actualized for kubespray version 2.28.0

.ansible-lint

@@ -0,0 +1,45 @@
+---
+parseable: true
+skip_list:
+  # see https://docs.ansible.com/ansible-lint/rules/default_rules.html for a list of all default rules
+
+  # DO NOT add any other rules to this skip_list, instead use local `# noqa` with a comment explaining WHY it is necessary
+
+  # These rules are intentionally skipped:
+  #
+  # [role-name] "meta/main.yml" Role name role-name does not match ``^+$`` pattern
+  # Meta roles in Kubespray don't need proper names
+  # (Disabled in June 2021)
+  - 'role-name'
+
+  # [var-naming] "defaults/main.yml" File defines variable 'apiVersion' that violates variable naming standards
+  # In Kubespray we use variables that use camelCase to match their k8s counterparts
+  # (Disabled in June 2021)
+  - 'var-naming'
+
+  # [fqcn-builtins]
+  # Roles in kubespray don't need fully qualified collection names
+  # (Disabled in Feb 2023)
+  - 'fqcn-builtins'
+
+  # We use template in names
+  - 'name[template]'
+
+  # No changed-when on commands
+  # (Disabled in June 2023 after ansible upgrade; FIXME)
+  - 'no-changed-when'
+
+  # Disable run-once check with free strategy
+  # (Disabled in June 2023 after ansible upgrade; FIXME)
+  - 'run-once[task]'
+exclude_paths:
+  # Generated files
+  - tests/files/custom_cni/cilium.yaml
+  - venv
+  - .github
+  - .ansible
+  - .cache
+  - .gitlab-ci.yml
+  - .gitlab-ci
+mock_modules:
+  - gluster.gluster.gluster_volume

.ansible-lint-ignore

@@ -0,0 +1,8 @@
+# This file contains ignores rule violations for ansible-lint
+inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml jinja[spacing]
+roles/kubernetes/control-plane/defaults/main/kube-proxy.yml jinja[spacing]
+roles/kubernetes/control-plane/defaults/main/main.yml jinja[spacing]
+roles/kubernetes/kubeadm/defaults/main.yml jinja[spacing]
+roles/kubernetes/node/defaults/main.yml jinja[spacing]
+roles/kubernetes/preinstall/defaults/main.yml jinja[spacing]
+roles/kubespray-defaults/defaults/main/main.yml jinja[spacing]

.gitignore

@@ -5,3 +5,9 @@
 *k8s-admin*
 vault-keys.json
 config.yaml
+temp
+*id_rsa*
+.venv
+.ropeproject
+*__pycache__
+bin

.gitlab-ci.yml

@@ -1,106 +0,0 @@
-variables:
-  DOCKER_IMAGE: harbor.kvazaric.ru/kube-forge/kube-forge
-
-  KANIKO_IMAGE: harbor.kvazaric.ru/postgres-tasks/kaniko_executor:debug
-  KANIKO_CONTEXT: ${CI_PROJECT_DIR}
-  RELEASE_CLI_IMAGE: harbor.kvazaric.ru/kube-forge/release-cli:v0.18.0
-  CICD_MULTITOOL: harbor.kvazaric.ru/postgres-tasks/cicd-multitool:2.4
-
-  PREPARE_RELEASE:
-    options:
-      - "No"
-      - "Yes"
-    value: "No"
-    description: Create release from this build?
-
-  WITHOUT_BUILD:
-    options:
-      - "No"
-      - "Yes"
-    value: "Yes"
-    description: Create release without building?
-
-stages:
-  - prepare
-  - build
-  - release
-
-make-version-name:
-  stage: prepare
-  image:
-    name: ${CICD_MULTITOOL}
-    entrypoint: [""]
-  allow_failure: false
-  tags:
-    - build
-    - docker
-  script:
-    - echo "VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)" > version.env
-  artifacts:
-    reports:
-      dotenv: version.env
-
-build-docker:
-  variables:
-    DOCKERFILE_PATH: Dockerfile
-    IMAGE_DESTINATION: image
-  stage: build
-  image:
-    name: ${KANIKO_IMAGE}
-    entrypoint: [""]
-  allow_failure: false
-  tags:
-    - build
-    - docker
-  before_script:
-    - mkdir -p /kaniko/.docker
-    - echo "${DOCKER_AUTH_CONFIG}" > /kaniko/.docker/config.json
-  script:
-    - |
-      /kaniko/executor --context "${KANIKO_CONTEXT}" \
-        --dockerfile ${CI_PROJECT_DIR}/build/docker/Dockerfile \
-        --destination "${DOCKER_IMAGE}:${VERSION}-${CI_COMMIT_SHORT_SHA}"
-  dependencies:
-    - make-version-name
-  needs:
-    - make-version-name
-  rules:
-    - if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes"
-      when: never
-    - changes:
-        - build/docker/**/*
-        - cmd/**/*
-        - internal/**/*
-        - kubespray/**/*
-        - go.sum
-        - go.mod
-        - requirements.txt
-        - ansible.cfg
-      if: $CI_COMMIT_REF_NAME =~ /^(master)$/
-      when: always
-
-make-release:
-  stage: release
-  image: ${RELEASE_CLI_IMAGE}
-  dependencies:
-    - make-version-name
-  needs:
-    - make-version-name
-  tags:
-    - build
-    - docker
-  rules:
-    - if: $PREPARE_RELEASE == "Yes"
-  script:
-    - VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)
-    - echo "Preparing release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}"
-  release: # See https://docs.gitlab.com/ee/ci/yaml/#release for available properties
-    name: kube-forge:${VERSION}-${CI_COMMIT_SHORT_SHA}
-    tag_name: "${VERSION}-${CI_COMMIT_SHORT_SHA}"
-    description: "Kube-forge release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}"
-    assets:
-      links:
-        - name: "Docker image"
-          url: "https://harbor.kvazaric.ru/harbor/projects/4/repositories/kube-forge/artifacts-tab"
-          link_type: "image"
-  when: on_success

Makefile

@@ -0,0 +1,18 @@
+BINNAME    := kube-forge
+BINDIR  := $(CURDIR)/bin
+TARGETS := darwin/amd64 darwin/arm64 linux/amd64 linux/arm linux/arm64 windows/amd64 windows/arm64
+
+.PHONY: run
+run:
+	@'$(BINDIR)/'$(BINNAME)
+
+
+.PHONY: build
+build:
+	@go build -v -trimpath -ldflags "-s -w $(ADDITIONAL_LLD_FLAGS)" -o '$(BINDIR)/'$(BINNAME) ./cmd/main/main.go
+
+.PHONY: clean
+clean:
+	@rm -r ${BINDIR}
+
+.DEFAULT_GOAL := build

README.md

@@ -1,4 +1,4 @@
-## Устнановка
+## Установка
 
 ### Docker-образ
 
@@ -7,7 +7,29 @@
 ### Docker-образ
 
 ```shell
+touch k8s-admin.conf
+
 docker run -v $(pwd)/config.yaml:/application/config.yaml \
-  -v $(pwd)/id_rsa:/root/.ssh/id_rsa \
-  -v $(pwd)/config:/root/.ssh/config harbor.kvazaric.ru/kube-forge/kube-forge:1.0-5dcd4a83 apply
+  -v $(pwd)/id_rsa_bastion_ift:/root/.ssh/id_rsa \
+  --mount type=bind,source=$(pwd)/k8s-admin.conf,target=/application/k8s-admin.conf \
+  harbor.kvazaric.ru/kube-forge/kube-forge:1.1-f84c27e6 apply
 ```
+
+## С помощью исполняемого файла
+
+Необходимо также на машине оператора иметь утилиты:
+
+- sshpass
+
+А также установить Python-библиотеки из списка "requirements.txt"
+
+```shell
+kube-forge -c config.yaml -d . apply
+```
+
+## Параметры:
+
+- "-с" путь до конфигурационного файла
+- "-d" путь до рабочей директории (там же должна быть директория kubespray)
+- "-p" пароль для авторизации через SSH
+- "-v" включить расширенное логирование ("-v=true")

ansible.cfg

@@ -11,7 +11,8 @@ gathering = smart
 fact_caching = jsonfile
 fact_caching_connection = /tmp
 fact_caching_timeout = 86400
-stdout_callback = dense
+timeout = 300
+stdout_callback = default
 display_skipped_hosts = no
 library = ./library
 callbacks_enabled = profile_tasks,ara_default

build/README.md

@@ -1,5 +0,0 @@
-## Сборка Docker
-
-## Сборка Linux
-
-### Debian

build/debian/DEBIAN/control

@@ -1,5 +0,0 @@
-Package: kube-forge
-Version: 1.0
-Architecture: amd64
-Maintainer: Kvazaric <kvazaric.official@gmail.com>
-Description: A program to install Kubernetes-based platform  to facilitate the development, desting and dperation of Ccntainerized applications

build/docker/Dockerfile

@@ -1,5 +1,5 @@
 ## Install dependencies
-FROM python:3.12 as deps
+FROM harbor.kvazaric.ru/mirror/library/python:3.12 as deps
 
 WORKDIR /application
 COPY ./requirements.txt ./
@@ -9,7 +9,7 @@ RUN apt-get update -y && \
     pip3 install -r requirements.txt
 
 ## Build executable
-FROM golang:alpine as builder
+FROM harbor.kvazaric.ru/mirror/library/golang:alpine as builder
 
 WORKDIR /application
 COPY go.mod go.sum ./

build/version.txt

@@ -1 +0,0 @@
-1.0

cmd/main/main.go

@@ -2,29 +2,31 @@ package main
 
 import (
 	"flag"
-	"fmt"
+	"kube-forge/internal/additional"
 	"kube-forge/internal/config"
+	"kube-forge/internal/csi"
 	"kube-forge/internal/kubespray"
+	"kube-forge/internal/logging"
 	"kube-forge/internal/templates"
 	"os"
 )
 
-func parseArgs() (string, string, string) {
-	var password, configPath, workDir string
-	flag.StringVar(&password, "p", "", "Password to access hosts")
-	flag.StringVar(&configPath, "c", "/etc/kube-forge/config.yaml", "Path to config file")
-	flag.StringVar(&workDir, "d", "/var/lib/kube-forge", "Path to kube-forge work dir")
-	flag.Parse()
-	return password, configPath, workDir
+func installAndConfigureModules() {
+	csi.ApplyCharts()
+	additional.ApplyCharts()
 }
 
 func main() {
-	password, configPath, workDir := parseArgs()
-	config := config.CreateConfig(configPath, workDir, password)
+	var password, configPath, workDir string
+	var verbose bool
 
-	repositories, releases := templates.GetHelmAppsConfigData()
-	config.Repositories = repositories
-	config.Releases = releases
+	flag.StringVar(&password, "p", "", "Password to access hosts")
+	flag.StringVar(&configPath, "c", "/etc/kube-forge/config.yaml", "Path to config file")
+	flag.StringVar(&workDir, "d", "/var/lib/kube-forge", "Path to kube-forge work dir")
+	flag.BoolVar(&verbose, "v", false, "Enable verbose logging")
+	flag.Parse()
+	config := config.CreateConfig(configPath, workDir, password)
+	config.Verbose = verbose
 
 	templates.ApplyK8sTemplates()
 
@@ -32,9 +34,10 @@ func main() {
 		switch cmd {
 		case "apply":
 			kubespray.InstallCluster("")
+			installAndConfigureModules()
 			return
 		case "apply-modules":
-			kubespray.InstallCluster("helm-apps")
+			installAndConfigureModules()
 			return
 		case "upgrade":
 			kubespray.UpgradeCluster("")
@@ -42,7 +45,10 @@ func main() {
 		case "scale":
 			kubespray.ScaleCluster()
 			return
+		case "reset":
+			kubespray.ResetCluster()
+			return
 		}
 	}
-	fmt.Println("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
+	logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale, reset")
 }

config.sample.yaml

@@ -1,123 +1,91 @@
 credentials:
   user: sre-admin
   ask_sudo_password: false
-  private_key_file: /home/sre-admin/.ssh/id_rsa
+  private_key_file: /Users/georgest/.ssh/id_rsa_bastion_ift
 
 hosts:
-  - hostname: vbox-prod-k8s-master-01
-    ip: "10.250.50.22"
+  - hostname: t1-disk-lt-k8s-test-master-01
+    ip: "10.100.20.47"
     roles: [control_plane, etcd]
-  - hostname: vbox-prod-k8s-slave-01
-    ip: "10.250.50.23"
+
+  - hostname: t1-disk-lt-k8s-test-slave-01
+    ip: "10.100.20.48"
     roles: [node]
-  - hostname: vbox-prod-k8s-slave-02
-    ip: "10.250.50.21"
+
+  - hostname: t1-disk-lt-k8s-test-slave-02
+    ip: "10.100.20.49"
     roles: [node]
 
 orchestrator:
-  version: v1.29.0
+  version: v1.32
+  cluster_name: cluster.local
+  kubelet_dir: "/app/k8s/kubelet"
+  proxy_mode: "ipvs" # iptables, ipvs
+  proxy_scheduler: "rr"
   container_engine:
     install: true
+    type: "containerd"
+    data_dir: "/app/containerd"
+    state_dir: "/app/containerd-state"
+  dns:
+    servers:
+      - 8.8.8.8
+      - 8.8.4.4
+      - 1.1.1.1
+    disable_host_nameservers: false
+    coredns_external_zones:
+      []
+      # - zones:
+      #     - example.com
+      #     - example.io:1053
+      #   nameservers:
+      #     - 1.1.1.1
+      #     - 2.2.2.2
+      #   cache: 5
+      # - zones:
+      #     - https://mycompany.local:4453
+      #   nameservers:
+      #     - 192.168.0.53
+      #   cache: 0
+      # - zones:
+      #     - mydomain.tld
+      #   nameservers:
+      #     - 10.233.0.3
+      #   cache: 5
+      #   rewrite:
+      #     - name website.tld website.namespace.svc.cluster.local
   ping_access_ip: true
   auto_renew_certificates: true
   pod_security_policy_enabled: true
+  registry_mirrors:
+    - host: https://mirror.gcr.io
+      skip_verify: false
+    - host: https://quay.io
+      skip_verify: false
 
 modules:
   admin_password: changeit
+
   observability:
-    enabled: true
-    logging:
-      enabled: true
-      events:
-        enabled: true
-    tracing:
-      enabled: true
-    monitoring:
-      enabled: true
-      alert_manager:
-        enabled: true
-        route:
-          receiver: kvazaric_notifications
-          group_wait: 1s
-          repeat_interval: 180m
-          routes:
-            - receiver: "kvazaric_notifications"
-              group_by: ["alertname"]
-              group_wait: 1s
-              repeat_interval: 8737h
-              matchers:
-                - fireOnce=true
-        receivers:
-          - name: kvazaric_notifications
-            telegram_configs:
-              - send_resolved: true
-                api_url: https://api.telegram.org
-                bot_token: bot_token
-                chat_id: -10000
-                parse_mode: HTML
-                message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}'
-                http_config:
-                  follow_redirects: true
-                  enable_http2: false
-      blackbox:
-        enabled: true
-      kube_state:
-        enabled: true
-      node:
-        enabled: true
-    visualization:
-      enabled: true
-      grafana:
-        enabled: true
-        expose:
-          type: ingress # ingress or NodePort
-          domain: grafana.disk.lt.t1.cloud
-          tls:
-            enabled: true
+    enabled: false
 
   cicd:
-    enabled: true
-    argo_cd:
-      expose:
-        type: ingress # ingress or NodePort
-        domain: argocd.disk.lt.t1.cloud
-        tls:
-          enabled: true
-    rollouts:
-      enabled: true
-    updates_operator:
-      enabled: true
+    enabled: false
 
   secrets_storage:
-    enabled: true
-    key_shares: 5
-    key_threshold: 3
-    expose:
-      type: ingress # ingress or NodePort
-      domain: vault.disk.lt.t1.cloud
-      tls:
-        enabled: true
-    csi_integration:
-      enabled: true
+    enabled: false
 
   registry:
-    enabled: true
-    expose:
-      type: ingress # ingress or nodePort
-      domain: harbor.disk.lt.t1.cloud
-    tls:
-      enabled: true
-    enabled_scanner: true
+    enabled: false
 
   additional:
     cert_manager:
       enabled: true
-      account_email: adminmail@gmail.com
-    ingress:
-      enabled: true
-      host_network: true
+      account_email: g.stykalin@rockitsoft.ru
     storage:
+      local_path_provisioner:
+        data_dir: "/app/local-path-provisioner"
       longhorn:
-        enabled: true
+        enabled: false
       secrets_store_csi_driver:
-        enabled: true
+        enabled: false

examples/argo-cd-example.yaml

@@ -1 +0,0 @@
-https://github.com/argoproj/argocd-example-apps/tree/master/guestbook

examples/rollouts-app-test.yaml

@@ -1,65 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: canary-demo-preview
-spec:
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app: canary-demo
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: canary-demo
-spec:
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app: canary-demo
----
-apiVersion: argoproj.io/v1alpha1
-kind: Rollout
-metadata:
-  name: canary-demo
-spec:
-  replicas: 5
-  revisionHistoryLimit: 1
-  selector:
-    matchLabels:
-      app: canary-demo
-  template:
-    metadata:
-      labels:
-        app: canary-demo
-    spec:
-      containers:
-        - name: canary-demo
-          image: argoproj/rollouts-demo:green
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          resources:
-            requests:
-              memory: 32Mi
-              cpu: 5m
-  strategy:
-    canary:
-      canaryService: canary-demo-preview
-      steps:
-        - setWeight: 20
-        - pause: {}
-        - setWeight: 40
-        - pause: { duration: 10 }
-        - setWeight: 60
-        - pause: { duration: 10 }
-        - setWeight: 80
-        - pause: { duration: 10 }

examples/vault-inject-example.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault-inject-example
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vault-inject-example-deployment
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: vault-inject-example
-  template:
-    metadata:
-      labels:
-        app: vault-inject-example
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/role: "vault-example"
-        vault.hashicorp.com/agent-inject-secret-env: "vault-example/creds"
-        vault.hashicorp.com/auth-path: "auth/kubernetes-local"
-        vault.hashicorp.com/agent-inject-template-env: |
-          {{- with secret "vault-example/creds" -}}
-          {{- range $key, $value := .Data.data }}
-          export {{ $key }}={{ $value }}
-          {{- end }}
-          {{- end }}
-    spec:
-      containers:
-        - name: app
-          image: "postgres:latest"
-          env:
-            - name: POSTGRES_PASSWORD
-              value: admin
-      serviceAccountName: vault-inject-example

go.mod

@@ -5,75 +5,158 @@ go 1.22.0
 toolchain go1.22.2
 
 require (
-	github.com/BurntSushi/toml v1.2.1
+	github.com/BurntSushi/toml v1.3.2
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/apenella/go-ansible v1.3.0
-	github.com/apenella/go-ansible/v2 v2.0.0
+	github.com/apenella/go-ansible/v2 v2.0.1
 	github.com/ilyakaznacheev/cleanenv v1.5.0
+	github.com/mittwald/go-helm-client v0.12.9
+	github.com/sirupsen/logrus v1.9.3
 	golang.org/x/crypto v0.22.0
+	helm.sh/helm/v3 v3.14.2
+	k8s.io/api v0.30.0
+	k8s.io/apimachinery v0.30.0
+	k8s.io/client-go v0.30.0
 	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.2.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Masterminds/squirrel v1.5.4 // indirect
+	github.com/Microsoft/hcsshim v0.11.4 // indirect
 	github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df // indirect
 	github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/chai2010/gettext-go v1.0.2 // indirect
+	github.com/containerd/containerd v1.7.11 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/distribution/reference v0.5.0 // indirect
+	github.com/docker/cli v24.0.7+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker v24.0.7+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.8.0 // indirect
+	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-metrics v0.0.1 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.1 // indirect
+	github.com/evanphx/json-patch v5.7.0+incompatible // indirect
+	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fatih/color v1.16.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
+	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.20.2 // indirect
+	github.com/go-openapi/jsonreference v0.20.4 // indirect
+	github.com/go-openapi/swag v0.22.7 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/btree v1.1.2 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/huandu/xstrings v1.3.3 // indirect
-	github.com/imdario/mergo v0.3.11 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/google/uuid v1.5.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gorilla/websocket v1.5.1 // indirect
+	github.com/gosuri/uitable v0.0.4 // indirect
+	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jmoiron/sqlx v1.3.5 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
+	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
+	github.com/lib/pq v1.10.9 // indirect
+	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mitchellh/copystructure v1.0.0 // indirect
-	github.com/mitchellh/reflectwalk v1.0.0 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.2.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
+	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
+	github.com/prometheus/client_golang v1.18.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/rubenv/sql-migrate v1.6.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
+	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/stretchr/testify v1.9.0 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/xlab/treeprint v1.2.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
+	go.opentelemetry.io/otel v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.21.0 // indirect
+	go.starlark.net v0.0.0-20231121155337-90ade8b19d09 // indirect
+	golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc // indirect
 	golang.org/x/net v0.24.0 // indirect
-	golang.org/x/oauth2 v0.10.0 // indirect
+	golang.org/x/oauth2 v0.15.0 // indirect
+	golang.org/x/sync v0.5.0 // indirect
 	golang.org/x/sys v0.19.0 // indirect
 	golang.org/x/term v0.19.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
+	google.golang.org/grpc v1.60.1 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
+	gopkg.in/evanphx/json-patch.v5 v5.7.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.30.0 // indirect
-	k8s.io/apimachinery v0.30.0 // indirect
-	k8s.io/client-go v0.30.0 // indirect
+	k8s.io/apiextensions-apiserver v0.29.0 // indirect
+	k8s.io/apiserver v0.29.0 // indirect
+	k8s.io/cli-runtime v0.29.0 // indirect
+	k8s.io/component-base v0.29.0 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	k8s.io/kubectl v0.29.0 // indirect
+	k8s.io/utils v0.0.0-20240102154912-e7106e64919e // indirect
 	olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3 // indirect
+	oras.land/oras-go v1.2.4 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/kustomize/api v0.16.0 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.16.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 )

go.sum

@@ -1,77 +1,227 @@
-github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
+github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
+github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
+github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
+github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
+github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
+github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
+github.com/Microsoft/hcsshim v0.11.4/go.mod h1:smjE4dvqPX9Zldna+t5FG3rnoHhaB7QYxPRqGcpAD9w=
+github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
+github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/apenella/go-ansible v1.3.0 h1:INNaVzrgQMNIO9Yvnly6lA5KfN/pY3m1Z37gpmlUzPM=
 github.com/apenella/go-ansible v1.3.0/go.mod h1:qiLWolQqLkCoqFlPvdsKhxk7O0qjIBCPNhUKpH/vjaU=
-github.com/apenella/go-ansible/v2 v2.0.0 h1:9aZkU8dQ2fVITYX5V1CiQ3VX4PnNPBTgv31wJFd2Ito=
-github.com/apenella/go-ansible/v2 v2.0.0/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
+github.com/apenella/go-ansible/v2 v2.0.1 h1:9o3805u4NAIMf1px5EKpRS2LEa2aeQbMtHB7vilt7XE=
+github.com/apenella/go-ansible/v2 v2.0.1/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
 github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df h1:sEikY2P+NZK/7VZUwIsnXIGElhsuFDSxh1bZYwHxdcI=
 github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df/go.mod h1:cLVL6GjUiKG/WyBzX+KD6h/XRV/HnNZIZbMNNiBgQ9o=
 github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df h1:SvlYbjlsSQDS7hbVT1h012/zdgvcwWJ+Yd9XRiiY/8s=
 github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df/go.mod h1:+3dyIlHX350xJIUIffwMLswZXU+N2FwDE05VuKqxYdw=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
+github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
+github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd h1:rFt+Y/IK1aEZkEHchZRSq9OQbsSzIT/OrI8YFFmRIng=
+github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
+github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
+github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
+github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
+github.com/containerd/containerd v1.7.11 h1:lfGKw3eU35sjV0aG2eYZTiwFEY1pCzxdzicHP3SZILw=
+github.com/containerd/containerd v1.7.11/go.mod h1:5UluHxHTX2rdvYuZ5OJTC5m/KJNs0Zs9wVoJm9zf5ZE=
+github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
+github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
+github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
-github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aBfCb7iqHmDEIp6fBvC/hQUddQfg+3qdYjwzaiP9Hnc=
+github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
+github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
+github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v24.0.7+incompatible h1:wa/nIwYFW7BVTGa7SWPVyyXU9lgORqUb1xfI36MSkFg=
+github.com/docker/cli v24.0.7+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
+github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
+github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
+github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
+github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
+github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
+github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1 h1:ZClxb8laGDf5arXfYcAtECDFgAgHklGI8CxgjHnXKJ4=
+github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
+github.com/emicklei/go-restful/v3 v3.11.1 h1:S+9bSbua1z3FgCnV0KKOSSZ3mDthb5NyEPL5gEpCvyk=
+github.com/emicklei/go-restful/v3 v3.11.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
+github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
 github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
 github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
+github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
+github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/jsonpointer v0.20.2 h1:mQc3nmndL8ZBzStEo3JYF8wzmeWffDH4VbXz58sAx6Q=
+github.com/go-openapi/jsonpointer v0.20.2/go.mod h1:bHen+N0u1KEO3YlmqOjTT9Adn1RfD91Ar825/PuiRVs=
+github.com/go-openapi/jsonreference v0.20.4 h1:bKlDxQxQJgwpUSgOENiMPzCTBVuc7vTdXSSgNeAhojU=
+github.com/go-openapi/jsonreference v0.20.4/go.mod h1:5pZJyJP2MnYCpoeoMAql78cCHauHj0V9Lhc506VOpw4=
+github.com/go-openapi/swag v0.22.7 h1:JWrc1uc/P9cSomxfnsFSVWoE1FW6bNbrVPmpQYpCcR8=
+github.com/go-openapi/swag v0.22.7/go.mod h1:Gl91UqO+btAM0plGGxHqJcQZ1ZTy6jbmridBTsDy8A0=
+github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/gomodule/redigo v1.8.2 h1:H5XSIre1MB5NbPYFp+i1NBbb5qN1W8Y8YAQoAYbkm8k=
+github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
+github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
+github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
 github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
+github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4=
+github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
-github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
+github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
+github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
+github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
+github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
+github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
+github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/ilyakaznacheev/cleanenv v1.5.0 h1:0VNZXggJE2OYdXE87bfSSwGxeiGt9moSR2lOrsHHvr4=
 github.com/ilyakaznacheev/cleanenv v1.5.0/go.mod h1:a5aDzaJrLCQZsazHol1w8InnDcOX0OColm64SlIi6gk=
-github.com/imdario/mergo v0.3.11 h1:3tnifQM4i+fbajXKBHXWEH+KvNHqojZ778UH75j3bGA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
+github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
+github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq6+3iTQz8KNCLtVX6idSoTLdUw=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
@@ -79,51 +229,157 @@ github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovk
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.15 h1:vfoHhTN1af61xCRSWzFIWzx2YskyMTwHLrExkBOjvxI=
+github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
+github.com/miekg/dns v1.1.25 h1:dFwPR6SfLtrSwgDcIq2bcU/gVutB4sNApq2HBdqcakg=
+github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
-github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mittwald/go-helm-client v0.12.9 h1:tfI5ECgrbfAolA9TnlCeA5F2TEIvdsOxVmoSyW80lCI=
+github.com/mittwald/go-helm-client v0.12.9/go.mod h1:ukR3Et5zbfBij7bFL1ZnLvPytsbBXCrI2qQYr2yVi9I=
+github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
+github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
+github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
+github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY=
+github.com/onsi/ginkgo/v2 v2.15.0/go.mod h1:HlxMHtYF57y6Dpf+mc5529KKmSq9h2FpCF+/ZkwUxKM=
+github.com/onsi/gomega v1.31.0 h1:54UJxxj6cPInHS3a35wm6BK/F9nHYueZ1NVujHDrnXE=
+github.com/onsi/gomega v1.31.0/go.mod h1:DW9aCi7U6Yi40wNVAvT6kzFnEVEI5n3DloYBiKiT6zk=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.0-rc5 h1:Ygwkfw9bpDvs+c9E34SdgGOj41dX/cbdlwvlWt0pnFI=
+github.com/opencontainers/image-spec v1.1.0-rc5/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
+github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
+github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
+github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
+github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
+github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
+github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rubenv/sql-migrate v1.6.0 h1:IZpcTlAx/VKXphWEpwWJ7BaMq05tYtE80zYz+8a5Il8=
+github.com/rubenv/sql-migrate v1.6.0/go.mod h1:m3ilnKP7sNb4eYkLsp6cGdPOl4OBcXM6rcbzU+Oqc5k=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
+github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sosedoff/ansible-vault-go v0.2.0 h1:XqkBdqbXgTuFQ++NdrZvSdUTNozeb6S3V5x7FVs17vg=
 github.com/sosedoff/ansible-vault-go v0.2.0/go.mod h1:wMU54HNJfY0n0KIgbpA9m15NBfaUDlJrAsaZp0FwzkI=
-github.com/spf13/cast v1.3.1 h1:nFm6S0SMdyzrzcmThSipiEubIDy8WEXKNZ0UOgiRpng=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
+github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43 h1:+lm10QQTNSBd8DVTNGHx7o/IKu9HYDvLMffDhbyLccI=
+github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
+github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50 h1:hlE8//ciYMztlGpl/VA+Zm1AcTPHYkHJPbHqE6WJUXE=
+github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
+github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f h1:ERexzlUfuTvpE74urLSbIQW0Z/6hF9t8U4NsJLaioAY=
+github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
+go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
+go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
+go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
+go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
+go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
+go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.starlark.net v0.0.0-20231121155337-90ade8b19d09 h1:hzy3LFnSN8kuQK8h9tHl4ndF6UruMj47OqwqsS+/Ai4=
+go.starlark.net v0.0.0-20231121155337-90ade8b19d09/go.mod h1:LcLNIzVOMp4oV+uusnpk+VU+SzXaJakUuBjoCSWH5dM=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -131,11 +387,16 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc h1:ao2WRsKSzW6KuUY9IWPwWahcHCgR0s52IfwutMfEbdM=
+golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
@@ -144,18 +405,27 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
 golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
-golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
-golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
+golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
+golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -168,32 +438,44 @@ golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
 golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
+golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
+google.golang.org/grpc v1.60.1 h1:26+wFr+cNqSGFcOXcabYC0lUVJVRa2Sb2ortSK7VrEU=
+google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v5 v5.7.0 h1:dGKGylPlZ/jus2g1YqhhyzfH0gPy2R8/MYUpW/OslTY=
+gopkg.in/evanphx/json-patch.v5 v5.7.0/go.mod h1:/kvTRh1TVm5wuM6OkHxqXtE/1nUZZpihg29RtuIyfvk=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -202,22 +484,42 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
+gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
+helm.sh/helm/v3 v3.14.2 h1:V71fv+NGZv0icBlr+in1MJXuUIHCiPG1hW9gEBISTIA=
+helm.sh/helm/v3 v3.14.2/go.mod h1:2itvvDv2WSZXTllknfQo6j7u3VVgMAvm8POCDgYH424=
 k8s.io/api v0.30.0 h1:siWhRq7cNjy2iHssOB9SCGNCl2spiF1dO3dABqZ8niA=
 k8s.io/api v0.30.0/go.mod h1:OPlaYhoHs8EQ1ql0R/TsUgaRPhpKNxIMrKQfWUp8QSE=
+k8s.io/apiextensions-apiserver v0.29.0 h1:0VuspFG7Hj+SxyF/Z/2T0uFbI5gb5LRgEyUVE3Q4lV0=
+k8s.io/apiextensions-apiserver v0.29.0/go.mod h1:TKmpy3bTS0mr9pylH0nOt/QzQRrW7/h7yLdRForMZwc=
 k8s.io/apimachinery v0.30.0 h1:qxVPsyDM5XS96NIh9Oj6LavoVFYff/Pon9cZeDIkHHA=
 k8s.io/apimachinery v0.30.0/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
+k8s.io/apiserver v0.29.0 h1:Y1xEMjJkP+BIi0GSEv1BBrf1jLU9UPfAnnGGbbDdp7o=
+k8s.io/apiserver v0.29.0/go.mod h1:31n78PsRKPmfpee7/l9NYEv67u6hOL6AfcE761HapDM=
+k8s.io/cli-runtime v0.29.0 h1:q2kC3cex4rOBLfPOnMSzV2BIrrQlx97gxHJs21KxKS4=
+k8s.io/cli-runtime v0.29.0/go.mod h1:VKudXp3X7wR45L+nER85YUzOQIru28HQpXr0mTdeCrk=
 k8s.io/client-go v0.30.0 h1:sB1AGGlhY/o7KCyCEQ0bPWzYDL0pwOZO4vAtTSh/gJQ=
 k8s.io/client-go v0.30.0/go.mod h1:g7li5O5256qe6TYdAMyX/otJqMhIiGgTapdLchhmOaY=
+k8s.io/component-base v0.29.0 h1:T7rjd5wvLnPBV1vC4zWd/iWRbV8Mdxs+nGaoaFzGw3s=
+k8s.io/component-base v0.29.0/go.mod h1:sADonFTQ9Zc9yFLghpDpmNXEdHyQmFIGbiuZbqAXQ1M=
 k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
 k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kubectl v0.29.0 h1:Oqi48gXjikDhrBF67AYuZRTcJV4lg2l42GmvsP7FmYI=
+k8s.io/kubectl v0.29.0/go.mod h1:0jMjGWIcMIQzmUaMgAzhSELv5WtHo2a8pq67DtviAJs=
+k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
+k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3 h1:slmdOY3vp8a7KQbHkL+FLbvbkgMqmXojpFUO/jENuqQ=
 olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3/go.mod h1:oVgVk4OWVDi43qWBEyGhXgYxt7+ED4iYNpTngSLX2Iw=
+oras.land/oras-go v1.2.4 h1:djpBY2/2Cs1PV87GSJlxv4voajVOMZxqqtq9AB8YNvY=
+oras.land/oras-go v1.2.4/go.mod h1:DYcGfb3YF1nKjcezfX2SNlDAeQFKSXmf+qrFmrh4324=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/kustomize/api v0.16.0 h1:/zAR4FOQDCkgSDmVzV2uiFbuy9bhu3jEzthrHCuvm1g=
+sigs.k8s.io/kustomize/api v0.16.0/go.mod h1:MnFZ7IP2YqVyVwMWoRxPtgl/5hpA+eCCrQR/866cm5c=
+sigs.k8s.io/kustomize/kyaml v0.16.0 h1:6J33uKSoATlKZH16unr2XOhDI+otoe2sR3M8PDzW3K0=
+sigs.k8s.io/kustomize/kyaml v0.16.0/go.mod h1:xOK/7i+vmE14N2FdFyugIshB8eF6ALpy7jI87Q2nRh4=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=

internal/additional/helm.go

@@ -0,0 +1,79 @@
+package additional
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getCertManagerSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "cert-manager",
+		ChartName:       appConfig.Modules.Additional.CertManager.ChartRef,
+		Version:         appConfig.Modules.Additional.CertManager.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.CertManager.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl"),
+	}
+}
+
+func getIngressNginxSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "ingress-nginx",
+		ChartName:       appConfig.Modules.Additional.Ingress.ChartRef,
+		Version:         appConfig.Modules.Additional.Ingress.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Ingress.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl"),
+	}
+}
+
+func getDockerSecretsGeneratorSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "docker-secrets-generator",
+		ChartName:       appConfig.Modules.Additional.DockerSecrets.ChartRef,
+		Version:         appConfig.Modules.Additional.DockerSecrets.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.DockerSecrets.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos("kube-system", HELM_REPOS)
+	if appConfig.Modules.Additional.CertManager.Enabled {
+		helm_client.InstallChart(getCertManagerSpec())
+	} else {
+		helm_client.DeleteChart(getCertManagerSpec())
+	}
+	if appConfig.Modules.Additional.Ingress.Enabled && appConfig.Modules.Additional.Ingress.Type == "nginx" {
+		helm_client.InstallChart(getIngressNginxSpec())
+	} else {
+		helm_client.DeleteChart(getIngressNginxSpec())
+	}
+	if appConfig.Modules.Additional.DockerSecrets.Repositories != nil {
+		helm_client.InstallChart(getDockerSecretsGeneratorSpec())
+	} else {
+		helm_client.DeleteChart(getDockerSecretsGeneratorSpec())
+	}
+}

internal/config/config.go

@@ -15,8 +15,10 @@ type Host struct {
 }
 
 type Config struct {
-	WorkDir     string
-	Credentials struct {
+	WorkDir        string
+	KubeconfigFile string `yaml:"kubeconfig_file" env-default:"k8s-admin.conf"`
+	Verbose        bool
+	Credentials    struct {
 		User            string `yaml:"user"`
 		Password        string `yaml:"password"`
 		AskSudoPassword bool   `yaml:"ask_sudo_password"`
@@ -28,17 +30,8 @@ type Config struct {
 	Orchestrator Orchestrator `yaml:"orchestrator"`
 
 	Modules struct {
-		AdminPassword          string         `yaml:"admin_password"`
-		AdditionalRepositories interface{}    `yaml:"additional_repositories"`
-		Additional             Additional     `yaml:"additional"`
-		Observability          Observability  `yaml:"observability"`
-		Registry               Registry       `yaml:"registry"`
-		Cicd                   Cicd           `yaml:"cicd"`
-		SecretsStorage         SecretsStorage `yaml:"secrets_storage"`
+		Additional Additional `yaml:"additional"`
 	} `yaml:"modules"`
-
-	Repositories string
-	Releases     string
 }
 
 var instance *Config
@@ -55,9 +48,6 @@ func CreateConfig(configPath string, workDir string, password string) *Config {
 	if password != "" {
 		instance.Credentials.Password = password
 	}
-
-	generateCreds(instance)
-
 	return instance
 }
 

internal/config/helm.go

@@ -0,0 +1,62 @@
+package config
+
+import (
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"time"
+
+	helm_client "github.com/mittwald/go-helm-client"
+)
+
+type RepoSettings struct {
+	Name     string
+	URL      string
+	Username string
+	Password string
+}
+
+type ChartSettings struct {
+	ReleaseName     string
+	ChartRef        string
+	ChartVersion    string
+	Namespace       string
+	CreateNamespace bool
+	Atomic          bool
+	Timeout         time.Duration
+	ValuesYaml      string
+}
+
+func GetHelmClient(namespace string) helm_client.Client {
+	config := GetConfig()
+	file, err := os.Open(filepath.Join(config.WorkDir, config.KubeconfigFile))
+	if err != nil {
+		log.Fatalf("failed to open file: %s", err)
+	}
+	defer file.Close()
+	kubeconfig, err := io.ReadAll(file)
+	if err != nil {
+		log.Fatalf("failed to read file: %s", err)
+	}
+	opts := &helm_client.KubeConfClientOptions{
+		Options: &helm_client.Options{
+			Namespace:        namespace,
+			RepositoryCache:  "/tmp/.helmcache",
+			RepositoryConfig: "/tmp/.helmrepo",
+			Debug:            true,
+			Linting:          true, // Change this to false if you don't want linting.
+			DebugLog: func(format string, v ...interface{}) {
+				// Change this to your own logger. Default is 'log.Printf(format, v...)'.
+			},
+		},
+		KubeContext: "",
+		KubeConfig:  kubeconfig,
+	}
+	client, err := helm_client.NewClientFromKubeConf(opts)
+	if err != nil {
+		log.Fatalf("error while creating helm client: %s", err)
+	}
+
+	return client
+}

internal/config/kubernetes.go

@@ -11,7 +11,7 @@ var kubernetesConfig *rest.Config
 
 func GetKubernetesConfig() *rest.Config {
 	appConfig := GetConfig()
-	kubeconfigPath := filepath.Join(appConfig.WorkDir, "k8s-admin.conf")
+	kubeconfigPath := filepath.Join(appConfig.WorkDir, appConfig.KubeconfigFile)
 
 	kubernetesConfig, err := clientcmd.BuildConfigFromFlags("", kubeconfigPath)
 	if err != nil {

internal/config/modules_additional.go

@@ -5,6 +5,7 @@ type Additional struct {
 		ChartRef     string   `yaml:"chart_ref" env-default:"kube-forge/cert-manager"`
 		ChartVersion string   `yaml:"chart_version" env-default:"v1.14.5"`
 		Enabled      bool     `yaml:"enabled"`
+		Namespace    string   `yaml:"namespace" env-default:"cert-manager"`
 		HaEnabled    bool     `yaml:"ha_enabled"`
 		DnsServers   []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"`
 		AccountEmail string   `yaml:"account_email"`
@@ -19,6 +20,7 @@ type Additional struct {
 		ChartVersion            string `yaml:"chart_version" env-default:"4.10.1"`
 		Type                    string `yaml:"type" env-default:"nginx"`
 		Enabled                 bool   `yaml:"enabled"`
+		Namespace               string `yaml:"namespace" env-default:"ingress-nginx"`
 		IngressClassName        string `yaml:"ingress_class_name" env-default:"nginx"`
 		HostNetwork             bool   `yaml:"host_network"`
 		EnableAdmissionWebhooks bool   `yaml:"enable_admission_webhooks"`
@@ -36,12 +38,13 @@ type Additional struct {
 
 	LoadBalancer struct {
 		Type    string `yaml:"type" env-default:"metallb"`
-		Install bool   `yaml:"install"`
+		Enabled bool   `yaml:"enabled"`
 	} `yaml:"load_balancer"`
 
 	DockerSecrets struct {
 		ChartRef     string      `yaml:"chart_ref" env-default:"kube-forge/docker-secrets-generator"`
 		ChartVersion string      `yaml:"chart_version" env-default:"0.1.0"`
+		Namespace    string      `yaml:"namespace" env-default:"kube-system"`
 		Repositories interface{} `yaml:"repositories"`
 	} `yaml:"docker_secrets"`
 
@@ -49,16 +52,19 @@ type Additional struct {
 		LocalPathProvisioner struct {
 			StorageClassName string `yaml:"storage_class_name" env-default:"local-path"`
 			ReclaimPolicy    string `yaml:"reclaim_policy" env-default:"Delete"`
+			DataDir          string `yaml:"data_dir" env-default:"/opt/local-path-provisioner/"`
 		} `yaml:"local_path_provisioner"`
 		Longhorn struct {
 			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/longhorn"`
 			ChartVersion string `yaml:"chart_version" env-default:"1.6.1"`
 			Enabled      bool   `yaml:"enabled"`
+			Namespace    string `yaml:"namespace" env-default:"longhorn-system"`
 		} `yaml:"longhorn"`
 		SecretsStoreCsiDriver struct {
 			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/secrets-store-csi-driver"`
 			ChartVersion string `yaml:"chart_version" env-default:"1.4.3"`
 			Enabled      bool   `yaml:"enabled"`
+			Namespace    string `yaml:"namespace" env-default:"kube-system"`
 		} `yaml:"secrets_store_csi_driver"`
 	} `yaml:"storage"`
 }

internal/config/modules_cicd.go

@@ -1,52 +0,0 @@
-package config
-
-type Cicd struct {
-	Enabled bool `yaml:"enabled"`
-	ArgoCd  struct {
-		ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
-		ChartVersion  string `yaml:"chart_version" env-default:"5.46.7"`
-		AdminPassword string
-		Ha            struct {
-			Enabled     bool `yaml:"enabled"`
-			Autoscaling bool `yaml:"autoscaling"`
-		} `yaml:"ha"`
-		Expose struct {
-			Type          string `yaml:"type"`
-			Domain        string `yaml:"domain"`
-			NodePortHttp  int    `yaml:"node_port_http" env-default:"30005"`
-			NodePortHttps int    `yaml:"node_port_https" env-default:"30006"`
-			Tls           struct {
-				Enabled bool `yaml:"enabled"`
-			} `yaml:"tls"`
-		} `yaml:"expose"`
-		Repositories interface{} `yaml:"repositories"`
-		Rbac         struct {
-			AdditionalPolicies string `yaml:"additional_policies"`
-		} `yaml:"argo_cd"`
-		ServiceIngress struct {
-			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/service-ingress"`
-			ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
-		} `yaml:"service_ingress"`
-	} `yaml:"argo_cd"`
-	UpdatesOperator struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/keel"`
-		ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
-		Enabled      bool   `yaml:"enabled"`
-	} `yaml:"updates_operator"`
-	Rollouts struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/argo-rollouts"`
-		ChartVersion string `yaml:"chart_version" env-default:"2.35.1"`
-		Enabled      bool   `yaml:"enabled"`
-		Ha           struct {
-			Enabled bool `yaml:"enabled"`
-		} `yaml:"ha"`
-		Expose struct {
-			Type     string `yaml:"type"`
-			NodePort int    `yaml:"node_port" env-default:"30010"`
-		} `yaml:"expose"`
-		Controller struct {
-		} `yaml:"controller"`
-		Dashboard struct {
-		} `yaml:"dashboard"`
-	} `yaml:"rollouts"`
-}

internal/config/modules_observability.go

@@ -1,172 +0,0 @@
-package config
-
-type Observability struct {
-	ChartRef      string        `yaml:"chart_ref" env-default:"kube-forge/observability"`
-	ChartVersion  string        `yaml:"chart_version" env-default:"0.1.0"`
-	Enabled       bool          `yaml:"enabled"`
-	Logging       Logging       `yaml:"logging"`
-	Tracing       Tracing       `yaml:"tracing"`
-	Monitoring    Monitoring    `yaml:"monitoring"`
-	Visualization Visualization `yaml:"visualization"`
-}
-
-type Logging struct {
-	Enabled  bool `yaml:"enabled"`
-	Operator struct {
-		ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/fluent-operator"`
-		ChartVersion  string `yaml:"chart_version" env-default:"2.7.0"`
-		Image         string `yaml:"image" env-default:"kubesphere/fluent-operator"`
-		Tag           string `yaml:"tag" env-default:"v2.7.0"`
-		InitContainer struct {
-			Image string `yaml:"image" env-default:"docker"`
-			Tag   string `yaml:"tag" env-default:"20.10"`
-		} `yaml:"initcontainer"`
-	} `yaml:"operator"`
-	Fluentd struct {
-		Image string `yaml:"image" env-default:"kubesphere/fluentd"`
-		Tag   string `yaml:"tag" env-default:"v1.15.3"`
-	} `yaml:"fluentd"`
-	FluentBit struct {
-		Image string `yaml:"image" env-default:"kubesphere/fluent-bit"`
-		Tag   string `yaml:"tag" env-default:"v2.2.2"`
-	} `yaml:"fluent_bit"`
-	Loki struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/loki"`
-		ChartVersion string `yaml:"chart_version" env-default:"5.47.2"`
-		Registry     string `yaml:"registry" env-default:"docker.io"`
-		Image        string `yaml:"image" env-default:"grafana/loki"`
-		Tag          string `yaml:"tag" env-default:"null"`
-		Persistence  struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"10Gi"`
-			Retention    string `yaml:"retention" env-default:"168h"`
-		} `yaml:"persistence"`
-		AlertManagerUrl       string `yaml:"alert_manager_url" env-default:"http://observability-alert-manager:9093"`
-		AdditionalRulesGroups string `yaml:"additional_rules_groups" env-default:""`
-	} `yaml:"loki"`
-	Events struct {
-		Enabled  bool `yaml:"enabled"`
-		Exporter struct {
-			Image string `yaml:"image" env-default:"ghcr.io/resmoio/kubernetes-event-exporter"`
-			Tag   string `yaml:"tag" env-default:"v1.4"`
-		} `yaml:"exporter"`
-		Cron struct {
-			Image    string `yaml:"image" env-default:"bitnami/kubectl"`
-			Tag      string `yaml:"tag" env-default:"1.27.5-debian-11-r8"`
-			Schedule string `yaml:"schedule" env-default:"*/2 * * * *"`
-		} `yaml:"cron"`
-	} `yaml:"events"`
-}
-
-type Tracing struct {
-	Enabled  bool `yaml:"enabled"`
-	Operator struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/opentelemetry-operator"`
-		ChartVersion string `yaml:"chart_version" env-default:"0.55.0"`
-		Image        string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"`
-		Tag          string `yaml:"tag" env-default:""`
-	} `yaml:"operator"`
-	Collector struct {
-		Image string `yaml:"image" env-default:"otel/opentelemetry-collector-contrib"`
-		Tag   string `yaml:"tag" env-default:"0.95.0"`
-	} `yaml:"collector"`
-	Tempo struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/tempo"`
-		ChartVersion string `yaml:"chart_version" env-default:"1.7.2"`
-		Image        string `yaml:"image" env-default:"grafana/tempo"`
-		Tag          string `yaml:"tag" env-default:""`
-		Retention    string `yaml:"retention" env-default:"24h"`
-		ListenPort   int    `yaml:"listen_port" env-default:"3100"`
-		Persistence  struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"10Gi"`
-		} `yaml:"persistence"`
-		TempoQuery struct {
-			Image      string `yaml:"image" env-default:"grafana/tempo-query"`
-			Tag        string `yaml:"tag" env-default:"null"`
-			ListenPort int    `yaml:"listen_port" env-default:"16686"`
-		} `yaml:"tempo_query"`
-	} `yaml:"tempo"`
-}
-
-type Monitoring struct {
-	Enabled    bool `yaml:"enabled"`
-	Prometheus struct {
-		Image          string `yaml:"image" env-default:"prom/prometheus"`
-		Tag            string `yaml:"tag" env-default:"v2.45.0"`
-		ScrapeInterval string `yaml:"scrape_interval" env-default:"15s"`
-		Persistence    struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"3Gi"`
-			Retention    string `yaml:"retention" env-default:"7d"`
-		} `yaml:"persistence"`
-		Operator struct {
-			Image          string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-operator"`
-			Tag            string `yaml:"tag" env-default:"v0.65.2"`
-			ConfigReloader struct {
-				Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-config-reloader"`
-				Tag   string `yaml:"tag" env-default:"v0.65.2"`
-			} `yaml:"config_reloader"`
-			KubeRbacProxy struct {
-				Image string `yaml:"image" env-default:"bitnami/kube-rbac-proxy"`
-				Tag   string `yaml:"tag" env-default:"0.14.1"`
-			} `yaml:"kube_rbac_proxy"`
-		} `yaml:"operator"`
-	} `yaml:"prometheus"`
-	AlertManager struct {
-		Enabled                    bool        `yaml:"enabled"`
-		Image                      string      `yaml:"image" env-default:"prom/alertmanager"`
-		Tag                        string      `yaml:"tag" env-default:"v0.26.0"`
-		AdditionalMessageTemplates interface{} `yaml:"additionalMessageTemplates"`
-		Route                      interface{} `yaml:"route"`
-		Receivers                  interface{} `yaml:"receivers"`
-	} `yaml:"alert_manager"`
-	Blackbox struct {
-		Enabled           bool   `yaml:"enabled"`
-		Image             string `yaml:"image" env-default:"prom/blackbox-exporter"`
-		Tag               string `yaml:"tag" env-default:"v0.24.0"`
-		AdditionalModules string `yaml:"routes" env-default:""`
-	} `yaml:"blackbox"`
-	KubeState struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"bitnami/kube-state-metrics"`
-		Tag     string `yaml:"tag" env-default:"2.9.2"`
-	} `yaml:"kube_state"`
-	Node struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"prom/node-exporter"`
-		Tag     string `yaml:"tag" env-default:"v1.5.0"`
-	} `yaml:"node"`
-	MetricsServer struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/metrics-server"`
-		ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
-		Image        string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
-		Tag          string `yaml:"tag" env-default:""`
-	}
-}
-
-type Visualization struct {
-	Enabled bool `yaml:"enabled"`
-	Grafana struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"grafana/grafana"`
-		Tag     string `yaml:"tag" env-default:"10.4.1"`
-		Expose  struct {
-			Type         string `yaml:"type" env-default:"ingress"`
-			Domain       string `yaml:"domain" env-default:""`
-			NodePortHttp int    `yaml:"node_port_http" env-default:"30007"`
-			Tls          struct {
-				Enabled bool `yaml:"enabled"`
-			}
-		} `yaml:"expose"`
-		Persistence struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"2Gi"`
-		} `yaml:"persistence"`
-		Config struct {
-			Auth                  string      `yaml:"auth" env-default:""`
-			AuthGenericAuth       string      `yaml:"auth_generic_auth" env-default:""`
-			AdditionalDatasources interface{} `yaml:"additional_datasources"`
-		} `yaml:"config"`
-	} `yaml:"grafana"`
-}

internal/config/modules_registry.go

@@ -1,32 +0,0 @@
-package config
-
-type Registry struct {
-	ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/harbor"`
-	ChartVersion  string `yaml:"chart_version" env-default:"1.14.2"`
-	Enabled       bool   `yaml:"enabled"`
-	AdminPassword string
-	Namespace     string `yaml:"namespace" env-default:"registry"`
-	Version       string `yaml:"version" env-default:"v2.10.1"`
-	Expose        struct {
-		Type          string `yaml:"type" env-default:"nodePort"`
-		Domain        string `yaml:"domain" env-default:""`
-		NodePortHttp  int    `yaml:"node_port_http" env-default:"30002"`
-		NodePortHttps int    `yaml:"node_port_https" env-default:"30003"`
-	} `yaml:"expose"`
-	Tls struct {
-		Enabled              bool `yaml:"enabled"`
-		CertificateGenerator struct {
-			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/certificate-generator"`
-			ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
-		} `yaml:"certificate_generator"`
-	} `yaml:"tls"`
-	Persistence struct {
-		StorageClass   string `yaml:"storage_class" env-default:"local-path"`
-		RegistrySize   string `yaml:"registry_size" env-default:"10Gi"`
-		JobserviceSize string `yaml:"jobservice_size" env-default:"1Gi"`
-		DatabaseSize   string `yaml:"database_size" env-default:"2Gi"`
-		RedisSize      string `yaml:"redis_size" env-default:"1Gi"`
-		TrivySize      string `yaml:"trivy_size" env-default:"5Gi"`
-	} `yaml:"persistence"`
-	EnabledScanner bool `yaml:"enabled_scanner"`
-}

internal/config/modules_secrets_storage.go

@@ -1,46 +0,0 @@
-package config
-
-type SecretsStorage struct {
-	ChartRef     string   `yaml:"chart_ref" env-default:"kube-forge/vault"`
-	ChartVersion string   `yaml:"chart_version" env-default:"0.1.0"`
-	Enabled      bool     `yaml:"enabled"`
-	KeyShares    int      `yaml:"key_shares" env-default:"5"`
-	KeyThreshold int      `yaml:"key_threshold" env-default:"3"`
-	UnsealKeys   []string `yaml:"unseal_keys" env-default:"[]"`
-	AuthToken    string   `yaml:"auth_token" env-default:""`
-	Expose       struct {
-		Type     string `yaml:"type"`
-		Domain   string `yaml:"domain"`
-		NodePort int    `yaml:"node_port"`
-		Tls      struct {
-			Enabled bool `yaml:"enabled"`
-		} `yaml:"tls"`
-	} `yaml:"expose"`
-	CsiIntegration struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"hashicorp/vault-csi-provider"`
-		Tag     string `yaml:"tag" env-default:"1.4.1"`
-	} `yaml:"csi_integration"`
-	Injector struct {
-		Image string `yaml:"image" env-default:"hashicorp/vault-k8s"`
-		Tag   string `yaml:"tag" env-default:"1.3.1"`
-	} `yaml:"injector"`
-	Server struct {
-		Image       string `yaml:"image" env-default:"hashicorp/vault"`
-		Tag         string `yaml:"tag" env-default:"1.16.0"`
-		Persistence struct {
-			DataStorage struct {
-				StorageClass string `yaml:"storage_class" env-default:"local-path"`
-				Size         string `yaml:"size" env-default:"10Gi"`
-			} `yaml:"data_storage"`
-			AuditStorage struct {
-				StorageClass string `yaml:"storage_class" env-default:"local-path"`
-				Size         string `yaml:"size" env-default:"10Gi"`
-			} `yaml:"audit_storage"`
-		} `yaml:"persistence"`
-	} `yaml:"server"`
-	Agent struct {
-		Image string `yaml:"image" env-default:"hashicorp/vault"`
-		Tag   string `yaml:"tag" env-default:"1.16.0"`
-	} `yaml:"agent"`
-}

internal/config/orchestrator.go

@@ -1,22 +1,33 @@
 package config
 
 type Dns struct {
-	Servers                []string `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"`
-	DisableHostNameservers bool     `yaml:"disable_host_nameservers"`
+	Servers                []string      `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"`
+	DisableHostNameservers bool          `yaml:"disable_host_nameservers"`
+	CoreDNSExternalZones   []interface{} `yaml:"coredns_external_zones"`
+}
+
+type RegistryMirror struct {
+	Host       string `yaml:"host"`
+	SkipVerify bool   `yaml:"skip_verify"`
 }
 
 type Orchestrator struct {
 	Version                   string `yaml:"version" env-default:"v1.29.0"`
-	ClusterName               string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
+	ClusterName               string `yaml:"cluster_name" env-default:"cluster.local"`
 	BinDir                    string `yaml:"bin_dir" env-default:"/usr/local/bin"`
 	SysctlFilePath            string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"`
 	LoadbalancerApiserverPort int    `yaml:"loadbalancer_apiserver_port" env-default:"6443"`
+	ProxyMode                 string `yaml:"proxy_mode" env-default:"ipvs"`
+	ProxyScheduler            string `yaml:"proxy_scheduler" env-default:"rr"`
 	Dns                       Dns    `yaml:"dns"`
 	CloudProvider             string `yaml:"cloud_provider"`
 	ExgernalCloudProvider     string `yaml:"external_cloud_provider"`
+	KubeletDir                string `yaml:"kubelet_dir" env-default:"/var/lib/kubelet"`
 	ContainerEngine           struct {
-		Type    string `yaml:"type" env-default:"containerd"`
-		Install bool   `yaml:"install"`
+		Type     string `yaml:"type" env-default:"containerd"`
+		Install  bool   `yaml:"install"`
+		DataDir  string `yaml:"data_dir" env-default:"/var/lib/containerd"`
+		StateDir string `yaml:"state_dir" env-default:"/run/containerd"`
 	} `yaml:"container_engine"`
 	PingAccessIp             bool   `yaml:"ping_access_ip"`
 	AutoRenewCertificates    bool   `yaml:"auto_renew_certificates"`
@@ -27,5 +38,16 @@ type Orchestrator struct {
 		Plugin           string `yaml:"plugin" env-default:"calico"`
 		ServiceAddresses string `yaml:"service_addresses" env-default:"10.233.0.0/18"`
 		PodsSubnet       string `yaml:"pods_subnet" env-default:"10.233.64.0/18"`
+		Calico           struct {
+			EnableBpf bool `yaml:"enable_bpf"`
+		} `yaml:"calico"`
+		Cilium struct {
+			EnableBpf bool `yaml:"enable_bpf"`
+			Hubble    struct {
+				Install       bool `yaml:"install"`
+				EnableMetrics bool `yaml:"enable_metrics"`
+			} `yaml:"hubble"`
+		} `yaml:"cilium"`
 	} `yaml:"network"`
+	RegistryMirrors []RegistryMirror `yaml:"registry_mirrors"`
 }

internal/config/utility.go

@@ -11,8 +11,3 @@ func getBcryptHash(input string) string {
 	}
 	return string(hashedPassword)
 }
-
-func generateCreds(config *Config) {
-	config.Modules.Cicd.ArgoCd.AdminPassword = getBcryptHash(config.Modules.AdminPassword)
-	config.Modules.Registry.AdminPassword = config.Modules.AdminPassword
-}

internal/csi/helm.go

@@ -0,0 +1,60 @@
+package csi
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getLonghornSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "longhorn",
+		ChartName:       appConfig.Modules.Additional.Storage.Longhorn.ChartRef,
+		Version:         appConfig.Modules.Additional.Storage.Longhorn.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Storage.Longhorn.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl"),
+	}
+}
+
+func getSecretsStoreSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "csi-secrets-store",
+		ChartName:       appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef,
+		Version:         appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos("kube-system", HELM_REPOS)
+	if appConfig.Modules.Additional.Storage.Longhorn.Enabled {
+		helm_client.InstallChart(getLonghornSpec())
+	} else {
+		helm_client.DeleteChart(getLonghornSpec())
+	}
+	if appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled {
+		helm_client.InstallChart(getSecretsStoreSpec())
+	} else {
+		helm_client.DeleteChart(getSecretsStoreSpec())
+	}
+}

internal/helm_client/chart.go

@@ -0,0 +1,32 @@
+package helm_client
+
+import (
+	"context"
+	"kube-forge/internal/config"
+	"kube-forge/internal/logging"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+func InstallChart(chartSpec go_helm_client.ChartSpec) {
+	helmClient := config.GetHelmClient(chartSpec.Namespace)
+	_, error := helmClient.GetRelease(chartSpec.ReleaseName)
+	if error != nil {
+		logging.Log.Infof("Installing %s", chartSpec.ChartName)
+	} else {
+		logging.Log.Infof("Upgrading %s", chartSpec.ChartName)
+	}
+	if _, err := helmClient.InstallOrUpgradeChart(context.Background(), &chartSpec, nil); err != nil {
+		panic(err)
+	}
+}
+
+func DeleteChart(chartSpec go_helm_client.ChartSpec) {
+	helmClient := config.GetHelmClient(chartSpec.Namespace)
+	_, error := helmClient.GetRelease(chartSpec.ReleaseName)
+	if error != nil {
+		return
+	}
+	logging.Log.Warnf("Uninstalling %s", chartSpec.ChartName)
+	helmClient.UninstallRelease(&chartSpec)
+}

internal/helm_client/repo.go

@@ -0,0 +1,27 @@
+package helm_client
+
+import (
+	"kube-forge/internal/config"
+
+	"helm.sh/helm/v3/pkg/repo"
+)
+
+func AddHelmRepo(namespace string, repoSettings config.RepoSettings) {
+	helmClient := config.GetHelmClient(namespace)
+	chartRepo := repo.Entry{
+		Name:     repoSettings.Name,
+		URL:      repoSettings.URL,
+		Username: repoSettings.Username,
+		Password: repoSettings.Password,
+	}
+
+	if err := helmClient.AddOrUpdateChartRepo(chartRepo); err != nil {
+		panic(err)
+	}
+}
+
+func AddHelmRepos(namespace string, helmRepos []config.RepoSettings) {
+	for _, repoSettings := range helmRepos {
+		AddHelmRepo(namespace, repoSettings)
+	}
+}

internal/kubespray/cluster.go

@@ -1,29 +1,29 @@
 package kubespray
 
 import (
-	"fmt"
 	"kube-forge/internal/config"
-	"kube-forge/internal/secrets_storage"
 )
 
 func InstallCluster(tags string) {
+	appConfig := config.GetConfig()
 	runPlaybook("kubespray/project/cluster.yml", tags)
-	CopyK8SAdminConfig("k8s-admin.conf")
-	config := config.GetConfig()
-	if config.Modules.SecretsStorage.Enabled {
-		fmt.Println("## Additional Vault Configuration")
-		secrets_storage.InitVault()
-		secrets_storage.UnsealVault()
-		secrets_storage.AddKubernetesLocalIntegration()
-	}
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
 }
 
 func UpgradeCluster(tags string) {
+	appConfig := config.GetConfig()
 	runPlaybook("kubespray/project/upgrade_cluster.yml", tags)
-	CopyK8SAdminConfig("k8s-admin.conf")
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
 }
 
 func ScaleCluster() {
+	appConfig := config.GetConfig()
 	runPlaybook("kubespray/project/scale.yml", "")
-	CopyK8SAdminConfig("k8s-admin.conf")
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
+}
+
+func ResetCluster() {
+	appConfig := config.GetConfig()
+	runPlaybook("kubespray/project/reset.yml", "")
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
 }

internal/kubespray/utility.go

@@ -56,19 +56,26 @@ func CopyK8SAdminConfig(pathInDataDir string) {
 }
 
 func runPlaybook(playbookPath string, tags string) {
+	config := config.GetConfig()
+	var callbackExecute execute.Executor
+
 	playbookOptions := getPlaybookParameters(tags)
 	playbookCmd := playbook.NewAnsiblePlaybookCmd(
 		playbook.WithPlaybooks(playbookPath),
 		playbook.WithPlaybookOptions(&playbookOptions),
 	)
-	exec := stdoutcallback.NewDebugStdoutCallbackExecute(
-		execute.NewDefaultExecute(
-			execute.WithCmd(playbookCmd),
-			execute.WithErrorEnrich(playbook.NewAnsiblePlaybookErrorEnrich()),
-		),
+	execute := execute.NewDefaultExecute(
+		execute.WithCmd(playbookCmd),
+		execute.WithErrorEnrich(playbook.NewAnsiblePlaybookErrorEnrich()),
 	)
 
-	err := exec.Execute(context.Background())
+	if config.Verbose {
+		callbackExecute = stdoutcallback.NewDebugStdoutCallbackExecute(execute)
+	} else {
+		callbackExecute = stdoutcallback.NewDenseStdoutCallbackExecute(execute)
+	}
+
+	err := callbackExecute.Execute(context.Background())
 	if err != nil {
 		panic(err)
 	}

internal/logging/log.go

@@ -0,0 +1,12 @@
+package logging
+
+import (
+	"github.com/sirupsen/logrus"
+)
+
+var Log = logrus.New()
+
+func init() {
+	Log.SetLevel(logrus.InfoLevel)
+	Log.SetFormatter(&logrus.TextFormatter{})
+}

internal/registry/commands.go

@@ -1,9 +0,0 @@
-package registry
-
-func CreateDockerRepositories() {
-
-}
-
-func CreateHelmRepositories() {
-
-}

internal/resources/templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl

@@ -1,14 +1,2 @@
-- name: docker-secrets-generator
-  namespace: kube-system
-  chart_ref: {{ .Modules.Additional.DockerSecrets.ChartRef }}
-  chart_version: {{ .Modules.Additional.DockerSecrets.ChartVersion }}
-  {{- if .Modules.Additional.DockerSecrets.Repositories }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-    {{- if .Modules.Additional.DockerSecrets.Repositories }}
-  values:
-    repositories:
-      {{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}
-    {{- end }}
+repositories:
+  {{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}

internal/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl

@@ -1,490 +1,479 @@
-- name: longhorn
-  namespace: longhorn-system
-  create_namespace: true
-  chart_ref: {{ .Modules.Additional.Storage.Longhorn.ChartRef }}
-  chart_version: {{ .Modules.Additional.Storage.Longhorn.ChartVersion }}
-  {{- if .Modules.Additional.Storage.Longhorn.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    global:
-      cattle:
-        # -- Default system registry.
-        systemDefaultRegistry: ""
-        windowsCluster:
-          # -- Setting that allows Longhorn to run on a Rancher Windows cluster.
-          enabled: false
-          # -- Toleration for Linux nodes that can run user-deployed Longhorn components.
-          tolerations:
-          - key: "cattle.io/os"
-            value: "linux"
-            effect: "NoSchedule"
-            operator: "Equal"
-          # -- Node selector for Linux nodes that can run user-deployed Longhorn components.
-          nodeSelector:
-            kubernetes.io/os: "linux"
-          defaultSetting:
-            # -- Toleration for system-managed Longhorn components.
-            taintToleration: cattle.io/os=linux:NoSchedule
-            # -- Node selector for system-managed Longhorn components.
-            systemManagedComponentsNodeSelector: kubernetes.io/os:linux
-
-    networkPolicies:
-      # -- Setting that allows you to enable network policies that control access to Longhorn pods.
+global:
+  cattle:
+    # -- Default system registry.
+    systemDefaultRegistry: ""
+    windowsCluster:
+      # -- Setting that allows Longhorn to run on a Rancher Windows cluster.
       enabled: false
-      # -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
-      type: "k3s"
+      # -- Toleration for Linux nodes that can run user-deployed Longhorn components.
+      tolerations:
+        - key: "cattle.io/os"
+          value: "linux"
+          effect: "NoSchedule"
+          operator: "Equal"
+      # -- Node selector for Linux nodes that can run user-deployed Longhorn components.
+      nodeSelector:
+        kubernetes.io/os: "linux"
+      defaultSetting:
+        # -- Toleration for system-managed Longhorn components.
+        taintToleration: cattle.io/os=linux:NoSchedule
+        # -- Node selector for system-managed Longhorn components.
+        systemManagedComponentsNodeSelector: kubernetes.io/os:linux
 
-    image:
-      longhorn:
-        engine:
-          # -- Repository for the Longhorn Engine image.
-          repository: longhornio/longhorn-engine
-          # -- Specify Longhorn engine image tag
-          tag: v1.6.1
-        manager:
-          # -- Repository for the Longhorn Manager image.
-          repository: longhornio/longhorn-manager
-          # -- Specify Longhorn manager image tag
-          tag: v1.6.1
-        ui:
-          # -- Repository for the Longhorn UI image.
-          repository: longhornio/longhorn-ui
-          # -- Specify Longhorn ui image tag
-          tag: v1.6.1
-        instanceManager:
-          # -- Repository for the Longhorn Instance Manager image.
-          repository: longhornio/longhorn-instance-manager
-          # -- Specify Longhorn instance manager image tag
-          tag: v1.6.1
-        shareManager:
-          # -- Repository for the Longhorn Share Manager image.
-          repository: longhornio/longhorn-share-manager
-          # -- Specify Longhorn share manager image tag
-          tag: v1.6.1
-        backingImageManager:
-          # -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/backing-image-manager
-          # -- Specify Longhorn backing image manager image tag
-          tag: v1.6.1
-        supportBundleKit:
-          # -- Repository for the Longhorn Support Bundle Manager image.
-          repository: longhornio/support-bundle-kit
-          # -- Tag for the Longhorn Support Bundle Manager image.
-          tag: v0.0.36
-      csi:
-        attacher:
-          # -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-attacher
-          # -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
-          tag: v4.4.2
-        provisioner:
-          # -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-provisioner
-          # -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
-          tag: v3.6.2
-        nodeDriverRegistrar:
-          # -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-node-driver-registrar
-          # -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
-          tag: v2.9.2
-        resizer:
-          # -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-resizer
-          # -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
-          tag: v1.9.2
-        snapshotter:
-          # -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/csi-snapshotter
-          # -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
-          tag: v6.3.2
-        livenessProbe:
-          # -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
-          repository: longhornio/livenessprobe
-          # -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
-          tag: v2.12.0
-      openshift:
-        oauthProxy:
-          # -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
-          repository: quay.io/openshift/origin-oauth-proxy
-          # -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
-          tag: 4.14
-      # -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
-      pullPolicy: IfNotPresent
+networkPolicies:
+  # -- Setting that allows you to enable network policies that control access to Longhorn pods.
+  enabled: false
+  # -- Distribution that determines the policy for allowing access for an ingress. (Options: "k3s", "rke2", "rke1")
+  type: "k3s"
 
-    service:
-      ui:
-        # -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
-        type: ClusterIP
-        # -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
-        nodePort: null
-      manager:
-        # -- Service type for Longhorn Manager.
-        type: ClusterIP
-        # -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
-        nodePort: ""
+image:
+  longhorn:
+    engine:
+      # -- Repository for the Longhorn Engine image.
+      repository: longhornio/longhorn-engine
+      # -- Specify Longhorn engine image tag
+      tag: v1.6.1
+    manager:
+      # -- Repository for the Longhorn Manager image.
+      repository: longhornio/longhorn-manager
+      # -- Specify Longhorn manager image tag
+      tag: v1.6.1
+    ui:
+      # -- Repository for the Longhorn UI image.
+      repository: longhornio/longhorn-ui
+      # -- Specify Longhorn ui image tag
+      tag: v1.6.1
+    instanceManager:
+      # -- Repository for the Longhorn Instance Manager image.
+      repository: longhornio/longhorn-instance-manager
+      # -- Specify Longhorn instance manager image tag
+      tag: v1.6.1
+    shareManager:
+      # -- Repository for the Longhorn Share Manager image.
+      repository: longhornio/longhorn-share-manager
+      # -- Specify Longhorn share manager image tag
+      tag: v1.6.1
+    backingImageManager:
+      # -- Repository for the Backing Image Manager image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/backing-image-manager
+      # -- Specify Longhorn backing image manager image tag
+      tag: v1.6.1
+    supportBundleKit:
+      # -- Repository for the Longhorn Support Bundle Manager image.
+      repository: longhornio/support-bundle-kit
+      # -- Tag for the Longhorn Support Bundle Manager image.
+      tag: v0.0.36
+  csi:
+    attacher:
+      # -- Repository for the CSI attacher image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-attacher
+      # -- Tag for the CSI attacher image. When unspecified, Longhorn uses the default value.
+      tag: v4.4.2
+    provisioner:
+      # -- Repository for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-provisioner
+      # -- Tag for the CSI Provisioner image. When unspecified, Longhorn uses the default value.
+      tag: v3.6.2
+    nodeDriverRegistrar:
+      # -- Repository for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-node-driver-registrar
+      # -- Tag for the CSI Node Driver Registrar image. When unspecified, Longhorn uses the default value.
+      tag: v2.9.2
+    resizer:
+      # -- Repository for the CSI Resizer image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-resizer
+      # -- Tag for the CSI Resizer image. When unspecified, Longhorn uses the default value.
+      tag: v1.9.2
+    snapshotter:
+      # -- Repository for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/csi-snapshotter
+      # -- Tag for the CSI Snapshotter image. When unspecified, Longhorn uses the default value.
+      tag: v6.3.2
+    livenessProbe:
+      # -- Repository for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
+      repository: longhornio/livenessprobe
+      # -- Tag for the CSI liveness probe image. When unspecified, Longhorn uses the default value.
+      tag: v2.12.0
+  openshift:
+    oauthProxy:
+      # -- Repository for the OAuth Proxy image. This setting applies only to OpenShift users.
+      repository: quay.io/openshift/origin-oauth-proxy
+      # -- Tag for the OAuth Proxy image. This setting applies only to OpenShift users. Specify OCP/OKD version 4.1 or later. The latest stable version is 4.14.
+      tag: 4.14
+  # -- Image pull policy that applies to all user-deployed Longhorn components, such as Longhorn Manager, Longhorn driver, and Longhorn UI.
+  pullPolicy: IfNotPresent
 
-    persistence:
-      # -- Setting that allows you to specify the default Longhorn StorageClass.
-      defaultClass: true
-      # -- Filesystem type of the default Longhorn StorageClass.
-      defaultFsType: ext4
-      # -- mkfs parameters of the default Longhorn StorageClass.
-      defaultMkfsParams: ""
-      # -- Replica count of the default Longhorn StorageClass.
-      defaultClassReplicaCount: 3
-      # -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
-      defaultDataLocality: disabled
-      # -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
-      reclaimPolicy: Delete
-      # -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
-      migratable: false
-      # -- Set NFS mount options for Longhorn StorageClass for RWX volumes
-      nfsOptions: ""
-      recurringJobSelector:
-        # -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
-        enable: false
-        # -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
-        jobList: []
-      backingImage:
-        # -- Setting that allows you to use a backing image in a Longhorn StorageClass.
-        enable: false
-        # -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
-        name: ~
-        # -- Data source type of a backing image used in a Longhorn StorageClass.
-        # If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
-        # If the backing image does not exist, Longhorn creates one using the specified data source type.
-        dataSourceType: ~
-        # -- Data source parameters of a backing image used in a Longhorn StorageClass.
-        # You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
-        dataSourceParameters: ~
-        # -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
-        expectedChecksum: ~
-      defaultNodeSelector:
-        # -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
-        enable: false
-        # -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
-        selector: ""
-      # -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
-      removeSnapshotsDuringFilesystemTrim: ignored
+service:
+  ui:
+    # -- Service type for Longhorn UI. (Options: "ClusterIP", "NodePort", "LoadBalancer", "Rancher-Proxy")
+    type: ClusterIP
+    # -- NodePort port number for Longhorn UI. When unspecified, Longhorn selects a free port between 30000 and 32767.
+    nodePort: null
+  manager:
+    # -- Service type for Longhorn Manager.
+    type: ClusterIP
+    # -- NodePort port number for Longhorn Manager. When unspecified, Longhorn selects a free port between 30000 and 32767.
+    nodePort: ""
 
-    preUpgradeChecker:
-      # -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
-      jobEnabled: true
-      # -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
-      upgradeVersionCheck: true
+persistence:
+  # -- Setting that allows you to specify the default Longhorn StorageClass.
+  defaultClass: true
+  # -- Filesystem type of the default Longhorn StorageClass.
+  defaultFsType: ext4
+  # -- mkfs parameters of the default Longhorn StorageClass.
+  defaultMkfsParams: ""
+  # -- Replica count of the default Longhorn StorageClass.
+  defaultClassReplicaCount: 3
+  # -- Data locality of the default Longhorn StorageClass. (Options: "disabled", "best-effort")
+  defaultDataLocality: disabled
+  # -- Reclaim policy that provides instructions for handling of a volume after its claim is released. (Options: "Retain", "Delete")
+  reclaimPolicy: Delete
+  # -- Setting that allows you to enable live migration of a Longhorn volume from one node to another.
+  migratable: false
+  # -- Set NFS mount options for Longhorn StorageClass for RWX volumes
+  nfsOptions: ""
+  recurringJobSelector:
+    # -- Setting that allows you to enable the recurring job selector for a Longhorn StorageClass.
+    enable: false
+    # -- Recurring job selector for a Longhorn StorageClass. Ensure that quotes are used correctly when specifying job parameters. (Example: `[{"name":"backup", "isGroup":true}]`)
+    jobList: []
+  backingImage:
+    # -- Setting that allows you to use a backing image in a Longhorn StorageClass.
+    enable: false
+    # -- Backing image to be used for creating and restoring volumes in a Longhorn StorageClass. When no backing images are available, specify the data source type and parameters that Longhorn can use to create a backing image.
+    name: ~
+    # -- Data source type of a backing image used in a Longhorn StorageClass.
+    # If the backing image exists in the cluster, Longhorn uses this setting to verify the image.
+    # If the backing image does not exist, Longhorn creates one using the specified data source type.
+    dataSourceType: ~
+    # -- Data source parameters of a backing image used in a Longhorn StorageClass.
+    # You can specify a JSON string of a map. (Example: `'{\"url\":\"https://backing-image-example.s3-region.amazonaws.com/test-backing-image\"}'`)
+    dataSourceParameters: ~
+    # -- Expected SHA-512 checksum of a backing image used in a Longhorn StorageClass.
+    expectedChecksum: ~
+  defaultNodeSelector:
+    # -- Setting that allows you to enable the node selector for the default Longhorn StorageClass.
+    enable: false
+    # -- Node selector for the default Longhorn StorageClass. Longhorn uses only nodes with the specified tags for storing volume data. (Examples: "storage,fast")
+    selector: ""
+  # -- Setting that allows you to enable automatic snapshot removal during filesystem trim for a Longhorn StorageClass. (Options: "ignored", "enabled", "disabled")
+  removeSnapshotsDuringFilesystemTrim: ignored
 
-    csi:
-      # -- kubelet root directory. When unspecified, Longhorn uses the default value.
-      kubeletRootDir: ~
-      # -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
-      attacherReplicaCount: ~
-      # -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
-      provisionerReplicaCount: ~
-      # -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
-      resizerReplicaCount: ~
-      # -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
-      snapshotterReplicaCount: ~
+preUpgradeChecker:
+  # -- Setting that allows Longhorn to perform pre-upgrade checks. Disable this setting when installing Longhorn using Argo CD or other GitOps solutions.
+  jobEnabled: true
+  # -- Setting that allows Longhorn to perform upgrade version checks after starting the Longhorn Manager DaemonSet Pods. Disabling this setting also disables `preUpgradeChecker.jobEnabled`. Longhorn recommends keeping this setting enabled.
+  upgradeVersionCheck: true
 
-    defaultSettings:
-      # -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
-      backupTarget: ~
-      # -- Name of the Kubernetes secret associated with the backup target.
-      backupTargetCredentialSecret: ~
-      # -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
-      allowRecurringJobWhileVolumeDetached: ~
-      # -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
-      createDefaultDiskLabeledNodes: ~
-      # -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
-      defaultDataPath: ~
-      # -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
-      defaultDataLocality: ~
-      # -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
-      replicaSoftAntiAffinity: ~
-      # -- Setting that automatically rebalances replicas when an available node is discovered.
-      replicaAutoBalance: ~
-      # -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
-      storageOverProvisioningPercentage: ~
-      # -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
-      storageMinimalAvailablePercentage: ~
-      # -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
-      storageReservedPercentageForDefaultDisk: ~
-      # -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
-      upgradeChecker: ~
-      # -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
-      defaultReplicaCount: ~
-      # -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
-      defaultLonghornStaticStorageClass: ~
-      # -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
-      backupstorePollInterval: ~
-      # -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
-      failedBackupTTL: ~
-      # -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
-      restoreVolumeRecurringJobs: ~
-      # -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
-      recurringSuccessfulJobsHistoryLimit: ~
-      # -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
-      recurringFailedJobsHistoryLimit: ~
-      # -- Maximum number of snapshots or backups to be retained.
-      recurringJobMaxRetention: ~
-      # -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
-      supportBundleFailedHistoryLimit: ~
-      # -- Taint or toleration for system-managed Longhorn components.
-      taintToleration: ~
-      # -- Node selector for system-managed Longhorn components.
-      systemManagedComponentsNodeSelector: ~
-      # -- PriorityClass for system-managed Longhorn components.
-      # This setting can help prevent Longhorn components from being evicted under Node Pressure.
-      # Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
-      priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
-      # -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
-      autoSalvage: ~
-      # -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
-      autoDeletePodWhenVolumeDetachedUnexpectedly: ~
-      # -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
-      disableSchedulingOnCordonedNode: ~
-      # -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
-      replicaZoneSoftAntiAffinity: ~
-      # -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
-      replicaDiskSoftAntiAffinity: ~
-      # -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
-      nodeDownPodDeletionPolicy: ~
-      # -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
-      nodeDrainPolicy: ~
-      # -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
-      detachManuallyAttachedVolumesWhenCordoned: ~
-      # -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
-      replicaReplenishmentWaitInterval: ~
-      # -- Maximum number of replicas that can be concurrently rebuilt on each node.
-      concurrentReplicaRebuildPerNodeLimit: ~
-      # -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
-      concurrentVolumeBackupRestorePerNodeLimit: ~
-      # -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
-      disableRevisionCounter: ~
-      # -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
-      systemManagedPodsImagePullPolicy: ~
-      # -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
-      allowVolumeCreationWithDegradedAvailability: ~
-      # -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
-      autoCleanupSystemGeneratedSnapshot: ~
-      # -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
-      autoCleanupRecurringJobBackupSnapshot: ~
-      # -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
-      concurrentAutomaticEngineUpgradePerNodeLimit: ~
-      # -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
-      backingImageCleanupWaitInterval: ~
-      # -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
-      backingImageRecoveryWaitInterval: ~
-      # -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
-      guaranteedInstanceManagerCPU: ~
-      # -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
-      kubernetesClusterAutoscalerEnabled: ~
-      # -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
-      orphanAutoDeletion: ~
-      # -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
-      storageNetwork: ~
-      # -- Flag that prevents accidental uninstallation of Longhorn.
-      deletingConfirmationFlag: ~
-      # -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
-      engineReplicaTimeout: ~
-      # -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
-      snapshotDataIntegrity: ~
-      # -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
-      snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
-      # -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
-      snapshotDataIntegrityCronjob: ~
-      # -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
-      removeSnapshotsDuringFilesystemTrim: ~
-      # -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
-      fastReplicaRebuildEnabled: ~
-      # -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
-      replicaFileSyncHttpClientTimeout: ~
-      # -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
-      logLevel: ~
-      # -- Setting that allows you to specify a backup compression method.
-      backupCompressionMethod: ~
-      # -- Maximum number of worker threads that can concurrently run for each backup.
-      backupConcurrentLimit: ~
-      # -- Maximum number of worker threads that can concurrently run for each restore operation.
-      restoreConcurrentLimit: ~
-      # -- Setting that allows you to enable the V1 Data Engine.
-      v1DataEngine: ~
-      # -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
-      v2DataEngine: ~
-      # -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
-      v2DataEngineHugepageLimit: ~
-      # -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
-      offlineReplicaRebuilding: ~
-      # -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
-      v2DataEngineGuaranteedInstanceManagerCPU: ~
-      # -- Setting that allows scheduling of empty node selector volumes to any node.
-      allowEmptyNodeSelectorVolume: ~
-      # -- Setting that allows scheduling of empty disk selector volumes to any disk.
-      allowEmptyDiskSelectorVolume: ~
-      # -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
-      allowCollectingLonghornUsageMetrics: ~
-      # -- Setting that temporarily prevents all attempts to purge volume snapshots.
-      disableSnapshotPurge: ~
-      # -- Maximum snapshot count for a volume. The value should be between 2 to 250
-      snapshotMaxCount: ~
+csi:
+  # -- kubelet root directory. When unspecified, Longhorn uses the default value.
+  kubeletRootDir: ~
+  # -- Replica count of the CSI Attacher. When unspecified, Longhorn uses the default value ("3").
+  attacherReplicaCount: ~
+  # -- Replica count of the CSI Provisioner. When unspecified, Longhorn uses the default value ("3").
+  provisionerReplicaCount: ~
+  # -- Replica count of the CSI Resizer. When unspecified, Longhorn uses the default value ("3").
+  resizerReplicaCount: ~
+  # -- Replica count of the CSI Snapshotter. When unspecified, Longhorn uses the default value ("3").
+  snapshotterReplicaCount: ~
 
-    privateRegistry:
-      # -- Setting that allows you to create a private registry secret.
-      createSecret: ~
-      # -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
-      registryUrl: ~
-      # -- User account used for authenticating with a private registry.
-      registryUser: ~
-      # -- Password for authenticating with a private registry.
-      registryPasswd: ~
-      # -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
-      registrySecret: ~
+defaultSettings:
+  # -- Endpoint used to access the backupstore. (Options: "NFS", "CIFS", "AWS", "GCP", "AZURE")
+  backupTarget: ~
+  # -- Name of the Kubernetes secret associated with the backup target.
+  backupTargetCredentialSecret: ~
+  # -- Setting that allows Longhorn to automatically attach a volume and create snapshots or backups when recurring jobs are run.
+  allowRecurringJobWhileVolumeDetached: ~
+  # -- Setting that allows Longhorn to automatically create a default disk only on nodes with the label "node.longhorn.io/create-default-disk=true" (if no other disks exist). When this setting is disabled, Longhorn creates a default disk on each node that is added to the cluster.
+  createDefaultDiskLabeledNodes: ~
+  # -- Default path for storing data on a host. The default value is "/var/lib/longhorn/".
+  defaultDataPath: ~
+  # -- Default data locality. A Longhorn volume has data locality if a local replica of the volume exists on the same node as the pod that is using the volume.
+  defaultDataLocality: ~
+  # -- Setting that allows scheduling on nodes with healthy replicas of the same volume. This setting is disabled by default.
+  replicaSoftAntiAffinity: ~
+  # -- Setting that automatically rebalances replicas when an available node is discovered.
+  replicaAutoBalance: ~
+  # -- Percentage of storage that can be allocated relative to hard drive capacity. The default value is "100".
+  storageOverProvisioningPercentage: ~
+  # -- Percentage of minimum available disk capacity. When the minimum available capacity exceeds the total available capacity, the disk becomes unschedulable until more space is made available for use. The default value is "25".
+  storageMinimalAvailablePercentage: ~
+  # -- Percentage of disk space that is not allocated to the default disk on each new Longhorn node.
+  storageReservedPercentageForDefaultDisk: ~
+  # -- Upgrade Checker that periodically checks for new Longhorn versions. When a new version is available, a notification appears on the Longhorn UI. This setting is enabled by default
+  upgradeChecker: ~
+  # -- Default number of replicas for volumes created using the Longhorn UI. For Kubernetes configuration, modify the `numberOfReplicas` field in the StorageClass. The default value is "3".
+  defaultReplicaCount: ~
+  # -- Default Longhorn StorageClass. "storageClassName" is assigned to PVs and PVCs that are created for an existing Longhorn volume. "storageClassName" can also be used as a label, so it is possible to use a Longhorn StorageClass to bind a workload to an existing PV without creating a Kubernetes StorageClass object. The default value is "longhorn-static".
+  defaultLonghornStaticStorageClass: ~
+  # -- Number of seconds that Longhorn waits before checking the backupstore for new backups. The default value is "300". When the value is "0", polling is disabled.
+  backupstorePollInterval: ~
+  # -- Number of minutes that Longhorn keeps a failed backup resource. When the value is "0", automatic deletion is disabled.
+  failedBackupTTL: ~
+  # -- Setting that restores recurring jobs from a backup volume on a backup target and creates recurring jobs if none exist during backup restoration.
+  restoreVolumeRecurringJobs: ~
+  # -- Maximum number of successful recurring backup and snapshot jobs to be retained. When the value is "0", a history of successful recurring jobs is not retained.
+  recurringSuccessfulJobsHistoryLimit: ~
+  # -- Maximum number of failed recurring backup and snapshot jobs to be retained. When the value is "0", a history of failed recurring jobs is not retained.
+  recurringFailedJobsHistoryLimit: ~
+  # -- Maximum number of snapshots or backups to be retained.
+  recurringJobMaxRetention: ~
+  # -- Maximum number of failed support bundles that can exist in the cluster. When the value is "0", Longhorn automatically purges all failed support bundles.
+  supportBundleFailedHistoryLimit: ~
+  # -- Taint or toleration for system-managed Longhorn components.
+  taintToleration: ~
+  # -- Node selector for system-managed Longhorn components.
+  systemManagedComponentsNodeSelector: ~
+  # -- PriorityClass for system-managed Longhorn components.
+  # This setting can help prevent Longhorn components from being evicted under Node Pressure.
+  # Notice that this will be applied to Longhorn user-deployed components by default if there are no priority class values set yet, such as `longhornManager.priorityClass`.
+  priorityClass: &defaultPriorityClassNameRef "longhorn-critical"
+  # -- Setting that allows Longhorn to automatically salvage volumes when all replicas become faulty (for example, when the network connection is interrupted). Longhorn determines which replicas are usable and then uses these replicas for the volume. This setting is enabled by default.
+  autoSalvage: ~
+  # -- Setting that allows Longhorn to automatically delete a workload pod that is managed by a controller (for example, daemonset) whenever a Longhorn volume is detached unexpectedly (for example, during Kubernetes upgrades). After deletion, the controller restarts the pod and then Kubernetes handles volume reattachment and remounting.
+  autoDeletePodWhenVolumeDetachedUnexpectedly: ~
+  # -- Setting that prevents Longhorn Manager from scheduling replicas on a cordoned Kubernetes node. This setting is enabled by default.
+  disableSchedulingOnCordonedNode: ~
+  # -- Setting that allows Longhorn to schedule new replicas of a volume to nodes in the same zone as existing healthy replicas. Nodes that do not belong to any zone are treated as existing in the zone that contains healthy replicas. When identifying zones, Longhorn relies on the label "topology.kubernetes.io/zone=<Zone name of the node>" in the Kubernetes node object.
+  replicaZoneSoftAntiAffinity: ~
+  # -- Setting that allows scheduling on disks with existing healthy replicas of the same volume. This setting is enabled by default.
+  replicaDiskSoftAntiAffinity: ~
+  # -- Policy that defines the action Longhorn takes when a volume is stuck with a StatefulSet or Deployment pod on a node that failed.
+  nodeDownPodDeletionPolicy: ~
+  # -- Policy that defines the action Longhorn takes when a node with the last healthy replica of a volume is drained.
+  nodeDrainPolicy: ~
+  # -- Setting that allows automatic detaching of manually-attached volumes when a node is cordoned.
+  detachManuallyAttachedVolumesWhenCordoned: ~
+  # -- Number of seconds that Longhorn waits before reusing existing data on a failed replica instead of creating a new replica of a degraded volume.
+  replicaReplenishmentWaitInterval: ~
+  # -- Maximum number of replicas that can be concurrently rebuilt on each node.
+  concurrentReplicaRebuildPerNodeLimit: ~
+  # -- Maximum number of volumes that can be concurrently restored on each node using a backup. When the value is "0", restoration of volumes using a backup is disabled.
+  concurrentVolumeBackupRestorePerNodeLimit: ~
+  # -- Setting that disables the revision counter and thereby prevents Longhorn from tracking all write operations to a volume. When salvaging a volume, Longhorn uses properties of the "volume-head-xxx.img" file (the last file size and the last time the file was modified) to select the replica to be used for volume recovery. This setting applies only to volumes created using the Longhorn UI.
+  disableRevisionCounter: ~
+  # -- Image pull policy for system-managed pods, such as Instance Manager, engine images, and CSI Driver. Changes to the image pull policy are applied only after the system-managed pods restart.
+  systemManagedPodsImagePullPolicy: ~
+  # -- Setting that allows you to create and attach a volume without having all replicas scheduled at the time of creation.
+  allowVolumeCreationWithDegradedAvailability: ~
+  # -- Setting that allows Longhorn to automatically clean up the system-generated snapshot after replica rebuilding is completed.
+  autoCleanupSystemGeneratedSnapshot: ~
+  # -- Setting that allows Longhorn to automatically clean up the snapshot generated by a recurring backup job.
+  autoCleanupRecurringJobBackupSnapshot: ~
+  # -- Maximum number of engines that are allowed to concurrently upgrade on each node after Longhorn Manager is upgraded. When the value is "0", Longhorn does not automatically upgrade volume engines to the new default engine image version.
+  concurrentAutomaticEngineUpgradePerNodeLimit: ~
+  # -- Number of minutes that Longhorn waits before cleaning up the backing image file when no replicas in the disk are using it.
+  backingImageCleanupWaitInterval: ~
+  # -- Number of seconds that Longhorn waits before downloading a backing image file again when the status of all image disk files changes to "failed" or "unknown".
+  backingImageRecoveryWaitInterval: ~
+  # -- Percentage of the total allocatable CPU resources on each node to be reserved for each instance manager pod when the V1 Data Engine is enabled. The default value is "12".
+  guaranteedInstanceManagerCPU: ~
+  # -- Setting that notifies Longhorn that the cluster is using the Kubernetes Cluster Autoscaler.
+  kubernetesClusterAutoscalerEnabled: ~
+  # -- Setting that allows Longhorn to automatically delete an orphaned resource and the corresponding data (for example, stale replicas). Orphaned resources on failed or unknown nodes are not automatically cleaned up.
+  orphanAutoDeletion: ~
+  # -- Storage network for in-cluster traffic. When unspecified, Longhorn uses the Kubernetes cluster network.
+  storageNetwork: ~
+  # -- Flag that prevents accidental uninstallation of Longhorn.
+  deletingConfirmationFlag: ~
+  # -- Timeout between the Longhorn Engine and replicas. Specify a value between "8" and "30" seconds. The default value is "8".
+  engineReplicaTimeout: ~
+  # -- Setting that allows you to enable and disable snapshot hashing and data integrity checks.
+  snapshotDataIntegrity: ~
+  # -- Setting that allows disabling of snapshot hashing after snapshot creation to minimize impact on system performance.
+  snapshotDataIntegrityImmediateCheckAfterSnapshotCreation: ~
+  # -- Setting that defines when Longhorn checks the integrity of data in snapshot disk files. You must use the Unix cron expression format.
+  snapshotDataIntegrityCronjob: ~
+  # -- Setting that allows Longhorn to automatically mark the latest snapshot and its parent files as removed during a filesystem trim. Longhorn does not remove snapshots containing multiple child files.
+  removeSnapshotsDuringFilesystemTrim: ~
+  # -- Setting that allows fast rebuilding of replicas using the checksum of snapshot disk files. Before enabling this setting, you must set the snapshot-data-integrity value to "enable" or "fast-check".
+  fastReplicaRebuildEnabled: ~
+  # -- Number of seconds that an HTTP client waits for a response from a File Sync server before considering the connection to have failed.
+  replicaFileSyncHttpClientTimeout: ~
+  # -- Log levels that indicate the type and severity of logs in Longhorn Manager. The default value is "Info". (Options: "Panic", "Fatal", "Error", "Warn", "Info", "Debug", "Trace")
+  logLevel: ~
+  # -- Setting that allows you to specify a backup compression method.
+  backupCompressionMethod: ~
+  # -- Maximum number of worker threads that can concurrently run for each backup.
+  backupConcurrentLimit: ~
+  # -- Maximum number of worker threads that can concurrently run for each restore operation.
+  restoreConcurrentLimit: ~
+  # -- Setting that allows you to enable the V1 Data Engine.
+  v1DataEngine: ~
+  # -- Setting that allows you to enable the V2 Data Engine, which is based on the Storage Performance Development Kit (SPDK). The V2 Data Engine is a preview feature and should not be used in production environments.
+  v2DataEngine: ~
+  # -- Setting that allows you to configure maximum huge page size (in MiB) for the V2 Data Engine.
+  v2DataEngineHugepageLimit: ~
+  # -- Setting that allows rebuilding of offline replicas for volumes using the V2 Data Engine.
+  offlineReplicaRebuilding: ~
+  # -- Number of millicpus on each node to be reserved for each Instance Manager pod when the V2 Data Engine is enabled. The default value is "1250".
+  v2DataEngineGuaranteedInstanceManagerCPU: ~
+  # -- Setting that allows scheduling of empty node selector volumes to any node.
+  allowEmptyNodeSelectorVolume: ~
+  # -- Setting that allows scheduling of empty disk selector volumes to any disk.
+  allowEmptyDiskSelectorVolume: ~
+  # -- Setting that allows Longhorn to periodically collect anonymous usage data for product improvement purposes. Longhorn sends collected data to the [Upgrade Responder](https://github.com/longhorn/upgrade-responder) server, which is the data source of the Longhorn Public Metrics Dashboard (https://metrics.longhorn.io). The Upgrade Responder server does not store data that can be used to identify clients, including IP addresses.
+  allowCollectingLonghornUsageMetrics: ~
+  # -- Setting that temporarily prevents all attempts to purge volume snapshots.
+  disableSnapshotPurge: ~
+  # -- Maximum snapshot count for a volume. The value should be between 2 to 250
+  snapshotMaxCount: ~
 
-    longhornManager:
-      log:
-        # -- Format of Longhorn Manager logs. (Options: "plain", "json")
-        format: plain
-      # -- PriorityClass for Longhorn Manager.
-      priorityClass: *defaultPriorityClassNameRef
-      # -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
-      tolerations: []
-      ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
-      ## and uncomment this example block
-      # - key: "key"
-      #   operator: "Equal"
-      #   value: "value"
-      #   effect: "NoSchedule"
-      # -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
-      nodeSelector: {}
-      ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
-      ## and uncomment this example block
-      #  label-key1: "label-value1"
-      #  label-key2: "label-value2"
-      # -- Annotation for the Longhorn Manager service.
-      serviceAnnotations: {}
-      ## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
-      ## and uncomment this example block
-      #  annotation-key1: "annotation-value1"
-      #  annotation-key2: "annotation-value2"
+privateRegistry:
+  # -- Setting that allows you to create a private registry secret.
+  createSecret: ~
+  # -- URL of a private registry. When unspecified, Longhorn uses the default system registry.
+  registryUrl: ~
+  # -- User account used for authenticating with a private registry.
+  registryUser: ~
+  # -- Password for authenticating with a private registry.
+  registryPasswd: ~
+  # -- Kubernetes secret that allows you to pull images from a private registry. This setting applies only when creation of private registry secrets is enabled. You must include the private registry name in the secret name.
+  registrySecret: ~
 
-    longhornDriver:
-      # -- PriorityClass for Longhorn Driver.
-      priorityClass: *defaultPriorityClassNameRef
-      # -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
-      tolerations: []
-      ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
-      ## and uncomment this example block
-      # - key: "key"
-      #   operator: "Equal"
-      #   value: "value"
-      #   effect: "NoSchedule"
-      # -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
-      nodeSelector: {}
-      ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
-      ## and uncomment this example block
-      #  label-key1: "label-value1"
-      #  label-key2: "label-value2"
+longhornManager:
+  log:
+    # -- Format of Longhorn Manager logs. (Options: "plain", "json")
+    format: plain
+  # -- PriorityClass for Longhorn Manager.
+  priorityClass: *defaultPriorityClassNameRef
+  # -- Toleration for Longhorn Manager on nodes allowed to run Longhorn Manager.
+  tolerations: []
+  ## If you want to set tolerations for Longhorn Manager DaemonSet, delete the `[]` in the line above
+  ## and uncomment this example block
+  # - key: "key"
+  #   operator: "Equal"
+  #   value: "value"
+  #   effect: "NoSchedule"
+  # -- Node selector for Longhorn Manager. Specify the nodes allowed to run Longhorn Manager.
+  nodeSelector: {}
+  ## If you want to set node selector for Longhorn Manager DaemonSet, delete the `{}` in the line above
+  ## and uncomment this example block
+  #  label-key1: "label-value1"
+  #  label-key2: "label-value2"
+  # -- Annotation for the Longhorn Manager service.
+  serviceAnnotations: {}
+  ## If you want to set annotations for the Longhorn Manager service, delete the `{}` in the line above
+  ## and uncomment this example block
+  #  annotation-key1: "annotation-value1"
+  #  annotation-key2: "annotation-value2"
 
-    longhornUI:
-      # -- Replica count for Longhorn UI.
-      replicas: 2
-      # -- PriorityClass for Longhorn UI.
-      priorityClass: *defaultPriorityClassNameRef
-      # -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
-      tolerations: []
-      ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
-      ## and uncomment this example block
-      # - key: "key"
-      #   operator: "Equal"
-      #   value: "value"
-      #   effect: "NoSchedule"
-      # -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
-      nodeSelector: {}
-      ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
-      ## and uncomment this example block
-      #  label-key1: "label-value1"
-      #  label-key2: "label-value2"
+longhornDriver:
+  # -- PriorityClass for Longhorn Driver.
+  priorityClass: *defaultPriorityClassNameRef
+  # -- Toleration for Longhorn Driver on nodes allowed to run Longhorn components.
+  tolerations: []
+  ## If you want to set tolerations for Longhorn Driver Deployer Deployment, delete the `[]` in the line above
+  ## and uncomment this example block
+  # - key: "key"
+  #   operator: "Equal"
+  #   value: "value"
+  #   effect: "NoSchedule"
+  # -- Node selector for Longhorn Driver. Specify the nodes allowed to run Longhorn Driver.
+  nodeSelector: {}
+  ## If you want to set node selector for Longhorn Driver Deployer Deployment, delete the `{}` in the line above
+  ## and uncomment this example block
+  #  label-key1: "label-value1"
+  #  label-key2: "label-value2"
 
-    ingress:
-      # -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
-      enabled: false
+longhornUI:
+  # -- Replica count for Longhorn UI.
+  replicas: 2
+  # -- PriorityClass for Longhorn UI.
+  priorityClass: *defaultPriorityClassNameRef
+  # -- Toleration for Longhorn UI on nodes allowed to run Longhorn components.
+  tolerations: []
+  ## If you want to set tolerations for Longhorn UI Deployment, delete the `[]` in the line above
+  ## and uncomment this example block
+  # - key: "key"
+  #   operator: "Equal"
+  #   value: "value"
+  #   effect: "NoSchedule"
+  # -- Node selector for Longhorn UI. Specify the nodes allowed to run Longhorn UI.
+  nodeSelector: {}
+  ## If you want to set node selector for Longhorn UI Deployment, delete the `{}` in the line above
+  ## and uncomment this example block
+  #  label-key1: "label-value1"
+  #  label-key2: "label-value2"
 
-      # -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
-      # ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
-      ingressClassName: ~
+ingress:
+  # -- Setting that allows Longhorn to generate ingress records for the Longhorn UI service.
+  enabled: false
 
-      # -- Hostname of the Layer 7 load balancer.
-      host: sslip.io
+  # -- IngressClass resource that contains ingress configuration, including the name of the Ingress controller.
+  # ingressClassName can replace the kubernetes.io/ingress.class annotation used in earlier Kubernetes releases.
+  ingressClassName: ~
 
-      # -- Setting that allows you to enable TLS on ingress records.
-      tls: false
+  # -- Hostname of the Layer 7 load balancer.
+  host: sslip.io
 
-      # -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
-      secureBackends: false
+  # -- Setting that allows you to enable TLS on ingress records.
+  tls: false
 
-      # -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
-      tlsSecret: longhorn.local-tls
+  # -- Setting that allows you to enable secure connections to the Longhorn UI service via port 443.
+  secureBackends: false
 
-      path: /
+  # -- TLS secret that contains the private key and certificate to be used for TLS. This setting applies only when TLS is enabled on ingress records.
+  tlsSecret: longhorn.local-tls
 
-      ## If you're using kube-lego, you will want to add:
-      ## kubernetes.io/tls-acme: true
-      ##
-      ## For a full list of possible ingress annotations, please see
-      ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
-      ##
-      ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
-      # -- Ingress annotations in the form of key-value pairs.
-      annotations:
-      #  kubernetes.io/ingress.class: nginx
-      #  kubernetes.io/tls-acme: true
+  path: /
 
-      # -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
-      secrets:
-      ## If you're providing your own certificates, please use this to add the certificates as secrets
-      ## key and certificate should start with -----BEGIN CERTIFICATE----- or
-      ## -----BEGIN RSA PRIVATE KEY-----
-      ##
-      ## name should line up with a tlsSecret set further up
-      ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
-      ##
-      ## It is also possible to create and manage the certificates outside of this helm chart
-      ## Please see README.md for more information
-      # - name: longhorn.local-tls
-      #   key:
-      #   certificate:
+  ## If you're using kube-lego, you will want to add:
+  ## kubernetes.io/tls-acme: true
+  ##
+  ## For a full list of possible ingress annotations, please see
+  ## ref: https://github.com/kubernetes/ingress-nginx/blob/master/docs/annotations.md
+  ##
+  ## If tls is set to true, annotation ingress.kubernetes.io/secure-backends: "true" will automatically be set
+  # -- Ingress annotations in the form of key-value pairs.
+  annotations:
+  #  kubernetes.io/ingress.class: nginx
+  #  kubernetes.io/tls-acme: true
 
-    # -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
-    enablePSP: false
+  # -- Secret that contains a TLS private key and certificate. Use secrets if you want to use your own certificates to secure ingresses.
+  secrets:
+  ## If you're providing your own certificates, please use this to add the certificates as secrets
+  ## key and certificate should start with -----BEGIN CERTIFICATE----- or
+  ## -----BEGIN RSA PRIVATE KEY-----
+  ##
+  ## name should line up with a tlsSecret set further up
+  ## If you're using kube-lego, this is unneeded, as it will create the secret for you if it is not set
+  ##
+  ## It is also possible to create and manage the certificates outside of this helm chart
+  ## Please see README.md for more information
+  # - name: longhorn.local-tls
+  #   key:
+  #   certificate:
 
-    # -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
-    namespaceOverride: ""
+# -- Setting that allows you to enable pod security policies (PSPs) that allow privileged Longhorn pods to start. This setting applies only to clusters running Kubernetes 1.25 and earlier, and with the built-in Pod Security admission controller enabled.
+enablePSP: false
 
-    # -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
-    annotations: {}
+# -- Specify override namespace, specifically this is useful for using longhorn as sub-chart and its release namespace is not the `longhorn-system`.
+namespaceOverride: ""
 
-    serviceAccount:
-      # -- Annotations to add to the service account
-      annotations: {}
+# -- Annotation for the Longhorn Manager DaemonSet pods. This setting is optional.
+annotations: {}
 
-    metrics:
-      serviceMonitor:
-        # -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
-        enabled: false
+serviceAccount:
+  # -- Annotations to add to the service account
+  annotations: {}
 
-    ## openshift settings
-    openshift:
-      # -- Setting that allows Longhorn to integrate with OpenShift.
-      enabled: false
-      ui:
-        # -- Route for connections between Longhorn and the OpenShift web console.
-        route: "longhorn-ui"
-        # -- Port for accessing the OpenShift web console.
-        port: 443
-        # -- Port for proxy that provides access to the OpenShift web console.
-        proxy: 8443
+metrics:
+  serviceMonitor:
+    # -- Setting that allows the creation of a Prometheus ServiceMonitor resource for Longhorn Manager components.
+    enabled: false
 
-    # -- Setting that allows Longhorn to generate code coverage profiles.
-    enableGoCoverDir: false
+## openshift settings
+openshift:
+  # -- Setting that allows Longhorn to integrate with OpenShift.
+  enabled: false
+  ui:
+    # -- Route for connections between Longhorn and the OpenShift web console.
+    route: "longhorn-ui"
+    # -- Port for accessing the OpenShift web console.
+    port: 443
+    # -- Port for proxy that provides access to the OpenShift web console.
+    proxy: 8443
+
+# -- Setting that allows Longhorn to generate code coverage profiles.
+enableGoCoverDir: false

internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl

@@ -1,9 +1,244 @@
-- name: csi-secrets-store
-  namespace: kube-system
-  chart_ref: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef }}
-  chart_version: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion }}
-  {{- if .Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
+linux:
+  enabled: true
+  image:
+    repository: registry.k8s.io/csi-secrets-store/driver
+    tag: v1.4.3
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  crds:
+    enabled: true
+    image:
+      repository: registry.k8s.io/csi-secrets-store/driver-crds
+      tag: v1.4.3
+      pullPolicy: IfNotPresent
+    ## Optionally override resource limits for crd hooks(jobs)
+    resources: {}
+      # requests:
+      #   cpu: "100m"
+      #   memory: "128Mi"
+      # limits:
+      #   cpu: "500m"
+      #   memory: "512Mi"
+    annotations: {}
+    podLabels: {}
+
+  ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: type
+                operator: NotIn
+                values:
+                  - virtual-kubelet
+
+  driver:
+    resources:
+      limits:
+        cpu: 200m
+        memory: 200Mi
+      requests:
+        cpu: 50m
+        memory: 100Mi
+
+  registrarImage:
+    repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+    tag: v2.10.0
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  registrar:
+    resources:
+      limits:
+        cpu: 100m
+        memory: 100Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+    logVerbosity: 5
+
+  livenessProbeImage:
+    repository: registry.k8s.io/sig-storage/livenessprobe
+    tag: v2.12.0
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  livenessProbe:
+    resources:
+      limits:
+        cpu: 100m
+        memory: 100Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  kubeletRootDir: /var/lib/kubelet
+  providersDir: /var/run/secrets-store-csi-providers
+  additionalProvidersDirs:
+    - /etc/kubernetes/secrets-store-csi-providers
+  nodeSelector: {}
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+  # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+  tolerations:
+    - operator: "Exists"
+  metricsAddr: ":8095"
+  env: []
+  priorityClassName: ""
+  daemonsetAnnotations: {}
+  podAnnotations: {}
+  podLabels: {}
+
+  # volumes is a list of volumes made available to secrets store csi driver.
+  volumes: null
+  #   - name: foo
+  #     emptyDir: {}
+
+  # volumeMounts is a list of volumeMounts for secrets store csi driver.
+  volumeMounts: null
+  #   - name: foo
+  #     mountPath: /bar
+  #     readOnly: true
+
+windows:
+  enabled: false
+  image:
+    repository: registry.k8s.io/csi-secrets-store/driver
+    tag: v1.4.3
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: type
+                operator: NotIn
+                values:
+                  - virtual-kubelet
+
+  driver:
+    resources:
+      limits:
+        cpu: 400m
+        memory: 400Mi
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+  registrarImage:
+    repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+    tag: v2.10.0
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  registrar:
+    resources:
+      limits:
+        cpu: 200m
+        memory: 200Mi
+      requests:
+        cpu: 100m
+        memory: 100Mi
+    logVerbosity: 5
+
+  livenessProbeImage:
+    repository: registry.k8s.io/sig-storage/livenessprobe
+    tag: v2.12.0
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  livenessProbe:
+    resources:
+      limits:
+        cpu: 200m
+        memory: 200Mi
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  kubeletRootDir: C:\var\lib\kubelet
+  providersDir: C:\\k\\secrets-store-csi-providers
+  additionalProvidersDirs:
+  nodeSelector: {}
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+  # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+  tolerations:
+    - operator: "Exists"
+  metricsAddr: ":8095"
+  env: []
+  priorityClassName: ""
+  daemonsetAnnotations: {}
+  podAnnotations: {}
+  podLabels: {}
+
+  # volumes is a list of volumes made available to secrets store csi driver.
+  volumes: null
+  #   - name: foo
+  #     emptyDir: {}
+
+  # volumeMounts is a list of volumeMounts for secrets store csi driver.
+  volumeMounts: null
+  #   - name: foo
+  #     mountPath: /bar
+  #     readOnly: true
+
+# log level. Uses V logs (klog)
+logVerbosity: 0
+
+# logging format JSON
+logFormatJSON: false
+
+livenessProbe:
+  port: 9808
+  logLevel: 2
+
+## Maximum size in bytes of gRPC response from plugins
+maxCallRecvMsgSize: 4194304
+
+## Install Default RBAC roles and bindings
+rbac:
+  install: true
+  pspEnabled: false
+
+## Install RBAC roles and bindings required for K8S Secrets syncing if true
+syncSecret:
+  enabled: false
+
+## Enable secret rotation feature [alpha]
+enableSecretRotation: false
+
+## Secret rotation poll interval duration
+rotationPollInterval:
+
+## Provider HealthCheck
+providerHealthCheck: false
+
+## Provider HealthCheck interval
+providerHealthCheckInterval: 2m
+
+imagePullSecrets: []
+
+## This allows CSI drivers to impersonate the pods that they mount the volumes for.
+# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
+# Supported only for Kubernetes v1.20+
+tokenRequests: []
+# - audience: aud1
+# - audience: aud2
+
+# -- Labels to apply to all resources
+commonLabels: {}
+# team_name: dev

internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl

@@ -1,34 +0,0 @@
-- name: argo-cd-ingress
-  namespace: cicd
-  create_namespace: true
-  chart_ref: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartRef }}
-  chart_version: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion }}
-  {{- if and .Modules.Cicd.Enabled (eq .Modules.Cicd.ArgoCd.Expose.Type "ingress") }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    services:
-      - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
-        address: argo-cd-argocd-server
-        port: 80
-        secretName: argo-cd-server-tls
-
-    ingress:
-      accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-      class: {{ .Modules.Additional.Ingress.Type }}
-      annotations:
-        {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-        nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-        nginx.ingress.kubernetes.io/proxy-body-size: "0"
-        {{- end }}
-      tls:
-        enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
-        useCertManager: true
-
-        # used if "useCertManager" is false
-        crt: ""
-        key: ""

internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl

@@ -1,148 +0,0 @@
-- name: argo-cd
-  namespace: cicd
-  create_namespace: true
-  chart_ref: {{ .Modules.Cicd.ArgoCd.ChartRef }}
-  chart_version: {{ .Modules.Cicd.ArgoCd.ChartVersion }}
-  {{- if .Modules.Cicd.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    crds:
-      install: true
-
-    server:
-      certificateSecret:
-        enabled: false
-      {{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
-      service:
-        type: "NodePort"
-        nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
-        nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
-      {{- end }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-      autoscaling:
-        enabled: true
-        minReplicas: 2
-      {{- else }}
-      replicas: 2
-      {{- end }}
-      {{- end }}
-
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    redis:
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    controller:
-      replicas: 1
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    applicationSet:
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-      replicas: 2
-      {{- end }}
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    dex:
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        ## check later
-        serviceMonitor:
-          enabled: false
-
-    repoServer:
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-      autoscaling:
-        enabled: true
-        minReplicas: 2
-      {{- else }}
-      replicas: 2
-      {{- end }}
-      {{- end }}
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    notifications:
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    configs:
-      params:
-        server.insecure: true
-
-      secret:
-        argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
-
-      repositories:
-        # add default helm-repository from harbor
-        {{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
-
-      cm:
-        create: true
-        url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
-
-        accounts.developer: login
-        accounts.guest: login
-
-        # oidc.config: ""
-
-      rbac:
-        create: true
-        policy.csv: |
-          p, role:admin, applications, create, */*, allow
-          p, role:admin, applications, update, */*, allow
-          p, role:admin, applications, delete, */*, allow
-          p, role:admin, applications, sync, */*, allow
-          p, role:admin, applications, override, */*, allow
-          p, role:admin, applications, action/*, */*, allow
-          p, role:admin, applicationsets, get, */*, allow
-          p, role:admin, applicationsets, create, */*, allow
-          p, role:admin, applicationsets, update, */*, allow
-          p, role:admin, applicationsets, delete, */*, allow
-          p, role:admin, certificates, create, *, allow
-          p, role:admin, certificates, update, *, allow
-          p, role:admin, certificates, delete, *, allow
-          p, role:admin, clusters, create, *, allow
-          p, role:admin, clusters, update, *, allow
-          p, role:admin, clusters, delete, *, allow
-          p, role:admin, repositories, create, *, allow
-          p, role:admin, repositories, update, *, allow
-          p, role:admin, repositories, delete, *, allow
-          p, role:admin, projects, create, *, allow
-          p, role:admin, projects, update, *, allow
-          p, role:admin, projects, delete, *, allow
-          p, role:admin, accounts, update, *, allow
-          p, role:admin, gpgkeys, create, *, allow
-          p, role:admin, gpgkeys, delete, *, allow
-          p, role:admin, exec, create, */*, allow
-
-          {{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
-
-
-        policy.default: role:''
-        # scopes: "[roles,email,groups]"
-
-    {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-    redis-ha:
-      enabled: true
-    {{- end }}

internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl

@@ -1,435 +0,0 @@
-- name: argo-rollouts
-  namespace: cicd
-  create_namespace: true
-  chart_ref: {{ .Modules.Cicd.Rollouts.ChartRef }}
-  chart_version: {{ .Modules.Cicd.Rollouts.ChartVersion }}
-  {{- if and .Modules.Cicd.Enabled .Modules.Cicd.Rollouts.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    installCRDs: true
-    keepCRDs: false
-    clusterInstall: true
-    createClusterAggregateRoles: true
-
-    apiVersionOverrides:
-      # -- String to override apiVersion of ingresses rendered by this helm chart
-      ingress: "" # networking.k8s.io/v1beta1
-
-    # -- Override the Kubernetes version, which is used to evaluate certain manifests
-    kubeVersionOverride: ""
-
-    # -- Additional manifests to deploy within the chart. A list of objects.
-    ## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
-    extraObjects: []
-      # - apiVersion: v1
-      #   kind: Secret
-      #   metadata:
-      #     name: datadog
-      #   type: Opaque
-      #   data:
-      #     address: https://api.datadoghq.com
-      #     api-key: <datadog-api-key>
-      #     app-key: <datadog-app-key>
-
-    global:
-      # -- Annotations for all deployed Deployments
-      deploymentAnnotations: {}
-
-    controller:
-      # -- Value of label `app.kubernetes.io/component`
-      component: rollouts-controller
-      # -- Annotations to be added to the controller deployment
-      deploymentAnnotations: {}
-      # -- Annotations to be added to application controller pods
-      podAnnotations: {}
-      # -- [Node selector]
-      nodeSelector: {}
-      # -- [Tolerations] for use with node taints
-      tolerations: []
-      # -- Assign custom [affinity] rules to the deployment
-      affinity: {}
-      logging:
-        # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
-        level: info
-        # -- Set the klog logging level
-        kloglevel: "0"
-        # -- Set the logging format (one of: `text`, `json`)
-        format: "text"
-
-      # -- Assign custom [TopologySpreadConstraints] rules to the controller
-      ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-      ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
-      topologySpreadConstraints: []
-      # - maxSkew: 1
-      #   topologyKey: topology.kubernetes.io/zone
-      #   whenUnsatisfiable: DoNotSchedule
-
-      # -- [priorityClassName] for the controller
-      priorityClassName: ""
-      # -- The number of controller pods to run
-      {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
-      replicas: 3
-      {{- else }}
-      replicas: 1
-      {{- end }}
-      image:
-        # -- Registry to use
-        registry: quay.io
-        # -- Repository to use
-        repository: argoproj/argo-rollouts
-        # -- Overrides the image tag (default is the chart appVersion)
-        tag: ""
-        # -- Image pull policy
-        pullPolicy: IfNotPresent
-
-      # -- flag to enable creation of cluster controller role (requires cluster RBAC)
-      createClusterRole: true
-
-      # Controller container ports
-      containerPorts:
-        # -- Metrics container port
-        metrics: 8090
-        # -- Healthz container port
-        healthz: 8080
-      {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      metrics:
-        # -- Deploy metrics service
-        enabled: true
-        service:
-          # -- Metrics service port name
-          portName: metrics
-          # -- Metrics service port
-          port: 8090
-          # -- Service annotations
-          annotations: {}
-        serviceMonitor:
-          # -- Enable a prometheus ServiceMonitor
-          enabled: true
-          # -- Namespace to be used for the ServiceMonitor
-          namespace: ""
-          # -- Labels to be added to the ServiceMonitor
-          additionalLabels: {}
-          # -- Annotations to be added to the ServiceMonitor
-          additionalAnnotations: {}
-          # -- RelabelConfigs to apply to samples before scraping
-          relabelings: []
-          # -- MetricRelabelConfigs to apply to samples before ingestion
-          metricRelabelings: []
-      {{- end }}
-
-      # -- Configure liveness [probe] for the controller
-      # @default -- See [values.yaml]
-      livenessProbe:
-        httpGet:
-          path: /healthz
-          port: healthz
-        initialDelaySeconds: 30
-        periodSeconds: 20
-        failureThreshold: 3
-        successThreshold: 1
-        timeoutSeconds: 10
-
-      # -- Configure readiness [probe] for the controller
-      # @default -- See [values.yaml]
-      readinessProbe:
-        httpGet:
-          path: /metrics
-          port: metrics
-        initialDelaySeconds: 15
-        periodSeconds: 5
-        failureThreshold: 3
-        successThreshold: 1
-        timeoutSeconds: 4
-
-      ## Configure Pod Disruption Budget for the controller
-      pdb:
-        # -- Labels to be added to controller [Pod Disruption Budget]
-        labels: {}
-        # -- Annotations to be added to controller [Pod Disruption Budget]
-        annotations: {}
-        # -- Deploy a [Pod Disruption Budget] for the controller
-        enabled: false
-        # -- Minimum number / percentage of pods that should remain scheduled
-        minAvailable: # 1
-        # -- Maximum number / percentage of pods that may be made unavailable
-        maxUnavailable: # 0
-
-      # -- Additional volumes to add to the controller pod
-      volumes: []
-        # - configMap:
-        #     name: my-certs-cm
-        #   name: my-certs
-
-      # -- Additional volumeMounts to add to the controller container
-      volumeMounts: []
-        # - mountPath: /etc/ssl/certs
-        #   name: my-certs
-
-      # -- Configures 3rd party metric providers for controller
-      ## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
-      metricProviderPlugins: {}
-        # metricProviderPlugins: |-
-        #   - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
-        #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-
-      # -- Configures 3rd party traffic router plugins for controller
-      ## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
-      trafficRouterPlugins: {}
-        # trafficRouterPlugins: |-
-        #   - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
-        #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-
-    serviceAccount:
-      # -- Specifies whether a service account should be created
-      create: true
-      # -- Annotations to add to the service account
-      annotations: {}
-      # -- The name of the service account to use.
-      # If not set and create is true, a name is generated using the fullname template
-      name: ""
-
-    # -- Annotations to be added to all CRDs
-    crdAnnotations: {}
-
-    # -- Annotations for the all deployed pods
-    podAnnotations: {}
-
-    # -- Security Context to set on pod level
-    podSecurityContext:
-      runAsNonRoot: true
-
-    # -- Security Context to set on container level
-    containerSecurityContext: {}
-      # capabilities:
-      #   drop:
-      #   - ALL
-      # readOnlyRootFilesystem: true
-      # runAsNonRoot: true
-      # runAsUser: 1000
-
-    # -- Annotations to be added to the Rollout service
-    serviceAnnotations: {}
-
-    # -- Labels to be added to the Rollout pods
-    podLabels: {}
-
-    # -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
-    imagePullSecrets: []
-    # - name: argo-pull-secret
-
-    providerRBAC:
-      # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
-      enabled: true
-      # providerRBAC.enabled must be true in order to toggle the individual providers
-      providers:
-        # -- Adds RBAC rules for the Istio provider
-        istio: true
-        # -- Adds RBAC rules for the SMI provider
-        smi: true
-        # -- Adds RBAC rules for the Ambassador provider
-        ambassador: true
-        # -- Adds RBAC rules for the AWS Load Balancer Controller provider
-        awsLoadBalancerController: true
-        # -- Adds RBAC rules for the AWS App Mesh provider
-        awsAppMesh: true
-        # -- Adds RBAC rules for the Traefik provider
-        traefik: true
-        # -- Adds RBAC rules for the Apisix provider
-        apisix: true
-        # -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
-        contour: true
-        # -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
-        glooPlatform: true
-      # -- Additional RBAC rules for others providers
-      additionalRules: []
-
-    dashboard:
-      # -- Deploy dashboard server
-      enabled: true
-      # -- Set cluster role to readonly
-      readonly: false
-      # -- Value of label `app.kubernetes.io/component`
-      component: rollouts-dashboard
-      # -- Annotations to be added to the dashboard deployment
-      deploymentAnnotations: {}
-      # -- Annotations to be added to application dashboard pods
-      podAnnotations: {}
-      # -- [Node selector]
-      nodeSelector: {}
-      # -- [Tolerations] for use with node taints
-      tolerations: []
-      # -- Assign custom [affinity] rules to the deployment
-      affinity: {}
-      logging:
-        # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
-        level: info
-        # -- Set the klog logging level
-        kloglevel: "0"
-
-      # -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
-      ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-      ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
-      topologySpreadConstraints: []
-      # - maxSkew: 1
-      #   topologyKey: topology.kubernetes.io/zone
-      #   whenUnsatisfiable: DoNotSchedule
-
-      # -- [priorityClassName] for the dashboard server
-      priorityClassName: ""
-
-      # -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
-      createClusterRole: true
-
-      # -- The number of dashboard pods to run
-      {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
-      replicas: 3
-      {{- else }}
-      replicas: 1
-      {{- end }}
-      image:
-        # -- Registry to use
-        registry: quay.io
-        # --  Repository to use
-        repository: argoproj/kubectl-argo-rollouts
-        # -- Overrides the image tag (default is the chart appVersion)
-        tag: ""
-        # -- Image pull policy
-        pullPolicy: IfNotPresent
-      # -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
-      extraArgs: []
-      # -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
-      extraEnv: []
-        # - name: FOO
-        #   value: bar
-      # -- Resource limits and requests for the dashboard pods.
-      resources: {}
-      # -- Security Context to set on pod level
-      podSecurityContext:
-        runAsNonRoot: true
-      # -- Security Context to set on container level
-      containerSecurityContext: {}
-      service:
-        # -- Sets the type of the Service
-        {{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
-        type: NodePort
-        nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
-        {{- else }}
-        type: ClusterIP
-        nodePort:
-        {{- end }}
-        # -- LoadBalancer will get created with the IP specified in this field
-        loadBalancerIP: ""
-        # -- Source IP ranges to allow access to service from
-        loadBalancerSourceRanges: []
-        # -- Dashboard service external IPs
-        externalIPs: []
-        # -- Service annotations
-        annotations: {}
-        # -- Service labels
-        labels: {}
-        # -- Service port name
-        portName: dashboard
-        # -- Service port
-        port: 3100
-        # -- Service target port
-        targetPort: 3100
-        # -- (int) Service nodePort
-
-      serviceAccount:
-        # -- Specifies whether a dashboard service account should be created
-        create: true
-        # -- Annotations to add to the dashboard service account
-        annotations: {}
-        # -- The name of the service account to use.
-        # If not set and create is true, a name is generated using the fullname template
-        name: ""
-
-      ## Configure Pod Disruption Budget for the dashboard
-      pdb:
-        # -- Labels to be added to dashboard [Pod Disruption Budget]
-        labels: {}
-        # -- Annotations to be added to dashboard [Pod Disruption Budget]
-        annotations: {}
-        # -- Deploy a [Pod Disruption Budget] for the dashboard
-        enabled: false
-        # -- Minimum number / percentage of pods that should remain scheduled
-        minAvailable: # 1
-        # -- Maximum number / percentage of pods that may be made unavailable
-        maxUnavailable: # 0
-
-      ## Ingress configuration.
-      ## ref: https://kubernetes.io/docs/user-guide/ingress/
-      ##
-      ingress:
-        # -- Enable dashboard ingress support
-        enabled: false
-        # -- Dashboard ingress annotations
-        annotations: {}
-        # -- Dashboard ingress labels
-        labels: {}
-        # -- Dashboard ingress class name
-        ingressClassName: ""
-
-        # -- Dashboard ingress hosts
-        ## Argo Rollouts Dashboard Ingress.
-        ## Hostnames must be provided if Ingress is enabled.
-        ## Secrets must be manually created in the namespace
-        hosts: []
-          # - argorollouts.example.com
-
-        # -- Dashboard ingress paths
-        paths:
-          - /
-        # -- Dashboard ingress path type
-        pathType: Prefix
-        # -- Dashboard ingress extra paths
-        extraPaths: []
-          # - path: /*
-          #   backend:
-          #     serviceName: ssl-redirect
-          #     servicePort: use-annotation
-          ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
-          # - path: /*
-          #   pathType: Prefix
-          #   backend:
-          #     service
-          #       name: ssl-redirect
-          #       port:
-          #         name: use-annotation
-
-        # -- Dashboard ingress tls
-        tls: []
-          # - secretName: argorollouts-example-tls
-          #   hosts:
-          #     - argorollouts.example.com
-
-      # -- Additional volumes to add to the dashboard pod
-      volumes: []
-
-      # -- Additional volumeMounts to add to the dashboard container
-      volumeMounts: []
-
-    notifications:
-      secret:
-        # -- Whether to create notifications secret
-        create: false
-        # -- Generic key:value pairs to be inserted into the notifications secret
-        items: {}
-          # slack-token:
-
-      # -- Configures notification services
-      notifiers: {}
-        # service.slack: |
-        #   token: $slack-token
-
-      # -- Notification templates
-      templates: {}
-
-      # -- The trigger defines the condition when the notification should be sent
-      triggers: {}
-        # trigger.on-purple: |
-        #   - send: [my-purple-template]
-        #     when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'

internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl

@@ -1,255 +0,0 @@
-- name: keel
-  namespace: kube-system
-  chart_ref: {{ .Modules.Cicd.UpdatesOperator.ChartRef }}
-  chart_version: {{ .Modules.Cicd.UpdatesOperator.ChartVersion }}
-  {{- if and .Modules.Cicd.Enabled .Modules.Cicd.UpdatesOperator.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    image:
-      repository: keelhq/keel
-      tag: null
-      pullPolicy: Always
-
-    # Enable insecure registries
-    insecureRegistry: false
-
-    # Polling is enabled by default,
-    # you can disable it setting value below to false
-    polling:
-      enabled: true
-      defaultSchedule: "@every 1m"
-
-    # Extra Containers to run alongside Keel
-    # extraContainers:
-    #   - name: busybox
-    #     image: busybox
-    #     imagePullPolicy: IfNotPresent
-    #     command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
-
-    # Helm provider support
-    helmProvider:
-      enabled: true
-      # set to version "v3" for Helm v3
-      version: "v2"
-      tillerNamespace: "kube-system"
-      # optional Tiller address (if portforwarder tunnel doesn't work),
-      # if you are using default configuration, setting it to
-      # 'tiller-deploy:44134' is usually fine
-      tillerAddress: 'tiller-deploy:44134'
-    #  helmDriver: ''
-    #  helmDriverSqlConnectionString: ''
-
-    # Google Container Registry
-    # GCP Project ID
-    gcr:
-      enabled: false
-      projectId: ""
-      gcpServiceAccount: ""
-      clusterName: ""
-      pubSub:
-        enabled: false
-
-    # Notification level (debug, info, success, warn, error, fatal)
-    notificationLevel: info
-
-    # AWS Elastic Container Registry
-    # https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
-    ecr:
-      enabled: false
-      roleArn: ""
-      accessKeyId: ""
-      secretAccessKey: ""
-      region: ""
-
-    # Webhook Notification
-    # Remote webhook endpoint for notification delivery
-    webhook:
-      enabled: false
-      endpoint: ""
-
-    # Slack Notification
-    # bot name (default keel) must exist!
-    slack:
-      enabled: false
-      botName: ""
-      token: ""
-      channel: ""
-      approvalsChannel: ""
-
-    # Hipchat notification and approvals
-    hipchat:
-      enabled: false
-      token: ""
-      channel: ""
-      approvalsChannel: ""
-      botName: ""
-      userName: ""
-      password: ""
-
-    # Mattermost notifications
-    mattermost:
-      enabled: false
-      endpoint: ""
-
-    # MS Teams notifications
-    teams:
-      enabled: false
-      webhookUrl: ""
-
-    # Discord notifications
-    discord:
-      enabled: false
-      webhookUrl: ""
-
-    # Mail notifications
-    mail:
-      enabled: false
-      from: ""
-      to: ""
-      smtp:
-        server: ""
-        port: 25
-        user: ""
-        pass: ""
-
-    # Basic auth on approvals
-    basicauth:
-      enabled: true
-      user: "admin"
-      password: "{{ .Modules.AdminPassword }}"
-
-    # Keel service
-    # Enable to receive webhooks from Docker registries
-    service:
-      enabled: false
-      type: LoadBalancer
-      externalPort: 9300
-      clusterIP: ""
-
-    # Webhook Relay service
-    # If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
-    # which can deliver webhooks to your internal Keel service through Keel sidecar container.
-    webhookRelay:
-      enabled: false
-      bucket: ""
-      # webhookrelay.com credentials
-      # Set the key and secret values here to create the keel-webhookrelay secret with this
-      # chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
-      key: ""
-      secret: ""
-      # webhookrelay docker image
-      image:
-        repository: webhookrelay/webhookrelayd
-        tag: latest
-        pullPolicy: IfNotPresent
-
-    # Use a secret file to define passwords and tokens of third parties.
-    secret:
-      # Leave blank to use `keel.fullname`
-      name: ""
-      # Set to false to manage your own secret file, with terraform for example.
-      create: true
-
-    # Keel self-update
-    # uncomment lines below if you want Keel to automaticly
-    # self-update to the latest release version
-    # keel:
-    #   # keel policy (all/major/minor/patch/force)
-    #   policy: patch
-    #   # trigger type, defaults to events such as pubsub, webhooks
-    #   trigger: poll
-    #   # polling schedule
-    #   pollSchedule: "@every 3m"
-    #   # images to track and update
-    #   images:
-    #     - repository: image.repository
-    #       tag: image.tag
-
-    # RBAC manifests management
-    rbac:
-      enabled: true
-      serviceAccount:
-        # Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
-        # name:
-        # Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
-        # If rbac.serviceAccount.name is not set, a new name for the service account is generated
-        create: true
-
-    # Resources
-    resources:
-      limits:
-        cpu: 100m
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-
-    # NodeSelector
-    nodeSelector: {}
-
-    affinity: {}
-
-    tolerations: {}
-
-    # base64 encoded json of GCP service account
-    # more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
-    # e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
-    googleApplicationCredentials: ""
-
-    # Enable DEBUG logging
-    debug: false
-
-    # This is used by the static manifest generator in order to create a static
-    # namespace manifest for the namespace that keel is being installed
-    # within. It should **not** be used if you are using Helm for deployment.
-    createNamespaceResource: false
-
-    podAnnotations: {}
-
-    serviceAnnotations: {}
-    # Useful for making the load balancer internal
-    # serviceAnnotations:
-    #    cloud.google.com/load-balancer-type: Internal
-
-    aws:
-      region: null
-
-    podDisruptionBudget:
-      enabled: false
-      maxUnavailable: 1
-      minAvailable: null
-
-    # Google Cloud Certificates
-    gcloud:
-      managedCertificates:
-        enabled: false
-        domains:
-          - ""
-
-    ingress:
-      enabled: false
-      labels: {}
-      annotations: {}
-    #    kubernetes.io/ingress.class: nginx
-    #    kubernetes.io/tls-acme: "true"
-      hosts: []
-    #    - host: chart-example.local
-    #      paths:
-    #        - /
-      tls: []
-    #    - secretName: chart-example-tls
-    #      hosts:
-    #        - chart-example.local
-
-    dockerRegistry:
-      enabled: false
-      name: ""
-      key: ""
-
-    persistence:
-      enabled: false
-      storageClass: "-"
-      size: 1Gi

internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl

@@ -1,66 +0,0 @@
-- name: fluent-operator
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Logging.Operator.ChartRef }}
-  chart_version: {{ .Modules.Observability.Logging.Operator.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    # Set this to containerd or crio if you want to collect CRI format logs
-    containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-    Kubernetes: false
-
-    operator:
-      initcontainer:
-        repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
-
-        resources:
-          limits:
-            cpu: 100m
-            memory: 100Mi
-
-          requests:
-            cpu: 50m
-            memory: 64Mi
-      container:
-        repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
-      resources:
-        limits:
-          cpu: 100m
-          memory: 100Mi
-        requests:
-          cpu: 100m
-          memory: 60Mi
-      imagePullSecrets: []
-      labels: {}
-      logPath:
-        # The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
-        # crio: /var/log
-        containerd: /var/log
-      disableComponentControllers: ""
-
-    fluentbit:
-      crdsEnable: true
-      enable: false
-
-    fluentd:
-      crdsEnable: true
-      enable: false
-      name: fluentd
-      # Valid modes include "collector" and "agent".
-      # The "collector" mode will deploy Fluentd as a StatefulSet as before.
-      # The new "agent" mode will deploy Fluentd as a DaemonSet.
-      mode: "agent"
-      port: 24224
-      image:
-        repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
-
-    nameOverride: ""
-    fullnameOverride: ""
-    namespaceOverride: ""

internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl

@@ -1,200 +0,0 @@
-- name: loki
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Logging.Loki.ChartRef }}
-  chart_version: {{ .Modules.Observability.Logging.Loki.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    loki:
-      image:
-        registry: {{ .Modules.Observability.Logging.Loki.Registry }}
-        repository: {{ .Modules.Observability.Logging.Loki.Image }}
-        tag: {{ .Modules.Observability.Logging.Loki.Tag }}
-      podAnnotations:
-        app.kubernetes.io/component: "loki"
-      auth_enabled: false
-      commonConfig:
-        replication_factor: 1
-      storage:
-        type: 'filesystem'
-
-      frontend:
-        max_outstanding_per_tenant: 10000
-
-      limits_config:
-        reject_old_samples: false
-        split_queries_by_interval: 15m
-        max_query_parallelism: 32
-        max_query_series: 10000
-        retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
-
-      compactor:
-        compaction_interval: 10m
-        retention_enabled: true
-        retention_delete_delay: 2h
-
-      querier:
-        max_concurrent: 2048
-
-      query_scheduler:
-        max_outstanding_requests_per_tenant: 10000
-
-      rulerConfig:
-        storage:
-          type: local
-          local:
-            directory: /var/loki/rules
-        rule_path: /tmp/rules
-
-        alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
-
-
-    singleBinary:
-      replicas: 1
-
-      extraVolumes:
-        - name: loki-default-rules
-          configMap:
-            name: loki-default-alerting-rules
-
-      extraVolumeMounts:
-        - name: loki-default-rules
-          mountPath: /var/loki/rules
-
-
-    write:
-      persistence:
-        volumeClaimsEnabled: true
-        storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
-        size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
-
-    test:
-      enabled: false
-
-    gateway:
-      enabled: false
-
-    monitoring:
-      selfMonitoring:
-        enabled: false
-        grafanaAgent:
-          installOperator: false
-      lokiCanary:
-        enabled: false
-      rules:
-        enabled: true
-        alerting: true
-        additionalGroups: {}
-
-    extraObjects:
-      - apiVersion: v1
-        kind: ConfigMap
-        metadata:
-          name: loki-default-alerting-rules
-          labels:
-            loki_rule: ""
-
-        data:
-          loki-default-alerting-rules.yaml: |-
-            groups:
-              {{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
-              - name: kube-events-alerts
-                rules:
-                  - alert: FailedEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: FailedEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: Failed events occured in cluster
-                      addDefaultUrl: "true"
-
-                  - alert: OOMKilledEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: OOMKilledEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: OOMKilled events occured in cluster
-                      addDefaultUrl: "true"
-
-                  - alert: EvictedEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: EvictedEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: Evicted events occured in cluster
-                      addDefaultUrl: "true"
-
-                  - alert: ImagePullBackOffEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: ImagePullBackOffEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: ImagePullBackOff events occured in cluster
-                      addDefaultUrl: "true"
-
-                  - alert: BackOffEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: BackOffEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: BackOff events occured in cluster
-                      addDefaultUrl: "true"
-    sidecar:
-      rules:
-        enabled: true
-        # -- Label that the configmaps/secrets with rules will be marked with.
-        label: loki_rule
-        # -- Label value that the configmaps/secrets with rules will be set to.
-        labelValue: ""
-        # -- Folder into which the rules will be placed.
-        folder: /var/loki/rules
-        # -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
-        # Otherwise the namespace in which the sidecar is running will be used.
-        # It's also possible to specify 'ALL' to search in all namespaces.
-        searchNamespace: 'ALL'
-        # -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
-        watchMethod: WATCH
-        # -- Search in configmap, secret, or both.
-        resource: both
-        # -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
-        script: null
-        # -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
-        # defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
-        watchServerTimeout: 60
-        #
-        # -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
-        # If you have a network outage dropping all packets with no RST/FIN,
-        # this is how long your client waits before realizing & dropping the connection.
-        # Defaults to 66sec.
-        watchClientTimeout: 60
-        # -- Log level of the sidecar container.
-        logLevel: INFO

internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl

@@ -1,203 +0,0 @@
-- name: metrics-server
-  namespace: kube-system
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Monitoring.MetricsServer.ChartRef }}
-  chart_version: {{ .Modules.Observability.Monitoring.MetricsServer.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    image:
-      repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
-      tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
-      pullPolicy: IfNotPresent
-
-    imagePullSecrets: []
-    # - name: registrySecretName
-
-    nameOverride: ""
-    fullnameOverride: ""
-
-    serviceAccount:
-      # Specifies whether a service account should be created
-      create: true
-      # Annotations to add to the service account
-      annotations: {}
-      # The name of the service account to use.
-      # If not set and create is true, a name is generated using the fullname template
-      name: ""
-      # The list of secrets mountable by this service account.
-      # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
-      secrets: []
-
-    rbac:
-      # Specifies whether RBAC resources should be created
-      create: true
-      pspEnabled: false
-
-    apiService:
-      create: true
-      # Annotations to add to the API service
-      annotations: {}
-      # Specifies whether to skip TLS verification
-      insecureSkipTLSVerify: true
-      # The PEM encoded CA bundle for TLS verification
-      caBundle: ""
-
-    commonLabels: {}
-    podLabels:
-      "app.kubernetes.io/component": "metrics-server"
-    podAnnotations: {}
-
-    podSecurityContext: {}
-
-    securityContext:
-      allowPrivilegeEscalation: false
-      readOnlyRootFilesystem: true
-      runAsNonRoot: true
-      runAsUser: 1000
-      seccompProfile:
-        type: RuntimeDefault
-      capabilities:
-        drop:
-          - ALL
-
-    priorityClassName: system-cluster-critical
-
-    containerPort: 10250
-
-    hostNetwork:
-      # Specifies if metrics-server should be started in hostNetwork mode.
-      #
-      # You would require this enabled if you use alternate overlay networking for pods and
-      # API server unable to communicate with metrics-server. As an example, this is required
-      # if you use Weave network on EKS
-      enabled: false
-
-    replicas: 1
-
-    revisionHistoryLimit:
-
-    updateStrategy: {}
-    #   type: RollingUpdate
-    #   rollingUpdate:
-    #     maxSurge: 0
-    #     maxUnavailable: 1
-
-    podDisruptionBudget:
-      # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
-      enabled: false
-      minAvailable:
-      maxUnavailable:
-
-    defaultArgs:
-      - --cert-dir=/tmp
-      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
-      - --kubelet-use-node-status-port
-      - --metric-resolution=15s
-      - --kubelet-insecure-tls
-
-    args: []
-
-    livenessProbe:
-      httpGet:
-        path: /livez
-        port: https
-        scheme: HTTPS
-      initialDelaySeconds: 0
-      periodSeconds: 10
-      failureThreshold: 3
-
-    readinessProbe:
-      httpGet:
-        path: /readyz
-        port: https
-        scheme: HTTPS
-      initialDelaySeconds: 20
-      periodSeconds: 10
-      failureThreshold: 3
-
-    service:
-      type: ClusterIP
-      port: 443
-      annotations: {}
-      labels: {}
-      #  Add these labels to have metrics-server show up in `kubectl cluster-info`
-      #  kubernetes.io/cluster-service: "true"
-      #  kubernetes.io/name: "Metrics-server"
-
-    addonResizer:
-      enabled: false
-      image:
-        repository: registry.k8s.io/autoscaling/addon-resizer
-        tag: 1.8.20
-      securityContext:
-        allowPrivilegeEscalation: false
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-        capabilities:
-          drop:
-            - ALL
-      resources:
-        requests:
-          cpu: 40m
-          memory: 25Mi
-        limits:
-          cpu: 40m
-          memory: 25Mi
-      nanny:
-        cpu: 0m
-        extraCpu: 1m
-        memory: 0Mi
-        extraMemory: 2Mi
-        minClusterSize: 100
-        pollPeriod: 300000
-        threshold: 5
-
-    metrics:
-      enabled: true
-
-    serviceMonitor:
-      enabled: true
-      additionalLabels: {}
-      interval: 1m
-      scrapeTimeout: 10s
-      metricRelabelings: []
-      relabelings: []
-
-    # See https://github.com/kubernetes-sigs/metrics-server#scaling
-    resources:
-      requests:
-        cpu: 100m
-        memory: 200Mi
-      # limits:
-      #   cpu:
-      #   memory:
-
-    extraVolumeMounts: []
-
-    extraVolumes: []
-
-    nodeSelector: {}
-
-    tolerations: []
-
-    affinity: {}
-
-    topologySpreadConstraints: []
-
-    dnsConfig: {}
-
-    # Annotations to add to the deployment
-    deploymentAnnotations: {}
-
-    schedulerName: ""
-
-    tmpVolume:
-      emptyDir: {}
-

internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl

@@ -1,395 +0,0 @@
-- name: observability
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.ChartRef }}
-  chart_version: {{ .Modules.Observability.ChartVersion }}
-  {{- if .Modules.Observability.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    prometheus:
-      enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-      serviceMonitor: true
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
-        pullPolicy: IfNotPresent
-
-      clustering:
-        enabled: false
-        replicas: 3
-        shards: 1
-
-      persistence:
-        enabled: true
-
-        storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
-        storageResources:
-          requests:
-            storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
-
-      scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
-      retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
-      # serviceNodePort: 30008
-
-      additionalConfigs: |
-        - job_name: "kubelet"
-          scheme: https
-          metrics_path: /metrics/cadvisor
-          tls_config:
-            insecure_skip_verify: true
-          authorization:
-            credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-          kubernetes_sd_configs:
-            - role: node
-          relabel_configs:
-            - action: labelmap
-              regex: __meta_kubernetes_node_label_(.+)
-
-        - job_name: "kubernetes-apiservers"
-          kubernetes_sd_configs:
-            - role: endpoints
-          scheme: https
-          tls_config:
-            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          authorization:
-            credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-          relabel_configs:
-            - source_labels:
-                [
-                  __meta_kubernetes_namespace,
-                  __meta_kubernetes_service_name,
-                  __meta_kubernetes_endpoint_port_name,
-                ]
-              action: keep
-              regex: default;kubernetes;https
-
-        - job_name: "coredns"
-          kubernetes_sd_configs:
-            - role: endpoints
-          scheme: http
-          relabel_configs:
-            - source_labels:
-                [
-                  __meta_kubernetes_namespace,
-                  __meta_kubernetes_service_name,
-                  __meta_kubernetes_endpoint_port_name,
-                ]
-              action: keep
-              regex: kube-system;.*dns.*;metrics
-
-        - job_name: 'ingress-endpoints'
-          metrics_path: /probe
-          params:
-            module: [https_ok]
-          kubernetes_sd_configs:
-            - role: ingress
-          relabel_configs:
-            - source_labels: [__address__]
-              target_label: __param_target
-            - source_labels: [__param_target]
-              target_label: instance
-            - source_labels:
-                [
-                  __meta_kubernetes_ingress_scheme,
-                  __address__,
-                  __meta_kubernetes_ingress_path,
-                ]
-              regex: (.+);(.+);(.+)
-              replacement: https://${2}${3}
-              target_label: __param_target
-            - target_label: __address__
-              replacement: observability-blackbox-exporter:9115
-
-    alertManager:
-      enabled: {{ .Modules.Observability.Monitoring.AlertManager.Enabled }}
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-      enableDefaultRules: true
-      image:
-        repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
-        tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
-        pullPolicy: IfNotPresent
-
-      # serviceNodePort: 30009
-
-      configPath: /etc/alertmanager
-      {{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
-      additionalMessageTemplates:
-        {{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
-      {{- end }}
-      {{- if .Modules.Observability.Monitoring.AlertManager.Route }}
-      route:
-        {{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
-      {{- end }}
-      {{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
-      receivers:
-        {{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
-      {{- end }}
-
-    blackboxExporter:
-      enabled: {{ .Modules.Observability.Monitoring.Blackbox.Enabled }}
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
-        tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
-        pullPolicy: IfNotPresent
-
-      # serviceNodePort: 30012
-
-      configPath: /etc/blackbox_exporter
-      additionalModules:
-
-
-    kubeStateMetrics:
-      enabled: {{ .Modules.Observability.Monitoring.KubeState.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
-        tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
-        pullPolicy: IfNotPresent
-      resources:
-        requests:
-          cpu: 30m
-          memory: 120Mi
-        limits:
-          memory: 240Mi
-          cpu: 60m
-
-    prometheusOperator:
-      enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
-        pullPolicy: IfNotPresent
-
-      prometheusConfigReloader:
-        image:
-          repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
-          tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
-          pullPolicy: IfNotPresent
-
-      kubeRbacProxy:
-        image:
-          repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
-          tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
-          pullPolicy: IfNotPresent
-
-    nodeExporter:
-      enabled: {{ .Modules.Observability.Monitoring.Node.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Node.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
-        pullPolicy: IfNotPresent
-
-    kubeEventsExporter:
-      enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
-        tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
-        pullPolicy: IfNotPresent
-      lokiAddress: http://loki.observability.svc.cluster.local:3100
-      logLevel: warn
-      logFormat: json
-      kubeQPS: 100
-      kubeBurst: 500
-      maxEventAgeSeconds: 120
-      metricsNamePrefix: event_exporter_
-
-      cron:
-        restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
-        image:
-          repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
-          tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
-          pullPolicy: IfNotPresent
-      additionalRoutes:
-      additionalReceivers:
-
-    grafana:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-      domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-      {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
-      serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
-      {{- end }}
-      image:
-        repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
-        tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
-        pullPolicy: IfNotPresent
-
-      storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
-      storageResources:
-        requests:
-          storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
-
-      config:
-        server: |
-          enable_gzip = true
-          root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-
-        security: |
-          admin_user = admin
-          admin_password = {{ .Modules.AdminPassword }}
-
-        auth: |
-          {{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
-
-        authGenericAuth: |
-          {{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
-
-        additionalDatasources:
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-          - name: Kube-loki
-            type: loki
-            access: proxy
-            url: http://loki:3100
-            editable: false
-            basicAuth: false
-            isDefault: false
-            jsonData:
-              maxLines: 1000
-          {{- end }}
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-          - name: Kube-jaeger-query
-            type: jaeger
-            access: proxy
-            url: http://tempo:16686
-            editable: false
-            basicAuth: false
-            isDefault: false
-          {{- end }}
-          {{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
-          {{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
-          {{- end }}
-
-    opentelemetryCollector:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-      serviceMonitor: true
-      config: |
-        receivers:
-          otlp:
-            protocols:
-              grpc:
-              http:
-        exporters:
-          otlphttp:
-            endpoint: http://tempo:4318
-        service:
-          telemetry:
-            logs:
-              level: "debug"
-          pipelines:
-            traces:
-              receivers: [otlp]
-              exporters: [otlphttp]
-
-    ingress:
-      {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress" }}
-      enabled: true
-      {{- else }}
-      enabled: false
-      {{- end }}
-      accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-      class: {{ .Modules.Additional.Ingress.Type }}
-      annotations:
-        {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-        nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-        {{- end }}
-      tls:
-        {{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
-        enabled: true
-        {{- end }}
-        hosts:
-          - host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-            secretName: grafana-tls
-
-    containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-
-    fluentbit:
-      enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-      serviceMonitor: true
-      image:
-        repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
-        tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
-
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/edge
-                    operator: DoesNotExist
-      tolerations:
-        - operator: Exists
-
-      input:
-        tail:
-          enable: true
-          refreshIntervalSeconds: 10
-          memBufLimit: 100MB
-          bufferMaxSize: ""
-          path: "/var/log/containers/*.log"
-          skipLongLines: true
-          readFromHead: false
-          storageType: memory
-          pauseOnChunksOverlimit: "off"
-        systemd:
-          enable: true
-          systemdFilter:
-            enable: true
-            filters: []
-          path: "/var/log/journal"
-          includeKubelet: true
-          stripUnderscores: "off"
-          storageType: memory
-          pauseOnChunksOverlimit: "off"
-
-        nodeExporterMetrics: {}
-        fluentBitMetrics: {}
-
-      output:
-        es:
-          enable: false
-          host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
-          port: 9200
-          logstashPrefix: ks-logstash-log
-          bufferSize: 20MB
-          traceError: true
-        kafka:
-          enable: false
-          brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
-          topics: ks-log
-        opentelemetry: {}
-        opensearch:
-          enable: false
-        stdout:
-          enable: false
-        loki:
-          enable: true
-          host: loki
-          port: 3100
-
-        stackdriver: {}
-
-      service:
-        storage: {}
-
-      filter:
-        kubernetes:
-          enable: true
-          labels: true
-          annotations: true
-        containerd:
-          enable: true
-        systemd:
-          enable: true
-
-      kubeedge:
-        enable: false
-        prometheusRemoteWrite:
-          # Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
-          host: "<cloud-prometheus-service-host>"
-          # Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
-          port: "<cloud-prometheus-service-port>"

internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl

@@ -1,145 +0,0 @@
-- name: opentelemetry-operator
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Tracing.Operator.ChartRef }}
-  chart_version: {{ .Modules.Observability.Tracing.Operator.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    replicaCount: 1
-    nameOverride: ""
-    imagePullSecrets: []
-    pdb:
-      create: false
-      minAvailable: 1
-      maxUnavailable: ""
-
-    manager:
-      image:
-        repository: {{ .Modules.Observability.Tracing.Operator.Image }}
-        tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
-      collectorImage:
-        repository: {{ .Modules.Observability.Tracing.Collector.Image }}
-        tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
-
-      featureGates: ""
-      ports:
-        metricsPort: 8080
-        webhookPort: 9443
-        healthzPort: 8081
-      resources:
-        limits:
-          cpu: 100m
-          memory: 128Mi
-        requests:
-          cpu: 100m
-          memory: 64Mi
-      env:
-        ENABLE_WEBHOOKS: "true"
-
-      serviceAccount:
-        create: true
-        annotations: {}
-
-      serviceMonitor:
-        enabled: true
-        metricsEndpoints:
-          - port: metrics
-
-      prometheusRule:
-        enabled: true
-        groups: []
-        defaultRules:
-          enabled: true
-
-      extraArgs: []
-
-      leaderElection:
-        enabled: true
-
-      verticalPodAutoscaler:
-        enabled: false
-        controlledResources: []
-        maxAllowed: {}
-        minAllowed: {}
-
-        updatePolicy:
-          updateMode: Auto
-          minReplicas: 2
-      rolling: false
-
-      securityContext: {}
-
-    kubeRBACProxy:
-      enabled: true
-      image:
-        repository: quay.io/brancz/kube-rbac-proxy
-        tag: v0.15.0
-      ports:
-        proxyPort: 8443
-      resources:
-        limits:
-          cpu: 500m
-          memory: 128Mi
-        requests:
-          cpu: 5m
-          memory: 64Mi
-
-      extraArgs: []
-
-      securityContext: {}
-
-    admissionWebhooks:
-      create: true
-      servicePort: 443
-      failurePolicy: Fail
-      secretName: ""
-      pods:
-        failurePolicy: Ignore
-
-      namePrefix: ""
-
-      timeoutSeconds: 10
-
-      namespaceSelector: {}
-      objectSelector: {}
-      certManager:
-        enabled: true
-        issuerRef: {}
-        certificateAnnotations: {}
-        issuerAnnotations: {}
-
-      autoGenerateCert:
-        enabled: true
-        recreate: true
-
-      secretAnnotations: {}
-      secretLabels: {}
-
-    role:
-      create: true
-
-    clusterRole:
-      create: true
-
-    affinity: {}
-    tolerations: []
-    nodeSelector: {}
-    topologySpreadConstraints: []
-    hostNetwork: false
-
-    priorityClassName: ""
-
-    securityContext:
-      runAsGroup: 65532
-      runAsNonRoot: true
-      runAsUser: 65532
-      fsGroup: 65532
-
-    testFramework:
-      image:
-        repository: busybox
-        tag: latest

internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl

@@ -1,79 +0,0 @@
-- name: tempo
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Tracing.Tempo.ChartRef }}
-  chart_version: {{ .Modules.Observability.Tracing.Tempo.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    replicas: 1
-
-    tempo:
-      repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
-      tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
-      pullPolicy: IfNotPresent
-
-      updateStrategy: RollingUpdate
-
-      memBallastSizeMbs: 1024
-      multitenancyEnabled: false
-      reportingEnabled: false
-
-      metricsGenerator:
-        enabled: false
-        remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
-      retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
-      global_overrides:
-        per_tenant_override_config: /conf/overrides.yaml
-
-      server:
-        http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
-      storage:
-        trace:
-          backend: local
-          local:
-            path: /var/tempo/traces
-          wal:
-            path: /var/tempo/wal
-      receivers:
-        otlp:
-          protocols:
-            grpc:
-              endpoint: "0.0.0.0:4317"
-            http:
-              endpoint: "0.0.0.0:4318"
-
-    tempoQuery:
-      repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
-      tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
-      pullPolicy: IfNotPresent
-
-      enabled: true
-
-      service:
-        port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
-
-      ingress:
-        enabled: false
-
-    serviceAccount:
-      create: true
-      automountServiceAccountToken: true
-
-    service:
-      type: ClusterIP
-
-    serviceMonitor:
-      enabled: true
-
-    persistence:
-      enabled: true
-      storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
-      accessModes:
-        - ReadWriteOnce
-      size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
-
-    priorityClassName: null

internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl

@@ -1,17 +0,0 @@
-- name: harbor-certificate-generator
-  namespace: {{ .Modules.Registry.Namespace }}
-  create_namespace: true
-  chart_ref: {{ .Modules.Registry.Tls.CertificateGenerator.ChartRef }}
-  chart_version: {{ .Modules.Registry.Tls.CertificateGenerator.ChartVersion }}
-  {{- if and .Modules.Registry.Enabled (eq .Modules.Registry.Expose.Type "ingress") }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
-    solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
-
-    certificates:
-      - name: harbor-tls
-        domain: {{ .Modules.Registry.Expose.Domain }}

internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl

@@ -1,382 +0,0 @@
-- name: harbor
-  namespace: {{ .Modules.Registry.Namespace }}
-  create_namespace: true
-  chart_ref: {{ .Modules.Registry.ChartRef }}
-  chart_version: {{ .Modules.Registry.ChartVersion }}
-  {{- if .Modules.Registry.Enabled  }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    expose:
-      type: {{ .Modules.Registry.Expose.Type }}
-      tls:
-        enabled: {{ .Modules.Registry.Tls.Enabled }}
-        certSource: secret
-        secret:
-          secretName: harbor-tls
-      ingress:
-        hosts:
-          core: {{ .Modules.Registry.Expose.Domain }}
-        controller: default
-        kubeVersionOverride: ""
-        className: "{{ .Modules.Additional.Ingress.Type }}"
-        annotations:
-          ingress.kubernetes.io/ssl-redirect: "true"
-          ingress.kubernetes.io/proxy-body-size: "0"
-          {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-          nginx.ingress.kubernetes.io/ssl-redirect: "true"
-          nginx.ingress.kubernetes.io/proxy-body-size: "0"
-          {{- end }}
-        labels: {}
-
-      nodePort:
-        name: harbor
-        ports:
-          http:
-            port: 80
-            nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
-          https:
-            port: 443
-            nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
-
-    externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}
-    persistence:
-      resourcePolicy: "keep"
-      persistentVolumeClaim:
-        registry:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.RegistrySize  }}
-          annotations: {}
-        jobservice:
-          jobLog:
-            existingClaim: ""
-            storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-            subPath: ""
-            accessMode: ReadWriteOnce
-            size: {{ .Modules.Registry.Persistence.JobserviceSize  }}
-            annotations: {}
-        database:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.DatabaseSize  }}
-          annotations: {}
-        redis:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.RedisSize }}
-          annotations: {}
-        trivy:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.TrivySize }}
-          annotations: {}
-
-      imageChartStorage:
-        disableredirect: false
-
-        type: filesystem
-        filesystem:
-          rootdirectory: /storage
-          #maxthreads: 100
-
-    imagePullPolicy: IfNotPresent
-
-    updateStrategy:
-      type: RollingUpdate
-
-    harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
-
-    logLevel: info
-
-    metrics:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      core:
-        path: /metrics
-        port: 8001
-      registry:
-        path: /metrics
-        port: 8001
-      jobservice:
-        path: /metrics
-        port: 8001
-      exporter:
-        path: /metrics
-        port: 8001
-
-      serviceMonitor:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    trace:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-      provider: otel
-      sample_rate: 1
-      attributes:
-        application: harbor
-      jaeger:
-        endpoint: http://hostname:14268/api/traces
-      otel:
-        endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
-        url_path: /v1/traces
-        compression: false
-        insecure: true
-        timeout: 10
-
-    portal:
-      image:
-        repository: harbor.kvazaric.ru/kube-forge/harbor-portal
-        tag: {{ .Modules.Registry.Version }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-
-      topologySpreadConstraints: []
-
-      podLabels:
-        "app.kubernetes.io/component": "harbor-portal"
-      priorityClassName:
-
-    core:
-      image:
-        repository: goharbor/harbor-core
-        tag: {{ .Modules.Registry.Version }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-      startupProbe:
-        enabled: true
-        initialDelaySeconds: 10
-      extraEnvVars: []
-      nodeSelector: {}
-      tolerations: []
-      affinity: {}
-      topologySpreadConstraints: []
-      podLabels:
-        "app.kubernetes.io/component": "harbor-core"
-      serviceAnnotations: {}
-      priorityClassName:
-      configureUserSettings:
-      quotaUpdateProvider: db # Or redis
-      secret: ""
-      existingSecret: ""
-      secretName: ""
-      tokenKey: ""
-
-      tokenCert: ""
-
-      xsrfKey: ""
-      existingXsrfSecret: ""
-      existingXsrfSecretKey: CSRF_KEY
-      artifactPullAsyncFlushDuration:
-      gdpr:
-        deleteUser: false
-        auditLogsCompliant: false
-
-
-    jobservice:
-      image:
-        repository: goharbor/harbor-jobservice
-        tag: {{ .Modules.Registry.Version }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-      topologySpreadConstraints:
-      podLabels:
-        "app.kubernetes.io/component": "harbor-jobservice"
-      priorityClassName:
-      maxJobWorkers: 10
-      jobLoggers:
-        - file
-        # - database
-        # - stdout
-      loggerSweeperDuration: 14 #days
-      notification:
-        webhook_job_max_retry: 3
-        webhook_job_http_client_timeout: 3 # in seconds
-      reaper:
-        max_update_hours: 24
-        max_dangling_hours: 168
-      secret: ""
-      existingSecret: ""
-      existingSecretKey: JOBSERVICE_SECRET
-
-    registry:
-      registry:
-        image:
-          repository: goharbor/registry-photon
-          tag: {{ .Modules.Registry.Version }}
-        extraEnvVars: []
-      controller:
-        image:
-          repository: goharbor/harbor-registryctl
-          tag: {{ .Modules.Registry.Version }}
-        extraEnvVars: []
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-      topologySpreadConstraints: []
-      podLabels:
-        "app.kubernetes.io/component": "harbor-registry"
-      priorityClassName:
-      secret: ""
-      existingSecret: ""
-      existingSecretKey: REGISTRY_HTTP_SECRET
-      relativeurls: false
-      credentials:
-        # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
-        existingSecret: ""
-        # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
-        # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
-        # htpasswdString: ""
-      middleware:
-        enabled: false
-        type: cloudFront
-        cloudFront:
-          baseurl: example.cloudfront.net
-          keypairid: KEYPAIRID
-          duration: 3000s
-          ipfilteredby: none
-          # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
-          # that allows access to CloudFront
-          privateKeySecret: "my-secret"
-      # enable purge _upload directories
-      upload_purging:
-        enabled: true
-        # remove files in _upload directories which exist for a period of time, default is one week.
-        age: 168h
-        # the interval of the purge operations
-        interval: 24h
-        dryrun: false
-
-    trivy:
-      enabled: {{ .Modules.Registry.EnabledScanner }}
-      image:
-        repository: goharbor/trivy-adapter-photon
-        tag: {{ .Modules.Registry.Version }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      resources:
-        requests:
-          cpu: 200m
-          memory: 512Mi
-        limits:
-          cpu: 1
-          memory: 1Gi
-
-
-    database:
-      # if external database is used, set "type" to "external"
-      # and fill the connection information in "external" section
-      type: internal
-      internal:
-        image:
-          repository: goharbor/harbor-db
-          tag: {{ .Modules.Registry.Version }}
-        serviceAccountName: ""
-        automountServiceAccountToken: false
-        livenessProbe:
-          timeoutSeconds: 1
-        readinessProbe:
-          timeoutSeconds: 1
-        priorityClassName:
-        # The initial superuser password for internal database
-        # password: "changeit"
-        # The size limit for Shared memory, pgSQL use it for shared_buffer
-        # More details see:
-        # https://github.com/goharbor/harbor/issues/15034
-        shmSizeLimit: 512Mi
-        initContainer:
-          migrator: {}
-          # resources:
-          #  requests:
-          #    memory: 128Mi
-          #    cpu: 100m
-          permissions: {}
-          # resources:
-          #  requests:
-          #    memory: 128Mi
-          #    cpu: 100m
-      external:
-        host: "192.168.0.1"
-        port: "5432"
-        username: "user"
-        password: "password"
-        coreDatabase: "registry"
-        # if using existing secret, the key must be "password"
-        existingSecret: ""
-        # "disable" - No SSL
-        # "require" - Always SSL (skip verification)
-        # "verify-ca" - Always SSL (verify that the certificate presented by the
-        # server was signed by a trusted CA)
-        # "verify-full" - Always SSL (verify that the certification presented by the
-        # server was signed by a trusted CA and the server host name matches the one
-        # in the certificate)
-        sslmode: "disable"
-      # The maximum number of connections in the idle connection pool per pod (core+exporter).
-      # If it <=0, no idle connections are retained.
-      maxIdleConns: 100
-      # The maximum number of open connections to the database per pod (core+exporter).
-      # If it <= 0, then there is no limit on the number of open connections.
-      # Note: the default number of connections is 1024 for postgre of harbor.
-      maxOpenConns: 900
-      ## Additional deployment annotations
-      podAnnotations: {}
-      ## Additional deployment labels
-      podLabels: {}
-
-
-    redis:
-      type: internal
-      internal:
-        image:
-          repository: goharbor/redis-photon
-          tag: {{ .Modules.Registry.Version }}
-        serviceAccountName: ""
-        automountServiceAccountToken: false
-        extraEnvVars: []
-        nodeSelector: {}
-        tolerations: []
-        affinity: {}
-        priorityClassName:
-        jobserviceDatabaseIndex: "1"
-        registryDatabaseIndex: "2"
-        trivyAdapterIndex: "5"
-        # harborDatabaseIndex: "6"
-        # cacheLayerDatabaseIndex: "7"
-      external:
-        # support redis, redis+sentinel
-        # addr for redis: <host_redis>:<port_redis>
-        # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
-        addr: "192.168.0.2:6379"
-        # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
-        sentinelMasterSet: ""
-        # The "coreDatabaseIndex" must be "0" as the library Harbor
-        # used doesn't support configuring it
-        # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
-        # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
-        coreDatabaseIndex: "0"
-        jobserviceDatabaseIndex: "1"
-        registryDatabaseIndex: "2"
-        trivyAdapterIndex: "5"
-        # harborDatabaseIndex: "6"
-        # cacheLayerDatabaseIndex: "7"
-        # username field can be an empty string, and it will be authenticated against the default user
-        username: ""
-        password: ""
-        existingSecret: ""
-      podAnnotations: {}
-      podLabels: {}

internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl

@@ -1,879 +0,0 @@
-- name: vault
-  namespace: secrets-storage
-  create_namespace: true
-  chart_ref: {{ .Modules.SecretsStorage.ChartRef }}
-  chart_version: {{ .Modules.SecretsStorage.ChartVersion }}
-  {{- if .Modules.SecretsStorage.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    global:
-      enabled: true
-
-      imagePullSecrets: []
-      tlsDisable: true
-
-      externalVaultAddr: ""
-
-      openshift: false
-
-      # Create PodSecurityPolicy for pods
-      psp:
-        enable: false
-        # Annotation for PodSecurityPolicy.
-        # This is a multi-line templated string map, and can also be set as YAML.
-        annotations: |
-          seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
-          apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-          seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
-          apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
-
-      serverTelemetry:
-        # Enable integration with the Prometheus Operator
-        # See the top level serverTelemetry section below before enabling this feature.
-        prometheusOperator: false
-
-    injector:
-      enabled: true
-
-      replicas: 1
-
-      # Configures the port the injector should listen on
-      port: 8080
-
-      # If multiple replicas are specified, by default a leader will be determined
-      # so that only one injector attempts to create TLS certificates.
-      leaderElector:
-        enabled: true
-
-      # If true, will enable a node exporter metrics endpoint at /metrics.
-      metrics:
-        enabled: false
-
-      # Deprecated: Please use global.externalVaultAddr instead.
-      externalVaultAddr: ""
-
-      # image sets the repo and tag of the vault-k8s image to use for the injector.
-      image:
-        repository: "{{ .Modules.SecretsStorage.Injector.Image }}"
-        tag: "{{ .Modules.SecretsStorage.Injector.Tag }}"
-        pullPolicy: IfNotPresent
-
-      # agentImage sets the repo and tag of the Vault image to use for the Vault Agent
-      # containers.  This should be set to the official Vault image.  Vault 1.3.1+ is
-      # required.
-      agentImage:
-        repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
-        tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
-      agentDefaults:
-        cpuLimit: "500m"
-        cpuRequest: "250m"
-        memLimit: "128Mi"
-        memRequest: "64Mi"
-        # ephemeralLimit: "128Mi"
-        # ephemeralRequest: "64Mi"
-
-        # Default template type for secrets when no custom template is specified.
-        # Possible values include: "json" and "map".
-        template: "map"
-
-        # Default values within Agent's template_config stanza.
-        templateConfig:
-          exitOnRetryFailure: true
-          staticSecretRenderInterval: ""
-
-      # Used to define custom livenessProbe settings
-      livenessProbe:
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 2
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 5
-        # How often (in seconds) to perform the probe
-        periodSeconds: 2
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 5
-      # Used to define custom readinessProbe settings
-      readinessProbe:
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 2
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 5
-        # How often (in seconds) to perform the probe
-        periodSeconds: 2
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 5
-      # Used to define custom startupProbe settings
-      startupProbe:
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 12
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 5
-        # How often (in seconds) to perform the probe
-        periodSeconds: 5
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 5
-
-      # Mount Path of the Vault Kubernetes Auth Method.
-      authPath: "auth/kubernetes"
-
-      # Configures the log verbosity of the injector.
-      # Supported log levels include: trace, debug, info, warn, error
-      logLevel: "info"
-
-      # Configures the log format of the injector. Supported log formats: "standard", "json".
-      logFormat: "standard"
-
-      # Configures all Vault Agent sidecars to revoke their token when shutting down
-      revokeOnShutdown: false
-
-      webhook:
-        # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
-        # API Tag of the WebHook.
-        # To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
-        #
-        failurePolicy: Ignore
-
-        # matchPolicy specifies the approach to accepting changes based on the rules of
-        # the MutatingWebhookConfiguration.
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
-        # for more details.
-        #
-        matchPolicy: Exact
-
-        # timeoutSeconds is the amount of seconds before the webhook request will be ignored
-        # or fails.
-        # If it is ignored or fails depends on the failurePolicy
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
-        # for more details.
-        #
-        timeoutSeconds: 30
-
-        # namespaceSelector is the selector for restricting the webhook to only
-        # specific namespaces.
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
-        # for more details.
-        # Example:
-        # namespaceSelector:
-        #    matchLabels:
-        #      sidecar-injector: enabled
-        namespaceSelector: {}
-
-        # objectSelector is the selector for restricting the webhook to only
-        # specific labels.
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
-        # for more details.
-        # Example:
-        # objectSelector:
-        #    matchLabels:
-        #      vault-sidecar-injector: enabled
-
-        # Extra annotations to attach to the webhook
-        annotations: {}
-
-      # Deprecated: please use 'webhook.failurePolicy' instead
-      # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
-      # API Tag of the WebHook.
-      # To block pod creation while webhook is unavailable, set the policy to `Fail` below.
-      # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
-      #
-      failurePolicy: Ignore
-
-      # Deprecated: please use 'webhook.namespaceSelector' instead
-      # namespaceSelector is the selector for restricting the webhook to only
-      # specific namespaces.
-      # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
-      # for more details.
-      # Example:
-      # namespaceSelector:
-      #    matchLabels:
-      #      sidecar-injector: enabled
-      namespaceSelector: {}
-
-      # Deprecated: please use 'webhook.objectSelector' instead
-      # objectSelector is the selector for restricting the webhook to only
-      # specific labels.
-      # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
-      # for more details.
-      # Example:
-      # objectSelector:
-      #    matchLabels:
-      #      vault-sidecar-injector: enabled
-      objectSelector: {}
-
-      # Deprecated: please use 'webhook.annotations' instead
-      # Extra annotations to attach to the webhook
-      webhookAnnotations: {}
-
-      certs:
-        # secretName is the name of the secret that has the TLS certificate and
-        # private key to serve the injector webhook. If this is null, then the
-        # injector will default to its automatic management mode that will assign
-        # a service account to the injector to generate its own certificates.
-        secretName: null
-
-        # caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
-        # that signed the TLS certificate that the webhook serves. This must be set
-        # if secretName is non-null unless an external service like cert-manager is
-        # keeping the caBundle updated.
-        caBundle: ""
-
-        # certName and keyName are the names of the files within the secret for
-        # the TLS cert and private key, respectively. These have reasonable
-        # defaults but can be customized if necessary.
-        certName: tls.crt
-        keyName: tls.key
-
-      securityContext:
-        pod: {}
-        container: {}
-
-      resources: {}
-
-      # extraEnvironmentVars is a list of extra environment variables to set in the
-      # injector deployment.
-      extraEnvironmentVars: {}
-        # KUBERNETES_SERVICE_HOST: kubernetes.default.svc
-
-      topologySpreadConstraints: []
-
-      tolerations: []
-
-      nodeSelector: {}
-
-      priorityClassName: ""
-
-      annotations: {}
-
-      extraLabels: {}
-
-      hostNetwork: false
-
-
-      service:
-        # Extra annotations to attach to the injector service
-        annotations: {}
-
-      # Injector serviceAccount specific config
-      serviceAccount:
-        # Extra annotations to attach to the injector serviceAccount
-        annotations: {}
-
-      # A disruption budget limits the number of pods of a replicated application
-      # that are down simultaneously from voluntary disruptions
-      podDisruptionBudget: {}
-      # podDisruptionBudget:
-      #   maxUnavailable: 1
-
-      # strategy for updating the deployment. This can be a multi-line string or a
-      # YAML map.
-      strategy: {}
-      # strategy: |
-      #   rollingUpdate:
-      #     maxSurge: 25%
-      #     maxUnavailable: 25%
-      #   type: RollingUpdate
-
-    server:
-      enabled: true
-      enterpriseLicense:
-        # The name of the Kubernetes secret that holds the enterprise license. The
-        # secret must be in the same namespace that Vault is installed into.
-        secretName: ""
-        # The key within the Kubernetes secret that holds the enterprise license.
-        secretKey: "license"
-
-      image:
-        repository: "{{ .Modules.SecretsStorage.Server.Image }}"
-        tag: "{{ .Modules.SecretsStorage.Server.Tag }}"
-        # Overrides the default Image Pull Policy
-        pullPolicy: IfNotPresent
-
-      updateStrategyType: "RollingUpdate"
-
-      # Supported log levels include: trace, debug, info, warn, error
-      logLevel: ""
-
-      # Supported log formats include: standard, json
-      logFormat: ""
-
-      resources: {}
-
-      hostAliases: []
-      # - ip: 127.0.0.1
-      #   hostnames:
-      #     - chart-example.local
-
-      route:
-        enabled: false
-
-        # When HA mode is enabled and K8s service registration is being used,
-        # configure the route to point to the Vault active service.
-        activeService: true
-
-        labels: {}
-        annotations: {}
-        host: chart-example.local
-        # tls will be passed directly to the route's TLS config, which
-        # can be used to configure other termination methods that terminate
-        # TLS at the router
-        tls:
-          termination: passthrough
-
-      # authDelegator enables a cluster role binding to be attached to the service
-      # account.  This cluster role binding can be used to setup Kubernetes auth
-      # method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
-      authDelegator:
-        enabled: true
-
-      extraInitContainers: null
-      extraContainers: null
-      shareProcessNamespace: false
-      extraArgs: ""
-
-      extraPorts: null
-        # - containerPort: 8300
-        #   name: http-monitoring
-
-      readinessProbe:
-        enabled: false
-        # If you need to use a http path instead of the default exec
-        # path: /v1/sys/health?standbyok=true
-
-        # Port number on which readinessProbe will be checked.
-        port: 8200
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 2
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 5
-        # How often (in seconds) to perform the probe
-        periodSeconds: 5
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 3
-      # Used to enable a livenessProbe for the pods
-      livenessProbe:
-        enabled: false
-        # Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
-        execCommand: []
-        # - /bin/sh
-        # - -c
-        # - /vault/userconfig/mylivenessscript/run.sh
-        # Path for the livenessProbe to use httpGet as the livenessProbe handler
-        path: "/v1/sys/health?standbyok=true"
-        # Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
-        port: 8200
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 2
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 60
-        # How often (in seconds) to perform the probe
-        periodSeconds: 5
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 3
-
-      terminationGracePeriodSeconds: 10
-
-      # Used to set the sleep time during the preStop step
-      preStopSleepSeconds: 5
-
-      extraEnvironmentVars: {}
-
-      extraSecretEnvironmentVars: []
-
-      extraVolumes: []
-
-      volumes: null
-
-      volumeMounts: null
-
-      topologySpreadConstraints: []
-
-      tolerations: []
-      nodeSelector: {}
-
-      # Enables network policy for server pods
-      networkPolicy:
-        enabled: false
-        egress: []
-        # egress:
-        # - to:
-        #   - ipBlock:
-        #       cidr: 10.0.0.0/24
-        #   ports:
-        #   - protocol: TCP
-        #     port: 443
-        ingress:
-          - from:
-            - namespaceSelector: {}
-            ports:
-            - port: 8200
-              protocol: TCP
-            - port: 8201
-              protocol: TCP
-
-      priorityClassName: ""
-      extraLabels: {}
-
-      annotations: {}
-
-      service:
-        enabled: true
-        # Enable or disable the vault-active service, which selects Vault pods that
-        # have labeled themselves as the cluster leader with `vault-active: "true"`.
-        active:
-          enabled: true
-          # Extra annotations for the service definition. This can either be YAML or a
-          # YAML-formatted multi-line templated string map of the annotations to apply
-          # to the active service.
-          annotations: {}
-        # Enable or disable the vault-standby service, which selects Vault pods that
-        # have labeled themselves as a cluster follower with `vault-active: "false"`.
-        standby:
-          enabled: true
-          # Extra annotations for the service definition. This can either be YAML or a
-          # YAML-formatted multi-line templated string map of the annotations to apply
-          # to the standby service.
-          annotations: {}
-        # When disabled, services may select Vault pods not deployed from the chart.
-        # Does not affect the headless vault-internal service with `ClusterIP: None`
-        instanceSelector:
-          enabled: true
-        # clusterIP controls whether a Cluster IP address is attached to the
-        # Vault service within Kubernetes.  By default, the Vault service will
-        # be given a Cluster IP address, set to None to disable.  When disabled
-        # Kubernetes will create a "headless" service.  Headless services can be
-        # used to communicate with pods directly through DNS instead of a round-robin
-        # load balancer.
-        # clusterIP: None
-
-        # Configures the service type for the main Vault service.  Can be ClusterIP
-        # or NodePort.
-        #type: ClusterIP
-
-        # The IP family and IP families options are to set the behaviour in a dual-stack environment.
-        # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
-        # should be.
-        # These are only supported for kubernetes versions >=1.23.0
-        #
-        # Configures the service's supported IP family policy, can be either:
-        #     SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
-        #     PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
-        #     RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
-        ipFamilyPolicy: ""
-
-        # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
-        # Can be IPv4 and/or IPv6.
-        ipFamilies: []
-
-        # Do not wait for pods to be ready before including them in the services'
-        # targets. Does not apply to the headless service, which is used for
-        # cluster-internal communication.
-        publishNotReadyAddresses: true
-
-        # The externalTrafficPolicy can be set to either Cluster or Local
-        # and is only valid for LoadBalancer and NodePort service types.
-        # The default value is Cluster.
-        # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
-        externalTrafficPolicy: Cluster
-
-        # If type is set to "NodePort", a specific nodePort value can be configured,
-        # will be random if left blank.
-        #nodePort: 30000
-
-        # When HA mode is enabled
-        # If type is set to "NodePort", a specific nodePort value can be configured,
-        # will be random if left blank.
-        #activeNodePort: 30001
-
-        # When HA mode is enabled
-        # If type is set to "NodePort", a specific nodePort value can be configured,
-        # will be random if left blank.
-        #standbyNodePort: 30002
-
-        # Port on which Vault server is listening
-        port: 8200
-        # Target port to which the service should be mapped to
-        targetPort: 8200
-        # Extra annotations for the service definition. This can either be YAML or a
-        # YAML-formatted multi-line templated string map of the annotations to apply
-        # to the service.
-        annotations: {}
-
-      dataStorage:
-        enabled: true
-        size: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.Size }}
-        mountPath: "/vault/data"
-        storageClass: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.StorageClass }}
-        accessMode: ReadWriteOnce
-        annotations: {}
-        labels: {}
-
-      persistentVolumeClaimRetentionPolicy: {}
-
-      # required for ha installation
-      auditStorage:
-        enabled: false
-        # Size of the PVC created
-        size: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.Size }}
-        # Location where the PVC will be mounted.
-        mountPath: "/vault/audit"
-        # Name of the storage class to use.  If null it will use the
-        # configured default Storage Class.
-        storageClass: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.StorageClass }}
-        # Access Mode of the storage device being used for the PVC
-        accessMode: ReadWriteOnce
-        # Annotations to apply to the PVC
-        annotations: {}
-        # Labels to apply to the PVC
-        labels: {}
-
-      dev:
-        enabled: false
-
-        # Set VAULT_DEV_ROOT_TOKEN_ID value
-        devRootToken: "root"
-
-      # Run Vault in "standalone" mode. This is the default mode that will deploy if
-      # no arguments are given to helm. This requires a PVC for data storage to use
-      # the "file" backend.  This mode is not highly available and should not be scaled
-      # past a single replica.
-      standalone:
-        enabled: "-"
-
-        # config is a raw string of default configuration when using a Stateful
-        # deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
-        # and store data there. This is only used when using a Replica count of 1, and
-        # using a stateful set. This should be HCL.
-
-        # Note: Configuration files are stored in ConfigMaps so sensitive data
-        # such as passwords should be either mounted through extraSecretEnvironmentVars
-        # or through a Kube secret.  For more information see:
-        # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
-        config: |
-          ui = true
-
-          listener "tcp" {
-            tls_disable = 1
-            address = "[::]:8200"
-            cluster_address = "[::]:8201"
-
-            {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-            telemetry {
-              unauthenticated_metrics_access = "true"
-            }
-            {{- end }}
-          }
-          storage "file" {
-            path = "/vault/data"
-          }
-
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-          telemetry {
-            prometheus_retention_time = "30s"
-            disable_hostname = true
-          }
-          {{- end }}
-
-      # Run Vault in "HA" mode. There are no storage requirements unless the audit log
-      # persistence is required.  In HA mode Vault will configure itself to use Consul
-      # for its storage backend.  The default configuration provided will work the Consul
-      # Helm project by default.  It is possible to manually configure Vault to use a
-      # different HA backend.
-      ha:
-        enabled: false
-        replicas: 3
-
-        # Set the api_addr configuration for Vault HA
-        # See https://developer.hashicorp.com/vault/docs/configuration#api_addr
-        # If set to null, this will be set to the Pod IP Address
-        apiAddr: null
-
-        # Set the cluster_addr confuguration for Vault HA
-        # See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
-        clusterAddr: null
-
-        # Enables Vault's integrated Raft storage.  Unlike the typical HA modes where
-        # Vault's persistence is external (such as Consul), enabling Raft mode will create
-        # persistent volumes for Vault to store data according to the configuration under server.dataStorage.
-        # The Vault cluster will coordinate leader elections and failovers internally.
-        raft:
-          # Enables Raft integrated storage
-          enabled: false
-          # Set the Node Raft ID to the name of the pod
-          setNodeId: false
-
-          config: |
-            ui = true
-
-            listener "tcp" {
-              tls_disable = 1
-              address = "[::]:8200"
-              cluster_address = "[::]:8201"
-
-              {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-              telemetry {
-                unauthenticated_metrics_access = "true"
-              }
-              {{- end }}
-            }
-
-            storage "raft" {
-              path = "/vault/data"
-            }
-
-            service_registration "kubernetes" {}
-
-        # config is a raw string of default configuration when using a Stateful
-        # deployment. Default is to use a Consul for its HA storage backend.
-        # This should be HCL.
-
-        # Note: Configuration files are stored in ConfigMaps so sensitive data
-        # such as passwords should be either mounted through extraSecretEnvironmentVars
-        # or through a Kube secret.  For more information see:
-        # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
-        config: |
-          ui = true
-
-          listener "tcp" {
-            tls_disable = 1
-            address = "[::]:8200"
-            cluster_address = "[::]:8201"
-            {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-            telemetry {
-              unauthenticated_metrics_access = "true"
-            }
-            {{- end }}
-          }
-          storage "consul" {
-            path = "vault"
-            address = "HOST_IP:8500"
-          }
-
-          service_registration "kubernetes" {}
-
-          # Example configuration for using auto-unseal, using Google Cloud KMS. The
-          # GKMS keys must already exist, and the cluster must have a service account
-          # that is authorized to access GCP KMS.
-          #seal "gcpckms" {
-          #   project     = "vault-helm-dev-246514"
-          #   region      = "global"
-          #   key_ring    = "vault-helm-unseal-kr"
-          #   crypto_key  = "vault-helm-unseal-key"
-          #}
-
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-          telemetry {
-            prometheus_retention_time = "30s"
-            disable_hostname = true
-          }
-          {{- end }}
-
-        # A disruption budget limits the number of pods of a replicated application
-        # that are down simultaneously from voluntary disruptions
-        disruptionBudget:
-          enabled: true
-
-        # maxUnavailable will default to (n/2)-1 where n is the number of
-        # replicas. If you'd like a custom value, you can specify an override here.
-          maxUnavailable: null
-
-      serviceAccount:
-        create: true
-        name: ""
-        createSecret: false
-        annotations: {}
-        extraLabels: {}
-        serviceDiscovery:
-          enabled: true
-
-      statefulSet:
-        annotations: {}
-        securityContext:
-          pod: {}
-          container: {}
-
-      hostNetwork: false
-
-    # Vault UI
-    ui:
-      enabled: true
-      domain: {{ .Modules.SecretsStorage.Expose.Domain }}
-      publishNotReadyAddresses: true
-      # The service should only contain selectors for active Vault pod
-      activeVaultPodOnly: false
-      {{- if eq .Modules.SecretsStorage.Expose.Type "NodePort" }}
-      serviceType: "NodePort"
-      serviceNodePort: {{ .Modules.SecretsStorage.Expose.NodePort }}
-      {{- else }}
-      serviceType: "ClusterIP"
-      serviceNodePort: null
-      {{- end }}
-      externalPort: 8200
-      targetPort: 8200
-
-      serviceIPFamilyPolicy: ""
-
-      serviceIPFamilies: []
-
-      externalTrafficPolicy: Cluster
-
-      #loadBalancerSourceRanges:
-      #   - 10.0.0.0/16
-      #   - 1.78.23.3/32
-
-      # loadBalancerIP:
-
-      annotations: {}
-
-    csi:
-      # True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
-      #
-      # Requires installing the secrets-store-csi-driver separately, see:
-      # https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
-      #
-      # With the driver and provider installed, you can mount Vault secrets into volumes
-      # similar to the Vault Agent injector, and you can also sync those secrets into
-      # Kubernetes secrets.
-      enabled: {{ .Modules.SecretsStorage.CsiIntegration.Enabled }}
-
-      image:
-        repository: "{{ .Modules.SecretsStorage.CsiIntegration.Image }}"
-        tag: "{{ .Modules.SecretsStorage.CsiIntegration.Tag }}"
-        pullPolicy: IfNotPresent
-
-      volumes: null
-
-      volumeMounts: null
-
-      resources: {}
-
-      # Override the default secret name for the CSI Provider's HMAC key used for
-      # generating secret versions.
-      hmacSecretName: ""
-
-      daemonSet:
-        updateStrategy:
-          type: RollingUpdate
-          maxUnavailable: ""
-        # Extra annotations for the daemonSet. This can either be YAML or a
-        # YAML-formatted multi-line templated string map of the annotations to apply
-        # to the daemonSet.
-        annotations: {}
-        # Provider host path (must match the CSI provider's path)
-        providersDir: "/etc/kubernetes/secrets-store-csi-providers"
-        # Kubelet host path
-        kubeletRootDir: "/var/lib/kubelet"
-        # Extra labels to attach to the vault-csi-provider daemonSet
-        # This should be a YAML map of the labels to apply to the csi provider daemonSet
-        extraLabels: {}
-        # security context for the pod template and container in the csi provider daemonSet
-        securityContext:
-          pod: {}
-          container: {}
-
-      pod:
-        annotations: {}
-        tolerations: []
-        nodeSelector: {}
-        affinity: {}
-        extraLabels: {}
-
-      agent:
-        enabled: true
-        extraArgs: []
-
-        image:
-          repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
-          tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
-          pullPolicy: IfNotPresent
-
-        logFormat: standard
-        logLevel: info
-
-        resources: {}
-
-      priorityClassName: ""
-
-      serviceAccount:
-        annotations: {}
-        extraLabels: {}
-
-      readinessProbe:
-        enabled: true
-        failureThreshold: 2
-        initialDelaySeconds: 5
-        periodSeconds: 5
-        successThreshold: 1
-        timeoutSeconds: 3
-
-      livenessProbe:
-        failureThreshold: 2
-        initialDelaySeconds: 5
-        periodSeconds: 5
-        successThreshold: 1
-        timeoutSeconds: 3
-
-      debug: false
-      extraArgs: []
-
-    serverTelemetry:
-      # Enable support for the Prometheus Operator. Currently, this chart does not support
-      # authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
-      # in the `listener "tcp"{}` stanza
-      #  telemetry {
-      #    unauthenticated_metrics_access = "true"
-      #  }
-      #
-      # See the `standalone.config` for a more complete example of this.
-      #
-      # In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
-      #
-      # example:
-      #  telemetry {
-      #    prometheus_retention_time = "30s"
-      #    disable_hostname = true
-      #  }
-      #
-      # Configuration for monitoring the Vault server.
-      serviceMonitor:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        selectors: {}
-        interval: 30s
-        scrapeTimeout: 10s
-
-      prometheusRules:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-          selectors: {}
-          rules: []
-
-    ingress:
-      {{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }}
-      enabled: true
-      {{- end }}
-      accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-      class: {{ .Modules.Additional.Ingress.Type }}
-      annotations:
-        {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-        nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-        {{- end }}
-      tls:
-        {{- if .Modules.SecretsStorage.Expose.Tls.Enabled }}
-        enabled: true
-        {{- end }}
-        hosts:
-          - host: {{ .Modules.SecretsStorage.Expose.Domain }}
-            secretName: vault-tls

internal/resources/templates/helm-apps/repositories/repositories.yml.tmpl

@@ -1,5 +0,0 @@
-- name: kube-forge
-  url: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable"
-{{ if .Modules.AdditionalRepositories }}
-{{ .Modules.AdditionalRepositories | toYaml }}
-{{- end }}

internal/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl

@@ -134,8 +134,3 @@ unsafe_show_logs: false
 
 ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
 allow_unsupported_distribution_setup: false
-
-## Containerd settings
-# containerd_metadata_root_dir: /app/lib/containerd
-# The state directory for containerd
-# containerd_state_dir: /app/run/containerd

internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl

@@ -0,0 +1,52 @@
+---
+# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
+
+containerd_storage_dir: {{ .Orchestrator.ContainerEngine.DataDir }}
+containerd_state_dir:  {{ .Orchestrator.ContainerEngine.StateDir }}
+
+# containerd_oom_score: 0
+
+# containerd_default_runtime: "runc"
+# containerd_snapshotter: "native"
+
+# containerd_runc_runtime:
+#   name: runc
+#   type: "io.containerd.runc.v2"
+#   engine: ""
+#   root: ""
+
+# containerd_additional_runtimes:
+# Example for Kata Containers as additional runtime:
+#   - name: kata
+#     type: "io.containerd.kata.v2"
+#     engine: ""
+#     root: ""
+
+# containerd_grpc_max_recv_message_size: 16777216
+# containerd_grpc_max_send_message_size: 16777216
+
+# Containerd debug socket location: unix or tcp format
+# containerd_debug_address: ""
+
+# Containerd log level
+# containerd_debug_level: "info"
+
+# Containerd logs format, supported values: text, json
+# containerd_debug_format: ""
+
+# Containerd debug socket UID
+# containerd_debug_uid: 0
+
+# Containerd debug socket GID
+# containerd_debug_gid: 0
+
+# containerd_metrics_address: ""
+
+# containerd_metrics_grpc_histogram: false
+
+# containerd_max_container_log_line_size: -1
+
+# containerd_registry_auth:
+#   - registry: 10.0.0.2:5000
+#     username: user
+#     password: pass

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl

@@ -12,7 +12,7 @@ local_path_provisioner_enabled: true
 # local_path_provisioner_namespace: "local-path-storage"
 local_path_provisioner_storage_class: {{ .Modules.Additional.Storage.LocalPathProvisioner.StorageClassName }}
 local_path_provisioner_reclaim_policy: {{ .Modules.Additional.Storage.LocalPathProvisioner.ReclaimPolicy }}
-# local_path_provisioner_claim_root: /opt/local-path-provisioner/
+local_path_provisioner_claim_root: {{ .Modules.Additional.Storage.LocalPathProvisioner.DataDir }}
 # local_path_provisioner_debug: false
 # local_path_provisioner_image_repo: "rancher/local-path-provisioner"
 # local_path_provisioner_image_tag: "v0.0.23"
@@ -154,7 +154,7 @@ cert_manager_dns_config:
     - "8.8.4.4"
 
 # MetalLB deployment
-{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
+{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
 metallb_enabled: true
 {{- else }}
 metallb_enabled: false
@@ -232,13 +232,3 @@ argocd_enabled: false
 # The plugin manager for kubectl
 krew_enabled: false
 krew_root_dir: "/usr/local/krew"
-
-
-########################################
-# Helm apps configuration
-########################################
-repositories:
-  {{- .Repositories | nindent 2 }}
-
-releases:
-  {{- .Releases | nindent 2 }}

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl

@@ -122,11 +122,12 @@ kube_apiserver_port: 6443  # (https)
 
 # Kube-proxy proxyMode configuration.
 # Can be ipvs, iptables
-kube_proxy_mode: ipvs
+kube_proxy_mode: {{ .Orchestrator.ProxyMode }}
+kube_proxy_scheduler: {{ .Orchestrator.ProxyScheduler }}
 
 # configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
 # must be set to true for MetalLB, kube-vip(ARP enabled) to work
-{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
+{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
 kube_proxy_strict_arp: true
 {{- else }}
 kube_proxy_strict_arp: false
@@ -183,7 +184,10 @@ nodelocaldns_health_port: 9254
 nodelocaldns_second_health_port: 9256
 nodelocaldns_bind_metrics_host_ip: false
 nodelocaldns_secondary_skew_seconds: 5
-# nodelocaldns_external_zones:
+{{- if .Orchestrator.Dns.CoreDNSExternalZones }}
+coredns_external_zones:
+  {{- .Orchestrator.Dns.CoreDNSExternalZones | toYaml | nindent 2 }}
+{{- end }}
 # - zones:
 #   - example.com
 #   - example.io:1053
@@ -231,6 +235,72 @@ dns_domain: {{ `"{{ cluster_name }}"` }}
 ## Default: containerd
 container_manager: {{ .Orchestrator.ContainerEngine.Type }}
 
+{{- if .Orchestrator.RegistryMirrors }}
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+      - host: {{ $registryData.Host }}
+        capabilities: ["pull", "resolve"]
+        skip_verify: {{ $registryData.SkipVerify }}
+      {{- end }}
+{{- else }}
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      - host: https://mirror.gcr.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://quay.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://registry.redhat.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+{{- end }}
+
+## CRI-O registry mirrors setup
+{{- if .Orchestrator.RegistryMirrors }}
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+      - location: {{ $registryData.Host }}
+        insecure: {{ $registryData.SkipVerify }}
+      {{- end }}
+{{- else }}
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      - location: https://mirror.gcr.io
+        insecure: false
+      - location: https://quay.io
+        insecure: false
+      - location: https://registry.redhat.io
+        insecure: false
+{{- end }}
+
+## Docker registry mirrors setup
+{{- if .Orchestrator.RegistryMirrors }}
+docker_registry_mirrors:
+  {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+  - {{ $registryData.Host }}
+  {{- end }}
+{{- else }}
+docker_registry_mirrors:
+  - https://mirror.gcr.io
+  - https://quay.io
+  - https://registry.redhat.io
+{{- end }}
+
 # Additional container runtimes
 kata_containers_enabled: false
 
@@ -378,7 +448,10 @@ auto_renew_certificates: {{ .Orchestrator.AutoRenewCertificates }}
 # auto_renew_certificates_systemd_calendar: {{ `"Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"` }}
 
 # kubeadm patches path
-kubeadm_patches:
-  enabled: false
-  source_dir: {{ `"{{ inventory_dir }}/patches"` }}
-  dest_dir: {{ `"{{ kube_config_dir }}/patches"` }}
+kubeadm_patches: []
+
+{{- if not (eq .Orchestrator.KubeletDir "/var/lib/kubelet") }}
+## Kubelet additional settings
+kubelet_custom_flags:
+  - "--root-dir={{ .Orchestrator.KubeletDir }}"
+{{- end }}

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml.tmpl

@@ -0,0 +1,131 @@
+---
+# see roles/network_plugin/calico/defaults/main.yml
+
+# the default value of name
+calico_cni_name: k8s-pod-network
+
+## With calico it is possible to distributed routes with border routers of the datacenter.
+## Warning : enabling router peering will disable calico's default behavior ('node mesh').
+## The subnets of each nodes will be distributed by the datacenter router
+# peer_with_router: false
+
+# Enables Internet connectivity from containers
+# nat_outgoing: true
+
+# Enables Calico CNI "host-local" IPAM plugin
+# calico_ipam_host_local: true
+
+# add default ippool name
+# calico_pool_name: "default-pool"
+
+# add default ippool blockSize (defaults kube_network_node_prefix)
+calico_pool_blocksize: 26
+
+# add default ippool CIDR (must be inside kube_pods_subnet, defaults to kube_pods_subnet otherwise)
+# calico_pool_cidr: 1.2.3.4/5
+
+# add default ippool CIDR to CNI config
+# calico_cni_pool: true
+
+# Add default IPV6 IPPool CIDR. Must be inside kube_pods_subnet_ipv6. Defaults to kube_pods_subnet_ipv6 if not set.
+# calico_pool_cidr_ipv6: fd85:ee78:d8a6:8607::1:0000/112
+
+# Add default IPV6 IPPool CIDR to CNI config
+# calico_cni_pool_ipv6: true
+
+# Global as_num (/calico/bgp/v1/global/as_num)
+# global_as_num: "64512"
+
+# If doing peering with node-assigned asn where the globas does not match your nodes, you want this
+# to be true.  All other cases, false.
+# calico_no_global_as_num: false
+
+# You can set MTU value here. If left undefined or empty, it will
+# not be specified in calico CNI config, so Calico will use built-in
+# defaults. The value should be a number, not a string.
+# calico_mtu: 1500
+
+# Configure the MTU to use for workload interfaces and tunnels.
+# - If Wireguard is enabled, subtract 60 from your network MTU (i.e 1500-60=1440)
+# - Otherwise, if VXLAN or BPF mode is enabled, subtract 50 from your network MTU (i.e. 1500-50=1450)
+# - Otherwise, if IPIP is enabled, subtract 20 from your network MTU (i.e. 1500-20=1480)
+# - Otherwise, if not using any encapsulation, set to your network MTU (i.e. 1500)
+# calico_veth_mtu: 1440
+
+# Advertise Cluster IPs
+# calico_advertise_cluster_ips: true
+
+# Advertise Service External IPs
+# calico_advertise_service_external_ips:
+# - x.x.x.x/24
+# - y.y.y.y/32
+
+# Advertise Service LoadBalancer IPs
+# calico_advertise_service_loadbalancer_ips:
+# - x.x.x.x/24
+# - y.y.y.y/16
+
+# Choose data store type for calico: "etcd" or "kdd" (kubernetes datastore)
+# calico_datastore: "kdd"
+
+# Choose Calico iptables backend: "Legacy", "Auto" or "NFT"
+# calico_iptables_backend: "Auto"
+
+# Use typha (only with kdd)
+# typha_enabled: false
+
+# Generate TLS certs for secure typha<->calico-node communication
+# typha_secure: false
+
+# Scaling typha: 1 replica per 100 nodes is adequate
+# Number of typha replicas
+# typha_replicas: 1
+
+# Set max typha connections
+# typha_max_connections_lower_limit: 300
+
+# Set calico network backend: "bird", "vxlan" or "none"
+# bird enable BGP routing, required for ipip and no encapsulation modes
+# calico_network_backend: vxlan
+
+# IP in IP and VXLAN is mutualy exclusive modes.
+# set IP in IP encapsulation mode: "Always", "CrossSubnet", "Never"
+# calico_ipip_mode: 'Never'
+
+# set VXLAN encapsulation mode: "Always", "CrossSubnet", "Never"
+# calico_vxlan_mode: 'Always'
+
+# set VXLAN port and VNI
+# calico_vxlan_vni: 4096
+# calico_vxlan_port: 4789
+
+# Enable eBPF mode
+calico_bpf_enabled: {{ .Orchestrator.Network.Calico.EnableBpf }}
+
+# If you want to use non default IP_AUTODETECTION_METHOD, IP6_AUTODETECTION_METHOD for calico node set this option to one of:
+# * can-reach=DESTINATION
+# * interface=INTERFACE-REGEX
+# see https://docs.projectcalico.org/reference/node/configuration
+# calico_ip_auto_method: "interface=eth.*"
+# calico_ip6_auto_method: "interface=eth.*"
+
+# Set FELIX_MTUIFACEPATTERN, Pattern used to discover the host’s interface for MTU auto-detection.
+# see https://projectcalico.docs.tigera.io/reference/felix/configuration
+# calico_felix_mtu_iface_pattern: "^((en|wl|ww|sl|ib)[opsx].*|(eth|wlan|wwan).*)"
+
+# Choose the iptables insert mode for Calico: "Insert" or "Append".
+# calico_felix_chaininsertmode: Insert
+
+# If you want use the default route interface when you use multiple interface with dynamique route (iproute2)
+# see https://docs.projectcalico.org/reference/node/configuration : FELIX_DEVICEROUTESOURCEADDRESS
+# calico_use_default_route_src_ipaddr: false
+
+# Enable calico traffic encryption with wireguard
+# calico_wireguard_enabled: false
+
+# Under certain situations liveness and readiness probes may need tunning
+# calico_node_livenessprobe_timeout: 10
+# calico_node_readinessprobe_timeout: 10
+
+# Calico apiserver (only with kdd)
+# calico_apiserver_enabled: false

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml.tmpl

@@ -0,0 +1,245 @@
+---
+# cilium_version: "v1.12.1"
+
+# Log-level
+# cilium_debug: false
+
+# cilium_mtu: ""
+# cilium_enable_ipv4: true
+# cilium_enable_ipv6: false
+
+# Cilium agent health port
+# cilium_agent_health_port: "9879"
+
+# Identity allocation mode selects how identities are shared between cilium
+# nodes by setting how they are stored. The options are "crd" or "kvstore".
+# - "crd" stores identities in kubernetes as CRDs (custom resource definition).
+#   These can be queried with:
+#     `kubectl get ciliumid`
+# - "kvstore" stores identities in an etcd kvstore.
+# - In order to support External Workloads, "crd" is required
+#   - Ref: https://docs.cilium.io/en/stable/gettingstarted/external-workloads/#setting-up-support-for-external-workloads-beta
+# - KVStore operations are only required when cilium-operator is running with any of the below options:
+#   - --synchronize-k8s-services
+#   - --synchronize-k8s-nodes
+#   - --identity-allocation-mode=kvstore
+#   - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations
+# cilium_identity_allocation_mode: kvstore
+
+# Etcd SSL dirs
+# cilium_cert_dir: /etc/cilium/certs
+# kube_etcd_cacert_file: ca.pem
+# kube_etcd_cert_file: cert.pem
+# kube_etcd_key_file: cert-key.pem
+
+# Limits for apps
+# cilium_memory_limit: 500M
+# cilium_cpu_limit: 500m
+# cilium_memory_requests: 64M
+# cilium_cpu_requests: 100m
+
+# Overlay Network Mode
+# cilium_tunnel_mode: vxlan
+# Optional features
+# cilium_enable_prometheus: false
+# Enable if you want to make use of hostPort mappings
+# cilium_enable_portmap: false
+# Monitor aggregation level (none/low/medium/maximum)
+# cilium_monitor_aggregation: medium
+# The monitor aggregation flags determine which TCP flags which, upon the
+# first observation, cause monitor notifications to be generated.
+#
+# Only effective when monitor aggregation is set to "medium" or higher.
+# cilium_monitor_aggregation_flags: "all"
+# Kube Proxy Replacement mode (strict/partial)
+# cilium_kube_proxy_replacement: partial
+
+# If upgrading from Cilium < 1.5, you may want to override some of these options
+# to prevent service disruptions. See also:
+# http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action
+# cilium_preallocate_bpf_maps: false
+
+# `cilium_tofqdns_enable_poller` is deprecated in 1.8, removed in 1.9
+# cilium_tofqdns_enable_poller: false
+
+# `cilium_enable_legacy_services` is deprecated in 1.6, removed in 1.9
+# cilium_enable_legacy_services: false
+
+# Unique ID of the cluster. Must be unique across all conneted clusters and
+# in the range of 1 and 255. Only relevant when building a mesh of clusters.
+# This value is not defined by default
+# cilium_cluster_id:
+
+# Deploy cilium even if kube_network_plugin is not cilium.
+# This enables to deploy cilium alongside another CNI to replace kube-proxy.
+# cilium_deploy_additionally: false
+
+# Auto direct nodes routes can be used to advertise pods routes in your cluster
+# without any tunelling (with `cilium_tunnel_mode` sets to `disabled`).
+# This works only if you have a L2 connectivity between all your nodes.
+# You wil also have to specify the variable `cilium_native_routing_cidr` to
+# make this work. Please refer to the cilium documentation for more
+# information about this kind of setups.
+# cilium_auto_direct_node_routes: false
+
+# Allows to explicitly specify the IPv4 CIDR for native routing.
+# When specified, Cilium assumes networking for this CIDR is preconfigured and
+# hands traffic destined for that range to the Linux network stack without
+# applying any SNAT.
+# Generally speaking, specifying a native routing CIDR implies that Cilium can
+# depend on the underlying networking stack to route packets to their
+# destination. To offer a concrete example, if Cilium is configured to use
+# direct routing and the Kubernetes CIDR is included in the native routing CIDR,
+# the user must configure the routes to reach pods, either manually or by
+# setting the auto-direct-node-routes flag.
+# cilium_native_routing_cidr: ""
+
+# Allows to explicitly specify the IPv6 CIDR for native routing.
+# cilium_native_routing_cidr_ipv6: ""
+
+# Enable transparent network encryption.
+# cilium_encryption_enabled: false
+
+# Encryption method. Can be either ipsec or wireguard.
+# Only effective when `cilium_encryption_enabled` is set to true.
+# cilium_encryption_type: "ipsec"
+
+# Enable encryption for pure node to node traffic.
+# This option is only effective when `cilium_encryption_type` is set to `ipsec`.
+# cilium_ipsec_node_encryption: false
+
+# If your kernel or distribution does not support WireGuard, Cilium agent can be configured to fall back on the user-space implementation.
+# When this flag is enabled and Cilium detects that the kernel has no native support for WireGuard,
+# it will fallback on the wireguard-go user-space implementation of WireGuard.
+# This option is only effective when `cilium_encryption_type` is set to `wireguard`.
+# cilium_wireguard_userspace_fallback: false
+
+# IP Masquerade Agent
+# https://docs.cilium.io/en/stable/concepts/networking/masquerading/
+# By default, all packets from a pod destined to an IP address outside of the cilium_native_routing_cidr range are masqueraded
+# cilium_ip_masq_agent_enable: false
+
+### A packet sent from a pod to a destination which belongs to any CIDR from the nonMasqueradeCIDRs is not going to be masqueraded
+# cilium_non_masquerade_cidrs:
+#   - 10.0.0.0/8
+#   - 172.16.0.0/12
+#   - 192.168.0.0/16
+#   - 100.64.0.0/10
+#   - 192.0.0.0/24
+#   - 192.0.2.0/24
+#   - 192.88.99.0/24
+#   - 198.18.0.0/15
+#   - 198.51.100.0/24
+#   - 203.0.113.0/24
+#   - 240.0.0.0/4
+### Indicates whether to masquerade traffic to the link local prefix.
+### If the masqLinkLocal is not set or set to false, then 169.254.0.0/16 is appended to the non-masquerade CIDRs list.
+# cilium_masq_link_local: false
+### A time interval at which the agent attempts to reload config from disk
+# cilium_ip_masq_resync_interval: 60s
+
+# Hubble
+### Enable Hubble without install
+# cilium_enable_hubble: false
+### Enable Hubble Metrics
+cilium_enable_hubble_metrics: {{ .Orchestrator.Network.Cilium.Hubble.EnableMetrics }}
+### if cilium_enable_hubble_metrics: true
+# cilium_hubble_metrics:
+#   - dns
+#   - drop
+#   - tcp
+#   - flow
+#   - icmp
+#   - http
+### Enable Hubble install
+cilium_hubble_install:  {{ .Orchestrator.Network.Cilium.Hubble.Install }}
+### Enable auto generate certs if cilium_hubble_install: true
+cilium_hubble_tls_generate: true
+
+# IP address management mode for v1.9+.
+# https://docs.cilium.io/en/v1.9/concepts/networking/ipam/
+# cilium_ipam_mode: kubernetes
+
+# Extra arguments for the Cilium agent
+# cilium_agent_custom_args: []
+
+# For adding and mounting extra volumes to the cilium agent
+# cilium_agent_extra_volumes: []
+# cilium_agent_extra_volume_mounts: []
+
+# cilium_agent_extra_env_vars: []
+
+# cilium_operator_replicas: 2
+
+# The address at which the cillium operator bind health check api
+# cilium_operator_api_serve_addr: "127.0.0.1:9234"
+
+## A dictionary of extra config variables to add to cilium-config, formatted like:
+##  cilium_config_extra_vars:
+##    var1: "value1"
+##    var2: "value2"
+# cilium_config_extra_vars: {}
+
+# For adding and mounting extra volumes to the cilium operator
+# cilium_operator_extra_volumes: []
+# cilium_operator_extra_volume_mounts: []
+
+# Extra arguments for the Cilium Operator
+# cilium_operator_custom_args: []
+
+# Name of the cluster. Only relevant when building a mesh of clusters.
+# cilium_cluster_name: default
+
+# Make Cilium take ownership over the `/etc/cni/net.d` directory on the node, renaming all non-Cilium CNI configurations to `*.cilium_bak`.
+# This ensures no Pods can be scheduled using other CNI plugins during Cilium agent downtime.
+# Available for Cilium v1.10 and up.
+# cilium_cni_exclusive: true
+
+# Configure the log file for CNI logging with retention policy of 7 days.
+# Disable CNI file logging by setting this field to empty explicitly.
+# Available for Cilium v1.12 and up.
+# cilium_cni_log_file: "/var/run/cilium/cilium-cni.log"
+
+# -- Configure cgroup related configuration
+# -- Enable auto mount of cgroup2 filesystem.
+# When `cilium_cgroup_auto_mount` is enabled, cgroup2 filesystem is mounted at
+# `cilium_cgroup_host_root` path on the underlying host and inside the cilium agent pod.
+# If users disable `cilium_cgroup_auto_mount`, it's expected that users have mounted
+# cgroup2 filesystem at the specified `cilium_cgroup_auto_mount` volume, and then the
+# volume will be mounted inside the cilium agent pod at the same path.
+# Available for Cilium v1.11 and up
+# cilium_cgroup_auto_mount: true
+# -- Configure cgroup root where cgroup2 filesystem is mounted on the host
+# cilium_cgroup_host_root: "/run/cilium/cgroupv2"
+
+# Specifies the ratio (0.0-1.0) of total system memory to use for dynamic
+# sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
+# cilium_bpf_map_dynamic_size_ratio: "0.0"
+
+# -- Enables masquerading of IPv4 traffic leaving the node from endpoints.
+# Available for Cilium v1.10 and up
+# cilium_enable_ipv4_masquerade: true
+# -- Enables masquerading of IPv6 traffic leaving the node from endpoints.
+# Available for Cilium v1.10 and up
+# cilium_enable_ipv6_masquerade: true
+
+# -- Enable native IP masquerade support in eBPF
+cilium_enable_bpf_masquerade: {{ .Orchestrator.Network.Cilium.EnableBpf }}
+
+# -- Configure whether direct routing mode should route traffic via
+# host stack (true) or directly and more efficiently out of BPF (false) if
+# the kernel supports it. The latter has the implication that it will also
+# bypass netfilter in the host namespace.
+# cilium_enable_host_legacy_routing: true
+
+# -- Enable use of the remote node identity.
+# ref: https://docs.cilium.io/en/v1.7/install/upgrade/#configmap-remote-node-identity
+# cilium_enable_remote_node_identity: true
+
+# -- Enable the use of well-known identities.
+# cilium_enable_well_known_identities: false
+
+# cilium_enable_bpf_clock_probe: true
+
+# -- Whether to enable CNP status updates.
+# cilium_disable_cnp_status_updates: true

internal/resources/templates/kubespray/inventory/hosts.tmpl

@@ -44,10 +44,6 @@
 {{- end }}
 {{- end }}
 
-[k8s_cluster:children]
-kube_control_plane
-kube_node
-
 [all:vars]
 ansible_connection=ssh
 {{- if not (eq .Credentials.User "") }}

internal/resources/templates/secrets-storage/vault-keys.json.tmpl

@@ -1,8 +0,0 @@
-{
-  "keys": [
-    {{- range $index, $key := .Modules.SecretsStorage.UnsealKeys }}
-     "{{ $key }}",
-    {{- end }}
-  ],
-  "root_token": "{{ .Modules.SecretsStorage.AuthToken }}"
-}

internal/secrets_storage/commands.go

@@ -1,129 +0,0 @@
-package secrets_storage
-
-import (
-	"fmt"
-	"kube-forge/internal/config"
-	"kube-forge/internal/kubernetes_client"
-	"kube-forge/internal/templates"
-	"regexp"
-	"strings"
-)
-
-func InitVault() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	err = commandToInitVault()
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	fmt.Println("Vault initialized")
-	templates.ApplyVaultInitKeysTemplate()
-}
-
-func AddKubernetesLocalIntegration() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	err = commandToAddKubernetesLocalIntegration()
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	fmt.Println("Vault local Kubernetes integration added")
-}
-
-func UnsealVault() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	commandToUnsealVault()
-}
-
-func commandToInitVault() error {
-	config := config.GetConfig()
-	commandArray := []string{
-		"vault", "operator", "init",
-		fmt.Sprintf("-key-shares=%d", config.Modules.SecretsStorage.KeyShares),
-		fmt.Sprintf("-key-threshold=%d", config.Modules.SecretsStorage.KeyThreshold),
-	}
-	output, err := kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	if err != nil && strings.Contains(output, "Vault is already initialized") {
-		return VaultAlreadyInitialised
-	}
-
-	unsealKeys, rootToken := parseVaultInitKeys(output)
-	config.Modules.SecretsStorage.UnsealKeys = unsealKeys
-	config.Modules.SecretsStorage.AuthToken = rootToken
-	return nil
-}
-
-func parseVaultInitKeys(input string) ([]string, string) {
-	unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`)
-	rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`)
-
-	unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1)
-	var unsealKeys []string
-	for _, match := range unsealKeysMatches {
-		unsealKeys = append(unsealKeys, match[1])
-	}
-
-	rootTokenMatches := rootTokenPattern.FindStringSubmatch(input)
-	rootToken := rootTokenMatches[1]
-
-	return unsealKeys, rootToken
-}
-
-func commandToUnsealVault() {
-	config := config.GetConfig()
-
-	for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys {
-		commandArray := []string{"vault", "operator", "unseal", unsealKey}
-		kubernetes_client.ExecuteCommandInPodContainer(
-			commandArray, "secrets-storage", "vault-0", "vault",
-		)
-	}
-	fmt.Println("Vault unsealed")
-}
-
-func commandToAddKubernetesLocalIntegration() error {
-	config := config.GetConfig()
-
-	commandArray := []string{"vault", "login", config.Modules.SecretsStorage.AuthToken}
-	output, err := kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	if err != nil && strings.Contains(output, "permission denied") {
-		return IncorrectCredentials
-	}
-	commandArray = []string{"vault", "auth", "enable", "-local", "-path=kubernetes-local", "kubernetes"}
-	output, err = kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	kubernetesInternalServiceAddr, err := kubernetes_client.GetEnvVariableFromPodContainer(
-		"KUBERNETES_PORT_443_TCP_ADDR",
-		"secrets-storage",
-		"vault-0",
-		"vault",
-	)
-	if err != nil {
-		return err
-	}
-	commandArray = []string{
-		"vault", "write", "auth/kubernetes-local/config",
-		fmt.Sprintf("kubernetes_host=https://%s:443", kubernetesInternalServiceAddr),
-	}
-	output, err = kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	return nil
-}

internal/secrets_storage/errors.go

@@ -1,6 +0,0 @@
-package secrets_storage
-
-import "errors"
-
-var VaultAlreadyInitialised = errors.New("Vault already initialised")
-var IncorrectCredentials = errors.New("Incorrect Vault auth token credentials!!")

internal/templates/helm.go

@@ -0,0 +1,12 @@
+package templates
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/resources"
+)
+
+func GetHelmValuesByTemplate(templateFile string) string {
+	cfg := config.GetConfig()
+	template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
+	return executeTemplateToString(template, cfg)
+}

internal/templates/helm_apps.go

@@ -1,46 +0,0 @@
-package templates
-
-import (
-	"kube-forge/internal/config"
-	"kube-forge/internal/resources"
-	"strings"
-)
-
-var HELM_APPS_TEMPLATES = [...]string{
-	"templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl",
-	"templates/helm-apps/releases/observability/fluent-operator.yml.tmpl",
-	"templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl",
-	"templates/helm-apps/releases/observability/metrics-server.yml.tmpl",
-	"templates/helm-apps/releases/observability/tempo.yml.tmpl",
-	"templates/helm-apps/releases/observability/loki.yml.tmpl",
-	"templates/helm-apps/releases/observability/observability.yml.tmpl",
-	"templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl",
-	"templates/helm-apps/releases/registry/harbor.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-cd.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl",
-	"templates/helm-apps/releases/cicd/keel.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl",
-	"templates/helm-apps/releases/secrets-storage/vault.yml.tmpl",
-}
-var HELM_REPOSITORIES_TEMPLATES = [...]string{
-	"templates/helm-apps/repositories/repositories.yml.tmpl",
-}
-
-func GetHelmAppsConfigData() (string, string) {
-	cfg := config.GetConfig()
-	helmAppsTemplateResults := []string{}
-	for _, templateFile := range HELM_APPS_TEMPLATES {
-		template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
-		helmAppsTemplateResults = append(helmAppsTemplateResults, executeTemplateToString(template, cfg))
-	}
-	repositoriesTemplateResults := []string{}
-	for _, templateFile := range HELM_REPOSITORIES_TEMPLATES {
-		template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
-		repositoriesTemplateResults = append(repositoriesTemplateResults, executeTemplateToString(template, cfg))
-	}
-	return strings.Join(repositoriesTemplateResults, "\n"), strings.Join(helmAppsTemplateResults, "\n")
-}

internal/templates/kubespray.go

@@ -5,6 +5,9 @@ var K8S_TEMPLATES = [...][2]string{
 	{"templates/kubespray/inventory/group_vars/all.yml.tmpl", "kubespray/inventory/group_vars/all.yml"},
 	{"templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/addons.yml"},
 	{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml"},
+	{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml"},
+	{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml"},
+	{"templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl", "kubespray/inventory/group_vars/all/containerd.yml"},
 }
 
 func ApplyK8sTemplates() {

kubespray/env/cmdline

@@ -1 +0,0 @@
--b -v --become

kubespray/env/extravars

@@ -1,2 +0,0 @@
----
-ansible_sudo_pass: nF5S8nuKi87Dh42Jnjik

kubespray/inventory/group_vars/all.yml

@@ -32,6 +32,7 @@ disable_host_nameservers: false
 upstream_dns_servers:
   - 8.8.8.8
   - 8.8.4.4
+  - 1.1.1.1
 
 ## There are some changes specific to the cloud providers
 ## for instance we need to encapsulate packets with some network plugins
@@ -127,8 +128,3 @@ unsafe_show_logs: false
 
 ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
 allow_unsupported_distribution_setup: false
-
-## Containerd settings
-# containerd_metadata_root_dir: /app/lib/containerd
-# The state directory for containerd
-# containerd_state_dir: /app/run/containerd

kubespray/inventory/group_vars/all/containerd.yml

@@ -0,0 +1,63 @@
+---
+# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
+
+containerd_storage_dir: /app/containerd
+containerd_state_dir:  /app/containerd-state
+
+# containerd_oom_score: 0
+
+# containerd_default_runtime: "runc"
+# containerd_snapshotter: "native"
+
+# containerd_runc_runtime:
+#   name: runc
+#   type: "io.containerd.runc.v2"
+#   engine: ""
+#   root: ""
+
+# containerd_additional_runtimes:
+# Example for Kata Containers as additional runtime:
+#   - name: kata
+#     type: "io.containerd.kata.v2"
+#     engine: ""
+#     root: ""
+
+# containerd_grpc_max_recv_message_size: 16777216
+# containerd_grpc_max_send_message_size: 16777216
+
+# Containerd debug socket location: unix or tcp format
+# containerd_debug_address: ""
+
+# Containerd log level
+# containerd_debug_level: "info"
+
+# Containerd logs format, supported values: text, json
+# containerd_debug_format: ""
+
+# Containerd debug socket UID
+# containerd_debug_uid: 0
+
+# Containerd debug socket GID
+# containerd_debug_gid: 0
+
+# containerd_metrics_address: ""
+
+# containerd_metrics_grpc_histogram: false
+
+# Registries defined within containerd.
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      - host: https://mirror.gcr.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://quay.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+
+# containerd_max_container_log_line_size: -1
+
+# containerd_registry_auth:
+#   - registry: 10.0.0.2:5000
+#     username: user
+#     password: pass

kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml

@@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
 kube_api_anonymous_auth: true
 
 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.29.0
+kube_version: 1.32.4
 
 # Where the binaries will be downloaded.
 # Note: ensure that you've enough disk space (about 1G)
@@ -123,6 +123,7 @@ kube_apiserver_port: 6443  # (https)
 # Kube-proxy proxyMode configuration.
 # Can be ipvs, iptables
 kube_proxy_mode: ipvs
+kube_proxy_scheduler: lc
 
 # configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
 # must be set to true for MetalLB, kube-vip(ARP enabled) to work
@@ -157,7 +158,7 @@ kube_encrypt_secret_data: false
 
 # DNS configuration.
 # Kubernetes cluster name, also will be used as DNS domain
-cluster_name: k8s-cluster.local
+cluster_name: cluster.local
 # Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
 ndots: 2
 # dns_timeout: 2
@@ -179,7 +180,6 @@ nodelocaldns_health_port: 9254
 nodelocaldns_second_health_port: 9256
 nodelocaldns_bind_metrics_host_ip: false
 nodelocaldns_secondary_skew_seconds: 5
-# nodelocaldns_external_zones:
 # - zones:
 #   - example.com
 #   - example.io:1053
@@ -227,6 +227,24 @@ dns_domain: "{{ cluster_name }}"
 ## Default: containerd
 container_manager: containerd
 
+## CRI-O registry mirrors setup
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      - location: https://mirror.gcr.io
+        insecure: false
+      - location: https://quay.io
+        insecure: false
+
+## Docker registry mirrors setup
+docker_registry_mirrors:
+  - https://mirror.gcr.io
+  - https://quay.io
+
 # Additional container runtimes
 kata_containers_enabled: false
 
@@ -374,7 +392,7 @@ auto_renew_certificates: true
 # auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"
 
 # kubeadm patches path
-kubeadm_patches:
-  enabled: false
-  source_dir: "{{ inventory_dir }}/patches"
-  dest_dir: "{{ kube_config_dir }}/patches"
+kubeadm_patches: []
+## Kubelet additional settings
+kubelet_custom_flags:
+  - "--root-dir=/app/k8s/kubelet"

kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml

@@ -100,7 +100,7 @@ calico_pool_blocksize: 26
 # calico_vxlan_port: 4789
 
 # Enable eBPF mode
-# calico_bpf_enabled: false
+calico_bpf_enabled: false
 
 # If you want to use non default IP_AUTODETECTION_METHOD, IP6_AUTODETECTION_METHOD for calico node set this option to one of:
 # * can-reach=DESTINATION

kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml

@@ -142,19 +142,19 @@
 ### Enable Hubble without install
 # cilium_enable_hubble: false
 ### Enable Hubble Metrics
-# cilium_enable_hubble_metrics: false
+cilium_enable_hubble_metrics: false
 ### if cilium_enable_hubble_metrics: true
-# cilium_hubble_metrics: {}
-# - dns
-# - drop
-# - tcp
-# - flow
-# - icmp
-# - http
+# cilium_hubble_metrics:
+#   - dns
+#   - drop
+#   - tcp
+#   - flow
+#   - icmp
+#   - http
 ### Enable Hubble install
-# cilium_hubble_install: false
+cilium_hubble_install:  false
 ### Enable auto generate certs if cilium_hubble_install: true
-# cilium_hubble_tls_generate: false
+cilium_hubble_tls_generate: true
 
 # IP address management mode for v1.9+.
 # https://docs.cilium.io/en/v1.9/concepts/networking/ipam/
@@ -224,7 +224,7 @@
 # cilium_enable_ipv6_masquerade: true
 
 # -- Enable native IP masquerade support in eBPF
-# cilium_enable_bpf_masquerade: false
+cilium_enable_bpf_masquerade: false
 
 # -- Configure whether direct routing mode should route traffic via
 # host stack (true) or directly and more efficiently out of BPF (false) if

kubespray/inventory/hosts

@@ -1,23 +1,17 @@
 
-vbox-prod-k8s-master-01 ansible_host=10.250.50.22 ip=10.250.50.22  
-vbox-prod-k8s-slave-01 ansible_host=10.250.50.23 ip=10.250.50.23  
-vbox-prod-k8s-slave-02 ansible_host=10.250.50.21 ip=10.250.50.21  
+k8s-master-1 ansible_host=172.16.1.136 ip=172.16.1.136  
+k8s-worker-1 ansible_host=172.16.1.135 ip=172.16.1.135  
 
 [kube_control_plane]
-vbox-prod-k8s-master-01
+k8s-master-1
 
 [etcd]
-vbox-prod-k8s-master-01
+k8s-master-1
 
 [kube_node]
-vbox-prod-k8s-slave-01
-vbox-prod-k8s-slave-02
-
-[k8s_cluster:children]
-kube_control_plane
-kube_node
+k8s-worker-1
 
 [all:vars]
 ansible_connection=ssh
-ansible_user=sre-admin
-ansible_ssh_private_key_file=/root/.ssh/id_rsa
+ansible_user=georgest
+ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa

kubespray/project/ansible_version.yml

@@ -2,10 +2,10 @@
 - name: Check Ansible version
   hosts: all
   gather_facts: false
-  become: no
+  become: false
   run_once: true
   vars:
-    minimal_ansible_version: 2.15.5  # 2.15 versions before 2.15.5 are known to be buggy for kubespray
+    minimal_ansible_version: 2.16.4
     maximal_ansible_version: 2.17.0
   tags: always
   tasks:
@@ -25,7 +25,6 @@
       tags:
         - check
 
-    # CentOS 7 provides too old jinja version
     - name: "Check that jinja is not too old (install via pip)"
       assert:
         msg: "Your Jinja version is too old, install via pip"

kubespray/project/boilerplate.yml

@@ -2,57 +2,45 @@
 - name: Check ansible version
   import_playbook: ansible_version.yml
 
-# These are inventory compatibility tasks to ensure we keep compatibility with old style group names
+# These are inventory compatibility tasks with two purposes:
+# - to ensure we keep compatibility with old style group names
+# - to reduce inventory boilerplate (defining parent groups / empty groups)
 
-- name: Add kube-master nodes to kube_control_plane
-  hosts: kube-master
+- name: Define groups for legacy less structured inventories
+  hosts: all
   gather_facts: false
   tags: always
   tasks:
-    - name: Add nodes to kube_control_plane group
+    - name: Match needed groups by their old names or definition
+      vars:
+        group_mappings:
+          kube_control_plane:
+            - kube-master
+          kube_node:
+            - kube-node
+          calico_rr:
+            - calico-rr
+          no_floating:
+            - no-floating
+          k8s_cluster:
+            - kube_node
+            - kube_control_plane
+            - calico_rr
       group_by:
-        key: 'kube_control_plane'
+        key: "{{ (group_names | intersect(item.value) | length > 0) | ternary(item.key, '_all') }}"
+      loop: "{{ group_mappings | dict2items }}"
 
-- name: Add kube-node nodes to kube_node
-  hosts: kube-node
+- name: Check inventory settings
+  hosts: all
   gather_facts: false
   tags: always
-  tasks:
-    - name: Add nodes to kube_node group
-      group_by:
-        key: 'kube_node'
-
-- name: Add k8s-cluster nodes to k8s_cluster
-  hosts: k8s-cluster
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to k8s_cluster group
-      group_by:
-        key: 'k8s_cluster'
-
-- name: Add calico-rr nodes to calico_rr
-  hosts: calico-rr
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to calico_rr group
-      group_by:
-        key: 'calico_rr'
-
-- name: Add no-floating nodes to no_floating
-  hosts: no-floating
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to no-floating group
-      group_by:
-        key: 'no_floating'
+  roles:
+    - validate_inventory
 
 - name: Install bastion ssh config
   hosts: bastion[0]
-  gather_facts: False
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: bastion-ssh-config, tags: ["localhost", "bastion"] }

kubespray/project/cluster.yml

@@ -7,101 +7,95 @@
 
 - name: Prepare for etcd install
   hosts: k8s_cluster:etcd
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/preinstall, tags: preinstall }
-    - {
-        role: "container-engine",
-        tags: "container-engine",
-        when: deploy_container_engine,
-      }
+    - { role: "container-engine", tags: "container-engine", when: deploy_container_engine }
     - { role: download, tags: download, when: "not skip_downloads" }
 
 - name: Install etcd
+  vars:
+    etcd_cluster_setup: true
+    etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}"
   import_playbook: install_etcd.yml
 
 - name: Install Kubernetes nodes
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/node, tags: node }
 
 - name: Install the control plane
   hosts: kube_control_plane
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/control-plane, tags: master }
     - { role: kubernetes/client, tags: client }
     - { role: kubernetes-apps/cluster_roles, tags: cluster-roles }
 
 - name: Invoke kubeadm and install a CNI
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
-    - { role: kubernetes/kubeadm, tags: kubeadm }
+    - { role: kubespray_defaults }
+    - { role: kubernetes/kubeadm, tags: kubeadm}
     - { role: kubernetes/node-label, tags: node-label }
     - { role: kubernetes/node-taint, tags: node-taint }
+    - role: kubernetes-apps/gateway_api
+      when: gateway_api_enabled
+      tags: gateway_api
+      delegate_to: "{{ groups['kube_control_plane'][0] }}"
+      run_once: true
     - { role: network_plugin, tags: network }
-    - { role: kubernetes-apps/kubelet-csr-approver, tags: kubelet-csr-approver }
 
 - name: Install Calico Route Reflector
   hosts: calico_rr
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
-    - { role: network_plugin/calico/rr, tags: ["network", "calico_rr"] }
+    - { role: kubespray_defaults }
+    - { role: network_plugin/calico/rr, tags: ['network', 'calico_rr'] }
 
 - name: Patch Kubernetes for Windows
   hosts: kube_control_plane[0]
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] }
 
-- name: Install Kubernetes and Helm apps
+- name: Install Kubernetes apps
   hosts: kube_control_plane
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
-    - {
-        role: kubernetes-apps/external_cloud_controller,
-        tags: external-cloud-controller,
-      }
+    - { role: kubespray_defaults }
+    - { role: kubernetes-apps/external_cloud_controller, tags: external-cloud-controller }
     - { role: kubernetes-apps/network_plugin, tags: network }
     - { role: kubernetes-apps/policy_controller, tags: policy-controller }
     - { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
     - { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
     - { role: kubernetes-apps, tags: apps }
-    - { role: helm-apps, tags: helm-apps }
 
 - name: Apply resolv.conf changes now that cluster DNS is up
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
-    - {
-        role: kubernetes/preinstall,
-        when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'",
-        tags: resolvconf,
-        dns_late: true,
-      }
+    - { role: kubespray_defaults }
+    - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }

kubespray/project/facts.yml

@@ -5,19 +5,17 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   gather_facts: false
   environment: "{{ proxy_disable_env }}"
-  vars:
-    # Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining
-    # fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.
-    ansible_ssh_pipelining: false
   roles:
-    - { role: kubespray-defaults }
-    - { role: bootstrap-os, tags: bootstrap-os}
+    - { role: bootstrap_os, tags: bootstrap_os}
 
 - name: Gather facts
   hosts: k8s_cluster:etcd:calico_rr
-  gather_facts: False
+  gather_facts: false
   tags: always
   tasks:
+    - name: Gather and compute network facts
+      import_role:
+        name: network_facts
     - name: Gather minimal facts
       setup:
         gather_subset: '!all'

kubespray/project/install_etcd.yml

@@ -2,7 +2,7 @@
 - name: Add worker nodes to the etcd play if needed
   hosts: kube_node
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
   tasks:
     - name: Check if nodes needs etcd client certs (depends on network_plugin)
       group_by:
@@ -16,14 +16,11 @@
 
 - name: Install etcd
   hosts: etcd:kube_control_plane:_kubespray_needs_etcd
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - role: etcd
       tags: etcd
-      vars:
-        etcd_cluster_setup: true
-        etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}"
       when: etcd_deployment_type != "kubeadm"

kubespray/project/recover_control_plane.yml

@@ -6,7 +6,7 @@
   hosts: etcd[0]
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - role: recover_control_plane/etcd
       when: etcd_deployment_type != "kubeadm"
 
@@ -14,7 +14,7 @@
   hosts: kube_control_plane[0]
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: recover_control_plane/control-plane }
 
 - name: Apply whole cluster install
@@ -24,5 +24,5 @@
   hosts: kube_control_plane
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: recover_control_plane/post-recover }

kubespray/project/remove_node.yml

@@ -1,16 +1,26 @@
 ---
+- name: Validate nodes for removal
+  hosts: localhost
+  tasks:
+    - name: Assert that nodes are specified for removal
+      assert:
+        that:
+          - node is defined
+          - node | length > 0
+        msg: "No nodes specified for removal. The `node` variable must be set explicitly."
+
 - name: Common tasks for every playbooks
   import_playbook: boilerplate.yml
 
 - name: Confirm node removal
-  hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}"
-  gather_facts: no
+  hosts: "{{ node | default('this_is_unreachable') }}"
+  gather_facts: false
   tasks:
     - name: Confirm Execution
       pause:
         prompt: "Are you sure you want to delete nodes state? Type 'yes' to delete nodes."
       register: pause_result
-      run_once: True
+      run_once: true
       when:
         - not (skip_confirmation | default(false) | bool)
 
@@ -24,20 +34,25 @@
   when: reset_nodes | default(True) | bool
 
 - name: Reset node
-  hosts: "{{ node | default('kube_node') }}"
-  gather_facts: no
+  hosts: "{{ node | default('this_is_unreachable') }}"
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
+  pre_tasks:
+    - name: Gather information about installed services
+      service_facts:
+      when: reset_nodes | default(True) | bool
   roles:
-    - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
-    - { role: remove-node/pre-remove, tags: pre-remove }
-    - { role: remove-node/remove-etcd-node }
+    - { role: kubespray_defaults, when: reset_nodes | default(True) | bool }
+    - { role: remove_node/pre_remove, tags: pre-remove }
+    - role: remove-node/remove-etcd-node
+      when: "'etcd' in group_names"
     - { role: reset, tags: reset, when: reset_nodes | default(True) | bool }
 
-# Currently cannot remove first master or etcd
+# Currently cannot remove first control plane node or first etcd node
 - name: Post node removal
-  hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}"
-  gather_facts: no
+  hosts: "{{ node | default('this_is_unreachable') }}"
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
+    - { role: kubespray_defaults, when: reset_nodes | default(True) | bool }
     - { role: remove-node/post-remove, tags: post-remove }

kubespray/project/reset.yml

@@ -7,13 +7,13 @@
 
 - name: Reset cluster
   hosts: etcd:k8s_cluster:calico_rr
-  gather_facts: False
+  gather_facts: false
   pre_tasks:
     - name: Reset Confirmation
       pause:
         prompt: "Are you sure you want to reset cluster state? Type 'yes' to reset your cluster."
       register: reset_confirmation_prompt
-      run_once: True
+      run_once: true
       when:
         - not (skip_confirmation | default(false) | bool)
         - reset_confirmation is not defined
@@ -30,6 +30,6 @@
 
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_early: true }
     - { role: reset, tags: reset }

kubespray/project/roles/adduser/defaults/main.yml

@@ -7,14 +7,14 @@ addusers:
   etcd:
     name: etcd
     comment: "Etcd user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
     shell: /sbin/nologin
   kube:
     name: kube
     comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"
 

kubespray/project/roles/adduser/molecule/default/molecule.yml

@@ -2,22 +2,18 @@
 role_name_check: 1
 dependency:
   name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
-  - name: adduser-01
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
+  - name: ubuntu20
+    cloud_image: ubuntu-2004
+    vm_cpu_cores: 1
+    vm_memory: 512
 provisioner:
   name: ansible
   config_options:
     defaults:
       callbacks_enabled: profile_tasks
       timeout: 120
+  playbooks:
+    create: ../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/adduser/vars/coreos.yml

@@ -3,6 +3,6 @@ addusers:
   - name: kube
     comment: "Kubernetes user"
     shell: /sbin/nologin
-    system: yes
+    system: true
     group: "{{ kube_cert_group }}"
-    create_home: no
+    create_home: false

kubespray/project/roles/adduser/vars/debian.yml

@@ -2,14 +2,14 @@
 addusers:
   - name: etcd
     comment: "Etcd user"
-    create_home: yes
+    create_home: true
     home: "{{ etcd_data_dir }}"
-    system: yes
+    system: true
     shell: /sbin/nologin
 
   - name: kube
     comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"

kubespray/project/roles/adduser/vars/redhat.yml

@@ -2,14 +2,14 @@
 addusers:
   - name: etcd
     comment: "Etcd user"
-    create_home: yes
+    create_home: true
     home: "{{ etcd_data_dir }}"
-    system: yes
+    system: true
     shell: /sbin/nologin
 
   - name: kube
     comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"

kubespray/project/roles/bastion-ssh-config/molecule/default/converge.yml

@@ -12,4 +12,4 @@
         dest: "{{ ssh_bastion_confing__name }}"
         owner: "{{ ansible_user }}"
         group: "{{ ansible_user }}"
-        mode: 0644
+        mode: "0644"

kubespray/project/roles/bastion-ssh-config/molecule/default/molecule.yml

@@ -2,17 +2,11 @@
 role_name_check: 1
 dependency:
   name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
   - name: bastion-01
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
+    cloud_image: ubuntu-2004
+    vm_cpu_cores: 1
+    vm_memory: 512
 provisioner:
   name: ansible
   config_options:
@@ -27,5 +21,7 @@ provisioner:
           bastion:
             hosts:
               bastion-01:
+  playbooks:
+    create: ../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/bastion-ssh-config/tasks/main.yml

@@ -19,4 +19,4 @@
   template:
     src: "{{ ssh_bastion_confing__name }}.j2"
     dest: "{{ playbook_dir }}/{{ ssh_bastion_confing__name }}"
-    mode: 0640
+    mode: "0640"

kubespray/project/roles/bootstrap-os/molecule/default/converge.yml

@@ -1,6 +0,0 @@
----
-- name: Converge
-  hosts: all
-  gather_facts: no
-  roles:
-    - role: bootstrap-os

kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml

@@ -1,53 +0,0 @@
----
-role_name_check: 1
-dependency:
-  name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
-platforms:
-  - name: ubuntu20
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-  - name: ubuntu22
-    box: generic/ubuntu2204
-    cpus: 1
-    memory: 1024
-    provider_options:
-      driver: kvm
-  - name: centos7
-    box: centos/7
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-  - name: almalinux8
-    box: almalinux/8
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-  - name: debian10
-    box: generic/debian10
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      callbacks_enabled: profile_tasks
-      timeout: 120
-  inventory:
-    group_vars:
-      all:
-        user:
-          name: foo
-          comment: My test comment
-verifier:
-  name: testinfra

kubespray/project/roles/bootstrap-os/tasks/bootstrap-coreos.yml

@@ -1,37 +0,0 @@
----
-# CoreOS ships without Python installed
-
-- name: Check if bootstrap is needed
-  raw: stat /opt/bin/.bootstrapped
-  register: need_bootstrap
-  failed_when: false
-  changed_when: false
-  tags:
-    - facts
-
-- name: Force binaries directory for Container Linux by CoreOS and Flatcar
-  set_fact:
-    bin_dir: "/opt/bin"
-  tags:
-    - facts
-
-- name: Run bootstrap.sh
-  script: bootstrap.sh
-  become: true
-  environment: "{{ proxy_env }}"
-  when:
-    - need_bootstrap.rc != 0
-
-- name: Set the ansible_python_interpreter fact
-  set_fact:
-    ansible_python_interpreter: "{{ bin_dir }}/python"
-  tags:
-    - facts
-
-- name: Disable auto-upgrade
-  systemd:
-    name: locksmithd.service
-    masked: true
-    state: stopped
-  when:
-    - coreos_locksmithd_disable

kubespray/project/roles/bootstrap-os/tasks/main.yml

@@ -1,109 +1,10 @@
 ---
-- name: Fetch /etc/os-release
-  raw: cat /etc/os-release
-  register: os_release
-  changed_when: false
-  # This command should always run, even in check mode
-  check_mode: false
+- name: Warn for usage of deprecated role
+  fail:
+    msg: bootstrap-os is deprecated, switch to bootstrap_os
+  ignore_errors: true # noqa ignore-errors
+  run_once: true
 
-- name: Bootstrap CentOS
-  include_tasks: bootstrap-centos.yml
-  when: '''ID="centos"'' in os_release.stdout_lines or ''ID="ol"'' in os_release.stdout_lines or ''ID="almalinux"'' in os_release.stdout_lines or ''ID="rocky"'' in os_release.stdout_lines or ''ID="kylin"'' in os_release.stdout_lines  or ''ID="uos"'' in os_release.stdout_lines or ''ID="openEuler"'' in os_release.stdout_lines'
-
-- name: Bootstrap Amazon
-  include_tasks: bootstrap-amazon.yml
-  when: '''ID="amzn"'' in os_release.stdout_lines'
-
-- name: Bootstrap RedHat
-  include_tasks: bootstrap-redhat.yml
-  when: '''ID="rhel"'' in os_release.stdout_lines'
-
-- name: Bootstrap Clear Linux
-  include_tasks: bootstrap-clearlinux.yml
-  when: '''ID=clear-linux-os'' in os_release.stdout_lines'
-
-# Fedora CoreOS
-- name: Bootstrap Fedora CoreOS
-  include_tasks: bootstrap-fedora-coreos.yml
-  when:
-    - '''ID=fedora'' in os_release.stdout_lines'
-    - '''VARIANT_ID=coreos'' in os_release.stdout_lines'
-
-- name: Bootstrap Flatcar
-  include_tasks: bootstrap-flatcar.yml
-  when: '''ID=flatcar'' in os_release.stdout_lines'
-
-- name: Bootstrap Debian
-  include_tasks: bootstrap-debian.yml
-  when: '''ID=debian'' in os_release.stdout_lines or ''ID=ubuntu'' in os_release.stdout_lines'
-
-# Fedora "classic"
-- name: Boostrap Fedora
-  include_tasks: bootstrap-fedora.yml
-  when:
-    - '''ID=fedora'' in os_release.stdout_lines'
-    - '''VARIANT_ID=coreos'' not in os_release.stdout_lines'
-
-- name: Bootstrap OpenSUSE
-  include_tasks: bootstrap-opensuse.yml
-  when: '''ID="opensuse-leap"'' in os_release.stdout_lines or ''ID="opensuse-tumbleweed"'' in os_release.stdout_lines'
-
-- name: Create remote_tmp for it is used by another module
-  file:
-    path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"
-    state: directory
-    mode: 0700
-
-# Workaround for https://github.com/ansible/ansible/issues/42726
-# (1/3)
-- name: Gather host facts to get ansible_os_family
-  setup:
-    gather_subset: '!all'
-    filter: ansible_*
-
-- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora)
-  hostname:
-    name: "{{ inventory_hostname }}"
-  when:
-    - override_system_hostname
-    - ansible_os_family not in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    - not ansible_distribution == "Fedora"
-    - not is_fedora_coreos
-
-# (2/3)
-- name: Assign inventory name to unconfigured hostnames (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
-  command: "hostnamectl set-hostname {{ inventory_hostname }}"
-  register: hostname_changed
-  become: true
-  changed_when: false
-  when: >
-    override_system_hostname
-    and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    or is_fedora_coreos
-    or ansible_distribution == "Fedora")
-
-# (3/3)
-- name: Update hostname fact (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
-  setup:
-    gather_subset: '!all'
-    filter: ansible_hostname
-  when: >
-    override_system_hostname
-    and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    or is_fedora_coreos
-    or ansible_distribution == "Fedora")
-
-- name: Install ceph-commmon package
-  package:
-    name:
-      - ceph-common
-    state: present
-  when: rbd_provisioner_enabled | default(false)
-
-- name: Ensure bash_completion.d folder exists
-  file:
-    name: /etc/bash_completion.d/
-    state: directory
-    owner: root
-    group: root
-    mode: 0755
+- name: Compat for direct role import
+  import_role:
+    name: bootstrap_os

kubespray/project/roles/bootstrap_os/defaults/main.yml

@@ -2,21 +2,33 @@
 ## CentOS/RHEL/AlmaLinux specific variables
 # Use the fastestmirror yum plugin
 centos_fastestmirror_enabled: false
+# Timeout (in seconds) for checking RHEL subscription status
+rh_subscription_check_timeout: 180
 
 ## Flatcar Container Linux specific variables
 # Disable locksmithd or leave it in its current state
 coreos_locksmithd_disable: false
 
+# Install epel repo on Centos/RHEL
+epel_enabled: false
+
 ## Oracle Linux specific variables
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true
 
+## Ubuntu specific variables
+# Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
+ubuntu_kernel_unattended_upgrades_disabled: false
+# Stop unattended-upgrades if it is currently running on Ubuntu
+ubuntu_stop_unattended_upgrades: false
+
 fedora_coreos_packages:
   - python
   - python3-libselinux
   - ethtool                 # required in kubeadm preflight phase for verifying the environment
   - ipset                   # required in kubeadm preflight phase for verifying the environment
   - conntrack-tools         # required by kube-proxy
+  - containernetworking-plugins  # required by crio
 
 ## General
 # Set the hostname to inventory_hostname