actualized for kubespray version 2.28.0

.ansible-lint

@@ -0,0 +1,45 @@
+---
+parseable: true
+skip_list:
+  # see https://docs.ansible.com/ansible-lint/rules/default_rules.html for a list of all default rules
+
+  # DO NOT add any other rules to this skip_list, instead use local `# noqa` with a comment explaining WHY it is necessary
+
+  # These rules are intentionally skipped:
+  #
+  # [role-name] "meta/main.yml" Role name role-name does not match ``^+$`` pattern
+  # Meta roles in Kubespray don't need proper names
+  # (Disabled in June 2021)
+  - 'role-name'
+
+  # [var-naming] "defaults/main.yml" File defines variable 'apiVersion' that violates variable naming standards
+  # In Kubespray we use variables that use camelCase to match their k8s counterparts
+  # (Disabled in June 2021)
+  - 'var-naming'
+
+  # [fqcn-builtins]
+  # Roles in kubespray don't need fully qualified collection names
+  # (Disabled in Feb 2023)
+  - 'fqcn-builtins'
+
+  # We use template in names
+  - 'name[template]'
+
+  # No changed-when on commands
+  # (Disabled in June 2023 after ansible upgrade; FIXME)
+  - 'no-changed-when'
+
+  # Disable run-once check with free strategy
+  # (Disabled in June 2023 after ansible upgrade; FIXME)
+  - 'run-once[task]'
+exclude_paths:
+  # Generated files
+  - tests/files/custom_cni/cilium.yaml
+  - venv
+  - .github
+  - .ansible
+  - .cache
+  - .gitlab-ci.yml
+  - .gitlab-ci
+mock_modules:
+  - gluster.gluster.gluster_volume

.ansible-lint-ignore

@@ -0,0 +1,8 @@
+# This file contains ignores rule violations for ansible-lint
+inventory/sample/group_vars/k8s_cluster/k8s-cluster.yml jinja[spacing]
+roles/kubernetes/control-plane/defaults/main/kube-proxy.yml jinja[spacing]
+roles/kubernetes/control-plane/defaults/main/main.yml jinja[spacing]
+roles/kubernetes/kubeadm/defaults/main.yml jinja[spacing]
+roles/kubernetes/node/defaults/main.yml jinja[spacing]
+roles/kubernetes/preinstall/defaults/main.yml jinja[spacing]
+roles/kubespray-defaults/defaults/main/main.yml jinja[spacing]

.gitignore

@@ -5,3 +5,9 @@
 *k8s-admin*
 vault-keys.json
 config.yaml
+temp
+*id_rsa*
+.venv
+.ropeproject
+*__pycache__
+bin

.gitlab-ci.yml

@@ -1,83 +0,0 @@
-variables:
-  DOCKER_IMAGE: harbor.kvazaric.ru/kube-forge/kube-forge
-
-  KANIKO_IMAGE: harbor.kvazaric.ru/postgres-tasks/kaniko_executor:debug
-  KANIKO_CONTEXT: ${CI_PROJECT_DIR}
-  RELEASE_CLI_IMAGE: harbor.kvazaric.ru/kube-forge/release-cli:v0.18.0
-
-  PREPARE_RELEASE:
-    options:
-      - "No"
-      - "Yes"
-    value: "No"
-    description: Create release from this build?
-
-  WITHOUT_BUILD:
-    options:
-      - "No"
-      - "Yes"
-    value: "Yes"
-    description: Create release without building?
-
-stages:
-  - build
-  - release
-
-build-docker:
-  variables:
-    DOCKERFILE_PATH: Dockerfile
-    IMAGE_DESTINATION: image
-  stage: build
-  image:
-    name: ${KANIKO_IMAGE}
-    entrypoint: [""]
-  allow_failure: false
-  tags:
-    - build
-    - docker
-  before_script:
-    - mkdir -p /kaniko/.docker
-    - echo "${DOCKER_AUTH_CONFIG}" > /kaniko/.docker/config.json
-    - VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)
-  script:
-    - |
-      /kaniko/executor --context "${KANIKO_CONTEXT}" \
-        --dockerfile ${CI_PROJECT_DIR}/build/docker/Dockerfile \
-        --destination "${DOCKER_IMAGE}:${VERSION}-${CI_COMMIT_SHORT_SHA}"
-  dependencies: []
-  rules:
-    - if: $PREPARE_RELEASE == "Yes" && $WITHOUT_BUILD == "Yes"
-      when: never
-    - changes:
-        - build/docker/**/*
-        - cmd/**/*
-        - internal/**/*
-        - kubespray/**/*
-        - go.sum
-        - go.mod
-        - requirements.txt
-        - ansible.cfg
-      if: $CI_COMMIT_REF_NAME =~ /^(master)$/
-      when: always
-
-make-release:
-  stage: release
-  image: ${RELEASE_CLI_IMAGE}
-  tags:
-    - build
-    - docker
-  rules:
-    - if: $PREPARE_RELEASE == "Yes"
-  script:
-    - VERSION=$(cat ${CI_PROJECT_DIR}/build/version.txt)
-    - echo "Preparing release for version ${VERSION}-${CI_COMMIT_SHORT_SHA}"
-  release: # See https://docs.gitlab.com/ee/ci/yaml/#release for available properties
-    name: kube-forge:${VERSION}-${CI_COMMIT_SHORT_SHA}
-    tag_name: "${CI_COMMIT_SHORT_SHA}"
-    description: "${VERSION}-${CI_COMMIT_SHORT_SHA}"
-    assets:
-      links:
-        - name: "Docker image"
-          url: "harbor.kvazaric.ru/kube-forge/kube-forge:${VERSION}-${CI_COMMIT_SHORT_SHA}"
-          link_type: "image"
-  when: on_success

Makefile

@@ -0,0 +1,18 @@
+BINNAME    := kube-forge
+BINDIR  := $(CURDIR)/bin
+TARGETS := darwin/amd64 darwin/arm64 linux/amd64 linux/arm linux/arm64 windows/amd64 windows/arm64
+
+.PHONY: run
+run:
+	@'$(BINDIR)/'$(BINNAME)
+
+
+.PHONY: build
+build:
+	@go build -v -trimpath -ldflags "-s -w $(ADDITIONAL_LLD_FLAGS)" -o '$(BINDIR)/'$(BINNAME) ./cmd/main/main.go
+
+.PHONY: clean
+clean:
+	@rm -r ${BINDIR}
+
+.DEFAULT_GOAL := build

README.md

@@ -1,4 +1,4 @@
-## Устнановка
+## Установка
 
 ### Docker-образ
 
@@ -7,7 +7,29 @@
 ### Docker-образ
 
 ```shell
+touch k8s-admin.conf
+
 docker run -v $(pwd)/config.yaml:/application/config.yaml \
-  -v $(pwd)/id_rsa:/root/.ssh/id_rsa \
-  -v $(pwd)/config:/root/.ssh/config harbor.kvazaric.ru/kube-forge/kube-forge:1.0-5dcd4a83 apply
+  -v $(pwd)/id_rsa_bastion_ift:/root/.ssh/id_rsa \
+  --mount type=bind,source=$(pwd)/k8s-admin.conf,target=/application/k8s-admin.conf \
+  harbor.kvazaric.ru/kube-forge/kube-forge:1.1-f84c27e6 apply
 ```
+
+## С помощью исполняемого файла
+
+Необходимо также на машине оператора иметь утилиты:
+
+- sshpass
+
+А также установить Python-библиотеки из списка "requirements.txt"
+
+```shell
+kube-forge -c config.yaml -d . apply
+```
+
+## Параметры:
+
+- "-с" путь до конфигурационного файла
+- "-d" путь до рабочей директории (там же должна быть директория kubespray)
+- "-p" пароль для авторизации через SSH
+- "-v" включить расширенное логирование ("-v=true")

ansible.cfg

@@ -11,7 +11,8 @@ gathering = smart
 fact_caching = jsonfile
 fact_caching_connection = /tmp
 fact_caching_timeout = 86400
-stdout_callback = dense
+timeout = 300
+stdout_callback = default
 display_skipped_hosts = no
 library = ./library
 callbacks_enabled = profile_tasks,ara_default

build/README.md

@@ -1,5 +0,0 @@
-## Сборка Docker
-
-## Сборка Linux
-
-### Debian

build/debian/DEBIAN/control

@@ -1,5 +0,0 @@
-Package: kube-forge
-Version: 1.0
-Architecture: amd64
-Maintainer: Kvazaric <kvazaric.official@gmail.com>
-Description: A program to install Kubernetes-based platform  to facilitate the development, desting and dperation of Ccntainerized applications

build/docker/Dockerfile

@@ -1,5 +1,5 @@
 ## Install dependencies
-FROM python:3.12 as deps
+FROM harbor.kvazaric.ru/mirror/library/python:3.12 as deps
 
 WORKDIR /application
 COPY ./requirements.txt ./
@@ -9,7 +9,7 @@ RUN apt-get update -y && \
     pip3 install -r requirements.txt
 
 ## Build executable
-FROM golang:alpine as builder
+FROM harbor.kvazaric.ru/mirror/library/golang:alpine as builder
 
 WORKDIR /application
 COPY go.mod go.sum ./

build/version.txt

@@ -1 +0,0 @@
-1.0

cmd/main/main.go

@@ -2,29 +2,31 @@ package main
 
 import (
 	"flag"
-	"fmt"
+	"kube-forge/internal/additional"
 	"kube-forge/internal/config"
+	"kube-forge/internal/csi"
 	"kube-forge/internal/kubespray"
+	"kube-forge/internal/logging"
 	"kube-forge/internal/templates"
 	"os"
 )
 
-func parseArgs() (string, string, string) {
-	var password, configPath, workDir string
-	flag.StringVar(&password, "p", "", "Password to access hosts")
-	flag.StringVar(&configPath, "c", "/etc/kube-forge/config.yaml", "Path to config file")
-	flag.StringVar(&workDir, "d", "/var/lib/kube-forge", "Path to kube-forge work dir")
-	flag.Parse()
-	return password, configPath, workDir
+func installAndConfigureModules() {
+	csi.ApplyCharts()
+	additional.ApplyCharts()
 }
 
 func main() {
-	password, configPath, workDir := parseArgs()
-	config := config.CreateConfig(configPath, workDir, password)
+	var password, configPath, workDir string
+	var verbose bool
 
-	repositories, releases := templates.GetHelmAppsConfigData()
-	config.Repositories = repositories
-	config.Releases = releases
+	flag.StringVar(&password, "p", "", "Password to access hosts")
+	flag.StringVar(&configPath, "c", "/etc/kube-forge/config.yaml", "Path to config file")
+	flag.StringVar(&workDir, "d", "/var/lib/kube-forge", "Path to kube-forge work dir")
+	flag.BoolVar(&verbose, "v", false, "Enable verbose logging")
+	flag.Parse()
+	config := config.CreateConfig(configPath, workDir, password)
+	config.Verbose = verbose
 
 	templates.ApplyK8sTemplates()
 
@@ -32,9 +34,10 @@ func main() {
 		switch cmd {
 		case "apply":
 			kubespray.InstallCluster("")
+			installAndConfigureModules()
 			return
 		case "apply-modules":
-			kubespray.InstallCluster("helm-apps")
+			installAndConfigureModules()
 			return
 		case "upgrade":
 			kubespray.UpgradeCluster("")
@@ -42,7 +45,10 @@ func main() {
 		case "scale":
 			kubespray.ScaleCluster()
 			return
+		case "reset":
+			kubespray.ResetCluster()
+			return
 		}
 	}
-	fmt.Println("No such command\nAvailable commands: apply, apply-modules, upgrade, scale")
+	logging.Log.Error("No such command\nAvailable commands: apply, apply-modules, upgrade, scale, reset")
 }

config.sample.yaml

@@ -1,123 +1,91 @@
 credentials:
   user: sre-admin
   ask_sudo_password: false
-  private_key_file: /home/sre-admin/.ssh/id_rsa
+  private_key_file: /Users/georgest/.ssh/id_rsa_bastion_ift
 
 hosts:
-  - hostname: vbox-prod-k8s-master-01
-    ip: "10.250.50.22"
+  - hostname: t1-disk-lt-k8s-test-master-01
+    ip: "10.100.20.47"
     roles: [control_plane, etcd]
-  - hostname: vbox-prod-k8s-slave-01
-    ip: "10.250.50.23"
+
+  - hostname: t1-disk-lt-k8s-test-slave-01
+    ip: "10.100.20.48"
     roles: [node]
-  - hostname: vbox-prod-k8s-slave-02
-    ip: "10.250.50.21"
+
+  - hostname: t1-disk-lt-k8s-test-slave-02
+    ip: "10.100.20.49"
     roles: [node]
 
 orchestrator:
-  version: v1.29.0
+  version: v1.32
+  cluster_name: cluster.local
+  kubelet_dir: "/app/k8s/kubelet"
+  proxy_mode: "ipvs" # iptables, ipvs
+  proxy_scheduler: "rr"
   container_engine:
     install: true
+    type: "containerd"
+    data_dir: "/app/containerd"
+    state_dir: "/app/containerd-state"
+  dns:
+    servers:
+      - 8.8.8.8
+      - 8.8.4.4
+      - 1.1.1.1
+    disable_host_nameservers: false
+    coredns_external_zones:
+      []
+      # - zones:
+      #     - example.com
+      #     - example.io:1053
+      #   nameservers:
+      #     - 1.1.1.1
+      #     - 2.2.2.2
+      #   cache: 5
+      # - zones:
+      #     - https://mycompany.local:4453
+      #   nameservers:
+      #     - 192.168.0.53
+      #   cache: 0
+      # - zones:
+      #     - mydomain.tld
+      #   nameservers:
+      #     - 10.233.0.3
+      #   cache: 5
+      #   rewrite:
+      #     - name website.tld website.namespace.svc.cluster.local
   ping_access_ip: true
   auto_renew_certificates: true
   pod_security_policy_enabled: true
+  registry_mirrors:
+    - host: https://mirror.gcr.io
+      skip_verify: false
+    - host: https://quay.io
+      skip_verify: false
 
 modules:
   admin_password: changeit
+
   observability:
-    enabled: true
-    logging:
-      enabled: true
-      events:
-        enabled: true
-    tracing:
-      enabled: true
-    monitoring:
-      enabled: true
-      alert_manager:
-        enabled: true
-        route:
-          receiver: kvazaric_notifications
-          group_wait: 1s
-          repeat_interval: 180m
-          routes:
-            - receiver: "kvazaric_notifications"
-              group_by: ["alertname"]
-              group_wait: 1s
-              repeat_interval: 8737h
-              matchers:
-                - fireOnce=true
-        receivers:
-          - name: kvazaric_notifications
-            telegram_configs:
-              - send_resolved: true
-                api_url: https://api.telegram.org
-                bot_token: bot_token
-                chat_id: -10000
-                parse_mode: HTML
-                message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}'
-                http_config:
-                  follow_redirects: true
-                  enable_http2: false
-      blackbox:
-        enabled: true
-      kube_state:
-        enabled: true
-      node:
-        enabled: true
-    visualization:
-      enabled: true
-      grafana:
-        enabled: true
-        expose:
-          type: ingress # ingress or NodePort
-          domain: grafana.disk.lt.t1.cloud
-          tls:
-            enabled: true
+    enabled: false
 
   cicd:
-    enabled: true
-    argo_cd:
-      expose:
-        type: ingress # ingress or NodePort
-        domain: argocd.disk.lt.t1.cloud
-        tls:
-          enabled: true
-    rollouts:
-      enabled: true
-    updates_operator:
-      enabled: true
+    enabled: false
 
   secrets_storage:
-    enabled: true
-    key_shares: 5
-    key_threshold: 3
-    expose:
-      type: ingress # ingress or NodePort
-      domain: vault.disk.lt.t1.cloud
-      tls:
-        enabled: true
-    csi_integration:
-      enabled: true
+    enabled: false
 
   registry:
-    enabled: true
-    expose:
-      type: ingress # ingress or nodePort
-      domain: harbor.disk.lt.t1.cloud
-    tls:
-      enabled: true
-    enabled_scanner: true
+    enabled: false
 
   additional:
     cert_manager:
       enabled: true
-      account_email: adminmail@gmail.com
-    ingress:
-      enabled: true
-      host_network: true
+      account_email: g.stykalin@rockitsoft.ru
     storage:
+      local_path_provisioner:
+        data_dir: "/app/local-path-provisioner"
       longhorn:
-        enabled: true
+        enabled: false
       secrets_store_csi_driver:
-        enabled: true
+        enabled: false

examples/argo-cd-example.yaml

@@ -1 +0,0 @@
-https://github.com/argoproj/argocd-example-apps/tree/master/guestbook

examples/rollouts-app-test.yaml

@@ -1,65 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: canary-demo-preview
-spec:
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app: canary-demo
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: canary-demo
-spec:
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    app: canary-demo
----
-apiVersion: argoproj.io/v1alpha1
-kind: Rollout
-metadata:
-  name: canary-demo
-spec:
-  replicas: 5
-  revisionHistoryLimit: 1
-  selector:
-    matchLabels:
-      app: canary-demo
-  template:
-    metadata:
-      labels:
-        app: canary-demo
-    spec:
-      containers:
-        - name: canary-demo
-          image: argoproj/rollouts-demo:green
-          imagePullPolicy: Always
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          resources:
-            requests:
-              memory: 32Mi
-              cpu: 5m
-  strategy:
-    canary:
-      canaryService: canary-demo-preview
-      steps:
-        - setWeight: 20
-        - pause: {}
-        - setWeight: 40
-        - pause: { duration: 10 }
-        - setWeight: 60
-        - pause: { duration: 10 }
-        - setWeight: 80
-        - pause: { duration: 10 }

examples/vault-inject-example.yaml

@@ -1,38 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: vault-inject-example
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vault-inject-example-deployment
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: vault-inject-example
-  template:
-    metadata:
-      labels:
-        app: vault-inject-example
-      annotations:
-        vault.hashicorp.com/agent-inject: "true"
-        vault.hashicorp.com/role: "vault-example"
-        vault.hashicorp.com/agent-inject-secret-env: "vault-example/creds"
-        vault.hashicorp.com/auth-path: "auth/kubernetes-local"
-        vault.hashicorp.com/agent-inject-template-env: |
-          {{- with secret "vault-example/creds" -}}
-          {{- range $key, $value := .Data.data }}
-          export {{ $key }}={{ $value }}
-          {{- end }}
-          {{- end }}
-    spec:
-      containers:
-        - name: app
-          image: "postgres:latest"
-          env:
-            - name: POSTGRES_PASSWORD
-              value: admin
-      serviceAccountName: vault-inject-example

go.mod

@@ -5,75 +5,158 @@ go 1.22.0
 toolchain go1.22.2
 
 require (
-	github.com/BurntSushi/toml v1.2.1
+	github.com/BurntSushi/toml v1.3.2
 	github.com/Masterminds/sprig/v3 v3.2.3
 	github.com/apenella/go-ansible v1.3.0
-	github.com/apenella/go-ansible/v2 v2.0.0
+	github.com/apenella/go-ansible/v2 v2.0.1
 	github.com/ilyakaznacheev/cleanenv v1.5.0
+	github.com/mittwald/go-helm-client v0.12.9
+	github.com/sirupsen/logrus v1.9.3
 	golang.org/x/crypto v0.22.0
+	helm.sh/helm/v3 v3.14.2
+	k8s.io/api v0.30.0
+	k8s.io/apimachinery v0.30.0
+	k8s.io/client-go v0.30.0
 	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.2.0 // indirect
+	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Masterminds/squirrel v1.5.4 // indirect
+	github.com/Microsoft/hcsshim v0.11.4 // indirect
 	github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df // indirect
 	github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df // indirect
+	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/chai2010/gettext-go v1.0.2 // indirect
+	github.com/containerd/containerd v1.7.11 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/distribution/reference v0.5.0 // indirect
+	github.com/docker/cli v24.0.7+incompatible // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker v24.0.7+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.8.0 // indirect
+	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-metrics v0.0.1 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/emicklei/go-restful/v3 v3.11.1 // indirect
+	github.com/evanphx/json-patch v5.7.0+incompatible // indirect
+	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fatih/color v1.16.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
+	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
 	github.com/go-logr/logr v1.4.1 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.20.2 // indirect
+	github.com/go-openapi/jsonreference v0.20.4 // indirect
+	github.com/go-openapi/swag v0.22.7 // indirect
+	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/btree v1.1.2 // indirect
 	github.com/google/gnostic-models v0.6.8 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
 	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/uuid v1.3.0 // indirect
-	github.com/gorilla/websocket v1.5.0 // indirect
-	github.com/huandu/xstrings v1.3.3 // indirect
-	github.com/imdario/mergo v0.3.11 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/google/uuid v1.5.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gorilla/websocket v1.5.1 // indirect
+	github.com/gosuri/uitable v0.0.4 // indirect
+	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
+	github.com/huandu/xstrings v1.4.0 // indirect
+	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jmoiron/sqlx v1.3.5 // indirect
 	github.com/joho/godotenv v1.5.1 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/kr/pretty v0.3.1 // indirect
+	github.com/klauspost/compress v1.17.4 // indirect
+	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
+	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
+	github.com/lib/pq v1.10.9 // indirect
+	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mitchellh/copystructure v1.0.0 // indirect
-	github.com/mitchellh/reflectwalk v1.0.0 // indirect
+	github.com/mattn/go-runewidth v0.0.15 // indirect
+	github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.2.0 // indirect
+	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
+	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
+	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/shopspring/decimal v1.2.0 // indirect
-	github.com/spf13/cast v1.3.1 // indirect
+	github.com/prometheus/client_golang v1.18.0 // indirect
+	github.com/prometheus/client_model v0.5.0 // indirect
+	github.com/prometheus/common v0.45.0 // indirect
+	github.com/prometheus/procfs v0.12.0 // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/rubenv/sql-migrate v1.6.0 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
+	github.com/spf13/cobra v1.8.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stretchr/objx v0.5.2 // indirect
 	github.com/stretchr/testify v1.9.0 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	github.com/xlab/treeprint v1.2.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 // indirect
+	go.opentelemetry.io/otel v1.21.0 // indirect
+	go.opentelemetry.io/otel/metric v1.21.0 // indirect
+	go.opentelemetry.io/otel/trace v1.21.0 // indirect
+	go.starlark.net v0.0.0-20231121155337-90ade8b19d09 // indirect
+	golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc // indirect
 	golang.org/x/net v0.24.0 // indirect
-	golang.org/x/oauth2 v0.10.0 // indirect
+	golang.org/x/oauth2 v0.15.0 // indirect
+	golang.org/x/sync v0.5.0 // indirect
 	golang.org/x/sys v0.19.0 // indirect
 	golang.org/x/term v0.19.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
-	golang.org/x/time v0.3.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
+	golang.org/x/time v0.5.0 // indirect
+	google.golang.org/appengine v1.6.8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 // indirect
+	google.golang.org/grpc v1.60.1 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
+	gopkg.in/evanphx/json-patch.v5 v5.7.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.30.0 // indirect
-	k8s.io/apimachinery v0.30.0 // indirect
-	k8s.io/client-go v0.30.0 // indirect
+	k8s.io/apiextensions-apiserver v0.29.0 // indirect
+	k8s.io/apiserver v0.29.0 // indirect
+	k8s.io/cli-runtime v0.29.0 // indirect
+	k8s.io/component-base v0.29.0 // indirect
 	k8s.io/klog/v2 v2.120.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 // indirect
-	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
+	k8s.io/kubectl v0.29.0 // indirect
+	k8s.io/utils v0.0.0-20240102154912-e7106e64919e // indirect
 	olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3 // indirect
+	oras.land/oras-go v1.2.4 // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
+	sigs.k8s.io/kustomize/api v0.16.0 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.16.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
 )

go.sum

@@ -1,77 +1,227 @@
-github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/BurntSushi/toml v1.3.2 h1:o7IhLm0Msx3BaB+n3Ag7L8EVlByGnpq14C4YWiu/gL8=
+github.com/BurntSushi/toml v1.3.2/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
+github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
+github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
+github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
+github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
+github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
+github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM=
+github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/hcsshim v0.11.4 h1:68vKo2VN8DE9AdN4tnkWnmdhqdbpUFM8OF3Airm7fz8=
+github.com/Microsoft/hcsshim v0.11.4/go.mod h1:smjE4dvqPX9Zldna+t5FG3rnoHhaB7QYxPRqGcpAD9w=
+github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs=
+github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/apenella/go-ansible v1.3.0 h1:INNaVzrgQMNIO9Yvnly6lA5KfN/pY3m1Z37gpmlUzPM=
 github.com/apenella/go-ansible v1.3.0/go.mod h1:qiLWolQqLkCoqFlPvdsKhxk7O0qjIBCPNhUKpH/vjaU=
-github.com/apenella/go-ansible/v2 v2.0.0 h1:9aZkU8dQ2fVITYX5V1CiQ3VX4PnNPBTgv31wJFd2Ito=
-github.com/apenella/go-ansible/v2 v2.0.0/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
+github.com/apenella/go-ansible/v2 v2.0.1 h1:9o3805u4NAIMf1px5EKpRS2LEa2aeQbMtHB7vilt7XE=
+github.com/apenella/go-ansible/v2 v2.0.1/go.mod h1:ifhiX4d0bpynb8yhdzLTmGl/38HqTYr/26PfjB1enXQ=
 github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df h1:sEikY2P+NZK/7VZUwIsnXIGElhsuFDSxh1bZYwHxdcI=
 github.com/apenella/go-common-utils/data v0.0.0-20220913191136-86daaa87e7df/go.mod h1:cLVL6GjUiKG/WyBzX+KD6h/XRV/HnNZIZbMNNiBgQ9o=
 github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df h1:SvlYbjlsSQDS7hbVT1h012/zdgvcwWJ+Yd9XRiiY/8s=
 github.com/apenella/go-common-utils/error v0.0.0-20220913191136-86daaa87e7df/go.mod h1:+3dyIlHX350xJIUIffwMLswZXU+N2FwDE05VuKqxYdw=
-github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
+github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so=
+github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw=
+github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
+github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bshuster-repo/logrus-logstash-hook v1.0.0 h1:e+C0SB5R1pu//O4MQ3f9cFuPGoOVeF2fE4Og9otCc70=
+github.com/bshuster-repo/logrus-logstash-hook v1.0.0/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
+github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd h1:rFt+Y/IK1aEZkEHchZRSq9OQbsSzIT/OrI8YFFmRIng=
+github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b h1:otBG+dV+YK+Soembjv71DPz3uX/V/6MMlSyD9JBQ6kQ=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0 h1:nvj0OLI3YqYXer/kZD8Ri1aaunCxIEsOst1BVJswV0o=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
+github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA=
+github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaDFBM=
+github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
+github.com/containerd/containerd v1.7.11 h1:lfGKw3eU35sjV0aG2eYZTiwFEY1pCzxdzicHP3SZILw=
+github.com/containerd/containerd v1.7.11/go.mod h1:5UluHxHTX2rdvYuZ5OJTC5m/KJNs0Zs9wVoJm9zf5ZE=
+github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
+github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY=
+github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
+github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
+github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
-github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2 h1:aBfCb7iqHmDEIp6fBvC/hQUddQfg+3qdYjwzaiP9Hnc=
+github.com/distribution/distribution/v3 v3.0.0-20221208165359-362910506bc2/go.mod h1:WHNsWjnIn2V1LYOrME7e8KxSeKunYHsxEm4am0BUtcI=
+github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
+github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v24.0.7+incompatible h1:wa/nIwYFW7BVTGa7SWPVyyXU9lgORqUb1xfI36MSkFg=
+github.com/docker/cli v24.0.7+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
+github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
+github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
+github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
+github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
+github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
+github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1 h1:ZClxb8laGDf5arXfYcAtECDFgAgHklGI8CxgjHnXKJ4=
+github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
+github.com/emicklei/go-restful/v3 v3.11.1 h1:S+9bSbua1z3FgCnV0KKOSSZ3mDthb5NyEPL5gEpCvyk=
+github.com/emicklei/go-restful/v3 v3.11.1/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
+github.com/evanphx/json-patch v5.7.0+incompatible h1:vgGkfT/9f8zE6tvSCe74nfpAVDQ2tG6yudJd8LBksgI=
+github.com/evanphx/json-patch v5.7.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4=
+github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
 github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
 github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/foxcpp/go-mockdns v1.0.0 h1:7jBqxd3WDWwi/6WhDvacvH1XsN3rOLXyHM1uhvIx6FI=
+github.com/foxcpp/go-mockdns v1.0.0/go.mod h1:lgRN6+KxQBawyIghpnl5CezHFGS9VLzvtVlwxvzXTQ4=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk=
 github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs=
+github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw=
+github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
+github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
 github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-openapi/jsonpointer v0.19.6 h1:eCs3fxoIi3Wh6vtgmLTOjdhSpiqphQ+DaPn38N2ZdrE=
-github.com/go-openapi/jsonpointer v0.19.6/go.mod h1:osyAmYz/mB/C3I+WsTTSgw1ONzaLJoLCyoi6/zppojs=
-github.com/go-openapi/jsonreference v0.20.2 h1:3sVjiK66+uXK/6oQ8xgcRKcFgQ5KXa2KvnJRumpMGbE=
-github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En5Ap4rVB5KVcIDZG2k=
-github.com/go-openapi/swag v0.22.3 h1:yMBqmnQ0gyZvEb/+KzuWZOXgllrXT4SADYbvDaXHv/g=
-github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/jsonpointer v0.20.2 h1:mQc3nmndL8ZBzStEo3JYF8wzmeWffDH4VbXz58sAx6Q=
+github.com/go-openapi/jsonpointer v0.20.2/go.mod h1:bHen+N0u1KEO3YlmqOjTT9Adn1RfD91Ar825/PuiRVs=
+github.com/go-openapi/jsonreference v0.20.4 h1:bKlDxQxQJgwpUSgOENiMPzCTBVuc7vTdXSSgNeAhojU=
+github.com/go-openapi/jsonreference v0.20.4/go.mod h1:5pZJyJP2MnYCpoeoMAql78cCHauHj0V9Lhc506VOpw4=
+github.com/go-openapi/swag v0.22.7 h1:JWrc1uc/P9cSomxfnsFSVWoE1FW6bNbrVPmpQYpCcR8=
+github.com/go-openapi/swag v0.22.7/go.mod h1:Gl91UqO+btAM0plGGxHqJcQZ1ZTy6jbmridBTsDy8A0=
+github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
+github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
+github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572/go.mod h1:9Pwr4B2jHnOSGXyyzV8ROjYa2ojvAY6HCGYYfMoC3Ls=
+github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y=
+github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8=
+github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/gomodule/redigo v1.8.2 h1:H5XSIre1MB5NbPYFp+i1NBbb5qN1W8Y8YAQoAYbkm8k=
+github.com/gomodule/redigo v1.8.2/go.mod h1:P9dn9mFrCBvWhGE1wpxx6fgq7BAeLBk+UUUzlpkBYO0=
+github.com/google/btree v1.1.2 h1:xf4v41cLI2Z6FxbKm+8Bu+m8ifhj15JuZ9sa0jZCMUU=
+github.com/google/btree v1.1.2/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
 github.com/google/gnostic-models v0.6.8 h1:yo/ABAfM5IMRsS1VnXjTBvUb61tFIHozhlYvRgGre9I=
 github.com/google/gnostic-models v0.6.8/go.mod h1:5n7qKqH0f5wFt+aWF8CW6pZLLNOfYuF5OpfBSENuI8U=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1 h1:K6RDEckDVWvDI9JAJYCmNdQXq6neHJOYx3V6jnqNEec=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
+github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
-github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.5.0 h1:1p67kYwdtXjb0gL0BPiP1Av9wiZPo5A8z2cWkTZ+eyU=
+github.com/google/uuid v1.5.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/handlers v1.5.1 h1:9lRY6j8DEeeBT10CvO9hGW0gmky0BprnvDI5vfhUHH4=
+github.com/gorilla/handlers v1.5.1/go.mod h1:t8XrUpc4KVXb7HGyJ4/cEnwQiaxrX/hz1Zv/4g96P1Q=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
-github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
-github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
+github.com/gorilla/websocket v1.5.1 h1:gmztn0JnHVt9JZquRuzLw3g4wouNVzKL15iLr/zn/QY=
+github.com/gorilla/websocket v1.5.1/go.mod h1:x3kM2JMyaluk02fnUJpQuwD2dCS5NDG2ZHL0uE0tcaY=
+github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY=
+github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
+github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
+github.com/hashicorp/golang-lru v0.5.4 h1:YDjusn29QI/Das2iO9M0BHnIbxPeyuCHsjMW+lJfyTc=
+github.com/hashicorp/golang-lru v0.5.4/go.mod h1:iADmTwqILo4mZ8BN3D2Q6+9jd8WM5uGBxy+E8yxSoD4=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
+github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/ilyakaznacheev/cleanenv v1.5.0 h1:0VNZXggJE2OYdXE87bfSSwGxeiGt9moSR2lOrsHHvr4=
 github.com/ilyakaznacheev/cleanenv v1.5.0/go.mod h1:a5aDzaJrLCQZsazHol1w8InnDcOX0OColm64SlIi6gk=
-github.com/imdario/mergo v0.3.11 h1:3tnifQM4i+fbajXKBHXWEH+KvNHqojZ778UH75j3bGA=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
+github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/jmoiron/sqlx v1.3.5 h1:vFFPA71p1o5gAeqtEAwLU4dnX2napprKtHr7PYIcN3g=
+github.com/jmoiron/sqlx v1.3.5/go.mod h1:nRVWtLre0KfCLJvgxzCsLVMogSvQ1zNJtpYr2Ccp0mQ=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
 github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
-github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/klauspost/compress v1.17.4 h1:Ej5ixsIri7BrIjBkRZLTo6ghwrEtHFk7ijlczPW4fZ4=
+github.com/klauspost/compress v1.17.4/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq6+3iTQz8KNCLtVX6idSoTLdUw=
+github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk=
+github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
+github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0=
+github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
@@ -79,51 +229,157 @@ github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovk
 github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.15 h1:vfoHhTN1af61xCRSWzFIWzx2YskyMTwHLrExkBOjvxI=
+github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
+github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0 h1:jWpvCLoY8Z/e3VKvlsiIGKtc+UG6U5vzxaoagmhXfyg=
+github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0/go.mod h1:QUyp042oQthUoa9bqDv0ER0wrtXnBruoNd7aNjkbP+k=
+github.com/miekg/dns v1.1.25 h1:dFwPR6SfLtrSwgDcIq2bcU/gVutB4sNApq2HBdqcakg=
+github.com/miekg/dns v1.1.25/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
-github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/mittwald/go-helm-client v0.12.9 h1:tfI5ECgrbfAolA9TnlCeA5F2TEIvdsOxVmoSyW80lCI=
+github.com/mittwald/go-helm-client v0.12.9/go.mod h1:ukR3Et5zbfBij7bFL1ZnLvPytsbBXCrI2qQYr2yVi9I=
+github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg=
+github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
 github.com/moby/spdystream v0.2.0 h1:cjW1zVyyoiM0T7b6UoySUFqzXMoqRckQtXwGPiBhOM8=
 github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
+github.com/moby/sys/mountinfo v0.6.2 h1:BzJjoreD5BMFNmD9Rus6gdd1pLuecOFPt8wC+Vygl78=
+github.com/moby/sys/mountinfo v0.6.2/go.mod h1:IJb6JQeOklcdMU9F5xQ8ZALD+CUr5VlGpwtX+VE0rpI=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
 github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0=
+github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4=
+github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
+github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f h1:y5//uYreIhSUg3J1GEMiLbxo1LJaP8RfCpH6pymGZus=
 github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
-github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/onsi/ginkgo/v2 v2.15.0 h1:79HwNRBAZHOEwrczrgSOPy+eFTTlIGELKy5as+ClttY=
+github.com/onsi/ginkgo/v2 v2.15.0/go.mod h1:HlxMHtYF57y6Dpf+mc5529KKmSq9h2FpCF+/ZkwUxKM=
+github.com/onsi/gomega v1.31.0 h1:54UJxxj6cPInHS3a35wm6BK/F9nHYueZ1NVujHDrnXE=
+github.com/onsi/gomega v1.31.0/go.mod h1:DW9aCi7U6Yi40wNVAvT6kzFnEVEI5n3DloYBiKiT6zk=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.0-rc5 h1:Ygwkfw9bpDvs+c9E34SdgGOj41dX/cbdlwvlWt0pnFI=
+github.com/opencontainers/image-spec v1.1.0-rc5/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5 h1:Ii+DKncOVM8Cu1Hc+ETb5K+23HdAMvESYE3ZJ5b5cMI=
+github.com/phayes/freeport v0.0.0-20220201140144-74d24b5ae9f5/go.mod h1:iIss55rKnNBTvrwdmkUpLnDpZoAHvWaiq5+iMmen4AE=
+github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/shopspring/decimal v1.2.0 h1:abSATXmQEYyShuxI4/vyW3tV1MrKAJzCZ/0zLUXYbsQ=
+github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY=
+github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg=
+github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
+github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
+github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
+github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
+github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
+github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
+github.com/prometheus/common v0.45.0 h1:2BGz0eBc2hdMDLnO/8n0jeB3oPrt2D08CekT0lneoxM=
+github.com/prometheus/common v0.45.0/go.mod h1:YJmSTw9BoKxJplESWWxlbyttQR4uaEcGyv9MZjVOJsY=
+github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
+github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
+github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
+github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rubenv/sql-migrate v1.6.0 h1:IZpcTlAx/VKXphWEpwWJ7BaMq05tYtE80zYz+8a5Il8=
+github.com/rubenv/sql-migrate v1.6.0/go.mod h1:m3ilnKP7sNb4eYkLsp6cGdPOl4OBcXM6rcbzU+Oqc5k=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
+github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
+github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/sosedoff/ansible-vault-go v0.2.0 h1:XqkBdqbXgTuFQ++NdrZvSdUTNozeb6S3V5x7FVs17vg=
 github.com/sosedoff/ansible-vault-go v0.2.0/go.mod h1:wMU54HNJfY0n0KIgbpA9m15NBfaUDlJrAsaZp0FwzkI=
-github.com/spf13/cast v1.3.1 h1:nFm6S0SMdyzrzcmThSipiEubIDy8WEXKNZ0UOgiRpng=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
+github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
+github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
 github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
+github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
+github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ=
+github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43 h1:+lm10QQTNSBd8DVTNGHx7o/IKu9HYDvLMffDhbyLccI=
+github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
+github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50 h1:hlE8//ciYMztlGpl/VA+Zm1AcTPHYkHJPbHqE6WJUXE=
+github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
+github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f h1:ERexzlUfuTvpE74urLSbIQW0Z/6hF9t8U4NsJLaioAY=
+github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1 h1:aFJWCqJMNjENlcleuuOkGAPH82y0yULBScfXcIEdS24=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.46.1/go.mod h1:sEGXWArGqc3tVa+ekntsN65DmVbVeW+7lTKTjZF3/Fo=
+go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
+go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
+go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
+go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
+go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
+go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
+go.starlark.net v0.0.0-20231121155337-90ade8b19d09 h1:hzy3LFnSN8kuQK8h9tHl4ndF6UruMj47OqwqsS+/Ai4=
+go.starlark.net v0.0.0-20231121155337-90ade8b19d09/go.mod h1:LcLNIzVOMp4oV+uusnpk+VU+SzXaJakUuBjoCSWH5dM=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
@@ -131,11 +387,16 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.22.0 h1:g1v0xeRhjcugydODzvb3mEM9SQ0HGp9s/nh3COQ/C30=
 golang.org/x/crypto v0.22.0/go.mod h1:vr6Su+7cTlO45qkww3VDJlzDn0ctJvRgYbC2NvXHt+M=
+golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc h1:ao2WRsKSzW6KuUY9IWPwWahcHCgR0s52IfwutMfEbdM=
+golang.org/x/exp v0.0.0-20240103183307-be819d1f06fc/go.mod h1:iRJReGqOEeBhDZGkGbynYwcHlctCvnjTYIamk7uXpHI=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.15.0 h1:SernR4v+D55NyBH2QiEQrlBAnj1ECL6AGrA5+dPaMY8=
+golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
@@ -144,18 +405,27 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
 golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
-golang.org/x/oauth2 v0.10.0 h1:zHCpF2Khkwy4mMB4bv0U37YtJdTGW8jI0glAApi0Kh8=
-golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQI=
+golang.org/x/oauth2 v0.15.0 h1:s8pnnxNVzjWyrvYdFUQq5llS1PX2zhPXmccZv99h7uQ=
+golang.org/x/oauth2 v0.15.0/go.mod h1:q48ptWNTY5XWf+JNten23lcvHpLJ0ZSxF5ttTHKVCAM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
@@ -168,32 +438,44 @@ golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.19.0 h1:+ThwsDv+tYfnJFhF4L8jITxu1tdTWRTZpdsWgEgjL6Q=
 golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4=
-golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
+golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.18.0 h1:k8NLag8AGHnn+PHbl7g43CtqZAwG60vZkLqgyZgIHgQ=
+golang.org/x/tools v0.18.0/go.mod h1:GL7B4CwcLLeo59yx/9UWWuNOW1n3VZ4f5axWfML7Lcg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
+google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917 h1:6G8oQ016D88m1xAKljMlBOOGWDZkes4kMhgGFlf8WcQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240102182953-50ed04b92917/go.mod h1:xtjpI3tXFPP051KaWnhvxkiubL/6dJ18vLVf7q2pTOU=
+google.golang.org/grpc v1.60.1 h1:26+wFr+cNqSGFcOXcabYC0lUVJVRa2Sb2ortSK7VrEU=
+google.golang.org/grpc v1.60.1/go.mod h1:OlCHIeLYqSSsLi6i49B5QGdzaMZK9+M7LXN2FKz4eGM=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/evanphx/json-patch.v5 v5.7.0 h1:dGKGylPlZ/jus2g1YqhhyzfH0gPy2R8/MYUpW/OslTY=
+gopkg.in/evanphx/json-patch.v5 v5.7.0/go.mod h1:/kvTRh1TVm5wuM6OkHxqXtE/1nUZZpihg29RtuIyfvk=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
@@ -202,22 +484,42 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.4.0 h1:ZazjZUfuVeZGLAmlKKuyv3IKP5orXcwtOwDQH6YVr6o=
+gotest.tools/v3 v3.4.0/go.mod h1:CtbdzLSsqVhDgMtKsx03ird5YTGB3ar27v0u/yKBW5g=
+helm.sh/helm/v3 v3.14.2 h1:V71fv+NGZv0icBlr+in1MJXuUIHCiPG1hW9gEBISTIA=
+helm.sh/helm/v3 v3.14.2/go.mod h1:2itvvDv2WSZXTllknfQo6j7u3VVgMAvm8POCDgYH424=
 k8s.io/api v0.30.0 h1:siWhRq7cNjy2iHssOB9SCGNCl2spiF1dO3dABqZ8niA=
 k8s.io/api v0.30.0/go.mod h1:OPlaYhoHs8EQ1ql0R/TsUgaRPhpKNxIMrKQfWUp8QSE=
+k8s.io/apiextensions-apiserver v0.29.0 h1:0VuspFG7Hj+SxyF/Z/2T0uFbI5gb5LRgEyUVE3Q4lV0=
+k8s.io/apiextensions-apiserver v0.29.0/go.mod h1:TKmpy3bTS0mr9pylH0nOt/QzQRrW7/h7yLdRForMZwc=
 k8s.io/apimachinery v0.30.0 h1:qxVPsyDM5XS96NIh9Oj6LavoVFYff/Pon9cZeDIkHHA=
 k8s.io/apimachinery v0.30.0/go.mod h1:iexa2somDaxdnj7bha06bhb43Zpa6eWH8N8dbqVjTUc=
+k8s.io/apiserver v0.29.0 h1:Y1xEMjJkP+BIi0GSEv1BBrf1jLU9UPfAnnGGbbDdp7o=
+k8s.io/apiserver v0.29.0/go.mod h1:31n78PsRKPmfpee7/l9NYEv67u6hOL6AfcE761HapDM=
+k8s.io/cli-runtime v0.29.0 h1:q2kC3cex4rOBLfPOnMSzV2BIrrQlx97gxHJs21KxKS4=
+k8s.io/cli-runtime v0.29.0/go.mod h1:VKudXp3X7wR45L+nER85YUzOQIru28HQpXr0mTdeCrk=
 k8s.io/client-go v0.30.0 h1:sB1AGGlhY/o7KCyCEQ0bPWzYDL0pwOZO4vAtTSh/gJQ=
 k8s.io/client-go v0.30.0/go.mod h1:g7li5O5256qe6TYdAMyX/otJqMhIiGgTapdLchhmOaY=
+k8s.io/component-base v0.29.0 h1:T7rjd5wvLnPBV1vC4zWd/iWRbV8Mdxs+nGaoaFzGw3s=
+k8s.io/component-base v0.29.0/go.mod h1:sADonFTQ9Zc9yFLghpDpmNXEdHyQmFIGbiuZbqAXQ1M=
 k8s.io/klog/v2 v2.120.1 h1:QXU6cPEOIslTGvZaXvFWiP9VKyeet3sawzTOvdXb4Vw=
 k8s.io/klog/v2 v2.120.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340 h1:BZqlfIlq5YbRMFko6/PM7FjZpUb45WallggurYhKGag=
 k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340/go.mod h1:yD4MZYeKMBwQKVht279WycxKyM84kkAx2DPrTXaeb98=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
-k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/kubectl v0.29.0 h1:Oqi48gXjikDhrBF67AYuZRTcJV4lg2l42GmvsP7FmYI=
+k8s.io/kubectl v0.29.0/go.mod h1:0jMjGWIcMIQzmUaMgAzhSELv5WtHo2a8pq67DtviAJs=
+k8s.io/utils v0.0.0-20240102154912-e7106e64919e h1:eQ/4ljkx21sObifjzXwlPKpdGLrCfRziVtos3ofG/sQ=
+k8s.io/utils v0.0.0-20240102154912-e7106e64919e/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3 h1:slmdOY3vp8a7KQbHkL+FLbvbkgMqmXojpFUO/jENuqQ=
 olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3/go.mod h1:oVgVk4OWVDi43qWBEyGhXgYxt7+ED4iYNpTngSLX2Iw=
+oras.land/oras-go v1.2.4 h1:djpBY2/2Cs1PV87GSJlxv4voajVOMZxqqtq9AB8YNvY=
+oras.land/oras-go v1.2.4/go.mod h1:DYcGfb3YF1nKjcezfX2SNlDAeQFKSXmf+qrFmrh4324=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
+sigs.k8s.io/kustomize/api v0.16.0 h1:/zAR4FOQDCkgSDmVzV2uiFbuy9bhu3jEzthrHCuvm1g=
+sigs.k8s.io/kustomize/api v0.16.0/go.mod h1:MnFZ7IP2YqVyVwMWoRxPtgl/5hpA+eCCrQR/866cm5c=
+sigs.k8s.io/kustomize/kyaml v0.16.0 h1:6J33uKSoATlKZH16unr2XOhDI+otoe2sR3M8PDzW3K0=
+sigs.k8s.io/kustomize/kyaml v0.16.0/go.mod h1:xOK/7i+vmE14N2FdFyugIshB8eF6ALpy7jI87Q2nRh4=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1 h1:150L+0vs/8DA78h1u02ooW1/fFq/Lwr+sGiqlzvrtq4=
 sigs.k8s.io/structured-merge-diff/v4 v4.4.1/go.mod h1:N8hJocpFajUSSeSJ9bOZ77VzejKZaXsTtZo4/u7Io08=
 sigs.k8s.io/yaml v1.4.0 h1:Mk1wCc2gy/F0THH0TAp1QYyJNzRm2KCLy3o5ASXVI5E=

internal/additional/helm.go

@@ -0,0 +1,79 @@
+package additional
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getCertManagerSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "cert-manager",
+		ChartName:       appConfig.Modules.Additional.CertManager.ChartRef,
+		Version:         appConfig.Modules.Additional.CertManager.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.CertManager.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl"),
+	}
+}
+
+func getIngressNginxSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "ingress-nginx",
+		ChartName:       appConfig.Modules.Additional.Ingress.ChartRef,
+		Version:         appConfig.Modules.Additional.Ingress.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Ingress.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl"),
+	}
+}
+
+func getDockerSecretsGeneratorSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "docker-secrets-generator",
+		ChartName:       appConfig.Modules.Additional.DockerSecrets.ChartRef,
+		Version:         appConfig.Modules.Additional.DockerSecrets.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.DockerSecrets.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos("kube-system", HELM_REPOS)
+	if appConfig.Modules.Additional.CertManager.Enabled {
+		helm_client.InstallChart(getCertManagerSpec())
+	} else {
+		helm_client.DeleteChart(getCertManagerSpec())
+	}
+	if appConfig.Modules.Additional.Ingress.Enabled && appConfig.Modules.Additional.Ingress.Type == "nginx" {
+		helm_client.InstallChart(getIngressNginxSpec())
+	} else {
+		helm_client.DeleteChart(getIngressNginxSpec())
+	}
+	if appConfig.Modules.Additional.DockerSecrets.Repositories != nil {
+		helm_client.InstallChart(getDockerSecretsGeneratorSpec())
+	} else {
+		helm_client.DeleteChart(getDockerSecretsGeneratorSpec())
+	}
+}

internal/config/config.go

@@ -16,6 +16,8 @@ type Host struct {
 
 type Config struct {
 	WorkDir        string
+	KubeconfigFile string `yaml:"kubeconfig_file" env-default:"k8s-admin.conf"`
+	Verbose        bool
 	Credentials    struct {
 		User            string `yaml:"user"`
 		Password        string `yaml:"password"`
@@ -28,17 +30,8 @@ type Config struct {
 	Orchestrator Orchestrator `yaml:"orchestrator"`
 
 	Modules struct {
-		AdminPassword          string         `yaml:"admin_password"`
-		AdditionalRepositories interface{}    `yaml:"additional_repositories"`
 		Additional Additional `yaml:"additional"`
-		Observability          Observability  `yaml:"observability"`
-		Registry               Registry       `yaml:"registry"`
-		Cicd                   Cicd           `yaml:"cicd"`
-		SecretsStorage         SecretsStorage `yaml:"secrets_storage"`
 	} `yaml:"modules"`
-
-	Repositories string
-	Releases     string
 }
 
 var instance *Config
@@ -55,9 +48,6 @@ func CreateConfig(configPath string, workDir string, password string) *Config {
 	if password != "" {
 		instance.Credentials.Password = password
 	}
-
-	generateCreds(instance)
-
 	return instance
 }
 

internal/config/helm.go

@@ -0,0 +1,62 @@
+package config
+
+import (
+	"io"
+	"log"
+	"os"
+	"path/filepath"
+	"time"
+
+	helm_client "github.com/mittwald/go-helm-client"
+)
+
+type RepoSettings struct {
+	Name     string
+	URL      string
+	Username string
+	Password string
+}
+
+type ChartSettings struct {
+	ReleaseName     string
+	ChartRef        string
+	ChartVersion    string
+	Namespace       string
+	CreateNamespace bool
+	Atomic          bool
+	Timeout         time.Duration
+	ValuesYaml      string
+}
+
+func GetHelmClient(namespace string) helm_client.Client {
+	config := GetConfig()
+	file, err := os.Open(filepath.Join(config.WorkDir, config.KubeconfigFile))
+	if err != nil {
+		log.Fatalf("failed to open file: %s", err)
+	}
+	defer file.Close()
+	kubeconfig, err := io.ReadAll(file)
+	if err != nil {
+		log.Fatalf("failed to read file: %s", err)
+	}
+	opts := &helm_client.KubeConfClientOptions{
+		Options: &helm_client.Options{
+			Namespace:        namespace,
+			RepositoryCache:  "/tmp/.helmcache",
+			RepositoryConfig: "/tmp/.helmrepo",
+			Debug:            true,
+			Linting:          true, // Change this to false if you don't want linting.
+			DebugLog: func(format string, v ...interface{}) {
+				// Change this to your own logger. Default is 'log.Printf(format, v...)'.
+			},
+		},
+		KubeContext: "",
+		KubeConfig:  kubeconfig,
+	}
+	client, err := helm_client.NewClientFromKubeConf(opts)
+	if err != nil {
+		log.Fatalf("error while creating helm client: %s", err)
+	}
+
+	return client
+}

internal/config/kubernetes.go

@@ -11,7 +11,7 @@ var kubernetesConfig *rest.Config
 
 func GetKubernetesConfig() *rest.Config {
 	appConfig := GetConfig()
-	kubeconfigPath := filepath.Join(appConfig.WorkDir, "k8s-admin.conf")
+	kubeconfigPath := filepath.Join(appConfig.WorkDir, appConfig.KubeconfigFile)
 
 	kubernetesConfig, err := clientcmd.BuildConfigFromFlags("", kubeconfigPath)
 	if err != nil {

internal/config/modules_additional.go

@@ -5,6 +5,7 @@ type Additional struct {
 		ChartRef     string   `yaml:"chart_ref" env-default:"kube-forge/cert-manager"`
 		ChartVersion string   `yaml:"chart_version" env-default:"v1.14.5"`
 		Enabled      bool     `yaml:"enabled"`
+		Namespace    string   `yaml:"namespace" env-default:"cert-manager"`
 		HaEnabled    bool     `yaml:"ha_enabled"`
 		DnsServers   []string `yaml:"dns_servers" env-default:"8.8.8.8,1.1.1.1"`
 		AccountEmail string   `yaml:"account_email"`
@@ -19,6 +20,7 @@ type Additional struct {
 		ChartVersion            string `yaml:"chart_version" env-default:"4.10.1"`
 		Type                    string `yaml:"type" env-default:"nginx"`
 		Enabled                 bool   `yaml:"enabled"`
+		Namespace               string `yaml:"namespace" env-default:"ingress-nginx"`
 		IngressClassName        string `yaml:"ingress_class_name" env-default:"nginx"`
 		HostNetwork             bool   `yaml:"host_network"`
 		EnableAdmissionWebhooks bool   `yaml:"enable_admission_webhooks"`
@@ -36,12 +38,13 @@ type Additional struct {
 
 	LoadBalancer struct {
 		Type    string `yaml:"type" env-default:"metallb"`
-		Install bool   `yaml:"install"`
+		Enabled bool   `yaml:"enabled"`
 	} `yaml:"load_balancer"`
 
 	DockerSecrets struct {
 		ChartRef     string      `yaml:"chart_ref" env-default:"kube-forge/docker-secrets-generator"`
 		ChartVersion string      `yaml:"chart_version" env-default:"0.1.0"`
+		Namespace    string      `yaml:"namespace" env-default:"kube-system"`
 		Repositories interface{} `yaml:"repositories"`
 	} `yaml:"docker_secrets"`
 
@@ -49,16 +52,19 @@ type Additional struct {
 		LocalPathProvisioner struct {
 			StorageClassName string `yaml:"storage_class_name" env-default:"local-path"`
 			ReclaimPolicy    string `yaml:"reclaim_policy" env-default:"Delete"`
+			DataDir          string `yaml:"data_dir" env-default:"/opt/local-path-provisioner/"`
 		} `yaml:"local_path_provisioner"`
 		Longhorn struct {
 			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/longhorn"`
 			ChartVersion string `yaml:"chart_version" env-default:"1.6.1"`
 			Enabled      bool   `yaml:"enabled"`
+			Namespace    string `yaml:"namespace" env-default:"longhorn-system"`
 		} `yaml:"longhorn"`
 		SecretsStoreCsiDriver struct {
 			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/secrets-store-csi-driver"`
 			ChartVersion string `yaml:"chart_version" env-default:"1.4.3"`
 			Enabled      bool   `yaml:"enabled"`
+			Namespace    string `yaml:"namespace" env-default:"kube-system"`
 		} `yaml:"secrets_store_csi_driver"`
 	} `yaml:"storage"`
 }

internal/config/modules_cicd.go

@@ -1,52 +0,0 @@
-package config
-
-type Cicd struct {
-	Enabled bool `yaml:"enabled"`
-	ArgoCd  struct {
-		ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/argo-cd"`
-		ChartVersion  string `yaml:"chart_version" env-default:"5.46.7"`
-		AdminPassword string
-		Ha            struct {
-			Enabled     bool `yaml:"enabled"`
-			Autoscaling bool `yaml:"autoscaling"`
-		} `yaml:"ha"`
-		Expose struct {
-			Type          string `yaml:"type"`
-			Domain        string `yaml:"domain"`
-			NodePortHttp  int    `yaml:"node_port_http" env-default:"30005"`
-			NodePortHttps int    `yaml:"node_port_https" env-default:"30006"`
-			Tls           struct {
-				Enabled bool `yaml:"enabled"`
-			} `yaml:"tls"`
-		} `yaml:"expose"`
-		Repositories interface{} `yaml:"repositories"`
-		Rbac         struct {
-			AdditionalPolicies string `yaml:"additional_policies"`
-		} `yaml:"argo_cd"`
-		ServiceIngress struct {
-			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/service-ingress"`
-			ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
-		} `yaml:"service_ingress"`
-	} `yaml:"argo_cd"`
-	UpdatesOperator struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/keel"`
-		ChartVersion string `yaml:"chart_version" env-default:"1.0.3"`
-		Enabled      bool   `yaml:"enabled"`
-	} `yaml:"updates_operator"`
-	Rollouts struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/argo-rollouts"`
-		ChartVersion string `yaml:"chart_version" env-default:"2.35.1"`
-		Enabled      bool   `yaml:"enabled"`
-		Ha           struct {
-			Enabled bool `yaml:"enabled"`
-		} `yaml:"ha"`
-		Expose struct {
-			Type     string `yaml:"type"`
-			NodePort int    `yaml:"node_port" env-default:"30010"`
-		} `yaml:"expose"`
-		Controller struct {
-		} `yaml:"controller"`
-		Dashboard struct {
-		} `yaml:"dashboard"`
-	} `yaml:"rollouts"`
-}

internal/config/modules_observability.go

@@ -1,172 +0,0 @@
-package config
-
-type Observability struct {
-	ChartRef      string        `yaml:"chart_ref" env-default:"kube-forge/observability"`
-	ChartVersion  string        `yaml:"chart_version" env-default:"0.1.0"`
-	Enabled       bool          `yaml:"enabled"`
-	Logging       Logging       `yaml:"logging"`
-	Tracing       Tracing       `yaml:"tracing"`
-	Monitoring    Monitoring    `yaml:"monitoring"`
-	Visualization Visualization `yaml:"visualization"`
-}
-
-type Logging struct {
-	Enabled  bool `yaml:"enabled"`
-	Operator struct {
-		ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/fluent-operator"`
-		ChartVersion  string `yaml:"chart_version" env-default:"2.7.0"`
-		Image         string `yaml:"image" env-default:"kubesphere/fluent-operator"`
-		Tag           string `yaml:"tag" env-default:"v2.7.0"`
-		InitContainer struct {
-			Image string `yaml:"image" env-default:"docker"`
-			Tag   string `yaml:"tag" env-default:"20.10"`
-		} `yaml:"initcontainer"`
-	} `yaml:"operator"`
-	Fluentd struct {
-		Image string `yaml:"image" env-default:"kubesphere/fluentd"`
-		Tag   string `yaml:"tag" env-default:"v1.15.3"`
-	} `yaml:"fluentd"`
-	FluentBit struct {
-		Image string `yaml:"image" env-default:"kubesphere/fluent-bit"`
-		Tag   string `yaml:"tag" env-default:"v2.2.2"`
-	} `yaml:"fluent_bit"`
-	Loki struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/loki"`
-		ChartVersion string `yaml:"chart_version" env-default:"5.47.2"`
-		Registry     string `yaml:"registry" env-default:"docker.io"`
-		Image        string `yaml:"image" env-default:"grafana/loki"`
-		Tag          string `yaml:"tag" env-default:"null"`
-		Persistence  struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"10Gi"`
-			Retention    string `yaml:"retention" env-default:"168h"`
-		} `yaml:"persistence"`
-		AlertManagerUrl       string `yaml:"alert_manager_url" env-default:"http://observability-alert-manager:9093"`
-		AdditionalRulesGroups string `yaml:"additional_rules_groups" env-default:""`
-	} `yaml:"loki"`
-	Events struct {
-		Enabled  bool `yaml:"enabled"`
-		Exporter struct {
-			Image string `yaml:"image" env-default:"ghcr.io/resmoio/kubernetes-event-exporter"`
-			Tag   string `yaml:"tag" env-default:"v1.4"`
-		} `yaml:"exporter"`
-		Cron struct {
-			Image    string `yaml:"image" env-default:"bitnami/kubectl"`
-			Tag      string `yaml:"tag" env-default:"1.27.5-debian-11-r8"`
-			Schedule string `yaml:"schedule" env-default:"*/2 * * * *"`
-		} `yaml:"cron"`
-	} `yaml:"events"`
-}
-
-type Tracing struct {
-	Enabled  bool `yaml:"enabled"`
-	Operator struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/opentelemetry-operator"`
-		ChartVersion string `yaml:"chart_version" env-default:"0.55.0"`
-		Image        string `yaml:"image" env-default:"ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator"`
-		Tag          string `yaml:"tag" env-default:""`
-	} `yaml:"operator"`
-	Collector struct {
-		Image string `yaml:"image" env-default:"otel/opentelemetry-collector-contrib"`
-		Tag   string `yaml:"tag" env-default:"0.95.0"`
-	} `yaml:"collector"`
-	Tempo struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/tempo"`
-		ChartVersion string `yaml:"chart_version" env-default:"1.7.2"`
-		Image        string `yaml:"image" env-default:"grafana/tempo"`
-		Tag          string `yaml:"tag" env-default:""`
-		Retention    string `yaml:"retention" env-default:"24h"`
-		ListenPort   int    `yaml:"listen_port" env-default:"3100"`
-		Persistence  struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"10Gi"`
-		} `yaml:"persistence"`
-		TempoQuery struct {
-			Image      string `yaml:"image" env-default:"grafana/tempo-query"`
-			Tag        string `yaml:"tag" env-default:"null"`
-			ListenPort int    `yaml:"listen_port" env-default:"16686"`
-		} `yaml:"tempo_query"`
-	} `yaml:"tempo"`
-}
-
-type Monitoring struct {
-	Enabled    bool `yaml:"enabled"`
-	Prometheus struct {
-		Image          string `yaml:"image" env-default:"prom/prometheus"`
-		Tag            string `yaml:"tag" env-default:"v2.45.0"`
-		ScrapeInterval string `yaml:"scrape_interval" env-default:"15s"`
-		Persistence    struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"3Gi"`
-			Retention    string `yaml:"retention" env-default:"7d"`
-		} `yaml:"persistence"`
-		Operator struct {
-			Image          string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-operator"`
-			Tag            string `yaml:"tag" env-default:"v0.65.2"`
-			ConfigReloader struct {
-				Image string `yaml:"image" env-default:"ghcr.io/prometheus-operator/prometheus-config-reloader"`
-				Tag   string `yaml:"tag" env-default:"v0.65.2"`
-			} `yaml:"config_reloader"`
-			KubeRbacProxy struct {
-				Image string `yaml:"image" env-default:"bitnami/kube-rbac-proxy"`
-				Tag   string `yaml:"tag" env-default:"0.14.1"`
-			} `yaml:"kube_rbac_proxy"`
-		} `yaml:"operator"`
-	} `yaml:"prometheus"`
-	AlertManager struct {
-		Enabled                    bool        `yaml:"enabled"`
-		Image                      string      `yaml:"image" env-default:"prom/alertmanager"`
-		Tag                        string      `yaml:"tag" env-default:"v0.26.0"`
-		AdditionalMessageTemplates interface{} `yaml:"additionalMessageTemplates"`
-		Route                      interface{} `yaml:"route"`
-		Receivers                  interface{} `yaml:"receivers"`
-	} `yaml:"alert_manager"`
-	Blackbox struct {
-		Enabled           bool   `yaml:"enabled"`
-		Image             string `yaml:"image" env-default:"prom/blackbox-exporter"`
-		Tag               string `yaml:"tag" env-default:"v0.24.0"`
-		AdditionalModules string `yaml:"routes" env-default:""`
-	} `yaml:"blackbox"`
-	KubeState struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"bitnami/kube-state-metrics"`
-		Tag     string `yaml:"tag" env-default:"2.9.2"`
-	} `yaml:"kube_state"`
-	Node struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"prom/node-exporter"`
-		Tag     string `yaml:"tag" env-default:"v1.5.0"`
-	} `yaml:"node"`
-	MetricsServer struct {
-		ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/metrics-server"`
-		ChartVersion string `yaml:"chart_version" env-default:"3.12.1"`
-		Image        string `yaml:"image" env-default:"registry.k8s.io/metrics-server/metrics-server"`
-		Tag          string `yaml:"tag" env-default:""`
-	}
-}
-
-type Visualization struct {
-	Enabled bool `yaml:"enabled"`
-	Grafana struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"grafana/grafana"`
-		Tag     string `yaml:"tag" env-default:"10.4.1"`
-		Expose  struct {
-			Type         string `yaml:"type" env-default:"ingress"`
-			Domain       string `yaml:"domain" env-default:""`
-			NodePortHttp int    `yaml:"node_port_http" env-default:"30007"`
-			Tls          struct {
-				Enabled bool `yaml:"enabled"`
-			}
-		} `yaml:"expose"`
-		Persistence struct {
-			StorageClass string `yaml:"storage_class" env-default:"local-path"`
-			StorageSize  string `yaml:"storage_size" env-default:"2Gi"`
-		} `yaml:"persistence"`
-		Config struct {
-			Auth                  string      `yaml:"auth" env-default:""`
-			AuthGenericAuth       string      `yaml:"auth_generic_auth" env-default:""`
-			AdditionalDatasources interface{} `yaml:"additional_datasources"`
-		} `yaml:"config"`
-	} `yaml:"grafana"`
-}

internal/config/modules_registry.go

@@ -1,32 +0,0 @@
-package config
-
-type Registry struct {
-	ChartRef      string `yaml:"chart_ref" env-default:"kube-forge/harbor"`
-	ChartVersion  string `yaml:"chart_version" env-default:"1.14.2"`
-	Enabled       bool   `yaml:"enabled"`
-	AdminPassword string
-	Namespace     string `yaml:"namespace" env-default:"registry"`
-	Version       string `yaml:"version" env-default:"v2.10.1"`
-	Expose        struct {
-		Type          string `yaml:"type" env-default:"nodePort"`
-		Domain        string `yaml:"domain" env-default:""`
-		NodePortHttp  int    `yaml:"node_port_http" env-default:"30002"`
-		NodePortHttps int    `yaml:"node_port_https" env-default:"30003"`
-	} `yaml:"expose"`
-	Tls struct {
-		Enabled              bool `yaml:"enabled"`
-		CertificateGenerator struct {
-			ChartRef     string `yaml:"chart_ref" env-default:"kube-forge/certificate-generator"`
-			ChartVersion string `yaml:"chart_version" env-default:"0.1.0"`
-		} `yaml:"certificate_generator"`
-	} `yaml:"tls"`
-	Persistence struct {
-		StorageClass   string `yaml:"storage_class" env-default:"local-path"`
-		RegistrySize   string `yaml:"registry_size" env-default:"10Gi"`
-		JobserviceSize string `yaml:"jobservice_size" env-default:"1Gi"`
-		DatabaseSize   string `yaml:"database_size" env-default:"2Gi"`
-		RedisSize      string `yaml:"redis_size" env-default:"1Gi"`
-		TrivySize      string `yaml:"trivy_size" env-default:"5Gi"`
-	} `yaml:"persistence"`
-	EnabledScanner bool `yaml:"enabled_scanner"`
-}

internal/config/modules_secrets_storage.go

@@ -1,46 +0,0 @@
-package config
-
-type SecretsStorage struct {
-	ChartRef     string   `yaml:"chart_ref" env-default:"kube-forge/vault"`
-	ChartVersion string   `yaml:"chart_version" env-default:"0.1.0"`
-	Enabled      bool     `yaml:"enabled"`
-	KeyShares    int      `yaml:"key_shares" env-default:"5"`
-	KeyThreshold int      `yaml:"key_threshold" env-default:"3"`
-	UnsealKeys   []string `yaml:"unseal_keys" env-default:"[]"`
-	AuthToken    string   `yaml:"auth_token" env-default:""`
-	Expose       struct {
-		Type     string `yaml:"type"`
-		Domain   string `yaml:"domain"`
-		NodePort int    `yaml:"node_port"`
-		Tls      struct {
-			Enabled bool `yaml:"enabled"`
-		} `yaml:"tls"`
-	} `yaml:"expose"`
-	CsiIntegration struct {
-		Enabled bool   `yaml:"enabled"`
-		Image   string `yaml:"image" env-default:"hashicorp/vault-csi-provider"`
-		Tag     string `yaml:"tag" env-default:"1.4.1"`
-	} `yaml:"csi_integration"`
-	Injector struct {
-		Image string `yaml:"image" env-default:"hashicorp/vault-k8s"`
-		Tag   string `yaml:"tag" env-default:"1.3.1"`
-	} `yaml:"injector"`
-	Server struct {
-		Image       string `yaml:"image" env-default:"hashicorp/vault"`
-		Tag         string `yaml:"tag" env-default:"1.16.0"`
-		Persistence struct {
-			DataStorage struct {
-				StorageClass string `yaml:"storage_class" env-default:"local-path"`
-				Size         string `yaml:"size" env-default:"10Gi"`
-			} `yaml:"data_storage"`
-			AuditStorage struct {
-				StorageClass string `yaml:"storage_class" env-default:"local-path"`
-				Size         string `yaml:"size" env-default:"10Gi"`
-			} `yaml:"audit_storage"`
-		} `yaml:"persistence"`
-	} `yaml:"server"`
-	Agent struct {
-		Image string `yaml:"image" env-default:"hashicorp/vault"`
-		Tag   string `yaml:"tag" env-default:"1.16.0"`
-	} `yaml:"agent"`
-}

internal/config/orchestrator.go

@@ -3,20 +3,31 @@ package config
 type Dns struct {
 	Servers                []string      `yaml:"servers" env-default:"8.8.8.8,8.8.4.4"`
 	DisableHostNameservers bool          `yaml:"disable_host_nameservers"`
+	CoreDNSExternalZones   []interface{} `yaml:"coredns_external_zones"`
+}
+
+type RegistryMirror struct {
+	Host       string `yaml:"host"`
+	SkipVerify bool   `yaml:"skip_verify"`
 }
 
 type Orchestrator struct {
 	Version                   string `yaml:"version" env-default:"v1.29.0"`
-	ClusterName               string `yaml:"cluster_name" env-default:"k8s-cluster.local"`
+	ClusterName               string `yaml:"cluster_name" env-default:"cluster.local"`
 	BinDir                    string `yaml:"bin_dir" env-default:"/usr/local/bin"`
 	SysctlFilePath            string `yaml:"sysctl_file_path" env-default:"/etc/sysctl.d/99-sysctl.conf"`
 	LoadbalancerApiserverPort int    `yaml:"loadbalancer_apiserver_port" env-default:"6443"`
+	ProxyMode                 string `yaml:"proxy_mode" env-default:"ipvs"`
+	ProxyScheduler            string `yaml:"proxy_scheduler" env-default:"rr"`
 	Dns                       Dns    `yaml:"dns"`
 	CloudProvider             string `yaml:"cloud_provider"`
 	ExgernalCloudProvider     string `yaml:"external_cloud_provider"`
+	KubeletDir                string `yaml:"kubelet_dir" env-default:"/var/lib/kubelet"`
 	ContainerEngine           struct {
 		Type     string `yaml:"type" env-default:"containerd"`
 		Install  bool   `yaml:"install"`
+		DataDir  string `yaml:"data_dir" env-default:"/var/lib/containerd"`
+		StateDir string `yaml:"state_dir" env-default:"/run/containerd"`
 	} `yaml:"container_engine"`
 	PingAccessIp             bool   `yaml:"ping_access_ip"`
 	AutoRenewCertificates    bool   `yaml:"auto_renew_certificates"`
@@ -27,5 +38,16 @@ type Orchestrator struct {
 		Plugin           string `yaml:"plugin" env-default:"calico"`
 		ServiceAddresses string `yaml:"service_addresses" env-default:"10.233.0.0/18"`
 		PodsSubnet       string `yaml:"pods_subnet" env-default:"10.233.64.0/18"`
+		Calico           struct {
+			EnableBpf bool `yaml:"enable_bpf"`
+		} `yaml:"calico"`
+		Cilium struct {
+			EnableBpf bool `yaml:"enable_bpf"`
+			Hubble    struct {
+				Install       bool `yaml:"install"`
+				EnableMetrics bool `yaml:"enable_metrics"`
+			} `yaml:"hubble"`
+		} `yaml:"cilium"`
 	} `yaml:"network"`
+	RegistryMirrors []RegistryMirror `yaml:"registry_mirrors"`
 }

internal/config/utility.go

@@ -11,8 +11,3 @@ func getBcryptHash(input string) string {
 	}
 	return string(hashedPassword)
 }
-
-func generateCreds(config *Config) {
-	config.Modules.Cicd.ArgoCd.AdminPassword = getBcryptHash(config.Modules.AdminPassword)
-	config.Modules.Registry.AdminPassword = config.Modules.AdminPassword
-}

internal/csi/helm.go

@@ -0,0 +1,60 @@
+package csi
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/helm_client"
+	"kube-forge/internal/templates"
+	"time"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+var HELM_REPOS = []config.RepoSettings{
+	{
+		Name: "kube-forge",
+		URL:  "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable",
+	},
+}
+
+func getLonghornSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "longhorn",
+		ChartName:       appConfig.Modules.Additional.Storage.Longhorn.ChartRef,
+		Version:         appConfig.Modules.Additional.Storage.Longhorn.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Storage.Longhorn.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 600,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl"),
+	}
+}
+
+func getSecretsStoreSpec() go_helm_client.ChartSpec {
+	appConfig := config.GetConfig()
+	return go_helm_client.ChartSpec{
+		ReleaseName:     "csi-secrets-store",
+		ChartName:       appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef,
+		Version:         appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion,
+		Namespace:       appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Namespace,
+		CreateNamespace: true,
+		Atomic:          true,
+		Timeout:         time.Second * 60,
+		ValuesYaml:      templates.GetHelmValuesByTemplate("templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl"),
+	}
+}
+
+func ApplyCharts() {
+	appConfig := config.GetConfig()
+	helm_client.AddHelmRepos("kube-system", HELM_REPOS)
+	if appConfig.Modules.Additional.Storage.Longhorn.Enabled {
+		helm_client.InstallChart(getLonghornSpec())
+	} else {
+		helm_client.DeleteChart(getLonghornSpec())
+	}
+	if appConfig.Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled {
+		helm_client.InstallChart(getSecretsStoreSpec())
+	} else {
+		helm_client.DeleteChart(getSecretsStoreSpec())
+	}
+}

internal/helm_client/chart.go

@@ -0,0 +1,32 @@
+package helm_client
+
+import (
+	"context"
+	"kube-forge/internal/config"
+	"kube-forge/internal/logging"
+
+	go_helm_client "github.com/mittwald/go-helm-client"
+)
+
+func InstallChart(chartSpec go_helm_client.ChartSpec) {
+	helmClient := config.GetHelmClient(chartSpec.Namespace)
+	_, error := helmClient.GetRelease(chartSpec.ReleaseName)
+	if error != nil {
+		logging.Log.Infof("Installing %s", chartSpec.ChartName)
+	} else {
+		logging.Log.Infof("Upgrading %s", chartSpec.ChartName)
+	}
+	if _, err := helmClient.InstallOrUpgradeChart(context.Background(), &chartSpec, nil); err != nil {
+		panic(err)
+	}
+}
+
+func DeleteChart(chartSpec go_helm_client.ChartSpec) {
+	helmClient := config.GetHelmClient(chartSpec.Namespace)
+	_, error := helmClient.GetRelease(chartSpec.ReleaseName)
+	if error != nil {
+		return
+	}
+	logging.Log.Warnf("Uninstalling %s", chartSpec.ChartName)
+	helmClient.UninstallRelease(&chartSpec)
+}

internal/helm_client/repo.go

@@ -0,0 +1,27 @@
+package helm_client
+
+import (
+	"kube-forge/internal/config"
+
+	"helm.sh/helm/v3/pkg/repo"
+)
+
+func AddHelmRepo(namespace string, repoSettings config.RepoSettings) {
+	helmClient := config.GetHelmClient(namespace)
+	chartRepo := repo.Entry{
+		Name:     repoSettings.Name,
+		URL:      repoSettings.URL,
+		Username: repoSettings.Username,
+		Password: repoSettings.Password,
+	}
+
+	if err := helmClient.AddOrUpdateChartRepo(chartRepo); err != nil {
+		panic(err)
+	}
+}
+
+func AddHelmRepos(namespace string, helmRepos []config.RepoSettings) {
+	for _, repoSettings := range helmRepos {
+		AddHelmRepo(namespace, repoSettings)
+	}
+}

internal/kubespray/cluster.go

@@ -1,29 +1,29 @@
 package kubespray
 
 import (
-	"fmt"
 	"kube-forge/internal/config"
-	"kube-forge/internal/secrets_storage"
 )
 
 func InstallCluster(tags string) {
+	appConfig := config.GetConfig()
 	runPlaybook("kubespray/project/cluster.yml", tags)
-	CopyK8SAdminConfig("k8s-admin.conf")
-	config := config.GetConfig()
-	if config.Modules.SecretsStorage.Enabled {
-		fmt.Println("## Additional Vault Configuration")
-		secrets_storage.InitVault()
-		secrets_storage.UnsealVault()
-		secrets_storage.AddKubernetesLocalIntegration()
-	}
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
 }
 
 func UpgradeCluster(tags string) {
+	appConfig := config.GetConfig()
 	runPlaybook("kubespray/project/upgrade_cluster.yml", tags)
-	CopyK8SAdminConfig("k8s-admin.conf")
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
 }
 
 func ScaleCluster() {
+	appConfig := config.GetConfig()
 	runPlaybook("kubespray/project/scale.yml", "")
-	CopyK8SAdminConfig("k8s-admin.conf")
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
+}
+
+func ResetCluster() {
+	appConfig := config.GetConfig()
+	runPlaybook("kubespray/project/reset.yml", "")
+	CopyK8SAdminConfig(appConfig.KubeconfigFile)
 }

internal/kubespray/utility.go

@@ -56,19 +56,26 @@ func CopyK8SAdminConfig(pathInDataDir string) {
 }
 
 func runPlaybook(playbookPath string, tags string) {
+	config := config.GetConfig()
+	var callbackExecute execute.Executor
+
 	playbookOptions := getPlaybookParameters(tags)
 	playbookCmd := playbook.NewAnsiblePlaybookCmd(
 		playbook.WithPlaybooks(playbookPath),
 		playbook.WithPlaybookOptions(&playbookOptions),
 	)
-	exec := stdoutcallback.NewDebugStdoutCallbackExecute(
-		execute.NewDefaultExecute(
+	execute := execute.NewDefaultExecute(
 		execute.WithCmd(playbookCmd),
 		execute.WithErrorEnrich(playbook.NewAnsiblePlaybookErrorEnrich()),
-		),
 	)
 
-	err := exec.Execute(context.Background())
+	if config.Verbose {
+		callbackExecute = stdoutcallback.NewDebugStdoutCallbackExecute(execute)
+	} else {
+		callbackExecute = stdoutcallback.NewDenseStdoutCallbackExecute(execute)
+	}
+
+	err := callbackExecute.Execute(context.Background())
 	if err != nil {
 		panic(err)
 	}

internal/logging/log.go

@@ -0,0 +1,12 @@
+package logging
+
+import (
+	"github.com/sirupsen/logrus"
+)
+
+var Log = logrus.New()
+
+func init() {
+	Log.SetLevel(logrus.InfoLevel)
+	Log.SetFormatter(&logrus.TextFormatter{})
+}

internal/registry/commands.go

@@ -1,9 +0,0 @@
-package registry
-
-func CreateDockerRepositories() {
-
-}
-
-func CreateHelmRepositories() {
-
-}

internal/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl

@@ -1,14 +1,3 @@
-- name: cert-manager
-  namespace: cert-manager
-  create_namespace: true
-  chart_ref: {{ .Modules.Additional.CertManager.ChartRef }}
-  chart_version: {{ .Modules.Additional.CertManager.ChartVersion }}
-  {{- if .Modules.Additional.CertManager.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
 global:
   imagePullSecrets: []
 

internal/resources/templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl

@@ -1,14 +1,2 @@
-- name: docker-secrets-generator
-  namespace: kube-system
-  chart_ref: {{ .Modules.Additional.DockerSecrets.ChartRef }}
-  chart_version: {{ .Modules.Additional.DockerSecrets.ChartVersion }}
-  {{- if .Modules.Additional.DockerSecrets.Repositories }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-    {{- if .Modules.Additional.DockerSecrets.Repositories }}
-  values:
 repositories:
   {{- .Modules.Additional.DockerSecrets.Repositories | toYaml | nindent 6 }}
-    {{- end }}

internal/resources/templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl

@@ -1,14 +1,3 @@
-- name: ingress-nginx
-  namespace: ingress-nginx
-  create_namespace: true
-  chart_ref: {{ .Modules.Additional.Ingress.ChartRef }}
-  chart_version: {{ .Modules.Additional.Ingress.ChartVersion }}
-  {{- if and .Modules.Additional.Ingress.Enabled (eq .Modules.Additional.Ingress.Type "nginx") }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
 commonLabels: {}
 controller:
   name: controller
@@ -20,8 +9,6 @@
     ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail
     repository: {{ .Modules.Additional.Ingress.Nginx.Controller.Image }}
     tag: "{{ .Modules.Additional.Ingress.Nginx.Controller.Tag }}"
-        digest: sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3
-        digestChroot: sha256:5976b1067cfbca8a21d0ba53d71f83543a73316a61ea7f7e436d6cf84ddf9b26
     pullPolicy: IfNotPresent
     # www-data -> uid 101
     runAsUser: 101
@@ -556,7 +543,7 @@
 
   opentelemetry:
     enabled: false
-        image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
+    # image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472
     containerSecurityContext:
       allowPrivilegeEscalation: false
     resources: {}

internal/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl

@@ -1,14 +1,3 @@
-- name: longhorn
-  namespace: longhorn-system
-  create_namespace: true
-  chart_ref: {{ .Modules.Additional.Storage.Longhorn.ChartRef }}
-  chart_version: {{ .Modules.Additional.Storage.Longhorn.ChartVersion }}
-  {{- if .Modules.Additional.Storage.Longhorn.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
 global:
   cattle:
     # -- Default system registry.

internal/resources/templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl

@@ -1,9 +1,244 @@
-- name: csi-secrets-store
-  namespace: kube-system
-  chart_ref: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartRef }}
-  chart_version: {{ .Modules.Additional.Storage.SecretsStoreCsiDriver.ChartVersion }}
-  {{- if .Modules.Additional.Storage.SecretsStoreCsiDriver.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
+linux:
+  enabled: true
+  image:
+    repository: registry.k8s.io/csi-secrets-store/driver
+    tag: v1.4.3
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  crds:
+    enabled: true
+    image:
+      repository: registry.k8s.io/csi-secrets-store/driver-crds
+      tag: v1.4.3
+      pullPolicy: IfNotPresent
+    ## Optionally override resource limits for crd hooks(jobs)
+    resources: {}
+      # requests:
+      #   cpu: "100m"
+      #   memory: "128Mi"
+      # limits:
+      #   cpu: "500m"
+      #   memory: "512Mi"
+    annotations: {}
+    podLabels: {}
+
+  ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: type
+                operator: NotIn
+                values:
+                  - virtual-kubelet
+
+  driver:
+    resources:
+      limits:
+        cpu: 200m
+        memory: 200Mi
+      requests:
+        cpu: 50m
+        memory: 100Mi
+
+  registrarImage:
+    repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+    tag: v2.10.0
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  registrar:
+    resources:
+      limits:
+        cpu: 100m
+        memory: 100Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+    logVerbosity: 5
+
+  livenessProbeImage:
+    repository: registry.k8s.io/sig-storage/livenessprobe
+    tag: v2.12.0
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  livenessProbe:
+    resources:
+      limits:
+        cpu: 100m
+        memory: 100Mi
+      requests:
+        cpu: 10m
+        memory: 20Mi
+
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  kubeletRootDir: /var/lib/kubelet
+  providersDir: /var/run/secrets-store-csi-providers
+  additionalProvidersDirs:
+    - /etc/kubernetes/secrets-store-csi-providers
+  nodeSelector: {}
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+  # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+  tolerations:
+    - operator: "Exists"
+  metricsAddr: ":8095"
+  env: []
+  priorityClassName: ""
+  daemonsetAnnotations: {}
+  podAnnotations: {}
+  podLabels: {}
+
+  # volumes is a list of volumes made available to secrets store csi driver.
+  volumes: null
+  #   - name: foo
+  #     emptyDir: {}
+
+  # volumeMounts is a list of volumeMounts for secrets store csi driver.
+  volumeMounts: null
+  #   - name: foo
+  #     mountPath: /bar
+  #     readOnly: true
+
+windows:
+  enabled: false
+  image:
+    repository: registry.k8s.io/csi-secrets-store/driver
+    tag: v1.4.3
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  ## Prevent the CSI driver from being scheduled on virtual-kubelet nodes
+  affinity:
+    nodeAffinity:
+      requiredDuringSchedulingIgnoredDuringExecution:
+        nodeSelectorTerms:
+          - matchExpressions:
+              - key: type
+                operator: NotIn
+                values:
+                  - virtual-kubelet
+
+  driver:
+    resources:
+      limits:
+        cpu: 400m
+        memory: 400Mi
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+  registrarImage:
+    repository: registry.k8s.io/sig-storage/csi-node-driver-registrar
+    tag: v2.10.0
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  registrar:
+    resources:
+      limits:
+        cpu: 200m
+        memory: 200Mi
+      requests:
+        cpu: 100m
+        memory: 100Mi
+    logVerbosity: 5
+
+  livenessProbeImage:
+    repository: registry.k8s.io/sig-storage/livenessprobe
+    tag: v2.12.0
+    #digest: sha256:
+    pullPolicy: IfNotPresent
+
+  livenessProbe:
+    resources:
+      limits:
+        cpu: 200m
+        memory: 200Mi
+      requests:
+        cpu: 100m
+        memory: 100Mi
+
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+
+  kubeletRootDir: C:\var\lib\kubelet
+  providersDir: C:\\k\\secrets-store-csi-providers
+  additionalProvidersDirs:
+  nodeSelector: {}
+  # ref: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
+  # An empty key with operator Exists matches all keys, values and effects which means this will tolerate everything.
+  tolerations:
+    - operator: "Exists"
+  metricsAddr: ":8095"
+  env: []
+  priorityClassName: ""
+  daemonsetAnnotations: {}
+  podAnnotations: {}
+  podLabels: {}
+
+  # volumes is a list of volumes made available to secrets store csi driver.
+  volumes: null
+  #   - name: foo
+  #     emptyDir: {}
+
+  # volumeMounts is a list of volumeMounts for secrets store csi driver.
+  volumeMounts: null
+  #   - name: foo
+  #     mountPath: /bar
+  #     readOnly: true
+
+# log level. Uses V logs (klog)
+logVerbosity: 0
+
+# logging format JSON
+logFormatJSON: false
+
+livenessProbe:
+  port: 9808
+  logLevel: 2
+
+## Maximum size in bytes of gRPC response from plugins
+maxCallRecvMsgSize: 4194304
+
+## Install Default RBAC roles and bindings
+rbac:
+  install: true
+  pspEnabled: false
+
+## Install RBAC roles and bindings required for K8S Secrets syncing if true
+syncSecret:
+  enabled: false
+
+## Enable secret rotation feature [alpha]
+enableSecretRotation: false
+
+## Secret rotation poll interval duration
+rotationPollInterval:
+
+## Provider HealthCheck
+providerHealthCheck: false
+
+## Provider HealthCheck interval
+providerHealthCheckInterval: 2m
+
+imagePullSecrets: []
+
+## This allows CSI drivers to impersonate the pods that they mount the volumes for.
+# refer to https://kubernetes-csi.github.io/docs/token-requests.html for more details.
+# Supported only for Kubernetes v1.20+
+tokenRequests: []
+# - audience: aud1
+# - audience: aud2
+
+# -- Labels to apply to all resources
+commonLabels: {}
+# team_name: dev

internal/resources/templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl

@@ -1,34 +0,0 @@
-- name: argo-cd-ingress
-  namespace: cicd
-  create_namespace: true
-  chart_ref: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartRef }}
-  chart_version: {{ .Modules.Cicd.ArgoCd.ServiceIngress.ChartVersion }}
-  {{- if and .Modules.Cicd.Enabled (eq .Modules.Cicd.ArgoCd.Expose.Type "ingress") }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    services:
-      - domain: {{ .Modules.Cicd.ArgoCd.Expose.Domain }}
-        address: argo-cd-argocd-server
-        port: 80
-        secretName: argo-cd-server-tls
-
-    ingress:
-      accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-      class: {{ .Modules.Additional.Ingress.Type }}
-      annotations:
-        {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-        nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-        nginx.ingress.kubernetes.io/proxy-body-size: "0"
-        {{- end }}
-      tls:
-        enabled: {{ .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}
-        useCertManager: true
-
-        # used if "useCertManager" is false
-        crt: ""
-        key: ""

internal/resources/templates/helm-apps/releases/cicd/argo-cd.yml.tmpl

@@ -1,148 +0,0 @@
-- name: argo-cd
-  namespace: cicd
-  create_namespace: true
-  chart_ref: {{ .Modules.Cicd.ArgoCd.ChartRef }}
-  chart_version: {{ .Modules.Cicd.ArgoCd.ChartVersion }}
-  {{- if .Modules.Cicd.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    crds:
-      install: true
-
-    server:
-      certificateSecret:
-        enabled: false
-      {{- if eq .Modules.Cicd.ArgoCd.Expose.Type "NodePort" }}
-      service:
-        type: "NodePort"
-        nodePortHttp: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttp }}
-        nodePortHttps: {{ .Modules.Cicd.ArgoCd.Expose.NodePortHttps }}
-      {{- end }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-      autoscaling:
-        enabled: true
-        minReplicas: 2
-      {{- else }}
-      replicas: 2
-      {{- end }}
-      {{- end }}
-
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    redis:
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    controller:
-      replicas: 1
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    applicationSet:
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-      replicas: 2
-      {{- end }}
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    dex:
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        ## check later
-        serviceMonitor:
-          enabled: false
-
-    repoServer:
-      {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-      {{- if .Modules.Cicd.ArgoCd.Ha.Autoscaling }}
-      autoscaling:
-        enabled: true
-        minReplicas: 2
-      {{- else }}
-      replicas: 2
-      {{- end }}
-      {{- end }}
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    notifications:
-      metrics:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        serviceMonitor:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    configs:
-      params:
-        server.insecure: true
-
-      secret:
-        argocdServerAdminPassword: {{ .Modules.Cicd.ArgoCd.AdminPassword }}
-
-      repositories:
-        # add default helm-repository from harbor
-        {{- .Modules.Cicd.ArgoCd.Repositories | toYaml | nindent 8 }}
-
-      cm:
-        create: true
-        url: "{{ if .Modules.Cicd.ArgoCd.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Cicd.ArgoCd.Expose.Domain }}"
-
-        accounts.developer: login
-        accounts.guest: login
-
-        # oidc.config: ""
-
-      rbac:
-        create: true
-        policy.csv: |
-          p, role:admin, applications, create, */*, allow
-          p, role:admin, applications, update, */*, allow
-          p, role:admin, applications, delete, */*, allow
-          p, role:admin, applications, sync, */*, allow
-          p, role:admin, applications, override, */*, allow
-          p, role:admin, applications, action/*, */*, allow
-          p, role:admin, applicationsets, get, */*, allow
-          p, role:admin, applicationsets, create, */*, allow
-          p, role:admin, applicationsets, update, */*, allow
-          p, role:admin, applicationsets, delete, */*, allow
-          p, role:admin, certificates, create, *, allow
-          p, role:admin, certificates, update, *, allow
-          p, role:admin, certificates, delete, *, allow
-          p, role:admin, clusters, create, *, allow
-          p, role:admin, clusters, update, *, allow
-          p, role:admin, clusters, delete, *, allow
-          p, role:admin, repositories, create, *, allow
-          p, role:admin, repositories, update, *, allow
-          p, role:admin, repositories, delete, *, allow
-          p, role:admin, projects, create, *, allow
-          p, role:admin, projects, update, *, allow
-          p, role:admin, projects, delete, *, allow
-          p, role:admin, accounts, update, *, allow
-          p, role:admin, gpgkeys, create, *, allow
-          p, role:admin, gpgkeys, delete, *, allow
-          p, role:admin, exec, create, */*, allow
-
-          {{- .Modules.Cicd.ArgoCd.Rbac.AdditionalPolicies }}
-
-
-        policy.default: role:''
-        # scopes: "[roles,email,groups]"
-
-    {{- if .Modules.Cicd.ArgoCd.Ha.Enabled }}
-    redis-ha:
-      enabled: true
-    {{- end }}

internal/resources/templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl

@@ -1,435 +0,0 @@
-- name: argo-rollouts
-  namespace: cicd
-  create_namespace: true
-  chart_ref: {{ .Modules.Cicd.Rollouts.ChartRef }}
-  chart_version: {{ .Modules.Cicd.Rollouts.ChartVersion }}
-  {{- if and .Modules.Cicd.Enabled .Modules.Cicd.Rollouts.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    installCRDs: true
-    keepCRDs: false
-    clusterInstall: true
-    createClusterAggregateRoles: true
-
-    apiVersionOverrides:
-      # -- String to override apiVersion of ingresses rendered by this helm chart
-      ingress: "" # networking.k8s.io/v1beta1
-
-    # -- Override the Kubernetes version, which is used to evaluate certain manifests
-    kubeVersionOverride: ""
-
-    # -- Additional manifests to deploy within the chart. A list of objects.
-    ## Can be used to add secrets for Analysis with 3rd-party monitoring solutions.
-    extraObjects: []
-      # - apiVersion: v1
-      #   kind: Secret
-      #   metadata:
-      #     name: datadog
-      #   type: Opaque
-      #   data:
-      #     address: https://api.datadoghq.com
-      #     api-key: <datadog-api-key>
-      #     app-key: <datadog-app-key>
-
-    global:
-      # -- Annotations for all deployed Deployments
-      deploymentAnnotations: {}
-
-    controller:
-      # -- Value of label `app.kubernetes.io/component`
-      component: rollouts-controller
-      # -- Annotations to be added to the controller deployment
-      deploymentAnnotations: {}
-      # -- Annotations to be added to application controller pods
-      podAnnotations: {}
-      # -- [Node selector]
-      nodeSelector: {}
-      # -- [Tolerations] for use with node taints
-      tolerations: []
-      # -- Assign custom [affinity] rules to the deployment
-      affinity: {}
-      logging:
-        # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
-        level: info
-        # -- Set the klog logging level
-        kloglevel: "0"
-        # -- Set the logging format (one of: `text`, `json`)
-        format: "text"
-
-      # -- Assign custom [TopologySpreadConstraints] rules to the controller
-      ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-      ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
-      topologySpreadConstraints: []
-      # - maxSkew: 1
-      #   topologyKey: topology.kubernetes.io/zone
-      #   whenUnsatisfiable: DoNotSchedule
-
-      # -- [priorityClassName] for the controller
-      priorityClassName: ""
-      # -- The number of controller pods to run
-      {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
-      replicas: 3
-      {{- else }}
-      replicas: 1
-      {{- end }}
-      image:
-        # -- Registry to use
-        registry: quay.io
-        # -- Repository to use
-        repository: argoproj/argo-rollouts
-        # -- Overrides the image tag (default is the chart appVersion)
-        tag: ""
-        # -- Image pull policy
-        pullPolicy: IfNotPresent
-
-      # -- flag to enable creation of cluster controller role (requires cluster RBAC)
-      createClusterRole: true
-
-      # Controller container ports
-      containerPorts:
-        # -- Metrics container port
-        metrics: 8090
-        # -- Healthz container port
-        healthz: 8080
-      {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      metrics:
-        # -- Deploy metrics service
-        enabled: true
-        service:
-          # -- Metrics service port name
-          portName: metrics
-          # -- Metrics service port
-          port: 8090
-          # -- Service annotations
-          annotations: {}
-        serviceMonitor:
-          # -- Enable a prometheus ServiceMonitor
-          enabled: true
-          # -- Namespace to be used for the ServiceMonitor
-          namespace: ""
-          # -- Labels to be added to the ServiceMonitor
-          additionalLabels: {}
-          # -- Annotations to be added to the ServiceMonitor
-          additionalAnnotations: {}
-          # -- RelabelConfigs to apply to samples before scraping
-          relabelings: []
-          # -- MetricRelabelConfigs to apply to samples before ingestion
-          metricRelabelings: []
-      {{- end }}
-
-      # -- Configure liveness [probe] for the controller
-      # @default -- See [values.yaml]
-      livenessProbe:
-        httpGet:
-          path: /healthz
-          port: healthz
-        initialDelaySeconds: 30
-        periodSeconds: 20
-        failureThreshold: 3
-        successThreshold: 1
-        timeoutSeconds: 10
-
-      # -- Configure readiness [probe] for the controller
-      # @default -- See [values.yaml]
-      readinessProbe:
-        httpGet:
-          path: /metrics
-          port: metrics
-        initialDelaySeconds: 15
-        periodSeconds: 5
-        failureThreshold: 3
-        successThreshold: 1
-        timeoutSeconds: 4
-
-      ## Configure Pod Disruption Budget for the controller
-      pdb:
-        # -- Labels to be added to controller [Pod Disruption Budget]
-        labels: {}
-        # -- Annotations to be added to controller [Pod Disruption Budget]
-        annotations: {}
-        # -- Deploy a [Pod Disruption Budget] for the controller
-        enabled: false
-        # -- Minimum number / percentage of pods that should remain scheduled
-        minAvailable: # 1
-        # -- Maximum number / percentage of pods that may be made unavailable
-        maxUnavailable: # 0
-
-      # -- Additional volumes to add to the controller pod
-      volumes: []
-        # - configMap:
-        #     name: my-certs-cm
-        #   name: my-certs
-
-      # -- Additional volumeMounts to add to the controller container
-      volumeMounts: []
-        # - mountPath: /etc/ssl/certs
-        #   name: my-certs
-
-      # -- Configures 3rd party metric providers for controller
-      ## Ref: https://argo-rollouts.readthedocs.io/en/stable/analysis/plugins/
-      metricProviderPlugins: {}
-        # metricProviderPlugins: |-
-        #   - name: "argoproj-labs/sample-prometheus" # name of the plugin, it must match the name required by the plugin so that it can find its configuration
-        #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-
-      # -- Configures 3rd party traffic router plugins for controller
-      ## Ref: https://argo-rollouts.readthedocs.io/en/stable/features/traffic-management/plugins/
-      trafficRouterPlugins: {}
-        # trafficRouterPlugins: |-
-        #   - name: "argoproj-labs/sample-nginx" # name of the plugin, it must match the name required by the plugin so it can find it's configuration
-        #     location: "file://./my-custom-plugin" # supports http(s):// urls and file://
-
-    serviceAccount:
-      # -- Specifies whether a service account should be created
-      create: true
-      # -- Annotations to add to the service account
-      annotations: {}
-      # -- The name of the service account to use.
-      # If not set and create is true, a name is generated using the fullname template
-      name: ""
-
-    # -- Annotations to be added to all CRDs
-    crdAnnotations: {}
-
-    # -- Annotations for the all deployed pods
-    podAnnotations: {}
-
-    # -- Security Context to set on pod level
-    podSecurityContext:
-      runAsNonRoot: true
-
-    # -- Security Context to set on container level
-    containerSecurityContext: {}
-      # capabilities:
-      #   drop:
-      #   - ALL
-      # readOnlyRootFilesystem: true
-      # runAsNonRoot: true
-      # runAsUser: 1000
-
-    # -- Annotations to be added to the Rollout service
-    serviceAnnotations: {}
-
-    # -- Labels to be added to the Rollout pods
-    podLabels: {}
-
-    # -- Secrets with credentials to pull images from a private registry. Registry secret names as an array.
-    imagePullSecrets: []
-    # - name: argo-pull-secret
-
-    providerRBAC:
-      # -- Toggles addition of provider-specific RBAC rules to the controller Role and ClusterRole
-      enabled: true
-      # providerRBAC.enabled must be true in order to toggle the individual providers
-      providers:
-        # -- Adds RBAC rules for the Istio provider
-        istio: true
-        # -- Adds RBAC rules for the SMI provider
-        smi: true
-        # -- Adds RBAC rules for the Ambassador provider
-        ambassador: true
-        # -- Adds RBAC rules for the AWS Load Balancer Controller provider
-        awsLoadBalancerController: true
-        # -- Adds RBAC rules for the AWS App Mesh provider
-        awsAppMesh: true
-        # -- Adds RBAC rules for the Traefik provider
-        traefik: true
-        # -- Adds RBAC rules for the Apisix provider
-        apisix: true
-        # -- Adds RBAC rules for the Contour provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-contour/blob/main/README.md`
-        contour: true
-        # -- Adds RBAC rules for the Gloo Platform provider, see `https://github.com/argoproj-labs/rollouts-plugin-trafficrouter-glooplatform/blob/main/README.md`
-        glooPlatform: true
-      # -- Additional RBAC rules for others providers
-      additionalRules: []
-
-    dashboard:
-      # -- Deploy dashboard server
-      enabled: true
-      # -- Set cluster role to readonly
-      readonly: false
-      # -- Value of label `app.kubernetes.io/component`
-      component: rollouts-dashboard
-      # -- Annotations to be added to the dashboard deployment
-      deploymentAnnotations: {}
-      # -- Annotations to be added to application dashboard pods
-      podAnnotations: {}
-      # -- [Node selector]
-      nodeSelector: {}
-      # -- [Tolerations] for use with node taints
-      tolerations: []
-      # -- Assign custom [affinity] rules to the deployment
-      affinity: {}
-      logging:
-        # -- Set the logging level (one of: `debug`, `info`, `warn`, `error`)
-        level: info
-        # -- Set the klog logging level
-        kloglevel: "0"
-
-      # -- Assign custom [TopologySpreadConstraints] rules to the dashboard server
-      ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
-      ## If labelSelector is left out, it will default to the labelSelector configuration of the deployment
-      topologySpreadConstraints: []
-      # - maxSkew: 1
-      #   topologyKey: topology.kubernetes.io/zone
-      #   whenUnsatisfiable: DoNotSchedule
-
-      # -- [priorityClassName] for the dashboard server
-      priorityClassName: ""
-
-      # -- flag to enable creation of dashbord cluster role (requires cluster RBAC)
-      createClusterRole: true
-
-      # -- The number of dashboard pods to run
-      {{- if .Modules.Cicd.Rollouts.Ha.Enabled }}
-      replicas: 3
-      {{- else }}
-      replicas: 1
-      {{- end }}
-      image:
-        # -- Registry to use
-        registry: quay.io
-        # --  Repository to use
-        repository: argoproj/kubectl-argo-rollouts
-        # -- Overrides the image tag (default is the chart appVersion)
-        tag: ""
-        # -- Image pull policy
-        pullPolicy: IfNotPresent
-      # -- Additional command line arguments to pass to rollouts-dashboard. A list of flags.
-      extraArgs: []
-      # -- Additional environment variables for rollouts-dashboard. A list of name/value maps.
-      extraEnv: []
-        # - name: FOO
-        #   value: bar
-      # -- Resource limits and requests for the dashboard pods.
-      resources: {}
-      # -- Security Context to set on pod level
-      podSecurityContext:
-        runAsNonRoot: true
-      # -- Security Context to set on container level
-      containerSecurityContext: {}
-      service:
-        # -- Sets the type of the Service
-        {{- if eq .Modules.Cicd.Rollouts.Expose.Type "NodePort" }}
-        type: NodePort
-        nodePort: {{ .Modules.Cicd.Rollouts.Expose.NodePort }}
-        {{- else }}
-        type: ClusterIP
-        nodePort:
-        {{- end }}
-        # -- LoadBalancer will get created with the IP specified in this field
-        loadBalancerIP: ""
-        # -- Source IP ranges to allow access to service from
-        loadBalancerSourceRanges: []
-        # -- Dashboard service external IPs
-        externalIPs: []
-        # -- Service annotations
-        annotations: {}
-        # -- Service labels
-        labels: {}
-        # -- Service port name
-        portName: dashboard
-        # -- Service port
-        port: 3100
-        # -- Service target port
-        targetPort: 3100
-        # -- (int) Service nodePort
-
-      serviceAccount:
-        # -- Specifies whether a dashboard service account should be created
-        create: true
-        # -- Annotations to add to the dashboard service account
-        annotations: {}
-        # -- The name of the service account to use.
-        # If not set and create is true, a name is generated using the fullname template
-        name: ""
-
-      ## Configure Pod Disruption Budget for the dashboard
-      pdb:
-        # -- Labels to be added to dashboard [Pod Disruption Budget]
-        labels: {}
-        # -- Annotations to be added to dashboard [Pod Disruption Budget]
-        annotations: {}
-        # -- Deploy a [Pod Disruption Budget] for the dashboard
-        enabled: false
-        # -- Minimum number / percentage of pods that should remain scheduled
-        minAvailable: # 1
-        # -- Maximum number / percentage of pods that may be made unavailable
-        maxUnavailable: # 0
-
-      ## Ingress configuration.
-      ## ref: https://kubernetes.io/docs/user-guide/ingress/
-      ##
-      ingress:
-        # -- Enable dashboard ingress support
-        enabled: false
-        # -- Dashboard ingress annotations
-        annotations: {}
-        # -- Dashboard ingress labels
-        labels: {}
-        # -- Dashboard ingress class name
-        ingressClassName: ""
-
-        # -- Dashboard ingress hosts
-        ## Argo Rollouts Dashboard Ingress.
-        ## Hostnames must be provided if Ingress is enabled.
-        ## Secrets must be manually created in the namespace
-        hosts: []
-          # - argorollouts.example.com
-
-        # -- Dashboard ingress paths
-        paths:
-          - /
-        # -- Dashboard ingress path type
-        pathType: Prefix
-        # -- Dashboard ingress extra paths
-        extraPaths: []
-          # - path: /*
-          #   backend:
-          #     serviceName: ssl-redirect
-          #     servicePort: use-annotation
-          ## for Kubernetes >=1.19 (when "networking.k8s.io/v1" is used)
-          # - path: /*
-          #   pathType: Prefix
-          #   backend:
-          #     service
-          #       name: ssl-redirect
-          #       port:
-          #         name: use-annotation
-
-        # -- Dashboard ingress tls
-        tls: []
-          # - secretName: argorollouts-example-tls
-          #   hosts:
-          #     - argorollouts.example.com
-
-      # -- Additional volumes to add to the dashboard pod
-      volumes: []
-
-      # -- Additional volumeMounts to add to the dashboard container
-      volumeMounts: []
-
-    notifications:
-      secret:
-        # -- Whether to create notifications secret
-        create: false
-        # -- Generic key:value pairs to be inserted into the notifications secret
-        items: {}
-          # slack-token:
-
-      # -- Configures notification services
-      notifiers: {}
-        # service.slack: |
-        #   token: $slack-token
-
-      # -- Notification templates
-      templates: {}
-
-      # -- The trigger defines the condition when the notification should be sent
-      triggers: {}
-        # trigger.on-purple: |
-        #   - send: [my-purple-template]
-        #     when: rollout.spec.template.spec.containers[0].image == 'argoproj/rollouts-demo:purple'

internal/resources/templates/helm-apps/releases/cicd/keel.yml.tmpl

@@ -1,255 +0,0 @@
-- name: keel
-  namespace: kube-system
-  chart_ref: {{ .Modules.Cicd.UpdatesOperator.ChartRef }}
-  chart_version: {{ .Modules.Cicd.UpdatesOperator.ChartVersion }}
-  {{- if and .Modules.Cicd.Enabled .Modules.Cicd.UpdatesOperator.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    image:
-      repository: keelhq/keel
-      tag: null
-      pullPolicy: Always
-
-    # Enable insecure registries
-    insecureRegistry: false
-
-    # Polling is enabled by default,
-    # you can disable it setting value below to false
-    polling:
-      enabled: true
-      defaultSchedule: "@every 1m"
-
-    # Extra Containers to run alongside Keel
-    # extraContainers:
-    #   - name: busybox
-    #     image: busybox
-    #     imagePullPolicy: IfNotPresent
-    #     command: ['sh', '-c', 'echo Container 1 is Running ; sleep 3600']
-
-    # Helm provider support
-    helmProvider:
-      enabled: true
-      # set to version "v3" for Helm v3
-      version: "v2"
-      tillerNamespace: "kube-system"
-      # optional Tiller address (if portforwarder tunnel doesn't work),
-      # if you are using default configuration, setting it to
-      # 'tiller-deploy:44134' is usually fine
-      tillerAddress: 'tiller-deploy:44134'
-    #  helmDriver: ''
-    #  helmDriverSqlConnectionString: ''
-
-    # Google Container Registry
-    # GCP Project ID
-    gcr:
-      enabled: false
-      projectId: ""
-      gcpServiceAccount: ""
-      clusterName: ""
-      pubSub:
-        enabled: false
-
-    # Notification level (debug, info, success, warn, error, fatal)
-    notificationLevel: info
-
-    # AWS Elastic Container Registry
-    # https://keel.sh/v1/guide/documentation.html#Polling-with-AWS-ECR
-    ecr:
-      enabled: false
-      roleArn: ""
-      accessKeyId: ""
-      secretAccessKey: ""
-      region: ""
-
-    # Webhook Notification
-    # Remote webhook endpoint for notification delivery
-    webhook:
-      enabled: false
-      endpoint: ""
-
-    # Slack Notification
-    # bot name (default keel) must exist!
-    slack:
-      enabled: false
-      botName: ""
-      token: ""
-      channel: ""
-      approvalsChannel: ""
-
-    # Hipchat notification and approvals
-    hipchat:
-      enabled: false
-      token: ""
-      channel: ""
-      approvalsChannel: ""
-      botName: ""
-      userName: ""
-      password: ""
-
-    # Mattermost notifications
-    mattermost:
-      enabled: false
-      endpoint: ""
-
-    # MS Teams notifications
-    teams:
-      enabled: false
-      webhookUrl: ""
-
-    # Discord notifications
-    discord:
-      enabled: false
-      webhookUrl: ""
-
-    # Mail notifications
-    mail:
-      enabled: false
-      from: ""
-      to: ""
-      smtp:
-        server: ""
-        port: 25
-        user: ""
-        pass: ""
-
-    # Basic auth on approvals
-    basicauth:
-      enabled: true
-      user: "admin"
-      password: "{{ .Modules.AdminPassword }}"
-
-    # Keel service
-    # Enable to receive webhooks from Docker registries
-    service:
-      enabled: false
-      type: LoadBalancer
-      externalPort: 9300
-      clusterIP: ""
-
-    # Webhook Relay service
-    # If you don’t want to expose your Keel service, you can use https://webhookrelay.com/
-    # which can deliver webhooks to your internal Keel service through Keel sidecar container.
-    webhookRelay:
-      enabled: false
-      bucket: ""
-      # webhookrelay.com credentials
-      # Set the key and secret values here to create the keel-webhookrelay secret with this
-      # chart -or- leave key and secret blank and create the keel-webhookrelay secret separately.
-      key: ""
-      secret: ""
-      # webhookrelay docker image
-      image:
-        repository: webhookrelay/webhookrelayd
-        tag: latest
-        pullPolicy: IfNotPresent
-
-    # Use a secret file to define passwords and tokens of third parties.
-    secret:
-      # Leave blank to use `keel.fullname`
-      name: ""
-      # Set to false to manage your own secret file, with terraform for example.
-      create: true
-
-    # Keel self-update
-    # uncomment lines below if you want Keel to automaticly
-    # self-update to the latest release version
-    # keel:
-    #   # keel policy (all/major/minor/patch/force)
-    #   policy: patch
-    #   # trigger type, defaults to events such as pubsub, webhooks
-    #   trigger: poll
-    #   # polling schedule
-    #   pollSchedule: "@every 3m"
-    #   # images to track and update
-    #   images:
-    #     - repository: image.repository
-    #       tag: image.tag
-
-    # RBAC manifests management
-    rbac:
-      enabled: true
-      serviceAccount:
-        # Kubernetes service account name to be used for ClusterRoleBinding and Deployment.
-        # name:
-        # Create a new Kubernetes service account automatically. Set to false if you want to use your own service account.
-        # If rbac.serviceAccount.name is not set, a new name for the service account is generated
-        create: true
-
-    # Resources
-    resources:
-      limits:
-        cpu: 100m
-        memory: 128Mi
-      requests:
-        cpu: 50m
-        memory: 64Mi
-
-    # NodeSelector
-    nodeSelector: {}
-
-    affinity: {}
-
-    tolerations: {}
-
-    # base64 encoded json of GCP service account
-    # more info available here: https://cloud.google.com/kubernetes-engine/docs/tutorials/authenticating-to-cloud-platform
-    # e.g. --set googleApplicationCredentials=$(cat <JSON_KEY_FIEL> | base64)
-    googleApplicationCredentials: ""
-
-    # Enable DEBUG logging
-    debug: false
-
-    # This is used by the static manifest generator in order to create a static
-    # namespace manifest for the namespace that keel is being installed
-    # within. It should **not** be used if you are using Helm for deployment.
-    createNamespaceResource: false
-
-    podAnnotations: {}
-
-    serviceAnnotations: {}
-    # Useful for making the load balancer internal
-    # serviceAnnotations:
-    #    cloud.google.com/load-balancer-type: Internal
-
-    aws:
-      region: null
-
-    podDisruptionBudget:
-      enabled: false
-      maxUnavailable: 1
-      minAvailable: null
-
-    # Google Cloud Certificates
-    gcloud:
-      managedCertificates:
-        enabled: false
-        domains:
-          - ""
-
-    ingress:
-      enabled: false
-      labels: {}
-      annotations: {}
-    #    kubernetes.io/ingress.class: nginx
-    #    kubernetes.io/tls-acme: "true"
-      hosts: []
-    #    - host: chart-example.local
-    #      paths:
-    #        - /
-      tls: []
-    #    - secretName: chart-example-tls
-    #      hosts:
-    #        - chart-example.local
-
-    dockerRegistry:
-      enabled: false
-      name: ""
-      key: ""
-
-    persistence:
-      enabled: false
-      storageClass: "-"
-      size: 1Gi

internal/resources/templates/helm-apps/releases/observability/fluent-operator.yml.tmpl

@@ -1,66 +0,0 @@
-- name: fluent-operator
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Logging.Operator.ChartRef }}
-  chart_version: {{ .Modules.Observability.Logging.Operator.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    # Set this to containerd or crio if you want to collect CRI format logs
-    containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-    Kubernetes: false
-
-    operator:
-      initcontainer:
-        repository: "{{ .Modules.Observability.Logging.Operator.InitContainer.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Operator.InitContainer.Tag }}"
-
-        resources:
-          limits:
-            cpu: 100m
-            memory: 100Mi
-
-          requests:
-            cpu: 50m
-            memory: 64Mi
-      container:
-        repository: "{{ .Modules.Observability.Logging.Operator.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Operator.Tag }}"
-      resources:
-        limits:
-          cpu: 100m
-          memory: 100Mi
-        requests:
-          cpu: 100m
-          memory: 60Mi
-      imagePullSecrets: []
-      labels: {}
-      logPath:
-        # The operator currently assumes a Docker container runtime path for the logs as the default, for other container runtimes you can set the location explicitly below.
-        # crio: /var/log
-        containerd: /var/log
-      disableComponentControllers: ""
-
-    fluentbit:
-      crdsEnable: true
-      enable: false
-
-    fluentd:
-      crdsEnable: true
-      enable: false
-      name: fluentd
-      # Valid modes include "collector" and "agent".
-      # The "collector" mode will deploy Fluentd as a StatefulSet as before.
-      # The new "agent" mode will deploy Fluentd as a DaemonSet.
-      mode: "agent"
-      port: 24224
-      image:
-        repository: "{{ .Modules.Observability.Logging.Fluentd.Image }}"
-        tag: "{{ .Modules.Observability.Logging.Fluentd.Tag }}"
-
-    nameOverride: ""
-    fullnameOverride: ""
-    namespaceOverride: ""

internal/resources/templates/helm-apps/releases/observability/loki.yml.tmpl

@@ -1,200 +0,0 @@
-- name: loki
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Logging.Loki.ChartRef }}
-  chart_version: {{ .Modules.Observability.Logging.Loki.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    loki:
-      image:
-        registry: {{ .Modules.Observability.Logging.Loki.Registry }}
-        repository: {{ .Modules.Observability.Logging.Loki.Image }}
-        tag: {{ .Modules.Observability.Logging.Loki.Tag }}
-      podAnnotations:
-        app.kubernetes.io/component: "loki"
-      auth_enabled: false
-      commonConfig:
-        replication_factor: 1
-      storage:
-        type: 'filesystem'
-
-      frontend:
-        max_outstanding_per_tenant: 10000
-
-      limits_config:
-        reject_old_samples: false
-        split_queries_by_interval: 15m
-        max_query_parallelism: 32
-        max_query_series: 10000
-        retention_period: {{ .Modules.Observability.Logging.Loki.Persistence.Retention }}
-
-      compactor:
-        compaction_interval: 10m
-        retention_enabled: true
-        retention_delete_delay: 2h
-
-      querier:
-        max_concurrent: 2048
-
-      query_scheduler:
-        max_outstanding_requests_per_tenant: 10000
-
-      rulerConfig:
-        storage:
-          type: local
-          local:
-            directory: /var/loki/rules
-        rule_path: /tmp/rules
-
-        alertmanager_url: {{ .Modules.Observability.Logging.Loki.AlertManagerUrl }}
-
-
-    singleBinary:
-      replicas: 1
-
-      extraVolumes:
-        - name: loki-default-rules
-          configMap:
-            name: loki-default-alerting-rules
-
-      extraVolumeMounts:
-        - name: loki-default-rules
-          mountPath: /var/loki/rules
-
-
-    write:
-      persistence:
-        volumeClaimsEnabled: true
-        storageClass: "{{ .Modules.Observability.Logging.Loki.Persistence.StorageClass }}"
-        size: {{ .Modules.Observability.Logging.Loki.Persistence.StorageSize }}
-
-    test:
-      enabled: false
-
-    gateway:
-      enabled: false
-
-    monitoring:
-      selfMonitoring:
-        enabled: false
-        grafanaAgent:
-          installOperator: false
-      lokiCanary:
-        enabled: false
-      rules:
-        enabled: true
-        alerting: true
-        additionalGroups: {}
-
-    extraObjects:
-      - apiVersion: v1
-        kind: ConfigMap
-        metadata:
-          name: loki-default-alerting-rules
-          labels:
-            loki_rule: ""
-
-        data:
-          loki-default-alerting-rules.yaml: |-
-            groups:
-              {{- .Modules.Observability.Logging.Loki.AdditionalRulesGroups | toString | nindent 14 -}}
-              - name: kube-events-alerts
-                rules:
-                  - alert: FailedEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Failed` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: FailedEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: Failed events occured in cluster
-                      addDefaultUrl: "true"
-
-                  - alert: OOMKilledEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `OOMKilled` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: OOMKilledEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: OOMKilled events occured in cluster
-                      addDefaultUrl: "true"
-
-                  - alert: EvictedEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `Evicted` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: EvictedEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: Evicted events occured in cluster
-                      addDefaultUrl: "true"
-
-                  - alert: ImagePullBackOffEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `ImagePullBackOff` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: ImagePullBackOffEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: ImagePullBackOff events occured in cluster
-                      addDefaultUrl: "true"
-
-                  - alert: BackOffEventsOccured
-                    expr: |
-                      count(rate({logs_type="kube-events"} | json reason="reason", event_type="event_type" | event_type = `Warning` | reason = `BackOff` [1h])) > 0
-                    for: 1m
-                    labels:
-                      severity: critical
-                    annotations:
-                      alertname: BackOffEventsOccured
-                      instance: kube-cluster
-                      jobName: kube_events
-                      summary: BackOff events occured in cluster
-                      addDefaultUrl: "true"
-    sidecar:
-      rules:
-        enabled: true
-        # -- Label that the configmaps/secrets with rules will be marked with.
-        label: loki_rule
-        # -- Label value that the configmaps/secrets with rules will be set to.
-        labelValue: ""
-        # -- Folder into which the rules will be placed.
-        folder: /var/loki/rules
-        # -- Comma separated list of namespaces. If specified, the sidecar will search for config-maps/secrets inside these namespaces.
-        # Otherwise the namespace in which the sidecar is running will be used.
-        # It's also possible to specify 'ALL' to search in all namespaces.
-        searchNamespace: 'ALL'
-        # -- Method to use to detect ConfigMap changes. With WATCH the sidecar will do a WATCH request, with SLEEP it will list all ConfigMaps, then sleep for 60 seconds.
-        watchMethod: WATCH
-        # -- Search in configmap, secret, or both.
-        resource: both
-        # -- Absolute path to the shell script to execute after a configmap or secret has been reloaded.
-        script: null
-        # -- WatchServerTimeout: request to the server, asking it to cleanly close the connection after that.
-        # defaults to 60sec; much higher values like 3600 seconds (1h) are feasible for non-Azure K8S.
-        watchServerTimeout: 60
-        #
-        # -- WatchClientTimeout: is a client-side timeout, configuring your local socket.
-        # If you have a network outage dropping all packets with no RST/FIN,
-        # this is how long your client waits before realizing & dropping the connection.
-        # Defaults to 66sec.
-        watchClientTimeout: 60
-        # -- Log level of the sidecar container.
-        logLevel: INFO

internal/resources/templates/helm-apps/releases/observability/metrics-server.yml.tmpl

@@ -1,203 +0,0 @@
-- name: metrics-server
-  namespace: kube-system
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Monitoring.MetricsServer.ChartRef }}
-  chart_version: {{ .Modules.Observability.Monitoring.MetricsServer.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    image:
-      repository: {{.Modules.Observability.Monitoring.MetricsServer.Image }}
-      tag: "{{ .Modules.Observability.Monitoring.MetricsServer.Tag }}"
-      pullPolicy: IfNotPresent
-
-    imagePullSecrets: []
-    # - name: registrySecretName
-
-    nameOverride: ""
-    fullnameOverride: ""
-
-    serviceAccount:
-      # Specifies whether a service account should be created
-      create: true
-      # Annotations to add to the service account
-      annotations: {}
-      # The name of the service account to use.
-      # If not set and create is true, a name is generated using the fullname template
-      name: ""
-      # The list of secrets mountable by this service account.
-      # See https://kubernetes.io/docs/reference/labels-annotations-taints/#enforce-mountable-secrets
-      secrets: []
-
-    rbac:
-      # Specifies whether RBAC resources should be created
-      create: true
-      pspEnabled: false
-
-    apiService:
-      create: true
-      # Annotations to add to the API service
-      annotations: {}
-      # Specifies whether to skip TLS verification
-      insecureSkipTLSVerify: true
-      # The PEM encoded CA bundle for TLS verification
-      caBundle: ""
-
-    commonLabels: {}
-    podLabels:
-      "app.kubernetes.io/component": "metrics-server"
-    podAnnotations: {}
-
-    podSecurityContext: {}
-
-    securityContext:
-      allowPrivilegeEscalation: false
-      readOnlyRootFilesystem: true
-      runAsNonRoot: true
-      runAsUser: 1000
-      seccompProfile:
-        type: RuntimeDefault
-      capabilities:
-        drop:
-          - ALL
-
-    priorityClassName: system-cluster-critical
-
-    containerPort: 10250
-
-    hostNetwork:
-      # Specifies if metrics-server should be started in hostNetwork mode.
-      #
-      # You would require this enabled if you use alternate overlay networking for pods and
-      # API server unable to communicate with metrics-server. As an example, this is required
-      # if you use Weave network on EKS
-      enabled: false
-
-    replicas: 1
-
-    revisionHistoryLimit:
-
-    updateStrategy: {}
-    #   type: RollingUpdate
-    #   rollingUpdate:
-    #     maxSurge: 0
-    #     maxUnavailable: 1
-
-    podDisruptionBudget:
-      # https://kubernetes.io/docs/tasks/run-application/configure-pdb/
-      enabled: false
-      minAvailable:
-      maxUnavailable:
-
-    defaultArgs:
-      - --cert-dir=/tmp
-      - --kubelet-preferred-address-types=InternalIP,ExternalIP,Hostname
-      - --kubelet-use-node-status-port
-      - --metric-resolution=15s
-      - --kubelet-insecure-tls
-
-    args: []
-
-    livenessProbe:
-      httpGet:
-        path: /livez
-        port: https
-        scheme: HTTPS
-      initialDelaySeconds: 0
-      periodSeconds: 10
-      failureThreshold: 3
-
-    readinessProbe:
-      httpGet:
-        path: /readyz
-        port: https
-        scheme: HTTPS
-      initialDelaySeconds: 20
-      periodSeconds: 10
-      failureThreshold: 3
-
-    service:
-      type: ClusterIP
-      port: 443
-      annotations: {}
-      labels: {}
-      #  Add these labels to have metrics-server show up in `kubectl cluster-info`
-      #  kubernetes.io/cluster-service: "true"
-      #  kubernetes.io/name: "Metrics-server"
-
-    addonResizer:
-      enabled: false
-      image:
-        repository: registry.k8s.io/autoscaling/addon-resizer
-        tag: 1.8.20
-      securityContext:
-        allowPrivilegeEscalation: false
-        readOnlyRootFilesystem: true
-        runAsNonRoot: true
-        runAsUser: 1000
-        seccompProfile:
-          type: RuntimeDefault
-        capabilities:
-          drop:
-            - ALL
-      resources:
-        requests:
-          cpu: 40m
-          memory: 25Mi
-        limits:
-          cpu: 40m
-          memory: 25Mi
-      nanny:
-        cpu: 0m
-        extraCpu: 1m
-        memory: 0Mi
-        extraMemory: 2Mi
-        minClusterSize: 100
-        pollPeriod: 300000
-        threshold: 5
-
-    metrics:
-      enabled: true
-
-    serviceMonitor:
-      enabled: true
-      additionalLabels: {}
-      interval: 1m
-      scrapeTimeout: 10s
-      metricRelabelings: []
-      relabelings: []
-
-    # See https://github.com/kubernetes-sigs/metrics-server#scaling
-    resources:
-      requests:
-        cpu: 100m
-        memory: 200Mi
-      # limits:
-      #   cpu:
-      #   memory:
-
-    extraVolumeMounts: []
-
-    extraVolumes: []
-
-    nodeSelector: {}
-
-    tolerations: []
-
-    affinity: {}
-
-    topologySpreadConstraints: []
-
-    dnsConfig: {}
-
-    # Annotations to add to the deployment
-    deploymentAnnotations: {}
-
-    schedulerName: ""
-
-    tmpVolume:
-      emptyDir: {}
-

internal/resources/templates/helm-apps/releases/observability/observability.yml.tmpl

@@ -1,395 +0,0 @@
-- name: observability
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.ChartRef }}
-  chart_version: {{ .Modules.Observability.ChartVersion }}
-  {{- if .Modules.Observability.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    prometheus:
-      enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-      serviceMonitor: true
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Prometheus.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Prometheus.Tag }}
-        pullPolicy: IfNotPresent
-
-      clustering:
-        enabled: false
-        replicas: 3
-        shards: 1
-
-      persistence:
-        enabled: true
-
-        storageClassName: "{{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageClass }}"
-        storageResources:
-          requests:
-            storage: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.StorageSize }}
-
-      scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }}
-      retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }}
-      # serviceNodePort: 30008
-
-      additionalConfigs: |
-        - job_name: "kubelet"
-          scheme: https
-          metrics_path: /metrics/cadvisor
-          tls_config:
-            insecure_skip_verify: true
-          authorization:
-            credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-          kubernetes_sd_configs:
-            - role: node
-          relabel_configs:
-            - action: labelmap
-              regex: __meta_kubernetes_node_label_(.+)
-
-        - job_name: "kubernetes-apiservers"
-          kubernetes_sd_configs:
-            - role: endpoints
-          scheme: https
-          tls_config:
-            ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          authorization:
-            credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token
-          relabel_configs:
-            - source_labels:
-                [
-                  __meta_kubernetes_namespace,
-                  __meta_kubernetes_service_name,
-                  __meta_kubernetes_endpoint_port_name,
-                ]
-              action: keep
-              regex: default;kubernetes;https
-
-        - job_name: "coredns"
-          kubernetes_sd_configs:
-            - role: endpoints
-          scheme: http
-          relabel_configs:
-            - source_labels:
-                [
-                  __meta_kubernetes_namespace,
-                  __meta_kubernetes_service_name,
-                  __meta_kubernetes_endpoint_port_name,
-                ]
-              action: keep
-              regex: kube-system;.*dns.*;metrics
-
-        - job_name: 'ingress-endpoints'
-          metrics_path: /probe
-          params:
-            module: [https_ok]
-          kubernetes_sd_configs:
-            - role: ingress
-          relabel_configs:
-            - source_labels: [__address__]
-              target_label: __param_target
-            - source_labels: [__param_target]
-              target_label: instance
-            - source_labels:
-                [
-                  __meta_kubernetes_ingress_scheme,
-                  __address__,
-                  __meta_kubernetes_ingress_path,
-                ]
-              regex: (.+);(.+);(.+)
-              replacement: https://${2}${3}
-              target_label: __param_target
-            - target_label: __address__
-              replacement: observability-blackbox-exporter:9115
-
-    alertManager:
-      enabled: {{ .Modules.Observability.Monitoring.AlertManager.Enabled }}
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-      enableDefaultRules: true
-      image:
-        repository: {{ .Modules.Observability.Monitoring.AlertManager.Image }}
-        tag: "{{ .Modules.Observability.Monitoring.AlertManager.Tag }}"
-        pullPolicy: IfNotPresent
-
-      # serviceNodePort: 30009
-
-      configPath: /etc/alertmanager
-      {{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }}
-      additionalMessageTemplates:
-        {{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }}
-      {{- end }}
-      {{- if .Modules.Observability.Monitoring.AlertManager.Route }}
-      route:
-        {{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }}
-      {{- end }}
-      {{- if .Modules.Observability.Monitoring.AlertManager.Receivers }}
-      receivers:
-        {{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }}
-      {{- end }}
-
-    blackboxExporter:
-      enabled: {{ .Modules.Observability.Monitoring.Blackbox.Enabled }}
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Blackbox.Image }}
-        tag: "{{ .Modules.Observability.Monitoring.Blackbox.Tag }}"
-        pullPolicy: IfNotPresent
-
-      # serviceNodePort: 30012
-
-      configPath: /etc/blackbox_exporter
-      additionalModules:
-
-
-    kubeStateMetrics:
-      enabled: {{ .Modules.Observability.Monitoring.KubeState.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.KubeState.Image }}
-        tag: "{{ .Modules.Observability.Monitoring.KubeState.Tag }}"
-        pullPolicy: IfNotPresent
-      resources:
-        requests:
-          cpu: 30m
-          memory: 120Mi
-        limits:
-          memory: 240Mi
-          cpu: 60m
-
-    prometheusOperator:
-      enabled: {{ .Modules.Observability.Monitoring.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.Tag }}
-        pullPolicy: IfNotPresent
-
-      prometheusConfigReloader:
-        image:
-          repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Image }}
-          tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.ConfigReloader.Tag }}
-          pullPolicy: IfNotPresent
-
-      kubeRbacProxy:
-        image:
-          repository: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Image }}
-          tag: {{ .Modules.Observability.Monitoring.Prometheus.Operator.KubeRbacProxy.Tag }}
-          pullPolicy: IfNotPresent
-
-    nodeExporter:
-      enabled: {{ .Modules.Observability.Monitoring.Node.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Monitoring.Node.Image }}
-        tag: {{ .Modules.Observability.Monitoring.Node.Tag }}
-        pullPolicy: IfNotPresent
-
-    kubeEventsExporter:
-      enabled: {{ and .Modules.Observability.Logging.Enabled .Modules.Observability.Logging.Events.Enabled }}
-      image:
-        repository: {{ .Modules.Observability.Logging.Events.Exporter.Image }}
-        tag: {{ .Modules.Observability.Logging.Events.Exporter.Tag }}
-        pullPolicy: IfNotPresent
-      lokiAddress: http://loki.observability.svc.cluster.local:3100
-      logLevel: warn
-      logFormat: json
-      kubeQPS: 100
-      kubeBurst: 500
-      maxEventAgeSeconds: 120
-      metricsNamePrefix: event_exporter_
-
-      cron:
-        restartSchedule: "{{ .Modules.Observability.Logging.Events.Cron.Schedule }}"
-        image:
-          repository: {{ .Modules.Observability.Logging.Events.Cron.Image }}
-          tag: {{ .Modules.Observability.Logging.Events.Cron.Tag }}
-          pullPolicy: IfNotPresent
-      additionalRoutes:
-      additionalReceivers:
-
-    grafana:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Visualization.Grafana.Enabled }}
-      serviceMonitor: {{ .Modules.Observability.Monitoring.Enabled }}
-      domain: &grafanaDomain {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-      {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "NodePort" }}
-      serviceNodePort: {{ .Modules.Observability.Visualization.Grafana.Expose.NodePortHttp }}
-      {{- end }}
-      image:
-        repository: {{ .Modules.Observability.Visualization.Grafana.Image }}
-        tag: {{ .Modules.Observability.Visualization.Grafana.Tag }}
-        pullPolicy: IfNotPresent
-
-      storageClassName: "{{ .Modules.Observability.Visualization.Grafana.Persistence.StorageClass }}"
-      storageResources:
-        requests:
-          storage: {{ .Modules.Observability.Visualization.Grafana.Persistence.StorageSize }}
-
-      config:
-        server: |
-          enable_gzip = true
-          root_url = {{ if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-
-        security: |
-          admin_user = admin
-          admin_password = {{ .Modules.AdminPassword }}
-
-        auth: |
-          {{- .Modules.Observability.Visualization.Grafana.Config.Auth | toString | nindent 10 }}
-
-        authGenericAuth: |
-          {{- .Modules.Observability.Visualization.Grafana.Config.AuthGenericAuth | toString | nindent 10 }}
-
-        additionalDatasources:
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-          - name: Kube-loki
-            type: loki
-            access: proxy
-            url: http://loki:3100
-            editable: false
-            basicAuth: false
-            isDefault: false
-            jsonData:
-              maxLines: 1000
-          {{- end }}
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-          - name: Kube-jaeger-query
-            type: jaeger
-            access: proxy
-            url: http://tempo:16686
-            editable: false
-            basicAuth: false
-            isDefault: false
-          {{- end }}
-          {{- if .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources }}
-          {{- .Modules.Observability.Visualization.Grafana.Config.AdditionalDatasources | toYaml | nindent 10 }}
-          {{- end }}
-
-    opentelemetryCollector:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-      serviceMonitor: true
-      config: |
-        receivers:
-          otlp:
-            protocols:
-              grpc:
-              http:
-        exporters:
-          otlphttp:
-            endpoint: http://tempo:4318
-        service:
-          telemetry:
-            logs:
-              level: "debug"
-          pipelines:
-            traces:
-              receivers: [otlp]
-              exporters: [otlphttp]
-
-    ingress:
-      {{- if eq .Modules.Observability.Visualization.Grafana.Expose.Type "ingress" }}
-      enabled: true
-      {{- else }}
-      enabled: false
-      {{- end }}
-      accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-      class: {{ .Modules.Additional.Ingress.Type }}
-      annotations:
-        {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-        nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-        {{- end }}
-      tls:
-        {{- if .Modules.Observability.Visualization.Grafana.Expose.Tls.Enabled }}
-        enabled: true
-        {{- end }}
-        hosts:
-          - host: {{ .Modules.Observability.Visualization.Grafana.Expose.Domain }}
-            secretName: grafana-tls
-
-    containerRuntime: {{ .Orchestrator.ContainerEngine.Type }}
-
-    fluentbit:
-      enable: {{ and .Modules.Observability.Enabled .Modules.Observability.Logging.Enabled }}
-      serviceMonitor: true
-      image:
-        repository: "{{ .Modules.Observability.Logging.FluentBit.Image }}"
-        tag: "{{ .Modules.Observability.Logging.FluentBit.Tag }}"
-
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: node-role.kubernetes.io/edge
-                    operator: DoesNotExist
-      tolerations:
-        - operator: Exists
-
-      input:
-        tail:
-          enable: true
-          refreshIntervalSeconds: 10
-          memBufLimit: 100MB
-          bufferMaxSize: ""
-          path: "/var/log/containers/*.log"
-          skipLongLines: true
-          readFromHead: false
-          storageType: memory
-          pauseOnChunksOverlimit: "off"
-        systemd:
-          enable: true
-          systemdFilter:
-            enable: true
-            filters: []
-          path: "/var/log/journal"
-          includeKubelet: true
-          stripUnderscores: "off"
-          storageType: memory
-          pauseOnChunksOverlimit: "off"
-
-        nodeExporterMetrics: {}
-        fluentBitMetrics: {}
-
-      output:
-        es:
-          enable: false
-          host: "<Elasticsearch url like elasticsearch-logging-data.kubesphere-logging-system.svc>"
-          port: 9200
-          logstashPrefix: ks-logstash-log
-          bufferSize: 20MB
-          traceError: true
-        kafka:
-          enable: false
-          brokers: "<kafka broker list like xxx.xxx.xxx.xxx:9092,yyy.yyy.yyy.yyy:9092>"
-          topics: ks-log
-        opentelemetry: {}
-        opensearch:
-          enable: false
-        stdout:
-          enable: false
-        loki:
-          enable: true
-          host: loki
-          port: 3100
-
-        stackdriver: {}
-
-      service:
-        storage: {}
-
-      filter:
-        kubernetes:
-          enable: true
-          labels: true
-          annotations: true
-        containerd:
-          enable: true
-        systemd:
-          enable: true
-
-      kubeedge:
-        enable: false
-        prometheusRemoteWrite:
-          # Change the host to the address of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
-          host: "<cloud-prometheus-service-host>"
-          # Change the port to the port of a cloud-side Prometheus-compatible server that can receive Prometheus remote write data
-          port: "<cloud-prometheus-service-port>"

internal/resources/templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl

@@ -1,145 +0,0 @@
-- name: opentelemetry-operator
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Tracing.Operator.ChartRef }}
-  chart_version: {{ .Modules.Observability.Tracing.Operator.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    replicaCount: 1
-    nameOverride: ""
-    imagePullSecrets: []
-    pdb:
-      create: false
-      minAvailable: 1
-      maxUnavailable: ""
-
-    manager:
-      image:
-        repository: {{ .Modules.Observability.Tracing.Operator.Image }}
-        tag: "{{ .Modules.Observability.Tracing.Operator.Tag }}"
-      collectorImage:
-        repository: {{ .Modules.Observability.Tracing.Collector.Image }}
-        tag: {{ .Modules.Observability.Tracing.Collector.Tag }}
-
-      featureGates: ""
-      ports:
-        metricsPort: 8080
-        webhookPort: 9443
-        healthzPort: 8081
-      resources:
-        limits:
-          cpu: 100m
-          memory: 128Mi
-        requests:
-          cpu: 100m
-          memory: 64Mi
-      env:
-        ENABLE_WEBHOOKS: "true"
-
-      serviceAccount:
-        create: true
-        annotations: {}
-
-      serviceMonitor:
-        enabled: true
-        metricsEndpoints:
-          - port: metrics
-
-      prometheusRule:
-        enabled: true
-        groups: []
-        defaultRules:
-          enabled: true
-
-      extraArgs: []
-
-      leaderElection:
-        enabled: true
-
-      verticalPodAutoscaler:
-        enabled: false
-        controlledResources: []
-        maxAllowed: {}
-        minAllowed: {}
-
-        updatePolicy:
-          updateMode: Auto
-          minReplicas: 2
-      rolling: false
-
-      securityContext: {}
-
-    kubeRBACProxy:
-      enabled: true
-      image:
-        repository: quay.io/brancz/kube-rbac-proxy
-        tag: v0.15.0
-      ports:
-        proxyPort: 8443
-      resources:
-        limits:
-          cpu: 500m
-          memory: 128Mi
-        requests:
-          cpu: 5m
-          memory: 64Mi
-
-      extraArgs: []
-
-      securityContext: {}
-
-    admissionWebhooks:
-      create: true
-      servicePort: 443
-      failurePolicy: Fail
-      secretName: ""
-      pods:
-        failurePolicy: Ignore
-
-      namePrefix: ""
-
-      timeoutSeconds: 10
-
-      namespaceSelector: {}
-      objectSelector: {}
-      certManager:
-        enabled: true
-        issuerRef: {}
-        certificateAnnotations: {}
-        issuerAnnotations: {}
-
-      autoGenerateCert:
-        enabled: true
-        recreate: true
-
-      secretAnnotations: {}
-      secretLabels: {}
-
-    role:
-      create: true
-
-    clusterRole:
-      create: true
-
-    affinity: {}
-    tolerations: []
-    nodeSelector: {}
-    topologySpreadConstraints: []
-    hostNetwork: false
-
-    priorityClassName: ""
-
-    securityContext:
-      runAsGroup: 65532
-      runAsNonRoot: true
-      runAsUser: 65532
-      fsGroup: 65532
-
-    testFramework:
-      image:
-        repository: busybox
-        tag: latest

internal/resources/templates/helm-apps/releases/observability/tempo.yml.tmpl

@@ -1,79 +0,0 @@
-- name: tempo
-  namespace: observability
-  create_namespace: true
-  chart_ref: {{ .Modules.Observability.Tracing.Tempo.ChartRef }}
-  chart_version: {{ .Modules.Observability.Tracing.Tempo.ChartVersion }}
-  {{- if and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    replicas: 1
-
-    tempo:
-      repository: {{ .Modules.Observability.Tracing.Tempo.Image }}
-      tag: "{{ .Modules.Observability.Tracing.Tempo.Tag }}"
-      pullPolicy: IfNotPresent
-
-      updateStrategy: RollingUpdate
-
-      memBallastSizeMbs: 1024
-      multitenancyEnabled: false
-      reportingEnabled: false
-
-      metricsGenerator:
-        enabled: false
-        remoteWriteUrl: "http://prometheus.monitoring:9090/api/v1/write"
-      retention: {{ .Modules.Observability.Tracing.Tempo.Retention }}
-      global_overrides:
-        per_tenant_override_config: /conf/overrides.yaml
-
-      server:
-        http_listen_port: {{ .Modules.Observability.Tracing.Tempo.ListenPort }}
-      storage:
-        trace:
-          backend: local
-          local:
-            path: /var/tempo/traces
-          wal:
-            path: /var/tempo/wal
-      receivers:
-        otlp:
-          protocols:
-            grpc:
-              endpoint: "0.0.0.0:4317"
-            http:
-              endpoint: "0.0.0.0:4318"
-
-    tempoQuery:
-      repository: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Image }}
-      tag: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.Tag }}
-      pullPolicy: IfNotPresent
-
-      enabled: true
-
-      service:
-        port: {{ .Modules.Observability.Tracing.Tempo.TempoQuery.ListenPort }}
-
-      ingress:
-        enabled: false
-
-    serviceAccount:
-      create: true
-      automountServiceAccountToken: true
-
-    service:
-      type: ClusterIP
-
-    serviceMonitor:
-      enabled: true
-
-    persistence:
-      enabled: true
-      storageClassName: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageClass }}
-      accessModes:
-        - ReadWriteOnce
-      size: {{ .Modules.Observability.Tracing.Tempo.Persistence.StorageSize }}
-
-    priorityClassName: null

internal/resources/templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl

@@ -1,17 +0,0 @@
-- name: harbor-certificate-generator
-  namespace: {{ .Modules.Registry.Namespace }}
-  create_namespace: true
-  chart_ref: {{ .Modules.Registry.Tls.CertificateGenerator.ChartRef }}
-  chart_version: {{ .Modules.Registry.Tls.CertificateGenerator.ChartVersion }}
-  {{- if and .Modules.Registry.Enabled (eq .Modules.Registry.Expose.Type "ingress") }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    issuer_email: {{ .Modules.Additional.CertManager.AccountEmail }}
-    solver_ingress_class: {{ .Modules.Additional.Ingress.Type }}
-
-    certificates:
-      - name: harbor-tls
-        domain: {{ .Modules.Registry.Expose.Domain }}

internal/resources/templates/helm-apps/releases/registry/harbor.yml.tmpl

@@ -1,382 +0,0 @@
-- name: harbor
-  namespace: {{ .Modules.Registry.Namespace }}
-  create_namespace: true
-  chart_ref: {{ .Modules.Registry.ChartRef }}
-  chart_version: {{ .Modules.Registry.ChartVersion }}
-  {{- if .Modules.Registry.Enabled  }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    expose:
-      type: {{ .Modules.Registry.Expose.Type }}
-      tls:
-        enabled: {{ .Modules.Registry.Tls.Enabled }}
-        certSource: secret
-        secret:
-          secretName: harbor-tls
-      ingress:
-        hosts:
-          core: {{ .Modules.Registry.Expose.Domain }}
-        controller: default
-        kubeVersionOverride: ""
-        className: "{{ .Modules.Additional.Ingress.Type }}"
-        annotations:
-          ingress.kubernetes.io/ssl-redirect: "true"
-          ingress.kubernetes.io/proxy-body-size: "0"
-          {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-          nginx.ingress.kubernetes.io/ssl-redirect: "true"
-          nginx.ingress.kubernetes.io/proxy-body-size: "0"
-          {{- end }}
-        labels: {}
-
-      nodePort:
-        name: harbor
-        ports:
-          http:
-            port: 80
-            nodePort: {{ .Modules.Registry.Expose.NodePortHttp }}
-          https:
-            port: 443
-            nodePort: {{ .Modules.Registry.Expose.NodePortHttps }}
-
-    externalURL: {{ if .Modules.Registry.Tls.Enabled }}https{{ else }}http{{ end }}://{{ .Modules.Registry.Expose.Domain  }}
-    persistence:
-      resourcePolicy: "keep"
-      persistentVolumeClaim:
-        registry:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.RegistrySize  }}
-          annotations: {}
-        jobservice:
-          jobLog:
-            existingClaim: ""
-            storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-            subPath: ""
-            accessMode: ReadWriteOnce
-            size: {{ .Modules.Registry.Persistence.JobserviceSize  }}
-            annotations: {}
-        database:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.DatabaseSize  }}
-          annotations: {}
-        redis:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.RedisSize }}
-          annotations: {}
-        trivy:
-          existingClaim: ""
-          storageClass: "{{ .Modules.Registry.Persistence.StorageClass }}"
-          subPath: ""
-          accessMode: ReadWriteOnce
-          size: {{ .Modules.Registry.Persistence.TrivySize }}
-          annotations: {}
-
-      imageChartStorage:
-        disableredirect: false
-
-        type: filesystem
-        filesystem:
-          rootdirectory: /storage
-          #maxthreads: 100
-
-    imagePullPolicy: IfNotPresent
-
-    updateStrategy:
-      type: RollingUpdate
-
-    harborAdminPassword: "{{ .Modules.Registry.AdminPassword }}"
-
-    logLevel: info
-
-    metrics:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-      core:
-        path: /metrics
-        port: 8001
-      registry:
-        path: /metrics
-        port: 8001
-      jobservice:
-        path: /metrics
-        port: 8001
-      exporter:
-        path: /metrics
-        port: 8001
-
-      serviceMonitor:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-
-    trace:
-      enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Tracing.Enabled }}
-      provider: otel
-      sample_rate: 1
-      attributes:
-        application: harbor
-      jaeger:
-        endpoint: http://hostname:14268/api/traces
-      otel:
-        endpoint: observability-opentelemetry-collector-collector.observability.svc.{{ .Orchestrator.ClusterName }}:4318
-        url_path: /v1/traces
-        compression: false
-        insecure: true
-        timeout: 10
-
-    portal:
-      image:
-        repository: harbor.kvazaric.ru/kube-forge/harbor-portal
-        tag: {{ .Modules.Registry.Version }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-
-      topologySpreadConstraints: []
-
-      podLabels:
-        "app.kubernetes.io/component": "harbor-portal"
-      priorityClassName:
-
-    core:
-      image:
-        repository: goharbor/harbor-core
-        tag: {{ .Modules.Registry.Version }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-      startupProbe:
-        enabled: true
-        initialDelaySeconds: 10
-      extraEnvVars: []
-      nodeSelector: {}
-      tolerations: []
-      affinity: {}
-      topologySpreadConstraints: []
-      podLabels:
-        "app.kubernetes.io/component": "harbor-core"
-      serviceAnnotations: {}
-      priorityClassName:
-      configureUserSettings:
-      quotaUpdateProvider: db # Or redis
-      secret: ""
-      existingSecret: ""
-      secretName: ""
-      tokenKey: ""
-
-      tokenCert: ""
-
-      xsrfKey: ""
-      existingXsrfSecret: ""
-      existingXsrfSecretKey: CSRF_KEY
-      artifactPullAsyncFlushDuration:
-      gdpr:
-        deleteUser: false
-        auditLogsCompliant: false
-
-
-    jobservice:
-      image:
-        repository: goharbor/harbor-jobservice
-        tag: {{ .Modules.Registry.Version }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-      topologySpreadConstraints:
-      podLabels:
-        "app.kubernetes.io/component": "harbor-jobservice"
-      priorityClassName:
-      maxJobWorkers: 10
-      jobLoggers:
-        - file
-        # - database
-        # - stdout
-      loggerSweeperDuration: 14 #days
-      notification:
-        webhook_job_max_retry: 3
-        webhook_job_http_client_timeout: 3 # in seconds
-      reaper:
-        max_update_hours: 24
-        max_dangling_hours: 168
-      secret: ""
-      existingSecret: ""
-      existingSecretKey: JOBSERVICE_SECRET
-
-    registry:
-      registry:
-        image:
-          repository: goharbor/registry-photon
-          tag: {{ .Modules.Registry.Version }}
-        extraEnvVars: []
-      controller:
-        image:
-          repository: goharbor/harbor-registryctl
-          tag: {{ .Modules.Registry.Version }}
-        extraEnvVars: []
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      replicas: 1
-      revisionHistoryLimit: 10
-      topologySpreadConstraints: []
-      podLabels:
-        "app.kubernetes.io/component": "harbor-registry"
-      priorityClassName:
-      secret: ""
-      existingSecret: ""
-      existingSecretKey: REGISTRY_HTTP_SECRET
-      relativeurls: false
-      credentials:
-        # If using existingSecret, the key must be REGISTRY_PASSWD and REGISTRY_HTPASSWD
-        existingSecret: ""
-        # Login and password in htpasswd string format. Excludes `registry.credentials.username`  and `registry.credentials.password`. May come in handy when integrating with tools like argocd or flux. This allows the same line to be generated each time the template is rendered, instead of the `htpasswd` function from helm, which generates different lines each time because of the salt.
-        # htpasswdString: $apr1$XLefHzeG$Xl4.s00sMSCCcMyJljSZb0 # example string
-        # htpasswdString: ""
-      middleware:
-        enabled: false
-        type: cloudFront
-        cloudFront:
-          baseurl: example.cloudfront.net
-          keypairid: KEYPAIRID
-          duration: 3000s
-          ipfilteredby: none
-          # The secret key that should be present is CLOUDFRONT_KEY_DATA, which should be the encoded private key
-          # that allows access to CloudFront
-          privateKeySecret: "my-secret"
-      # enable purge _upload directories
-      upload_purging:
-        enabled: true
-        # remove files in _upload directories which exist for a period of time, default is one week.
-        age: 168h
-        # the interval of the purge operations
-        interval: 24h
-        dryrun: false
-
-    trivy:
-      enabled: {{ .Modules.Registry.EnabledScanner }}
-      image:
-        repository: goharbor/trivy-adapter-photon
-        tag: {{ .Modules.Registry.Version }}
-      serviceAccountName: ""
-      automountServiceAccountToken: false
-      resources:
-        requests:
-          cpu: 200m
-          memory: 512Mi
-        limits:
-          cpu: 1
-          memory: 1Gi
-
-
-    database:
-      # if external database is used, set "type" to "external"
-      # and fill the connection information in "external" section
-      type: internal
-      internal:
-        image:
-          repository: goharbor/harbor-db
-          tag: {{ .Modules.Registry.Version }}
-        serviceAccountName: ""
-        automountServiceAccountToken: false
-        livenessProbe:
-          timeoutSeconds: 1
-        readinessProbe:
-          timeoutSeconds: 1
-        priorityClassName:
-        # The initial superuser password for internal database
-        # password: "changeit"
-        # The size limit for Shared memory, pgSQL use it for shared_buffer
-        # More details see:
-        # https://github.com/goharbor/harbor/issues/15034
-        shmSizeLimit: 512Mi
-        initContainer:
-          migrator: {}
-          # resources:
-          #  requests:
-          #    memory: 128Mi
-          #    cpu: 100m
-          permissions: {}
-          # resources:
-          #  requests:
-          #    memory: 128Mi
-          #    cpu: 100m
-      external:
-        host: "192.168.0.1"
-        port: "5432"
-        username: "user"
-        password: "password"
-        coreDatabase: "registry"
-        # if using existing secret, the key must be "password"
-        existingSecret: ""
-        # "disable" - No SSL
-        # "require" - Always SSL (skip verification)
-        # "verify-ca" - Always SSL (verify that the certificate presented by the
-        # server was signed by a trusted CA)
-        # "verify-full" - Always SSL (verify that the certification presented by the
-        # server was signed by a trusted CA and the server host name matches the one
-        # in the certificate)
-        sslmode: "disable"
-      # The maximum number of connections in the idle connection pool per pod (core+exporter).
-      # If it <=0, no idle connections are retained.
-      maxIdleConns: 100
-      # The maximum number of open connections to the database per pod (core+exporter).
-      # If it <= 0, then there is no limit on the number of open connections.
-      # Note: the default number of connections is 1024 for postgre of harbor.
-      maxOpenConns: 900
-      ## Additional deployment annotations
-      podAnnotations: {}
-      ## Additional deployment labels
-      podLabels: {}
-
-
-    redis:
-      type: internal
-      internal:
-        image:
-          repository: goharbor/redis-photon
-          tag: {{ .Modules.Registry.Version }}
-        serviceAccountName: ""
-        automountServiceAccountToken: false
-        extraEnvVars: []
-        nodeSelector: {}
-        tolerations: []
-        affinity: {}
-        priorityClassName:
-        jobserviceDatabaseIndex: "1"
-        registryDatabaseIndex: "2"
-        trivyAdapterIndex: "5"
-        # harborDatabaseIndex: "6"
-        # cacheLayerDatabaseIndex: "7"
-      external:
-        # support redis, redis+sentinel
-        # addr for redis: <host_redis>:<port_redis>
-        # addr for redis+sentinel: <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
-        addr: "192.168.0.2:6379"
-        # The name of the set of Redis instances to monitor, it must be set to support redis+sentinel
-        sentinelMasterSet: ""
-        # The "coreDatabaseIndex" must be "0" as the library Harbor
-        # used doesn't support configuring it
-        # harborDatabaseIndex defaults to "0", but it can be configured to "6", this config is optional
-        # cacheLayerDatabaseIndex defaults to "0", but it can be configured to "7", this config is optional
-        coreDatabaseIndex: "0"
-        jobserviceDatabaseIndex: "1"
-        registryDatabaseIndex: "2"
-        trivyAdapterIndex: "5"
-        # harborDatabaseIndex: "6"
-        # cacheLayerDatabaseIndex: "7"
-        # username field can be an empty string, and it will be authenticated against the default user
-        username: ""
-        password: ""
-        existingSecret: ""
-      podAnnotations: {}
-      podLabels: {}

internal/resources/templates/helm-apps/releases/secrets-storage/vault.yml.tmpl

@@ -1,879 +0,0 @@
-- name: vault
-  namespace: secrets-storage
-  create_namespace: true
-  chart_ref: {{ .Modules.SecretsStorage.ChartRef }}
-  chart_version: {{ .Modules.SecretsStorage.ChartVersion }}
-  {{- if .Modules.SecretsStorage.Enabled }}
-  release_state: "present"
-  {{- else }}
-  release_state: "absent"
-  {{- end }}
-  values:
-    global:
-      enabled: true
-
-      imagePullSecrets: []
-      tlsDisable: true
-
-      externalVaultAddr: ""
-
-      openshift: false
-
-      # Create PodSecurityPolicy for pods
-      psp:
-        enable: false
-        # Annotation for PodSecurityPolicy.
-        # This is a multi-line templated string map, and can also be set as YAML.
-        annotations: |
-          seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
-          apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
-          seccomp.security.alpha.kubernetes.io/defaultProfileName:  runtime/default
-          apparmor.security.beta.kubernetes.io/defaultProfileName:  runtime/default
-
-      serverTelemetry:
-        # Enable integration with the Prometheus Operator
-        # See the top level serverTelemetry section below before enabling this feature.
-        prometheusOperator: false
-
-    injector:
-      enabled: true
-
-      replicas: 1
-
-      # Configures the port the injector should listen on
-      port: 8080
-
-      # If multiple replicas are specified, by default a leader will be determined
-      # so that only one injector attempts to create TLS certificates.
-      leaderElector:
-        enabled: true
-
-      # If true, will enable a node exporter metrics endpoint at /metrics.
-      metrics:
-        enabled: false
-
-      # Deprecated: Please use global.externalVaultAddr instead.
-      externalVaultAddr: ""
-
-      # image sets the repo and tag of the vault-k8s image to use for the injector.
-      image:
-        repository: "{{ .Modules.SecretsStorage.Injector.Image }}"
-        tag: "{{ .Modules.SecretsStorage.Injector.Tag }}"
-        pullPolicy: IfNotPresent
-
-      # agentImage sets the repo and tag of the Vault image to use for the Vault Agent
-      # containers.  This should be set to the official Vault image.  Vault 1.3.1+ is
-      # required.
-      agentImage:
-        repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
-        tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
-      agentDefaults:
-        cpuLimit: "500m"
-        cpuRequest: "250m"
-        memLimit: "128Mi"
-        memRequest: "64Mi"
-        # ephemeralLimit: "128Mi"
-        # ephemeralRequest: "64Mi"
-
-        # Default template type for secrets when no custom template is specified.
-        # Possible values include: "json" and "map".
-        template: "map"
-
-        # Default values within Agent's template_config stanza.
-        templateConfig:
-          exitOnRetryFailure: true
-          staticSecretRenderInterval: ""
-
-      # Used to define custom livenessProbe settings
-      livenessProbe:
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 2
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 5
-        # How often (in seconds) to perform the probe
-        periodSeconds: 2
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 5
-      # Used to define custom readinessProbe settings
-      readinessProbe:
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 2
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 5
-        # How often (in seconds) to perform the probe
-        periodSeconds: 2
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 5
-      # Used to define custom startupProbe settings
-      startupProbe:
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 12
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 5
-        # How often (in seconds) to perform the probe
-        periodSeconds: 5
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 5
-
-      # Mount Path of the Vault Kubernetes Auth Method.
-      authPath: "auth/kubernetes"
-
-      # Configures the log verbosity of the injector.
-      # Supported log levels include: trace, debug, info, warn, error
-      logLevel: "info"
-
-      # Configures the log format of the injector. Supported log formats: "standard", "json".
-      logFormat: "standard"
-
-      # Configures all Vault Agent sidecars to revoke their token when shutting down
-      revokeOnShutdown: false
-
-      webhook:
-        # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
-        # API Tag of the WebHook.
-        # To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
-        #
-        failurePolicy: Ignore
-
-        # matchPolicy specifies the approach to accepting changes based on the rules of
-        # the MutatingWebhookConfiguration.
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
-        # for more details.
-        #
-        matchPolicy: Exact
-
-        # timeoutSeconds is the amount of seconds before the webhook request will be ignored
-        # or fails.
-        # If it is ignored or fails depends on the failurePolicy
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
-        # for more details.
-        #
-        timeoutSeconds: 30
-
-        # namespaceSelector is the selector for restricting the webhook to only
-        # specific namespaces.
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
-        # for more details.
-        # Example:
-        # namespaceSelector:
-        #    matchLabels:
-        #      sidecar-injector: enabled
-        namespaceSelector: {}
-
-        # objectSelector is the selector for restricting the webhook to only
-        # specific labels.
-        # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
-        # for more details.
-        # Example:
-        # objectSelector:
-        #    matchLabels:
-        #      vault-sidecar-injector: enabled
-
-        # Extra annotations to attach to the webhook
-        annotations: {}
-
-      # Deprecated: please use 'webhook.failurePolicy' instead
-      # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
-      # API Tag of the WebHook.
-      # To block pod creation while webhook is unavailable, set the policy to `Fail` below.
-      # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
-      #
-      failurePolicy: Ignore
-
-      # Deprecated: please use 'webhook.namespaceSelector' instead
-      # namespaceSelector is the selector for restricting the webhook to only
-      # specific namespaces.
-      # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
-      # for more details.
-      # Example:
-      # namespaceSelector:
-      #    matchLabels:
-      #      sidecar-injector: enabled
-      namespaceSelector: {}
-
-      # Deprecated: please use 'webhook.objectSelector' instead
-      # objectSelector is the selector for restricting the webhook to only
-      # specific labels.
-      # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
-      # for more details.
-      # Example:
-      # objectSelector:
-      #    matchLabels:
-      #      vault-sidecar-injector: enabled
-      objectSelector: {}
-
-      # Deprecated: please use 'webhook.annotations' instead
-      # Extra annotations to attach to the webhook
-      webhookAnnotations: {}
-
-      certs:
-        # secretName is the name of the secret that has the TLS certificate and
-        # private key to serve the injector webhook. If this is null, then the
-        # injector will default to its automatic management mode that will assign
-        # a service account to the injector to generate its own certificates.
-        secretName: null
-
-        # caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
-        # that signed the TLS certificate that the webhook serves. This must be set
-        # if secretName is non-null unless an external service like cert-manager is
-        # keeping the caBundle updated.
-        caBundle: ""
-
-        # certName and keyName are the names of the files within the secret for
-        # the TLS cert and private key, respectively. These have reasonable
-        # defaults but can be customized if necessary.
-        certName: tls.crt
-        keyName: tls.key
-
-      securityContext:
-        pod: {}
-        container: {}
-
-      resources: {}
-
-      # extraEnvironmentVars is a list of extra environment variables to set in the
-      # injector deployment.
-      extraEnvironmentVars: {}
-        # KUBERNETES_SERVICE_HOST: kubernetes.default.svc
-
-      topologySpreadConstraints: []
-
-      tolerations: []
-
-      nodeSelector: {}
-
-      priorityClassName: ""
-
-      annotations: {}
-
-      extraLabels: {}
-
-      hostNetwork: false
-
-
-      service:
-        # Extra annotations to attach to the injector service
-        annotations: {}
-
-      # Injector serviceAccount specific config
-      serviceAccount:
-        # Extra annotations to attach to the injector serviceAccount
-        annotations: {}
-
-      # A disruption budget limits the number of pods of a replicated application
-      # that are down simultaneously from voluntary disruptions
-      podDisruptionBudget: {}
-      # podDisruptionBudget:
-      #   maxUnavailable: 1
-
-      # strategy for updating the deployment. This can be a multi-line string or a
-      # YAML map.
-      strategy: {}
-      # strategy: |
-      #   rollingUpdate:
-      #     maxSurge: 25%
-      #     maxUnavailable: 25%
-      #   type: RollingUpdate
-
-    server:
-      enabled: true
-      enterpriseLicense:
-        # The name of the Kubernetes secret that holds the enterprise license. The
-        # secret must be in the same namespace that Vault is installed into.
-        secretName: ""
-        # The key within the Kubernetes secret that holds the enterprise license.
-        secretKey: "license"
-
-      image:
-        repository: "{{ .Modules.SecretsStorage.Server.Image }}"
-        tag: "{{ .Modules.SecretsStorage.Server.Tag }}"
-        # Overrides the default Image Pull Policy
-        pullPolicy: IfNotPresent
-
-      updateStrategyType: "RollingUpdate"
-
-      # Supported log levels include: trace, debug, info, warn, error
-      logLevel: ""
-
-      # Supported log formats include: standard, json
-      logFormat: ""
-
-      resources: {}
-
-      hostAliases: []
-      # - ip: 127.0.0.1
-      #   hostnames:
-      #     - chart-example.local
-
-      route:
-        enabled: false
-
-        # When HA mode is enabled and K8s service registration is being used,
-        # configure the route to point to the Vault active service.
-        activeService: true
-
-        labels: {}
-        annotations: {}
-        host: chart-example.local
-        # tls will be passed directly to the route's TLS config, which
-        # can be used to configure other termination methods that terminate
-        # TLS at the router
-        tls:
-          termination: passthrough
-
-      # authDelegator enables a cluster role binding to be attached to the service
-      # account.  This cluster role binding can be used to setup Kubernetes auth
-      # method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
-      authDelegator:
-        enabled: true
-
-      extraInitContainers: null
-      extraContainers: null
-      shareProcessNamespace: false
-      extraArgs: ""
-
-      extraPorts: null
-        # - containerPort: 8300
-        #   name: http-monitoring
-
-      readinessProbe:
-        enabled: false
-        # If you need to use a http path instead of the default exec
-        # path: /v1/sys/health?standbyok=true
-
-        # Port number on which readinessProbe will be checked.
-        port: 8200
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 2
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 5
-        # How often (in seconds) to perform the probe
-        periodSeconds: 5
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 3
-      # Used to enable a livenessProbe for the pods
-      livenessProbe:
-        enabled: false
-        # Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
-        execCommand: []
-        # - /bin/sh
-        # - -c
-        # - /vault/userconfig/mylivenessscript/run.sh
-        # Path for the livenessProbe to use httpGet as the livenessProbe handler
-        path: "/v1/sys/health?standbyok=true"
-        # Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
-        port: 8200
-        # When a probe fails, Kubernetes will try failureThreshold times before giving up
-        failureThreshold: 2
-        # Number of seconds after the container has started before probe initiates
-        initialDelaySeconds: 60
-        # How often (in seconds) to perform the probe
-        periodSeconds: 5
-        # Minimum consecutive successes for the probe to be considered successful after having failed
-        successThreshold: 1
-        # Number of seconds after which the probe times out.
-        timeoutSeconds: 3
-
-      terminationGracePeriodSeconds: 10
-
-      # Used to set the sleep time during the preStop step
-      preStopSleepSeconds: 5
-
-      extraEnvironmentVars: {}
-
-      extraSecretEnvironmentVars: []
-
-      extraVolumes: []
-
-      volumes: null
-
-      volumeMounts: null
-
-      topologySpreadConstraints: []
-
-      tolerations: []
-      nodeSelector: {}
-
-      # Enables network policy for server pods
-      networkPolicy:
-        enabled: false
-        egress: []
-        # egress:
-        # - to:
-        #   - ipBlock:
-        #       cidr: 10.0.0.0/24
-        #   ports:
-        #   - protocol: TCP
-        #     port: 443
-        ingress:
-          - from:
-            - namespaceSelector: {}
-            ports:
-            - port: 8200
-              protocol: TCP
-            - port: 8201
-              protocol: TCP
-
-      priorityClassName: ""
-      extraLabels: {}
-
-      annotations: {}
-
-      service:
-        enabled: true
-        # Enable or disable the vault-active service, which selects Vault pods that
-        # have labeled themselves as the cluster leader with `vault-active: "true"`.
-        active:
-          enabled: true
-          # Extra annotations for the service definition. This can either be YAML or a
-          # YAML-formatted multi-line templated string map of the annotations to apply
-          # to the active service.
-          annotations: {}
-        # Enable or disable the vault-standby service, which selects Vault pods that
-        # have labeled themselves as a cluster follower with `vault-active: "false"`.
-        standby:
-          enabled: true
-          # Extra annotations for the service definition. This can either be YAML or a
-          # YAML-formatted multi-line templated string map of the annotations to apply
-          # to the standby service.
-          annotations: {}
-        # When disabled, services may select Vault pods not deployed from the chart.
-        # Does not affect the headless vault-internal service with `ClusterIP: None`
-        instanceSelector:
-          enabled: true
-        # clusterIP controls whether a Cluster IP address is attached to the
-        # Vault service within Kubernetes.  By default, the Vault service will
-        # be given a Cluster IP address, set to None to disable.  When disabled
-        # Kubernetes will create a "headless" service.  Headless services can be
-        # used to communicate with pods directly through DNS instead of a round-robin
-        # load balancer.
-        # clusterIP: None
-
-        # Configures the service type for the main Vault service.  Can be ClusterIP
-        # or NodePort.
-        #type: ClusterIP
-
-        # The IP family and IP families options are to set the behaviour in a dual-stack environment.
-        # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
-        # should be.
-        # These are only supported for kubernetes versions >=1.23.0
-        #
-        # Configures the service's supported IP family policy, can be either:
-        #     SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
-        #     PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
-        #     RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
-        ipFamilyPolicy: ""
-
-        # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
-        # Can be IPv4 and/or IPv6.
-        ipFamilies: []
-
-        # Do not wait for pods to be ready before including them in the services'
-        # targets. Does not apply to the headless service, which is used for
-        # cluster-internal communication.
-        publishNotReadyAddresses: true
-
-        # The externalTrafficPolicy can be set to either Cluster or Local
-        # and is only valid for LoadBalancer and NodePort service types.
-        # The default value is Cluster.
-        # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
-        externalTrafficPolicy: Cluster
-
-        # If type is set to "NodePort", a specific nodePort value can be configured,
-        # will be random if left blank.
-        #nodePort: 30000
-
-        # When HA mode is enabled
-        # If type is set to "NodePort", a specific nodePort value can be configured,
-        # will be random if left blank.
-        #activeNodePort: 30001
-
-        # When HA mode is enabled
-        # If type is set to "NodePort", a specific nodePort value can be configured,
-        # will be random if left blank.
-        #standbyNodePort: 30002
-
-        # Port on which Vault server is listening
-        port: 8200
-        # Target port to which the service should be mapped to
-        targetPort: 8200
-        # Extra annotations for the service definition. This can either be YAML or a
-        # YAML-formatted multi-line templated string map of the annotations to apply
-        # to the service.
-        annotations: {}
-
-      dataStorage:
-        enabled: true
-        size: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.Size }}
-        mountPath: "/vault/data"
-        storageClass: {{ .Modules.SecretsStorage.Server.Persistence.DataStorage.StorageClass }}
-        accessMode: ReadWriteOnce
-        annotations: {}
-        labels: {}
-
-      persistentVolumeClaimRetentionPolicy: {}
-
-      # required for ha installation
-      auditStorage:
-        enabled: false
-        # Size of the PVC created
-        size: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.Size }}
-        # Location where the PVC will be mounted.
-        mountPath: "/vault/audit"
-        # Name of the storage class to use.  If null it will use the
-        # configured default Storage Class.
-        storageClass: {{ .Modules.SecretsStorage.Server.Persistence.AuditStorage.StorageClass }}
-        # Access Mode of the storage device being used for the PVC
-        accessMode: ReadWriteOnce
-        # Annotations to apply to the PVC
-        annotations: {}
-        # Labels to apply to the PVC
-        labels: {}
-
-      dev:
-        enabled: false
-
-        # Set VAULT_DEV_ROOT_TOKEN_ID value
-        devRootToken: "root"
-
-      # Run Vault in "standalone" mode. This is the default mode that will deploy if
-      # no arguments are given to helm. This requires a PVC for data storage to use
-      # the "file" backend.  This mode is not highly available and should not be scaled
-      # past a single replica.
-      standalone:
-        enabled: "-"
-
-        # config is a raw string of default configuration when using a Stateful
-        # deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
-        # and store data there. This is only used when using a Replica count of 1, and
-        # using a stateful set. This should be HCL.
-
-        # Note: Configuration files are stored in ConfigMaps so sensitive data
-        # such as passwords should be either mounted through extraSecretEnvironmentVars
-        # or through a Kube secret.  For more information see:
-        # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
-        config: |
-          ui = true
-
-          listener "tcp" {
-            tls_disable = 1
-            address = "[::]:8200"
-            cluster_address = "[::]:8201"
-
-            {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-            telemetry {
-              unauthenticated_metrics_access = "true"
-            }
-            {{- end }}
-          }
-          storage "file" {
-            path = "/vault/data"
-          }
-
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-          telemetry {
-            prometheus_retention_time = "30s"
-            disable_hostname = true
-          }
-          {{- end }}
-
-      # Run Vault in "HA" mode. There are no storage requirements unless the audit log
-      # persistence is required.  In HA mode Vault will configure itself to use Consul
-      # for its storage backend.  The default configuration provided will work the Consul
-      # Helm project by default.  It is possible to manually configure Vault to use a
-      # different HA backend.
-      ha:
-        enabled: false
-        replicas: 3
-
-        # Set the api_addr configuration for Vault HA
-        # See https://developer.hashicorp.com/vault/docs/configuration#api_addr
-        # If set to null, this will be set to the Pod IP Address
-        apiAddr: null
-
-        # Set the cluster_addr confuguration for Vault HA
-        # See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
-        clusterAddr: null
-
-        # Enables Vault's integrated Raft storage.  Unlike the typical HA modes where
-        # Vault's persistence is external (such as Consul), enabling Raft mode will create
-        # persistent volumes for Vault to store data according to the configuration under server.dataStorage.
-        # The Vault cluster will coordinate leader elections and failovers internally.
-        raft:
-          # Enables Raft integrated storage
-          enabled: false
-          # Set the Node Raft ID to the name of the pod
-          setNodeId: false
-
-          config: |
-            ui = true
-
-            listener "tcp" {
-              tls_disable = 1
-              address = "[::]:8200"
-              cluster_address = "[::]:8201"
-
-              {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-              telemetry {
-                unauthenticated_metrics_access = "true"
-              }
-              {{- end }}
-            }
-
-            storage "raft" {
-              path = "/vault/data"
-            }
-
-            service_registration "kubernetes" {}
-
-        # config is a raw string of default configuration when using a Stateful
-        # deployment. Default is to use a Consul for its HA storage backend.
-        # This should be HCL.
-
-        # Note: Configuration files are stored in ConfigMaps so sensitive data
-        # such as passwords should be either mounted through extraSecretEnvironmentVars
-        # or through a Kube secret.  For more information see:
-        # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
-        config: |
-          ui = true
-
-          listener "tcp" {
-            tls_disable = 1
-            address = "[::]:8200"
-            cluster_address = "[::]:8201"
-            {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-            telemetry {
-              unauthenticated_metrics_access = "true"
-            }
-            {{- end }}
-          }
-          storage "consul" {
-            path = "vault"
-            address = "HOST_IP:8500"
-          }
-
-          service_registration "kubernetes" {}
-
-          # Example configuration for using auto-unseal, using Google Cloud KMS. The
-          # GKMS keys must already exist, and the cluster must have a service account
-          # that is authorized to access GCP KMS.
-          #seal "gcpckms" {
-          #   project     = "vault-helm-dev-246514"
-          #   region      = "global"
-          #   key_ring    = "vault-helm-unseal-kr"
-          #   crypto_key  = "vault-helm-unseal-key"
-          #}
-
-          {{- if and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-          telemetry {
-            prometheus_retention_time = "30s"
-            disable_hostname = true
-          }
-          {{- end }}
-
-        # A disruption budget limits the number of pods of a replicated application
-        # that are down simultaneously from voluntary disruptions
-        disruptionBudget:
-          enabled: true
-
-        # maxUnavailable will default to (n/2)-1 where n is the number of
-        # replicas. If you'd like a custom value, you can specify an override here.
-          maxUnavailable: null
-
-      serviceAccount:
-        create: true
-        name: ""
-        createSecret: false
-        annotations: {}
-        extraLabels: {}
-        serviceDiscovery:
-          enabled: true
-
-      statefulSet:
-        annotations: {}
-        securityContext:
-          pod: {}
-          container: {}
-
-      hostNetwork: false
-
-    # Vault UI
-    ui:
-      enabled: true
-      domain: {{ .Modules.SecretsStorage.Expose.Domain }}
-      publishNotReadyAddresses: true
-      # The service should only contain selectors for active Vault pod
-      activeVaultPodOnly: false
-      {{- if eq .Modules.SecretsStorage.Expose.Type "NodePort" }}
-      serviceType: "NodePort"
-      serviceNodePort: {{ .Modules.SecretsStorage.Expose.NodePort }}
-      {{- else }}
-      serviceType: "ClusterIP"
-      serviceNodePort: null
-      {{- end }}
-      externalPort: 8200
-      targetPort: 8200
-
-      serviceIPFamilyPolicy: ""
-
-      serviceIPFamilies: []
-
-      externalTrafficPolicy: Cluster
-
-      #loadBalancerSourceRanges:
-      #   - 10.0.0.0/16
-      #   - 1.78.23.3/32
-
-      # loadBalancerIP:
-
-      annotations: {}
-
-    csi:
-      # True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
-      #
-      # Requires installing the secrets-store-csi-driver separately, see:
-      # https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
-      #
-      # With the driver and provider installed, you can mount Vault secrets into volumes
-      # similar to the Vault Agent injector, and you can also sync those secrets into
-      # Kubernetes secrets.
-      enabled: {{ .Modules.SecretsStorage.CsiIntegration.Enabled }}
-
-      image:
-        repository: "{{ .Modules.SecretsStorage.CsiIntegration.Image }}"
-        tag: "{{ .Modules.SecretsStorage.CsiIntegration.Tag }}"
-        pullPolicy: IfNotPresent
-
-      volumes: null
-
-      volumeMounts: null
-
-      resources: {}
-
-      # Override the default secret name for the CSI Provider's HMAC key used for
-      # generating secret versions.
-      hmacSecretName: ""
-
-      daemonSet:
-        updateStrategy:
-          type: RollingUpdate
-          maxUnavailable: ""
-        # Extra annotations for the daemonSet. This can either be YAML or a
-        # YAML-formatted multi-line templated string map of the annotations to apply
-        # to the daemonSet.
-        annotations: {}
-        # Provider host path (must match the CSI provider's path)
-        providersDir: "/etc/kubernetes/secrets-store-csi-providers"
-        # Kubelet host path
-        kubeletRootDir: "/var/lib/kubelet"
-        # Extra labels to attach to the vault-csi-provider daemonSet
-        # This should be a YAML map of the labels to apply to the csi provider daemonSet
-        extraLabels: {}
-        # security context for the pod template and container in the csi provider daemonSet
-        securityContext:
-          pod: {}
-          container: {}
-
-      pod:
-        annotations: {}
-        tolerations: []
-        nodeSelector: {}
-        affinity: {}
-        extraLabels: {}
-
-      agent:
-        enabled: true
-        extraArgs: []
-
-        image:
-          repository: "{{ .Modules.SecretsStorage.Agent.Image }}"
-          tag: "{{ .Modules.SecretsStorage.Agent.Tag }}"
-          pullPolicy: IfNotPresent
-
-        logFormat: standard
-        logLevel: info
-
-        resources: {}
-
-      priorityClassName: ""
-
-      serviceAccount:
-        annotations: {}
-        extraLabels: {}
-
-      readinessProbe:
-        enabled: true
-        failureThreshold: 2
-        initialDelaySeconds: 5
-        periodSeconds: 5
-        successThreshold: 1
-        timeoutSeconds: 3
-
-      livenessProbe:
-        failureThreshold: 2
-        initialDelaySeconds: 5
-        periodSeconds: 5
-        successThreshold: 1
-        timeoutSeconds: 3
-
-      debug: false
-      extraArgs: []
-
-    serverTelemetry:
-      # Enable support for the Prometheus Operator. Currently, this chart does not support
-      # authenticating to Vault's metrics endpoint, so the following `telemetry{}` must be included
-      # in the `listener "tcp"{}` stanza
-      #  telemetry {
-      #    unauthenticated_metrics_access = "true"
-      #  }
-      #
-      # See the `standalone.config` for a more complete example of this.
-      #
-      # In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
-      #
-      # example:
-      #  telemetry {
-      #    prometheus_retention_time = "30s"
-      #    disable_hostname = true
-      #  }
-      #
-      # Configuration for monitoring the Vault server.
-      serviceMonitor:
-        enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-        selectors: {}
-        interval: 30s
-        scrapeTimeout: 10s
-
-      prometheusRules:
-          enabled: {{ and .Modules.Observability.Enabled .Modules.Observability.Monitoring.Enabled }}
-          selectors: {}
-          rules: []
-
-    ingress:
-      {{- if eq .Modules.SecretsStorage.Expose.Type "ingress" }}
-      enabled: true
-      {{- end }}
-      accountEmail: {{ .Modules.Additional.CertManager.AccountEmail }}
-      class: {{ .Modules.Additional.Ingress.Type }}
-      annotations:
-        {{- if eq .Modules.Additional.Ingress.Type "nginx" }}
-        nginx.ingress.kubernetes.io/proxy-buffer-size: "128k"
-        nginx.ingress.kubernetes.io/proxy-buffers: "4 256k"
-        nginx.ingress.kubernetes.io/proxy-busy-buffers-size: "256k"
-        {{- end }}
-      tls:
-        {{- if .Modules.SecretsStorage.Expose.Tls.Enabled }}
-        enabled: true
-        {{- end }}
-        hosts:
-          - host: {{ .Modules.SecretsStorage.Expose.Domain }}
-            secretName: vault-tls

internal/resources/templates/helm-apps/repositories/repositories.yml.tmpl

@@ -1,5 +0,0 @@
-- name: kube-forge
-  url: "https://git.kvazaric.ru/api/v4/projects/41/packages/helm/stable"
-{{ if .Modules.AdditionalRepositories }}
-{{ .Modules.AdditionalRepositories | toYaml }}
-{{- end }}

internal/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl

@@ -134,8 +134,3 @@ unsafe_show_logs: false
 
 ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
 allow_unsupported_distribution_setup: false
-
-## Containerd settings
-# containerd_metadata_root_dir: /app/lib/containerd
-# The state directory for containerd
-# containerd_state_dir: /app/run/containerd

internal/resources/templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl

@@ -0,0 +1,52 @@
+---
+# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
+
+containerd_storage_dir: {{ .Orchestrator.ContainerEngine.DataDir }}
+containerd_state_dir:  {{ .Orchestrator.ContainerEngine.StateDir }}
+
+# containerd_oom_score: 0
+
+# containerd_default_runtime: "runc"
+# containerd_snapshotter: "native"
+
+# containerd_runc_runtime:
+#   name: runc
+#   type: "io.containerd.runc.v2"
+#   engine: ""
+#   root: ""
+
+# containerd_additional_runtimes:
+# Example for Kata Containers as additional runtime:
+#   - name: kata
+#     type: "io.containerd.kata.v2"
+#     engine: ""
+#     root: ""
+
+# containerd_grpc_max_recv_message_size: 16777216
+# containerd_grpc_max_send_message_size: 16777216
+
+# Containerd debug socket location: unix or tcp format
+# containerd_debug_address: ""
+
+# Containerd log level
+# containerd_debug_level: "info"
+
+# Containerd logs format, supported values: text, json
+# containerd_debug_format: ""
+
+# Containerd debug socket UID
+# containerd_debug_uid: 0
+
+# Containerd debug socket GID
+# containerd_debug_gid: 0
+
+# containerd_metrics_address: ""
+
+# containerd_metrics_grpc_histogram: false
+
+# containerd_max_container_log_line_size: -1
+
+# containerd_registry_auth:
+#   - registry: 10.0.0.2:5000
+#     username: user
+#     password: pass

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl

@@ -12,7 +12,7 @@ local_path_provisioner_enabled: true
 # local_path_provisioner_namespace: "local-path-storage"
 local_path_provisioner_storage_class: {{ .Modules.Additional.Storage.LocalPathProvisioner.StorageClassName }}
 local_path_provisioner_reclaim_policy: {{ .Modules.Additional.Storage.LocalPathProvisioner.ReclaimPolicy }}
-# local_path_provisioner_claim_root: /opt/local-path-provisioner/
+local_path_provisioner_claim_root: {{ .Modules.Additional.Storage.LocalPathProvisioner.DataDir }}
 # local_path_provisioner_debug: false
 # local_path_provisioner_image_repo: "rancher/local-path-provisioner"
 # local_path_provisioner_image_tag: "v0.0.23"
@@ -154,7 +154,7 @@ cert_manager_dns_config:
     - "8.8.4.4"
 
 # MetalLB deployment
-{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
+{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
 metallb_enabled: true
 {{- else }}
 metallb_enabled: false
@@ -232,13 +232,3 @@ argocd_enabled: false
 # The plugin manager for kubectl
 krew_enabled: false
 krew_root_dir: "/usr/local/krew"
-
-
-########################################
-# Helm apps configuration
-########################################
-repositories:
-  {{- .Repositories | nindent 2 }}
-
-releases:
-  {{- .Releases | nindent 2 }}

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl

@@ -122,11 +122,12 @@ kube_apiserver_port: 6443  # (https)
 
 # Kube-proxy proxyMode configuration.
 # Can be ipvs, iptables
-kube_proxy_mode: ipvs
+kube_proxy_mode: {{ .Orchestrator.ProxyMode }}
+kube_proxy_scheduler: {{ .Orchestrator.ProxyScheduler }}
 
 # configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
 # must be set to true for MetalLB, kube-vip(ARP enabled) to work
-{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }}
+{{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Enabled }}
 kube_proxy_strict_arp: true
 {{- else }}
 kube_proxy_strict_arp: false
@@ -183,7 +184,10 @@ nodelocaldns_health_port: 9254
 nodelocaldns_second_health_port: 9256
 nodelocaldns_bind_metrics_host_ip: false
 nodelocaldns_secondary_skew_seconds: 5
-# nodelocaldns_external_zones:
+{{- if .Orchestrator.Dns.CoreDNSExternalZones }}
+coredns_external_zones:
+  {{- .Orchestrator.Dns.CoreDNSExternalZones | toYaml | nindent 2 }}
+{{- end }}
 # - zones:
 #   - example.com
 #   - example.io:1053
@@ -231,6 +235,72 @@ dns_domain: {{ `"{{ cluster_name }}"` }}
 ## Default: containerd
 container_manager: {{ .Orchestrator.ContainerEngine.Type }}
 
+{{- if .Orchestrator.RegistryMirrors }}
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+      - host: {{ $registryData.Host }}
+        capabilities: ["pull", "resolve"]
+        skip_verify: {{ $registryData.SkipVerify }}
+      {{- end }}
+{{- else }}
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      - host: https://mirror.gcr.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://quay.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://registry.redhat.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+{{- end }}
+
+## CRI-O registry mirrors setup
+{{- if .Orchestrator.RegistryMirrors }}
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+      - location: {{ $registryData.Host }}
+        insecure: {{ $registryData.SkipVerify }}
+      {{- end }}
+{{- else }}
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      - location: https://mirror.gcr.io
+        insecure: false
+      - location: https://quay.io
+        insecure: false
+      - location: https://registry.redhat.io
+        insecure: false
+{{- end }}
+
+## Docker registry mirrors setup
+{{- if .Orchestrator.RegistryMirrors }}
+docker_registry_mirrors:
+  {{- range $index, $registryData := .Orchestrator.RegistryMirrors }}
+  - {{ $registryData.Host }}
+  {{- end }}
+{{- else }}
+docker_registry_mirrors:
+  - https://mirror.gcr.io
+  - https://quay.io
+  - https://registry.redhat.io
+{{- end }}
+
 # Additional container runtimes
 kata_containers_enabled: false
 
@@ -378,7 +448,10 @@ auto_renew_certificates: {{ .Orchestrator.AutoRenewCertificates }}
 # auto_renew_certificates_systemd_calendar: {{ `"Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"` }}
 
 # kubeadm patches path
-kubeadm_patches:
-  enabled: false
-  source_dir: {{ `"{{ inventory_dir }}/patches"` }}
-  dest_dir: {{ `"{{ kube_config_dir }}/patches"` }}
+kubeadm_patches: []
+
+{{- if not (eq .Orchestrator.KubeletDir "/var/lib/kubelet") }}
+## Kubelet additional settings
+kubelet_custom_flags:
+  - "--root-dir={{ .Orchestrator.KubeletDir }}"
+{{- end }}

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml.tmpl

@@ -0,0 +1,131 @@
+---
+# see roles/network_plugin/calico/defaults/main.yml
+
+# the default value of name
+calico_cni_name: k8s-pod-network
+
+## With calico it is possible to distributed routes with border routers of the datacenter.
+## Warning : enabling router peering will disable calico's default behavior ('node mesh').
+## The subnets of each nodes will be distributed by the datacenter router
+# peer_with_router: false
+
+# Enables Internet connectivity from containers
+# nat_outgoing: true
+
+# Enables Calico CNI "host-local" IPAM plugin
+# calico_ipam_host_local: true
+
+# add default ippool name
+# calico_pool_name: "default-pool"
+
+# add default ippool blockSize (defaults kube_network_node_prefix)
+calico_pool_blocksize: 26
+
+# add default ippool CIDR (must be inside kube_pods_subnet, defaults to kube_pods_subnet otherwise)
+# calico_pool_cidr: 1.2.3.4/5
+
+# add default ippool CIDR to CNI config
+# calico_cni_pool: true
+
+# Add default IPV6 IPPool CIDR. Must be inside kube_pods_subnet_ipv6. Defaults to kube_pods_subnet_ipv6 if not set.
+# calico_pool_cidr_ipv6: fd85:ee78:d8a6:8607::1:0000/112
+
+# Add default IPV6 IPPool CIDR to CNI config
+# calico_cni_pool_ipv6: true
+
+# Global as_num (/calico/bgp/v1/global/as_num)
+# global_as_num: "64512"
+
+# If doing peering with node-assigned asn where the globas does not match your nodes, you want this
+# to be true.  All other cases, false.
+# calico_no_global_as_num: false
+
+# You can set MTU value here. If left undefined or empty, it will
+# not be specified in calico CNI config, so Calico will use built-in
+# defaults. The value should be a number, not a string.
+# calico_mtu: 1500
+
+# Configure the MTU to use for workload interfaces and tunnels.
+# - If Wireguard is enabled, subtract 60 from your network MTU (i.e 1500-60=1440)
+# - Otherwise, if VXLAN or BPF mode is enabled, subtract 50 from your network MTU (i.e. 1500-50=1450)
+# - Otherwise, if IPIP is enabled, subtract 20 from your network MTU (i.e. 1500-20=1480)
+# - Otherwise, if not using any encapsulation, set to your network MTU (i.e. 1500)
+# calico_veth_mtu: 1440
+
+# Advertise Cluster IPs
+# calico_advertise_cluster_ips: true
+
+# Advertise Service External IPs
+# calico_advertise_service_external_ips:
+# - x.x.x.x/24
+# - y.y.y.y/32
+
+# Advertise Service LoadBalancer IPs
+# calico_advertise_service_loadbalancer_ips:
+# - x.x.x.x/24
+# - y.y.y.y/16
+
+# Choose data store type for calico: "etcd" or "kdd" (kubernetes datastore)
+# calico_datastore: "kdd"
+
+# Choose Calico iptables backend: "Legacy", "Auto" or "NFT"
+# calico_iptables_backend: "Auto"
+
+# Use typha (only with kdd)
+# typha_enabled: false
+
+# Generate TLS certs for secure typha<->calico-node communication
+# typha_secure: false
+
+# Scaling typha: 1 replica per 100 nodes is adequate
+# Number of typha replicas
+# typha_replicas: 1
+
+# Set max typha connections
+# typha_max_connections_lower_limit: 300
+
+# Set calico network backend: "bird", "vxlan" or "none"
+# bird enable BGP routing, required for ipip and no encapsulation modes
+# calico_network_backend: vxlan
+
+# IP in IP and VXLAN is mutualy exclusive modes.
+# set IP in IP encapsulation mode: "Always", "CrossSubnet", "Never"
+# calico_ipip_mode: 'Never'
+
+# set VXLAN encapsulation mode: "Always", "CrossSubnet", "Never"
+# calico_vxlan_mode: 'Always'
+
+# set VXLAN port and VNI
+# calico_vxlan_vni: 4096
+# calico_vxlan_port: 4789
+
+# Enable eBPF mode
+calico_bpf_enabled: {{ .Orchestrator.Network.Calico.EnableBpf }}
+
+# If you want to use non default IP_AUTODETECTION_METHOD, IP6_AUTODETECTION_METHOD for calico node set this option to one of:
+# * can-reach=DESTINATION
+# * interface=INTERFACE-REGEX
+# see https://docs.projectcalico.org/reference/node/configuration
+# calico_ip_auto_method: "interface=eth.*"
+# calico_ip6_auto_method: "interface=eth.*"
+
+# Set FELIX_MTUIFACEPATTERN, Pattern used to discover the host’s interface for MTU auto-detection.
+# see https://projectcalico.docs.tigera.io/reference/felix/configuration
+# calico_felix_mtu_iface_pattern: "^((en|wl|ww|sl|ib)[opsx].*|(eth|wlan|wwan).*)"
+
+# Choose the iptables insert mode for Calico: "Insert" or "Append".
+# calico_felix_chaininsertmode: Insert
+
+# If you want use the default route interface when you use multiple interface with dynamique route (iproute2)
+# see https://docs.projectcalico.org/reference/node/configuration : FELIX_DEVICEROUTESOURCEADDRESS
+# calico_use_default_route_src_ipaddr: false
+
+# Enable calico traffic encryption with wireguard
+# calico_wireguard_enabled: false
+
+# Under certain situations liveness and readiness probes may need tunning
+# calico_node_livenessprobe_timeout: 10
+# calico_node_readinessprobe_timeout: 10
+
+# Calico apiserver (only with kdd)
+# calico_apiserver_enabled: false

internal/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml.tmpl

@@ -0,0 +1,245 @@
+---
+# cilium_version: "v1.12.1"
+
+# Log-level
+# cilium_debug: false
+
+# cilium_mtu: ""
+# cilium_enable_ipv4: true
+# cilium_enable_ipv6: false
+
+# Cilium agent health port
+# cilium_agent_health_port: "9879"
+
+# Identity allocation mode selects how identities are shared between cilium
+# nodes by setting how they are stored. The options are "crd" or "kvstore".
+# - "crd" stores identities in kubernetes as CRDs (custom resource definition).
+#   These can be queried with:
+#     `kubectl get ciliumid`
+# - "kvstore" stores identities in an etcd kvstore.
+# - In order to support External Workloads, "crd" is required
+#   - Ref: https://docs.cilium.io/en/stable/gettingstarted/external-workloads/#setting-up-support-for-external-workloads-beta
+# - KVStore operations are only required when cilium-operator is running with any of the below options:
+#   - --synchronize-k8s-services
+#   - --synchronize-k8s-nodes
+#   - --identity-allocation-mode=kvstore
+#   - Ref: https://docs.cilium.io/en/stable/internals/cilium_operator/#kvstore-operations
+# cilium_identity_allocation_mode: kvstore
+
+# Etcd SSL dirs
+# cilium_cert_dir: /etc/cilium/certs
+# kube_etcd_cacert_file: ca.pem
+# kube_etcd_cert_file: cert.pem
+# kube_etcd_key_file: cert-key.pem
+
+# Limits for apps
+# cilium_memory_limit: 500M
+# cilium_cpu_limit: 500m
+# cilium_memory_requests: 64M
+# cilium_cpu_requests: 100m
+
+# Overlay Network Mode
+# cilium_tunnel_mode: vxlan
+# Optional features
+# cilium_enable_prometheus: false
+# Enable if you want to make use of hostPort mappings
+# cilium_enable_portmap: false
+# Monitor aggregation level (none/low/medium/maximum)
+# cilium_monitor_aggregation: medium
+# The monitor aggregation flags determine which TCP flags which, upon the
+# first observation, cause monitor notifications to be generated.
+#
+# Only effective when monitor aggregation is set to "medium" or higher.
+# cilium_monitor_aggregation_flags: "all"
+# Kube Proxy Replacement mode (strict/partial)
+# cilium_kube_proxy_replacement: partial
+
+# If upgrading from Cilium < 1.5, you may want to override some of these options
+# to prevent service disruptions. See also:
+# http://docs.cilium.io/en/stable/install/upgrade/#changes-that-may-require-action
+# cilium_preallocate_bpf_maps: false
+
+# `cilium_tofqdns_enable_poller` is deprecated in 1.8, removed in 1.9
+# cilium_tofqdns_enable_poller: false
+
+# `cilium_enable_legacy_services` is deprecated in 1.6, removed in 1.9
+# cilium_enable_legacy_services: false
+
+# Unique ID of the cluster. Must be unique across all conneted clusters and
+# in the range of 1 and 255. Only relevant when building a mesh of clusters.
+# This value is not defined by default
+# cilium_cluster_id:
+
+# Deploy cilium even if kube_network_plugin is not cilium.
+# This enables to deploy cilium alongside another CNI to replace kube-proxy.
+# cilium_deploy_additionally: false
+
+# Auto direct nodes routes can be used to advertise pods routes in your cluster
+# without any tunelling (with `cilium_tunnel_mode` sets to `disabled`).
+# This works only if you have a L2 connectivity between all your nodes.
+# You wil also have to specify the variable `cilium_native_routing_cidr` to
+# make this work. Please refer to the cilium documentation for more
+# information about this kind of setups.
+# cilium_auto_direct_node_routes: false
+
+# Allows to explicitly specify the IPv4 CIDR for native routing.
+# When specified, Cilium assumes networking for this CIDR is preconfigured and
+# hands traffic destined for that range to the Linux network stack without
+# applying any SNAT.
+# Generally speaking, specifying a native routing CIDR implies that Cilium can
+# depend on the underlying networking stack to route packets to their
+# destination. To offer a concrete example, if Cilium is configured to use
+# direct routing and the Kubernetes CIDR is included in the native routing CIDR,
+# the user must configure the routes to reach pods, either manually or by
+# setting the auto-direct-node-routes flag.
+# cilium_native_routing_cidr: ""
+
+# Allows to explicitly specify the IPv6 CIDR for native routing.
+# cilium_native_routing_cidr_ipv6: ""
+
+# Enable transparent network encryption.
+# cilium_encryption_enabled: false
+
+# Encryption method. Can be either ipsec or wireguard.
+# Only effective when `cilium_encryption_enabled` is set to true.
+# cilium_encryption_type: "ipsec"
+
+# Enable encryption for pure node to node traffic.
+# This option is only effective when `cilium_encryption_type` is set to `ipsec`.
+# cilium_ipsec_node_encryption: false
+
+# If your kernel or distribution does not support WireGuard, Cilium agent can be configured to fall back on the user-space implementation.
+# When this flag is enabled and Cilium detects that the kernel has no native support for WireGuard,
+# it will fallback on the wireguard-go user-space implementation of WireGuard.
+# This option is only effective when `cilium_encryption_type` is set to `wireguard`.
+# cilium_wireguard_userspace_fallback: false
+
+# IP Masquerade Agent
+# https://docs.cilium.io/en/stable/concepts/networking/masquerading/
+# By default, all packets from a pod destined to an IP address outside of the cilium_native_routing_cidr range are masqueraded
+# cilium_ip_masq_agent_enable: false
+
+### A packet sent from a pod to a destination which belongs to any CIDR from the nonMasqueradeCIDRs is not going to be masqueraded
+# cilium_non_masquerade_cidrs:
+#   - 10.0.0.0/8
+#   - 172.16.0.0/12
+#   - 192.168.0.0/16
+#   - 100.64.0.0/10
+#   - 192.0.0.0/24
+#   - 192.0.2.0/24
+#   - 192.88.99.0/24
+#   - 198.18.0.0/15
+#   - 198.51.100.0/24
+#   - 203.0.113.0/24
+#   - 240.0.0.0/4
+### Indicates whether to masquerade traffic to the link local prefix.
+### If the masqLinkLocal is not set or set to false, then 169.254.0.0/16 is appended to the non-masquerade CIDRs list.
+# cilium_masq_link_local: false
+### A time interval at which the agent attempts to reload config from disk
+# cilium_ip_masq_resync_interval: 60s
+
+# Hubble
+### Enable Hubble without install
+# cilium_enable_hubble: false
+### Enable Hubble Metrics
+cilium_enable_hubble_metrics: {{ .Orchestrator.Network.Cilium.Hubble.EnableMetrics }}
+### if cilium_enable_hubble_metrics: true
+# cilium_hubble_metrics:
+#   - dns
+#   - drop
+#   - tcp
+#   - flow
+#   - icmp
+#   - http
+### Enable Hubble install
+cilium_hubble_install:  {{ .Orchestrator.Network.Cilium.Hubble.Install }}
+### Enable auto generate certs if cilium_hubble_install: true
+cilium_hubble_tls_generate: true
+
+# IP address management mode for v1.9+.
+# https://docs.cilium.io/en/v1.9/concepts/networking/ipam/
+# cilium_ipam_mode: kubernetes
+
+# Extra arguments for the Cilium agent
+# cilium_agent_custom_args: []
+
+# For adding and mounting extra volumes to the cilium agent
+# cilium_agent_extra_volumes: []
+# cilium_agent_extra_volume_mounts: []
+
+# cilium_agent_extra_env_vars: []
+
+# cilium_operator_replicas: 2
+
+# The address at which the cillium operator bind health check api
+# cilium_operator_api_serve_addr: "127.0.0.1:9234"
+
+## A dictionary of extra config variables to add to cilium-config, formatted like:
+##  cilium_config_extra_vars:
+##    var1: "value1"
+##    var2: "value2"
+# cilium_config_extra_vars: {}
+
+# For adding and mounting extra volumes to the cilium operator
+# cilium_operator_extra_volumes: []
+# cilium_operator_extra_volume_mounts: []
+
+# Extra arguments for the Cilium Operator
+# cilium_operator_custom_args: []
+
+# Name of the cluster. Only relevant when building a mesh of clusters.
+# cilium_cluster_name: default
+
+# Make Cilium take ownership over the `/etc/cni/net.d` directory on the node, renaming all non-Cilium CNI configurations to `*.cilium_bak`.
+# This ensures no Pods can be scheduled using other CNI plugins during Cilium agent downtime.
+# Available for Cilium v1.10 and up.
+# cilium_cni_exclusive: true
+
+# Configure the log file for CNI logging with retention policy of 7 days.
+# Disable CNI file logging by setting this field to empty explicitly.
+# Available for Cilium v1.12 and up.
+# cilium_cni_log_file: "/var/run/cilium/cilium-cni.log"
+
+# -- Configure cgroup related configuration
+# -- Enable auto mount of cgroup2 filesystem.
+# When `cilium_cgroup_auto_mount` is enabled, cgroup2 filesystem is mounted at
+# `cilium_cgroup_host_root` path on the underlying host and inside the cilium agent pod.
+# If users disable `cilium_cgroup_auto_mount`, it's expected that users have mounted
+# cgroup2 filesystem at the specified `cilium_cgroup_auto_mount` volume, and then the
+# volume will be mounted inside the cilium agent pod at the same path.
+# Available for Cilium v1.11 and up
+# cilium_cgroup_auto_mount: true
+# -- Configure cgroup root where cgroup2 filesystem is mounted on the host
+# cilium_cgroup_host_root: "/run/cilium/cgroupv2"
+
+# Specifies the ratio (0.0-1.0) of total system memory to use for dynamic
+# sizing of the TCP CT, non-TCP CT, NAT and policy BPF maps.
+# cilium_bpf_map_dynamic_size_ratio: "0.0"
+
+# -- Enables masquerading of IPv4 traffic leaving the node from endpoints.
+# Available for Cilium v1.10 and up
+# cilium_enable_ipv4_masquerade: true
+# -- Enables masquerading of IPv6 traffic leaving the node from endpoints.
+# Available for Cilium v1.10 and up
+# cilium_enable_ipv6_masquerade: true
+
+# -- Enable native IP masquerade support in eBPF
+cilium_enable_bpf_masquerade: {{ .Orchestrator.Network.Cilium.EnableBpf }}
+
+# -- Configure whether direct routing mode should route traffic via
+# host stack (true) or directly and more efficiently out of BPF (false) if
+# the kernel supports it. The latter has the implication that it will also
+# bypass netfilter in the host namespace.
+# cilium_enable_host_legacy_routing: true
+
+# -- Enable use of the remote node identity.
+# ref: https://docs.cilium.io/en/v1.7/install/upgrade/#configmap-remote-node-identity
+# cilium_enable_remote_node_identity: true
+
+# -- Enable the use of well-known identities.
+# cilium_enable_well_known_identities: false
+
+# cilium_enable_bpf_clock_probe: true
+
+# -- Whether to enable CNP status updates.
+# cilium_disable_cnp_status_updates: true

internal/resources/templates/kubespray/inventory/hosts.tmpl

@@ -44,10 +44,6 @@
 {{- end }}
 {{- end }}
 
-[k8s_cluster:children]
-kube_control_plane
-kube_node
-
 [all:vars]
 ansible_connection=ssh
 {{- if not (eq .Credentials.User "") }}

internal/resources/templates/secrets-storage/vault-keys.json.tmpl

@@ -1,8 +0,0 @@
-{
-  "keys": [
-    {{- range $index, $key := .Modules.SecretsStorage.UnsealKeys }}
-     "{{ $key }}",
-    {{- end }}
-  ],
-  "root_token": "{{ .Modules.SecretsStorage.AuthToken }}"
-}

internal/secrets_storage/commands.go

@@ -1,129 +0,0 @@
-package secrets_storage
-
-import (
-	"fmt"
-	"kube-forge/internal/config"
-	"kube-forge/internal/kubernetes_client"
-	"kube-forge/internal/templates"
-	"regexp"
-	"strings"
-)
-
-func InitVault() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	err = commandToInitVault()
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	fmt.Println("Vault initialized")
-	templates.ApplyVaultInitKeysTemplate()
-}
-
-func AddKubernetesLocalIntegration() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	err = commandToAddKubernetesLocalIntegration()
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	fmt.Println("Vault local Kubernetes integration added")
-}
-
-func UnsealVault() {
-	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
-	if err != nil {
-		fmt.Println(err.Error())
-		return
-	}
-	commandToUnsealVault()
-}
-
-func commandToInitVault() error {
-	config := config.GetConfig()
-	commandArray := []string{
-		"vault", "operator", "init",
-		fmt.Sprintf("-key-shares=%d", config.Modules.SecretsStorage.KeyShares),
-		fmt.Sprintf("-key-threshold=%d", config.Modules.SecretsStorage.KeyThreshold),
-	}
-	output, err := kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	if err != nil && strings.Contains(output, "Vault is already initialized") {
-		return VaultAlreadyInitialised
-	}
-
-	unsealKeys, rootToken := parseVaultInitKeys(output)
-	config.Modules.SecretsStorage.UnsealKeys = unsealKeys
-	config.Modules.SecretsStorage.AuthToken = rootToken
-	return nil
-}
-
-func parseVaultInitKeys(input string) ([]string, string) {
-	unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`)
-	rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`)
-
-	unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1)
-	var unsealKeys []string
-	for _, match := range unsealKeysMatches {
-		unsealKeys = append(unsealKeys, match[1])
-	}
-
-	rootTokenMatches := rootTokenPattern.FindStringSubmatch(input)
-	rootToken := rootTokenMatches[1]
-
-	return unsealKeys, rootToken
-}
-
-func commandToUnsealVault() {
-	config := config.GetConfig()
-
-	for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys {
-		commandArray := []string{"vault", "operator", "unseal", unsealKey}
-		kubernetes_client.ExecuteCommandInPodContainer(
-			commandArray, "secrets-storage", "vault-0", "vault",
-		)
-	}
-	fmt.Println("Vault unsealed")
-}
-
-func commandToAddKubernetesLocalIntegration() error {
-	config := config.GetConfig()
-
-	commandArray := []string{"vault", "login", config.Modules.SecretsStorage.AuthToken}
-	output, err := kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	if err != nil && strings.Contains(output, "permission denied") {
-		return IncorrectCredentials
-	}
-	commandArray = []string{"vault", "auth", "enable", "-local", "-path=kubernetes-local", "kubernetes"}
-	output, err = kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	kubernetesInternalServiceAddr, err := kubernetes_client.GetEnvVariableFromPodContainer(
-		"KUBERNETES_PORT_443_TCP_ADDR",
-		"secrets-storage",
-		"vault-0",
-		"vault",
-	)
-	if err != nil {
-		return err
-	}
-	commandArray = []string{
-		"vault", "write", "auth/kubernetes-local/config",
-		fmt.Sprintf("kubernetes_host=https://%s:443", kubernetesInternalServiceAddr),
-	}
-	output, err = kubernetes_client.ExecuteCommandInPodContainer(
-		commandArray, "secrets-storage", "vault-0", "vault",
-	)
-	return nil
-}

internal/secrets_storage/errors.go

@@ -1,6 +0,0 @@
-package secrets_storage
-
-import "errors"
-
-var VaultAlreadyInitialised = errors.New("Vault already initialised")
-var IncorrectCredentials = errors.New("Incorrect Vault auth token credentials!!")

internal/templates/helm.go

@@ -0,0 +1,12 @@
+package templates
+
+import (
+	"kube-forge/internal/config"
+	"kube-forge/internal/resources"
+)
+
+func GetHelmValuesByTemplate(templateFile string) string {
+	cfg := config.GetConfig()
+	template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
+	return executeTemplateToString(template, cfg)
+}

internal/templates/helm_apps.go

@@ -1,46 +0,0 @@
-package templates
-
-import (
-	"kube-forge/internal/config"
-	"kube-forge/internal/resources"
-	"strings"
-)
-
-var HELM_APPS_TEMPLATES = [...]string{
-	"templates/helm-apps/releases/additional-modules/docker-secrets-generator.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl",
-	"templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl",
-	"templates/helm-apps/releases/observability/fluent-operator.yml.tmpl",
-	"templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl",
-	"templates/helm-apps/releases/observability/metrics-server.yml.tmpl",
-	"templates/helm-apps/releases/observability/tempo.yml.tmpl",
-	"templates/helm-apps/releases/observability/loki.yml.tmpl",
-	"templates/helm-apps/releases/observability/observability.yml.tmpl",
-	"templates/helm-apps/releases/registry/harbor-certificate-generator.yml.tmpl",
-	"templates/helm-apps/releases/registry/harbor.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-cd.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-rollouts.yml.tmpl",
-	"templates/helm-apps/releases/cicd/keel.yml.tmpl",
-	"templates/helm-apps/releases/cicd/argo-cd-ingress.yml.tmpl",
-	"templates/helm-apps/releases/secrets-storage/vault.yml.tmpl",
-}
-var HELM_REPOSITORIES_TEMPLATES = [...]string{
-	"templates/helm-apps/repositories/repositories.yml.tmpl",
-}
-
-func GetHelmAppsConfigData() (string, string) {
-	cfg := config.GetConfig()
-	helmAppsTemplateResults := []string{}
-	for _, templateFile := range HELM_APPS_TEMPLATES {
-		template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
-		helmAppsTemplateResults = append(helmAppsTemplateResults, executeTemplateToString(template, cfg))
-	}
-	repositoriesTemplateResults := []string{}
-	for _, templateFile := range HELM_REPOSITORIES_TEMPLATES {
-		template := getTemplateFromEmbedFSFolder(resources.Templates, templateFile)
-		repositoriesTemplateResults = append(repositoriesTemplateResults, executeTemplateToString(template, cfg))
-	}
-	return strings.Join(repositoriesTemplateResults, "\n"), strings.Join(helmAppsTemplateResults, "\n")
-}

internal/templates/kubespray.go

@@ -5,6 +5,9 @@ var K8S_TEMPLATES = [...][2]string{
 	{"templates/kubespray/inventory/group_vars/all.yml.tmpl", "kubespray/inventory/group_vars/all.yml"},
 	{"templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/addons.yml"},
 	{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml"},
+	{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml"},
+	{"templates/kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml.tmpl", "kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml"},
+	{"templates/kubespray/inventory/group_vars/all/containerd.yml.tmpl", "kubespray/inventory/group_vars/all/containerd.yml"},
 }
 
 func ApplyK8sTemplates() {

kubespray/env/cmdline

@@ -1 +0,0 @@
--b -v --become

kubespray/env/extravars

@@ -1,2 +0,0 @@
----
-ansible_sudo_pass: nF5S8nuKi87Dh42Jnjik

kubespray/inventory/group_vars/all.yml

@@ -32,6 +32,7 @@ disable_host_nameservers: false
 upstream_dns_servers:
   - 8.8.8.8
   - 8.8.4.4
+  - 1.1.1.1
 
 ## There are some changes specific to the cloud providers
 ## for instance we need to encapsulate packets with some network plugins
@@ -127,8 +128,3 @@ unsafe_show_logs: false
 
 ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases.
 allow_unsupported_distribution_setup: false
-
-## Containerd settings
-# containerd_metadata_root_dir: /app/lib/containerd
-# The state directory for containerd
-# containerd_state_dir: /app/run/containerd

kubespray/inventory/group_vars/all/containerd.yml

@@ -0,0 +1,63 @@
+---
+# Please see roles/container-engine/containerd/defaults/main.yml for more configuration options
+
+containerd_storage_dir: /app/containerd
+containerd_state_dir:  /app/containerd-state
+
+# containerd_oom_score: 0
+
+# containerd_default_runtime: "runc"
+# containerd_snapshotter: "native"
+
+# containerd_runc_runtime:
+#   name: runc
+#   type: "io.containerd.runc.v2"
+#   engine: ""
+#   root: ""
+
+# containerd_additional_runtimes:
+# Example for Kata Containers as additional runtime:
+#   - name: kata
+#     type: "io.containerd.kata.v2"
+#     engine: ""
+#     root: ""
+
+# containerd_grpc_max_recv_message_size: 16777216
+# containerd_grpc_max_send_message_size: 16777216
+
+# Containerd debug socket location: unix or tcp format
+# containerd_debug_address: ""
+
+# Containerd log level
+# containerd_debug_level: "info"
+
+# Containerd logs format, supported values: text, json
+# containerd_debug_format: ""
+
+# Containerd debug socket UID
+# containerd_debug_uid: 0
+
+# Containerd debug socket GID
+# containerd_debug_gid: 0
+
+# containerd_metrics_address: ""
+
+# containerd_metrics_grpc_histogram: false
+
+# Registries defined within containerd.
+containerd_registries_mirrors:
+  - prefix: docker.io
+    mirrors:
+      - host: https://mirror.gcr.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+      - host: https://quay.io
+        capabilities: ["pull", "resolve"]
+        skip_verify: false
+
+# containerd_max_container_log_line_size: -1
+
+# containerd_registry_auth:
+#   - registry: 10.0.0.2:5000
+#     username: user
+#     password: pass

kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml

@@ -17,7 +17,7 @@ kube_token_dir: "{{ kube_config_dir }}/tokens"
 kube_api_anonymous_auth: true
 
 ## Change this to use another Kubernetes version, e.g. a current beta release
-kube_version: v1.29.0
+kube_version: 1.32.4
 
 # Where the binaries will be downloaded.
 # Note: ensure that you've enough disk space (about 1G)
@@ -123,6 +123,7 @@ kube_apiserver_port: 6443  # (https)
 # Kube-proxy proxyMode configuration.
 # Can be ipvs, iptables
 kube_proxy_mode: ipvs
+kube_proxy_scheduler: lc
 
 # configure arp_ignore and arp_announce to avoid answering ARP queries from kube-ipvs0 interface
 # must be set to true for MetalLB, kube-vip(ARP enabled) to work
@@ -157,7 +158,7 @@ kube_encrypt_secret_data: false
 
 # DNS configuration.
 # Kubernetes cluster name, also will be used as DNS domain
-cluster_name: k8s-cluster.local
+cluster_name: cluster.local
 # Subdomains of DNS domain to be resolved via /etc/resolv.conf for hostnet pods
 ndots: 2
 # dns_timeout: 2
@@ -179,7 +180,6 @@ nodelocaldns_health_port: 9254
 nodelocaldns_second_health_port: 9256
 nodelocaldns_bind_metrics_host_ip: false
 nodelocaldns_secondary_skew_seconds: 5
-# nodelocaldns_external_zones:
 # - zones:
 #   - example.com
 #   - example.io:1053
@@ -227,6 +227,24 @@ dns_domain: "{{ cluster_name }}"
 ## Default: containerd
 container_manager: containerd
 
+## CRI-O registry mirrors setup
+crio_registries:
+  - prefix: docker.io
+    insecure: false
+    blocked: false
+    location: registry-1.docker.io
+    unqualified: false
+    mirrors:
+      - location: https://mirror.gcr.io
+        insecure: false
+      - location: https://quay.io
+        insecure: false
+
+## Docker registry mirrors setup
+docker_registry_mirrors:
+  - https://mirror.gcr.io
+  - https://quay.io
+
 # Additional container runtimes
 kata_containers_enabled: false
 
@@ -374,7 +392,7 @@ auto_renew_certificates: true
 # auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"
 
 # kubeadm patches path
-kubeadm_patches:
-  enabled: false
-  source_dir: "{{ inventory_dir }}/patches"
-  dest_dir: "{{ kube_config_dir }}/patches"
+kubeadm_patches: []
+## Kubelet additional settings
+kubelet_custom_flags:
+  - "--root-dir=/app/k8s/kubelet"

kubespray/inventory/group_vars/k8s_cluster/k8s-net-calico.yml

@@ -100,7 +100,7 @@ calico_pool_blocksize: 26
 # calico_vxlan_port: 4789
 
 # Enable eBPF mode
-# calico_bpf_enabled: false
+calico_bpf_enabled: false
 
 # If you want to use non default IP_AUTODETECTION_METHOD, IP6_AUTODETECTION_METHOD for calico node set this option to one of:
 # * can-reach=DESTINATION

kubespray/inventory/group_vars/k8s_cluster/k8s-net-cilium.yml

@@ -142,9 +142,9 @@
 ### Enable Hubble without install
 # cilium_enable_hubble: false
 ### Enable Hubble Metrics
-# cilium_enable_hubble_metrics: false
+cilium_enable_hubble_metrics: false
 ### if cilium_enable_hubble_metrics: true
-# cilium_hubble_metrics: {}
+# cilium_hubble_metrics:
 #   - dns
 #   - drop
 #   - tcp
@@ -152,9 +152,9 @@
 #   - icmp
 #   - http
 ### Enable Hubble install
-# cilium_hubble_install: false
+cilium_hubble_install:  false
 ### Enable auto generate certs if cilium_hubble_install: true
-# cilium_hubble_tls_generate: false
+cilium_hubble_tls_generate: true
 
 # IP address management mode for v1.9+.
 # https://docs.cilium.io/en/v1.9/concepts/networking/ipam/
@@ -224,7 +224,7 @@
 # cilium_enable_ipv6_masquerade: true
 
 # -- Enable native IP masquerade support in eBPF
-# cilium_enable_bpf_masquerade: false
+cilium_enable_bpf_masquerade: false
 
 # -- Configure whether direct routing mode should route traffic via
 # host stack (true) or directly and more efficiently out of BPF (false) if

kubespray/inventory/hosts

@@ -1,23 +1,17 @@
 
-vbox-prod-k8s-master-01 ansible_host=10.250.50.22 ip=10.250.50.22  
-vbox-prod-k8s-slave-01 ansible_host=10.250.50.23 ip=10.250.50.23  
-vbox-prod-k8s-slave-02 ansible_host=10.250.50.21 ip=10.250.50.21  
+k8s-master-1 ansible_host=172.16.1.136 ip=172.16.1.136  
+k8s-worker-1 ansible_host=172.16.1.135 ip=172.16.1.135  
 
 [kube_control_plane]
-vbox-prod-k8s-master-01
+k8s-master-1
 
 [etcd]
-vbox-prod-k8s-master-01
+k8s-master-1
 
 [kube_node]
-vbox-prod-k8s-slave-01
-vbox-prod-k8s-slave-02
-
-[k8s_cluster:children]
-kube_control_plane
-kube_node
+k8s-worker-1
 
 [all:vars]
 ansible_connection=ssh
-ansible_user=sre-admin
-ansible_ssh_private_key_file=/root/.ssh/id_rsa
+ansible_user=georgest
+ansible_ssh_private_key_file=/Users/georgest/.ssh/id_rsa

kubespray/project/ansible_version.yml

@@ -2,10 +2,10 @@
 - name: Check Ansible version
   hosts: all
   gather_facts: false
-  become: no
+  become: false
   run_once: true
   vars:
-    minimal_ansible_version: 2.15.5  # 2.15 versions before 2.15.5 are known to be buggy for kubespray
+    minimal_ansible_version: 2.16.4
     maximal_ansible_version: 2.17.0
   tags: always
   tasks:
@@ -25,7 +25,6 @@
       tags:
         - check
 
-    # CentOS 7 provides too old jinja version
     - name: "Check that jinja is not too old (install via pip)"
       assert:
         msg: "Your Jinja version is too old, install via pip"

kubespray/project/boilerplate.yml

@@ -2,57 +2,45 @@
 - name: Check ansible version
   import_playbook: ansible_version.yml
 
-# These are inventory compatibility tasks to ensure we keep compatibility with old style group names
+# These are inventory compatibility tasks with two purposes:
+# - to ensure we keep compatibility with old style group names
+# - to reduce inventory boilerplate (defining parent groups / empty groups)
 
-- name: Add kube-master nodes to kube_control_plane
-  hosts: kube-master
+- name: Define groups for legacy less structured inventories
+  hosts: all
   gather_facts: false
   tags: always
   tasks:
-    - name: Add nodes to kube_control_plane group
+    - name: Match needed groups by their old names or definition
+      vars:
+        group_mappings:
+          kube_control_plane:
+            - kube-master
+          kube_node:
+            - kube-node
+          calico_rr:
+            - calico-rr
+          no_floating:
+            - no-floating
+          k8s_cluster:
+            - kube_node
+            - kube_control_plane
+            - calico_rr
       group_by:
-        key: 'kube_control_plane'
+        key: "{{ (group_names | intersect(item.value) | length > 0) | ternary(item.key, '_all') }}"
+      loop: "{{ group_mappings | dict2items }}"
 
-- name: Add kube-node nodes to kube_node
-  hosts: kube-node
+- name: Check inventory settings
+  hosts: all
   gather_facts: false
   tags: always
-  tasks:
-    - name: Add nodes to kube_node group
-      group_by:
-        key: 'kube_node'
-
-- name: Add k8s-cluster nodes to k8s_cluster
-  hosts: k8s-cluster
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to k8s_cluster group
-      group_by:
-        key: 'k8s_cluster'
-
-- name: Add calico-rr nodes to calico_rr
-  hosts: calico-rr
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to calico_rr group
-      group_by:
-        key: 'calico_rr'
-
-- name: Add no-floating nodes to no_floating
-  hosts: no-floating
-  gather_facts: false
-  tags: always
-  tasks:
-    - name: Add nodes to no-floating group
-      group_by:
-        key: 'no_floating'
+  roles:
+    - validate_inventory
 
 - name: Install bastion ssh config
   hosts: bastion[0]
-  gather_facts: False
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: bastion-ssh-config, tags: ["localhost", "bastion"] }

kubespray/project/cluster.yml

@@ -7,101 +7,95 @@
 
 - name: Prepare for etcd install
   hosts: k8s_cluster:etcd
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/preinstall, tags: preinstall }
-    - {
-        role: "container-engine",
-        tags: "container-engine",
-        when: deploy_container_engine,
-      }
+    - { role: "container-engine", tags: "container-engine", when: deploy_container_engine }
     - { role: download, tags: download, when: "not skip_downloads" }
 
 - name: Install etcd
+  vars:
+    etcd_cluster_setup: true
+    etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}"
   import_playbook: install_etcd.yml
 
 - name: Install Kubernetes nodes
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/node, tags: node }
 
 - name: Install the control plane
   hosts: kube_control_plane
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/control-plane, tags: master }
     - { role: kubernetes/client, tags: client }
     - { role: kubernetes-apps/cluster_roles, tags: cluster-roles }
 
 - name: Invoke kubeadm and install a CNI
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: kubernetes/kubeadm, tags: kubeadm}
     - { role: kubernetes/node-label, tags: node-label }
     - { role: kubernetes/node-taint, tags: node-taint }
+    - role: kubernetes-apps/gateway_api
+      when: gateway_api_enabled
+      tags: gateway_api
+      delegate_to: "{{ groups['kube_control_plane'][0] }}"
+      run_once: true
     - { role: network_plugin, tags: network }
-    - { role: kubernetes-apps/kubelet-csr-approver, tags: kubelet-csr-approver }
 
 - name: Install Calico Route Reflector
   hosts: calico_rr
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
-    - { role: network_plugin/calico/rr, tags: ["network", "calico_rr"] }
+    - { role: kubespray_defaults }
+    - { role: network_plugin/calico/rr, tags: ['network', 'calico_rr'] }
 
 - name: Patch Kubernetes for Windows
   hosts: kube_control_plane[0]
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - { role: win_nodes/kubernetes_patch, tags: ["master", "win_nodes"] }
 
-- name: Install Kubernetes and Helm apps
+- name: Install Kubernetes apps
   hosts: kube_control_plane
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
-    - {
-        role: kubernetes-apps/external_cloud_controller,
-        tags: external-cloud-controller,
-      }
+    - { role: kubespray_defaults }
+    - { role: kubernetes-apps/external_cloud_controller, tags: external-cloud-controller }
     - { role: kubernetes-apps/network_plugin, tags: network }
     - { role: kubernetes-apps/policy_controller, tags: policy-controller }
     - { role: kubernetes-apps/ingress_controller, tags: ingress-controller }
     - { role: kubernetes-apps/external_provisioner, tags: external-provisioner }
     - { role: kubernetes-apps, tags: apps }
-    - { role: helm-apps, tags: helm-apps }
 
 - name: Apply resolv.conf changes now that cluster DNS is up
   hosts: k8s_cluster
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
-    - {
-        role: kubernetes/preinstall,
-        when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'",
-        tags: resolvconf,
-        dns_late: true,
-      }
+    - { role: kubespray_defaults }
+    - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_late: true }

kubespray/project/facts.yml

@@ -5,19 +5,17 @@
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   gather_facts: false
   environment: "{{ proxy_disable_env }}"
-  vars:
-    # Need to disable pipelining for bootstrap-os as some systems have requiretty in sudoers set, which makes pipelining
-    # fail. bootstrap-os fixes this on these systems, so in later plays it can be enabled.
-    ansible_ssh_pipelining: false
   roles:
-    - { role: kubespray-defaults }
-    - { role: bootstrap-os, tags: bootstrap-os}
+    - { role: bootstrap_os, tags: bootstrap_os}
 
 - name: Gather facts
   hosts: k8s_cluster:etcd:calico_rr
-  gather_facts: False
+  gather_facts: false
   tags: always
   tasks:
+    - name: Gather and compute network facts
+      import_role:
+        name: network_facts
     - name: Gather minimal facts
       setup:
         gather_subset: '!all'

kubespray/project/install_etcd.yml

@@ -2,7 +2,7 @@
 - name: Add worker nodes to the etcd play if needed
   hosts: kube_node
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
   tasks:
     - name: Check if nodes needs etcd client certs (depends on network_plugin)
       group_by:
@@ -16,14 +16,11 @@
 
 - name: Install etcd
   hosts: etcd:kube_control_plane:_kubespray_needs_etcd
-  gather_facts: False
+  gather_facts: false
   any_errors_fatal: "{{ any_errors_fatal | default(true) }}"
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults }
+    - { role: kubespray_defaults }
     - role: etcd
       tags: etcd
-      vars:
-        etcd_cluster_setup: true
-        etcd_events_cluster_setup: "{{ etcd_events_cluster_enabled }}"
       when: etcd_deployment_type != "kubeadm"

kubespray/project/recover_control_plane.yml

@@ -6,7 +6,7 @@
   hosts: etcd[0]
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - role: recover_control_plane/etcd
       when: etcd_deployment_type != "kubeadm"
 
@@ -14,7 +14,7 @@
   hosts: kube_control_plane[0]
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: recover_control_plane/control-plane }
 
 - name: Apply whole cluster install
@@ -24,5 +24,5 @@
   hosts: kube_control_plane
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: recover_control_plane/post-recover }

kubespray/project/remove_node.yml

@@ -1,16 +1,26 @@
 ---
+- name: Validate nodes for removal
+  hosts: localhost
+  tasks:
+    - name: Assert that nodes are specified for removal
+      assert:
+        that:
+          - node is defined
+          - node | length > 0
+        msg: "No nodes specified for removal. The `node` variable must be set explicitly."
+
 - name: Common tasks for every playbooks
   import_playbook: boilerplate.yml
 
 - name: Confirm node removal
-  hosts: "{{ node | default('etcd:k8s_cluster:calico_rr') }}"
-  gather_facts: no
+  hosts: "{{ node | default('this_is_unreachable') }}"
+  gather_facts: false
   tasks:
     - name: Confirm Execution
       pause:
         prompt: "Are you sure you want to delete nodes state? Type 'yes' to delete nodes."
       register: pause_result
-      run_once: True
+      run_once: true
       when:
         - not (skip_confirmation | default(false) | bool)
 
@@ -24,20 +34,25 @@
   when: reset_nodes | default(True) | bool
 
 - name: Reset node
-  hosts: "{{ node | default('kube_node') }}"
-  gather_facts: no
+  hosts: "{{ node | default('this_is_unreachable') }}"
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
+  pre_tasks:
+    - name: Gather information about installed services
+      service_facts:
+      when: reset_nodes | default(True) | bool
   roles:
-    - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
-    - { role: remove-node/pre-remove, tags: pre-remove }
-    - { role: remove-node/remove-etcd-node }
+    - { role: kubespray_defaults, when: reset_nodes | default(True) | bool }
+    - { role: remove_node/pre_remove, tags: pre-remove }
+    - role: remove-node/remove-etcd-node
+      when: "'etcd' in group_names"
     - { role: reset, tags: reset, when: reset_nodes | default(True) | bool }
 
-# Currently cannot remove first master or etcd
+# Currently cannot remove first control plane node or first etcd node
 - name: Post node removal
-  hosts: "{{ node | default('kube_control_plane[1:]:etcd[1:]') }}"
-  gather_facts: no
+  hosts: "{{ node | default('this_is_unreachable') }}"
+  gather_facts: false
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults, when: reset_nodes | default(True) | bool }
+    - { role: kubespray_defaults, when: reset_nodes | default(True) | bool }
     - { role: remove-node/post-remove, tags: post-remove }

kubespray/project/reset.yml

@@ -7,13 +7,13 @@
 
 - name: Reset cluster
   hosts: etcd:k8s_cluster:calico_rr
-  gather_facts: False
+  gather_facts: false
   pre_tasks:
     - name: Reset Confirmation
       pause:
         prompt: "Are you sure you want to reset cluster state? Type 'yes' to reset your cluster."
       register: reset_confirmation_prompt
-      run_once: True
+      run_once: true
       when:
         - not (skip_confirmation | default(false) | bool)
         - reset_confirmation is not defined
@@ -30,6 +30,6 @@
 
   environment: "{{ proxy_disable_env }}"
   roles:
-    - { role: kubespray-defaults}
+    - { role: kubespray_defaults}
     - { role: kubernetes/preinstall, when: "dns_mode != 'none' and resolvconf_mode == 'host_resolvconf'", tags: resolvconf, dns_early: true }
     - { role: reset, tags: reset }

kubespray/project/roles/adduser/defaults/main.yml

@@ -7,14 +7,14 @@ addusers:
   etcd:
     name: etcd
     comment: "Etcd user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
     shell: /sbin/nologin
   kube:
     name: kube
     comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"
 

kubespray/project/roles/adduser/molecule/default/molecule.yml

@@ -2,22 +2,18 @@
 role_name_check: 1
 dependency:
   name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
-  - name: adduser-01
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
+  - name: ubuntu20
+    cloud_image: ubuntu-2004
+    vm_cpu_cores: 1
+    vm_memory: 512
 provisioner:
   name: ansible
   config_options:
     defaults:
       callbacks_enabled: profile_tasks
       timeout: 120
+  playbooks:
+    create: ../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/adduser/vars/coreos.yml

@@ -3,6 +3,6 @@ addusers:
   - name: kube
     comment: "Kubernetes user"
     shell: /sbin/nologin
-    system: yes
+    system: true
     group: "{{ kube_cert_group }}"
-    create_home: no
+    create_home: false

kubespray/project/roles/adduser/vars/debian.yml

@@ -2,14 +2,14 @@
 addusers:
   - name: etcd
     comment: "Etcd user"
-    create_home: yes
+    create_home: true
     home: "{{ etcd_data_dir }}"
-    system: yes
+    system: true
     shell: /sbin/nologin
 
   - name: kube
     comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"

kubespray/project/roles/adduser/vars/redhat.yml

@@ -2,14 +2,14 @@
 addusers:
   - name: etcd
     comment: "Etcd user"
-    create_home: yes
+    create_home: true
     home: "{{ etcd_data_dir }}"
-    system: yes
+    system: true
     shell: /sbin/nologin
 
   - name: kube
     comment: "Kubernetes user"
-    create_home: no
-    system: yes
+    create_home: false
+    system: true
     shell: /sbin/nologin
     group: "{{ kube_cert_group }}"

kubespray/project/roles/bastion-ssh-config/molecule/default/converge.yml

@@ -12,4 +12,4 @@
         dest: "{{ ssh_bastion_confing__name }}"
         owner: "{{ ansible_user }}"
         group: "{{ ansible_user }}"
-        mode: 0644
+        mode: "0644"

kubespray/project/roles/bastion-ssh-config/molecule/default/molecule.yml

@@ -2,17 +2,11 @@
 role_name_check: 1
 dependency:
   name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
 platforms:
   - name: bastion-01
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
+    cloud_image: ubuntu-2004
+    vm_cpu_cores: 1
+    vm_memory: 512
 provisioner:
   name: ansible
   config_options:
@@ -27,5 +21,7 @@ provisioner:
           bastion:
             hosts:
               bastion-01:
+  playbooks:
+    create: ../../../../tests/cloud_playbooks/create-kubevirt.yml
 verifier:
   name: testinfra

kubespray/project/roles/bastion-ssh-config/tasks/main.yml

@@ -19,4 +19,4 @@
   template:
     src: "{{ ssh_bastion_confing__name }}.j2"
     dest: "{{ playbook_dir }}/{{ ssh_bastion_confing__name }}"
-    mode: 0640
+    mode: "0640"

kubespray/project/roles/bootstrap-os/molecule/default/converge.yml

@@ -1,6 +0,0 @@
----
-- name: Converge
-  hosts: all
-  gather_facts: no
-  roles:
-    - role: bootstrap-os

kubespray/project/roles/bootstrap-os/molecule/default/molecule.yml

@@ -1,53 +0,0 @@
----
-role_name_check: 1
-dependency:
-  name: galaxy
-driver:
-  name: vagrant
-  provider:
-    name: libvirt
-platforms:
-  - name: ubuntu20
-    box: generic/ubuntu2004
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-  - name: ubuntu22
-    box: generic/ubuntu2204
-    cpus: 1
-    memory: 1024
-    provider_options:
-      driver: kvm
-  - name: centos7
-    box: centos/7
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-  - name: almalinux8
-    box: almalinux/8
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-  - name: debian10
-    box: generic/debian10
-    cpus: 1
-    memory: 512
-    provider_options:
-      driver: kvm
-provisioner:
-  name: ansible
-  config_options:
-    defaults:
-      callbacks_enabled: profile_tasks
-      timeout: 120
-  inventory:
-    group_vars:
-      all:
-        user:
-          name: foo
-          comment: My test comment
-verifier:
-  name: testinfra

kubespray/project/roles/bootstrap-os/tasks/bootstrap-coreos.yml

@@ -1,37 +0,0 @@
----
-# CoreOS ships without Python installed
-
-- name: Check if bootstrap is needed
-  raw: stat /opt/bin/.bootstrapped
-  register: need_bootstrap
-  failed_when: false
-  changed_when: false
-  tags:
-    - facts
-
-- name: Force binaries directory for Container Linux by CoreOS and Flatcar
-  set_fact:
-    bin_dir: "/opt/bin"
-  tags:
-    - facts
-
-- name: Run bootstrap.sh
-  script: bootstrap.sh
-  become: true
-  environment: "{{ proxy_env }}"
-  when:
-    - need_bootstrap.rc != 0
-
-- name: Set the ansible_python_interpreter fact
-  set_fact:
-    ansible_python_interpreter: "{{ bin_dir }}/python"
-  tags:
-    - facts
-
-- name: Disable auto-upgrade
-  systemd:
-    name: locksmithd.service
-    masked: true
-    state: stopped
-  when:
-    - coreos_locksmithd_disable

kubespray/project/roles/bootstrap-os/tasks/main.yml

@@ -1,109 +1,10 @@
 ---
-- name: Fetch /etc/os-release
-  raw: cat /etc/os-release
-  register: os_release
-  changed_when: false
-  # This command should always run, even in check mode
-  check_mode: false
+- name: Warn for usage of deprecated role
+  fail:
+    msg: bootstrap-os is deprecated, switch to bootstrap_os
+  ignore_errors: true # noqa ignore-errors
+  run_once: true
 
-- name: Bootstrap CentOS
-  include_tasks: bootstrap-centos.yml
-  when: '''ID="centos"'' in os_release.stdout_lines or ''ID="ol"'' in os_release.stdout_lines or ''ID="almalinux"'' in os_release.stdout_lines or ''ID="rocky"'' in os_release.stdout_lines or ''ID="kylin"'' in os_release.stdout_lines  or ''ID="uos"'' in os_release.stdout_lines or ''ID="openEuler"'' in os_release.stdout_lines'
-
-- name: Bootstrap Amazon
-  include_tasks: bootstrap-amazon.yml
-  when: '''ID="amzn"'' in os_release.stdout_lines'
-
-- name: Bootstrap RedHat
-  include_tasks: bootstrap-redhat.yml
-  when: '''ID="rhel"'' in os_release.stdout_lines'
-
-- name: Bootstrap Clear Linux
-  include_tasks: bootstrap-clearlinux.yml
-  when: '''ID=clear-linux-os'' in os_release.stdout_lines'
-
-# Fedora CoreOS
-- name: Bootstrap Fedora CoreOS
-  include_tasks: bootstrap-fedora-coreos.yml
-  when:
-    - '''ID=fedora'' in os_release.stdout_lines'
-    - '''VARIANT_ID=coreos'' in os_release.stdout_lines'
-
-- name: Bootstrap Flatcar
-  include_tasks: bootstrap-flatcar.yml
-  when: '''ID=flatcar'' in os_release.stdout_lines'
-
-- name: Bootstrap Debian
-  include_tasks: bootstrap-debian.yml
-  when: '''ID=debian'' in os_release.stdout_lines or ''ID=ubuntu'' in os_release.stdout_lines'
-
-# Fedora "classic"
-- name: Boostrap Fedora
-  include_tasks: bootstrap-fedora.yml
-  when:
-    - '''ID=fedora'' in os_release.stdout_lines'
-    - '''VARIANT_ID=coreos'' not in os_release.stdout_lines'
-
-- name: Bootstrap OpenSUSE
-  include_tasks: bootstrap-opensuse.yml
-  when: '''ID="opensuse-leap"'' in os_release.stdout_lines or ''ID="opensuse-tumbleweed"'' in os_release.stdout_lines'
-
-- name: Create remote_tmp for it is used by another module
-  file:
-    path: "{{ ansible_remote_tmp | default('~/.ansible/tmp') }}"
-    state: directory
-    mode: 0700
-
-# Workaround for https://github.com/ansible/ansible/issues/42726
-# (1/3)
-- name: Gather host facts to get ansible_os_family
-  setup:
-    gather_subset: '!all'
-    filter: ansible_*
-
-- name: Assign inventory name to unconfigured hostnames (non-CoreOS, non-Flatcar, Suse and ClearLinux, non-Fedora)
-  hostname:
-    name: "{{ inventory_hostname }}"
-  when:
-    - override_system_hostname
-    - ansible_os_family not in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    - not ansible_distribution == "Fedora"
-    - not is_fedora_coreos
-
-# (2/3)
-- name: Assign inventory name to unconfigured hostnames (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
-  command: "hostnamectl set-hostname {{ inventory_hostname }}"
-  register: hostname_changed
-  become: true
-  changed_when: false
-  when: >
-    override_system_hostname
-    and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    or is_fedora_coreos
-    or ansible_distribution == "Fedora")
-
-# (3/3)
-- name: Update hostname fact (CoreOS, Flatcar, Suse, ClearLinux and Fedora only)
-  setup:
-    gather_subset: '!all'
-    filter: ansible_hostname
-  when: >
-    override_system_hostname
-    and (ansible_os_family in ['Suse', 'Flatcar', 'Flatcar Container Linux by Kinvolk', 'ClearLinux']
-    or is_fedora_coreos
-    or ansible_distribution == "Fedora")
-
-- name: Install ceph-commmon package
-  package:
-    name:
-      - ceph-common
-    state: present
-  when: rbd_provisioner_enabled | default(false)
-
-- name: Ensure bash_completion.d folder exists
-  file:
-    name: /etc/bash_completion.d/
-    state: directory
-    owner: root
-    group: root
-    mode: 0755
+- name: Compat for direct role import
+  import_role:
+    name: bootstrap_os

kubespray/project/roles/bootstrap_os/defaults/main.yml

@@ -2,21 +2,33 @@
 ## CentOS/RHEL/AlmaLinux specific variables
 # Use the fastestmirror yum plugin
 centos_fastestmirror_enabled: false
+# Timeout (in seconds) for checking RHEL subscription status
+rh_subscription_check_timeout: 180
 
 ## Flatcar Container Linux specific variables
 # Disable locksmithd or leave it in its current state
 coreos_locksmithd_disable: false
 
+# Install epel repo on Centos/RHEL
+epel_enabled: false
+
 ## Oracle Linux specific variables
 # Install public repo on Oracle Linux
 use_oracle_public_repo: true
 
+## Ubuntu specific variables
+# Disable unattended-upgrades for Linux kernel and all packages start with linux- on Ubuntu
+ubuntu_kernel_unattended_upgrades_disabled: false
+# Stop unattended-upgrades if it is currently running on Ubuntu
+ubuntu_stop_unattended_upgrades: false
+
 fedora_coreos_packages:
   - python
   - python3-libselinux
   - ethtool                 # required in kubeadm preflight phase for verifying the environment
   - ipset                   # required in kubeadm preflight phase for verifying the environment
   - conntrack-tools         # required by kube-proxy
+  - containernetworking-plugins  # required by crio
 
 ## General
 # Set the hostname to inventory_hostname