5eAz$xr_sK z4hF2mFezeM=zL_sELcnW-G!o-+BfxXacGv*C0K%m9Mx5=M!ZOxa;3AHT}YkD7Wu}7 zVr*irljh?JxH&VV1a=C?&Y6eoPTTj=#$XQGz*HN}i$9#*Hf#sOUS93t-Gh*}?~9E| z7j4UK_+SQY8T0z~xM^rBkWpkekziWW^TB-WsoGcxw-?XgRtdLbr?xJ2I+jTcd5Z`= zm}W;dmD)Z_$ecQ`Bkj9dQU<5+9Za!JT^a+W>bnz|@i#F^x$vI^OOIV|!dPA&4) zkxnKIl0xF5iHXo^_YdmzJtCUdl;_ zLoM72_?>GmvnjEux!9*(K%&_=PK}mtG3mLV>e5b$$dI?}bo*}b&+y{asxgr;jEHn@ zpM2A7o!eXoj$qz5_qW3#A4u%BM2;9Z(!MXO*Pu-d_$v}Y+v)rX@-_oXD?L+?Ki7A# zme;69i)CvRHyZ25b9E1#*o7)!_gdm~rD1nbUap1s>+fg#U)hVj*o(c`_hkPB00960 LJFJ}Q03-ka$5nIO literal 0 HcmV?d00001 diff --git a/charts/rancher-aks-operator-crd/104.1.0+up1.9.1/Chart.yaml b/charts/rancher-aks-operator-crd/104.1.0+up1.9.1/Chart.yaml new file mode 100644 index 0000000000..fc0e712bdb --- /dev/null +++ b/charts/rancher-aks-operator-crd/104.1.0+up1.9.1/Chart.yaml @@ -0,0 +1,12 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/release-name: rancher-aks-operator-crd +apiVersion: v2 +appVersion: 1.9.1 +description: AKS Operator CustomResourceDefinitions +name: rancher-aks-operator-crd +version: 104.1.0+up1.9.1 diff --git a/charts/rancher-aks-operator-crd/104.1.0+up1.9.1/templates/crds.yaml b/charts/rancher-aks-operator-crd/104.1.0+up1.9.1/templates/crds.yaml new file mode 100644 index 0000000000..c4fcdfac05 --- /dev/null +++ b/charts/rancher-aks-operator-crd/104.1.0+up1.9.1/templates/crds.yaml @@ -0,0 +1,211 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + helm.sh/resource-policy: keep + name: aksclusterconfigs.aks.cattle.io +spec: + group: aks.cattle.io + names: + kind: AKSClusterConfig + plural: aksclusterconfigs + shortNames: + - akscc + singular: aksclusterconfig + preserveUnknownFields: false + scope: Namespaced + versions: + - name: v1 + schema: + openAPIV3Schema: + properties: + spec: + properties: + authBaseUrl: + nullable: true + type: string + authorizedIpRanges: + items: + nullable: true + type: string + nullable: true + type: array + azureCredentialSecret: + nullable: true + type: string + baseUrl: + nullable: true + type: string + clusterName: + nullable: true + type: string + dnsPrefix: + nullable: true + type: string + dnsServiceIp: + nullable: true + type: string + dockerBridgeCidr: + nullable: true + type: string + httpApplicationRouting: + nullable: true + type: boolean + imported: + type: boolean + kubernetesVersion: + nullable: true + type: string + linuxAdminUsername: + nullable: true + type: string + loadBalancerSku: + nullable: true + type: string + logAnalyticsWorkspaceGroup: + nullable: true + type: string + logAnalyticsWorkspaceName: + nullable: true + type: string + managedIdentity: + nullable: true + type: boolean + monitoring: + nullable: true + type: boolean + networkPlugin: + nullable: true + type: string + networkPolicy: + nullable: true + type: string + nodePools: + items: + properties: + availabilityZones: + items: + nullable: true + type: string + nullable: true + type: array + count: + nullable: true + type: integer + enableAutoScaling: + nullable: true + type: boolean + maxCount: + nullable: true + type: integer + maxPods: + nullable: true + type: integer + maxSurge: + nullable: true + type: string + minCount: + nullable: true + type: integer + mode: + nullable: true + type: string + name: + nullable: true + type: string + nodeLabels: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + nodeTaints: + items: + nullable: true + type: string + nullable: true + type: array + orchestratorVersion: + nullable: true + type: string + osDiskSizeGB: + nullable: true + type: integer + osDiskType: + nullable: true + type: string + osType: + nullable: true + type: string + vmSize: + nullable: true + type: string + vnetSubnetID: + nullable: true + type: string + type: object + nullable: true + type: array + nodeResourceGroup: + nullable: true + type: string + outboundType: + nullable: true + type: string + podCidr: + nullable: true + type: string + privateCluster: + nullable: true + type: boolean + privateDnsZone: + nullable: true + type: string + resourceGroup: + nullable: true + type: string + resourceLocation: + nullable: true + type: string + serviceCidr: + nullable: true + type: string + sshPublicKey: + nullable: true + type: string + subnet: + nullable: true + type: string + tags: + additionalProperties: + nullable: true + type: string + nullable: true + type: object + userAssignedIdentity: + nullable: true + type: string + virtualNetwork: + nullable: true + type: string + virtualNetworkResourceGroup: + nullable: true + type: string + type: object + status: + properties: + failureMessage: + nullable: true + type: string + phase: + nullable: true + type: string + rbacEnabled: + nullable: true + type: boolean + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/index.yaml b/index.yaml index dcc17b2093..fbc1977231 100755 --- a/index.yaml +++ b/index.yaml @@ -5713,6 +5713,22 @@ entries: - assets/rancher-aks-operator/rancher-aks-operator-101.0.0+up1.0.7.tgz version: 101.0.0+up1.0.7 rancher-aks-operator-crd: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/release-name: rancher-aks-operator-crd + apiVersion: v2 + appVersion: 1.9.1 + created: "2024-08-17T19:02:00.797827553-03:00" + description: AKS Operator CustomResourceDefinitions + digest: 0782ca81fa121007fdadf089b2a6bd20224203f8516821b9dcd1ac732ae9c146 + name: rancher-aks-operator-crd + urls: + - assets/rancher-aks-operator-crd/rancher-aks-operator-crd-104.1.0+up1.9.1.tgz + version: 104.1.0+up1.9.1 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/release.yaml b/release.yaml index 1f881085b2..c70e6dc5a4 100644 --- a/release.yaml +++ b/release.yaml @@ -1,4 +1,6 @@ rancher-aks-operator: - 104.1.0+up1.9.1 +rancher-aks-operator-crd: + - 104.1.0+up1.9.1 rancher-webhook: - 104.0.1+up0.5.1 From 1b69901546b507620c7dbdae8a7bdbc9ee77e021 Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:02:25 -0300 Subject: [PATCH 05/14] release chart: rancher-gke-operator - version: 104.1.0+up1.9.1 --- .../rancher-gke-operator-104.1.0+up1.9.1.tgz | Bin 0 -> 2140 bytes .../104.1.0+up1.9.1/Chart.yaml | 20 +++++ .../104.1.0+up1.9.1/templates/NOTES.txt | 4 + .../104.1.0+up1.9.1/templates/_helpers.tpl | 25 +++++++ .../templates/clusterrole.yaml | 15 ++++ .../templates/clusterrolebinding.yaml | 13 ++++ .../104.1.0+up1.9.1/templates/deployment.yaml | 69 ++++++++++++++++++ .../templates/serviceaccount.yaml | 5 ++ .../104.1.0+up1.9.1/values.yaml | 23 ++++++ index.yaml | 24 ++++++ release.yaml | 2 + 11 files changed, 200 insertions(+) create mode 100644 assets/rancher-gke-operator/rancher-gke-operator-104.1.0+up1.9.1.tgz create mode 100644 charts/rancher-gke-operator/104.1.0+up1.9.1/Chart.yaml create mode 100644 charts/rancher-gke-operator/104.1.0+up1.9.1/templates/NOTES.txt create mode 100644 charts/rancher-gke-operator/104.1.0+up1.9.1/templates/_helpers.tpl create mode 100644 charts/rancher-gke-operator/104.1.0+up1.9.1/templates/clusterrole.yaml create mode 100644 charts/rancher-gke-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml create mode 100644 charts/rancher-gke-operator/104.1.0+up1.9.1/templates/deployment.yaml create mode 100644 charts/rancher-gke-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml create mode 100644 charts/rancher-gke-operator/104.1.0+up1.9.1/values.yaml diff --git a/assets/rancher-gke-operator/rancher-gke-operator-104.1.0+up1.9.1.tgz b/assets/rancher-gke-operator/rancher-gke-operator-104.1.0+up1.9.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..c401a50d9a0fcf29bba639ad07bcaeb168aebe58 GIT binary patch literal 2140 zcmV-i2&4BOiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PGrnZ`-)Ff9q2`I5%XwRkG|j&YiFh$kOg^xLy(@-EGC8C}`?g z;!KM=l5*;~{_X=wS(a=$&T?I{VSfMErXJrf@%^MF$!LnwPbTP#93|00b}v#QbucGW z{^CnO7>40+FtDFt7;b*{1}D82y}|JG?DTAKGVH$yd#C-A{tF1d2=_fuC{5&x@K^KN zRPKKSNR|mrG!vPMJOD~G;UWnr(VAnxM3)p=_$*VJa2`S1aq+2)UrmXoX)6JWQnN9` zxZ2%{ma;g;EP{@f1$J6dCdCN-8A`=O7Qyi!UqLVEp9G;F!XKa)ob=4s#R8+ED+of~(9{Cig2_-NV609W*I?EFH?uR!}T0(iLFp{NO z=PK%U6QD_GzdygJU6q2HfJpaMeDwFoYLC_1r-xs-4=D8j7iJ&$9&j>G2 zeX#_vC;o?L+wp&Jc8LE^0tpu*!pqRFIht<(E;zo%F)6sd!GtL-=Mi)|o|jDUsyrtK zmrY4hZjzV_#k4S(t-fZEG)W?uITr(naa1G`j0sohdB$h2rTFAHSr1 z4B_vji6QaDxmr;49gQ`PFIR><4%Q5 z)0O*H*?zHrz_keHRSf{krT4m?|KFudReRUTUo}(zSc<7xxo`^?wkm>)8x{P&B;aR; zJ^ueOMV_NnfzBUa3he9udMBqF{(m;?4-fwT6tGxyzlIr`Mxao`m~qte9A8b1S!jw8 zeBE6xJ#Vq_A;vMw5IU|n_!ztD;G-&#lW&y`zq&kAmrMNBmo8^_CN6>lmOF?*N(=x4MsIua5GBk^(b;sPG^xTL0 z0DECi{4X6t3XYF&2lv%~!(rHr|NZdv#XeO;MAWXkxlQH{iG6!M)U2CXqsB=4dRVSTN|gX;oKgcMIL{7o?WGhF1A>g zygq#Kkos`{AF(WES@MW5u+RSogW-n%_rt^d=V{=<-o6zm{^ZU>OBi@~91t9DaBOz2 z+~yuBJb>+J)f#$KG5QBmZ3n?_%PqL}d!*xn$% zwNqQS0MNJ_TX!wV#Q6Q{ke0h^A{yWgLVHL7tOPW$G2UGO%P246UENRspCMyejG2aS zV7mpblXH(ji}z&8+c7@FCN0xWEtjQmjZyIq*%}SwKJn_UYpZm1ggwHkMwGp53$X?^ zB-ol?uL-t|wikV13a7%Vl&wt|kdAm&Z+6 zt_#ku1!r^~!C%IgLSIW%X!D{2A`??~c6@t5^J=kxHV*b7e6EHi_5uc$%g%?25N5Nr zsaMAO{@uIlkJmR>e}7*+s)iReR@HUT`YkqT+&++q+DYZ|>H#Fmo2UBzou>(aa4zny zC7Ush3BFO3aN;K7?tW^GDUrli8K2(>q5sS{x)TwBmPH*cU(t%UNl=oL5#vlVRCOT$ zVkz?GiVx>+-)?$;+f7!El7)Eo;puxCMC_xFJA0?(lrFO)oAVrCRSJ%->cujN~K^HZxF8!6_ zT}u45)Io0l{jmmjA~aWi1J8FVG*DGBaxCtrxO%}`ue4ozDTMZ&3F?~00#$abt;Sa2 zmm8Eug|-HxD7B$uaLoIlL?O7w(Wq4Z4~Lq%&Y)4kImY(Ir3m9f7ZO3pmHDr3?>B5d zVO?#`OxIXgNcG=gUPn%C2b~9ScB6(3KXS3{M-gKL;UEl~lG+`Y?F_s|8hY+RZwKtD z|I3U{TtAsQ;e?8h`3qmHr#u@@DzJ= 1.23.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: gkeclusterconfigs.gke.cattle.io/v1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-gke-operator + catalog.cattle.io/scope: management +apiVersion: v2 +appVersion: 1.9.1 +description: A Helm chart for provisioning GKE clusters +home: https://github.com/rancher/gke-operator +name: rancher-gke-operator +sources: +- https://github.com/rancher/gke-operator +version: 104.1.0+up1.9.1 diff --git a/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/NOTES.txt b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/NOTES.txt new file mode 100644 index 0000000000..238173d1bd --- /dev/null +++ b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/NOTES.txt @@ -0,0 +1,4 @@ +You have deployed the Rancher GKE operator +Version: {{ .Chart.AppVersion }} +Description: This operator provisions GKE clusters +from GKEClusterConfig CRs. diff --git a/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/_helpers.tpl b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/_helpers.tpl new file mode 100644 index 0000000000..de3b332f6a --- /dev/null +++ b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/_helpers.tpl @@ -0,0 +1,25 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} + diff --git a/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/clusterrole.yaml b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/clusterrole.yaml new file mode 100644 index 0000000000..7c352696ee --- /dev/null +++ b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/clusterrole.yaml @@ -0,0 +1,15 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: gke-operator + namespace: cattle-system +rules: + - apiGroups: [''] + resources: ['secrets'] + verbs: ['get', 'list', 'create', 'watch'] + - apiGroups: ['gke.cattle.io'] + resources: ['gkeclusterconfigs'] + verbs: ['get', 'list', 'update', 'watch'] + - apiGroups: ['gke.cattle.io'] + resources: ['gkeclusterconfigs/status'] + verbs: ['update'] diff --git a/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml new file mode 100644 index 0000000000..e2af390c71 --- /dev/null +++ b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: gke-operator + namespace: cattle-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: gke-operator +subjects: +- kind: ServiceAccount + name: gke-operator + namespace: cattle-system diff --git a/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/deployment.yaml b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/deployment.yaml new file mode 100644 index 0000000000..731fa1d4c2 --- /dev/null +++ b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/deployment.yaml @@ -0,0 +1,69 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: gke-config-operator + namespace: cattle-system +spec: + replicas: 1 + selector: + matchLabels: + ke.cattle.io/operator: gke + template: + metadata: + labels: + ke.cattle.io/operator: gke + spec: + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + serviceAccountName: gke-operator + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} + securityContext: + fsGroup: 1007 + runAsUser: 1007 + containers: + - name: rancher-gke-operator + image: '{{ template "system_default_registry" $ }}{{ $.Values.gkeOperator.image.repository }}:{{ $.Values.gkeOperator.image.tag }}' + imagePullPolicy: IfNotPresent + args: ["-debug={{ .Values.gkeOperator.debug | default false }}"] + env: + - name: HTTP_PROXY + value: {{ .Values.httpProxy }} + - name: HTTPS_PROXY + value: {{ .Values.httpsProxy }} + - name: NO_PROXY + value: {{ .Values.noProxy }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL +{{- if .Values.additionalTrustedCAs }} + # gke-operator mounts the additional CAs in two places: + volumeMounts: + # This directory is owned by the gke-operator user so c_rehash works here. + - mountPath: /etc/rancher/ssl/ca-additional.pem + name: tls-ca-additional-volume + subPath: ca-additional.pem + readOnly: true + # This directory is root-owned so c_rehash doesn't work here, + # but the cert is here in case update-ca-certificates is called in the future or by the OS. + - mountPath: /etc/pki/trust/anchors/ca-additional.pem + name: tls-ca-additional-volume + subPath: ca-additional.pem + readOnly: true + volumes: + - name: tls-ca-additional-volume + secret: + defaultMode: 0400 + secretName: tls-ca-additional + {{- end }} diff --git a/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml new file mode 100644 index 0000000000..ba52af6280 --- /dev/null +++ b/charts/rancher-gke-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: cattle-system + name: gke-operator diff --git a/charts/rancher-gke-operator/104.1.0+up1.9.1/values.yaml b/charts/rancher-gke-operator/104.1.0+up1.9.1/values.yaml new file mode 100644 index 0000000000..29b150636c --- /dev/null +++ b/charts/rancher-gke-operator/104.1.0+up1.9.1/values.yaml @@ -0,0 +1,23 @@ +global: + cattle: + systemDefaultRegistry: "" + +gkeOperator: + image: + repository: rancher/gke-operator + tag: v1.9.1 + debug: false + +httpProxy: "" +httpsProxy: "" +noProxy: "" +additionalTrustedCAs: false +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +## PriorityClassName assigned to deployment. +priorityClassName: "" diff --git a/index.yaml b/index.yaml index fbc1977231..4e1e185839 100755 --- a/index.yaml +++ b/index.yaml @@ -9147,6 +9147,30 @@ entries: - assets/rancher-gatekeeper-crd/rancher-gatekeeper-crd-101.0.0+up3.9.0.tgz version: 101.0.0+up3.9.0 rancher-gke-operator: + - annotations: + catalog.cattle.io/auto-install: rancher-gke-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: gkeclusterconfigs.gke.cattle.io/v1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-gke-operator + catalog.cattle.io/scope: management + apiVersion: v2 + appVersion: 1.9.1 + created: "2024-08-17T19:02:23.200891469-03:00" + description: A Helm chart for provisioning GKE clusters + digest: 5e4597e7e7ce9eac0bac0e25af2aab589ce522a7f5ec4c9faaa0fc342ac70765 + home: https://github.com/rancher/gke-operator + name: rancher-gke-operator + sources: + - https://github.com/rancher/gke-operator + urls: + - assets/rancher-gke-operator/rancher-gke-operator-104.1.0+up1.9.1.tgz + version: 104.1.0+up1.9.1 - annotations: catalog.cattle.io/auto-install: rancher-gke-operator-crd=match catalog.cattle.io/certified: rancher diff --git a/release.yaml b/release.yaml index c70e6dc5a4..e8215b7f90 100644 --- a/release.yaml +++ b/release.yaml @@ -2,5 +2,7 @@ rancher-aks-operator: - 104.1.0+up1.9.1 rancher-aks-operator-crd: - 104.1.0+up1.9.1 +rancher-gke-operator: + - 104.1.0+up1.9.1 rancher-webhook: - 104.0.1+up0.5.1 From a396272ac24f9e817a371fba2a479f2c14862e03 Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:02:38 -0300 Subject: [PATCH 06/14] release chart: rancher-gke-operator-crd - version: 104.1.0+up1.9.1 --- ...ncher-gke-operator-crd-104.1.0+up1.9.1.tgz | Bin 0 -> 1485 bytes .../104.1.0+up1.9.1/Chart.yaml | 12 + .../104.1.0+up1.9.1/templates/crds.yaml | 272 ++++++++++++++++++ index.yaml | 16 ++ release.yaml | 2 + 5 files changed, 302 insertions(+) create mode 100644 assets/rancher-gke-operator-crd/rancher-gke-operator-crd-104.1.0+up1.9.1.tgz create mode 100644 charts/rancher-gke-operator-crd/104.1.0+up1.9.1/Chart.yaml create mode 100644 charts/rancher-gke-operator-crd/104.1.0+up1.9.1/templates/crds.yaml diff --git a/assets/rancher-gke-operator-crd/rancher-gke-operator-crd-104.1.0+up1.9.1.tgz b/assets/rancher-gke-operator-crd/rancher-gke-operator-crd-104.1.0+up1.9.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..254506252882a22257f365cdd76913f3aec9727f GIT binary patch literal 1485 zcmV;;1v2^{iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI>%a~io4_nA+j%Jn_);1Kg3H$uEAmp5K2Y_jJ@Y6dMDNhN8p z$<}`NEsX#>c>Vzcsoiy7C?rjHtGj=#R?irabdIJSFR-mN8gRs~MWjiPAxH@bcsU37cb@A~ihy|?}7BI>^D_xl$lI$ClKO05HP5gjdScXNLe z0x6XP$Cb2$79kWI2o-lII47{f)g?va_>3bPkaeu&E}L`4P!7l&XHtBVyF@~QRs+QW z34?9BvJR8n#mWwd;4*#8oz-X(?reLz>c02Y#j}AT*j#Y^YYmiA=;otv&1iQA=QKYiKAe4KxQB;wg|CQX&jLIP4Z(cLe{9y zB(>KjSayRbI>!Wp3WO+)ayY*I`gZc&uovpV>i9<6KpQhXQT{qlkUFKgP%c<#cbX8H z3IS7r1L9Nqi|Jy{o>2NnS>6;OZsjd9RZ1Yp7c0W7n*NT|?M$vsKV)nhUyW%zSB8I6 z(t#K&HcXwe6a<$!hN<2HA#>;S&kERk5FqKnY$Un|WftQMGewT7W>js`TfOX!I5T@2 zHL$kMa2e;b_L1Kx+bj>E`2-STWH*wURdy!d;i}=7Sl}vO`x=}pcHzknpN@Zt)1MbI z4SFVk{w|%Ok?7D4g`UHK0`fySRw@=aGRROm4q}4TplfmuJkiRyyv$Xm7uQ1}6wMC4 z0M>>haR;XFg`$g7h2>h-1gVk?%<4197*B}!?W1OpZ1)hJ*%+u zdBbk~a7rnu#alfT9Bh8TA918Dwh3rc**2IT1WZxnXbg;H)i8*0DUd5IS8BIfdgmHt zlbv#u;trD^r7IW%s~4)qF_-ZqM1GUbOMpv<5+udnvVK9c%(L1wby+2e>^^{~={l8e zGEM<(3cXp)dPhLOD#JJT0N@}gW&E zG89EOMJ73-B=pDrSgE|6TnL3K7(mtauVyUPfm>;q1gffh0wwTxuNaP0Dsw90U2Z-R z##t}7fE$;MajV1{ExFk?XzHm_?gO`ryTs<+755ZL_DFAw3IB#4r^oxn^ZM1VJe&4B zff&y#vZ%;9K`={H#uMLAG^moCrcol&5)KlFwh=WBlRsu zLc{V$ieG|AO963O1#0ElMnkMpV)l*>;A~pC4t%bPJmX4l-J@sy13})X$uxGrjQ^s%X*+@Fw nd=j#?#@c4&k3Y}$`O_=C(ks2vzn1 Date: Sat, 17 Aug 2024 19:02:51 -0300 Subject: [PATCH 07/14] release chart: rancher-eks-operator - version: 104.1.0+up1.9.1 --- .../rancher-eks-operator-104.1.0+up1.9.1.tgz | Bin 0 -> 2109 bytes .../104.1.0+up1.9.1/Chart.yaml | 20 ++++++ .../104.1.0+up1.9.1/templates/NOTES.txt | 4 ++ .../104.1.0+up1.9.1/templates/_helpers.tpl | 25 +++++++ .../templates/clusterrole.yaml | 15 ++++ .../templates/clusterrolebinding.yaml | 13 ++++ .../104.1.0+up1.9.1/templates/deployment.yaml | 68 ++++++++++++++++++ .../templates/serviceaccount.yaml | 5 ++ .../104.1.0+up1.9.1/values.yaml | 22 ++++++ index.yaml | 24 +++++++ release.yaml | 2 + 11 files changed, 198 insertions(+) create mode 100644 assets/rancher-eks-operator/rancher-eks-operator-104.1.0+up1.9.1.tgz create mode 100644 charts/rancher-eks-operator/104.1.0+up1.9.1/Chart.yaml create mode 100644 charts/rancher-eks-operator/104.1.0+up1.9.1/templates/NOTES.txt create mode 100644 charts/rancher-eks-operator/104.1.0+up1.9.1/templates/_helpers.tpl create mode 100644 charts/rancher-eks-operator/104.1.0+up1.9.1/templates/clusterrole.yaml create mode 100644 charts/rancher-eks-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml create mode 100644 charts/rancher-eks-operator/104.1.0+up1.9.1/templates/deployment.yaml create mode 100644 charts/rancher-eks-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml create mode 100644 charts/rancher-eks-operator/104.1.0+up1.9.1/values.yaml diff --git a/assets/rancher-eks-operator/rancher-eks-operator-104.1.0+up1.9.1.tgz b/assets/rancher-eks-operator/rancher-eks-operator-104.1.0+up1.9.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..712a5e5225082c726233eb116b608ed8c9a8b979 GIT binary patch literal 2109 zcmV-D2*URtiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PH$#Z{xVp`&qwY;M{{ey{=@*agsZsTOiGDd&TV~L9)Geaab&9 zYHYElMIDE7Hud?x7o=ocvgJ6QQ>IOD z$0qXCQ$QGo;Yq*me#0~y1-+vn^h5X^M8Q#H9}ionW^96# zGmbHogFfAn!AUE!q8OyeiZ88ibJP=I$X{Z;z7<)bZmAtxtEotk{Lxg$fMepaAcLB# zY$!$);FxOI)2NlmLhB9Ld%?Gr=)E8cw~MY(A|v#z3fecYbsBM%V+<3Pu@O!%Gak#u zj|&E-J&)!2@^2J;8$@1$#I?wc8#;sUP)>kbR{}$&!D+&xi);k%zQ2J=6Xd1Ja+VsC zQ{3&2gh`7*z|~|ScelapJ#vsLG)Ia(|H0IjDviQ^5C!3Hi@X%(r493$pw<6RnJkc= zECB5A|KVxWTlfFRVSn%cp94lx4VbK4zmaI407~ch7Kf~m<{C$WjJ}JZ)A2kU(`9u| zEUuWaQ8h_pu1FYVF^m?_WQM>fFiKi!5&mD}&xO!P@cnW* za3SmDH(rJ1qAvXO$+HBnv`|`@yK~8iF4zPs5iqfI6U?Q$v*H9^zK-d1^tkl z5kN_}{L@+SgITii>{-FRzm}ET!XLq{kP=vuKqXum*j-NHN9x&AV1QEHR>QS; zZiDr$(qpMuLcmoaEh-RCF)3sj%uT8Y>l8hw<+_sHOW)-pHR7dAK8(@kMfHl+R?IGK zkE^+M0Ea{5CWg+1x~bN;!wWl)q4VzNg2~RhW?I>xDgi2aXy#C>in&4Qr4RQWcES$- zUm1p05+7dgLZWLo`oMDWC#{Oy)VX>`p*egFhfSMiJbC&xyJVOtHkPi|`t;;3 z_2KqE5LqI!(IeczF8lBIPuA?e7lr%!?^)o%*1q8={!pHW7B}#4KcFOD_ysbNC72ob1~yCJ zI=S*S81<1&WIM($uujXCQ}cPnT%&Wmg||k*xQo4d>DtO&9bpG^)bO$wZ7$Zr8V4Kg z>=nVbPWNoKb>e*9sV%X_8ZR8K$_#!ntAjD5D(*yKc)A?bMRrDiA=Hg=t}??!hI)Ch z{PsXnLU}g=hgPT6VZEn&@)gYIvl)D~kgj&o5;#i1>VgI4^Z0&T!$vTlA2xZpDx|zp zQt-PN{ye-;=1L=>i-#p(HeG3EA=`H!K3sjiy1x9|$K|VKuVFS@ZsYPYXQlKejhhD& zp{-OdE+0Umx;LuN-@5q#OiFcorNvZ89N|0SOtP|pUEVIOFg3E|GLv`LN|`?jiRDJd zV02MO%NMkgO%j~tY#^jC0;$dfK%!ON9P#1o{rh!eZMz4n3wqEvh%m8cNUo#5nhAD} z$iUnx$R*=-R;Ef86a2wVYqE1tHuMvrotwG?L7;9kOki;57HBM75NaR={IkZCQR+Hk z1Sx6^yt<5z!z*Ue7`kZq@{XQJb~*D`TnD-PSYrj{i7=A<2A*Gv&_JbPP%d#l#l;41 zY-zjnS}Eg~DyU1ED5UJrIEkIWuh%FI3gZ;UQ5#Fg;@JJ*j1bB?&x%xiHp6WiX3;p4 z5)-#^DZ;QYg+@?%q5jL8`xTpyMc3Ff)3q8_n*KA?Tau$qr}Kc7%g(@>9hGkN2bEw9 zVLuF;oVpno?F)E~sPWQy*>k~;{J)Cmtc>W7tO0h_|IyKU{U7yu`~KgvK;xsXMe4s+ nEw88lTRx;~$%I~7x;^Y+4|~|dHuz@%00960t+`Kz05AXm2kkDG literal 0 HcmV?d00001 diff --git a/charts/rancher-eks-operator/104.1.0+up1.9.1/Chart.yaml b/charts/rancher-eks-operator/104.1.0+up1.9.1/Chart.yaml new file mode 100644 index 0000000000..a5c11a0048 --- /dev/null +++ b/charts/rancher-eks-operator/104.1.0+up1.9.1/Chart.yaml @@ -0,0 +1,20 @@ +annotations: + catalog.cattle.io/auto-install: rancher-eks-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: eksclusterconfigs.eks.cattle.io/v1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-eks-operator + catalog.cattle.io/scope: management +apiVersion: v2 +appVersion: 1.9.1 +description: A Helm chart for provisioning EKS clusters +home: https://github.com/rancher/eks-operator +name: rancher-eks-operator +sources: +- https://github.com/rancher/eks-operator +version: 104.1.0+up1.9.1 diff --git a/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/NOTES.txt b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/NOTES.txt new file mode 100644 index 0000000000..23a1b4a8bf --- /dev/null +++ b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/NOTES.txt @@ -0,0 +1,4 @@ +You have deployed the Rancher EKS operator +Version: {{ .Chart.AppVersion }} +Description: This operator provisions EKS clusters +from EKSClusterConfig CRs. diff --git a/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/_helpers.tpl b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/_helpers.tpl new file mode 100644 index 0000000000..de3b332f6a --- /dev/null +++ b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/_helpers.tpl @@ -0,0 +1,25 @@ +{{/* vim: set filetype=mustache: */}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} + diff --git a/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/clusterrole.yaml b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/clusterrole.yaml new file mode 100644 index 0000000000..d0d561b6ea --- /dev/null +++ b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/clusterrole.yaml @@ -0,0 +1,15 @@ +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: eks-operator + namespace: cattle-system +rules: + - apiGroups: [''] + resources: ['secrets'] + verbs: ['get', 'list', 'create', 'watch'] + - apiGroups: ['eks.cattle.io'] + resources: ['eksclusterconfigs'] + verbs: ['get', 'list', 'update', 'watch'] + - apiGroups: ['eks.cattle.io'] + resources: ['eksclusterconfigs/status'] + verbs: ['update'] diff --git a/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml new file mode 100644 index 0000000000..2b1846353e --- /dev/null +++ b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/clusterrolebinding.yaml @@ -0,0 +1,13 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: eks-operator + namespace: cattle-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: eks-operator +subjects: +- kind: ServiceAccount + name: eks-operator + namespace: cattle-system diff --git a/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/deployment.yaml b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/deployment.yaml new file mode 100644 index 0000000000..27b1f58366 --- /dev/null +++ b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/deployment.yaml @@ -0,0 +1,68 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: eks-config-operator + namespace: cattle-system +spec: + replicas: 1 + selector: + matchLabels: + ke.cattle.io/operator: eks + template: + metadata: + labels: + ke.cattle.io/operator: eks + spec: + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + serviceAccountName: eks-operator + {{- if .Values.priorityClassName }} + priorityClassName: "{{.Values.priorityClassName}}" + {{- end }} + securityContext: + fsGroup: 1007 + runAsUser: 1007 + containers: + - name: eks-operator + image: '{{ template "system_default_registry" $ }}{{ $.Values.eksOperator.image.repository }}:{{ $.Values.eksOperator.image.tag }}' + imagePullPolicy: IfNotPresent + env: + - name: HTTP_PROXY + value: {{ .Values.httpProxy }} + - name: HTTPS_PROXY + value: {{ .Values.httpsProxy }} + - name: NO_PROXY + value: {{ .Values.noProxy }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL +{{- if .Values.additionalTrustedCAs }} + # eks-operator mounts the additional CAs in two places: + volumeMounts: + # This directory is owned by the eks-operator user so c_rehash works here. + - mountPath: /etc/rancher/ssl/ca-additional.pem + name: tls-ca-additional-volume + subPath: ca-additional.pem + readOnly: true + # This directory is root-owned so c_rehash doesn't work here, + # but the cert is here in case update-ca-certificates is called in the future or by the OS. + - mountPath: /etc/pki/trust/anchors/ca-additional.pem + name: tls-ca-additional-volume + subPath: ca-additional.pem + readOnly: true + volumes: + - name: tls-ca-additional-volume + secret: + defaultMode: 0400 + secretName: tls-ca-additional + {{- end }} diff --git a/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml new file mode 100644 index 0000000000..934de07e0d --- /dev/null +++ b/charts/rancher-eks-operator/104.1.0+up1.9.1/templates/serviceaccount.yaml @@ -0,0 +1,5 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: cattle-system + name: eks-operator diff --git a/charts/rancher-eks-operator/104.1.0+up1.9.1/values.yaml b/charts/rancher-eks-operator/104.1.0+up1.9.1/values.yaml new file mode 100644 index 0000000000..5c5688de8f --- /dev/null +++ b/charts/rancher-eks-operator/104.1.0+up1.9.1/values.yaml @@ -0,0 +1,22 @@ +global: + cattle: + systemDefaultRegistry: "" + +eksOperator: + image: + repository: rancher/eks-operator + tag: v1.9.1 + +httpProxy: "" +httpsProxy: "" +noProxy: "" +additionalTrustedCAs: false +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +## PriorityClassName assigned to deployment. +priorityClassName: "" diff --git a/index.yaml b/index.yaml index d3e498af53..98615766db 100755 --- a/index.yaml +++ b/index.yaml @@ -8231,6 +8231,30 @@ entries: - assets/rancher-csp-adapter/rancher-csp-adapter-1.0.0.tgz version: 1.0.0 rancher-eks-operator: + - annotations: + catalog.cattle.io/auto-install: rancher-eks-operator-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.23.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: eksclusterconfigs.eks.cattle.io/v1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-eks-operator + catalog.cattle.io/scope: management + apiVersion: v2 + appVersion: 1.9.1 + created: "2024-08-17T19:02:49.267692436-03:00" + description: A Helm chart for provisioning EKS clusters + digest: 5d425a6e740c06350f1d0a2a73e484431c4c4b32c0e19c58289ff4700e9f1398 + home: https://github.com/rancher/eks-operator + name: rancher-eks-operator + sources: + - https://github.com/rancher/eks-operator + urls: + - assets/rancher-eks-operator/rancher-eks-operator-104.1.0+up1.9.1.tgz + version: 104.1.0+up1.9.1 - annotations: catalog.cattle.io/auto-install: rancher-eks-operator-crd=match catalog.cattle.io/certified: rancher diff --git a/release.yaml b/release.yaml index 68536d0de1..cbcf882933 100644 --- a/release.yaml +++ b/release.yaml @@ -2,6 +2,8 @@ rancher-aks-operator: - 104.1.0+up1.9.1 rancher-aks-operator-crd: - 104.1.0+up1.9.1 +rancher-eks-operator: + - 104.1.0+up1.9.1 rancher-gke-operator: - 104.1.0+up1.9.1 rancher-gke-operator-crd: From a37c406a36b00d97a0d3bc2bf29ec52d465cb736 Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:03:03 -0300 Subject: [PATCH 08/14] release chart: rancher-eks-operator-crd - version: 104.1.0+up1.9.1 --- ...ncher-eks-operator-crd-104.1.0+up1.9.1.tgz | Bin 0 -> 1217 bytes .../104.1.0+up1.9.1/Chart.yaml | 12 + .../104.1.0+up1.9.1/templates/crds.yaml | 229 ++++++++++++++++++ index.yaml | 16 ++ release.yaml | 2 + 5 files changed, 259 insertions(+) create mode 100644 assets/rancher-eks-operator-crd/rancher-eks-operator-crd-104.1.0+up1.9.1.tgz create mode 100644 charts/rancher-eks-operator-crd/104.1.0+up1.9.1/Chart.yaml create mode 100644 charts/rancher-eks-operator-crd/104.1.0+up1.9.1/templates/crds.yaml diff --git a/assets/rancher-eks-operator-crd/rancher-eks-operator-crd-104.1.0+up1.9.1.tgz b/assets/rancher-eks-operator-crd/rancher-eks-operator-crd-104.1.0+up1.9.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..428c925447c1522b07205903ee80e88c1c8eb340 GIT binary patch literal 1217 zcmV;y1U~y8iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI=cQzN$z=Xw7M&%J)X2^%gzo41>A?J(EUn+v^n#Va;$ytXUZ z;c}h+@16Y-2+1x9WXS=8UKlK|K9W}Ytn3gNIYH{+lsncTfw$C=lpGExK)ySNOdsqj zaU91d{eJN`j^ow8@yYx6pw~Y+K0Q9|zwaL%#J!WacXS})osqYYz#ixz-Wh8(xECT| zjP>A^H9Uxfkl;bvv@5}Tja_9AC6ZTH3X_4TYNdADL?sEDfq3UB;Jex_1~Oy^5(lDO z?C_jDX0@9w4}?}Ge5=(uq)d74-0b@QwK9pl=Gxta8iBEsJ8%=lTE$1;)K?@{)(ph# zC<5nh{_S;t?)IVtS(0+TSo-*BB>t!#7sJ5bW?ztPAc<#qrHm?a8g0Ow-5|vMZm%2v zFSrtGU+=%M|2<|-gGWA;l<-bOaDV^zj*pK|R{H<+w0HW}|ND^Tq6eq&n@5xX$KB~q zoHx&`7fqE(28}fyW#}OR4>^CV(1{Qe)LEA&hg3b+aaJoiABZWUi-aiq1E(x?V2>oN zxl$>2amu$H9I->0+e^s?S8QKWmPRVP($|llM#IwHu&`ICoDKxK2CUHX#FD?bHPk8g z$x^3G8Z^-Qvyl*vkdbEirU&M)KNv|Fk7+S>)gURJ?g0kn(TFFtb^c(S zh8oEwb>WHMjLIOz^O_cKGYnUkrB=Bh8d-m}PcIa?>Z`xy4^k|JxG(9-OWrt_B5r@PW6z2)qKN1L5z;3~8(HK1G8B z9+Qj4A^GvfGcb^1^4pzL;`!N=LwsGjyS*#VyH Date: Sat, 17 Aug 2024 19:03:17 -0300 Subject: [PATCH 09/14] release chart: fleet - version: 104.0.1+up0.10.1 --- assets/fleet/fleet-104.0.1+up0.10.1.tgz | Bin 0 -> 6177 bytes charts/fleet/104.0.1+up0.10.1/Chart.yaml | 18 ++ charts/fleet/104.0.1+up0.10.1/README.md | 30 +++ .../104.0.1+up0.10.1/templates/_helpers.tpl | 22 ++ .../104.0.1+up0.10.1/templates/configmap.yaml | 26 ++ .../templates/deployment.yaml | 255 ++++++++++++++++++ .../templates/deployment_gitjob.yaml | 130 +++++++++ .../job_cleanup_clusterregistrations.yaml | 40 +++ .../104.0.1+up0.10.1/templates/rbac.yaml | 114 ++++++++ .../templates/rbac_gitjob.yaml | 133 +++++++++ .../104.0.1+up0.10.1/templates/service.yaml | 36 +++ .../templates/service_gitjob.yaml | 51 ++++ .../templates/serviceaccount.yaml | 12 + .../templates/serviceaccount_gitjob.yaml | 6 + charts/fleet/104.0.1+up0.10.1/values.yaml | 120 +++++++++ index.yaml | 22 ++ release.yaml | 2 + 17 files changed, 1017 insertions(+) create mode 100644 assets/fleet/fleet-104.0.1+up0.10.1.tgz create mode 100644 charts/fleet/104.0.1+up0.10.1/Chart.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/README.md create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/_helpers.tpl create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/configmap.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/deployment.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/deployment_gitjob.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/job_cleanup_clusterregistrations.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/rbac.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/rbac_gitjob.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/service.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/service_gitjob.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/serviceaccount.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/templates/serviceaccount_gitjob.yaml create mode 100644 charts/fleet/104.0.1+up0.10.1/values.yaml diff --git a/assets/fleet/fleet-104.0.1+up0.10.1.tgz b/assets/fleet/fleet-104.0.1+up0.10.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..69fdd29049f220f9b6cc4384f643715197eff963 GIT binary patch literal 6177 zcmV++7~ba}iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKBja~n63a6Zqk=%VtJlRV;xlx5k=N^-}Q7_T<6#G~ZRrna^e zaHdHj9s&~pLz%1SzhB{HUOA*FiISZh;Sbi}rO^#E8r_WsIEoO}-qC~z<O%B_Ww^}hsmd2K!5OL<^POC z3CgG10Pc|ghll%zRr&ww;BYJdpCi#J8Kai`0%IO$@wuEqF|^{Lbrbc62%M!OcSYKh#*nH1O<9K(ECWHafG>~LYv_SeA+oYIC!b$ z;)QAcesJ1>M&oX5a0U}`oFtq7z8>BFT+ z5GaFRETE&_LOI-!k6i>BT!9Vh0+UH2#g|r zoiRufb5`LJ4l>4oj^=sWv0bElxar1SIam43lxTPWreQyW;t|v*L5_3JQ1Xwa1qA;y7;4IXfrtuS~ zS&DHO3nU7z$y^hl1Rd+0pD@6ghN~t-LC8_E7YYKBNCW~A=do}3m~mw|JH!!5BE!k; zS7}$ejvKEY`z^r)k1- z*EEU@37Rgm%5~2k<9&-kd;hiH(*O3}?6zC^pRf1*_M!P`@9(z%qQBnQ&%<3`&VpS( zW&el=B=Wo==St6dtmP;&GK{oNt+ikeUM_d8oGyI%Zk~=o$kY<$K2G13B@vpsKT$J1FCCWng-+}vu2r*0YPGEjtS@uUZy zM|yui_)6e!2^Cn{vy9Pp__gP18H*JD^>0H&Ur;Wnnjb|(O3ed~1ikffH?^7^-;1j? z-N;eJW4XAFyeaA}q^=~yVKPp|tob;_8Acswd9mOz854!aI{N~Z-p=GD@0txH1+cRN z=f*-J5ghg3LmUe}Dl?7`eZfamZ=zaa2RzaPiJ`8gC`))Eqq*TONoE*o@haw^?PeZo z_+2*FdIb$(#-n746}Air)634;nBlHreW%sH5cSTKXt6foQuT?NXo(mneT`?w+W~Mr zb)a$Bk`0q%`#CChW2-_2CH=On+krhbjrR=kS%I3z*nwjz4BO1l#gP$Ko;RgqQSe4A z?tVuR5|+e;F+N2SqJWes%R}HrrnKh@HBe*j9;dj&%a$~&QHgoqQQLM|46l!ogb`)f zf&Ev~bZ3oSJwHOvmZ*o|3T}h~%!r_RElAK?r$r~1^f9-aH0pLe zHq-On1Z%DL{@L#hPTuv-F1x2!=SL@37nkRQ?%ST_9jyUpejINHOou&yGjillzTS`{Q~77NPM2pa!S?lm3+0JXiBel&7?kcA6>dp9?G-*`V+mup!A z)e2&!W@@d(C`86bYgVn?^>h`xG1}~cGNOf`mb(!rq1OMjji@d3V1i*1r9zTREJF0Y z*>m`%gKP?$Mv*E2w=^~318U8!=xWyDI~AO!tv_&-jJwUuRqUTkBzs-fszs z8r6}hMMFAaWpOAAs@&CGfb^+(cAGYrs`B4zGgA_8&>4J({NHaMzOKmsSNpAlt^9wE zR66QudmktZJ7CrOcO=&45ebPR9p@UzP5?7C*Gr2n=XBtAqi^0gt+P=p*&7{b+}uFQ zb}P0XA8v0OyD6~TwR}GaH#h0FlSA-x&-CqWr?!S7Ahcz`8AULOLO-ol&Y;lL@veAJY#vOHUZ!@Tw z7e=>tnE(yr9Vz3L)$~na0X2Yzp7dqaby>N#^~@}*Z%fN9tox?Xf%+!4xZEW3sV(a# zt59xNc8D!&T&{I{o0^09$X?@c!uf{*21x5zaY)8DWINVFk)m*WTMDQlaV+;TRVzP@ ztI@R@Rb}huhK?LujpOZY)BN4Mxhdt|+#n0Ju$3_e9dp8v`lB>SCUnakBf6m>aa^O? zL8f21h6N0Dib^n+L$RqE(_~Snq1B*@_&2gPjuGsccd^PHP@NiB2pY@b={a)%((%zr zV@xP3xK(x4Sx#N*<2>uW>s|D_N4>1XS?E6qKJ64T0Y(&~aDbz7uFE&R@@!1=UA{{E zm+2y@ITbCAM2g=Jr@h|g)zRtui_6~Ns(1E3?|biiSI526?$1?>wJNqY{L0wXVQ7zJ zYjFD8KREyA9Vn~>aPcSzXXooQcc-}bq&qz|Suq{`_gDS?;QWWH@vPordNaCv)jIq3DzuLixN z^RuIq)863fr}M#&y}`v=E9bu5KAIGJs#izJU*De{pZ1=Fki||nL`QCYET`zW*FQb~ z`Caeq@(F3HN2EYymAdpW)RuwbKa*)xQ~Wzn7HY6>3L0dg3mcCKFV^#IeQA`vyc=3^ zY=QA?Rm&C8%kV|k=Mu+W38i8{W@8a#jk9YhBe;+Y-^E)LsgJo(vZ!%oN?D%^)qyvy zH?6`HTf`l_RlI28yjWO-Y{;#lHpRA1*K9(wnQEV?8$&c zE*`_i+vGI`lJJ~G^8x4T2O6PW3t1Rk#yKgha1lg6Vlt!=RTO1e6AuNC%Q;Qxo}R86 zT^j)N&cs|6n>Jyp^ZHrHO9`yy)MD;Bs$30J7f7=RyPUs(c#-7_Tnam&2RDt53v6_a zjb}3feTCp$H4!`+Pi(XUWtvx{ECgSDrdHE)svTS1cWs3KZ|S~UeRQjjKB+#MW_@z~ z(e5A{Qy%Z3xiz8M`BoEpI!)+PZ}Vk0SATHc@4oF`>h1im@84cs^e!(?&fZ>JU7lZc z-}cTf*IJ3InUeT%X-(^Q4HTPfOcVNz`*KXC4;HC2`}Tjwq&?U;nr)9STO>;e!z+~mX23FFD~3x z%d6I1WGn0%3&ptrEizu66s*XprP4zrtSiqr(-NT~2Taj>iJ}ATR;yLce=B$ryMh8P z&1SRs`Kbe6w#lUB@n2VCs($6e4TOQMj{j=67URDTU%%SE|MVa;XVf~&9?C}!?~T4QX@O9_uL#u^2Emo1`K zr)R78nrEm-JEc zbiy6pPFU{ogcV*-SljdYaE~B7#48Ao@eJO%D{zMSY26Jh$EK~d|E+WM0ZWfR>K&XbU7YuEa<1*>T-5_?{r+T5 zzpel8Gf!3j->-al<-#bg+O*mAx5aM8K;jmm`s@j0it;kZ-^r6E5g~?EADI-bnlN zBk9XfPAT9KuJbmONFpsLn?Pb}HXtLOn$^P^^HQqhi3reDc=62(4`7C3SjboaV;)Sd zw9Nda(tNsIm)KobJ`kvV>BmCMUPxO9*wP_g>?2i&c;rwoWDF?_DI44Tyhf#HH8SCm8%p}P zwX(*j6arJ1F@}|#Yl+imTG>UUpKgs8dU^0Hm*Rf!UiW_nwY5(F+g#+AO?T*j2m9^) zh4;T+Z}q=tNfoiSIxy+c^2`NyIN4>w_sc4Z+1iXR$=dxDUB!s5U-?kl3kd~nC6{vb zFqeaidAI~zM5TI>e~z*Eb*+(nNPkY3+#m({zJG6^6-9h$9}RctC>x7edr}dVxROfW zjc*zo>sz4xxhLaRsOwD6SN1W+{O@b`Ta}N*!~Nb>qneY)%ofXxFG>c46*Ki-lh<2? zzja)$B*%UwaY#(X`?5{0^>2m`7fr22cCbH6w45iF0xy|$tKhl}JA6w!TBUQ;_MaME z3tgji7v?i%QOQ2FeYR073I^W-GOq6@Q|(+FoYUpda@9?fvqX8T341IlYp|%T z!Dh|0_4ctE6KlC}v8L8iA-ZvcDay& zaJbd~pC?t%e-|TXw>Lzd`-R|4f;;J1ckg4$8C6_RHg48F5?qLNDqROD<`-{-l#jFP zAM(wP#m%p`xn2CE?-i~PG|iudhuRboV^o#b+hV~L4|vpp%cFi_Q^>=y%NJ9Yzbjn2 z7gC|kR9OF7NHy?q^);1BUyTwcEJizhw)@-?`M*&Y&|UFAtyfj~f4Kj$wUz(Rk?!UH zSwk?Tx}Xykg}X&*5XnTTxS2iUn2L+^b3roHijW%dkX)!o?B)k3xz3%b5o<9wrq>sDo|JN@o_kY^$!xXoLb1i9*7Z3k0Vr0B4{k2oVoRl>HXC zh8J)q6=4c;i!*!Q-cp?sJK{kiQ5u_^vuK{ewD&;fx_dJ?yD&@?Pz5BC9L98p(qTkk zLdO#baV!vlk235uA~Py!4#{By_>lxEn!~jlJa^j(!?brti?7Ese;}wZYU!{BgryTy z2vdNO;8QK6H9CS^!;jgoe#6h*cc;6S9|Fw}auuN+yGv0S$pj z1J?0@;^~hUl;P9zKtWeegg}`@YS&GS9vfu8>ZVJkXxA_bl?qufx2TXLq$-_!OCc2% zovcqlvLrrznUl&%g)}Obs(4@s72vZzW24I zrY}(7Zwb}4rRTjx1rswLBbf69Le5?&n2;F)Rlc37m%8I$6RCi}(dmirxnVI}Y^nFW z^iyM05JHw3_)1MspkWhr&0&ZENhHEGg2b2zq7ZnZ;An6x&CmF2=`+>2qX<8`CFOtJ z@w{Jt`NjLvVr-sGAYo|j2}lV~Nw&XMt0}kkhHlfe=u_PrU%MW~wOPra{f(>86>=b!#J00960%wi{c0G= 1.18.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: clusters.fleet.cattle.io/v1alpha1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: fleet +apiVersion: v2 +appVersion: 0.10.1 +description: Fleet Manager - GitOps at Scale +icon: https://charts.rancher.io/assets/logos/fleet.svg +name: fleet +version: 104.0.1+up0.10.1 diff --git a/charts/fleet/104.0.1+up0.10.1/README.md b/charts/fleet/104.0.1+up0.10.1/README.md new file mode 100644 index 0000000000..2f2a4c302a --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/README.md @@ -0,0 +1,30 @@ +# Fleet Helm Chart + +Fleet is GitOps at scale. Fleet is designed to manage multiple clusters. + +## What is Fleet? + +* Cluster engine: Fleet is a container management and deployment engine designed to offer users more control on the local cluster and constant monitoring through GitOps. Fleet focuses not only on the ability to scale, but it also gives users a high degree of control and visibility to monitor exactly what is installed on the cluster. + +* Deployment management: Fleet can manage deployments from git of raw Kubernetes YAML, Helm charts, Kustomize, or any combination of the three. Regardless of the source, all resources are dynamically turned into Helm charts, and Helm is used as the engine to deploy all resources in the cluster. As a result, users can enjoy a high degree of control, consistency, and auditability of their clusters. + +## Introduction + +This chart deploys Fleet on a Kubernetes cluster. It also deploys some of its dependencies as subcharts. + +The documentation is centralized in the [doc website](https://fleet.rancher.io/). + +## Prerequisites + +Get helm if you don't have it. Helm 3 is just a CLI. + + +## Install Fleet + +Install the Fleet Helm charts (there are two because we separate out CRDs for ultimate flexibility.): + +``` +$ helm repo add fleet https://rancher.github.io/fleet-helm-charts/ +$ helm -n cattle-fleet-system install --create-namespace --wait fleet-crd fleet/fleet-crd +$ helm -n cattle-fleet-system install --create-namespace --wait fleet fleet/fleet +``` \ No newline at end of file diff --git a/charts/fleet/104.0.1+up0.10.1/templates/_helpers.tpl b/charts/fleet/104.0.1+up0.10.1/templates/_helpers.tpl new file mode 100644 index 0000000000..6cd96c3ace --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} \ No newline at end of file diff --git a/charts/fleet/104.0.1+up0.10.1/templates/configmap.yaml b/charts/fleet/104.0.1+up0.10.1/templates/configmap.yaml new file mode 100644 index 0000000000..a801cb6024 --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/configmap.yaml @@ -0,0 +1,26 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: fleet-controller +data: + config: | + { + "systemDefaultRegistry": "{{ template "system_default_registry" . }}", + "agentImage": "{{ template "system_default_registry" . }}{{.Values.agentImage.repository}}:{{.Values.agentImage.tag}}", + "agentImagePullPolicy": "{{ .Values.agentImage.imagePullPolicy }}", + "apiServerURL": "{{.Values.apiServerURL}}", + "apiServerCA": "{{b64enc .Values.apiServerCA}}", + "agentCheckinInterval": "{{.Values.agentCheckinInterval}}", + "agentTLSMode": "{{.Values.agentTLSMode}}", + "ignoreClusterRegistrationLabels": {{.Values.ignoreClusterRegistrationLabels}}, + "bootstrap": { + "paths": "{{.Values.bootstrap.paths}}", + "repo": "{{.Values.bootstrap.repo}}", + "secret": "{{.Values.bootstrap.secret}}", + "branch": "{{.Values.bootstrap.branch}}", + "namespace": "{{.Values.bootstrap.namespace}}", + "agentNamespace": "{{.Values.bootstrap.agentNamespace}}" + }, + "webhookReceiverURL": "{{.Values.webhookReceiverURL}}", + "githubURLPrefix": "{{.Values.githubURLPrefix}}" + } diff --git a/charts/fleet/104.0.1+up0.10.1/templates/deployment.yaml b/charts/fleet/104.0.1+up0.10.1/templates/deployment.yaml new file mode 100644 index 0000000000..bf3ebfd397 --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/deployment.yaml @@ -0,0 +1,255 @@ +{{- $shards := list (dict "id" "" "nodeSelector" dict) -}} +{{- $uniqueShards := list -}} +{{- if .Values.shards -}} + {{- range .Values.shards -}} + {{- if not (has .id $uniqueShards) -}} + {{- $shards = append $shards . -}} + {{- $uniqueShards = append $uniqueShards .id -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{ range $shard := $shards }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: "fleet-controller{{if $shard.id }}-shard-{{ $shard.id }}{{end}}" +spec: + selector: + matchLabels: + app: fleet-controller + template: + metadata: + labels: + app: fleet-controller + fleet.cattle.io/shard-id: "{{ $shard.id }}" + {{- if empty $shard.id }} + fleet.cattle.io/shard-default: "true" + {{- end }} + spec: + containers: + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if $.Values.clusterEnqueueDelay }} + - name: FLEET_CLUSTER_ENQUEUE_DELAY + value: {{ $.Values.clusterEnqueueDelay }} + {{- end }} + {{- if $.Values.proxy }} + - name: HTTP_PROXY + value: {{ $.Values.proxy }} + - name: HTTPS_PROXY + value: {{ $.Values.proxy }} + - name: NO_PROXY + value: {{ $.Values.noProxy }} + {{- end }} + {{- if $.Values.cpuPprof }} + - name: FLEET_CPU_PPROF_DIR + value: /tmp/pprof/ + {{- end }} + {{- if $.Values.cpuPprof }} + - name: FLEET_CPU_PPROF_PERIOD + value: {{ quote $.Values.cpuPprof.period }} + {{- end }} + {{- if $.Values.leaderElection.leaseDuration }} + - name: CATTLE_ELECTION_LEASE_DURATION + value: {{$.Values.leaderElection.leaseDuration}} + {{- end }} + {{- if $.Values.leaderElection.retryPeriod }} + - name: CATTLE_ELECTION_RETRY_PERIOD + value: {{$.Values.leaderElection.retryPeriod}} + {{- end }} + {{- if $.Values.leaderElection.renewDeadline }} + - name: CATTLE_ELECTION_RENEW_DEADLINE + value: {{$.Values.leaderElection.renewDeadline}} + {{- end }} + {{- if $.Values.debug }} + - name: CATTLE_DEV_MODE + value: "true" + {{- end }} + {{- if $.Values.controller.reconciler.workers.gitrepo }} + - name: GITREPO_RECONCILER_WORKERS + value: {{ quote $.Values.controller.reconciler.workers.gitrepo }} + {{- end }} + {{- if $.Values.controller.reconciler.workers.bundle }} + - name: BUNDLE_RECONCILER_WORKERS + value: {{ quote $.Values.controller.reconciler.workers.bundle }} + {{- end }} + {{- if $.Values.controller.reconciler.workers.bundledeployment }} + - name: BUNDLEDEPLOYMENT_RECONCILER_WORKERS + value: {{ quote $.Values.controller.reconciler.workers.bundledeployment }} + {{- end }} +{{- if $.Values.extraEnv }} +{{ toYaml $.Values.extraEnv | indent 8}} +{{- end }} + image: '{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}' + name: fleet-controller + imagePullPolicy: "{{ $.Values.image.imagePullPolicy }}" + {{- if $.Values.metrics.enabled }} + ports: + - containerPort: 8080 + name: metrics + {{- end }} + command: + - fleetcontroller + {{- if $shard.id }} + - --shard-id + - {{ quote $shard.id }} + {{- end }} + {{- if not $.Values.metrics.enabled }} + - --disable-metrics + {{- end }} + {{- if $.Values.debug }} + - --debug + - --debug-level + - {{ quote $.Values.debugLevel }} + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + volumeMounts: + - mountPath: /tmp + name: tmp + {{- if $.Values.cpuPprof }} + - mountPath: /tmp/pprof + name: pprof + {{- end }} + {{- if not $shard.id }} # Only deploy cleanup and agent management through sharding-less deployment + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if $.Values.debug }} + - name: CATTLE_DEV_MODE + value: "true" + {{- end }} + {{- if $.Values.leaderElection.leaseDuration }} + - name: CATTLE_ELECTION_LEASE_DURATION + value: {{$.Values.leaderElection.leaseDuration}} + {{- end }} + {{- if $.Values.leaderElection.retryPeriod }} + - name: CATTLE_ELECTION_RETRY_PERIOD + value: {{$.Values.leaderElection.retryPeriod}} + {{- end }} + {{- if $.Values.leaderElection.renewDeadline }} + - name: CATTLE_ELECTION_RENEW_DEADLINE + value: {{$.Values.leaderElection.renewDeadline}} + {{- end }} + {{- if $.Values.controller.reconciler.workers.gitrepo }} + - name: GITREPO_RECONCILER_WORKERS + value: {{ quote $.Values.controller.reconciler.workers.gitrepo }} + {{- end }} + {{- if $.Values.controller.reconciler.workers.bundle }} + - name: BUNDLE_RECONCILER_WORKERS + value: {{ quote $.Values.controller.reconciler.workers.bundle }} + {{- end }} + {{- if $.Values.controller.reconciler.workers.bundledeployment }} + - name: BUNDLEDEPLOYMENT_RECONCILER_WORKERS + value: {{ quote $.Values.controller.reconciler.workers.bundledeployment }} + {{- end }} + image: '{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}' + name: fleet-cleanup + imagePullPolicy: "{{ $.Values.image.imagePullPolicy }}" + command: + - fleetcontroller + - cleanup + {{- if $.Values.debug }} + - --debug + - --debug-level + - {{ quote $.Values.debugLevel }} + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: FLEET_PROPAGATE_DEBUG_SETTINGS_TO_AGENTS + value: {{ quote $.Values.propagateDebugSettingsToAgents }} + {{- if $.Values.debug }} + - name: CATTLE_DEV_MODE + value: "true" + {{- end }} + {{- if $.Values.leaderElection.leaseDuration }} + - name: CATTLE_ELECTION_LEASE_DURATION + value: {{$.Values.leaderElection.leaseDuration}} + {{- end }} + {{- if $.Values.leaderElection.retryPeriod }} + - name: CATTLE_ELECTION_RETRY_PERIOD + value: {{$.Values.leaderElection.retryPeriod}} + {{- end }} + {{- if $.Values.leaderElection.renewDeadline }} + - name: CATTLE_ELECTION_RENEW_DEADLINE + value: {{$.Values.leaderElection.renewDeadline}} + {{- end }} + image: '{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}' + name: fleet-agentmanagement + imagePullPolicy: "{{ $.Values.image.imagePullPolicy }}" + command: + - fleetcontroller + - agentmanagement + {{- if not $.Values.bootstrap.enabled }} + - --disable-bootstrap + {{- end }} + {{- if $.Values.debug }} + - --debug + - --debug-level + - {{ quote $.Values.debugLevel }} + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + {{- end }} + volumes: + - name: tmp + emptyDir: {} + {{- if $.Values.cpuPprof }} + - name: pprof {{ toYaml $.Values.cpuPprof.volumeConfiguration | nindent 10 }} + {{- end }} + + serviceAccountName: fleet-controller + nodeSelector: {{ include "linux-node-selector" $shard.id | nindent 8 }} +{{- if $.Values.nodeSelector }} +{{ toYaml $.Values.nodeSelector | indent 8 }} +{{- end }} +{{- if $shard.nodeSelector -}} +{{- range $key, $value := $shard.nodeSelector }} +{{ $key | indent 8}}: {{ $value }} +{{- end }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" $shard.id | nindent 8 }} +{{- if $.Values.tolerations }} +{{ toYaml $.Values.tolerations | indent 8 }} +{{- end }} + {{- if $.Values.priorityClassName }} + priorityClassName: "{{$.Values.priorityClassName}}" + {{- end }} + +{{- if not $.Values.debug }} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 +{{- end }} +--- +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/templates/deployment_gitjob.yaml b/charts/fleet/104.0.1+up0.10.1/templates/deployment_gitjob.yaml new file mode 100644 index 0000000000..8cacdded19 --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/deployment_gitjob.yaml @@ -0,0 +1,130 @@ +{{- $shards := list (dict "id" "" "nodeSelector" dict) -}} +{{- $uniqueShards := list -}} +{{- if .Values.shards -}} + {{- range .Values.shards -}} + {{- if not (has .id $uniqueShards) -}} + {{- $shards = append $shards . -}} + {{- $uniqueShards = append $uniqueShards .id -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{ range $shard := $shards }} +{{- if $.Values.gitops.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: "gitjob{{if $shard.id }}-shard-{{ $shard.id }}{{end}}" +spec: + selector: + matchLabels: + app: "gitjob" + template: + metadata: + labels: + app: "gitjob" + fleet.cattle.io/shard-id: "{{ $shard.id }}" + {{- if empty $shard.id }} + fleet.cattle.io/shard-default: "true" + {{- end }} + spec: + serviceAccountName: gitjob + containers: + - image: "{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}" + name: gitjob + {{- if $.Values.metrics.enabled }} + ports: + - containerPort: 8081 + name: metrics + {{- end }} + args: + - fleetcontroller + - gitjob + - --gitjob-image + - "{{ template "system_default_registry" $ }}{{ $.Values.image.repository }}:{{ $.Values.image.tag }}" + {{- if $.Values.debug }} + - --debug + - --debug-level + - {{ quote $.Values.debugLevel }} + {{- end }} + {{- if $shard.id }} + - --shard-id + - {{ quote $shard.id }} + {{- end }} + {{- if $shard.nodeSelector }} + - --shard-node-selector + - {{ toJson $shard.nodeSelector | squote }} + {{- end }} + {{- if not $.Values.metrics.enabled }} + - --disable-metrics + {{- end }} + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + {{- if $.Values.leaderElection.leaseDuration }} + - name: CATTLE_ELECTION_LEASE_DURATION + value: {{$.Values.leaderElection.leaseDuration}} + {{- end }} + {{- if $.Values.leaderElection.retryPeriod }} + - name: CATTLE_ELECTION_RETRY_PERIOD + value: {{$.Values.leaderElection.retryPeriod}} + {{- end }} + {{- if $.Values.leaderElection.renewDeadline }} + - name: CATTLE_ELECTION_RENEW_DEADLINE + value: {{$.Values.leaderElection.renewDeadline}} + {{- end }} + {{- if $.Values.proxy }} + - name: HTTP_PROXY + value: {{ $.Values.proxy }} + - name: HTTPS_PROXY + value: {{ $.Values.proxy }} + - name: NO_PROXY + value: {{ $.Values.noProxy }} + {{- end }} + {{- if $.Values.controller.reconciler.workers.gitrepo }} + - name: GITREPO_RECONCILER_WORKERS + value: {{ quote $.Values.controller.reconciler.workers.gitrepo }} + {{- end }} +{{- if $.Values.extraEnv }} +{{ toYaml $.Values.extraEnv | indent 12}} +{{- end }} + {{- if $.Values.debug }} + - name: CATTLE_DEV_MODE + value: "true" + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + nodeSelector: {{ include "linux-node-selector" $shard.id | nindent 8 }} +{{- if $.Values.nodeSelector }} +{{ toYaml $.Values.nodeSelector | indent 8 }} +{{- end }} +{{- if $shard.nodeSelector -}} +{{- range $key, $value := $shard.nodeSelector }} +{{ $key | indent 8}}: {{ $value }} +{{- end }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" $shard.id | nindent 8 }} +{{- if $.Values.tolerations }} +{{ toYaml $.Values.tolerations | indent 8 }} +{{- end }} + {{- if $.Values.priorityClassName }} + priorityClassName: "{{$.Values.priorityClassName}}" + {{- end }} + +{{- if not $.Values.debug }} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 +{{- end }} +{{- end }} +--- +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/templates/job_cleanup_clusterregistrations.yaml b/charts/fleet/104.0.1+up0.10.1/templates/job_cleanup_clusterregistrations.yaml new file mode 100644 index 0000000000..a58ac6b4b5 --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/job_cleanup_clusterregistrations.yaml @@ -0,0 +1,40 @@ +{{- if .Values.migrations.clusterRegistrationCleanup }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: fleet-cleanup-clusterregistrations + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + metadata: + labels: + app: fleet-job + spec: + serviceAccountName: fleet-controller + restartPolicy: Never + securityContext: + runAsNonRoot: true + runAsGroup: 1000 + runAsUser: 1000 + containers: + - name: cleanup + image: "{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}" + imagePullPolicy: {{ .Values.global.imagePullPolicy }} + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: false + privileged: false + command: + - fleet + args: + - cleanup + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} + backoffLimit: 1 +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/templates/rbac.yaml b/charts/fleet/104.0.1+up0.10.1/templates/rbac.yaml new file mode 100644 index 0000000000..e3670f08cf --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/rbac.yaml @@ -0,0 +1,114 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: fleet-controller +rules: +- apiGroups: + - fleet.cattle.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - "" + resources: + - namespaces + - serviceaccounts + verbs: + - '*' +- apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: + - '*' +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - roles + - rolebindings + verbs: + - '*' +- apiGroups: + - "" + resources: + - 'events' + verbs: + - '*' + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: fleet-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: fleet-controller +subjects: +- kind: ServiceAccount + name: fleet-controller + namespace: {{.Release.Namespace}} + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: fleet-controller +rules: +- apiGroups: + - "" + resources: + - configmaps + verbs: + - '*' +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - '*' + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: fleet-controller +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: fleet-controller +subjects: +- kind: ServiceAccount + name: fleet-controller + +{{- if .Values.bootstrap.enabled }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: fleet-controller-bootstrap +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: fleet-controller-bootstrap +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: fleet-controller-bootstrap +subjects: +- kind: ServiceAccount + name: fleet-controller-bootstrap + namespace: {{.Release.Namespace}} +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/templates/rbac_gitjob.yaml b/charts/fleet/104.0.1+up0.10.1/templates/rbac_gitjob.yaml new file mode 100644 index 0000000000..e2c93169de --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/rbac_gitjob.yaml @@ -0,0 +1,133 @@ +{{- if .Values.gitops.enabled }} +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: gitjob +rules: + - apiGroups: + - "batch" + resources: + - 'jobs' + verbs: + - '*' + - apiGroups: + - "" + resources: + - 'pods' + verbs: + - 'list' + - 'get' + - 'watch' + - apiGroups: + - "" + resources: + - 'secrets' + verbs: + - '*' + - apiGroups: + - "" + resources: + - 'configmaps' + verbs: + - '*' + - apiGroups: + - "fleet.cattle.io" + resources: + - "gitrepos" + - "gitrepos/status" + verbs: + - "*" + - apiGroups: + - "fleet.cattle.io" + resources: + - "gitreporestrictions" + verbs: + - list + - get + - watch + - apiGroups: + - "fleet.cattle.io" + resources: + - "bundles" + - "bundledeployments" + - "imagescans" + - "contents" + verbs: + - list + - delete + - get + - watch + - update + - apiGroups: + - "" + resources: + - 'events' + verbs: + - '*' + - apiGroups: + - "" + resources: + - serviceaccounts + verbs: + - "create" + - apiGroups: + - "" + resources: + - namespaces + verbs: + - "create" + - "delete" + - apiGroups: + - rbac.authorization.k8s.io + resources: + - roles + verbs: + - escalate + - create + - bind + - apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + verbs: + - create + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: gitjob-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: gitjob +subjects: + - kind: ServiceAccount + name: gitjob + namespace: {{ .Release.Namespace }} + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: gitjob +rules: + - apiGroups: + - "coordination.k8s.io" + resources: + - "leases" + verbs: + - "*" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: gitjob +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: gitjob +subjects: + - kind: ServiceAccount + name: gitjob +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/templates/service.yaml b/charts/fleet/104.0.1+up0.10.1/templates/service.yaml new file mode 100644 index 0000000000..49aefb490a --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/service.yaml @@ -0,0 +1,36 @@ +{{- if .Values.metrics.enabled }} +{{- $shards := list (dict "id" "" "nodeSelector" dict) -}} +{{- $uniqueShards := list -}} +{{- if .Values.shards -}} + {{- range .Values.shards -}} + {{- if not (has .id $uniqueShards) -}} + {{- $shards = append $shards . -}} + {{- $uniqueShards = append $uniqueShards .id -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{ range $shard := $shards }} +apiVersion: v1 +kind: Service +metadata: + name: "monitoring-fleet-controller{{if $shard.id }}-shard-{{ $shard.id }}{{end}}" + labels: + app: fleet-controller +spec: + type: ClusterIP + ports: + - port: 8080 + targetPort: 8080 + protocol: TCP + name: metrics + selector: + app: fleet-controller + {{- if empty $shard.id }} + fleet.cattle.io/shard-default: "true" + {{- else }} + fleet.cattle.io/shard-id: "{{ $shard.id }}" + {{- end }} +--- +{{- end }} +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/templates/service_gitjob.yaml b/charts/fleet/104.0.1+up0.10.1/templates/service_gitjob.yaml new file mode 100644 index 0000000000..f33c9a5457 --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/service_gitjob.yaml @@ -0,0 +1,51 @@ +{{- if .Values.gitops.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: gitjob +spec: + ports: + - name: http-80 + port: 80 + protocol: TCP + targetPort: 8080 + selector: + app: "gitjob" +--- +{{- if .Values.metrics.enabled }} +{{- $shards := list (dict "id" "" "nodeSelector" dict) -}} +{{- $uniqueShards := list -}} +{{- if .Values.shards -}} + {{- range .Values.shards -}} + {{- if not (has .id $uniqueShards) -}} + {{- $shards = append $shards . -}} + {{- $uniqueShards = append $uniqueShards .id -}} + {{- end -}} + {{- end -}} +{{- end -}} + +{{ range $shard := $shards }} +apiVersion: v1 +kind: Service +metadata: + name: "monitoring-gitjob{{if $shard.id }}-shard-{{ $shard.id }}{{end}}" + labels: + app: gitjob +spec: + type: ClusterIP + ports: + - port: 8081 + targetPort: 8081 + protocol: TCP + name: metrics + selector: + app: gitjob + {{- if empty $shard.id }} + fleet.cattle.io/shard-default: "true" + {{- else }} + fleet.cattle.io/shard-id: "{{ $shard.id }}" + {{- end }} +--- +{{- end }} +{{- end }} +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/templates/serviceaccount.yaml b/charts/fleet/104.0.1+up0.10.1/templates/serviceaccount.yaml new file mode 100644 index 0000000000..ba27c748d7 --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/serviceaccount.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fleet-controller + +{{- if .Values.bootstrap.enabled }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fleet-controller-bootstrap +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/templates/serviceaccount_gitjob.yaml b/charts/fleet/104.0.1+up0.10.1/templates/serviceaccount_gitjob.yaml new file mode 100644 index 0000000000..c769b47cfd --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/templates/serviceaccount_gitjob.yaml @@ -0,0 +1,6 @@ +{{- if .Values.gitops.enabled }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: gitjob +{{- end }} diff --git a/charts/fleet/104.0.1+up0.10.1/values.yaml b/charts/fleet/104.0.1+up0.10.1/values.yaml new file mode 100644 index 0000000000..d9276ac1f3 --- /dev/null +++ b/charts/fleet/104.0.1+up0.10.1/values.yaml @@ -0,0 +1,120 @@ +image: + repository: rancher/fleet + tag: v0.10.1 + imagePullPolicy: IfNotPresent + +agentImage: + repository: rancher/fleet-agent + tag: v0.10.1 + imagePullPolicy: IfNotPresent + +# For cluster registration the public URL of the Kubernetes API server must be set here +# Example: https://example.com:6443 +apiServerURL: "" + +# For cluster registration the pem encoded value of the CA of the Kubernetes API server must be set here +# If left empty it is assumed this Kubernetes API TLS is signed by a well known CA. +apiServerCA: "" + +# Determines whether the agent should trust CA bundles from the operating system's trust store when connecting to a +# management cluster. True in `system-store` mode, false in `strict` mode. +agentTLSMode: "system-store" + +# A duration string for how often agents should report a heartbeat +agentCheckinInterval: "15m" + +# Whether you want to allow cluster upon registration to specify their labels. +ignoreClusterRegistrationLabels: false + +# Counts from gitrepo are out of sync with bundleDeployment state. +# Just retry in a number of seconds as there is no great way to trigger an event that doesn't cause a loop. +# If not set default is 15 seconds. +# clusterEnqueueDelay: 120s + +# http[s] proxy server +# proxy: http://@:: + +# comma separated list of domains or ip addresses that will not use the proxy +noProxy: 127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,.svc,.cluster.local + +bootstrap: + enabled: true + # The namespace that will be autocreated and the local cluster will be registered in + namespace: fleet-local + # The namespace where the fleet agent for the local cluster will be ran, if empty + # this will default to cattle-fleet-system + agentNamespace: "" + # A repo to add at install time that will deploy to the local cluster. This allows + # one to fully bootstrap fleet, its configuration and all its downstream clusters + # in one shot. + repo: "" + secret: "" + branch: master + paths: "" + +global: + cattle: + systemDefaultRegistry: "" + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +## PriorityClassName assigned to deployment. +priorityClassName: "" + +gitops: + enabled: true + +metrics: + enabled: true + +debug: false +debugLevel: 0 +propagateDebugSettingsToAgents: true + +## Optional CPU pprof configuration. Profiles are collected continuously and saved every period +## Any valid volume configuration can be provided, the example below uses hostPath +# cpuPprof: +# period: "60s" +# volumeConfiguration: +# hostPath: +# path: /tmp/pprof +# type: DirectoryOrCreate + +migrations: + clusterRegistrationCleanup: true + +## Leader election configuration +leaderElection: + leaseDuration: 30s + retryPeriod: 10s + renewDeadline: 25s + +## Fleet controller configuration +controller: + reconciler: + # The number of workers that are allowed to each type of reconciler + workers: + gitrepo: "1" + bundle: "1" + bundledeployment: "1" + +# Extra environment variables passed to the fleet pods. +# extraEnv: +# - name: EXPERIMENTAL_OCI_STORAGE +# value: "true" + +# shards: +# - id: shard0 +# nodeSelector: +# kubernetes.io/hostname: k3d-upstream-server-0 +# - id: shard1 +# nodeSelector: +# kubernetes.io/hostname: k3d-upstream-server-1 +# - id: shard2 +# nodeSelector: +# kubernetes.io/hostname: k3d-upstream-server-2 diff --git a/index.yaml b/index.yaml index 5c3ae9b95b..dbdbed3873 100755 --- a/index.yaml +++ b/index.yaml @@ -689,6 +689,28 @@ entries: - assets/epinio-crd/epinio-crd-102.0.1+up1.6.2.tgz version: 102.0.1+up1.6.2 fleet: + - annotations: + catalog.cattle.io/auto-install: fleet-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/experimental: "true" + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.18.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: clusters.fleet.cattle.io/v1alpha1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: fleet + apiVersion: v2 + appVersion: 0.10.1 + created: "2024-08-17T19:03:15.553266027-03:00" + description: Fleet Manager - GitOps at Scale + digest: 698e66ca79756183bdb832c1908ed50078c210bc431540e084fdb2af18b2a632 + icon: https://charts.rancher.io/assets/logos/fleet.svg + name: fleet + urls: + - assets/fleet/fleet-104.0.1+up0.10.1.tgz + version: 104.0.1+up0.10.1 - annotations: catalog.cattle.io/auto-install: fleet-crd=match catalog.cattle.io/certified: rancher diff --git a/release.yaml b/release.yaml index 5966556861..664f7faf8f 100644 --- a/release.yaml +++ b/release.yaml @@ -1,3 +1,5 @@ +fleet: + - 104.0.1+up0.10.1 rancher-aks-operator: - 104.1.0+up1.9.1 rancher-aks-operator-crd: From 28b60ef0c7d4cf3e8569cc9751db4470e12f7c3d Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:03:28 -0300 Subject: [PATCH 10/14] release chart: fleet-crd - version: 104.0.1+up0.10.1 --- .../fleet-crd/fleet-crd-104.0.1+up0.10.1.tgz | Bin 0 -> 36178 bytes charts/fleet-crd/104.0.1+up0.10.1/Chart.yaml | 13 + charts/fleet-crd/104.0.1+up0.10.1/README.md | 5 + .../104.0.1+up0.10.1/templates/crds.yaml | 7069 +++++++++++++++++ charts/fleet-crd/104.0.1+up0.10.1/values.yaml | 1 + index.yaml | 17 + release.yaml | 2 + 7 files changed, 7107 insertions(+) create mode 100644 assets/fleet-crd/fleet-crd-104.0.1+up0.10.1.tgz create mode 100644 charts/fleet-crd/104.0.1+up0.10.1/Chart.yaml create mode 100644 charts/fleet-crd/104.0.1+up0.10.1/README.md create mode 100644 charts/fleet-crd/104.0.1+up0.10.1/templates/crds.yaml create mode 100644 charts/fleet-crd/104.0.1+up0.10.1/values.yaml diff --git a/assets/fleet-crd/fleet-crd-104.0.1+up0.10.1.tgz b/assets/fleet-crd/fleet-crd-104.0.1+up0.10.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..1a16df3a4d2847808f3dc06748551ba985d0d571 GIT binary patch literal 36178 zcmbTdW0xqg*0$TWZQHiZ)wXThwz=B2ZQJH*+qO^d{XY8-oQzS)OlDMHD#?|*@S`A5 z0R9txC;_MqBorBpBxKoSJUCemnN=B#l~^q_l{netR8`qz)vPTIY>hpX73_E=Oss7H zF1x?nHd|8Id-y+U`wCs-E>)QmkxMN;FKzKv9IO?~x!kYgD0+VWkIVJN(jUj?$A?C<-Zyk-*VBN~QKicrI^2EmT@+9sFMPG8STr?75^~7|% z5hvxV5An9V9b`gEv)TD8vp9PNv$^G*{&?ji2|=o&743dp-<-)6ZPqk1nro{*U{0=WqOiFQ9HcrHE7(;&3UE zbRro${VWq~k$WKq_^B2wLiYCGM*jc@o2a=YC9D)ocX=Qt*fB%Ia9Lr{YgyV{AUzoqxLII97K7HoOH zL0T$B9D`)zVr3D6DFhQmgH(i}zt!kSStixZ0uZge^Vt(P*>+#BkctpQPb*@Uvhlif zugRK5Cb_mQ6B-}H7-ve7e_6`Ge8iWr6iB!5O`nka7cE+01rWg_6kksKtI%eg2%sl#Bv0`B${C19k5jSL#hIT*V!^2Z78J3zAxS51gZI z(0Al&tb~M zrEevd_Li~rJDf~*dqcHb4Rm_Hm&|zqZ>&xqo~tbQEjW9>?7#aoL${K_QCp!^I~?*{ zluAmkCqg`&E8gPp39D<`Pb6>6E8l2q&@~xGgS=Tu7A0=zo$%^)_(x%5s3e>REj&!2 z3Zrw7uY;x@?)_D&&B!_d$@)CgFS`%`A#l205b(1Dmys0Y=dywU6GIxBi$ zFiH_2V&xmA_?meo%M9*h=;bML8XJ}AF-za$a4v?SYiw*4^aA%3;;|Al78^&GfJA!s z!BJ7xvCBj3o~d%ya!5p|0Q{=SAF)C*nUIQy&e6`OHf{};O#la9z@1@YUhgxc&D`3I z+p6HUhf2zpaRO<04I127nePwGZ zbSxHux={wd@1)KS93T78%O#0~IAWj3F@E*gA=xOU>dD45)RRUb6rCi=D~?k}38W!d zYK5Nfw6Z>*T2wawqoTd0Iis{3zOk%q{|dDqRSJ~xoqVixy4PRbxYR@R9Y^6n7lKt?XIjfpSKV9!U zMfm9A(?sOA4C+^Dd$+v$V3r^}Ik5-4ERxVV1ouM8Ig~Tr=$iE!82;MS5Gh(xCj&}E zaannQ>F_D_O_foO%m7T^?Js%dUgeII-GXL>kJ!mr$Rf%IXxvox4B2?1K}bmjO`vkY zn1RSDb0qentZ-Dp5Ysz_PRhua3^vPy_ECdpL^;2-tz>8-3F-(hYi{Zx+aUpUMzZ|I|_DR~ArlPzzZebE;M_@hMaj}imY}ZaL zCyVP>Qc_HHzF6C_<5Q5O!oEq_5_jj}*yy(UVP&fI;6|Dzx47MD;#!(xGiU`ZuJimA z-5CeO?TG-}AfTq3z*o=9PI=X392en&9?%7 zS=KR%h`?;~fOD%Pwd2)X>=zkSyIRe0`*zZGVgv|*RaP6|kC}(?gjS|G6xIP+S)FoY z*2^aYf`>$FXa!*!&D}dPoJeC?E!|&~9k)PYwCr0TTkQTTSjdmoHqXkZb~WseA|#d8 zHm$gS5yP!Nn4HmyC07%4@>G$Q?DIg?mER?z1gAgT6+Wi0L#XLxa@!Mlt}xS1uP)&r znz~*vNM}44hn0H6#r`%AyTSZgd;`94fYI4gAS=mZ`I{I`;dpnw5W)o0kTp}h?lb*N zGC$lY%_;6T6sXYh&To$m%Pi<4??Be>gAI2U`j;*XL1pX4R+o)8ZX@{bm0Q-)Qgtt` zb+^B9+U)8E8l9P-qwfWdQIrk&eOdba5tA*KbNl5?Kn+IgU%MHlaI0$V&7dU4ur18| zr>$tG0mVe3s(6a@f;WQR=zq10?0N$aK+yN9Q8&ImB~EVaddv&_1E}DD9yqFIYuc6A z48ftRj2cOYVD1ToMuxnvIe&;AZ~GH69jtuv?G6bC2LZwON31z$ki z)8V<2TQm1Vtqqt}i?({sIkshh0{C$ZA&IORXe~cao-$XjRorZ!*8jdQ86+d*yNp0^ zoyN)ssDKa_*oYR=h;k>ek5nz8SJiF(TS$q~1sLr9{+a1{CvlD0DPG~Gx36Y3E|GK9 z-M(03ZU-#CEgeUT)}gpu7T&;W@|wT*4Ze8Lad?HG;t0fzCx3)r3O@T?%aN5Qkjw<7 z|5}Kf=7=-SgfrH#f=nX3Y_4p|AdtuuVCfsn5woXQ5W_w|v<&`n@~V7E;5B&~0gBO_ zWtt&Q2i0W1A2kaomy z*ROo_QXyeFEZa(;Q+l=bx{Y|K&MTf=zQgnIM|jefdclrXJ&7g`>y@2kGTWsoaj%kp(PzsnAsAnY* zqFZWL*QAU_6{vL22b1X((5JA}5$0_u&rew5@12OvT;!~(2qn>++l?*}-CSlA^^I|s z3Lb6Uc9rMB>((EJKUc2?=0WiV(@ z@dQ-cU+zGTd{=uhik}W)G0JoVuAAX}m65*@Yg%XBIr?4HW-<*uA*NdQ1f}iIKiqW1 z*{9xdM;yY^LUs3kh2g0Ph6j@-OJJ{im#ufB9#-!{Cfq%zOWPVdv@Nsa;XjV=Jk&s}m&syerjo{xXXL_y!@uKwh- z*RQX!H+#D0{ow%L^!dm4==<@|E$+wa`s-`F*0=p8rsyc|bgQs@*-Y#0`0Jx}btShP zAMy&%>xu0-PIb+Pe7|nBu7^dY10RImGvtJpNc*L$%LO}KnTj6O7Td0t!9Rjbci`jd}8~W%qRHCuX)6-_K{b!Rh;uY8G81ROlI0IR?!Ya`|b!4aI zMys}+w~BiaeHFI^N*QW8ty`($O6B9>#=g%o)5Xt@s2GZ-8USJyq9c&vHc(pfDWc}(8A2(v)da2z~|mRlS>ut>T2 z9)I=7Fz5EuIXwkG@ln~&=a`6C4jof3D~D7%(C_02J&Jz8Y!(f~?`av`U9ji#^Y`rO z^S<0T%g_CBPoqP(aM;wQk-Z-%b!u$O#R36a8jtga{^f=~(7500{&x9L`#B$f$7Up) zs@C?JYQ3Exi2n(2CEIqK2r&@N4z>YDXpTCNciBc99aMk!Mtl``aCwq2PRX4vEsiC9 zfMaS-fnU9+(u%00_@n5NPDIc%zL<{yWQZojLmL=2S8QmWdCD*(_81RKe zRh(-^JN|LxRjxKOj9{8kwfEFQeu*##hm>NwQ&NCyrFLH`rg|Ke`xoBP$$Gb@56h#> zeeRUI_JhS_De_q8Ra`x=taBzw8=n3528Qs!_hRb&C4lCe0{2K4d4*39{~4BWxUKKP zF4NBWrRbWDj;dYkg~MI>KIUO!IOM}mi}TJ zKA`Kli{q&~+?0LoTH0&(#q6msLBl^3TUmu52PNc2NtPdnSNEZ0klW?*qyMP^qlz_CWoeq4S}4S&jtrIn?8xS_nmcFCK`68j7X z17T|`wt+e6;`axq!gr7o_F{OxImXW@IdR#YEsPyrJco(I&dM2;qe91X5~!UCCWLfA<9}~ z^aR+(D&JjxR!>To1s-C)cD85JLs~0w-`Rqj-}qq^!+sK+n0>k-ES3a*3;~n_mjcTB z8khA473av$=Ai5qZe~GO%sA3^{65h-yR0SqI10sm48ti<=>?$9g_fW35pG3j!^z}s zZr}=$^#gXPwZ2qgC`R`~iy)+jq&cb_2f^lC1sJ7P(yGJT;gt#`3cvbd-8 zJ8XdbA*S5_*JJ;0UFF}RvVZ@p#64~PKPMzW!Se5bkN^W4B~_2MnGFm4&;Dcp5G=UO zXJx!Yzh-#$2=D)9qx#$X{~N05x3hU$WB?I2>)%<@<>mko$ox8gTWG<<exQHnp_#8~N&V(M4r6pIgA`W)A4WTVAG6sYYm)!fx?uxSGh8s9Nv=2569Iu%f zb0#3w8iqZ}rW>&#gOnopn(2up7sqdosZx+aDbeoJxSurwr$wklHO!)b^e>q0T;8dj zqEpGX5uMjx!dcNTJm>xkaL~#8I*zWfl_2-bJn!uRzf7rhAd8qaf6I7D0rhJs#IGyKhTz`oJH!JPF(PdG`f%eNVQQp3{~hA7rq#Rw^}A59?t z0>~q-dY(c4jhmj%j%24`UpXXgsle+lwukBL%^Afl>JS+KE4IrE;r=?09COT@+l3Rv?1 zXN6Q;t8gBs;|?DvX2V$gF4WLxIZqk)fprh9YCC?uTW|R42)In7kA{qfJ)d zmmn+>3Z6!~NQEk!AoUpEThE;qwnjCflA!)n>T@s~UbfWZHs(O{jbf98<3Uns93azG z8eD{^X(NcNC$=)RZ4%13=lqSXn5N7k@1Q_Mzh@zBCE-qSW*sEbP!dI=ZOGXVoYD83 zDvCWmqo)#^OCbm2tXYR&{Ut*GR#v#6Eeh1)o8+|Mc|WgeNfEJcpM|NyEg|JM41@1R z$C!e^0U2gM#~&9pNH5UwAA90e>=)iHq!VZ6IhjutxB6Amax{(!R9is}OZC1tkSK|xn(4V!>SxrkeBQ3Wn<{vJ;$F3GW)cZSJ#bZcPkFc8=H&hJ0P zo1ciNmuee23$u~u*;vr&FXG6e2a(Zn?9*|!N6a==o^50@EENQO=S@SiKhF69_yAox z#e$4D+{hZAczL|w6dOK$MK++ar-nX{jxNY6+jX~DI>((Pb zW>A0SqLW1`)ozoL-?OUSqQ`yX2&T%ncxO_um9A#sG&w^a(d`1;hRQPzMj>h>q)Ist zBcQv6^8I5$%AR&3TyPgeIIuSDd%6tM+QQCw8zIsh+O&ar{y>1R@nvjvFA2d-P6eDq zUqKm)tU47~Mp$$tQXRTz5MmVTqj1uWzN-zv&TGG!>H&?n?5+***6ZtjM0j$FGjt!|9CiG_Cf+db z@&mV&TYz+S)H$3^P1A=kKIL<4oHkPJ9eBN>o!F0BZApN$6+b;cZtp1iz=N+-Pwez& zgFA9wa!9k0NBn97u)OSa0RMLn6TM?)U5S$}v{gAbyC`YKP@&i%YIQ{|NxH$~7vz4~ zI|5Rmn^whWO&1E8pXD$Cpatx~N$9B{XYW{x~BEf7T=kpZ*yCe^CU+ zU{RQir$nKw=U7qL&;=pC8TjTNj_qw&O^{7r{>qI&lye#@JbRn%f36&4%Uw(>gbn_4 z;b6*o%%<%Jr$CLq^0T}K5=x;}Y-@&K(cY}V1ygtvN#@j+{ro-xguTusI zQZ2k30OcqFm?&_Ro5kE6Q)ogr?hW*=^PmF_*y|pvHc#8`(pG~H2q8y5reY*{jb58az$iFqtUZ?Wz&XI z)fBl~b{Y^4(ZW#BzxEB-o_vUoOA9oA3T-ssAs!Ds5R%DA#Byo~TwB19$GuWhPw@XE3q zZ9!bB;uq{u@XFE~1x_FSXB0JBpE#+r!7>$YHOUvdj_~u-7X?h8(u&jkbd=!Yds(|I zXEV5G$sjCk$U?f^B>@3WrRr0PC6~su@;Y1S%496Zw)Qw@@Q`kbZ-95*tRsfQQ$gf= zu+0MCpf1~X=qES^VbHuN&~YC7jRd1uX@KZE3OE^qXuJ6hYD+IXaZk((v=r^O$`i)9 z>TXK7y&&sElOpy8Tcf^Z;{0W|TNSa#bAW`RRV$5Fh0`4ax#PaaeV+^krKa7F`t9is z+|Ai_j71EgP-?VxwryxE(Qv#llPdlu#-qEO`7&SXn==Z0i=npnu3`mVSDuP`-^Gq$ z5BUo;9U>oR!GJaryH(fQrWM*lr|QhvkAL1&j@U6(iU?#QGsY0FRu`_d;YXdGPQW{E zJ=@uz9WEQggV?7H_dg>ao);}qtL$^d50G(BKP$AB(&D@*_{CW3S2^Z}liNZ(*+{*U zM*>^HSV)mYU>QO;=-8BNb|t{oFnKvnz?;#iNTf28w(^KA;^nbx(Isp%w zVtyTz%zK?VTcIQd67c6PnE51~wT^9`&H2yGWl~%V^1xF|%N0Lwb0mL+he-0s`Dp1* zi@^^|tb-1_+fdbxGJU%i@L)s;vxbv4KS-q2!L-owiR`V|LkEXoF%6;O{#dj%fo+Yg z5e?&}R)vRt6_{ELZ&|pmn3^tjaqC$K7VqCyPnRpc+P~OcR-USisevEas1n14rJ$q^ znU%&%?{Pet=GhN@FN#BM;`-BYK9e7)_We5GjHWGLV^?k&{;?yKr6ywm=AGx0x@%bY zRIos5R`z)a3aCno6JQT#(8YSZA(7v(nGZgvSYlC83yd>+3M3K3fSJ=%ljiArDGsIm zo8`_b(%xYJ%*trg0gGGEzJOl^p}yXLMJrf@?%UD*`a!DREksg?0X<$XNDlK*Oqe+D zKo_#5?1ObCeN|V#@bI6x$g3IZn#F~vXY%VHfmEsT`5!txJ@JII2G6cao>dpVMtDvJEMa(s60C4xgGeCjDxky}UkBX~K2QT&nM`>qN+am)~X5u=Gu zfd?k>sws4lw6RkyDA%!mNeORh#c6ixwZUPqnG8QVVRqDtpiEt_rdGN&qo+X5a+NE7 zb~5=Bf`3AKW`jgx!*>iM>mHU%cU=B-As3x@grjt7$0O{`UB6^7Z>iwsVi3RRGF3QV z0~?b+jQ*?Rog4!XI+wQ*g|&-Zh1>U*bl zGdJh+`p$2uuDUuEp0TBRhtRq_-7 z|2i+eoptXb2ffu61iQ;ui-(8)<8zzC;}-(f zfmmb5?~ziqB`fckMs~`J-rTkQGQjw^Figx;^Wlq&t*qd^w&X!&&P$FU0w&?jL=6ke zi>c`P?FU%q%32FF$<3RKlZ`#umJxjMj6Dwi%(zOBDtX4Wnh&dCR6vj$6_T)HdUrVF z6xmv$v^^Oyq&`(cwkZ!%Nf1n-6pWKD&QND*Y&YvLL&I8zB^UDSfH&=0Q+3TdB77O5 z85|vmM8##PYW2TS9s>`HCaS&?3rb%{=}sLvbWA-Qywa&4KhKl&XnIAnIkXVp=auxg zf!=R#X0yH@kCkS*ey-0)8Xek2;}#B$T*II#bK{%N=8DpCgg5*2?>BTb-ot)(|It{$ za%&z~M}?x)+TYQxcM*4QPXcOU-`xC%{%zrG%=Cf789cgH0U9aEl+8kLD|N}TQnlC= zrP~B2&|Y>32=7(G`W3+{#J~TY_{KMY9ikIQQMH#Jw}E-lg+$!@Xqy!j!Qz3H;}}w? z-z@f!DGA!OSrl{+7sR1rIbi^b;BU#NjcEeLs4#x?-*>|Z`2+o?=X96rjY#?Tr`{KE zo;3JJNLy7ag#x6vm{Kxq7==ODKT?57l(`xjF6!vEnYD-1To7VRSX8Xf*}##_k;YcL zCqjB=bU`%<>+*?8IkI=bzfJ_xjGDutIsy)o(W^K#{WUgE`Vb1w%gBf5%RxiTg~1j? z%g&+hK7hTR1V`tHdb*SKIqLkb1xV4Yki4GY7u^xLo0&31?RYI30V%$%LChhVOW`kb zy9-Mo<{m%WJe*x`FX%Ko4gjr(f=@zrI(#SEHyFpzAs(^FSo97Li2eQN@X`p)PE{A1 z#&s4HGW0?}Ed{>F$MsHv3X%9xylfvmy`EeHZm7KU*st7S>c~Gmi7;wMdB9j4O(cWj zAphFsG3&1;Ws!8lOVH1j~tYKf*Eu^cnTV z9zKmyz1olFEEE+Z+P$9bo6q|?ck58Qfe%)ZUNq$!2-~m8$I=f~b(6gt;S+_M8h|GG zG#~`%l$N60<=@yGQoGD8T-QV!Zu$;4T?9!`93l&hKP-))c^FE1pw#SEfzIxqsFD%^ zoPbV-5PugN2kws4b`H~7D^$)a{W6rrkFh$teZ$8@{b&;cp!eop(mF38Oo zC+vw3;wcMemjUhE)R*{qyk4v3_YfS-r##%=ANrE&K;|WDhC8$9+aJKI`EBI8B+{Y|O>RDK2M<`s#CrgkL!3PSt{+gBH`I0kMT9hf zqKin}t43henr7-Q$XxMGt$vN)uSWH~0(;>paO4lZejGDez!ha5#g+@LTwrJR)+vuM zPmrt|!`cg+->b|sI-$P{>)TG`TS&8k#K=dpuC_+AT)Erj<`p~vHD8MkUX=q2QqC)$ z>vLD@RSrUXLuq0;GCVam|DYMm?>&0SH{q*TsYR=Fg#QT0v+PvWP?8>1itPoTOq`jmx0s+AN}G-$w- zh9CkScEkyz8JR^K)ogtCRwg1hJM+B^rc;t7Q3h3g3oB^cP7)!MqmKG;l@^r8e_t;r zH2fGUed*g_R^X8IYDtwhQPAwd#q$i~X02IDY^XAe=PMbtOJoZ;q7H1Wna>A2Vzo7o zGe^~gWFp`gCV4SaRxJkirZH&TaPI>PQ2Eoq$mL_XGF~LwZVbvh)!~U74 zV=03pzHAgS8<{`?x*}7Jl!g=c0Fk}xV!unpig!16kU)rBlFJX!)N;~p8!6<{1(4hs zspjIy@=9M`^>=*3rAWAzb0vSDCx_9FSfTl3mj=IQ0T&|pN9Wj`zUSH@PxTZppn9&q zuX+w6J|%%b4UxCN6*5OXud*!Xps#Mu*I(V-n2IbCd_?F4A~r+}*f{?Vf&0L}VU9P* zB;N<1aSmgy>J(2r$SPk4jS$ZmdJBIJjSFQB4GXjlb?eA=yZ~3Qwd-I5Xgl)Su`_Gl z{g$=~7yum$d?3ViJ_i5k40DnQ8i*yk|&g@n3-Q zlh&3ulXf{za}C;(>$O}GcNvmex!ns>y(D?2bAu##lx5N%wlm|TKP{uLWZ6?M6Gcg) zJUss?_$}=LcUvCc4-}DsZX1@3a*1ut#fzcE!{kAF^^Qy0JXgr4RUJiPjXGcQTPCW6 z#Th{=&U(W+vkg>%Jb0AV3bQF6 zhE^iS;AOL*=J2|&n=8o`C`lyQPbE9#k#t|jH{M`GV!>}^>y_c;6! zVzZ0s6pD35Y+NsyfW}xOdta$vHnI7V4!82Z=N z=ZE~x|7gIhw=Uzs;MZY(%qi$1qSWji^zaRnRfh3UrXDjWsu~y73X$d$jS2nzyqXve z3owt#yD?ahFdPY^{w;FFSp82{VKykqkcCn#hK*88Yx-uummnT%$AI;F z6k>_`#IDjZDnMy=n7-+&3ofF;ug+WG*j{grTKcggNH6YugLT<5eM?%Js>yiv9IJ9> zu^s(bWilpGG0|8ZVLg1#9yQ<*q)S&hFR;CpC#>WG*k!D~q)uQp%pw5#iHstNu>D-# zcB&^C%)PjTqsG8YGkr6su#Eu`6Fxw?Iqc=J;AFW4NENx?cZAt2FXDtNP5Cr{t$fZU zQ`wxQeD3$fsUC}j;9Dd^o`0Vl<xom3!#^bkq{b?G^I1DA5QtuaZk&9N;F)zqYM zC+_m>q<`y+WX(>B+~m#7OaEsyZjd!Um=(G@5=s=%f$EH;rnZ}RDOzA7o%0vnvTu~C zg34qRn|-@!Z(c?*$fl*<15cGHX@hOs6E`1}NXw&qh7l_pFE*2+=MOYh6Z%x=vKPmI z%r=1jv6X2*ScmCoAO#f+gT9pf8+dtaR3j??ojjL;i!^kY)FL$=LMP+(tt0vrB!3nf zzi%beXji7J4N`PbZI}?lo=+Z;Jm-8MO(7z_5Sg6d1bkmB8yA+QKUCk009-rR9NjAQ z(zRk&70rv^E_by$d8D=yVT}cI=!_evF6Ex=T2n^aI zgqA86**=ewRbGiVDV$cKn20D!x2@x8mDyp2UFq8XRB$C-5assQG4?wgw9xv=4`z3m zfl-EYOvdqp59bh;9+b&r?^LI)!*mLbtvhZj>+e--N3r%*eCDt=uTnMpV|Zc>v8lvg zJb;wvrc*~w`FjiyVrU|SGAQ75RJN-=FciV9h)ooMA*hH%N>6`;#Ibi69{M^0JJ~-& z7$|cqQ7Lcj6``dj)aum;@9EX(Ix4f$DJYy&$ zn1%L&y)WqA_*rjn8`Nq)TiaMJW-XpNMfcW{M^opFWRVHQui_Q`Kg66~lYr31U8u+W zwL4v|^qoo7Z@|j_{S<^i74TtRqH`*Fu6kS7vt)I|^#{=q?8&12E6qo26N;@D&fr^? z5qswpB|bzSv@qMo|6EhX;Oy_^vcLfE@@&730$Ph#;Uo>KM{^-0ql*dQvf71{*q1Ax zp9R~F$p%$iTSGSpwgWumf9zr3-5wNqf6waOCIlN-V^gb2i_PmJ1-KWY5#aDwQ}aW* zgT@sGVlS+omFX?OzUA9Q+%tF8+d9uED;u!Zpq?#vrycO@S`6J+99uU!F`}&%BSE+0 z(~c-i7v0-0^Te1jaHl_>(Xb)C#}kJbLlurs*k8*Vm})LW!K+mHvr_~eI!;i&yeLy7 ztJtZZ0SuE0#3%Pp&zYzcIr}9>b5=xD#Tf*s{!m}jjeXvq_61gnM+wNUp~mg3b{UbA zHcD}{g|T;M;8}}MO{_8=NVbrD<}b1 zd(}j>nRhOyzEg-!bvf}HCT{rR{O9A};b_=q@qE!fJF?loXf2pD^CmCj3eNfTQJ;Z> zG?BfDB2PlvpEWJkhCEq9E%x2N(fj|M_(#>}={j#Zwn-F8=$Uv|2R@NfF)12(ZiqYT zE(a*!7?=Y~K<0VqQ3W`o>NNhb+)|ME&sV_Hn^F_GW4hD28ghO!Z0|i*ctV=6l%`so zyaG>8b}7(l$7?~=T=v0`_K=nzZ_N~zz~}PKGdjTtdu;p>S9Rs`RqHi%2X6T+!78R5 z!sfFi;8yX*nB?rx3{`JK>#P7!MbN~;cd7C=Im8JH&Ajy%)Oa-)2?m#UowQ@2e*;#z zk?23UUDi|k0ddOtxgWa=`x{)n^v?Od{~)Zx47#F5?iKs}0nYQWv3^;}&;M;;`g5ap zEhp#u^4fd6y_5TS{x_^`y2+W3Viwrm}iV*2_#@dweUiaqEKlDP#Sg zL~*Q8`cVt5yXQ+PfH%CTkf5#^3Gx7;pmKoAjhU-v{blW2iYjr?3Eu@h01_bz;I19{ zdRX3=`oOPtWw=00H4_OPp1&-q$X)Zop+)%8-oc%m2_>YKotjiD;%DXL)Re0yhk5qi z&X}nANzTf@zo$fn|9>L^j?&M^=d*HM-T!KWNLv0+69ktYY(Vw{g}#$G&5cCk+t>_7 zChsH(Vld(qWAhiG##4NmYl7i|Wbt+FbG~KWtLmgJ>CLn0j%$T8(i696SFS?4fK5p5 z9T~H=*RCrcgpunn<;ZZ{W&jO^1(+sGq|q1*|3fi`6W8#09B; zQig=Dw6c;|GWPizrpjZ9lo^DV;w>w%JzXQMAhZyGoDE|TX`?c@T{uzL=!{l28U`sc z2wApGco^@Vy!sSRqzWVJP&4jP0F06h;1H$k3SJ4Zqtxzef(uXL&;Q0|e&s=$$()6e zQLfteJsz|fwk$;9Wys6tx|Y<5E@qyNQTkV&X+D;l@!9KNd<@(umDpFRjV>TJpTS0G zzq0p{5_s7f`sIZOK>01>Z|ALn=Rq$ zjxYo*vE~m%?Ap6!EBE_vk!{ST8_TEb z^dF&qf6j+Ephgujk;xiJ2(sIEf1kyIriy@RLslEBZd?shQkoiL^@bKpcgI^Q-8 z&{J;!8DcOr{uB*Wt`Yhu9j8r$^iu|xZTv+vq3mO;LzRjcP`=QE)_uPmGc{Z;xMT(u ztc#ujV8(O)5;9@04)>(#9Q+s6^i}Gkuf1y8%lVRny#Sfax-b2RcYoD0l1{?cy5>d( zWLN7jNSv^=iNe5TCR{PnJqjS?AHgiW)}Q-?4oADLfoz%vsh0t6rO(4a%EE+a-@!S5 zb4oeT>lvnrnhq4dVpTZMX!2IVj-h2ZI&(E;l?`%SY)Vl~J^uCcAx#ka*)Dw2e>e-e4a2$UFifLK(Zx87@|E#+;$( zO_NM$qjI>UCzpdWs-v=hJkM1uFRyus1&A_69oT)PU`4{zb+Ng)dIF(>=d-VN#0l2j z`(zo(LI@?=j@kg@RvZGP!2k$pib6Z>@-w%A-R*4^Ij#>3?K{_TGg-u_=mdgP-S%Ir zG!)3fJwm%t?<;vzQwTWhWfY?QNB%5(CYPe09<^|7DPhbfLC#Q^dPIRqE?Z_h14F8> zm%cHs{2{n)jYr_Xs~K(#3Mw4p93FIit&J|G)Ni8`ngNXYV>0EpUrWqG!a9nn952j` zi1l#71jdNOoLNy*QZDuHMJa&1KnARyxk4J!QDRg@Qn3k8g$G{IW3X65WdgY)UW_kk ztyYzu7zEb>9^{A0MHFNA_H0Cm`#6@V(f!AKz6#wgW#g->?VEK&r6B35{q9)NFg{o2 zy6a^#S@+yzDFhsDevcde9$ zX~A?Ct@7eJhi7bv(pIVNBM4tJAPgz4Zx+qvS^cfdVf^x-7FI|>1t8Lb(ZJY6SlRyt ztVB3~O%V|3qS#0eKOeQg4zAA!cu7S;BB!zFdz)c09*)u}vY4jOQn|x8trJ$>yM*yI z=T{J3fqIIJbZE(1d2O1m>{T#OdseaoXiFnBcq%(J5sy{Xgqp1ot`Y08)s#Xhad<0c z1oWgjDH#0y%nPZ98L#ni%{IMgy;Gh^r+YRFZ_WTKB70cI!R=qM`PQw|R~SrtNViKut+c@4 zx`od4Uh1RaTY+&iNMmlKyCyp&aG>1L5wokdg&0fZ_AtD*P*>w| zzyilLz{O#ctRL>G+nhiYVoQqKAN)^q+fD87ufl}iYC4BUnv@Fj>mvLhbZ*&1g<)$G zF1dQnZAV9Ef>WrM9FmSy&`mH?+o~)J7oYm^_-T?~uv_5tYRE$=AIC+^L7UZNu}_bh z;0pCCC#_wb2&$Mv&9`s>3!#D(lM3O|>0J2=X(hqmO7_ywb7;b(7<+oZD_B+#c)>Vsi6!{Y^Y2a#?oTd)#?<^JznA^!_3_$D^77K$UrqBa1k=mZ zI|6D%2ga1bK_5>;A5SCifrQo5JVrjRp^wg_TN{2BgO^WLcrC9#F7badBwsPR3D->_ zvS0Y$0oY-D$wGA|E?B=Wqjt3acH19zkLv0AIoaw8LZSzb z0WlEJLO>_0C5y;sX}nhXvYCc+_R>i()f(&o#M|3b0XN;NZ~e302~meD@)V6EPsY^h zVf?YW>dJju)wt%J|JzC8J{+vQtyE`XomQ*|1PcwYmp9=BS&CDBaD^gNZZh7FM;u7* z2A2t=#EU}J?iGJ%j|OFFQV`6Vn+-&)b82Ky8rIus$6%cHJ`Whr9me-wK@$t*84d3S z(+1!Q;Q&Kcc7wdh!Btg1yy|mY+2%izErfZHB|g6wWdw{KAP*SgUK>9=7^E-m(I^&1 z7AkKd8}*X3GuR~_Ob`phXAO=9W{!aVSSK9sOtDmlIEdhkeTi$#LDy9Wg#!am!&he? zt>>ZbJ@gfNJ`@HQ>l8C0rm^WnV()Fg+jce#X0_>*wVXB={edgxT({!`cR>7(GKwm; zMIU@~ySkj_-<^=}na$7@=d2e3^zhtUW2s=&s^6J=4tj6F@E(Eh_Ak7zt)9@KFmP`K zTsa2D9~<+%MOb2e&AwG3!1jRH-4)UnyA!H#AecyaT@187zjCsy9GA|UmdW0R8;7>y zC0l64FlafDV0&8Q8l&WSmZD|2@8u>g5DSiDgLmoDer20?U~&L#RbOJ=2PElg-w*>+ z01W~W8kr0Mt;I?M!Ujn%K5& zPB^h`+jjo3ZQGpKC-?olPrawkm+sYT@4dRKx@&#dbzQ$E_WH8fz0peTRMD|`EPQNr zB5v^w!RW&J{3MJuYg{V~RjNUE`6q--VfgZ+94#q&CHv-7{>v$}_@KJlieq^Icu@47-RHdX~g z^RC0zI%D`M)%W53Mv{6rzoI_hul39GFa2M(4!${7Za&|839(yue?0Nk8QqUt7d6OL zCqc(!8>O7I%P-|TWMdhJZ6%BhP(1$LkDn(i*@PVizR|vhD#Ai$#b6Y_q{LB%zz4a7 zs5yhD^lbNE*O;v*5pRT}9!0g_gwmT)a9BtkZP9bcogJ&PHIdt7`m zRn}Af!7hLJq0L)GPpwJ+$5&nh^ECe>9PWDt8%Uq?Z#Ay)HZF4N5(+$x&r4wA-y6@e z@4k(I1-V{1v8Yxd&dtrKDRa8~_5XRx`_fMfRCGock~R}ARpyuAB2DDbrJ9DlBVf6M z&X@+~?;kMHWv=vOgDQ-3tLv5D79i}@>eeY}TD8bA0r%HKkMDaCf9e{{=FZjMsScMF z5>pz;1%(%Io?($wgrntx$}<$Jrzf1^m7$J4t))z2Z%aI8Qt5a312R}^iU7+j>TtTd zStghoPpVYyCr68w6y{#x`I8$^>Ql#!`rHsGXj(P+rA$J69zqT0M~OI` z7+?E{^Bk-3DmeU0l%1El&`>6QKa$wtq@MZcYHT-st1yOU^Gg~ytlJAA;BA$NvRttC z=a0uD2SBu&bn-OfQ&$x`0bcDE7bDVzG60E4WpdUt5?3SIdozx#!cJp&4RGtC!AEG`%OE z#y5K3=PK_?31O5|^^-aCnTzwO97W%oTbaCvUaUmg=jVLIuDbv3LUX4X`3iN@;CqmN zaZ7h;9%TB0q22SRn%b8}^`%7XZ*D)$;EFIW0)~jqnC!q|s#kGcxq3uI8;5- zX9(&|BDY@X_p&$5;o;Q=QM1f{E+JHWj)6+R+|I*!xtM6%nKbh)JvbH8q;@6i78tmBrx@@G1?-FtsoK{!AV4| z=S&d?`gU%?l6(y7j2+^-8w!1k>+a&m-sA@Y_61hem!2Z&mg7o1Ay(QsXx5V?sW;KS9+?m|nIe~EFKHtHQtW1|z4#>Y zy$GC0)oCA|Oy=P93l|N+0Q4=-Nn>Nm?)=1TWo+bbix7?j$&FVBFVomL3vRmnDVjaL zxo{E2mSH=!_=4{~zpe|*{@HX!7Yev+Xc6=OH*DD`1^dHjc-r)q&FJEWHy)hNVt6Wx z#f=&|ErByM7|UbZKYJJbvn<@x@4stx-p$cAerk2d{b!QAedd2F=l%+v4lZekE+H9> z5KbYAvLO7OjA1k0Dc*W}f#D^6A5M&vyu7>nhwc~p+}G@d{#RnF! zgHqh!qs_u*hp+wT>!07U85hc$l6YDYE#>wgQ%GJ$7kI-#esslwWHcMHw-j4`lpcxD z+lTq7_ldzAOsu^fa3e9gtCUmM^$;MP;e!2tgcDeoSo8v;wrQm_YA$H|%7;8fsYIPq z=9#gosTNeJB_nF+!lc zwn>lP9|MYeI&&+-9^FC@JEmqqr}@X0ah*d06H2%d1V68#=)`R)bMARnt9 zgCBDOqEya#gB{rZ^a!H{IwagCJXZFqka!Cr)baQdTYskSARSK=0jr?GiZl$138hsH zay1dj_^JZd2o|qeQbt^S1Hoo&`jWqT!NI-7{ri$~3Q6}e&NTmp*QC-$J4Jn#YkF`l zYW6raUotSU7#8m0~+?GeHJOHC)zPk0z!ZT3{4ZL z$%UX(4vXTW(u_mZMOn?(H%iUoU=g0^l)4vgw8Ri#)bEwrzG5inx)&(sd{MS2=eAyd zO{Ws^iXQIeau7ncVG1cvfG9N#nwB8B322Y?sGBr)oxf;g5I;=ZxyD7H@0AZRg~fSh zJo>MkBX*Ac%XcsvR^BgM!I+|_^`ZZ?;**|gn`Z{SOi|j=;&%d!z7Ro)$ilhp(bvn| zLh7jJ_G&TdeZCGsCM40s;mj&tKIj^Ik@i!m9BU(8TKUfwK98i)Ab>gT@@Ocw<1x0W z*H+;^kiq--`@+ah^MGwx#)wFzyg9!i2M2*xN-t+k2p%%9UqBaj7jNbrfWj0BwjYzJ zMO#Kqydd~yFYC?=CfQFHSF9|aDZITe!;8<3x6QIjOg&m$L+Ms0KkO-yh@SXX)vw`b za@o~!5o;-pH%Pl%+gw8s)VJ=8EV&-|PU^u@q63+_3q0FFe;0*IA1i>&UO>-8Dj_E( z6h5P?iW+zu!syk&&C&gBasi3UO#;G(UyZjshj&}J8vV5!pXmC)S)~t|0s<65Q`?wW zBm%ssTXyk%F`_Q$mdc-^aGu>#QrWy=v5MhlZU5Uo$wL%H`~=4c;=0EX2!}@=IiAPJ zgNLooxACo<7PN+_8z)QTZSBI`Ptrf$nCm|&EhVG5!l zjJP}bcJU+&dA^K=CENNx{6KRaLd=Nk8jaD?TIU!k*m#YIu0MR)m*pf*u3%-nS>@>+kEgcYLC7r18n*43cu zT8$*#n$9pt6^#9_3VO~(jlH57R2S_?m4oJLM%;WN>MVIuIIUXK0wu06X#5v_xf@7Q ztP7pO<`4!qGHr;2{Hobn6~sNj_?%D(DEAyu2qY#AQ3!BtQ3whKF@GZwb3zELVPS>4`EMy*keZ8}SX zZ*$9DXbFrT3m5*vIVw9c%WsEoqVce@!^I`q_nD{OpKO~C+^*@q#F=&abJ_#Tp>}f4oafjVdvi&gj(C10{fvEVpk*2)VaU_# zc|r?mrBwu0U!0$+S)xAhBGEd6bA}}*$bI6QWv`BLoFi@Ss%)LW5rH()RnYs8gUNeP zDd)Tg2Zl2RdtxvmnF1?iMDK;0eB058NkY~!){Z6cFvib1OY#0&CG%1Qz`hnn@jh!p zm~knR=nM79vK~fpvQNhAwn4@#{__^#TBJPw`%3AeQ-nPn(_j25`uT#=5;l1XbnIu_OtVP9mVB|K;@k! z9mvwX9>5g{Cnyz4vKA1?OS2ZJPh7^inz>4?;e5ojkbVTy`)(!rK|EFzU#O#kOCKY4 zwgHUg?)mwGRza4MZ!LVSeIb@Mbc~=`C1hgY$SjQ~Tv|%n)jfRmf~hGg+oj@%;Vq>< z7?>@W(pLHwyJd^uE)}{@5tHaZp+RUI9<1Y-nQFPCAHN?2XJHGX3MWJTIj_#X3P=i4 zR*!}4v6ZEAvSzwz3$LbmSPT@BpdB{WO84M;)3A1v+kIu>HH}NBW%4dz{!Uu)Wpj<4 zgmlztD>4=G`?!T_oxk?elxdQmB~b`S%8DW%H?8f$o0Sz?^!YImhDK8%I!1KsV8J!a z8L>83rEL=a8nqR+qdV(l!4^DpC$`1ha%i<%poNCD#6rPHM`!O4#*mh+#B;^7&4dS! z*-3#fhHcj#hAmw>8~-{@+Hw?6283;+eJr)ROKfMRpJLXl`^Vpws|83VVDAy@slFQ# zFA@F7hQBe_uIi0c>r<=|Ph3Qu8Ip7PlSLMk%G5Zv^kSW9vUBui%1xw-h{Ezn$YC-a z53Mi444<~8TPtP_(T=#9zeYlO#=dHXs5qa$u}H5BXo}S4t0+t6A{&X=`8kh+FANpK zA40o_unor{inLKf37piW2@ejtegI5|yvE0QDER+z;YqC)&DzNk`22^zMAb1QnjOVc zVxD3}~L}{OH%6O((J4qoMW(d@5 zZYoLSyzZ}r6qnjJzTPxu5WFlGDSsc>_(0p@ZMj!t>9j{i+y#Kxgx*)Il+#0SmV$TB=4^a)@5}1bxt`G9K>5@`Y)^)1Svy{d<1ZqD6c5%&w z9<&okX{olKBjuSP6FBohBS)95Gb8wok-y~4nr`q)b_QB~ZI2{ukev5}{|hDF)&oL8 z4#m{$LYh4eSFbW06Ojp2rH0ZnJW?pKlC_Gu=Z+C?B{|3DZnon8oG)dK!=Iwh7-Dj-Rry&qa#D>rZBz0?kg!q${p~ zu2f^a0wdEYwdy*OUTKeJ#|4lrAjND4m)BmIQ{?q_lw4bSA^83zRGsc<}S$NKe!Sh&JIt(JFEBwx*B9L?7AQ5n{6dWV!HuO}* zjgtA*?Wa~V5A5VbBRN&p_Xp!1>7*f!4!9!K*sv7}YjK^;vAeTs$U;=qIfeY-g*s1h?H2*~q&PF; z$XitKj*w=ydCZeQRpXdasOb0Cbvfy{s1~IFCS(a9W?@)({P!R9-}_-^wSfa*D$k z`cHcwEfc+)yb7a<;HPb8kt`)}fo{@IN#Q?VAHk2?O5&rZU8 z^N2-yv4`I~6nF#c5=^DLV|ei0WkY8aHttFvJbom=TGoNWU{6LbC)S91>SJGVgbFtnA|IntK% z?8pfW%KVs24_r8GPmv~(1gxQ}whc4fzPYoF~!-;&4clwYp;XI-Q$MZ+c% zum5t4+>YBO%PiVmk}es=qt<1D*NJuAO)9Qkcz92*fGpb=z~=-Oa+kpCMU<}e+y{Nh z7UWk%2L})x{=}LVcEkZ@=z^8az?wl)-kXW zb78Ey&$*rr&hg01NF>eXINDaJhxI)#f{Fuv7DmqztC(21&D038st)9PRz;_mo@U~7 z;82psqgy-GlFI&LZo%NiY){&G*HcUR^o2v_d6&Ga-hgezJ&tX3mP6prMg??^Lm*|= zE;J=)jT|RHncB@=KrZ!algLt zcG1<6p!g1(>t(q}AMu7t^Mu267c()sLaP##P17Tfu3s8at30&Q!>;PHW%U!NW&UJ6 z=1}!q6f$oMD7#Lf8NB)pCspzc6?&UwX)dd4r#N zFjt+muXy23{ulI9&DFL8za*k|JN>JQ{_oE`7dh5-l{<8~|K2eXlA%J5psVcv`dEHa zMsSIcwY5L_u^^8Benl#Gt`#ph*IqwGRek>Faa-2~6o=GrW<12wya0B+BL%6k%?O{K z2Zl(Xqmbl`B$p{L(}E-&LxKBZ5SS~!V-lzlE$k_=fTX43@1n2sXRP-38mjNo^P8iv ztK3~i`56U&SHvENAZPqNZ9NE<3CbvyBC)faS1>as2RyPf(Q_!o!h&G)uhB_$r$CPy zxg}L@6^WJOb)-4_rTo$~ZXr3t)BWcZ|4Q*Sp%1bJE;TWz;AWh_QZdJ%fET%PshUC4 z%nS(8P9N^@>PW&ZxeYr3Ft#@9NAOBEu^RN= zyqkkkQa#`ek8Pm}CAc#!(83RzJM~uZPe7y%Qdf=Nv#koW&)Ko$^FO$;?*5@xllz!o z5=A9AXHyxqLPc|Un=Z$#gCjin1v>EBLvGP7W@1Hk$_BwDyS;|zz<}i+^7Md{O6D0y zExGr&I2eM88+?OKg6N!fg6i7U88jMltJD!}*5;-mGWj~?kKVcfHbb!)dijfeYCN8u zayz{=T?MNxl#UNRDRwGua2nQnIzWaf78f2(NdE6^t6GbYd!U5$_|1+^k7vyE!lGIi z1G#2OI$byK{}QVyPeU67(cKrMGrs7L7iu|8iWy%2SNv$L=qmqeIgaX?;gAw1Jf`ed zd86s%?lm$5Z(5mNaxn>&{|^nVVnM&pfB(dn+T)MkqQ34A0Xp2nuJtLF0!MrTIM5s$ zxe-0QyduuY2*e0$4o*&$MO(3%9`ioS8Nev{R;K=+Ot68f#?MX5f94fxy`TTU{Knz`9ynWj50EQk(T@ zTTd9=cjIN_?wK>$M8U4GR1#{4a@DO)Zon+HEgziOU(^TVM+sD(=YhMsUf=h9g>Ofn zj}yYo-u`4;-o|PP;V^j&vUHXl6kqVHG=HtJ*B?jBSkkA^4@denL&o)yofY}r0kBZn zN?Gk6LISp5dzt|r!^`tj4P!_2BdHzu_N!jGqf@(Rn~mZTN)F_dgIxinQeGpl@9$hK z6b3~A%W(9?D~EEey=F{ljnuf=8X%(z_FAj0RG-?nOSMJVW*?gBLs~rja(S z-=$et4+|VgMz1u~UaxvTQ@lL_p%nxBk4pK@|MSh?{6EsdT@tFx~a&dz!bw6UD9$kvvqHq&W1luTVi4Q zpdmCPv19=ETp$x}gW+Hs&valA>p6CkqS--X8T+=0Y^Dt*vdc+cFvQm5&4zr#NhsKs zoasvaTVZC*px2x4#(DN?X4pTZ=HLByT*m;e&-JY$$FIBdyOcvHjyxf5+cd{fpC$hg za*gt+$rNm2E3@qjZ$>94&{8n7=V_@9$Hqzmi3BRk8|G)q6GQ0+B^nY4CnzJ{FF<$* zSSs0o3nz1BVIiOqoU0t@6Km<2d4*MR0O_y=q$JK3Ks3~fe{wP;p-j;|!=xO$EWRcTGP z(@6oyoHm$-B9Vm-c=4D}o|-wSEB}7Mr+>hLwn(PeSVdaa$6ba|Mp#NGa2et-NpgFG=X$Gd<^>KnOWv z8gK?$^LWYZ#Bu0hLEW^4_5+-B9(oKXoka+7F;59u?*}v8Nv61S^Nvg;BBkCJds*2v z?ngq{ejoiuTaUMwl}eE)cwtnGvt97Wcd<_rrm!LT*&nQ%1R=lAIs#WaTJ^SFb-Y?C zQpzUXPwKRumAiiIW4=<{$w$56>CNqSxt6OgqvD$;J?LDK#1_GE9g12l#$IgUoB-in zEaPmg7(Nuo$Mlh7j^RV0WN*=BAZCf01q(dLuHJSh+gkz&QL6TE`wCnb7Q3@iKuCnK6a*}! zO`Y{aIGADxx_eBsjne}%WiNysCe(^x6OtC33iq#cT9%KBzY)OMYf!z)ra8IT+5G+- z34lXSF`P0tG7ix1Tlm|MM4?*Jn_hk^ofVpu*P4gC=zsT6wN$#YiB@;_XI69*Q_tEnvtnl%3oH~$4i2Ps?SZ`s z+b{>3ivKx5U8X>9eI3scHWG+pEzxU$OC)7%@~c_hOd#CPd~$#x5V-56{=C1xkn+<%|?#>5lRaxNX$T|1ZDEd0(jNn&($#YPj4 zWw=a)u+KAjs5MOv0>MLJr<8+Mc4^0+BJ?X54{+dQwp&^G*Pv_6<&AcuC1Ht6ag zWXnSL(mNqV58P3bY9C9|B{73EVk}W=qSDMj4kys>>Jg^%JssnB!FB4ew4DS~!i6+Q z^V)IScIXOV3k0&k3tC!%h>gY=9S3J>tn&Fq-D|AGGTXJz_^INm=5YZwMZ*adJoma$ zX-#4m{_^AVi4&opehmDlO#&u2R(H{tkDC4$^`N8ze^@Jkd0@)X5%ImP6Yq|oquRB+ z+cg@T*}raW#&=;ytNl~mGF%#hgH?6u^KbDl=Y$q^ShKfOa)vebroFze`ij92?0};_ zNhB#{ZIq}6Z;fJ*)P^03op52dGn4r`)X!>E5zulE;J1gHy)Jzjh zTzuDT>+o~XUz@AC=H-Lt`f+>%b8pGtF_Hb73j73?RciC+W_>g#xLN8jb@&82ksH~f z^jCQ*OAW|DIAnHXRVEx!JN4<%uIE?Yb^3{|bL53H%U~Bc<`i9_)7C^X0 zqa7;ZNcGU-4hj=Sj-rFsdW99Fc%?tnt4JXUY*Ka~hQM0FAa*7T*^h91DW|5&P*qju zL4mD2xNo2=vBJ2Ul2qcM<~^Ahj{qDGhLviKxIHW$Dq){RR7{pM8Rx&)VRU;42XDB) zyzlL~M{Bp#qi`CQzgNh@Q}XH%`8vt(5wL*pAmzj7F?#^$ryLC-2fMz6iCn15x^O=&Kwg*dg9{YAl@tne3H)GQQ|)Y6-xv?d)T4!9sM76jId& zOOU)_Ga{Oa9Gd5cw%Th((e{u@26YEG_)##aGaaM~Wi{jRNgG}>68+nni^G(>eY(~i z;)%D`zCzl6w9R3_r(H#>erqj(>2Vq(`ZNPJp19wxCg z8N0;6v7od2pA#4AywP>vSsXbv_jgP9?g3k;5~OOvPt>oDNIc&Xd|9HOP$T_WO@6{n z?>s_DQsm=BroY)rRcKrs_0riZ*Cl!u-2n$4BhZEMAm>eQ@$ZTreBp*VZSCLX@P_iYIh4QcBTz zDSrnZ0!~WuhM&A02`D|ewCg?nyvI!q>9U(|w|Mp|0_$JYjUzh@XhQ_<>9gvo!dy}G7PwN@HLgssQ zRd6zodIl8v-_NW#68}smgjJ(&zs+x~GdD(~1)iJv!KJmeKTf2JihN^~%d^z}t#^3X zrjpsyq!w8Lu;T`;ICp_X#$;)BK4G@{;LITU0*Xv-f{vrBi6I0zayoFgdMQ+Ou_x{f zkWDYIG1CKk;vCewFlUP>PVhDQT8NHHj2#A6u|#J0RGDD?on}&Gsks%d<|iH#QjEte z5O(8^jV};ODP5;&#$iKB#-aS<>%4wH5eqR_7#VQzmFz>xRi&7oOS*P8V_JWj?F;rs zt+fKU0rdDnzoXLPaobRSgakoQ+B^B0-nD)r@uGHiYO_3@sVkq`g`fj};)Vn8-ZWcx zQ;U>*{64qQxs*E;)T53wF}voy=5P7NPy6pxZK3oSN@cB%r##8`QZ<3<@KbvX9XUzS zlP8}RblOit&fSG0H;SBU)W9F#>|3C^`kbar#WEQ!wx#bS0&4KvUTK|$!?hSvRqSSe zfa_ZjO<~VP;f}HD)0h-fzuo|=*1p84hqsL%FO46JU6+ioWw^XZJ)0J7#?4vWFeq!T zr4;z=8G-fadjw%dhJ|6Khjwg?lh?%vbt~zJFUrhP=ir1q2?x#4vjZ>z2KF{xKdtcq$+8%8q zHmxwXjGk?-lKxaL>e?9Y{GFZF2+OnzEq&OcvpYyWaUMIa6SrAb64C2?q1VpymM5oE zd;WXQ(i(07GMtZT`tv^yQX70TI>6yxMCyG}&Ub+6dp3JAYxYi|07)2DWD`Pqe~=9r zzRfsE97)U8mbYF6jW0@+UgrE~O=qMsb2Oh z$-{_`Tkk#!p01(o*$Ho-ttB736;Z{bOIQ8qB*Qy~(VYp%=*&?_yuXZea4oTm)$S!^ z8mzKEIDnxGhYLZGNeuG9eWdF5mt8n@S;P z8Y`zrwNFLi^VLq=DCqglA~jPNzA~K~ipdxqjOv&(U%cOe9BO%t-C7AHX^3k~6rm~Y z=}KPVp2_a=we>6k_+WB3ePaqi2uRBJ+FYrj6KlCDLzcPG!z1kt#8d{GMe0zdkx#;?*F^Wbp?9AY zuxT;K(lQbTdiEdLJlvDvg7b%;`UO3`6A=0_ihJKgb?MtE*|5AcrA&pDY{&vGfJwb` zKbFG~4zcB-fl^D>3epc82^RMinsk&BWWUo*-YjR!o4_ib?KInK7Vo^EhbcKm2h3P3 zlO_Q$^tzLvD(jOc5Hwdg!ahKvjReTjPHJ^fO43_Q(0>-F!+RGTy;^1d)GZwjn#%;+ zO@%*zl~b3czO^5jD#_oD6x;O~EYxx&cd=6Kk5Jgpu6+-~ua2!;sYV~Un#H4v(9!IRorolxpQZd5y=?8uN_4-WXIKo5 zyU`F|iHLtMA_H#*-OpU9{X+1-{yh_aC&nr`ofSBdEu=MPTNIO#&r(=vMYoUugj8pk zjE+TxQKdoM_epL=2S4C~xTh}rD^8poPsN$FU>c~B6nNshmAZwzsWW6nysbK{U!;7VJJ4q7%f+n5V)0z&U#sTK%dC&)v+R)EsE? zM#+slMXA1=JVKNkST4YpM>xx%Y%DkuwArYRWu{o8HYfgiM!Xi#BG+3_<5B4P)!SjO z@0iG7qgq8yml3*GyidNnv{Z`-rIZIpAjEy6kX)MyWMSVEW*=!7qZIG#mM5~t5 z-TiSFc`=RHlN75}*PsT(*GxuYztowX^KksOHCDcpp~sc_s}kn-%SK|?k;A2l{@g@m z59FdXoQ|9%KG) zBDlOZ!$1q0qWK$}$6`#KZbuV3U(#)BH`Pi`_X;;Z`UWxmM*qO&th`g{Dlc%LH6X*H zr~8Z#N&#uzu5Rt@SstwJ1;R>GCHuXNSkVZCnQ=L-pm@eR>Xagp^?D+uPjH8IM|uhr&y&rT1@V)ZyUFkrgrvSu^c zecoUz(~~jRu)(80u{<|CYWRBDquA`RJ~JqOBV%b>21u{tVv#Tn)Ln>e1>2^Xyt$kS z<`s__jIx8#xgp6E@=R#%7Pd&FZ=E5lFWMh~#w?orUevSwx6*vRRR~^nglw$akG;|A zlP-U%*FDt4>lhj}{YKc7PP~@Y-OA;cv1!gZ>|5gz)svR7YQUX=uiI)Kur0*NoOL-y zM3`cmO`gV_%$@6^gL)@{`xl)t?Ze1?4&FliaXXVev4e0aQ7nF1K^*=}5tJa}(^ADA z5rzm!c#1e>Td}tONXxUxM7HN;u4F5b;PqmKG@5sgPq~29Ywx=RSlF%bTYS7_&RG1S z=-dvYliE`6jw&SW2~(tKF}|`}GjK-$j!6OM|Icg(di0= z2#tZ@jW?d@%pr(gc+R@(k{?&qG&Uz0-<7AnKJQJBe9dgY4=XDPMj%6geUX-_=e+IN zRw!b~@@+)_>%?E-!QKDso_LtyV^1IT0CDjG;JTuHBXU-XkOHx^FdVJcupRIm$4*sy zgUY?J9_`F9`-jpny#zBsmctPdXwXcqXm%U~dHl0()->`L9Iv1o)#%=dE`< zOfFgMPV1r2Up|{H%Hun(fN|z)tg}L?;cq(ivB-@L(^wuyQ=DRvx{^ zl%}iuFeY+>q1IH>mE^~jk9WF8t5M#iX+U}=3v(}F_tg-ewYm=J+5*=LOU{^PB`iGA zSbiFPh@A6}gO<^;U zvW!0lXqt&NR2|qt)Vcj}y^@w(6vHrvTyXBxZJOYL9UQb_Uo&@@{HPo-;~GA8PV@o# zYUqz>K7gc#QOt5KP94%#L<8=fr0>t8ui1su*^@w(4X|A%*>z3yX4i#sjAU7mNm|os zyn8~>}h5mdPXO4r%F8ykluJ7W;^>OXXR z`FU&j+;9&*$M9ei=#t;`yILgI!QZIP>k%k8N($JzIhD)%M&M$)vl?snsHC1d1E`_v zJV;iiEKZsQkyG$GT_Fj5g3cr)wR+!nNF}%S=~8@!Ezu7!5t*9eU4|*p#kpE?=}o*d zZ^abl@jU;onWV(v%l;@DHcheXC`N0a@cCI58XU5MO*c24NECZ&gf9hl$l+l>$YDJI zREEpYo|JUCT_kfDQ5Kb=)mUmOe@$LXqlUuSORK2f68TZU#c+5}ek3;k$8$L;?1DRS z7U-)cSXblkZevkvy(F5n7Y5t2XWF5Sq`n0;#As0Q>TgJ+cZPUQwr2^*2OCcr|KX`W9>)K##w2DX(I;(R-ipKCJ@d-hfG$)0YN_Qed}&q9V?pa zGWWSA#II{iHSEJDd!`@*AUer()$1!x*6MS3K}>};p#4nka*dXh%eRzTJ3Za+QLjU+zmHbtca~b(n}w z%9-m;)uYr)(nwow8o$M8yksn`g3=gcm;#c+onec5UBszWmguW{3+pk%pKt6!c+TGR z#2x%%qO0c^?t38C;ilthj5tv%b5Oxr;-zBtXeB+m!4446+_yLv8Fu4@x$9%8s_1?At@y+x;qJgJ}lb9<3dvPgVl#?U) z3`ap|k~HSHvS8cW7_JV>n2t&>V3g{aU?@(=lUx11xaVjh7V8Ii$l#bEvP>+`Z9BUN zw5s*P)0e}Vis}v4=qBCx?wTM%I22>!#AO&t0bl(`Y?~2XonGMWK{!h@Fych>cg*HD zgoTOjykJ@jXH*zu=5jt+iki*zg1~23ESF6CGsg}33aX1&RVzC&GwIMYaJ%#UCKi*{ zh&!(pS5DkrdAX_ZC87c^YcTnONb1q?%e^==<8q0A1yE@rQ@fTsZsogeQIvlHjrgf` zuA^njBc8+95&|F%r6xw|iix$uW`rJIuG$PTW33UP{^*Wa?(Up*7kD39Sh((k*VYlP z!t)RbFMordR1VjZk+FMt#|L7Yta}3U>j{Nd+EzR9pKUA6%a4$reS}k{h!DbGpP`5! zNDpF31#mcWIZVOCVYuxEe=f>WahrlGKIxKAev@umFxmN!FYFcwrg?q&k*6!=qxk^u zcjmUJD`f)DXh<`ZHa%Zeb zWuTdssWxaOz&cLNX1cM7o-RGBQB>Bn0l#Y}<+s-c;H{gGgI>be7bAM=Ia%Z1uPZF+ zfHB;QYNC9VeO764H5t?4X`29%&*benNb!ZoDg{2P1c{#Ra8BQT7EdX4FWlEyel5eT zkJKuvSgFXDEFnB0fR;WE_^hRgMab!KJBe4r=3IYKb}6|bcw-Ef?iy8!O>)4M8WryW z(|9tilg9*mn8Y0(-b-8N{+_9)hl;tjr7caf4T`MX4sY1)k)aAkq&=*ZGI#lJYkGz= z8dDlvO>Q^PJ22BSn-m8U27=PkjOP4tQ&?WbO(41?Ia@mKw!uSCKXJ)N7xkj*_<1e z=Mh0rN8o!_VauQLez0NOljaFD>Mlx~keac4ub=8IEoQzD=1by7gRX=$B}5@Bq)CA* zA5r<}bEM;t#V`L68W>gkPry7(9F{cXoV3VDcx9Zoa_m|?^3f$h_U3uYGCy>`!Hc1^ zw`($q(hh1LckFn(7)To7k0`rF=ZA#xC9jY5*~07s=w5I8@0SEB2}=C09!pw}{JlEA zW+?F65=}5c*HwMHHm+7Nx$zNOSb!L*nPNM#GIQPYpTU%FptD_WAdZKWZwz>ye=Vr+ zWN4-aqw3UP@3GLyZ)8g$8(*yQWw;weMp4#@<$eWj%{5ebtDXR!RwVHdnNAjCl#z55 z`Bie8u(D}yTInW{3T-EYbs(U*KYj^({eoQEiRV?(LAOwYl7FRtY6A)2u;@ZTr^`SL zRDG(zlH^6+vtnIP&kWytm^K?CNMD>{;EaIo%6i{Jgc2sob9>HVutYZ7ahId95^PG0 z6D&bVvwe$5Y3)QI+>$)$dJ{0hk*8R5Rjq{WgtLkf=8V_R+pP|<`92G~QlfTXSmUOU;;`NHu_w!&(cD!zht7K<-7fptQKDy?9zG?zB$ssWYKZodUR|}K z1CDX+?nH8jPuD+htBbQ)FPyp0E=HAf2}1}R`hcY>)Z;R=pC3d6erkb=AnZQ#HKrbS zP>T1whn>e_9G$yhl~fqHn#OsRzp1$apE#|F!AiGwhZ0YfoNewF;Mcd_#VgRVB_JlX1@Of{uX} zsAN0HXu|N7qQR3uqQIc+Ysc(qm$*``^ngT|=K97tMfrZ2w=q<}@TIWofRpPS)vIaC zbQx?iK?K(4J8 zJ^fpe&ieJ%`Sg+BfVmtF7Pcles>%Urs4)!SzH8fA1xqz3r)b(ls@vS{Sfvcg*P*jW z=k&3c-Q!2JVMAmpoL4>rPc@l0fO|HH#t19w!MYH&F}qKgoma!bbHkg znXZtPj97s;-HeVZL$c!muW)>$4jzhjgLF)6#!lZ;P+Vf;&UQnziNZGH1sVfoA~0C0qV^_cYJ!9 z-|x`^H{i_w9%yfaC!-)_#7f3}M;Ur*mDRdwr2%sejx9GG-Njbu#g{4AigE9~CFW%J zT>gz%Lz*ieo0{oJF^(O(ii)J-DBY;7H!Y;AJ)bb0u7VmQ&A+#QD-uP_z*4V+UL{;9 zMxr2|dNs42A_)3sIhlY=@vDralrjTThIq~&0%2@bwYgDSQaIBdhwb+Y%%f)|!pbiY z7+8L_x`80ZWA0SucOOo`)PgtzQvhJM=easiL15Tw=X(7-Y#0YFMVel92Wvz3o{&t| zVMFFKw(p!7Lk91ZGE~@6SVS!c{pc5^{`Ztr3tzAWJG z&r{&?k6r76?uUgX?b;n@3OQx z9-y|VXv<%qftC~iM-TdTOs1_y%uU}m?rL#Cq8Wi%Qokgq1EbITiu>dEW=TQzRB6}$ zqe~MvBMQetCh?4O&m#tWHXgu1wl@EZiH?RgfSV4Y$)7s)&GPl)$NaKx-y?<19l>56 z{w6aTd{AQTa1?;Ir4K?~x8c8vN#iqHUE!{SZgwZWp=UWv&hD5Zlk2Gtj!EhOphK9|z|1v(w3(b>-#C~Ypby@EoMP^;OUABT`U zJi^TW>h`uCPWEoocsu!q%a?j)nvCNZ9$v*X=0Ew}jz%VmxZn*j)G)VS< z((fmwe~;j1kQ;KwuC1iKULtidnGZ50o4vc>x2z?FfZL1XE85%E;|HN#U1=s*vx9Is zY!ywjQA`^Lx-DYJQ$#$?r~z3Q#R_|)j`Ez#*|-5GT`x)0N|N;UxGStXBkva*X9FH! zMQho7Xu8c54Er;N$ZvfJGvA#Ob*_kdj>mbBrjhOd7trY^S9P8*y?4vXamgIi{NN(8 zHeuP#r13%-tl+Y;u_O&5I)0wfI_!lS#K$8-O&Xx#jzP+jq{!cGPzF+NO`B&cV*%MV zsu($u(vNgw9T~hFYM#fXZos3fUvDaT@e3HI+@q40aL4kYx{_p5eC%!{TMxJ1@Q32e zhv!2=q;0AJ@!^jvD-myfT)l367(T92BscPi=T)blk8oTyq6QvES+T~PH1^uyH+q2l zGB*0B{kZc)Y;oOZo0&&a?=0J$PCZsh`c>fV!?`)B1?M9NQ1ktdkDY6zLQ8L98_~OqRt@2QWC1sZ&7SZXm^WTJ>j+?b`ah>0UL^IV-~$bHj{Tu`*AMI2ygh z!u!t)J*-o`b?Ku&V@k#NGTrpJvIoKG0Vt!7wg>`O9eYr{ZQ#f#8acA_8VD1Pi^IPL z;DiZWucd^oL@qZ3rsT$9*_pr5Z5+XFwg~A(yd5`e*Sh~gp6hl0XMezlTCr^6NwjVA z*7U#FCt5bZ1J7%WS8knW#$CVtZawwH$QW!I@}K`6jK|{xM-L@FPln^W(*w{C$vL<* z*z2Z?+NI&Z#;xc!XjzJiI=EHMBplCKIk{a=*>uf|oJpwMHhp(8IsIyKa$wXzlV~)f zrJBt2WS(TSstPvY;y{mzt{d{2JR{wojS7dYW6$ewb$C~BRsFU7{uMWgHdn=3(!y;X zUMpVC*9Dc%4+jL(964Uk`2n$EFsAu&3s?}6t)7cwy>vmn#^h%u%D1#yJR=jBaoxCi zGg!7uSTvEJe7hy`w0KOQOl;>*VS}!lDtm{T5 z$~z{t1eJ+-$^Tt9SEtiN=3+A4k`}1Z^u4!e={dKSbYt>jk#*@b5d_x#K}ZG{YR|}` zs#faR@$sBjcC}_=xm=gL+8o2ek9pNy;L*EeBTMHpEeGzZ5xGJcx1yqp0}3~#)J z2`lrJ;ALf8$GKL})Oxz)l>!JVraZ@SB|I&i!*&Om{w*L|ugqmh&gqgB=Txx|Kb(5h z)L0Ku`hdFodH(|+LZjJ{-KQHe2uCozWhIV-L+fHaon&HpJS*1kv-}u#zp-R91l=At z2S}%dn9Xa>E6G+OgxBwj$83_Z!glBR>H%{24|e8q=|n5J*9w?~U-}M#2kKvH`pZ!_ ziFm=vd9{F!a!gXM#YQq^)qPN6g|jt8+aqN0TZw{a!)}eEw@}W>yT78c;+a1D>+WJ* zM)aMDq7e6?bm<}L0a4y=drP6%3vheF ziC=*enE?fgeq}ic842lJ9TBQBV-3I#+=H}%Q-l0pfIW`Zs0nl{h_~OW{VZxPOg7P_ zB1*>WbBZnR!UNd>Q)9~?nKX-&>Q8A|@vM$Lm$aO-Is9P5&y|M%7GO@ zem&THhQ6oI=PMx9;lv%2hJFifio0q>=YNV@Sr?2f_<$GQ&Osu?N_<~lW z5nKe&IoUwejw2UGD}_$}Qf6cHXT>tfsw*}dK18l>it#03LC|OsxZ6=QeLHcu@bOb@Hq#%v)PUF0xxD$F};Pjtu&szs3eW zez(JWXo39;K>inK_VUa4!X8NlPphtPwRYw2{il zkwpuTN-`$(>?}6qUW#%a7gDTnNfiBdma2;2^>tI-`a1pE>b6_KMDv6v`VcSI3Ugx!z{bkgunMGV6J@t_Uy5 zl9qfHIw#S)sh}A%OX-0%qle78Kub|-MFDi!BumeOT37g z@=B2<%^6|uR|U^_^(Sz*KO#Tjd8fCQf=?xtn`2t6c*%b9*C;7$bJc>DLp-s+H9)&JPp7JO>?A0DCqU8Pxtb%P_ni1dco&R z4W|-%wC?_Ap&WPyXFaaQ}^8X2Vr-%?Mxc_ z_^-=H;FI6_1O5Z!Oyi>C1+cP`v;a2%vv2<+ z7a6%{Q^hOxum7>O1ay6ow9FQ$x%^@BvAOy5JUvg()AQ?j{(k@f0RR8VcF4>C5(NO~ CtRBh$ literal 0 HcmV?d00001 diff --git a/charts/fleet-crd/104.0.1+up0.10.1/Chart.yaml b/charts/fleet-crd/104.0.1+up0.10.1/Chart.yaml new file mode 100644 index 0000000000..0fd9b6ddd8 --- /dev/null +++ b/charts/fleet-crd/104.0.1+up0.10.1/Chart.yaml @@ -0,0 +1,13 @@ +annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/release-name: fleet-crd +apiVersion: v2 +appVersion: 0.10.1 +description: Fleet Manager CustomResourceDefinitions +icon: https://charts.rancher.io/assets/logos/fleet.svg +name: fleet-crd +version: 104.0.1+up0.10.1 diff --git a/charts/fleet-crd/104.0.1+up0.10.1/README.md b/charts/fleet-crd/104.0.1+up0.10.1/README.md new file mode 100644 index 0000000000..2452ab2f1f --- /dev/null +++ b/charts/fleet-crd/104.0.1+up0.10.1/README.md @@ -0,0 +1,5 @@ +# Fleet CRD Helm Chart + +Fleet Manager CustomResourceDefinitions Helm chart is a requirement for the Fleet Helm Chart. + +The Fleet documentation is centralized in the [doc website](https://fleet.rancher.io/). \ No newline at end of file diff --git a/charts/fleet-crd/104.0.1+up0.10.1/templates/crds.yaml b/charts/fleet-crd/104.0.1+up0.10.1/templates/crds.yaml new file mode 100644 index 0000000000..f20173ca36 --- /dev/null +++ b/charts/fleet-crd/104.0.1+up0.10.1/templates/crds.yaml @@ -0,0 +1,7069 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: bundledeployments.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: BundleDeployment + listKind: BundleDeploymentList + plural: bundledeployments + singular: bundledeployment + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.display.deployed + name: Deployed + type: string + - jsonPath: .status.display.monitored + name: Monitored + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: 'BundleDeployment is used internally by Fleet and should not + be used directly. + + When a Bundle is deployed to a cluster an instance of a Bundle is called + a + + BundleDeployment. A BundleDeployment represents the state of that Bundle + on + + a specific cluster with its cluster-specific customizations. The Fleet + agent + + is only aware of BundleDeployment resources that are created for the cluster + + the agent is managing.' + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + correctDrift: + description: CorrectDrift specifies how drift correction should + work. + properties: + enabled: + description: Enabled correct drift if true. + type: boolean + force: + description: Force helm rollback with --force option will be + used if true. This will try to recreate all resources in the + release. + type: boolean + keepFailHistory: + description: KeepFailHistory keeps track of failed rollbacks + in the helm history. + type: boolean + type: object + dependsOn: + description: DependsOn refers to the bundles which must be ready + before this bundle can be deployed. + items: + properties: + name: + description: Name of the bundle. + nullable: true + type: string + selector: + description: Selector matching bundle's labels. + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a selector + that contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is + replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains only + "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + type: object + nullable: true + type: array + deploymentID: + description: DeploymentID is the ID of the currently applied deployment. + nullable: true + type: string + ociContents: + description: OCIContents is true when this deployment's contents + is stored in an oci registry + type: boolean + options: + description: Options are the deployment options, that are currently + applied. + properties: + correctDrift: + description: CorrectDrift specifies how drift correction should + work. + properties: + enabled: + description: Enabled correct drift if true. + type: boolean + force: + description: Force helm rollback with --force option will + be used if true. This will try to recreate all resources + in the release. + type: boolean + keepFailHistory: + description: KeepFailHistory keeps track of failed rollbacks + in the helm history. + type: boolean + type: object + defaultNamespace: + description: 'DefaultNamespace is the namespace to use for resources + that do not + + specify a namespace. This field is not used to enforce or + lock down + + the deployment to a specific namespace.' + nullable: true + type: string + deleteCRDResources: + description: DeleteCRDResources deletes CRDs. Warning! this + will also delete all your Custom Resources. + type: boolean + deleteNamespace: + description: DeleteNamespace can be used to delete the deployed + namespace when removing the bundle + type: boolean + diff: + description: Diff can be used to ignore the modified state of + objects which are amended at runtime. + nullable: true + properties: + comparePatches: + description: ComparePatches match a resource and remove + fields from the check for modifications. + items: + description: ComparePatch matches a resource and removes + fields from the check for modifications. + properties: + apiVersion: + description: APIVersion is the apiVersion of the resource + to match. + nullable: true + type: string + jsonPointers: + description: JSONPointers ignore diffs at a certain + JSON path. + items: + type: string + nullable: true + type: array + kind: + description: Kind is the kind of the resource to match. + nullable: true + type: string + name: + description: Name is the name of the resource to match. + nullable: true + type: string + namespace: + description: Namespace is the namespace of the resource + to match. + nullable: true + type: string + operations: + description: Operations remove a JSON path from the + resource. + items: + description: Operation of a ComparePatch, usually + "remove". + properties: + op: + description: Op is usually "remove" + nullable: true + type: string + path: + description: Path is the JSON path to remove. + nullable: true + type: string + value: + description: Value is usually empty. + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + forceSyncGeneration: + description: ForceSyncGeneration is used to force a redeployment + format: int64 + type: integer + helm: + description: Helm options for the deployment, like the chart + name, repo and values. + nullable: true + properties: + atomic: + description: Atomic sets the --atomic flag when Helm is + performing an upgrade + type: boolean + chart: + description: 'Chart can refer to any go-getter URL or OCI + registry based helm + + chart URL. The chart will be downloaded.' + nullable: true + type: string + disableDNS: + description: DisableDNS can be used to customize Helm's + EnableDNS option, which Fleet sets to `true` by default. + type: boolean + disableDependencyUpdate: + description: DisableDependencyUpdate allows skipping chart + dependencies update + type: boolean + disablePreProcess: + description: DisablePreProcess disables template processing + in values + type: boolean + force: + description: Force allows to override immutable resources. + This could be dangerous. + type: boolean + maxHistory: + description: MaxHistory limits the maximum number of revisions + saved per release by Helm. + type: integer + releaseName: + description: 'ReleaseName sets a custom release name to + deploy the chart as. If + + not specified a release name will be generated by combining + the + + invoking GitRepo.name + GitRepo.path.' + maxLength: 53 + nullable: true + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + repo: + description: Repo is the name of the HTTPS helm repo to + download the chart from. + nullable: true + type: string + skipSchemaValidation: + description: SkipSchemaValidation allows skipping schema + validation against the chart values + type: boolean + takeOwnership: + description: TakeOwnership makes helm skip the check for + its own annotations + type: boolean + timeoutSeconds: + description: TimeoutSeconds is the time to wait for Helm + operations. + type: integer + values: + description: 'Values passed to Helm. It is possible to specify + the keys and values + + as go template strings.' + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + valuesFiles: + description: ValuesFiles is a list of files to load values + from. + items: + type: string + nullable: true + type: array + valuesFrom: + description: ValuesFrom loads the values from configmaps + and secrets. + items: + description: 'Define helm values that can come from configmap, + secret or external. Credit: https://github.com/fluxcd/helm-operator/blob/0cfea875b5d44bea995abe7324819432070dfbdc/pkg/apis/helm.fluxcd.io/v1/types_helmrelease.go#L439' + properties: + configMapKeyRef: + description: The reference to a config map with release + values. + nullable: true + properties: + key: + nullable: true + type: string + name: + description: Name of a resource in the same namespace + as the referent. + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + secretKeyRef: + description: The reference to a secret with release + values. + nullable: true + properties: + key: + nullable: true + type: string + name: + description: Name of a resource in the same namespace + as the referent. + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + version: + description: Version of the chart to download + nullable: true + type: string + waitForJobs: + description: 'WaitForJobs if set and timeoutSeconds provided, + will wait until all + + Jobs have been completed before marking the GitRepo as + ready. It + + will wait for as long as timeoutSeconds' + type: boolean + type: object + ignore: + description: IgnoreOptions can be used to ignore fields when + monitoring the bundle. + properties: + conditions: + description: Conditions is a list of conditions to be ignored + when monitoring the Bundle. + items: + additionalProperties: + type: string + type: object + nullable: true + type: array + type: object + keepResources: + description: KeepResources can be used to keep the deployed + resources when removing the bundle + type: boolean + kustomize: + description: 'Kustomize options for the deployment, like the + dir containing the + + kustomization.yaml file.' + nullable: true + properties: + dir: + description: 'Dir points to a custom folder for kustomize + resources. This folder must contain + + a kustomization.yaml file.' + nullable: true + type: string + type: object + namespace: + description: 'TargetNamespace if present will assign all resource + to this + + namespace and if any cluster scoped resource exists the deployment + + will fail.' + nullable: true + type: string + namespaceAnnotations: + additionalProperties: + type: string + description: NamespaceAnnotations are annotations that will + be appended to the namespace created by Fleet. + nullable: true + type: object + namespaceLabels: + additionalProperties: + type: string + description: NamespaceLabels are labels that will be appended + to the namespace created by Fleet. + nullable: true + type: object + serviceAccount: + description: ServiceAccount which will be used to perform this + deployment. + nullable: true + type: string + yaml: + description: 'YAML options, if using raw YAML these are names + that map to + + overlays/{name} files that will be used to replace or patch + a resource.' + nullable: true + properties: + overlays: + description: 'Overlays is a list of names that maps to folders + in "overlays/". + + If you wish to customize the file ./subdir/resource.yaml + then a file + + ./overlays/myoverlay/subdir/resource.yaml will replace + the base + + file. + + A file named ./overlays/myoverlay/subdir/resource_patch.yaml + will patch the base file.' + items: + type: string + nullable: true + type: array + type: object + type: object + paused: + description: 'Paused if set to true, will stop any BundleDeployments + from being + + updated. If true, BundleDeployments will be marked as out of sync + + when changes are detected.' + type: boolean + stagedDeploymentID: + description: StagedDeploymentID is the ID of the staged deployment. + nullable: true + type: string + stagedOptions: + description: 'StagedOptions are the deployment options, that are + staged for + + the next deployment.' + properties: + correctDrift: + description: CorrectDrift specifies how drift correction should + work. + properties: + enabled: + description: Enabled correct drift if true. + type: boolean + force: + description: Force helm rollback with --force option will + be used if true. This will try to recreate all resources + in the release. + type: boolean + keepFailHistory: + description: KeepFailHistory keeps track of failed rollbacks + in the helm history. + type: boolean + type: object + defaultNamespace: + description: 'DefaultNamespace is the namespace to use for resources + that do not + + specify a namespace. This field is not used to enforce or + lock down + + the deployment to a specific namespace.' + nullable: true + type: string + deleteCRDResources: + description: DeleteCRDResources deletes CRDs. Warning! this + will also delete all your Custom Resources. + type: boolean + deleteNamespace: + description: DeleteNamespace can be used to delete the deployed + namespace when removing the bundle + type: boolean + diff: + description: Diff can be used to ignore the modified state of + objects which are amended at runtime. + nullable: true + properties: + comparePatches: + description: ComparePatches match a resource and remove + fields from the check for modifications. + items: + description: ComparePatch matches a resource and removes + fields from the check for modifications. + properties: + apiVersion: + description: APIVersion is the apiVersion of the resource + to match. + nullable: true + type: string + jsonPointers: + description: JSONPointers ignore diffs at a certain + JSON path. + items: + type: string + nullable: true + type: array + kind: + description: Kind is the kind of the resource to match. + nullable: true + type: string + name: + description: Name is the name of the resource to match. + nullable: true + type: string + namespace: + description: Namespace is the namespace of the resource + to match. + nullable: true + type: string + operations: + description: Operations remove a JSON path from the + resource. + items: + description: Operation of a ComparePatch, usually + "remove". + properties: + op: + description: Op is usually "remove" + nullable: true + type: string + path: + description: Path is the JSON path to remove. + nullable: true + type: string + value: + description: Value is usually empty. + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + forceSyncGeneration: + description: ForceSyncGeneration is used to force a redeployment + format: int64 + type: integer + helm: + description: Helm options for the deployment, like the chart + name, repo and values. + nullable: true + properties: + atomic: + description: Atomic sets the --atomic flag when Helm is + performing an upgrade + type: boolean + chart: + description: 'Chart can refer to any go-getter URL or OCI + registry based helm + + chart URL. The chart will be downloaded.' + nullable: true + type: string + disableDNS: + description: DisableDNS can be used to customize Helm's + EnableDNS option, which Fleet sets to `true` by default. + type: boolean + disableDependencyUpdate: + description: DisableDependencyUpdate allows skipping chart + dependencies update + type: boolean + disablePreProcess: + description: DisablePreProcess disables template processing + in values + type: boolean + force: + description: Force allows to override immutable resources. + This could be dangerous. + type: boolean + maxHistory: + description: MaxHistory limits the maximum number of revisions + saved per release by Helm. + type: integer + releaseName: + description: 'ReleaseName sets a custom release name to + deploy the chart as. If + + not specified a release name will be generated by combining + the + + invoking GitRepo.name + GitRepo.path.' + maxLength: 53 + nullable: true + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + repo: + description: Repo is the name of the HTTPS helm repo to + download the chart from. + nullable: true + type: string + skipSchemaValidation: + description: SkipSchemaValidation allows skipping schema + validation against the chart values + type: boolean + takeOwnership: + description: TakeOwnership makes helm skip the check for + its own annotations + type: boolean + timeoutSeconds: + description: TimeoutSeconds is the time to wait for Helm + operations. + type: integer + values: + description: 'Values passed to Helm. It is possible to specify + the keys and values + + as go template strings.' + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + valuesFiles: + description: ValuesFiles is a list of files to load values + from. + items: + type: string + nullable: true + type: array + valuesFrom: + description: ValuesFrom loads the values from configmaps + and secrets. + items: + description: 'Define helm values that can come from configmap, + secret or external. Credit: https://github.com/fluxcd/helm-operator/blob/0cfea875b5d44bea995abe7324819432070dfbdc/pkg/apis/helm.fluxcd.io/v1/types_helmrelease.go#L439' + properties: + configMapKeyRef: + description: The reference to a config map with release + values. + nullable: true + properties: + key: + nullable: true + type: string + name: + description: Name of a resource in the same namespace + as the referent. + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + secretKeyRef: + description: The reference to a secret with release + values. + nullable: true + properties: + key: + nullable: true + type: string + name: + description: Name of a resource in the same namespace + as the referent. + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + version: + description: Version of the chart to download + nullable: true + type: string + waitForJobs: + description: 'WaitForJobs if set and timeoutSeconds provided, + will wait until all + + Jobs have been completed before marking the GitRepo as + ready. It + + will wait for as long as timeoutSeconds' + type: boolean + type: object + ignore: + description: IgnoreOptions can be used to ignore fields when + monitoring the bundle. + properties: + conditions: + description: Conditions is a list of conditions to be ignored + when monitoring the Bundle. + items: + additionalProperties: + type: string + type: object + nullable: true + type: array + type: object + keepResources: + description: KeepResources can be used to keep the deployed + resources when removing the bundle + type: boolean + kustomize: + description: 'Kustomize options for the deployment, like the + dir containing the + + kustomization.yaml file.' + nullable: true + properties: + dir: + description: 'Dir points to a custom folder for kustomize + resources. This folder must contain + + a kustomization.yaml file.' + nullable: true + type: string + type: object + namespace: + description: 'TargetNamespace if present will assign all resource + to this + + namespace and if any cluster scoped resource exists the deployment + + will fail.' + nullable: true + type: string + namespaceAnnotations: + additionalProperties: + type: string + description: NamespaceAnnotations are annotations that will + be appended to the namespace created by Fleet. + nullable: true + type: object + namespaceLabels: + additionalProperties: + type: string + description: NamespaceLabels are labels that will be appended + to the namespace created by Fleet. + nullable: true + type: object + serviceAccount: + description: ServiceAccount which will be used to perform this + deployment. + nullable: true + type: string + yaml: + description: 'YAML options, if using raw YAML these are names + that map to + + overlays/{name} files that will be used to replace or patch + a resource.' + nullable: true + properties: + overlays: + description: 'Overlays is a list of names that maps to folders + in "overlays/". + + If you wish to customize the file ./subdir/resource.yaml + then a file + + ./overlays/myoverlay/subdir/resource.yaml will replace + the base + + file. + + A file named ./overlays/myoverlay/subdir/resource_patch.yaml + will patch the base file.' + items: + type: string + nullable: true + type: array + type: object + type: object + type: object + status: + properties: + appliedDeploymentID: + nullable: true + type: string + conditions: + items: + properties: + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + type: string + lastUpdateTime: + description: The last time this condition was updated. + type: string + message: + description: Human-readable message indicating details about + last transition + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of cluster condition. + type: string + required: + - status + - type + type: object + nullable: true + type: array + display: + nullable: true + properties: + deployed: + nullable: true + type: string + monitored: + nullable: true + type: string + state: + nullable: true + type: string + type: object + modifiedStatus: + items: + description: 'ModifiedStatus is used to report the status of a + resource that is modified. + + It indicates if the modification was a create, a delete or a + patch.' + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + nonModified: + type: boolean + nonReadyStatus: + items: + description: NonReadyStatus is used to report the status of a + resource that is not ready. It includes a summary. + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + type: string + type: array + state: + type: string + transitioning: + type: boolean + type: object + uid: + description: 'UID is a type that holds unique ID values, including + UUIDs. Because we + + don''t ONLY use UUIDs, this is an alias to string. Being + a type captures + + intent and helps make sure that UIDs and names do not get + conflated.' + nullable: true + type: string + type: object + nullable: true + type: array + ready: + type: boolean + release: + nullable: true + type: string + resources: + description: 'Resources lists the metadata of resources that were + deployed + + according to the helm release history.' + items: + description: BundleDeploymentResource contains the metadata of + a deployed resource. + properties: + apiVersion: + nullable: true + type: string + createdAt: + format: date-time + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + nullable: true + type: array + syncGeneration: + format: int64 + nullable: true + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: bundlenamespacemappings.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: BundleNamespaceMapping + listKind: BundleNamespaceMappingList + plural: bundlenamespacemappings + singular: bundlenamespacemapping + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: BundleNamespaceMapping maps bundles to clusters in other namespaces. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + bundleSelector: + description: 'A label selector is a label query over a set of resources. + The result of matchLabels and + + matchExpressions are ANDed. An empty label selector matches all objects. + A null + + label selector matches no objects.' + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: 'A label selector requirement is a selector that + contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: 'operator represents a key''s relationship to + a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. If the + operator is In or NotIn, + + the values array must be non-empty. If the operator is Exists + or DoesNotExist, + + the values array must be empty. This array is replaced during + a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, whose key + field is "key", the + + operator is "In", and the values array contains only "value". + The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + namespaceSelector: + description: 'A label selector is a label query over a set of resources. + The result of matchLabels and + + matchExpressions are ANDed. An empty label selector matches all objects. + A null + + label selector matches no objects.' + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: 'A label selector requirement is a selector that + contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: 'operator represents a key''s relationship to + a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. If the + operator is In or NotIn, + + the values array must be non-empty. If the operator is Exists + or DoesNotExist, + + the values array must be empty. This array is replaced during + a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, whose key + field is "key", the + + operator is "In", and the values array contains only "value". + The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: bundles.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: Bundle + listKind: BundleList + plural: bundles + singular: bundle + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.display.readyClusters + name: BundleDeployments-Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: 'Bundle contains the resources of an application and its deployment + options. + + It will be deployed as a Helm chart to target clusters. + + + + When a GitRepo is scanned it will produce one or more bundles. Bundles + are + + a collection of resources that get deployed to one or more cluster(s). + Bundle is the + + fundamental deployment unit used in Fleet. The contents of a Bundle may + be + + Kubernetes manifests, Kustomize configuration, or Helm charts. Regardless + + of the source the contents are dynamically rendered into a Helm chart + by + + the agent and installed into the downstream cluster as a Helm release.' + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + contentsId: + description: ContentsID stores the contents id when deploying contents + using an OCI registry. + nullable: true + type: string + correctDrift: + description: CorrectDrift specifies how drift correction should + work. + properties: + enabled: + description: Enabled correct drift if true. + type: boolean + force: + description: Force helm rollback with --force option will be + used if true. This will try to recreate all resources in the + release. + type: boolean + keepFailHistory: + description: KeepFailHistory keeps track of failed rollbacks + in the helm history. + type: boolean + type: object + defaultNamespace: + description: 'DefaultNamespace is the namespace to use for resources + that do not + + specify a namespace. This field is not used to enforce or lock + down + + the deployment to a specific namespace.' + nullable: true + type: string + deleteCRDResources: + description: DeleteCRDResources deletes CRDs. Warning! this will + also delete all your Custom Resources. + type: boolean + deleteNamespace: + description: DeleteNamespace can be used to delete the deployed + namespace when removing the bundle + type: boolean + dependsOn: + description: DependsOn refers to the bundles which must be ready + before this bundle can be deployed. + items: + properties: + name: + description: Name of the bundle. + nullable: true + type: string + selector: + description: Selector matching bundle's labels. + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a selector + that contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is + replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains only + "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + type: object + nullable: true + type: array + diff: + description: Diff can be used to ignore the modified state of objects + which are amended at runtime. + nullable: true + properties: + comparePatches: + description: ComparePatches match a resource and remove fields + from the check for modifications. + items: + description: ComparePatch matches a resource and removes fields + from the check for modifications. + properties: + apiVersion: + description: APIVersion is the apiVersion of the resource + to match. + nullable: true + type: string + jsonPointers: + description: JSONPointers ignore diffs at a certain JSON + path. + items: + type: string + nullable: true + type: array + kind: + description: Kind is the kind of the resource to match. + nullable: true + type: string + name: + description: Name is the name of the resource to match. + nullable: true + type: string + namespace: + description: Namespace is the namespace of the resource + to match. + nullable: true + type: string + operations: + description: Operations remove a JSON path from the resource. + items: + description: Operation of a ComparePatch, usually "remove". + properties: + op: + description: Op is usually "remove" + nullable: true + type: string + path: + description: Path is the JSON path to remove. + nullable: true + type: string + value: + description: Value is usually empty. + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + forceSyncGeneration: + description: ForceSyncGeneration is used to force a redeployment + format: int64 + type: integer + helm: + description: Helm options for the deployment, like the chart name, + repo and values. + nullable: true + properties: + atomic: + description: Atomic sets the --atomic flag when Helm is performing + an upgrade + type: boolean + chart: + description: 'Chart can refer to any go-getter URL or OCI registry + based helm + + chart URL. The chart will be downloaded.' + nullable: true + type: string + disableDNS: + description: DisableDNS can be used to customize Helm's EnableDNS + option, which Fleet sets to `true` by default. + type: boolean + disableDependencyUpdate: + description: DisableDependencyUpdate allows skipping chart dependencies + update + type: boolean + disablePreProcess: + description: DisablePreProcess disables template processing + in values + type: boolean + force: + description: Force allows to override immutable resources. This + could be dangerous. + type: boolean + maxHistory: + description: MaxHistory limits the maximum number of revisions + saved per release by Helm. + type: integer + releaseName: + description: 'ReleaseName sets a custom release name to deploy + the chart as. If + + not specified a release name will be generated by combining + the + + invoking GitRepo.name + GitRepo.path.' + maxLength: 53 + nullable: true + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + repo: + description: Repo is the name of the HTTPS helm repo to download + the chart from. + nullable: true + type: string + skipSchemaValidation: + description: SkipSchemaValidation allows skipping schema validation + against the chart values + type: boolean + takeOwnership: + description: TakeOwnership makes helm skip the check for its + own annotations + type: boolean + timeoutSeconds: + description: TimeoutSeconds is the time to wait for Helm operations. + type: integer + values: + description: 'Values passed to Helm. It is possible to specify + the keys and values + + as go template strings.' + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + valuesFiles: + description: ValuesFiles is a list of files to load values from. + items: + type: string + nullable: true + type: array + valuesFrom: + description: ValuesFrom loads the values from configmaps and + secrets. + items: + description: 'Define helm values that can come from configmap, + secret or external. Credit: https://github.com/fluxcd/helm-operator/blob/0cfea875b5d44bea995abe7324819432070dfbdc/pkg/apis/helm.fluxcd.io/v1/types_helmrelease.go#L439' + properties: + configMapKeyRef: + description: The reference to a config map with release + values. + nullable: true + properties: + key: + nullable: true + type: string + name: + description: Name of a resource in the same namespace + as the referent. + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + secretKeyRef: + description: The reference to a secret with release values. + nullable: true + properties: + key: + nullable: true + type: string + name: + description: Name of a resource in the same namespace + as the referent. + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + version: + description: Version of the chart to download + nullable: true + type: string + waitForJobs: + description: 'WaitForJobs if set and timeoutSeconds provided, + will wait until all + + Jobs have been completed before marking the GitRepo as ready. + It + + will wait for as long as timeoutSeconds' + type: boolean + type: object + ignore: + description: IgnoreOptions can be used to ignore fields when monitoring + the bundle. + properties: + conditions: + description: Conditions is a list of conditions to be ignored + when monitoring the Bundle. + items: + additionalProperties: + type: string + type: object + nullable: true + type: array + type: object + keepResources: + description: KeepResources can be used to keep the deployed resources + when removing the bundle + type: boolean + kustomize: + description: 'Kustomize options for the deployment, like the dir + containing the + + kustomization.yaml file.' + nullable: true + properties: + dir: + description: 'Dir points to a custom folder for kustomize resources. + This folder must contain + + a kustomization.yaml file.' + nullable: true + type: string + type: object + namespace: + description: 'TargetNamespace if present will assign all resource + to this + + namespace and if any cluster scoped resource exists the deployment + + will fail.' + nullable: true + type: string + namespaceAnnotations: + additionalProperties: + type: string + description: NamespaceAnnotations are annotations that will be appended + to the namespace created by Fleet. + nullable: true + type: object + namespaceLabels: + additionalProperties: + type: string + description: NamespaceLabels are labels that will be appended to + the namespace created by Fleet. + nullable: true + type: object + paused: + description: Paused if set to true, will stop any BundleDeployments + from being updated. It will be marked as out of sync. + type: boolean + resources: + description: 'Resources contains the resources that were read from + the bundle''s + + path. This includes the content of downloaded helm charts.' + items: + description: BundleResource represents the content of a single + resource from the bundle, like a YAML manifest. + properties: + content: + description: The content of the resource, can be compressed. + nullable: true + type: string + encoding: + description: Encoding is either empty or "base64+gz". + nullable: true + type: string + name: + description: Name of the resource, can include the bundle's + internal path. + nullable: true + type: string + type: object + nullable: true + type: array + rolloutStrategy: + description: 'RolloutStrategy controls the rollout of bundles, by + defining + + partitions, canaries and percentages for cluster availability.' + nullable: true + properties: + autoPartitionSize: + anyOf: + - type: integer + - type: string + description: 'A number or percentage of how to automatically + partition clusters if no + + specific partitioning strategy is configured. + + default: 25%' + nullable: true + x-kubernetes-int-or-string: true + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'A number or percentage of clusters that can be + unavailable during an update + + of a bundle. This follows the same basic approach as a deployment + rollout + + strategy. Once the number of clusters meets unavailable state + update will be + + paused. Default value is 100% which doesn''t take effect on + update. + + default: 100%' + nullable: true + x-kubernetes-int-or-string: true + maxUnavailablePartitions: + anyOf: + - type: integer + - type: string + description: 'A number or percentage of cluster partitions that + can be unavailable during + + an update of a bundle. + + default: 0' + nullable: true + x-kubernetes-int-or-string: true + partitions: + description: 'A list of definitions of partitions. If any target + clusters do not match + + the configuration they are added to partitions at the end + following the + + autoPartitionSize.' + items: + description: Partition defines a separate rollout strategy + for a set of clusters. + properties: + clusterGroup: + description: A cluster group name to include in this partition + type: string + clusterGroupSelector: + description: Selector matching cluster group labels to + include in this partition + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a + selector that contains values, a key, and an operator + that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and + DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the + operator is Exists or DoesNotExist, + + the values array must be empty. This array + is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + clusterName: + description: ClusterName is the name of a cluster to include + in this partition + type: string + clusterSelector: + description: Selector matching cluster labels to include + in this partition + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a + selector that contains values, a key, and an operator + that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and + DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the + operator is Exists or DoesNotExist, + + the values array must be empty. This array + is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + maxUnavailable: + anyOf: + - type: integer + - type: string + description: 'A number or percentage of clusters that + can be unavailable in this + + partition before this partition is treated as done. + + default: 10%' + x-kubernetes-int-or-string: true + name: + description: A user-friendly name given to the partition + used for Display (optional). + nullable: true + type: string + type: object + nullable: true + type: array + type: object + serviceAccount: + description: ServiceAccount which will be used to perform this deployment. + nullable: true + type: string + targetRestrictions: + description: TargetRestrictions is an allow list, which controls + if a bundledeployment is created for a target. + items: + description: 'BundleTargetRestriction is used internally by Fleet + and should not be modified. + + It acts as an allow list, to prevent the creation of BundleDeployments + from + + Targets created by TargetCustomizations in fleet.yaml.' + properties: + clusterGroup: + nullable: true + type: string + clusterGroupSelector: + description: 'A label selector is a label query over a set + of resources. The result of matchLabels and + + matchExpressions are ANDed. An empty label selector matches + all objects. A null + + label selector matches no objects.' + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a selector + that contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is + replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains only + "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + clusterName: + nullable: true + type: string + clusterSelector: + description: 'A label selector is a label query over a set + of resources. The result of matchLabels and + + matchExpressions are ANDed. An empty label selector matches + all objects. A null + + label selector matches no objects.' + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a selector + that contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is + replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains only + "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + name: + nullable: true + type: string + type: object + type: array + targets: + description: 'Targets refer to the clusters which will be deployed + to. + + Targets are evaluated in order and the first one to match is used.' + items: + description: 'BundleTarget declares clusters to deploy to. Fleet + will merge the + + BundleDeploymentOptions from customizations into this struct.' + properties: + clusterGroup: + description: ClusterGroup to match a specific cluster group + by name. + nullable: true + type: string + clusterGroupSelector: + description: ClusterGroupSelector is a selector to match cluster + groups. + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a selector + that contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is + replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains only + "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + clusterName: + description: 'ClusterName to match a specific cluster by name + that will be + + selected' + nullable: true + type: string + clusterSelector: + description: 'ClusterSelector is a selector to match clusters. + The structure is + + the standard metav1.LabelSelector format. If clusterGroupSelector + or + + clusterGroup is specified, clusterSelector will be used + only to + + further refine the selection after clusterGroupSelector + and + + clusterGroup is evaluated.' + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a selector + that contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is + replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains only + "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + correctDrift: + description: CorrectDrift specifies how drift correction should + work. + properties: + enabled: + description: Enabled correct drift if true. + type: boolean + force: + description: Force helm rollback with --force option will + be used if true. This will try to recreate all resources + in the release. + type: boolean + keepFailHistory: + description: KeepFailHistory keeps track of failed rollbacks + in the helm history. + type: boolean + type: object + defaultNamespace: + description: 'DefaultNamespace is the namespace to use for + resources that do not + + specify a namespace. This field is not used to enforce or + lock down + + the deployment to a specific namespace.' + nullable: true + type: string + deleteCRDResources: + description: DeleteCRDResources deletes CRDs. Warning! this + will also delete all your Custom Resources. + type: boolean + deleteNamespace: + description: DeleteNamespace can be used to delete the deployed + namespace when removing the bundle + type: boolean + diff: + description: Diff can be used to ignore the modified state + of objects which are amended at runtime. + nullable: true + properties: + comparePatches: + description: ComparePatches match a resource and remove + fields from the check for modifications. + items: + description: ComparePatch matches a resource and removes + fields from the check for modifications. + properties: + apiVersion: + description: APIVersion is the apiVersion of the + resource to match. + nullable: true + type: string + jsonPointers: + description: JSONPointers ignore diffs at a certain + JSON path. + items: + type: string + nullable: true + type: array + kind: + description: Kind is the kind of the resource to + match. + nullable: true + type: string + name: + description: Name is the name of the resource to + match. + nullable: true + type: string + namespace: + description: Namespace is the namespace of the resource + to match. + nullable: true + type: string + operations: + description: Operations remove a JSON path from + the resource. + items: + description: Operation of a ComparePatch, usually + "remove". + properties: + op: + description: Op is usually "remove" + nullable: true + type: string + path: + description: Path is the JSON path to remove. + nullable: true + type: string + value: + description: Value is usually empty. + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + type: object + doNotDeploy: + description: DoNotDeploy if set to true, will not deploy to + this target. + type: boolean + forceSyncGeneration: + description: ForceSyncGeneration is used to force a redeployment + format: int64 + type: integer + helm: + description: Helm options for the deployment, like the chart + name, repo and values. + nullable: true + properties: + atomic: + description: Atomic sets the --atomic flag when Helm is + performing an upgrade + type: boolean + chart: + description: 'Chart can refer to any go-getter URL or + OCI registry based helm + + chart URL. The chart will be downloaded.' + nullable: true + type: string + disableDNS: + description: DisableDNS can be used to customize Helm's + EnableDNS option, which Fleet sets to `true` by default. + type: boolean + disableDependencyUpdate: + description: DisableDependencyUpdate allows skipping chart + dependencies update + type: boolean + disablePreProcess: + description: DisablePreProcess disables template processing + in values + type: boolean + force: + description: Force allows to override immutable resources. + This could be dangerous. + type: boolean + maxHistory: + description: MaxHistory limits the maximum number of revisions + saved per release by Helm. + type: integer + releaseName: + description: 'ReleaseName sets a custom release name to + deploy the chart as. If + + not specified a release name will be generated by combining + the + + invoking GitRepo.name + GitRepo.path.' + maxLength: 53 + nullable: true + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ + type: string + repo: + description: Repo is the name of the HTTPS helm repo to + download the chart from. + nullable: true + type: string + skipSchemaValidation: + description: SkipSchemaValidation allows skipping schema + validation against the chart values + type: boolean + takeOwnership: + description: TakeOwnership makes helm skip the check for + its own annotations + type: boolean + timeoutSeconds: + description: TimeoutSeconds is the time to wait for Helm + operations. + type: integer + values: + description: 'Values passed to Helm. It is possible to + specify the keys and values + + as go template strings.' + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + valuesFiles: + description: ValuesFiles is a list of files to load values + from. + items: + type: string + nullable: true + type: array + valuesFrom: + description: ValuesFrom loads the values from configmaps + and secrets. + items: + description: 'Define helm values that can come from + configmap, secret or external. Credit: https://github.com/fluxcd/helm-operator/blob/0cfea875b5d44bea995abe7324819432070dfbdc/pkg/apis/helm.fluxcd.io/v1/types_helmrelease.go#L439' + properties: + configMapKeyRef: + description: The reference to a config map with + release values. + nullable: true + properties: + key: + nullable: true + type: string + name: + description: Name of a resource in the same + namespace as the referent. + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + secretKeyRef: + description: The reference to a secret with release + values. + nullable: true + properties: + key: + nullable: true + type: string + name: + description: Name of a resource in the same + namespace as the referent. + nullable: true + type: string + namespace: + nullable: true + type: string + type: object + type: object + nullable: true + type: array + version: + description: Version of the chart to download + nullable: true + type: string + waitForJobs: + description: 'WaitForJobs if set and timeoutSeconds provided, + will wait until all + + Jobs have been completed before marking the GitRepo + as ready. It + + will wait for as long as timeoutSeconds' + type: boolean + type: object + ignore: + description: IgnoreOptions can be used to ignore fields when + monitoring the bundle. + properties: + conditions: + description: Conditions is a list of conditions to be + ignored when monitoring the Bundle. + items: + additionalProperties: + type: string + type: object + nullable: true + type: array + type: object + keepResources: + description: KeepResources can be used to keep the deployed + resources when removing the bundle + type: boolean + kustomize: + description: 'Kustomize options for the deployment, like the + dir containing the + + kustomization.yaml file.' + nullable: true + properties: + dir: + description: 'Dir points to a custom folder for kustomize + resources. This folder must contain + + a kustomization.yaml file.' + nullable: true + type: string + type: object + name: + description: 'Name of target. This value is largely for display + and logging. If + + not specified a default name of the format "target000" will + be used' + type: string + namespace: + description: 'TargetNamespace if present will assign all resource + to this + + namespace and if any cluster scoped resource exists the + deployment + + will fail.' + nullable: true + type: string + namespaceAnnotations: + additionalProperties: + type: string + description: NamespaceAnnotations are annotations that will + be appended to the namespace created by Fleet. + nullable: true + type: object + namespaceLabels: + additionalProperties: + type: string + description: NamespaceLabels are labels that will be appended + to the namespace created by Fleet. + nullable: true + type: object + serviceAccount: + description: ServiceAccount which will be used to perform + this deployment. + nullable: true + type: string + yaml: + description: 'YAML options, if using raw YAML these are names + that map to + + overlays/{name} files that will be used to replace or patch + a resource.' + nullable: true + properties: + overlays: + description: 'Overlays is a list of names that maps to + folders in "overlays/". + + If you wish to customize the file ./subdir/resource.yaml + then a file + + ./overlays/myoverlay/subdir/resource.yaml will replace + the base + + file. + + A file named ./overlays/myoverlay/subdir/resource_patch.yaml + will patch the base file.' + items: + type: string + nullable: true + type: array + type: object + type: object + type: array + yaml: + description: 'YAML options, if using raw YAML these are names that + map to + + overlays/{name} files that will be used to replace or patch a + resource.' + nullable: true + properties: + overlays: + description: 'Overlays is a list of names that maps to folders + in "overlays/". + + If you wish to customize the file ./subdir/resource.yaml then + a file + + ./overlays/myoverlay/subdir/resource.yaml will replace the + base + + file. + + A file named ./overlays/myoverlay/subdir/resource_patch.yaml + will patch the base file.' + items: + type: string + nullable: true + type: array + type: object + type: object + status: + properties: + conditions: + description: 'Conditions is a list of Wrangler conditions that describe + the state + + of the bundle.' + items: + properties: + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + type: string + lastUpdateTime: + description: The last time this condition was updated. + type: string + message: + description: Human-readable message indicating details about + last transition + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of cluster condition. + type: string + required: + - status + - type + type: object + type: array + display: + description: 'Display contains the number of ready, desiredready + clusters and a + + summary state for the bundle''s resources.' + properties: + readyClusters: + description: 'ReadyClusters is a string in the form "%d/%d", + that describes the + + number of clusters that are ready vs. the number of clusters + desired + + to be ready.' + nullable: true + type: string + state: + description: State is a summary state for the bundle, calculated + over the non-ready resources. + nullable: true + type: string + type: object + maxNew: + description: 'MaxNew is always 50. A bundle change can only stage + 50 + + bundledeployments at a time.' + type: integer + maxUnavailable: + description: 'MaxUnavailable is the maximum number of unavailable + deployments. See + + rollout configuration.' + type: integer + maxUnavailablePartitions: + description: 'MaxUnavailablePartitions is the maximum number of + unavailable + + partitions. The rollout configuration defines a maximum number + or + + percentage of unavailable partitions.' + type: integer + newlyCreated: + description: 'NewlyCreated is the number of bundle deployments that + have been created, + + not updated.' + type: integer + observedGeneration: + description: ObservedGeneration is the current generation of the + bundle. + format: int64 + type: integer + ociReference: + description: 'OCIReference is the OCI reference used to store contents, + this is + + only for informational purposes.' + type: string + partitions: + description: PartitionStatus lists the status of each partition. + items: + description: PartitionStatus is the status of a single rollout + partition. + properties: + count: + description: Count is the number of clusters in the partition. + type: integer + maxUnavailable: + description: MaxUnavailable is the maximum number of unavailable + clusters in the partition. + type: integer + name: + description: Name is the name of the partition. + nullable: true + type: string + summary: + description: Summary is a summary state for the partition, + calculated over its non-ready resources. + properties: + desiredReady: + description: 'DesiredReady is the number of bundle deployments + that should be + + ready.' + type: integer + errApplied: + description: 'ErrApplied is the number of bundle deployments + that have been synced + + from the Fleet controller and the downstream cluster, + but with some + + errors when deploying the bundle.' + type: integer + modified: + description: 'Modified is the number of bundle deployments + that have been deployed + + and for which all resources are ready, but where some + changes from the + + Git repository have not yet been synced.' + type: integer + nonReadyResources: + description: 'NonReadyClusters is a list of states, which + is filled for a bundle + + that is not ready.' + items: + description: 'NonReadyResource contains information + about a bundle that is not ready for a + + given state like "ErrApplied". It contains a list + of non-ready or modified + + resources and their states.' + properties: + bundleState: + description: State is the state of the resource, + like e.g. "NotReady" or "ErrApplied". + nullable: true + type: string + message: + description: Message contains information why the + bundle is not ready. + nullable: true + type: string + modifiedStatus: + description: ModifiedStatus lists the state for + each modified resource. + items: + description: 'ModifiedStatus is used to report + the status of a resource that is modified. + + It indicates if the modification was a create, + a delete or a patch.' + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + description: Name is the name of the resource. + nullable: true + type: string + nonReadyStatus: + description: NonReadyStatus lists the state for + each non-ready resource. + items: + description: NonReadyStatus is used to report + the status of a resource that is not ready. + It includes a summary. + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + type: string + type: array + state: + type: string + transitioning: + type: boolean + type: object + uid: + description: 'UID is a type that holds unique + ID values, including UUIDs. Because we + + don''t ONLY use UUIDs, this is an alias + to string. Being a type captures + + intent and helps make sure that UIDs and + names do not get conflated.' + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + description: 'NotReady is the number of bundle deployments + that have been deployed + + where some resources are not ready.' + type: integer + outOfSync: + description: 'OutOfSync is the number of bundle deployments + that have been synced + + from Fleet controller, but not yet by the downstream + agent.' + type: integer + pending: + description: 'Pending is the number of bundle deployments + that are being processed + + by Fleet controller.' + type: integer + ready: + description: 'Ready is the number of bundle deployments + that have been deployed + + where all resources are ready.' + type: integer + waitApplied: + description: 'WaitApplied is the number of bundle deployments + that have been + + synced from Fleet controller and downstream cluster, + but are waiting + + to be deployed.' + type: integer + type: object + unavailable: + description: Unavailable is the number of unavailable clusters + in the partition. + type: integer + type: object + type: array + resourceKey: + description: 'ResourceKey lists resources, which will likely be + deployed. The + + actual list of resources on a cluster might differ, depending + on the + + helm chart, value templating, etc..' + items: + description: ResourceKey lists resources, which will likely be + deployed. + properties: + apiVersion: + description: APIVersion is the k8s api version of the resource. + nullable: true + type: string + kind: + description: Kind is the k8s api kind of the resource. + nullable: true + type: string + name: + description: Name is the name of the resource. + nullable: true + type: string + namespace: + description: Namespace is the namespace of the resource. + nullable: true + type: string + type: object + nullable: true + type: array + resourcesSha256Sum: + description: ResourcesSHA256Sum corresponds to the JSON serialization + of the .Spec.Resources field + type: string + summary: + description: 'Summary contains the number of bundle deployments + in each state and + + a list of non-ready resources.' + properties: + desiredReady: + description: 'DesiredReady is the number of bundle deployments + that should be + + ready.' + type: integer + errApplied: + description: 'ErrApplied is the number of bundle deployments + that have been synced + + from the Fleet controller and the downstream cluster, but + with some + + errors when deploying the bundle.' + type: integer + modified: + description: 'Modified is the number of bundle deployments that + have been deployed + + and for which all resources are ready, but where some changes + from the + + Git repository have not yet been synced.' + type: integer + nonReadyResources: + description: 'NonReadyClusters is a list of states, which is + filled for a bundle + + that is not ready.' + items: + description: 'NonReadyResource contains information about + a bundle that is not ready for a + + given state like "ErrApplied". It contains a list of non-ready + or modified + + resources and their states.' + properties: + bundleState: + description: State is the state of the resource, like + e.g. "NotReady" or "ErrApplied". + nullable: true + type: string + message: + description: Message contains information why the bundle + is not ready. + nullable: true + type: string + modifiedStatus: + description: ModifiedStatus lists the state for each modified + resource. + items: + description: 'ModifiedStatus is used to report the status + of a resource that is modified. + + It indicates if the modification was a create, a delete + or a patch.' + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + description: Name is the name of the resource. + nullable: true + type: string + nonReadyStatus: + description: NonReadyStatus lists the state for each non-ready + resource. + items: + description: NonReadyStatus is used to report the status + of a resource that is not ready. It includes a summary. + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + type: string + type: array + state: + type: string + transitioning: + type: boolean + type: object + uid: + description: 'UID is a type that holds unique ID + values, including UUIDs. Because we + + don''t ONLY use UUIDs, this is an alias to string. Being + a type captures + + intent and helps make sure that UIDs and names + do not get conflated.' + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + description: 'NotReady is the number of bundle deployments that + have been deployed + + where some resources are not ready.' + type: integer + outOfSync: + description: 'OutOfSync is the number of bundle deployments + that have been synced + + from Fleet controller, but not yet by the downstream agent.' + type: integer + pending: + description: 'Pending is the number of bundle deployments that + are being processed + + by Fleet controller.' + type: integer + ready: + description: 'Ready is the number of bundle deployments that + have been deployed + + where all resources are ready.' + type: integer + waitApplied: + description: 'WaitApplied is the number of bundle deployments + that have been + + synced from Fleet controller and downstream cluster, but are + waiting + + to be deployed.' + type: integer + type: object + unavailable: + description: 'Unavailable is the number of bundle deployments that + are not ready or + + where the AppliedDeploymentID in the status does not match the + + DeploymentID from the spec.' + type: integer + unavailablePartitions: + description: UnavailablePartitions is the number of unavailable + partitions. + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: clustergroups.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + categories: + - fleet + kind: ClusterGroup + listKind: ClusterGroupList + plural: clustergroups + singular: clustergroup + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.display.readyClusters + name: Clusters-Ready + type: string + - jsonPath: .status.display.readyBundles + name: Bundles-Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterGroup is a re-usable selector to target a group of clusters. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + selector: + description: Selector is a label selector, used to select clusters + for this group. + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: 'A label selector requirement is a selector that + contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. If + the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is replaced + during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, whose + key field is "key", the + + operator is "In", and the values array contains only "value". + The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + type: object + status: + properties: + clusterCount: + description: ClusterCount is the number of clusters in the cluster + group. + type: integer + conditions: + description: Conditions is a list of conditions and their statuses + for the cluster group. + items: + properties: + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + type: string + lastUpdateTime: + description: The last time this condition was updated. + type: string + message: + description: Human-readable message indicating details about + last transition + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of cluster condition. + type: string + required: + - status + - type + type: object + type: array + display: + description: 'Display contains the number of ready, desiredready + clusters and a + + summary state for the bundle''s resources.' + properties: + readyBundles: + description: 'ReadyBundles is a string in the form "%d/%d", + that describes the + + number of bundles that are ready vs. the number of bundles + desired + + to be ready.' + nullable: true + type: string + readyClusters: + description: 'ReadyClusters is a string in the form "%d/%d", + that describes the + + number of clusters that are ready vs. the number of clusters + desired + + to be ready.' + nullable: true + type: string + state: + description: 'State is a summary state for the cluster group, + showing "NotReady" if + + there are non-ready resources.' + nullable: true + type: string + type: object + nonReadyClusterCount: + description: NonReadyClusterCount is the number of clusters that + are not ready. + type: integer + nonReadyClusters: + description: NonReadyClusters is a list of cluster names that are + not ready. + items: + type: string + nullable: true + type: array + resourceCounts: + description: 'ResourceCounts contains the number of resources in + each state over + + all bundles in the cluster group.' + properties: + desiredReady: + description: DesiredReady is the number of resources that should + be ready. + type: integer + missing: + description: Missing is the number of missing resources. + type: integer + modified: + description: Modified is the number of resources that have been + modified. + type: integer + notReady: + description: 'NotReady is the number of not ready resources. + Resources are not + + ready if they do not match any other state.' + type: integer + orphaned: + description: Orphaned is the number of orphaned resources. + type: integer + ready: + description: Ready is the number of ready resources. + type: integer + unknown: + description: Unknown is the number of resources in an unknown + state. + type: integer + waitApplied: + description: WaitApplied is the number of resources that are + waiting to be applied. + type: integer + type: object + summary: + description: 'Summary is a summary of the bundle deployments and + their resources + + in the cluster group.' + properties: + desiredReady: + description: 'DesiredReady is the number of bundle deployments + that should be + + ready.' + type: integer + errApplied: + description: 'ErrApplied is the number of bundle deployments + that have been synced + + from the Fleet controller and the downstream cluster, but + with some + + errors when deploying the bundle.' + type: integer + modified: + description: 'Modified is the number of bundle deployments that + have been deployed + + and for which all resources are ready, but where some changes + from the + + Git repository have not yet been synced.' + type: integer + nonReadyResources: + description: 'NonReadyClusters is a list of states, which is + filled for a bundle + + that is not ready.' + items: + description: 'NonReadyResource contains information about + a bundle that is not ready for a + + given state like "ErrApplied". It contains a list of non-ready + or modified + + resources and their states.' + properties: + bundleState: + description: State is the state of the resource, like + e.g. "NotReady" or "ErrApplied". + nullable: true + type: string + message: + description: Message contains information why the bundle + is not ready. + nullable: true + type: string + modifiedStatus: + description: ModifiedStatus lists the state for each modified + resource. + items: + description: 'ModifiedStatus is used to report the status + of a resource that is modified. + + It indicates if the modification was a create, a delete + or a patch.' + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + description: Name is the name of the resource. + nullable: true + type: string + nonReadyStatus: + description: NonReadyStatus lists the state for each non-ready + resource. + items: + description: NonReadyStatus is used to report the status + of a resource that is not ready. It includes a summary. + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + type: string + type: array + state: + type: string + transitioning: + type: boolean + type: object + uid: + description: 'UID is a type that holds unique ID + values, including UUIDs. Because we + + don''t ONLY use UUIDs, this is an alias to string. Being + a type captures + + intent and helps make sure that UIDs and names + do not get conflated.' + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + description: 'NotReady is the number of bundle deployments that + have been deployed + + where some resources are not ready.' + type: integer + outOfSync: + description: 'OutOfSync is the number of bundle deployments + that have been synced + + from Fleet controller, but not yet by the downstream agent.' + type: integer + pending: + description: 'Pending is the number of bundle deployments that + are being processed + + by Fleet controller.' + type: integer + ready: + description: 'Ready is the number of bundle deployments that + have been deployed + + where all resources are ready.' + type: integer + waitApplied: + description: 'WaitApplied is the number of bundle deployments + that have been + + synced from Fleet controller and downstream cluster, but are + waiting + + to be deployed.' + type: integer + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: clusterregistrations.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: ClusterRegistration + listKind: ClusterRegistrationList + plural: clusterregistrations + singular: clusterregistration + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.clusterName + name: Cluster-Name + type: string + - jsonPath: .spec.clusterLabels + name: Labels + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterRegistration is used internally by Fleet and should + not be used directly. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + clientID: + description: 'ClientID is a unique string that will identify the + cluster. The + + agent either uses the configured ID or the kubeSystem.UID.' + nullable: true + type: string + clientRandom: + description: 'ClientRandom is a random string that the agent generates. + When + + fleet-controller grants a registration, it creates a registration + + secret with this string in the name.' + nullable: true + type: string + clusterLabels: + additionalProperties: + type: string + description: ClusterLabels are copied to the cluster resource during + the registration. + nullable: true + type: object + type: object + status: + properties: + clusterName: + description: 'ClusterName is only set after the registration is + being processed by + + fleet-controller.' + nullable: true + type: string + granted: + description: 'Granted is set to true, if the request service account + is present + + and its token secret exists. This happens directly before creating + + the registration secret, roles and rolebindings.' + type: boolean + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: clusterregistrationtokens.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: ClusterRegistrationToken + listKind: ClusterRegistrationTokenList + plural: clusterregistrationtokens + singular: clusterregistrationtoken + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.secretName + name: Secret-Name + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterRegistrationToken is used by agents to register a new + cluster. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + ttl: + description: 'TTL is the time to live for the token. It is used + to calculate the + + expiration time. If the token expires, it will be deleted.' + nullable: true + type: string + type: object + status: + properties: + expires: + description: Expires is the time when the token expires. + format: date-time + type: string + secretName: + description: SecretName is the name of the secret containing the + token. + nullable: true + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: clusters.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: Cluster + listKind: ClusterList + plural: clusters + singular: cluster + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.display.readyBundles + name: Bundles-Ready + type: string + - jsonPath: .status.agent.lastSeen + name: Last-Seen + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: 'Cluster corresponds to a Kubernetes cluster. Fleet deploys + bundles to targeted clusters. + + Clusters to which Fleet deploys manifests are referred to as downstream + + clusters. In the single cluster use case, the Fleet manager Kubernetes + + cluster is both the manager and downstream cluster at the same time.' + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + agentAffinity: + description: 'AgentAffinity overrides the default affinity for the + cluster''s agent + + deployment. If this value is nil the default affinity is used.' + nullable: true + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for the + pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: 'The scheduler will prefer to schedule pods + to nodes that satisfy + + the affinity expressions specified by this field, but + it may choose + + a node that violates one or more of the expressions. The + node that is + + most preferred is the one with the greatest sum of weights, + i.e. + + for each node that meets all of the scheduling requirements + (resource + + request, requiredDuringScheduling affinity expressions, + etc.), + + compute a sum by iterating through the elements of this + field and adding + + "weight" to the sum if the node matches the corresponding + matchExpressions; the + + node(s) with the highest sum are the most preferred.' + items: + description: 'An empty preferred scheduling term matches + all objects with implicit weight 0 + + (i.e. it''s a no-op). A null preferred scheduling term + matches no objects (i.e. is also a no-op).' + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: 'A node selector requirement is + a selector that contains values, a key, and + an operator + + that relates the key and values.' + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: 'Represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists, + DoesNotExist. Gt, and Lt.' + type: string + values: + description: 'An array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + + the values array must be empty. If the + operator is Gt or Lt, the values + + array must have a single element, which + will be interpreted as an integer. + + This array is replaced during a strategic + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: 'A node selector requirement is + a selector that contains values, a key, and + an operator + + that relates the key and values.' + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: 'Represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists, + DoesNotExist. Gt, and Lt.' + type: string + values: + description: 'An array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + + the values array must be empty. If the + operator is Gt or Lt, the values + + array must have a single element, which + will be interpreted as an integer. + + This array is replaced during a strategic + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the corresponding + nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: 'If the affinity requirements specified by + this field are not met at + + scheduling time, the pod will not be scheduled onto the + node. + + If the affinity requirements specified by this field cease + to be met + + at some point during pod execution (e.g. due to an update), + the system + + may or may not try to eventually evict the pod from its + node.' + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: 'A null or empty node selector term matches + no objects. The requirements of + + them are ANDed. + + The TopologySelectorTerm type implements a subset + of the NodeSelectorTerm.' + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: 'A node selector requirement is + a selector that contains values, a key, and + an operator + + that relates the key and values.' + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: 'Represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists, + DoesNotExist. Gt, and Lt.' + type: string + values: + description: 'An array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + + the values array must be empty. If the + operator is Gt or Lt, the values + + array must have a single element, which + will be interpreted as an integer. + + This array is replaced during a strategic + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: 'A node selector requirement is + a selector that contains values, a key, and + an operator + + that relates the key and values.' + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: 'Represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists, + DoesNotExist. Gt, and Lt.' + type: string + values: + description: 'An array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + + the values array must be empty. If the + operator is Gt or Lt, the values + + array must have a single element, which + will be interpreted as an integer. + + This array is replaced during a strategic + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + type: object + x-kubernetes-map-type: atomic + type: array + x-kubernetes-list-type: atomic + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. co-locate + this pod in the same node, zone, etc. as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: 'The scheduler will prefer to schedule pods + to nodes that satisfy + + the affinity expressions specified by this field, but + it may choose + + a node that violates one or more of the expressions. The + node that is + + most preferred is the one with the greatest sum of weights, + i.e. + + for each node that meets all of the scheduling requirements + (resource + + request, requiredDuringScheduling affinity expressions, + etc.), + + compute a sum by iterating through the elements of this + field and adding + + "weight" to the sum if the node has pods which matches + the corresponding podAffinityTerm; the + + node(s) with the highest sum are the most preferred.' + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: 'A label query over a set of resources, + in this case pods. + + If it''s null, this PodAffinityTerm matches + with no Pods.' + properties: + matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. + items: + description: 'A label selector requirement + is a selector that contains values, a + key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: 'operator represents a + key''s relationship to a set of values. + + Valid operators are In, NotIn, Exists + and DoesNotExist.' + type: string + values: + description: 'values is an array of + string values. If the operator is + In or NotIn, + + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + + the values array must be empty. This + array is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: 'MatchLabelKeys is a set of pod label + keys to select which pods will + + be taken into consideration. The keys are used + to lookup values from the + + incoming pod labels, those key-value labels + are merged with `labelSelector` as `key in (value)` + + to select the group of existing pods which pods + will be taken into consideration + + for the incoming pod''s pod (anti) affinity. + Keys that don''t exist in the incoming + + pod labels will be ignored. The default value + is empty. + + The same key is forbidden to exist in both matchLabelKeys + and labelSelector. + + Also, matchLabelKeys cannot be set when labelSelector + isn''t set. + + This is an alpha field and requires enabling + MatchLabelKeysInPodAffinity feature gate.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: 'MismatchLabelKeys is a set of pod + label keys to select which pods will + + be taken into consideration. The keys are used + to lookup values from the + + incoming pod labels, those key-value labels + are merged with `labelSelector` as `key notin + (value)` + + to select the group of existing pods which pods + will be taken into consideration + + for the incoming pod''s pod (anti) affinity. + Keys that don''t exist in the incoming + + pod labels will be ignored. The default value + is empty. + + The same key is forbidden to exist in both mismatchLabelKeys + and labelSelector. + + Also, mismatchLabelKeys cannot be set when labelSelector + isn''t set. + + This is an alpha field and requires enabling + MatchLabelKeysInPodAffinity feature gate.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: 'A label query over the set of namespaces + that the term applies to. + + The term is applied to the union of the namespaces + selected by this field + + and the ones listed in the namespaces field. + + null selector and null or empty namespaces list + means "this pod''s namespace". + + An empty selector ({}) matches all namespaces.' + properties: + matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. + items: + description: 'A label selector requirement + is a selector that contains values, a + key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: 'operator represents a + key''s relationship to a set of values. + + Valid operators are In, NotIn, Exists + and DoesNotExist.' + type: string + values: + description: 'values is an array of + string values. If the operator is + In or NotIn, + + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + + the values array must be empty. This + array is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: 'namespaces specifies a static list + of namespace names that the term applies to. + + The term is applied to the union of the namespaces + listed in this field + + and the ones selected by namespaceSelector. + + null or empty namespaces list and null namespaceSelector + means "this pod''s namespace".' + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: 'This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching + + the labelSelector in the specified namespaces, + where co-located is defined as running on a + node + + whose value of the label with key topologyKey + matches that of any node on which any of the + + selected pods is running. + + Empty topologyKey is not allowed.' + type: string + required: + - topologyKey + type: object + weight: + description: 'weight associated with matching the + corresponding podAffinityTerm, + + in the range 1-100.' + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: 'If the affinity requirements specified by + this field are not met at + + scheduling time, the pod will not be scheduled onto the + node. + + If the affinity requirements specified by this field cease + to be met + + at some point during pod execution (e.g. due to a pod + label update), the + + system may or may not try to eventually evict the pod + from its node. + + When there are multiple elements, the lists of nodes corresponding + to each + + podAffinityTerm are intersected, i.e. all terms must be + satisfied.' + items: + description: 'Defines a set of pods (namely those matching + the labelSelector + + relative to the given namespace(s)) that this pod should + be + + co-located (affinity) or not co-located (anti-affinity) + with, + + where co-located is defined as running on a node whose + value of + + the label with key matches that of any + node on which + + a pod of the set of pods is running' + properties: + labelSelector: + description: 'A label query over a set of resources, + in this case pods. + + If it''s null, this PodAffinityTerm matches with + no Pods.' + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: 'A label selector requirement is + a selector that contains values, a key, and + an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: 'operator represents a key''s + relationship to a set of values. + + Valid operators are In, NotIn, Exists + and DoesNotExist.' + type: string + values: + description: 'values is an array of string + values. If the operator is In or NotIn, + + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + + the values array must be empty. This array + is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: 'MatchLabelKeys is a set of pod label + keys to select which pods will + + be taken into consideration. The keys are used to + lookup values from the + + incoming pod labels, those key-value labels are + merged with `labelSelector` as `key in (value)` + + to select the group of existing pods which pods + will be taken into consideration + + for the incoming pod''s pod (anti) affinity. Keys + that don''t exist in the incoming + + pod labels will be ignored. The default value is + empty. + + The same key is forbidden to exist in both matchLabelKeys + and labelSelector. + + Also, matchLabelKeys cannot be set when labelSelector + isn''t set. + + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity + feature gate.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: 'MismatchLabelKeys is a set of pod label + keys to select which pods will + + be taken into consideration. The keys are used to + lookup values from the + + incoming pod labels, those key-value labels are + merged with `labelSelector` as `key notin (value)` + + to select the group of existing pods which pods + will be taken into consideration + + for the incoming pod''s pod (anti) affinity. Keys + that don''t exist in the incoming + + pod labels will be ignored. The default value is + empty. + + The same key is forbidden to exist in both mismatchLabelKeys + and labelSelector. + + Also, mismatchLabelKeys cannot be set when labelSelector + isn''t set. + + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity + feature gate.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: 'A label query over the set of namespaces + that the term applies to. + + The term is applied to the union of the namespaces + selected by this field + + and the ones listed in the namespaces field. + + null selector and null or empty namespaces list + means "this pod''s namespace". + + An empty selector ({}) matches all namespaces.' + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: 'A label selector requirement is + a selector that contains values, a key, and + an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: 'operator represents a key''s + relationship to a set of values. + + Valid operators are In, NotIn, Exists + and DoesNotExist.' + type: string + values: + description: 'values is an array of string + values. If the operator is In or NotIn, + + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + + the values array must be empty. This array + is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: 'namespaces specifies a static list of + namespace names that the term applies to. + + The term is applied to the union of the namespaces + listed in this field + + and the ones selected by namespaceSelector. + + null or empty namespaces list and null namespaceSelector + means "this pod''s namespace".' + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: 'This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching + + the labelSelector in the specified namespaces, where + co-located is defined as running on a node + + whose value of the label with key topologyKey matches + that of any node on which any of the + + selected pods is running. + + Empty topologyKey is not allowed.' + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules (e.g. + avoid putting this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: 'The scheduler will prefer to schedule pods + to nodes that satisfy + + the anti-affinity expressions specified by this field, + but it may choose + + a node that violates one or more of the expressions. The + node that is + + most preferred is the one with the greatest sum of weights, + i.e. + + for each node that meets all of the scheduling requirements + (resource + + request, requiredDuringScheduling anti-affinity expressions, + etc.), + + compute a sum by iterating through the elements of this + field and adding + + "weight" to the sum if the node has pods which matches + the corresponding podAffinityTerm; the + + node(s) with the highest sum are the most preferred.' + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: 'A label query over a set of resources, + in this case pods. + + If it''s null, this PodAffinityTerm matches + with no Pods.' + properties: + matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. + items: + description: 'A label selector requirement + is a selector that contains values, a + key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: 'operator represents a + key''s relationship to a set of values. + + Valid operators are In, NotIn, Exists + and DoesNotExist.' + type: string + values: + description: 'values is an array of + string values. If the operator is + In or NotIn, + + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + + the values array must be empty. This + array is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: 'MatchLabelKeys is a set of pod label + keys to select which pods will + + be taken into consideration. The keys are used + to lookup values from the + + incoming pod labels, those key-value labels + are merged with `labelSelector` as `key in (value)` + + to select the group of existing pods which pods + will be taken into consideration + + for the incoming pod''s pod (anti) affinity. + Keys that don''t exist in the incoming + + pod labels will be ignored. The default value + is empty. + + The same key is forbidden to exist in both matchLabelKeys + and labelSelector. + + Also, matchLabelKeys cannot be set when labelSelector + isn''t set. + + This is an alpha field and requires enabling + MatchLabelKeysInPodAffinity feature gate.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: 'MismatchLabelKeys is a set of pod + label keys to select which pods will + + be taken into consideration. The keys are used + to lookup values from the + + incoming pod labels, those key-value labels + are merged with `labelSelector` as `key notin + (value)` + + to select the group of existing pods which pods + will be taken into consideration + + for the incoming pod''s pod (anti) affinity. + Keys that don''t exist in the incoming + + pod labels will be ignored. The default value + is empty. + + The same key is forbidden to exist in both mismatchLabelKeys + and labelSelector. + + Also, mismatchLabelKeys cannot be set when labelSelector + isn''t set. + + This is an alpha field and requires enabling + MatchLabelKeysInPodAffinity feature gate.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: 'A label query over the set of namespaces + that the term applies to. + + The term is applied to the union of the namespaces + selected by this field + + and the ones listed in the namespaces field. + + null selector and null or empty namespaces list + means "this pod''s namespace". + + An empty selector ({}) matches all namespaces.' + properties: + matchExpressions: + description: matchExpressions is a list of + label selector requirements. The requirements + are ANDed. + items: + description: 'A label selector requirement + is a selector that contains values, a + key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: 'operator represents a + key''s relationship to a set of values. + + Valid operators are In, NotIn, Exists + and DoesNotExist.' + type: string + values: + description: 'values is an array of + string values. If the operator is + In or NotIn, + + the values array must be non-empty. + If the operator is Exists or DoesNotExist, + + the values array must be empty. This + array is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: 'namespaces specifies a static list + of namespace names that the term applies to. + + The term is applied to the union of the namespaces + listed in this field + + and the ones selected by namespaceSelector. + + null or empty namespaces list and null namespaceSelector + means "this pod''s namespace".' + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: 'This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching + + the labelSelector in the specified namespaces, + where co-located is defined as running on a + node + + whose value of the label with key topologyKey + matches that of any node on which any of the + + selected pods is running. + + Empty topologyKey is not allowed.' + type: string + required: + - topologyKey + type: object + weight: + description: 'weight associated with matching the + corresponding podAffinityTerm, + + in the range 1-100.' + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + x-kubernetes-list-type: atomic + requiredDuringSchedulingIgnoredDuringExecution: + description: 'If the anti-affinity requirements specified + by this field are not met at + + scheduling time, the pod will not be scheduled onto the + node. + + If the anti-affinity requirements specified by this field + cease to be met + + at some point during pod execution (e.g. due to a pod + label update), the + + system may or may not try to eventually evict the pod + from its node. + + When there are multiple elements, the lists of nodes corresponding + to each + + podAffinityTerm are intersected, i.e. all terms must be + satisfied.' + items: + description: 'Defines a set of pods (namely those matching + the labelSelector + + relative to the given namespace(s)) that this pod should + be + + co-located (affinity) or not co-located (anti-affinity) + with, + + where co-located is defined as running on a node whose + value of + + the label with key matches that of any + node on which + + a pod of the set of pods is running' + properties: + labelSelector: + description: 'A label query over a set of resources, + in this case pods. + + If it''s null, this PodAffinityTerm matches with + no Pods.' + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: 'A label selector requirement is + a selector that contains values, a key, and + an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: 'operator represents a key''s + relationship to a set of values. + + Valid operators are In, NotIn, Exists + and DoesNotExist.' + type: string + values: + description: 'values is an array of string + values. If the operator is In or NotIn, + + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + + the values array must be empty. This array + is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: 'MatchLabelKeys is a set of pod label + keys to select which pods will + + be taken into consideration. The keys are used to + lookup values from the + + incoming pod labels, those key-value labels are + merged with `labelSelector` as `key in (value)` + + to select the group of existing pods which pods + will be taken into consideration + + for the incoming pod''s pod (anti) affinity. Keys + that don''t exist in the incoming + + pod labels will be ignored. The default value is + empty. + + The same key is forbidden to exist in both matchLabelKeys + and labelSelector. + + Also, matchLabelKeys cannot be set when labelSelector + isn''t set. + + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity + feature gate.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: 'MismatchLabelKeys is a set of pod label + keys to select which pods will + + be taken into consideration. The keys are used to + lookup values from the + + incoming pod labels, those key-value labels are + merged with `labelSelector` as `key notin (value)` + + to select the group of existing pods which pods + will be taken into consideration + + for the incoming pod''s pod (anti) affinity. Keys + that don''t exist in the incoming + + pod labels will be ignored. The default value is + empty. + + The same key is forbidden to exist in both mismatchLabelKeys + and labelSelector. + + Also, mismatchLabelKeys cannot be set when labelSelector + isn''t set. + + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity + feature gate.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: 'A label query over the set of namespaces + that the term applies to. + + The term is applied to the union of the namespaces + selected by this field + + and the ones listed in the namespaces field. + + null selector and null or empty namespaces list + means "this pod''s namespace". + + An empty selector ({}) matches all namespaces.' + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: 'A label selector requirement is + a selector that contains values, a key, and + an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the + selector applies to. + type: string + operator: + description: 'operator represents a key''s + relationship to a set of values. + + Valid operators are In, NotIn, Exists + and DoesNotExist.' + type: string + values: + description: 'values is an array of string + values. If the operator is In or NotIn, + + the values array must be non-empty. If + the operator is Exists or DoesNotExist, + + the values array must be empty. This array + is replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} + pairs. A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains + only "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: 'namespaces specifies a static list of + namespace names that the term applies to. + + The term is applied to the union of the namespaces + listed in this field + + and the ones selected by namespaceSelector. + + null or empty namespaces list and null namespaceSelector + means "this pod''s namespace".' + items: + type: string + type: array + x-kubernetes-list-type: atomic + topologyKey: + description: 'This pod should be co-located (affinity) + or not co-located (anti-affinity) with the pods + matching + + the labelSelector in the specified namespaces, where + co-located is defined as running on a node + + whose value of the label with key topologyKey matches + that of any node on which any of the + + selected pods is running. + + Empty topologyKey is not allowed.' + type: string + required: + - topologyKey + type: object + type: array + x-kubernetes-list-type: atomic + type: object + type: object + agentEnvVars: + description: AgentEnvVars are extra environment variables to be + added to the agent deployment. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a C_IDENTIFIER. + type: string + value: + description: 'Variable references $(VAR_NAME) are expanded + + using the previously defined environment variables in the + container and + + any service environment variables. If a variable cannot + be resolved, + + the reference in the input string will be unchanged. Double + $$ are reduced + + to a single $, which allows for escaping the $(VAR_NAME) + syntax: i.e. + + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + + Escaped references will never be expanded, regardless of + whether the variable + + exists or not. + + Defaults to "".' + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + default: '' + description: 'Name of the referent. + + This field is effectively required, but due to backwards + compatibility is + + allowed to be empty. Instances of this type with + an empty value here are + + almost certainly wrong. + + TODO: Add other useful fields. apiVersion, kind, + uid? + + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + TODO: Drop `kubebuilder:default` when controller-gen + doesn''t need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.' + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: 'Selects a field of the pod: supports metadata.name, + metadata.namespace, `metadata.labels['''']`, `metadata.annotations['''']`, + + spec.nodeName, spec.serviceAccountName, status.hostIP, + status.podIP, status.podIPs.' + properties: + apiVersion: + description: Version of the schema the FieldPath is + written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the specified + API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: 'Selects a resource of the container: only + resources limits and requests + + (limits.cpu, limits.memory, limits.ephemeral-storage, + requests.cpu, requests.memory and requests.ephemeral-storage) + are currently supported.' + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the exposed + resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + default: '' + description: 'Name of the referent. + + This field is effectively required, but due to backwards + compatibility is + + allowed to be empty. Instances of this type with + an empty value here are + + almost certainly wrong. + + TODO: Add other useful fields. apiVersion, kind, + uid? + + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + TODO: Drop `kubebuilder:default` when controller-gen + doesn''t need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.' + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + nullable: true + type: array + agentNamespace: + description: AgentNamespace defaults to the system namespace, e.g. + cattle-fleet-system. + nullable: true + type: string + agentResources: + description: AgentResources sets the resources for the cluster's + agent deployment. + nullable: true + properties: + claims: + description: 'Claims lists the names of resources, defined in + spec.resourceClaims, + + that are used by this container. + + + + This is an alpha field and requires enabling the + + DynamicResourceAllocation feature gate. + + + + This field is immutable. It can only be set for containers.' + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: 'Name must match the name of one entry in + pod.spec.resourceClaims of + + the Pod where this field is used. It makes that resource + available + + inside a container.' + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Limits describes the maximum amount of compute + resources allowed. + + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: 'Requests describes the minimum amount of compute + resources required. + + If Requests is omitted for a container, it defaults to Limits + if that is explicitly specified, + + otherwise to an implementation-defined value. Requests cannot + exceed Limits. + + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/' + type: object + type: object + agentTolerations: + description: AgentTolerations defines an extra set of Tolerations + to be added to the Agent deployment. + items: + description: 'The pod this Toleration is attached to tolerates + any taint that matches + + the triple using the matching operator .' + properties: + effect: + description: 'Effect indicates the taint effect to match. + Empty means match all taint effects. + + When specified, allowed values are NoSchedule, PreferNoSchedule + and NoExecute.' + type: string + key: + description: 'Key is the taint key that the toleration applies + to. Empty means match all taint keys. + + If the key is empty, operator must be Exists; this combination + means to match all values and all keys.' + type: string + operator: + description: 'Operator represents a key''s relationship to + the value. + + Valid operators are Exists and Equal. Defaults to Equal. + + Exists is equivalent to wildcard for value, so that a pod + can + + tolerate all taints of a particular category.' + type: string + tolerationSeconds: + description: 'TolerationSeconds represents the period of time + the toleration (which must be + + of effect NoExecute, otherwise this field is ignored) tolerates + the taint. By default, + + it is not set, which means tolerate the taint forever (do + not evict). Zero and + + negative values will be treated as 0 (evict immediately) + by the system.' + format: int64 + type: integer + value: + description: 'Value is the taint value the toleration matches + to. + + If the operator is Exists, the value should be empty, otherwise + just a regular string.' + type: string + type: object + nullable: true + type: array + clientID: + description: 'ClientID is a unique string that will identify the + cluster. It can + + either be predefined, or generated when importing the cluster.' + nullable: true + type: string + hostNetwork: + description: 'HostNetwork sets the agent StatefulSet to use hostNetwork: + true setting. + + Allows for provisioning of network related bundles (CNI configuration).' + nullable: true + type: boolean + kubeConfigSecret: + description: 'KubeConfigSecret is the name of the secret containing + the kubeconfig for the downstream cluster. + + It can optionally contain a APIServerURL and CA to override the + + values in the fleet-controller''s configmap.' + nullable: true + type: string + kubeConfigSecretNamespace: + description: 'KubeConfigSecretNamespace is the namespace of the + secret containing the kubeconfig for the downstream cluster. + + If unset, it will be assumed the secret can be found in the namespace + that the Cluster object resides within.' + nullable: true + type: string + paused: + description: Paused if set to true, will stop any BundleDeployments + from being updated. + type: boolean + privateRepoURL: + description: PrivateRepoURL prefixes the image name and overrides + a global repo URL from the agents config. + nullable: true + type: string + redeployAgentGeneration: + description: RedeployAgentGeneration can be used to force redeploying + the agent. + format: int64 + type: integer + templateValues: + description: TemplateValues defines a cluster specific mapping of + values to be sent to fleet.yaml values templating. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + status: + properties: + agent: + description: AgentStatus contains information about the agent. + properties: + lastSeen: + description: 'LastSeen is the last time the agent checked in + to update the status + + of the cluster resource.' + format: date-time + nullable: true + type: string + namespace: + description: Namespace is the namespace of the agent deployment, + e.g. "cattle-fleet-system". + nullable: true + type: string + type: object + agentAffinityHash: + description: 'AgentAffinityHash is a hash of the agent''s affinity + configuration, + + used to detect changes.' + type: string + agentConfigChanged: + description: 'AgentConfigChanged is set to true if any of the agent + configuration + + changed, like the API server URL or CA. Setting it to true will + + trigger a re-import of the cluster.' + type: boolean + agentDeployedGeneration: + description: AgentDeployedGeneration is the generation of the agent + that is currently deployed. + format: int64 + nullable: true + type: integer + agentEnvVarsHash: + description: AgentEnvVarsHash is a hash of the agent's env vars, + used to detect changes. + nullable: true + type: string + agentHostNetwork: + description: AgentHostNetwork defines observed state of spec.hostNetwork + setting that is currently used. + nullable: true + type: boolean + agentMigrated: + description: 'AgentMigrated is always set to true after importing + a cluster. If + + false, it will trigger a migration. Old agents don''t have + + this in their status.' + type: boolean + agentNamespaceMigrated: + description: 'AgentNamespaceMigrated is always set to true after + importing a + + cluster. If false, it will trigger a migration. Old Fleet agents + + don''t have this in their status.' + type: boolean + agentPrivateRepoURL: + description: AgentPrivateRepoURL is the private repo URL for the + agent that is currently used. + nullable: true + type: string + agentResourcesHash: + description: 'AgentResourcesHash is a hash of the agent''s resources + configuration, + + used to detect changes.' + nullable: true + type: string + agentTLSMode: + description: 'AgentTLSMode supports two values: `system-store` and + `strict`. If set to + + `system-store`, instructs the agent to trust CA bundles from the + operating + + system''s store. If set to `strict`, then the agent shall only + connect to a + + server which uses the exact CA configured when creating/updating + the agent.' + nullable: true + type: string + agentTolerationsHash: + description: 'AgentTolerationsHash is a hash of the agent''s tolerations + + configuration, used to detect changes.' + nullable: true + type: string + apiServerCAHash: + description: APIServerCAHash is a hash of the upstream API server + CA, used to detect changes. + nullable: true + type: string + apiServerURL: + description: 'APIServerURL is the currently used URL of the API + server that the + + cluster uses to connect to upstream.' + nullable: true + type: string + cattleNamespaceMigrated: + description: 'CattleNamespaceMigrated is always set to true after + importing a + + cluster. If false, it will trigger a migration. Old Fleet agents, + + don''t have this in their status.' + type: boolean + conditions: + items: + properties: + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + type: string + lastUpdateTime: + description: The last time this condition was updated. + type: string + message: + description: Human-readable message indicating details about + last transition + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of cluster condition. + type: string + required: + - status + - type + type: object + type: array + desiredReadyGitRepos: + description: 'DesiredReadyGitRepos is the number of gitrepos for + this cluster that + + are desired to be ready.' + type: integer + display: + description: Display contains the number of ready bundles, nodes + and a summary state. + properties: + readyBundles: + description: 'ReadyBundles is a string in the form "%d/%d", + that describes the + + number of bundles that are ready vs. the number of bundles + desired + + to be ready.' + type: string + state: + description: State of the cluster, either one of the bundle + states, or "WaitCheckIn". + nullable: true + type: string + type: object + namespace: + description: 'Namespace is the cluster namespace, it contains the + clusters service + + account as well as any bundledeployments. Example: + + "cluster-fleet-local-cluster-294db1acfa77-d9ccf852678f"' + type: string + readyGitRepos: + description: ReadyGitRepos is the number of gitrepos for this cluster + that are ready. + type: integer + resourceCounts: + description: ResourceCounts is an aggregate over the GitRepoResourceCounts. + properties: + desiredReady: + description: DesiredReady is the number of resources that should + be ready. + type: integer + missing: + description: Missing is the number of missing resources. + type: integer + modified: + description: Modified is the number of resources that have been + modified. + type: integer + notReady: + description: 'NotReady is the number of not ready resources. + Resources are not + + ready if they do not match any other state.' + type: integer + orphaned: + description: Orphaned is the number of orphaned resources. + type: integer + ready: + description: Ready is the number of ready resources. + type: integer + unknown: + description: Unknown is the number of resources in an unknown + state. + type: integer + waitApplied: + description: WaitApplied is the number of resources that are + waiting to be applied. + type: integer + type: object + summary: + description: 'Summary is a summary of the bundledeployments. The + resource counts + + are copied from the gitrepo resource.' + properties: + desiredReady: + description: 'DesiredReady is the number of bundle deployments + that should be + + ready.' + type: integer + errApplied: + description: 'ErrApplied is the number of bundle deployments + that have been synced + + from the Fleet controller and the downstream cluster, but + with some + + errors when deploying the bundle.' + type: integer + modified: + description: 'Modified is the number of bundle deployments that + have been deployed + + and for which all resources are ready, but where some changes + from the + + Git repository have not yet been synced.' + type: integer + nonReadyResources: + description: 'NonReadyClusters is a list of states, which is + filled for a bundle + + that is not ready.' + items: + description: 'NonReadyResource contains information about + a bundle that is not ready for a + + given state like "ErrApplied". It contains a list of non-ready + or modified + + resources and their states.' + properties: + bundleState: + description: State is the state of the resource, like + e.g. "NotReady" or "ErrApplied". + nullable: true + type: string + message: + description: Message contains information why the bundle + is not ready. + nullable: true + type: string + modifiedStatus: + description: ModifiedStatus lists the state for each modified + resource. + items: + description: 'ModifiedStatus is used to report the status + of a resource that is modified. + + It indicates if the modification was a create, a delete + or a patch.' + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + description: Name is the name of the resource. + nullable: true + type: string + nonReadyStatus: + description: NonReadyStatus lists the state for each non-ready + resource. + items: + description: NonReadyStatus is used to report the status + of a resource that is not ready. It includes a summary. + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + type: string + type: array + state: + type: string + transitioning: + type: boolean + type: object + uid: + description: 'UID is a type that holds unique ID + values, including UUIDs. Because we + + don''t ONLY use UUIDs, this is an alias to string. Being + a type captures + + intent and helps make sure that UIDs and names + do not get conflated.' + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + description: 'NotReady is the number of bundle deployments that + have been deployed + + where some resources are not ready.' + type: integer + outOfSync: + description: 'OutOfSync is the number of bundle deployments + that have been synced + + from Fleet controller, but not yet by the downstream agent.' + type: integer + pending: + description: 'Pending is the number of bundle deployments that + are being processed + + by Fleet controller.' + type: integer + ready: + description: 'Ready is the number of bundle deployments that + have been deployed + + where all resources are ready.' + type: integer + waitApplied: + description: 'WaitApplied is the number of bundle deployments + that have been + + synced from Fleet controller and downstream cluster, but are + waiting + + to be deployed.' + type: integer + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: contents.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: Content + listKind: ContentList + plural: contents + singular: content + scope: Cluster + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: 'Content is used internally by Fleet and should not be used + directly. It + + contains the resources from a bundle for a specific target cluster.' + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + content: + description: 'Content is a byte array, which contains the manifests + of a bundle. + + The bundle resources are copied into the bundledeployment''s content + + resource, so the downstream agent can deploy them.' + format: byte + nullable: true + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + sha256sum: + description: SHA256Sum of the Content field + type: string + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: gitreporestrictions.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: GitRepoRestriction + listKind: GitRepoRestrictionList + plural: gitreporestrictions + singular: gitreporestriction + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .defaultServiceAccount + name: Default-ServiceAccount + type: string + - jsonPath: .allowedServiceAccounts + name: Allowed-ServiceAccounts + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: 'GitRepoRestriction is a resource that can optionally be used + to restrict + + the options of GitRepos in the same namespace.' + properties: + allowedClientSecretNames: + description: AllowedClientSecretNames is a list of client secret names + that GitRepos are allowed to use. + items: + type: string + nullable: true + type: array + allowedRepoPatterns: + description: 'AllowedRepoPatterns is a list of regex patterns that restrict + the + + valid values of the Repo field of a GitRepo.' + items: + type: string + nullable: true + type: array + allowedServiceAccounts: + description: AllowedServiceAccounts is a list of service accounts that + GitRepos are allowed to use. + items: + type: string + nullable: true + type: array + allowedTargetNamespaces: + description: 'AllowedTargetNamespaces restricts TargetNamespace to the + given + + namespaces. If AllowedTargetNamespaces is set, TargetNamespace must + + be set.' + items: + type: string + nullable: true + type: array + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + defaultClientSecretName: + description: DefaultClientSecretName overrides the GitRepo's default + client secret. + nullable: true + type: string + defaultServiceAccount: + description: DefaultServiceAccount overrides the GitRepo's default service + account. + nullable: true + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: gitrepos.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + categories: + - fleet + kind: GitRepo + listKind: GitRepoList + plural: gitrepos + singular: gitrepo + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.repo + name: Repo + type: string + - jsonPath: .status.commit + name: Commit + type: string + - jsonPath: .status.display.readyBundleDeployments + name: BundleDeployments-Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + description: 'GitRepo describes a git repository that is watched by Fleet. + + The resource contains the necessary information to deploy the repo, or + parts + + of it, to target clusters.' + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + branch: + description: Branch The git branch to follow. + nullable: true + type: string + caBundle: + description: CABundle is a PEM encoded CA bundle which will be used + to validate the repo's certificate. + format: byte + nullable: true + type: string + clientSecretName: + description: 'ClientSecretName is the name of the client secret + to be used to connect to the repo + + It is expected the secret be of type "kubernetes.io/basic-auth" + or "kubernetes.io/ssh-auth".' + nullable: true + type: string + correctDrift: + description: CorrectDrift specifies how drift correction should + work. + properties: + enabled: + description: Enabled correct drift if true. + type: boolean + force: + description: Force helm rollback with --force option will be + used if true. This will try to recreate all resources in the + release. + type: boolean + keepFailHistory: + description: KeepFailHistory keeps track of failed rollbacks + in the helm history. + type: boolean + type: object + deleteNamespace: + description: DeleteNamespace specifies if the namespace created + must be deleted after deleting the GitRepo. + type: boolean + disablePolling: + description: Disables git polling. When enabled only webhooks will + be used. + type: boolean + forceSyncGeneration: + description: Increment this number to force a redeployment of contents + from Git. + format: int64 + type: integer + helmRepoURLRegex: + description: 'HelmRepoURLRegex Helm credentials will be used if + the helm repo matches this regex + + Credentials will always be used if this is empty or not provided.' + nullable: true + type: string + helmSecretName: + description: HelmSecretName contains the auth secret for a private + Helm repository. + nullable: true + type: string + helmSecretNameForPaths: + description: HelmSecretNameForPaths contains the auth secret for + private Helm repository for each path. + nullable: true + type: string + imageScanCommit: + description: Commit specifies how to commit to the git repo when + a new image is scanned and written back to git repo. + properties: + authorEmail: + description: AuthorEmail gives the email to provide when making + a commit + nullable: true + type: string + authorName: + description: AuthorName gives the name to provide when making + a commit + nullable: true + type: string + messageTemplate: + description: 'MessageTemplate provides a template for the commit + message, + + into which will be interpolated the details of the change + made.' + nullable: true + type: string + type: object + imageScanInterval: + description: ImageScanInterval is the interval of syncing scanned + images and writing back to git repo. + type: string + insecureSkipTLSVerify: + description: InsecureSkipTLSverify will use insecure HTTPS to clone + the repo. + type: boolean + keepResources: + description: KeepResources specifies if the resources created must + be kept after deleting the GitRepo. + type: boolean + ociRegistry: + description: OCIRegistry specifies the OCI registry related parameters + properties: + authSecretName: + description: AuthSecretName contains the auth secret where the + OCI regristry credentials are stored. + nullable: true + type: string + basicHTTP: + description: BasicHTTP uses HTTP connections to the OCI registry + when enabled. + nullable: true + type: boolean + insecureSkipTLS: + description: InsecureSkipTLS allows connections to OCI registry + without certs when enabled. + nullable: true + type: boolean + reference: + description: Reference of the OCI Registry + type: string + type: object + paths: + description: 'Paths is the directories relative to the git repo + root that contain resources to be applied. + + Path globbing is supported, for example ["charts/*"] will match + all folders as a subdirectory of charts/ + + If empty, "/" is the default.' + items: + type: string + nullable: true + type: array + paused: + description: 'Paused, when true, causes changes in Git not to be + propagated down to the clusters but instead to mark + + resources as OutOfSync.' + type: boolean + pollingInterval: + description: PollingInterval is how often to check git for new updates. + nullable: true + type: string + repo: + description: Repo is a URL to a git repo to clone and index. + nullable: true + type: string + revision: + description: Revision A specific commit or tag to operate on. + nullable: true + type: string + serviceAccount: + description: ServiceAccount used in the downstream cluster for deployment. + nullable: true + type: string + targetNamespace: + description: 'Ensure that all resources are created in this namespace + + Any cluster scoped resource will be rejected if this is set + + Additionally this namespace will be created on demand.' + nullable: true + type: string + targets: + description: Targets is a list of targets this repo will deploy + to. + items: + description: GitTarget is a cluster or cluster group to deploy + to. + properties: + clusterGroup: + description: ClusterGroup is the name of a cluster group in + the same namespace as the clusters. + nullable: true + type: string + clusterGroupSelector: + description: ClusterGroupSelector is a label selector to select + cluster groups. + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a selector + that contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is + replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains only + "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + clusterName: + description: ClusterName is the name of a cluster. + nullable: true + type: string + clusterSelector: + description: ClusterSelector is a label selector to select + clusters. + nullable: true + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: 'A label selector requirement is a selector + that contains values, a key, and an operator that + + relates the key and values.' + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: 'operator represents a key''s relationship + to a set of values. + + Valid operators are In, NotIn, Exists and DoesNotExist.' + type: string + values: + description: 'values is an array of string values. + If the operator is In or NotIn, + + the values array must be non-empty. If the operator + is Exists or DoesNotExist, + + the values array must be empty. This array is + replaced during a strategic + + merge patch.' + items: + type: string + type: array + x-kubernetes-list-type: atomic + required: + - key + - operator + type: object + type: array + x-kubernetes-list-type: atomic + matchLabels: + additionalProperties: + type: string + description: 'matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels + + map is equivalent to an element of matchExpressions, + whose key field is "key", the + + operator is "In", and the values array contains only + "value". The requirements are ANDed.' + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: Name is the name of this target. + nullable: true + type: string + type: object + type: array + type: object + status: + properties: + commit: + description: Commit is the Git commit hash from the last git job + run. + nullable: true + type: string + conditions: + description: 'Conditions is a list of Wrangler conditions that describe + the state + + of the GitRepo.' + items: + properties: + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + type: string + lastUpdateTime: + description: The last time this condition was updated. + type: string + message: + description: Human-readable message indicating details about + last transition + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of cluster condition. + type: string + required: + - status + - type + type: object + type: array + desiredReadyClusters: + description: "DesiredReadyClusters\tis the number of clusters that\ + \ should be ready for bundles of this GitRepo." + type: integer + display: + description: Display contains a human readable summary of the status. + properties: + error: + description: Error is true if a message is present. + type: boolean + message: + description: Message contains the relevant message from the + deployment conditions. + type: string + readyBundleDeployments: + description: 'ReadyBundleDeployments is a string in the form + "%d/%d", that describes the + + number of ready bundledeployments over the total number of + bundledeployments.' + type: string + state: + description: 'State is the state of the GitRepo, e.g. "GitUpdating" + or the maximal + + BundleState according to StateRank.' + type: string + type: object + gitJobStatus: + description: GitJobStatus is the status of the last Git job run, + e.g. "Current" if there was no error. + type: string + lastPollingTriggered: + description: LastPollingTime is the last time the polling check + was triggered + format: date-time + type: string + lastSyncedImageScanTime: + description: LastSyncedImageScanTime is the time of the last image + scan. + format: date-time + type: string + observedGeneration: + description: 'ObservedGeneration is the current generation of the + resource in the cluster. It is copied from k8s + + metadata.Generation. The value is incremented for all changes, + except for changes to .metadata or .status.' + format: int64 + type: integer + readyClusters: + description: 'ReadyClusters is the lowest number of clusters that + are ready over + + all the bundles of this GitRepo.' + type: integer + resourceCounts: + description: ResourceCounts contains the number of resources in + each state over all bundles. + properties: + desiredReady: + description: DesiredReady is the number of resources that should + be ready. + type: integer + missing: + description: Missing is the number of missing resources. + type: integer + modified: + description: Modified is the number of resources that have been + modified. + type: integer + notReady: + description: 'NotReady is the number of not ready resources. + Resources are not + + ready if they do not match any other state.' + type: integer + orphaned: + description: Orphaned is the number of orphaned resources. + type: integer + ready: + description: Ready is the number of ready resources. + type: integer + unknown: + description: Unknown is the number of resources in an unknown + state. + type: integer + waitApplied: + description: WaitApplied is the number of resources that are + waiting to be applied. + type: integer + type: object + resourceErrors: + description: ResourceErrors is a sorted list of errors from the + resources. + items: + type: string + type: array + resources: + description: Resources contains metadata about the resources of + each bundle. + items: + description: GitRepoResource contains metadata about the resources + of a bundle. + properties: + apiVersion: + description: APIVersion is the API version of the resource. + nullable: true + type: string + error: + description: Error is true if any Error in the PerClusterState + is true. + type: boolean + id: + description: ID is the name of the resource, e.g. "namespace1/my-config" + or "backingimagemanagers.storage.io". + nullable: true + type: string + incompleteState: + description: 'IncompleteState is true if a bundle summary + has 10 or more non-ready + + resources or a non-ready resource has more 10 or more non-ready + or + + modified states.' + type: boolean + kind: + description: Kind is the k8s kind of the resource. + nullable: true + type: string + message: + description: Message is the first message from the PerClusterStates. + nullable: true + type: string + name: + description: Name of the resource. + nullable: true + type: string + namespace: + description: Namespace of the resource. + nullable: true + type: string + perClusterState: + description: PerClusterState is a list of states for each + cluster. Derived from the summaries non-ready resources. + items: + description: ResourcePerClusterState is generated for each + non-ready resource of the bundles. + properties: + clusterId: + description: ClusterID is the id of the cluster. + nullable: true + type: string + error: + description: Error is true if the resource is in an + error state, copied from the bundle's summary for + non-ready resources. + type: boolean + message: + description: Message combines the messages from the + bundle's summary. Messages are joined with the delimiter + ';'. + nullable: true + type: string + patch: + description: Patch for modified resources. + nullable: true + type: object + x-kubernetes-preserve-unknown-fields: true + state: + description: State is the state of the resource. + nullable: true + type: string + transitioning: + description: 'Transitioning is true if the resource + is in a transitioning state, + + copied from the bundle''s summary for non-ready resources.' + type: boolean + type: object + nullable: true + type: array + state: + description: State is the state of the resource, e.g. "Unknown", + "WaitApplied", "ErrApplied" or "Ready". + type: string + transitioning: + description: Transitioning is true if any Transitioning in + the PerClusterState is true. + type: boolean + type: + description: Type is the type of the resource, e.g. "apiextensions.k8s.io.customresourcedefinition" + or "configmap". + type: string + type: object + type: array + summary: + description: Summary contains the number of bundle deployments in + each state and a list of non-ready resources. + properties: + desiredReady: + description: 'DesiredReady is the number of bundle deployments + that should be + + ready.' + type: integer + errApplied: + description: 'ErrApplied is the number of bundle deployments + that have been synced + + from the Fleet controller and the downstream cluster, but + with some + + errors when deploying the bundle.' + type: integer + modified: + description: 'Modified is the number of bundle deployments that + have been deployed + + and for which all resources are ready, but where some changes + from the + + Git repository have not yet been synced.' + type: integer + nonReadyResources: + description: 'NonReadyClusters is a list of states, which is + filled for a bundle + + that is not ready.' + items: + description: 'NonReadyResource contains information about + a bundle that is not ready for a + + given state like "ErrApplied". It contains a list of non-ready + or modified + + resources and their states.' + properties: + bundleState: + description: State is the state of the resource, like + e.g. "NotReady" or "ErrApplied". + nullable: true + type: string + message: + description: Message contains information why the bundle + is not ready. + nullable: true + type: string + modifiedStatus: + description: ModifiedStatus lists the state for each modified + resource. + items: + description: 'ModifiedStatus is used to report the status + of a resource that is modified. + + It indicates if the modification was a create, a delete + or a patch.' + properties: + apiVersion: + nullable: true + type: string + delete: + type: boolean + kind: + nullable: true + type: string + missing: + type: boolean + name: + nullable: true + type: string + namespace: + nullable: true + type: string + patch: + nullable: true + type: string + type: object + nullable: true + type: array + name: + description: Name is the name of the resource. + nullable: true + type: string + nonReadyStatus: + description: NonReadyStatus lists the state for each non-ready + resource. + items: + description: NonReadyStatus is used to report the status + of a resource that is not ready. It includes a summary. + properties: + apiVersion: + nullable: true + type: string + kind: + nullable: true + type: string + name: + nullable: true + type: string + namespace: + nullable: true + type: string + summary: + properties: + error: + type: boolean + message: + items: + type: string + type: array + state: + type: string + transitioning: + type: boolean + type: object + uid: + description: 'UID is a type that holds unique ID + values, including UUIDs. Because we + + don''t ONLY use UUIDs, this is an alias to string. Being + a type captures + + intent and helps make sure that UIDs and names + do not get conflated.' + nullable: true + type: string + type: object + nullable: true + type: array + type: object + nullable: true + type: array + notReady: + description: 'NotReady is the number of bundle deployments that + have been deployed + + where some resources are not ready.' + type: integer + outOfSync: + description: 'OutOfSync is the number of bundle deployments + that have been synced + + from Fleet controller, but not yet by the downstream agent.' + type: integer + pending: + description: 'Pending is the number of bundle deployments that + are being processed + + by Fleet controller.' + type: integer + ready: + description: 'Ready is the number of bundle deployments that + have been deployed + + where all resources are ready.' + type: integer + waitApplied: + description: 'WaitApplied is the number of bundle deployments + that have been + + synced from Fleet controller and downstream cluster, but are + waiting + + to be deployed.' + type: integer + type: object + updateGeneration: + description: Update generation is the force update generation if + spec.forceSyncGeneration is set + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: imagescans.fleet.cattle.io +spec: + group: fleet.cattle.io + names: + kind: ImageScan + listKind: ImageScanList + plural: imagescans + singular: imagescan + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.image + name: Repository + type: string + - jsonPath: .status.latestTag + name: Latest + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. + + Servers should convert recognized schemas to the latest internal value, + and + + may reject unrecognized values. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource + this object represents. + + Servers may infer this from the endpoint the client submits requests + to. + + Cannot be updated. + + In CamelCase. + + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: API is taken from https://github.com/fluxcd/image-reflector-controller + properties: + gitrepoName: + description: GitRepo reference name + nullable: true + type: string + image: + description: Image is the name of the image repository + nullable: true + type: string + interval: + description: 'Interval is the length of time to wait between + + scans of the image repository.' + nullable: true + type: string + policy: + description: 'Policy gives the particulars of the policy to be followed + in + + selecting the most recent image' + properties: + alphabetical: + description: Alphabetical set of rules to use for alphabetical + ordering of the tags. + nullable: true + properties: + order: + description: 'Order specifies the sorting order of the tags. + Given the letters of the + + alphabet as tags, ascending order would select Z, and + descending order + + would select A.' + nullable: true + type: string + type: object + semver: + description: 'SemVer gives a semantic version range to check + against the tags + + available.' + nullable: true + properties: + range: + description: 'Range gives a semver range for the image tag; + the highest + + version within the range that''s a tag yields the latest + image.' + nullable: true + type: string + type: object + type: object + secretRef: + description: 'SecretRef can be given the name of a secret containing + + credentials to use for the image registry. The secret should be + + created with `kubectl create secret docker-registry`, or the + + equivalent.' + nullable: true + properties: + name: + default: '' + description: 'Name of the referent. + + This field is effectively required, but due to backwards compatibility + is + + allowed to be empty. Instances of this type with an empty + value here are + + almost certainly wrong. + + TODO: Add other useful fields. apiVersion, kind, uid? + + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + + TODO: Drop `kubebuilder:default` when controller-gen doesn''t + need it https://github.com/kubernetes-sigs/kubebuilder/issues/3896.' + type: string + type: object + x-kubernetes-map-type: atomic + suspend: + description: 'This flag tells the controller to suspend subsequent + image scans. + + It does not apply to already started scans. Defaults to false.' + type: boolean + tagName: + description: TagName is the tag ref that needs to be put in manifest + to replace fields + nullable: true + type: string + type: object + status: + properties: + canonicalImageName: + description: 'CanonicalName is the name of the image repository + with all the + + implied bits made explicit; e.g., `docker.io/library/alpine` + + rather than `alpine`.' + type: string + conditions: + items: + properties: + lastTransitionTime: + description: Last time the condition transitioned from one + status to another. + type: string + lastUpdateTime: + description: The last time this condition was updated. + type: string + message: + description: Human-readable message indicating details about + last transition + type: string + reason: + description: The reason for the condition's last transition. + type: string + status: + description: Status of the condition, one of True, False, + Unknown. + type: string + type: + description: Type of cluster condition. + type: string + required: + - status + - type + type: object + type: array + lastScanTime: + description: LastScanTime is the last time image was scanned + format: date-time + type: string + latestDigest: + description: LatestDigest is the digest of latest tag + type: string + latestImage: + description: 'LatestImage gives the first in the list of images + scanned by + + the image repository, when filtered and ordered according to + + the policy.' + type: string + latestTag: + description: Latest tag is the latest tag filtered by the policy + type: string + observedGeneration: + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/fleet-crd/104.0.1+up0.10.1/values.yaml b/charts/fleet-crd/104.0.1+up0.10.1/values.yaml new file mode 100644 index 0000000000..d41d3a2444 --- /dev/null +++ b/charts/fleet-crd/104.0.1+up0.10.1/values.yaml @@ -0,0 +1 @@ +# This file is intentionally empty diff --git a/index.yaml b/index.yaml index dbdbed3873..9d371f061b 100755 --- a/index.yaml +++ b/index.yaml @@ -1474,6 +1474,23 @@ entries: - assets/fleet-agent/fleet-agent-101.0.0+up0.5.0.tgz version: 101.0.0+up0.5.0 fleet-crd: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/release-name: fleet-crd + apiVersion: v2 + appVersion: 0.10.1 + created: "2024-08-17T19:03:25.91663359-03:00" + description: Fleet Manager CustomResourceDefinitions + digest: e14a4a3c696f7a185de2d82932a05c89d9e26e64eb5eb565e4c4d6aa56a66d3f + icon: https://charts.rancher.io/assets/logos/fleet.svg + name: fleet-crd + urls: + - assets/fleet-crd/fleet-crd-104.0.1+up0.10.1.tgz + version: 104.0.1+up0.10.1 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/release.yaml b/release.yaml index 664f7faf8f..90d50bdb78 100644 --- a/release.yaml +++ b/release.yaml @@ -1,5 +1,7 @@ fleet: - 104.0.1+up0.10.1 +fleet-crd: + - 104.0.1+up0.10.1 rancher-aks-operator: - 104.1.0+up1.9.1 rancher-aks-operator-crd: From 8fc8445a7d7ba980d7b2b79c0cffba70577604fb Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:03:38 -0300 Subject: [PATCH 11/14] release chart: fleet-agent - version: 104.0.1+up0.10.1 --- .../fleet-agent-104.0.1+up0.10.1.tgz | Bin 0 -> 3462 bytes .../fleet-agent/104.0.1+up0.10.1/Chart.yaml | 15 +++ charts/fleet-agent/104.0.1+up0.10.1/README.md | 8 ++ .../104.0.1+up0.10.1/templates/_helpers.tpl | 22 ++++ .../104.0.1+up0.10.1/templates/configmap.yaml | 13 +++ .../templates/deployment.yaml | 108 ++++++++++++++++++ .../templates/network_policy_allow_all.yaml | 15 +++ .../patch_default_serviceaccount.yaml | 28 +++++ .../104.0.1+up0.10.1/templates/rbac.yaml | 28 +++++ .../104.0.1+up0.10.1/templates/secret.yaml | 10 ++ .../104.0.1+up0.10.1/templates/service.yaml | 9 ++ .../templates/serviceaccount.yaml | 4 + .../104.0.1+up0.10.1/templates/validate.yaml | 11 ++ .../fleet-agent/104.0.1+up0.10.1/values.yaml | 70 ++++++++++++ index.yaml | 19 +++ release.yaml | 2 + 16 files changed, 362 insertions(+) create mode 100644 assets/fleet-agent/fleet-agent-104.0.1+up0.10.1.tgz create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/Chart.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/README.md create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/_helpers.tpl create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/configmap.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/deployment.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/network_policy_allow_all.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/patch_default_serviceaccount.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/rbac.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/secret.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/service.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/serviceaccount.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/templates/validate.yaml create mode 100644 charts/fleet-agent/104.0.1+up0.10.1/values.yaml diff --git a/assets/fleet-agent/fleet-agent-104.0.1+up0.10.1.tgz b/assets/fleet-agent/fleet-agent-104.0.1+up0.10.1.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5d5ff1d9991a47a50dad26994a665747ff452f62 GIT binary patch literal 3462 zcmV;14SDh(iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI|QbKJO*_uu>!T~wvK-V-?wJ-lJvU6oGOCeF!WIvc>%sY)NF6Up z&YnFg4TrG84sKO7Fb|3|~q<7cDe)03A+!}0O(^x1H9boBE084Mp+jD9MWCi2~f5Ip}8kwKZdy8_Cqbf*>3An__>8)BSjd^bo zp%P$}mp}F97ASM7RaA2w-cg>3JJrkW8{QUv9RJ?SK8{Dj`(>BNkSL5y8xm;Dw}2G% zFIA0;aX^ZqejJ)AM?r=vm9)?{?ORh6-Vjb^DB;Xh0TKLx>OU6>h=!Y#FbrsFc;{Ld zDj5t?Go@AR8(_pCN}*N*CT2nntTeG&%z|y{>c)q=(0PMj3+7-!q9`@p@l?);t~s?s1|Zr!~dWO5&)Xa z5?FX-2oB)g9HA&DjHdA2^(BZY=sCjwmJ^g5H7YoJ`x+F=1xk=5=akPZM;qPpQfZhV zDAX`ViNOI}{6zAC;Rf5#CB&)7lhfnlBZH?mw&L%uFB1sEN*q&tfjJ;gMTQwzJ+CA? zKl?-(76uaa3?OM?FVrg|PzwYA#BaftIGj&d*>{@{FN^sT8?o69r15O$*#& z`CNHsrG-ROBZpLQj;UqR0!VNGxou-^-jK3VX_PU%lO+P>@OM{HWGnbP^H zvJkvogWzl#n-?sBNCYmlDTf)5srG$1C8;*!$ZX9?Z~y>PArhDnxsi^VZg~Bw(v#|q zMh>M!N{L3eqk0}V*4M9^%2%5%-Qss>#d0E>XIF#GyxQ11eKnyIYpds-;%%Q@2Z%r&ih}P@CFw!Z+e{oKtgOw`G(F-Sau|iU=rx5;54Z=^V0F7-~J%k&1 zkY`)JgVk#Ab?{f`$TU_R#;n!o8|Tp6E-2R5v8b#L1H8<*U)A+!LqOff++1*tW= zjfdiq)*GZkVY9~I>w%ZA>SUW4*=49vxoeYOA;M-9%OG-v^tD@70e!eZdXv1pPIP*v zR}AIXJtsqZE!srU8Z~`so!!&pQ9u4W11=}UqXdI?;Q#P=blSoH)A2t3|1@+$D~Fr4x@1f6&PK-yC{J0L-4_vx;b-8KXUH{t1KVN1hFq=vH_HiH{2$5LPUfGX`-Yat zt!=G)ByNS$K0@ebd~cV`P2PJ&_OIeX-#6{UVfKH&|L1r2-WP(=bot)SQuFuIyun@ZpQF=`|2G~TkN5uHlTZ{zt(cD= zdCF(;?Kd_ATswpwU*1}s=y3`CDj8XAF@JrI-`roV>KRcT0*E^&0F2sJE?Xh8&W0@I zGl|M?rP>tiCOCb4w=B@7zIJ8o?+f?yOZWJ{7xmBo!Z_%)+2dC%;#RDW$ABI4e>^3^hh>GKUG+L{+9KVuslvOmHeBMm9N>Xy04oMmuWM3;=zY;U&>1 zgmx%rKyOjUIQsl>*CDnO9C<$?{1`u?yD91qSTsBeur9@Ye3}^hB5cd>wq&eo#dgsS zOVeDhd=B_N^e+exA+%#|ezeiRr1)l;pHX4{uKpI1QVZ(=-n4rCow!B*x6s?>>+pw7 z{7%l4d1b`I!w+05e)v2#ZPly04ccDLr?zHmCD>)k_Ax#n?1ZGZVmiH~In@d5PyPQo zsek>K6OumOcK|!j|C}6k&;N{%PWS8oQ&4m5x1&x z_-@qNYcQo`$&7Ix0V$~UT)n0K{OjlTdjlm(nPMw(fpXGFh=2=z?HRwjzVun)*I}F2 zBy`Q2k89%pP@Yjf`?Quu6JOdq_^@Qv<_81`0JgjOV>(!slYd~UZ6Eucyw(!jyM@>B z)M9_wIYybb`bab-E|EHkNd7ld99{gw|T&*Uj z$H>##w0wZw`6WHywQN<=<#8peFMzh#ZHD9NeE7A++RX2iu%B7oU*P=A@K-QuCdH1$ zU?PMzeNg;D;PSrtZ&!>*0)Soff4p`6Z-4&#si-smTL!}i9{T~%%K~eI<@H;emR3&* zTnX;NJnd6JJ!f{lbZ`9j=)w8_$r0Z+?VA6iVR!w1d9?Tco`xQp|CPh=FbsU@7VPO? zq5k>5AdF^2Kav5kGyZeb{r>B8v_Jp*G_+dLDR6{skN<;qYga3n63XDK>Km_jbE?4J zI#b`_;J1A+1Iq1Z$D0q?f2V*bo91uHv3X5+33rO|!pVU=bKf}iv}e1H?QhDzRBN^+ z>1$BqI7!o)X$l>-GN=OoakBj|&0VE&Xupfkh0?(2EwUvLrbN>j3Y+i#(z>~)&rePK zzrHwo_2weZvqyf%F8m*jyYc_=%klpHpC_S%1AnWHyHD(o$a1jv00zOu0_D=>MjoXg z6L(x`i6n1-S}RKqg!>C6^qgqBi(GP=8hgU-B~}-`@3*y*GO(D5RK4lIKLzlrXl8gWz2~8ktB-!{%;|G1Vg1(%nE&_3rnX oNZ}4AifVkIX)oe0t= 1.18.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: fleet-agent +apiVersion: v2 +appVersion: 0.10.1 +description: Fleet Manager Agent - GitOps at Scale +icon: https://charts.rancher.io/assets/logos/fleet.svg +name: fleet-agent +version: 104.0.1+up0.10.1 diff --git a/charts/fleet-agent/104.0.1+up0.10.1/README.md b/charts/fleet-agent/104.0.1+up0.10.1/README.md new file mode 100644 index 0000000000..2c5724dcef --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/README.md @@ -0,0 +1,8 @@ +## Fleet Agent Helm Chart + +Every Fleet-managed downstream cluster will run an agent that communicates back to the Fleet controller. This agent is just another set of Kubernetes controllers running in the downstream cluster. + +Standalone Fleet users use this chart for agent-initiated registration. For more details see [agent-initiated registration](https://fleet.rancher.io/cluster-registration#agent-initiated). +Fleet in Rancher does not use this chart, but creates the agent deployments programmatically. + +The Fleet documentation is centralized in the [doc website](https://fleet.rancher.io/). \ No newline at end of file diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/_helpers.tpl b/charts/fleet-agent/104.0.1+up0.10.1/templates/_helpers.tpl new file mode 100644 index 0000000000..6cd96c3ace --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/_helpers.tpl @@ -0,0 +1,22 @@ +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} \ No newline at end of file diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/configmap.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/configmap.yaml new file mode 100644 index 0000000000..f3e83a89cc --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/configmap.yaml @@ -0,0 +1,13 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: fleet-agent +data: + config: |- + { + {{ if .Values.labels }} + "labels":{{toJson .Values.labels}}, + {{ end }} + "clientID":"{{.Values.clientID}}", + "agentTLSMode": "{{.Values.agentTLSMode}}" + } diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/deployment.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/deployment.yaml new file mode 100644 index 0000000000..a13d85abee --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/deployment.yaml @@ -0,0 +1,108 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: fleet-agent +spec: + serviceName: fleet-agent + selector: + matchLabels: + app: fleet-agent + template: + metadata: + labels: + app: fleet-agent + spec: + initContainers: + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: '{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}' + name: fleet-agent-register + command: + - fleetagent + - register + {{- if .Values.debug }} + - --debug + - --debug-level + - {{ quote .Values.debugLevel }} + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + containers: + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: '{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}' + name: fleet-agent + command: + - fleetagent + {{- if .Values.debug }} + - --debug + - --debug-level + - {{ quote .Values.debugLevel }} + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + volumeMounts: + - mountPath: /.kube + name: kube + - env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + image: '{{ template "system_default_registry" . }}{{.Values.image.repository}}:{{.Values.image.tag}}' + name: fleet-agent-clusterstatus + command: + - fleetagent + - clusterstatus + {{- if .Values.debug }} + - --debug + - --debug-level + - {{ quote .Values.debugLevel }} + {{- else }} + securityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + privileged: false + capabilities: + drop: + - ALL + {{- end }} + volumes: + - name: kube + emptyDir: {} + serviceAccountName: fleet-agent + {{- if .Values.fleetAgent.hostNetwork }} + hostNetwork: true + {{- end }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.fleetAgent.nodeSelector }} +{{ toYaml .Values.fleetAgent.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.fleetAgent.tolerations }} +{{ toYaml .Values.fleetAgent.tolerations | indent 8 }} +{{- end }} +{{- if not .Values.debug }} + securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 +{{- end }} diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/network_policy_allow_all.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/network_policy_allow_all.yaml new file mode 100644 index 0000000000..a72109a062 --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/network_policy_allow_all.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all + namespace: {{ .Values.internal.systemNamespace }} +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/patch_default_serviceaccount.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/patch_default_serviceaccount.yaml new file mode 100644 index 0000000000..aad4eea415 --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/patch_default_serviceaccount.yaml @@ -0,0 +1,28 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: patch-fleet-sa + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + spec: + serviceAccountName: fleet-agent + restartPolicy: Never + containers: + - name: sa + image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}" + imagePullPolicy: {{ .Values.global.imagePullPolicy }} + command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] + args: ["-n", {{ .Values.internal.systemNamespace }}] + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.kubectl.nodeSelector }} +{{ toYaml .Values.kubectl.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.kubectl.tolerations }} +{{ toYaml .Values.kubectl.tolerations | indent 8 }} +{{- end }} + backoffLimit: 1 diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/rbac.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/rbac.yaml new file mode 100644 index 0000000000..1a7e8d8841 --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/rbac.yaml @@ -0,0 +1,28 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: fleet-agent-system-fleet-agent-role +rules: +- apiGroups: + - '*' + resources: + - '*' + verbs: + - '*' +- nonResourceURLs: + - "*" + verbs: + - "*" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: fleet-agent-system-fleet-agent-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: fleet-agent-system-fleet-agent-role +subjects: +- kind: ServiceAccount + name: fleet-agent + namespace: {{.Release.Namespace}} diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/secret.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/secret.yaml new file mode 100644 index 0000000000..4715882047 --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/secret.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +data: + systemRegistrationNamespace: "{{b64enc .Values.systemRegistrationNamespace}}" + clusterNamespace: "{{b64enc .Values.clusterNamespace}}" + token: "{{b64enc .Values.token}}" + apiServerURL: "{{b64enc .Values.apiServerURL}}" + apiServerCA: "{{b64enc .Values.apiServerCA}}" +kind: Secret +metadata: + name: fleet-agent-bootstrap diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/service.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/service.yaml new file mode 100644 index 0000000000..36d35588f3 --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/service.yaml @@ -0,0 +1,9 @@ +apiVersion: v1 +kind: Service +metadata: + name: fleet-agent +spec: + type: ClusterIP + clusterIP: None + selector: + app: fleet-agent diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/serviceaccount.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/serviceaccount.yaml new file mode 100644 index 0000000000..73e27f0be9 --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/serviceaccount.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + name: fleet-agent diff --git a/charts/fleet-agent/104.0.1+up0.10.1/templates/validate.yaml b/charts/fleet-agent/104.0.1+up0.10.1/templates/validate.yaml new file mode 100644 index 0000000000..d53ff1c508 --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/templates/validate.yaml @@ -0,0 +1,11 @@ +{{if ne .Release.Namespace .Values.internal.systemNamespace }} +{{ fail (printf "This chart must be installed in the namespace %s as the release name fleet-agent" .Values.internal.systemNamespace) }} +{{end}} + +{{if ne .Release.Name .Values.internal.managedReleaseName }} +{{ fail (printf "This chart must be installed in the namespace %s as the release name fleet-agent" .Values.internal.managedReleaseName) }} +{{end}} + +{{if not .Values.apiServerURL }} +{{ fail "apiServerURL is required to be set, and most likely also apiServerCA" }} +{{end}} diff --git a/charts/fleet-agent/104.0.1+up0.10.1/values.yaml b/charts/fleet-agent/104.0.1+up0.10.1/values.yaml new file mode 100644 index 0000000000..dc3f4e71a0 --- /dev/null +++ b/charts/fleet-agent/104.0.1+up0.10.1/values.yaml @@ -0,0 +1,70 @@ +image: + os: "windows,linux" + repository: rancher/fleet-agent + tag: v0.10.1 + +# The public URL of the Kubernetes API server running the Fleet Manager must be set here +# Example: https://example.com:6443 +apiServerURL: "" + +# The the pem encoded value of the CA of the Kubernetes API server running the Fleet Manager. +# If left empty it is assumed this Kubernetes API TLS is signed by a well known CA. +apiServerCA: "" + +# Determines whether the agent should trust CA bundles from the operating system's trust store when connecting to a +# management cluster. True in `system-store` mode, false in `strict` mode. +agentTLSMode: "system-store" + +# The cluster registration value +token: "" + +# Labels to add to the cluster upon registration only. They are not added after the fact. +# labels: +# foo: bar + +# The client ID of the cluster to associate with +clientID: "" + +# The namespace of the cluster we are register with +clusterNamespace: "" + +# The namespace containing the clusters registration secrets +systemRegistrationNamespace: cattle-fleet-clusters-system + +# Please do not change the below setting unless you really know what you are doing +internal: + systemNamespace: cattle-fleet-system + managedReleaseName: fleet-agent + +# The nodeSelector and tolerations for the agent deployment +fleetAgent: + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## List of node taints to tolerate (requires Kubernetes >= 1.6) + tolerations: [] + ## HostNetwork setting for the agent deployment. + ## When set allows for provisioning of network related bundles (CNI configuration) in a cluster without CNI. + hostNetwork: false +kubectl: + ## Node labels for pod assignment + ## Ref: https://kubernetes.io/docs/user-guide/node-selection/ + ## + nodeSelector: {} + ## List of node taints to tolerate (requires Kubernetes >= 1.6) + tolerations: + - key: node.cloudprovider.kubernetes.io/uninitialized + operator: "Equal" + value: "true" + effect: NoSchedule + +global: + cattle: + systemDefaultRegistry: "" + kubectl: + repository: rancher/kubectl + tag: v1.29.0 + +debug: false +debugLevel: 0 diff --git a/index.yaml b/index.yaml index 9d371f061b..33d3e6c5b7 100755 --- a/index.yaml +++ b/index.yaml @@ -1150,6 +1150,25 @@ entries: - assets/fleet/fleet-101.0.0+up0.5.0.tgz version: 101.0.0+up0.5.0 fleet-agent: + - annotations: + catalog.cattle.io/certified: rancher + catalog.cattle.io/hidden: "true" + catalog.cattle.io/kube-version: '>= 1.18.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cattle-fleet-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: fleet-agent + apiVersion: v2 + appVersion: 0.10.1 + created: "2024-08-17T19:03:36.449675034-03:00" + description: Fleet Manager Agent - GitOps at Scale + digest: ede4dfa79674d4d040ba7068be479565d73e71b01e36c5bb6742476226fc7fc6 + icon: https://charts.rancher.io/assets/logos/fleet.svg + name: fleet-agent + urls: + - assets/fleet-agent/fleet-agent-104.0.1+up0.10.1.tgz + version: 104.0.1+up0.10.1 - annotations: catalog.cattle.io/certified: rancher catalog.cattle.io/hidden: "true" diff --git a/release.yaml b/release.yaml index 90d50bdb78..415d0f55cd 100644 --- a/release.yaml +++ b/release.yaml @@ -1,5 +1,7 @@ fleet: - 104.0.1+up0.10.1 +fleet-agent: + - 104.0.1+up0.10.1 fleet-crd: - 104.0.1+up0.10.1 rancher-aks-operator: From e14339c1ee88ad5ad7211cdbde1e6df9d2f7464f Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:09:34 -0300 Subject: [PATCH 12/14] release by forward-port rancher-cis-benchmark 6.1.0 --- .../rancher-cis-benchmark-6.1.0.tgz | Bin 0 -> 6244 bytes charts/rancher-cis-benchmark/6.1.0/Chart.yaml | 22 ++ charts/rancher-cis-benchmark/6.1.0/README.md | 9 + .../rancher-cis-benchmark/6.1.0/app-readme.md | 37 ++++ .../6.1.0/templates/_helpers.tpl | 27 +++ .../6.1.0/templates/alertingrule.yaml | 14 ++ .../6.1.0/templates/benchmark-aks-1.0.yaml | 8 + .../6.1.0/templates/benchmark-cis-1.7.yaml | 9 + .../6.1.0/templates/benchmark-cis-1.8.yaml | 8 + .../6.1.0/templates/benchmark-eks-1.2.0.yaml | 8 + .../6.1.0/templates/benchmark-gke-1.2.0.yaml | 8 + .../benchmark-k3s-cis-1.7-hardened.yaml | 9 + .../benchmark-k3s-cis-1.7-permissive.yaml | 9 + .../benchmark-k3s-cis-1.8-hardened.yaml | 8 + .../benchmark-k3s-cis-1.8-permissive.yaml | 8 + .../benchmark-rke-cis-1.7-hardened.yaml | 9 + .../benchmark-rke-cis-1.7-permissive.yaml | 9 + .../benchmark-rke-cis-1.8-hardened.yaml | 8 + .../benchmark-rke-cis-1.8-permissive.yaml | 8 + .../benchmark-rke2-cis-1.7-hardened.yaml | 9 + .../benchmark-rke2-cis-1.7-permissive.yaml | 9 + .../benchmark-rke2-cis-1.8-hardened.yaml | 8 + .../benchmark-rke2-cis-1.8-permissive.yaml | 8 + .../6.1.0/templates/cis-roles.yaml | 49 ++++ .../6.1.0/templates/configmap.yaml | 18 ++ .../6.1.0/templates/deployment.yaml | 61 +++++ .../templates/network_policy_allow_all.yaml | 15 ++ .../patch_default_serviceaccount.yaml | 29 +++ .../6.1.0/templates/rbac.yaml | 209 ++++++++++++++++++ .../6.1.0/templates/scanprofile-cis-1.7.yaml | 9 + .../6.1.0/templates/scanprofile-cis-1.8.yaml | 9 + .../scanprofile-k3s-cis-1.7-hardened.yml | 9 + .../scanprofile-k3s-cis-1.7-permissive.yml | 9 + .../scanprofile-k3s-cis-1.8-hardened.yml | 9 + .../scanprofile-k3s-cis-1.8-permissive.yml | 9 + .../scanprofile-rke-1.7-hardened.yaml | 9 + .../scanprofile-rke-1.7-permissive.yaml | 9 + .../scanprofile-rke-1.8-hardened.yaml | 9 + .../scanprofile-rke-1.8-permissive.yaml | 9 + .../scanprofile-rke2-cis-1.7-hardened.yml | 9 + .../scanprofile-rke2-cis-1.7-permissive.yml | 9 + .../scanprofile-rke2-cis-1.8-hardened.yml | 9 + .../scanprofile-rke2-cis-1.8-permissive.yml | 9 + .../6.1.0/templates/scanprofileaks.yml | 9 + .../6.1.0/templates/scanprofileeks.yml | 9 + .../6.1.0/templates/scanprofilegke.yml | 9 + .../6.1.0/templates/serviceaccount.yaml | 14 ++ .../6.1.0/templates/validate-install-crd.yaml | 17 ++ .../rancher-cis-benchmark/6.1.0/values.yaml | 53 +++++ index.yaml | 26 +++ release.yaml | 2 + 51 files changed, 898 insertions(+) create mode 100644 assets/rancher-cis-benchmark/rancher-cis-benchmark-6.1.0.tgz create mode 100644 charts/rancher-cis-benchmark/6.1.0/Chart.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/README.md create mode 100644 charts/rancher-cis-benchmark/6.1.0/app-readme.md create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/_helpers.tpl create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/alertingrule.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-aks-1.0.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-cis-1.7.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-cis-1.8.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-eks-1.2.0.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-gke-1.2.0.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.7-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.7-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.8-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.8-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.7-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.7-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.8-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.8-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.7-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.7-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.8-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.8-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/cis-roles.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/configmap.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/deployment.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/network_policy_allow_all.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/patch_default_serviceaccount.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/rbac.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-cis-1.7.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-cis-1.8.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.7-hardened.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.7-permissive.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.8-hardened.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.8-permissive.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.7-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.7-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.8-hardened.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.8-permissive.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.7-hardened.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.7-permissive.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.8-hardened.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.8-permissive.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofileaks.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofileeks.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/scanprofilegke.yml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/serviceaccount.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/templates/validate-install-crd.yaml create mode 100644 charts/rancher-cis-benchmark/6.1.0/values.yaml diff --git a/assets/rancher-cis-benchmark/rancher-cis-benchmark-6.1.0.tgz b/assets/rancher-cis-benchmark/rancher-cis-benchmark-6.1.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..8c3915666fe59a96da23087b4cefa02a2816f148 GIT binary patch literal 6244 zcmYkBcRbba`^S%!vPVMV*fV>FV-yG385tQNB|M}=GGoJ!T@l8?cA?|tTuzhb`8_WB*iCrzyf|@>GoPkon>IPwC@Cq~ zD5h`8F9aI(aSi^V6**{S%Fn{MdBadlIZ*f}=cAK}J~8Blc?=0UfGvCNy1j#47gmoVW5ewy z?Y(AU{*4#plE5YB$!}u(yno9f>mPJf0r9;4pXrlmn)q10G1?U#s^YKS>+R-BwV`i@ z7|GMMF;j1*a2L}|;w~*FLoYs_Fro59TY~t8=r`OKB zs&+n@1YBlLnxV10)zA#jlVB8~vwNpa`BUb043=r77)-G>8y?FoA2aHtThc9Karh+j3G?;Kx3aY#yx zXBdbh?^3&davqvAOxc^UFU?*I?ZYnjIj2Er-(0k4yk5VhxxK<2tfczm6EujQ))PKh z5&KMd(%dSlyU`g+IuIda><;Gc%4OP|#b~idRqhGY+lngX@;zeOFVE4^Xbe+qdt^$d zsk3Nq1!T%pdVQp3byjOx_WjCtcRF?0nX#eTLg%YAJ!v>}_PaN|@Pu|8aG;xm^L;{c zpT2~Dl{kiSSkB9x;tNcUEa#_M5JNYBX1wt0+Bo}Gltdfiw^?}7S zPOFDKToWYTDzd}IPa#X{5MD+sGnuY2C9nrpmd=c-AkSJu9`(6XTFFEadT&oDx8@P%?2MU6Cg@PB;6jg6Y zZl`&9cerCqslR5us$A)KcmesuRsBTzsGfco+9>v`(3fRaYg#(ilQB2B=aC=HzWR&x z=Oe~4k`;0)+s;KF3=)e72-mW97BU+CQir(>%bPa8E}Bk_Ra6Y_a{d0v4O+!{VA*_O zcJbLpw>c!~ZCmhE$_Enf z3nGL22C8Rx_I=0{(M81UTR$26`iDIedj zA@dmNiWqwk#g*aX_ueKOxWm^#1t7KUWzv!gT;MQr%N2~nTi~)?6IBjQ>U;&T(_Q`nZx%vVU0H+@=d9DIB z?%=EKZJ;j^SDQW6r=BxYgXy7hlqV)5&%s>syO_o?*iqq5|4ZuEBQ(pN#ivK=*-nY) zU^$%n^P+`S^~sct^TOe}E@1lp?ixbj-N5bFvI5=E7-Dd#BMXsop_^DsT>f+QFmaSE z-fFx55`6Zv4J=>Y>5`oprrMiIe&%m@6?i-*5y-j_1I<9b~ z?F(=~k30YA){PS?dT6W8;oEUy26ccRM>g z!thA;DMdh?OX0jW`V|ro<+M%;KRP#aWF|~&%&#C0j)CxF91wg};?M^u-daX`T-hcC zsKdem3;I23V0Rd>D#FAQvBp=Yfn#9JJ_@+^|1RLeW1DS3Gpa;z-bpUu%BCMj4pS-6 zl_mHp;8r4jgfRux-3EFHh;LnWL4XzY9wXp+4U|X`Xf#I!a7ch&Z~^p2mm|b0)$nr% zUy@~?6U8H-!{Z_T;1__6g}MSue}Ss#vp69C9Oxzen`OD;;J~UHIPO#@cDQtqu?bva zuKX}z1Xg1LCE|ajQ(vlY9!dth60LgCB|z^zVEj5>z3j6Rl6D< zS#YIjqO5YH!Vj01wj3MrFsqPy24e^QQvQLgJld0<-%Yz_;w^Tn&-p_3VWoDm=*xpr zi?gLZsb#FMi?J?cV>gjLw&WN*l2VsQsEw#Uv+pZJekH{Et!KU2%VsuLl*Ta#>DR4n z+CWkJmz~oOI^P?Y`sYO68EVWX<$szpDh#WLbt~xOD_zXEHxf_HV9T9SD61`eKjlWR zn9A=|!#q++->{C8_kIhwLiI8zAt!dhV2~vs#gU{VlwHlnJmp5{#XlLzfmq?|ki*x( zSiY}pn6;fKjd+i>&b+eR?HPmlRI*n*B`C2M`Y~_ij@Wy$-_lxE-{ol)pZ4}AUX~3Z zlhqv@+94qUVMk|w;al02tH(oyW60Tc_6wLDG<`SO4N-M-D@Fe=C>@PKV2QZGMW8KN zp?AQ`vQbi~tHtnPprpstF0yL3L2)Y!TwAkLfM{zA4D%8}|LfJ` z?bgay_>()$)77K44e$;RIy)k4oYHSC0p`+gCBgEHki`cOOqlp_okpLxk1|{+OMh2DPq_ync+6e>BBf!Qgv}Kq zL(xu*e8f{W>h@unnipaHk4*8~=FLHN$@;&4_lh;pO!Ow}8J^E1T1S~?UtaK7#+Utz zvdNTCzm-f?Cixy^F7kTy*L@_fhfJ|$P-sGGrp_hWx&EGq1%A|I!AH84F3|xasM&dN zg2^4eX4wvK-pM#a(B&R4?G~*@hN~{78|qVE9Q+mMSW&B&aq)Wqw7S~FzQdvI+(7Au zjYcT-4wckZ>t0iv}%?cW7G zEzz@xmk2)zl#~MaFclgtrc}_>TN*qFIgOBnuHP9GKhlq_L&$luL!2RgYn+i$YDBC z_pQ?rn5@*uI5^(~z+E_aF^NE?DQaF`;!;N65vn-18t_aQas|`c_wTVNI!|!TN%IwN zffT>z9vz+2=0B2;v|r-|=G`*@MGn=1_mrX0fI9oFCE(2Hvi%tlAddPtqB<+@%M=5H z7_K?%9aR-dk&sPHTysi`yO#sq*o|E`M2*Sxw8l~4p4{;SO=yRDZTJo;(V;N%*>}@8 zjnA~Q4JXrhu!gq{gc^4Trh6bc=aG6X*^(SMkoD*ANKpy*SF_(~_O8j}1QtI&!_25D zf6+MewZ1GNvzxrTP^g%Gk#0DCb~iZqB0oc1WXM15xslg6oG+g_6?!p7V?xY0Q4= ztj-iSa_jEx`Wim6ISSp(%e2J5XM@jI^QSzUO4n_D&xV<``R^Y8$q2k#P@aSk!m2!G!ghJQqeqZ%pf+xoiXR;|Tp!3ZP>mHhTII#Nc{&d~Kb&1&N&9A|8 zpsDEjt%3-3$!Z&5;P1iWJ+i|=ET)72w6Cpg;tOrukC%X6mE$Zoz_2OPs-065c-}cO z9mxDs!&D)%iHWgkB1@$L_Dnz?9aGp!3Cy6BiHf73HWp$o_NsmFA0ceSh{hav^>~FY zg#Wcp&OAU-xDW^!&jX%N?=b=BzYbr1e2N9_O|zK`a)s`95ctNL&PTaGC+o*R%)%0N0vdMJy39)9XNG z^jRX{b_kRu0uF@=U6}VPw`PHjIf?Mu6Vnz*i=sj<^EfGK|oGAJNiT@$a z>i?89o&)#9uNtjlG3}8<2Fc;}1%|Q&@6av?z|~OBcx<63nTG#n*Vg_*ZDCU{a7_|q zxr%uF8&Fie_xuc)(hBKAcu9gXH?Dl(BDP#X3miq_C0Xd*MJ9 z?kFpgtp?%Hb(g6hUbVD)!+LNp_g#RV?gRCYEXitC!L0GZUe%|Nw;g1K!J@wRi}hhm z$e%hw%xm&Q^Gv5HgQa zlbrO|myRG62N|nY`X&k_SZ)a{f{J$|;SaayH~MVMNp8lD@pSB=5I$dD;Ph*csxMP} z_tH3TsfV&2Iq{Zh1Oz3SW?UcAy6DWptdW3GRmZLDp;fQ}W_^|C@EOU^z*&sY!X^PO zenKiyeXVmBDW)qf)HcQD*$8>=_pDp7PEYi|EQV|fS=EE5NhL>q5DH?tieiv|L`K$( z-qSO?LoOS$<(sS@W}b*(ib>K~9ra;VSoXnVFZ-ZS3OqPp z?gF!0BygT}`!c@DP_rpcid=UiQS?!2Lr@*u^| zfL^(2sqsxV5m}vv;yvPC4rnPvZLHB`r+%~?iZHhJM7@J)P0F=MM}F7xucx5zj7ZHW zVA|Xzq1OH0RzaJ`0NIA1glk=l!;!k zoMa6Cs9;+@0`~O;iM+%{o5z&WrEdqfizbU+kTD&65EE05D#vJeMJrY4NCx~%8OTZ+wf;Hsj8eP|Eb?lsa$japw>d7?<+etGLnEdA`6JA zE`DPX*y}`+c5Ss-IXfyAA*s~Z7{>cmjQuYBW3SfBwAU6(x7pvu=~<=Qy_SxeBbJq( zH60KaHK(lk1HE9rh(T>i)f_;O<3Hc2*A|kn8?Ahet1*otxS#l=geDW>* zQ=ed?qO|4|#o6cW&K}H7lzJttDOf)TLP!e=A*=r-u`OhKX##qQWema%ZB$=wjKCh$ ztcE)FSeMXy4z$kGNgS&^j%y$b3aIV0$ZH_r= 1.27.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-cis-benchmark + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: rancher-cis-benchmark +apiVersion: v1 +appVersion: v6.1.0 +description: The cis-operator enables running CIS benchmark security scans on a kubernetes + cluster +icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg +keywords: +- security +name: rancher-cis-benchmark +version: 6.1.0 diff --git a/charts/rancher-cis-benchmark/6.1.0/README.md b/charts/rancher-cis-benchmark/6.1.0/README.md new file mode 100644 index 0000000000..50beab58ba --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/README.md @@ -0,0 +1,9 @@ +# Rancher CIS Benchmark Chart + +The cis-operator enables running CIS benchmark security scans on a kubernetes cluster and generate compliance reports that can be downloaded. + +# Installation + +``` +helm install rancher-cis-benchmark ./ --create-namespace -n cis-operator-system +``` diff --git a/charts/rancher-cis-benchmark/6.1.0/app-readme.md b/charts/rancher-cis-benchmark/6.1.0/app-readme.md new file mode 100644 index 0000000000..d4834a4824 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/app-readme.md @@ -0,0 +1,37 @@ +# Rancher CIS Benchmarks + +This chart enables security scanning of the cluster using [CIS (Center for Internet Security) benchmarks](https://www.cisecurity.org/benchmark/kubernetes/). + +For more information on how to use the feature, refer to our [docs](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/cis-scan-guides). + +This chart installs the following components: + +- [cis-operator](https://github.com/rancher/cis-operator) - The cis-operator handles launching the [kube-bench](https://github.com/aquasecurity/kube-bench) tool that runs a suite of CIS tests on the nodes of your Kubernetes cluster. After scans finish, the cis-operator generates a compliance report that can be downloaded. +- Scans - A scan is a CRD (`ClusterScan`) that defines when to trigger CIS scans on the cluster based on the defined profile. A report is created after the scan is completed. +- Profiles - A profile is a CRD (`ClusterScanProfile`) that defines the configuration for the CIS scan, which is the benchmark versions to use and any specific tests to skip in that benchmark. This chart installs a few default `ClusterScanProfile` custom resources with no skipped tests, which can immediately be used to launch CIS scans. +- Benchmark Versions - A benchmark version is a CRD (`ClusterScanBenchmark`) that defines the CIS benchmark version to run using kube-bench as well as the valid configuration parameters for that benchmark. This chart installs a few default `ClusterScanBenchmark` custom resources. +- Alerting Resources - Rancher's CIS Benchmark application lets you run a cluster scan on a schedule, and send alerts when scans finish. + - If you want to enable alerts to be delivered when a cluster scan completes, you need to ensure that [Rancher's Monitoring and Alerting](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/) application is pre-installed and the [Receivers and Routes](https://rancher.com/docs/rancher/v2.x/en/monitoring-alerting/v2.5/configuration/#alertmanager-config) are configured to send out alerts. + - Additionally, you need to set `alerts: true` in the Values YAML while installing or upgrading this chart. + +## CIS Kubernetes Benchmark support + +| Source | Kubernetes distribution | scan profile | Kubernetes versions | +|--------|-------------------------|--------------------------------------------------------------------------------------------------------------------|---------------------| +| CIS | any | [cis-1.7](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.7) | v1.25 | +| CIS | any | [cis-1.8](https://github.com/rancher/security-scan/tree/master/package/cfg/cis-1.8) | v1.26+ | +| CIS | rke | [rke-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-permissive) | rke1-v1.25 | +| CIS | rke | [rke-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.7-hardened) | rke1-v1.25 | +| CIS | rke | [rke-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-permissive) | rke1-v1.26+ | +| CIS | rke | [rke-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke-cis-1.8-hardened) | rke1-v1.26+ | +| CIS | rke2 | [rke2-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.7-permissive)| rke2-v1.25 | +| CIS | rke2 | [rke2-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.7-hardened) | rke2-v1.25 | +| CIS | rke2 | [rke2-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-permissive)| rke2-v1.26+ | +| CIS | rke2 | [rke2-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/rke2-cis-1.8-hardened) | rke2-v1.26+ | +| CIS | k3s | [k3s-cis-1.7-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.7-permissive) | k3s-v1.25 | +| CIS | k3s | [k3s-cis-1.7-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.7-hardened) | k3s-v1.25 | +| CIS | k3s | [k3s-cis-1.8-permissive](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-permissive) | k3s-v1.26+ | +| CIS | k3s | [k3s-cis-1.8-hardened](https://github.com/rancher/security-scan/tree/master/package/cfg/k3s-cis-1.8-hardened) | k3s-v1.26+ | +| CIS | eks | eks-1.2.0 | eks | +| CIS | aks | aks-1.0 | aks | +| CIS | gke | gke-1.2.0 | gke | \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/_helpers.tpl b/charts/rancher-cis-benchmark/6.1.0/templates/_helpers.tpl new file mode 100644 index 0000000000..b7bb000422 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/_helpers.tpl @@ -0,0 +1,27 @@ +{{/* Ensure namespace is set the same everywhere */}} +{{- define "cis.namespace" -}} + {{- .Release.Namespace | default "cis-operator-system" -}} +{{- end -}} + +{{- define "system_default_registry" -}} +{{- if .Values.global.cattle.systemDefaultRegistry -}} +{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}} +{{- else -}} +{{- "" -}} +{{- end -}} +{{- end -}} + +{{/* +Windows cluster will add default taint for linux nodes, +add below linux tolerations to workloads could be scheduled to those linux nodes +*/}} +{{- define "linux-node-tolerations" -}} +- key: "cattle.io/os" + value: "linux" + effect: "NoSchedule" + operator: "Equal" +{{- end -}} + +{{- define "linux-node-selector" -}} +kubernetes.io/os: linux +{{- end -}} diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/alertingrule.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/alertingrule.yaml new file mode 100644 index 0000000000..1787c88a07 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/alertingrule.yaml @@ -0,0 +1,14 @@ +{{- if .Values.alerts.enabled -}} +--- +apiVersion: monitoring.coreos.com/v1 +kind: PodMonitor +metadata: + name: rancher-cis-pod-monitor + namespace: {{ template "cis.namespace" . }} +spec: + selector: + matchLabels: + cis.cattle.io/operator: cis-operator + podMetricsEndpoints: + - port: cismetrics +{{- end }} diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-aks-1.0.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-aks-1.0.yaml new file mode 100644 index 0000000000..1ac866253f --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-aks-1.0.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: aks-1.0 +spec: + clusterProvider: aks + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-cis-1.7.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-cis-1.7.yaml new file mode 100644 index 0000000000..fa8dfd8eb9 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-cis-1.7.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.7 +spec: + clusterProvider: "" + minKubernetesVersion: "1.25.0" + maxKubernetesVersion: "1.25.x" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-cis-1.8.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-cis-1.8.yaml new file mode 100644 index 0000000000..ae19007b2e --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-cis-1.8.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: cis-1.8 +spec: + clusterProvider: "" + minKubernetesVersion: "1.26.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-eks-1.2.0.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-eks-1.2.0.yaml new file mode 100644 index 0000000000..c1bdd9ed5e --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-eks-1.2.0.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: eks-1.2.0 +spec: + clusterProvider: eks + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-gke-1.2.0.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-gke-1.2.0.yaml new file mode 100644 index 0000000000..c609e736fd --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-gke-1.2.0.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: gke-1.2.0 +spec: + clusterProvider: gke + minKubernetesVersion: "1.15.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.7-hardened.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.7-hardened.yaml new file mode 100644 index 0000000000..6fb369360c --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.7-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.7-hardened +spec: + clusterProvider: k3s + minKubernetesVersion: "1.25.0" + maxKubernetesVersion: "1.25.x" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.7-permissive.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.7-permissive.yaml new file mode 100644 index 0000000000..b556d70fe5 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.7-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.7-permissive +spec: + clusterProvider: k3s + minKubernetesVersion: "1.25.0" + maxKubernetesVersion: "1.25.x" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.8-hardened.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.8-hardened.yaml new file mode 100644 index 0000000000..07b4300d20 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.8-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.8-hardened +spec: + clusterProvider: k3s + minKubernetesVersion: "1.26.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.8-permissive.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.8-permissive.yaml new file mode 100644 index 0000000000..c30fa7f725 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-k3s-cis-1.8-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: k3s-cis-1.8-permissive +spec: + clusterProvider: k3s + minKubernetesVersion: "1.26.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.7-hardened.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.7-hardened.yaml new file mode 100644 index 0000000000..39bac7833c --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.7-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.7-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.25.0" + maxKubernetesVersion: "1.25.x" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.7-permissive.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.7-permissive.yaml new file mode 100644 index 0000000000..2e2f09ac74 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.7-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.7-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.25.0" + maxKubernetesVersion: "1.25.x" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.8-hardened.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.8-hardened.yaml new file mode 100644 index 0000000000..d3d357c023 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.8-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.8-hardened +spec: + clusterProvider: rke + minKubernetesVersion: "1.26.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.8-permissive.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.8-permissive.yaml new file mode 100644 index 0000000000..208eb777cd --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke-cis-1.8-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke-cis-1.8-permissive +spec: + clusterProvider: rke + minKubernetesVersion: "1.26.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.7-hardened.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.7-hardened.yaml new file mode 100644 index 0000000000..6306e9601a --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.7-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.7-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.25.0" + maxKubernetesVersion: "1.25.x" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.7-permissive.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.7-permissive.yaml new file mode 100644 index 0000000000..76236e11af --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.7-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.7-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.25.0" + maxKubernetesVersion: "1.25.x" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.8-hardened.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.8-hardened.yaml new file mode 100644 index 0000000000..0237206a73 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.8-hardened.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.8-hardened +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.26.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.8-permissive.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.8-permissive.yaml new file mode 100644 index 0000000000..b5f9e4b50f --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/benchmark-rke2-cis-1.8-permissive.yaml @@ -0,0 +1,8 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanBenchmark +metadata: + name: rke2-cis-1.8-permissive +spec: + clusterProvider: rke2 + minKubernetesVersion: "1.26.0" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/cis-roles.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/cis-roles.yaml new file mode 100644 index 0000000000..23c93dc659 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/cis-roles.yaml @@ -0,0 +1,49 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cis-admin +rules: + - apiGroups: + - cis.cattle.io + resources: + - clusterscanbenchmarks + - clusterscanprofiles + - clusterscans + - clusterscanreports + verbs: ["create", "update", "delete", "patch","get", "watch", "list"] + - apiGroups: + - catalog.cattle.io + resources: ["apps"] + resourceNames: ["rancher-cis-benchmark"] + verbs: ["get", "watch", "list"] + - apiGroups: + - "" + resources: + - configmaps + verbs: + - '*' +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: cis-view +rules: + - apiGroups: + - cis.cattle.io + resources: + - clusterscanbenchmarks + - clusterscanprofiles + - clusterscans + - clusterscanreports + verbs: ["get", "watch", "list"] + - apiGroups: + - catalog.cattle.io + resources: ["apps"] + resourceNames: ["rancher-cis-benchmark"] + verbs: ["get", "watch", "list"] + - apiGroups: + - "" + resources: + - configmaps + verbs: ["get", "watch", "list"] diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/configmap.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/configmap.yaml new file mode 100644 index 0000000000..094c9dfe0a --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/configmap.yaml @@ -0,0 +1,18 @@ +kind: ConfigMap +apiVersion: v1 +metadata: + name: default-clusterscanprofiles + namespace: {{ template "cis.namespace" . }} +data: + # Default ClusterScanProfiles per cluster provider type + rke: |- + <1.21.0: rke-profile-permissive-1.20 + >=1.21.0: rke-profile-permissive-1.8 + rke2: |- + <1.21.0: rke2-cis-1.20-profile-permissive + >=1.21.0: rke2-cis-1.8-profile-permissive + eks: "eks-profile" + gke: "gke-profile" + aks: "aks-profile" + k3s: "k3s-cis-1.8-profile-permissive" + default: "cis-1.8-profile" diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/deployment.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/deployment.yaml new file mode 100644 index 0000000000..8c9f72f5de --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/deployment.yaml @@ -0,0 +1,61 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cis-operator + namespace: {{ template "cis.namespace" . }} + labels: + cis.cattle.io/operator: cis-operator +spec: + selector: + matchLabels: + cis.cattle.io/operator: cis-operator + template: + metadata: + labels: + cis.cattle.io/operator: cis-operator + spec: + serviceAccountName: cis-operator-serviceaccount + containers: + - name: cis-operator + image: '{{ template "system_default_registry" . }}{{ .Values.image.cisoperator.repository }}:{{ .Values.image.cisoperator.tag }}' + imagePullPolicy: IfNotPresent + ports: + - name: cismetrics + containerPort: {{ .Values.alerts.metricsPort }} + env: + - name: SECURITY_SCAN_IMAGE + value: {{ template "system_default_registry" . }}{{ .Values.image.securityScan.repository }} + - name: SECURITY_SCAN_IMAGE_TAG + value: {{ .Values.image.securityScan.tag }} + - name: SONOBUOY_IMAGE + value: {{ template "system_default_registry" . }}{{ .Values.image.sonobuoy.repository }} + - name: SONOBUOY_IMAGE_TAG + value: {{ .Values.image.sonobuoy.tag }} + - name: CIS_ALERTS_METRICS_PORT + value: '{{ .Values.alerts.metricsPort }}' + - name: CIS_ALERTS_SEVERITY + value: {{ .Values.alerts.severity }} + - name: CIS_ALERTS_ENABLED + value: {{ .Values.alerts.enabled | default "false" | quote }} + - name: CLUSTER_NAME + value: '{{ .Values.global.cattle.clusterName }}' + - name: CIS_OPERATOR_DEBUG + value: '{{ .Values.image.cisoperator.debug }}' + {{- if .Values.securityScanJob.overrideTolerations }} + - name: SECURITY_SCAN_JOB_TOLERATIONS + value: '{{ .Values.securityScanJob.tolerations | toJson }}' + {{- end }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/network_policy_allow_all.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/network_policy_allow_all.yaml new file mode 100644 index 0000000000..6ed5d645ea --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/network_policy_allow_all.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: default-allow-all + namespace: {{ template "cis.namespace" . }} +spec: + podSelector: {} + ingress: + - {} + egress: + - {} + policyTypes: + - Ingress + - Egress diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/patch_default_serviceaccount.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/patch_default_serviceaccount.yaml new file mode 100644 index 0000000000..e78a6bd08a --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/patch_default_serviceaccount.yaml @@ -0,0 +1,29 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: patch-sa + annotations: + "helm.sh/hook": post-install, post-upgrade + "helm.sh/hook-delete-policy": hook-succeeded, before-hook-creation +spec: + template: + spec: + serviceAccountName: cis-operator-serviceaccount + nodeSelector: {{ include "linux-node-selector" . | nindent 8 }} +{{- if .Values.nodeSelector }} +{{ toYaml .Values.nodeSelector | indent 8 }} +{{- end }} + tolerations: {{ include "linux-node-tolerations" . | nindent 8 }} +{{- if .Values.tolerations }} +{{ toYaml .Values.tolerations | indent 8 }} +{{- end }} + restartPolicy: Never + containers: + - name: sa + image: "{{ template "system_default_registry" . }}{{ .Values.global.kubectl.repository }}:{{ .Values.global.kubectl.tag }}" + imagePullPolicy: {{ .Values.global.imagePullPolicy }} + command: ["kubectl", "patch", "serviceaccount", "default", "-p", "{\"automountServiceAccountToken\": false}"] + args: ["-n", {{ template "cis.namespace" . }}] + + backoffLimit: 1 diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/rbac.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/rbac.yaml new file mode 100644 index 0000000000..5fe075e34f --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/rbac.yaml @@ -0,0 +1,209 @@ +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-operator-clusterrole +rules: +- apiGroups: + - "cis.cattle.io" + resources: + - "*" + verbs: + - "*" +- apiGroups: + - "" + resources: + - "pods" + - "services" + - "configmaps" + - "nodes" + - "serviceaccounts" + verbs: + - "get" + - "list" + - "create" + - "update" + - "watch" + - "patch" +- apiGroups: + - "rbac.authorization.k8s.io" + resources: + - "rolebindings" + - "clusterrolebindings" + - "clusterroles" + verbs: + - "get" + - "list" +- apiGroups: + - "batch" + resources: + - "jobs" + verbs: + - "list" + - "create" + - "patch" + - "update" + - "watch" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-scan-ns +rules: +- apiGroups: + - "" + resources: + - "namespaces" + - "nodes" + - "pods" + - "serviceaccounts" + - "services" + - "replicationcontrollers" + verbs: + - "get" + - "list" + - "watch" +- apiGroups: + - "rbac.authorization.k8s.io" + resources: + - "rolebindings" + - "clusterrolebindings" + - "clusterroles" + verbs: + - "get" + - "list" +- apiGroups: + - "batch" + resources: + - "jobs" + - "cronjobs" + verbs: + - "list" +- apiGroups: + - "apps" + resources: + - "daemonsets" + - "deployments" + - "replicasets" + - "statefulsets" + verbs: + - "list" +- apiGroups: + - "autoscaling" + resources: + - "horizontalpodautoscalers" + verbs: + - "list" +- apiGroups: + - "networking.k8s.io" + resources: + - "networkpolicies" + verbs: + - "get" + - "list" + - "watch" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: cis-operator-role + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + namespace: {{ template "cis.namespace" . }} +rules: +- apiGroups: + - "" + resources: + - "services" + verbs: + - "watch" + - "list" + - "get" + - "patch" +- apiGroups: + - "batch" + resources: + - "jobs" + verbs: + - "watch" + - "list" + - "get" + - "delete" +- apiGroups: + - "" + resources: + - "configmaps" + - "pods" + - "secrets" + verbs: + - "*" +- apiGroups: + - "apps" + resources: + - "daemonsets" + verbs: + - "*" +- apiGroups: + - monitoring.coreos.com + resources: + - prometheusrules + verbs: + - create +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-operator-clusterrolebinding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cis-operator-clusterrole +subjects: +- kind: ServiceAccount + name: cis-operator-serviceaccount + namespace: {{ template "cis.namespace" . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: cis-scan-ns + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cis-scan-ns +subjects: +- kind: ServiceAccount + name: cis-serviceaccount + namespace: {{ template "cis.namespace" . }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-operator-rolebinding + namespace: {{ template "cis.namespace" . }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: cis-operator-role +subjects: +- kind: ServiceAccount + name: cis-serviceaccount + namespace: {{ template "cis.namespace" . }} +- kind: ServiceAccount + name: cis-operator-serviceaccount + namespace: {{ template "cis.namespace" . }} diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-cis-1.7.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-cis-1.7.yaml new file mode 100644 index 0000000000..1a37aad835 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-cis-1.7.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.7-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.7 diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-cis-1.8.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-cis-1.8.yaml new file mode 100644 index 0000000000..40be06c946 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-cis-1.8.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: cis-1.8-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: cis-1.8 diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.7-hardened.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.7-hardened.yml new file mode 100644 index 0000000000..22ae9e0d23 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.7-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.7-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.7-hardened diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.7-permissive.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.7-permissive.yml new file mode 100644 index 0000000000..f79e9ed966 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.7-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.7-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.7-permissive diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.8-hardened.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.8-hardened.yml new file mode 100644 index 0000000000..03f6695689 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.8-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.8-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.8-hardened diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.8-permissive.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.8-permissive.yml new file mode 100644 index 0000000000..39932a4e5b --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-k3s-cis-1.8-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: k3s-cis-1.8-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: k3s-cis-1.8-permissive diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.7-hardened.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.7-hardened.yaml new file mode 100644 index 0000000000..7b83f95bcd --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.7-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.7 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.7-hardened diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.7-permissive.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.7-permissive.yaml new file mode 100644 index 0000000000..52327c4af1 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.7-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.7 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.7-permissive diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.8-hardened.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.8-hardened.yaml new file mode 100644 index 0000000000..54aa08691e --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.8-hardened.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-hardened-1.8 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.8-hardened diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.8-permissive.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.8-permissive.yaml new file mode 100644 index 0000000000..f7d4fdd229 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke-1.8-permissive.yaml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke-profile-permissive-1.8 + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke-cis-1.8-permissive diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.7-hardened.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.7-hardened.yml new file mode 100644 index 0000000000..193753a0bc --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.7-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.7-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.7-hardened diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.7-permissive.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.7-permissive.yml new file mode 100644 index 0000000000..409645dc76 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.7-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.7-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.7-permissive diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.8-hardened.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.8-hardened.yml new file mode 100644 index 0000000000..d0a1180f56 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.8-hardened.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.8-profile-hardened + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.8-hardened diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.8-permissive.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.8-permissive.yml new file mode 100644 index 0000000000..0aa72407c0 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofile-rke2-cis-1.8-permissive.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: rke2-cis-1.8-profile-permissive + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: rke2-cis-1.8-permissive diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofileaks.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofileaks.yml new file mode 100644 index 0000000000..ac9f47a8fb --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofileaks.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: aks-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: aks-1.0 diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofileeks.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofileeks.yml new file mode 100644 index 0000000000..7cf7936cbf --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofileeks.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: eks-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: eks-1.2.0 diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/scanprofilegke.yml b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofilegke.yml new file mode 100644 index 0000000000..42fa4f23a2 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/scanprofilegke.yml @@ -0,0 +1,9 @@ +--- +apiVersion: cis.cattle.io/v1 +kind: ClusterScanProfile +metadata: + name: gke-profile + annotations: + clusterscanprofile.cis.cattle.io/builtin: "true" +spec: + benchmarkVersion: gke-1.2.0 diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/serviceaccount.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/serviceaccount.yaml new file mode 100644 index 0000000000..ec48ec6224 --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/serviceaccount.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: {{ template "cis.namespace" . }} + name: cis-operator-serviceaccount +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + namespace: {{ template "cis.namespace" . }} + labels: + app.kubernetes.io/name: rancher-cis-benchmark + app.kubernetes.io/instance: release-name + name: cis-serviceaccount diff --git a/charts/rancher-cis-benchmark/6.1.0/templates/validate-install-crd.yaml b/charts/rancher-cis-benchmark/6.1.0/templates/validate-install-crd.yaml new file mode 100644 index 0000000000..562295791b --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/templates/validate-install-crd.yaml @@ -0,0 +1,17 @@ +#{{- if gt (len (lookup "rbac.authorization.k8s.io/v1" "ClusterRole" "" "")) 0 -}} +# {{- $found := dict -}} +# {{- set $found "cis.cattle.io/v1/ClusterScan" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanBenchmark" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanProfile" false -}} +# {{- set $found "cis.cattle.io/v1/ClusterScanReport" false -}} +# {{- range .Capabilities.APIVersions -}} +# {{- if hasKey $found (toString .) -}} +# {{- set $found (toString .) true -}} +# {{- end -}} +# {{- end -}} +# {{- range $_, $exists := $found -}} +# {{- if (eq $exists false) -}} +# {{- required "Required CRDs are missing. Please install the corresponding CRD chart before installing this chart." "" -}} +# {{- end -}} +# {{- end -}} +#{{- end -}} \ No newline at end of file diff --git a/charts/rancher-cis-benchmark/6.1.0/values.yaml b/charts/rancher-cis-benchmark/6.1.0/values.yaml new file mode 100644 index 0000000000..bce51b913b --- /dev/null +++ b/charts/rancher-cis-benchmark/6.1.0/values.yaml @@ -0,0 +1,53 @@ +# Default values for rancher-cis-benchmark. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. + +image: + cisoperator: + repository: rancher/cis-operator + tag: v1.0.14 + securityScan: + repository: rancher/security-scan + tag: v0.2.16 + sonobuoy: + repository: rancher/mirrored-sonobuoy-sonobuoy + tag: v0.57.1 + +resources: {} + # We usually recommend not to specify default resources and to leave this as a conscious + # choice for the user. This also increases chances charts run on environments with little + # resources, such as Minikube. If you do want to specify resources, uncomment the following + # lines, adjust them as necessary, and remove the curly braces after 'resources:'. + # limits: + # cpu: 100m + # memory: 128Mi + # requests: + # cpu: 100m + # memory: 128Mi + +## Node labels for pod assignment +## Ref: https://kubernetes.io/docs/user-guide/node-selection/ +## +nodeSelector: {} + +## List of node taints to tolerate (requires Kubernetes >= 1.6) +tolerations: [] + +securityScanJob: + overrideTolerations: false + tolerations: [] + +affinity: {} + +global: + cattle: + systemDefaultRegistry: "" + clusterName: "" + kubectl: + repository: rancher/kubectl + tag: v1.29.7 + +alerts: + enabled: false + severity: warning + metricsPort: 8080 diff --git a/index.yaml b/index.yaml index 33d3e6c5b7..2a5f18d239 100755 --- a/index.yaml +++ b/index.yaml @@ -7361,6 +7361,32 @@ entries: - assets/rancher-backup-crd/rancher-backup-crd-1.0.200.tgz version: 1.0.200 rancher-cis-benchmark: + - annotations: + catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match + catalog.cattle.io/certified: rancher + catalog.cattle.io/display-name: CIS Benchmark + catalog.cattle.io/kube-version: '>= 1.27.0-0 < 1.31.0-0' + catalog.cattle.io/namespace: cis-operator-system + catalog.cattle.io/os: linux + catalog.cattle.io/permits-os: linux,windows + catalog.cattle.io/provides-gvr: cis.cattle.io.clusterscans/v1 + catalog.cattle.io/rancher-version: '>= 2.9.0-0 < 2.10.0-0' + catalog.cattle.io/release-name: rancher-cis-benchmark + catalog.cattle.io/type: cluster-tool + catalog.cattle.io/ui-component: rancher-cis-benchmark + apiVersion: v1 + appVersion: v6.1.0 + created: "2024-08-17T19:09:15.773127469-03:00" + description: The cis-operator enables running CIS benchmark security scans on + a kubernetes cluster + digest: 88cbf1231d5e62e5d08363ff70694c1ddd6422eedabd7774b4b4a8bc4b352e18 + icon: https://charts.rancher.io/assets/logos/cis-kube-bench.svg + keywords: + - security + name: rancher-cis-benchmark + urls: + - assets/rancher-cis-benchmark/rancher-cis-benchmark-6.1.0.tgz + version: 6.1.0 - annotations: catalog.cattle.io/auto-install: rancher-cis-benchmark-crd=match catalog.cattle.io/certified: rancher diff --git a/release.yaml b/release.yaml index 415d0f55cd..56e759173d 100644 --- a/release.yaml +++ b/release.yaml @@ -18,3 +18,5 @@ rancher-gke-operator-crd: - 104.1.0+up1.9.1 rancher-webhook: - 104.0.1+up0.5.1 +rancher-cis-benchmark: + - 6.1.0 From a50c2c5572b970719950fa1b25c48abddd3b3bd2 Mon Sep 17 00:00:00 2001 From: nicholasSSUSE Date: Sat, 17 Aug 2024 19:09:51 -0300 Subject: [PATCH 13/14] release by forward-port rancher-cis-benchmark-crd 6.1.0 --- .../rancher-cis-benchmark-crd-6.1.0.tgz | Bin 0 -> 1476 bytes .../6.1.0/Chart.yaml | 10 ++ .../rancher-cis-benchmark-crd/6.1.0/README.md | 2 + .../6.1.0/templates/clusterscan.yaml | 149 ++++++++++++++++++ .../6.1.0/templates/clusterscanbenchmark.yaml | 55 +++++++ .../6.1.0/templates/clusterscanprofile.yaml | 37 +++++ .../6.1.0/templates/clusterscanreport.yaml | 40 +++++ index.yaml | 14 ++ release.yaml | 2 + 9 files changed, 309 insertions(+) create mode 100644 assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-6.1.0.tgz create mode 100644 charts/rancher-cis-benchmark-crd/6.1.0/Chart.yaml create mode 100644 charts/rancher-cis-benchmark-crd/6.1.0/README.md create mode 100644 charts/rancher-cis-benchmark-crd/6.1.0/templates/clusterscan.yaml create mode 100644 charts/rancher-cis-benchmark-crd/6.1.0/templates/clusterscanbenchmark.yaml create mode 100644 charts/rancher-cis-benchmark-crd/6.1.0/templates/clusterscanprofile.yaml create mode 100644 charts/rancher-cis-benchmark-crd/6.1.0/templates/clusterscanreport.yaml diff --git a/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-6.1.0.tgz b/assets/rancher-cis-benchmark-crd/rancher-cis-benchmark-crd-6.1.0.tgz new file mode 100644 index 0000000000000000000000000000000000000000..3b53e1401211f2dabe18efa89d34ae21027cf8b3 GIT binary patch literal 1476 zcmV;#1v~m5iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PI@PbK1BQ&NF|7roU%gn*jL@Zz=8F^zNEwNUrz1$Qw{&OBzYe zmASe9{YJI{8)U#>XfyS`Flgm(W&7Jt>$MedI!D!|On0Zq={yGY+@&gfJD!6w-U8z2 z>O}K>-yin->96nmo4@{`=U)Z=;oxR49NhGWSAH-Ig6k{dpBnfOOSA!X<)0jD^Wd*9ExR-OL_V;O-#{gy_FHmEcO zev}^U&i}yg^{>nM-wXPF(B}Uote80<8GbX!?LX~3|6kh_d4iMgt)ju=vw-McF>X+eMU=!mUqhFC)q>xH znU9F44VXlG5oj|>xLwh`5>G6`JBTrzzC8cJqVp-aJChG>6yvkX06K|dPz%op15pY0 zu`p5#N`lrUr2F+iEubf0H9;gMRpP4KHJ*)?60sRe%mw^6S57YwU!rW%MK8?z^ z^G+DD+F9!tXf)YYGi=t4?E)aN~}WL0IXUrSi6E_9EX#sLbS) zh3>u<*1*R2%*P^@5t@of>jh7Rh!FU0Fe@&JIteSAA*NrEnhF9rotg@TR!SImFb8=O zZ;y6KL1&A@1=U>JvE;5;bf!3mrrsTXGd4AD9jrP&>mHU|V|-@m)^t`=!L!}k!9r#* zc9L@+b*)A}D&RUrwrX6(w*&HIZ%SwJ{*)mYJb$bhwT9W5gD31#fC3rT1K#Fcy~jkgxa;?RBP@|&Yiv|S|*$g+^lrKDf?va>F>D5?&pRk z<#DsxY!X{cHL4d3e?^We?R;#b?5n#-zDta{l67q8f*l{{@3#f202E-Q4(X{dWmFcm0=4L28Q4r8oL6?wQF))TU0;es3#pXCv>(X6nzl)z;L1g;Lc1DsZ3v-vq-={U7#w zt^Qxa&aM9$VH%YGNeWn{{&~1+@mI^k8`l0aed*C|DHng!kul`AhtGFE!$VxP{!c#K zzW?;Wi^G#OX5aVULBF^0{r8~XAGG>^3H#rUkDYJHB=ZqE2W5zvgCT6|bLvE6NT!Rb ePpZH78MfA1Ypu2Bvi|}A0RR6SZ Date: Mon, 19 Aug 2024 14:28:07 +0000 Subject: [PATCH 14/14] Updating resync.yaml --- regsync.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/regsync.yaml b/regsync.yaml index c6129be948..83028de9e7 100644 --- a/regsync.yaml +++ b/regsync.yaml @@ -35,6 +35,7 @@ sync: - v1.2.2 - v1.2.3 - v1.9.0 + - v1.9.1 - source: docker.io/rancher/backup-restore-operator target: '{{ env "REGISTRY_ENDPOINT" }}/rancher/backup-restore-operator' type: repository @@ -72,6 +73,7 @@ sync: - v1.0.11 - v1.0.12 - v1.0.13 + - v1.0.14 - v1.0.5 - v1.0.6 - v1.0.7 @@ -92,12 +94,14 @@ sync: - v1.3.2 - v1.3.3 - v1.9.0 + - v1.9.1 - source: docker.io/rancher/fleet target: '{{ env "REGISTRY_ENDPOINT" }}/rancher/fleet' type: repository tags: allow: - v0.10.0 + - v0.10.1 - v0.5.0 - v0.5.1 - v0.6.0 @@ -120,6 +124,7 @@ sync: tags: allow: - v0.10.0 + - v0.10.1 - v0.5.0 - v0.5.1 - v0.6.0 @@ -177,6 +182,7 @@ sync: - v1.2.2 - v1.2.3 - v1.9.0 + - v1.9.1 - source: docker.io/rancher/hardened-ib-sriov-cni target: '{{ env "REGISTRY_ENDPOINT" }}/rancher/hardened-ib-sriov-cni' type: repository @@ -309,6 +315,7 @@ sync: - v1.29.0 - v1.29.2 - v1.29.4 + - v1.29.7 - source: docker.io/rancher/mirrored-amazon-aws-cli target: '{{ env "REGISTRY_ENDPOINT" }}/rancher/mirrored-amazon-aws-cli' type: repository @@ -1213,6 +1220,7 @@ sync: - v0.4.8 - v0.4.9 - v0.5.0 + - v0.5.1 - source: docker.io/rancher/security-scan target: '{{ env "REGISTRY_ENDPOINT" }}/rancher/security-scan' type: repository