From 6250c810211734a8814493ea3e902bdbb0e81eb7 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Wed, 24 Jan 2024 12:39:12 +0100 Subject: [PATCH 01/69] Update rucio UI, server and server-auth grid host certs (#270) --- .../secrets/rucio-vre/ss_servers-vre-auth-cafile.yaml | 2 +- .../secrets/rucio-vre/ss_servers-vre-auth-hostcert.yaml | 2 +- .../secrets/rucio-vre/ss_servers-vre-auth-hostkey.yaml | 2 +- .../secrets/rucio-vre/ss_servers-vre-server-cafile.yaml | 2 +- .../secrets/rucio-vre/ss_servers-vre-server-hostcert.yaml | 2 +- .../secrets/rucio-vre/ss_servers-vre-server-hostkey.yaml | 2 +- infrastructure/secrets/rucio-vre/ss_webui-vre-cafile.yaml | 2 +- infrastructure/secrets/rucio-vre/ss_webui-vre-hostcert.yaml | 2 +- infrastructure/secrets/rucio-vre/ss_webui-vre-hostkey.yaml | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-cafile.yaml b/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-cafile.yaml index cd2307e2..a85920a7 100644 --- a/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-cafile.yaml +++ b/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-cafile.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - ca.pem: AgBJodAahYPNppYurfKr2DqTL0+/99OiKDOG84TvJuQcP6QXIB347AnOum87qEHcQCAFL8NYcM5s08ph1Ok9rf9thPHY1eUxupeOuQrjc++0qqaCuWz6YgJAbPWG+gNGide6oNe2A2mbM8H9j3o3DKnk2VDIkhvmI4c+UCDChIuPCFKBe8NP1kk+A4zmynasIfR+14RkObQud3LXd6R/gGVYDG/3PaoO7jB16w0Npk7Fj8ikTokc3lJjW2bfizWTZ6TzSeDwMgtBH8CAjuFWT+xhCvHYYdlueHU94OOlp7f3vOMhxXlAvABDc1cCLYhHlQfqhYkBegoPbwSvysbhTdbK/VwLRizQF1L7B5Sii0GgebZVHj6AOqjaUFXv9SiWi87asvYoJTCMlQc1wk+rk2y9glFWONLLBVYRNuzezHA56fi9tWmPd5QjHobFTrhTvkxpV7Y7hjVPLB/fd1CfhwSsJV99q2SxIxZu7UEEzA70NteFJjTefKt2tdQDfvTTyhkwfJ71jiYN8ZxWhFdHXT7QEiD3374vBdWFP3HHuKn7nNjdER4hWXzd+QnH4mY0q/k9hdo7nJYTppJ97E9cTW8HrU0cFNvkT1QDUL1eJ+KjAgu3SXMgQq76pZWdET4lhjzr7LfFhrrhbhdz3erJB0aDsihd+m9f7+9ybdx/7GBnQRKiwPXe8FTxZpF+o3H9RCbpl+8goQm2oWtBaD/r1QVvG8sl6ajqWgurMb7XMgIcd51OI/28DVzwLYsXzvkurVHdtAO2gKo19IThoF0JP8yJrXvDiRM1U8D78+k01IuFqgEe2hRRvdw4Mmi1CJijnoPjdHQ+o15zyqr1VgdALOF/5X0QbQuSkcuvC8ztCQmn0WLqHAWJsQjp7meWv+NWcJiO1IE53SgRTciEayJA95mMY/ALUnBcLhPCVgqRbdVlsbhSQzQ+7dnNakUEzO/V0knqOktYxB0E01FMwMj26/KMgC2LxKaRh2aoeLxs3fgBnv6HZ5E2kgqd2x1JhjxvWKR5IWarVuSGfQURGwngE3KNWMP0rvG3s3KpyyHKN/6bduD9f9kiTf61IioUQ3EqxQYG4v43aMPXLSByxQzUhD5th47OvdwlI8VJe+lJDAb4PNIIbcfL+CAh6D3mMfOQ9R/UiRqLjDmKTrduSStAw077OqhwIsxIzd1QCM14VmNUekyUtyGeHjCm1NLCWos+HrEz0XnqWInUeggH0BS5bXhfVJPg0Fbwq8I2+inHHv1YIWA7dMkhOCzLSXU94MHSspFVbkr05OLTY8lp2t5GK96QIvHpqIcACSh1rYhT/tAgh4CJo3c7DQhO5RmVR03RWtXLcvDiFdQATiMiROOQOxnqwZ/GyV5I+RL9SyA0y3xk9Taqeox6UtXFEWHPaBtSh61X4Wq0TGfW1+teP6CA2WiqjIeJUQkNf83ntF5kdg5iXybFJq/2PgAw8jr90mvVQUF51muZ5GiKvjKbUDEylaElhSEuzyiF3kfc6DB2alqgh+g3TEUpkeygaEhcbsMg1tGLGwRjEZKmQqIZ8GcEom6CtOTneyP5fdn3nMOqSZ+HoAsNGbtQFDrr7erpc6iSRKRukpYlfYey8y8PK4knixv7Wu/0lLX1rl71hqDH+y1VmJkNNcvXtuZFO4nQnoksZW/H0UvYsl56PMLGEDIX6PhJKzZz/zfE9PJrYs4YHAkGOvH0Alv82xJCN1m/EnwMCFocnMIO2tUZrWgafDh2I1CNReTr4bTq1lt7dygF76i8/P5k0jl9CwqavaUOOzurtydKdDEcNSROLDAaCFogR0o0TO2ZHAJyHhJTYd6youhAaqps8HAsC0jR0AVYn+AFyM+GR3OrIj7wWKkZzK8Lg7GBuVg2NCyG3cEliVQ1TWRWgxFE/hdm+LtcK+Ud78+Mph6Py6kkP0nMswOBiWUuPSOIogLKvWabUNa2PZHN4KsFCRUebvpYxWyctlKE9GDwBjHuo8d7yunI3ZooP9+ur9fWNszGfjDYZsZ8z5hixpi6jASOajX6vjfXjuJm/jdxCr6aZQvnW9Aol+Yo627lGhROWcRHrAgWTYjkhpusvdqC5cMptYzk/GLAuTVgMwMRLAVPz64yphlzRU9cQIY/+t6vRgZhqvXgCu6UjbBz2/KFde/GBN87Yfd4dq1oFO7jok/3niErxGZ7KN0OgfE+zsZStzvk8H1cYhezoLWwTviHHorXVcB46GA8pPVG0Lcagth1/tjsyCOk6tVFSDx5ZOA6lfJwVAoXh1OxiOnh5EbYFwiND5wOBlgKIaI4orO9WrS1TMFJDwPdJkMRoAQ7fi5g46yflStuzpWMjisNpYhDc5jbOncnJkDLHEu1T1jNghAKiusr62ZZMC8IqwLLvaW0NQ1EV/B7y2dfK1+ZLUJzZj8wHPC1wtLV3z26/naegtrXWRCbN6avYDLlLIqULtkIkPlnmutqvqwNiewo3jZf95nnviswnW9mcmgA+XoW6fgoRzJ9Edd1HUwl9+IvNtFX6cIGSrZ35YMK7LL7hQsjRSMXpdLVAqVhCSuAT2dfTRK98Vljb4QMHZ0SEGhzOVa7zNxry2UR3w6xqTLk8x/OkNoSbZjyxFpMeTRjnWVUWFrNtKIu1U19QQmzAmwbvn0w/wvONXWE+oJcR2ky8hoPeKIUBcgkYTPx4rDidOQoGfuHN8OT5vPKd4rnJlJWVQQ0KjmLiGwIgdvYcZhSb0DyZgG6AfKM3eIaoxXogOW5DaMGouhxptnjxrH1xQs6AH0tDeNWXiDAet38IaS7zHCSKxJhLInMXQbyPd6vAvL67WeC5POaFx+Ps+Bb7NqJCxfdakWLniPRQebVlieuv8UjAT45N2cBOcMlCAZWx6eCv7jvFiewzBjeB0kg8dZvQA2TJL0mMAsnQ6CdvYGRNx+mhZu44MhCVxIo9J6B8AI70uve26vL9MWn6SChH+7QWBxX2d+uj9lk8m+LTU752Dxf8re/qklX0kNeKSo2MGIkh5Cml8pBnPZiMKxfc/EmWXrEcMTQl4f7LpSh5ZNdWfKIqrBrDDDDUdYNz1/7MWmKM9P2tY1TuImXxpUtz+VXgQ8jWmXjObxrewZch9qsF9bES8qUfMOx5EsfLfKucdfv140sqe/Sy6xar3233Mk0C5yfP8sf02XwQjUY96DYF3xFHrZwKgh1lZq7Gc/L8tKRyUVYFnr2ZlSAsGTsek3/pPtwNojD3r3QrVTZ1uwG0Whra49a4jFuezkg2v8WJ0eEBZi98wr7fQ2EuWXhN5YyBgmQreMO7gSjPCIu9HigLCfRIA6sGs2TPOvwTwm6LWCPYYjbW5uAq11s9jWgDv4ONfDAeNtahEdRReJJwFKwozW5CeA6QPucNwwK7qtePfC9pFNSBvu5U8Ipo3Rqr7lmbmV1TmEy4n0xRfO6HrndtUElTmkqI9LIwHlqI0Da8g4RTjpdSwDtLsmRt5U8Hs+dCDLq0EHxnZGZbaPEX/Q5PaS1bD3Dg/2wtgRLmMDJuCsHEXuDX422d4xnKFoTurT8PeFe07OqEhE6wPDueo4yi+HndeCb0OzC0RbH7gohkhwmjjxOEuvLK9TyqZ7y8ZBLMgukaYBw6pI3FuLGThP5lm3bexOG4cg0j9Qy9nYkcE1qec/jP2OnnAIEUB1b3Vq3svvdIgSTIMBkSx5K7T99w1qIt8SYvQfgGnu0SHlpugnNAK+vD5V7Ea9TYPX7P5AvbSjIhguwo0fUNYZyGf5rL1M6b2Mm/ly/a0vmjl6mwYQtlhC+Hp10eyE/Cxcn16mu11nL0d4NVHWxevGU9QT0KWQL3lsG/YP3Mq/qWRru90+1FDE0wJrphNytpbEKecwcRJ3h+q8E23KGRHbg8iSLIg/EGpjDQIB3l5UGKCSSMeIbgmtVjY4l7wGhi8DntZ3ZmkJZtRb8of1mRIqJVoLXFLSXYBS1yzkAnbGl6ic72KuUUp05IJ2MG+f/iv/YMcQn/6+uBfi/6g2Bp/3dLsSUjgRpXxWaDfAGnJdrntRuldQLmoqTELatU57TlpG2IYf54q1XgdBtdVknt2vIbLrVECQUsue9aiGRdxXZyqjAFEVujy8KcYh2CetR/ewspdSZw97sxfcIOxV7GxVpFixyDiChdBK/edTovPnv3o8N2rcUycSUBsMePeOL2i2OLv3NE8QdJiFHDYbRTFYo9jSXqal+J8/jdmRRcsc1bEJV5x5jszViCIWGVG4bXKUYVoEJVT2Z5fgsykZoAMZq6TXWo88oaX5VO9gfoDLN3Sddan5hVrrkuPwCAbAShE/RkVdIkUWxCstvyg1VGXicsLrhKhZQ3OQhJMUV5mIq9kYpSQrQxnqOrToXZzB0UQzCuU8J2LGv3riXwXf4NvZh/MRonfHOwAvey1D4SXA19639Z7y6J8/OKqFNOAuxkVkRSSFuFn+SUNe0VYZfkEjxZQ3Yv8oszqT7J/ujxaYMDTfwyQD8rnKj64Cs9K+CVsB9rZMhbuZMwHtcj/3jl7dx25aiqD6LgUCRb9UiF+mpEWIBHTHbjYHyQ3dy4LpqcinjaXBXPrdOpLteChbm38gjqgGjeVwASoXGDkb3xxynQVt17L6jodUJmlNCBuVHnxivnENqwBl8u/MSF8cHna5iQe/snXz+KITO845Ru8woaCOP/wRD8YeXLVXNghMeDbGfA4TQ8w+4eS2zvndP7NBxe4fBV+xWFUeGn3krDSZrSqnFPXQBTVH8yZdrBHeO0Ig3bmJwm7eeTsakBucqRp5FwthPuaF2eONPYt2FG57MrRYkuQUMgGjc1S4sH2kBDaK4TKKJI7SIuQM78823t1+a4AdQG4U1HNVXtHp3+jRcX0X+QWv1kNa+0FguOKbkjEXX06WmLM2T05lly2HaAZEy0FNBKSmlo6ydawTElyRQyCpoCGINtB3BWIxGAQczhEqZVz2HvcC+kmVZOiJbW7KQM4p/K4qFsLYacB7mBKoNnLHPc+rX5rDJnzGkK9UWIbano1VwywMBOq8sOT+qu8ov0bBxW40CIGRs7wGQ1Sa3hUTNgZ/tcuAF6Wz+9jzEGT1Y9BwVMmU1BPwXWinAzFoQX7b08l90koMyE2YrLu1a3O0Ef1R4sy4TfDizLQJEzDevu66sNQobonxSWF00YoAYWolMys942puiwP4s9FUYKqGs2YClsQGzgA45CVOvp8F3gciV0+h4NS6Ofunm41Vj02nRBUxFxKUdVftOUcDHfLx5XvEiI5KwyXyC9zH8vH4CXSum7pKdNaz1OcIxNU6044F8imFHtzXfSSUHyfJSoBZieDrjx1q6VN0sT10O/r+Pnsp/R/J6AA4DXH2K6GhuhkpDCmFioz63vZcJHTOPFaRI6SRHcAUNFxh+JXx72JkgmWV1uFCoiZC6QYGKstCHuo+iKHHFXqYS8+jdbkwt2BginPjU5o646SQB3eAJxGiL+arwrNvgNq86lO3CccvmQcrMHQTQFlZAHsmiyGshDFNIufUywQg6xgduYCAkRd0trJNvib+F/Ewemce+oGbJC2fLtFszpbnnEKt2dRMxKnr8Qsa+YpLGWMtEOQZyMwcyFU9xdSABrBmiYljHkOVa+bCZGupTmY2Tj2jA2wf8X6PVdg3iN15p5E79IJQ0ZExyJh4KB8ScJN/kywxvbNPCzABWY86hj7I0xTU6TvJ2A8c2ME/TQbrKJ/RDaoXXGVq04cDHp180XO8yqjPcNcs47tK9pZ6t7Mk0ws3AVaTXJjxnxNM4zvtptLYFA6XamWG95DPI8cShntTOJfcO5DsVQ7Xdqt0xOZh3Y4MYDheYqyw46OggtLM1e4swekI9sUdZEtApvhhJoxq+1ixUdiRHuUzAPX7YBqGj1BVHR2yLS3f7zaO4Zs6NoJINs1XUd1tU/g6PreH6ZwoJyzuN8gtrmQgL+WYjYOE3rsh/Sb4BrJ1CoX7PGS5rR7ZoQ+Y4ewt9hyV3TIrhzrBr82w/jijXlLn5gnv5JnzO+EtrTumFW4/OuFh+8mnSgWa5d6Tleajza6+LW3AfwMq9bpagi1+UaMN5BZYL+172CfkJjw6ZS6jJE5mG6gLSrf04URgRo1RJQWicwJuJ7ZECVBRLyhBZe+uFknS3E+C4hcEFyEd6qnDQ5uPAFjOxHUlIfrnwTIxaA42xQILZ2OpiY8uM2g4afjM36AL/Zh7Q1ODYZilfgsLW+vDXHzz3fyUunWF8k5fNxEXDWX9vfr5Sj6bXVYta84xn43VU2407OiE62d9JlHbJaGzDumQsoDzW1O97u2qubQe6YMF+WKJC+YO2lDGSbU3CydStpMFWzOcmH/PpByp9c49hOp1F/uS+IlT2gK41PHcj1dw1q2SdKgJwSEDENnIPqKPzUZ2aYRipYMUiS+jMYNFERsksR9wJWjfA+Pbm0RhuIanOdfBL7/we//sV5TA1xnTCVA7IlVGStMbVjpuwfseP8Pe1SRYpFU5GdghQBeLiALVT7ZQPdfPg6F3ymJ2KoFdThZFa2gZLpENzYfS+AxNYe+unm38poWJVuWwuEnKhALWocaJkI/5JuDYCJszt7m1olKkvhwAL19DwVX52wC36NVYyku17ysEkNAGUbrK8jQfMa6N0r3mkrrjC7RcS3DwBY34osBHdXs7jnyx3gRajBYVYi2ZXR00ntnM84N/BCfbaZjdmPKi/pE+YBJTYA2Ei1uh9jQsWmhJspYKvoGCm+i4DaG4ZULQIViCXFUSs19OhisFtssYq35kBMR6DQqtQwSEvJe/qb0/Ol8fbAo5sOe5ggKAljxzWFfvyfUg3FEvsFZrlzNe4vLGHJg/DYABTXMvNlEUWLQwXvSKFMYBDrHi99TA9nOH0Nk+l7E57r/d8zRwwFhhBKhyZDQfXT2b+DjwK7au4SNPpGju7Q3M8b3NFnM2IVG1Got8G3aAbNq2h1Hvx8pW3Vt8eSy5sQcuX8gg1aLXIvcIAN6IOjnuJVC54WkyD2V6XnLQyq1yOmY/aRZg1utjd/MStJyBawaYPxnDdjYpirmZyiv5n6nDgXNgmyKtBxJ1XGlHesOzh0EFVv7NEj49/bkfwMSfPplxpdgLloM5Pufx58Wuk9dOTasqYpTZHJSGURpXWPZAvdo+pH96AFFLH38i1FHKUdb2m+Gmx61UEYkMcgM2VUk74cuyHjTg5yCvrcCwUPvSaRsc01Sb2Y6IeVXghpZVoAuvbYoRMKu01eoOb5bojzrXB3gM5A5PLiNKwmsZSGQmgy5ljSDEE+nGbiAti/Ed37RxGRyaFM4J/b1g2RHRFwZNsUhRwnAN/qrCZZBHieca0gxRz0NRB8TgwDP8aU+WcF+1KAYDFj9KWClskiFbQBGRIHUT4FkDqhqTriuYAGXJNPGjH1kmnO9Dle7qCx8g/cqwmNywQVcK2d1q2s+F95pZaFd9uWdbQOJKNt/9sEtM+kr50OnPoezY9IrBiQLGWVlZkJc4F23RGf+Niky1aJta2qzOX8tr4gajKpDHQo8hHLCtzbI+Sih8mfGi/8yjsO4931sX4nuwyED5ha2ZNsdONXB3lYOdFaI49tr4MN8DRjdDXjlQ98l3DvRm8RF2APC1B4tsxUPrVLEFNOICH2C9aXjHEwFkgSYqXgkLwxvH+C1gfBr+ti9wJWXr+pzYktSTTrz0ZDBYTIZV0SplC6MlxLwCBGaP6qNlaTfpKcFWldub1J4NwnIM8MpEhtGX7Ax7PFUnHUpLHwK03zpcoxD1wEWn2M6VVXNiMCU0Pk9lFE6XJEVyfBCZfq1xZgRjJibORCLAoPYLTSta0Qupy6ks1dY+KyQnGoE+6D1P/xVrRfJms+t0hRBbr2B/7HVK4srdxVJRm8gRHQT1FiPmxVVahVrUadtC0Vg5rsAK/de1ChF91vDZE87NUlqL9piZbD83Cx0nqufz/VxVBfLc6Bag2inhS0hXVASYhwrFzmexZ4lEK9AU/9De/oxJM6vOB26tWDnxjcvEJbfN7gJTMJUzqW/X2+rhhxCSFmlXLNaQTKBH5RpPk+ye52g96RkI35T8AonbmvfwX/WnAMzjnk+MNfurJaHiNNStMOrVsY0kA8lj58iJokAQvagiSSJEzgEjJ50q6p10EMIUWjZHpkZa2vgAuIodMsn8QhF+9V29P4G/zQZ1XY1B4Wl4hugKkCLFSrM4GT4s1Z9MxftDF8lVWyXFllExlaR6KN4JixUugns2Y+RffZ2VN1L5Srm7os6SMbM3LkPH0MCoCxA9GxEkme73ahOyjg+T6lxaiU4nrBVIVe+u0JtQdRnyD0z6U1OhN50LXKKf2nqzWV/IBH5maTCgED48LZEtZ0Od8OKMxiRCeQZiiW4XaJM6XK72vxalef1S6tmH4bPIyjySdSIIiIv43SeaXvSA4vcl5gBeh6DZ1qjcHH2493t3rUPtPumfzL7m9PKkWB8y8BzFEw3/yHC4qrP6Vces0jj3JYdhMXeJZE9xvjxkGUg8Yz2MNkipwSFIRar7mCDOFV3vK3lkX3UWpAFpeLK+1xHrC3Ps30/lOlwNGsHO4QO9gPG+z7v481QwNmwvvfuwqLl9rdrB/z+y2BFVS5W4M17JrVZeEn2JwFrDQiAEn0vWXYic0VwL7c3O3RiDezBFS5Oml1ZebIoVvgtxmDEuo+Sc92XPzAq3jRYOObGlE8+L15PPTCb8kVqn6MCmIaTzb5rPR/CZ0FmqezeTs5eWIk/EeoaXIx2XTtgydkdB+gDocLhkAc1AXA27H75Hz/qaRDGV+68X8SBarUzjAaT8vQPQ61bE5x7yebEayQ+ktshB8ymAI7g1Ew20hEaiimLS6LjhvfmOuDVaFdQP0yGDp6wu2ZaQhgOh8p21jYEyZ418aqQ6usKuGLwrePaMvwgXSdknIr5dvWYa4JpfPUalr09F4UNhzTh0n5OhAR5EIDgMqvbSK81Kzcavnbtv2MecufuQqqFiI+QpzC5fEuTisIIiwM7FtwG3e7Qwq0ZBeG0+fyVq931r/eTTdbkgFB8zkNsCXSuu5zYjkN43ujPhlQVteq4Er/gLpatKwBspaKRT+fG0arbj6z5TmR4T0IvnCq2yC4jsHPHsn8iH/Ma9g4+01N9NM4f4cEbULSyWl/AomZ6di+flXdYHkbfXuINPAHKr9ap2Pm5lIQWEHuxt001d0jtSex59XY15QhBqcclgJoFiOXsM01MScc7ZCUQOn/CU4LWKXuPCmHyIchgoQd1W6a1jsUVcNeippzDPo4BxAjtmK6CKQr/P1LjZb82rxZ1/VWQ4pfFxE0kconzQdyTTbBWfO7MchY/CcHn/nFCZ9vISSQiU6D+7GnnrvCyZu+vKy+wtlZaWRt3EtTlsj5LQGoUhnI+D9svMpX3/4fHpCc3iwyQWcHewElWIglHzq8HSWeHUvJ2R3ejeQjKMCO4cMX8VRGEat/Q13eb6TGNHxB3l4z+FdeJeWik6fpTFx4Np/ycd0hQwk/ENhMpHdxVC421sxKQgECwDIzCgk8eH8BRKF9TK1yLZK1nZp+/5jWiqAnZzPRMzZut7HunPrw9PGBgehHn03QFXz8sAx0HICyyu/ThYMDtuwat5KIr6BMh7wyZopKMsQK72KiG5K9jyVs4tJ9mB6+uJ3ZL/yXJpKkGRXA3glpmKhnkOWl4nBWnATDrKMCnHlZ60aBSjDV88EEuUDUSZ+iVd5BcfoefPKcYfBuYpNnotf13fnhikcsfLyGRAYLiixL2yqA/BMLfRN4Q5a6is6tlL/1c2MVbVot31PG8YGF2K5cnbzOe7U+5eWKTa6jH+ai25TmdkCE1/6ZfdS/fN7/y/TXo4zzdyAQtTgGPMjes5GZznOh1F4Zf6ZcNlk7GM9//jSB/neHAk+sLshGXt3bkGDK1UB3wcZJLXTRsQ5Qj17wPcsRSajK7+E6J7pEm3GzrJmjPjqAUUtqVbZLEILpy1HimeXDY/vrz2ANIiro1P3QlllOROUYxKkDkPLHyQ2eH0p2CjIazb0Xg9BzEY7wwqdrs/Hzm6L0Y9InkaLmG80Btv1y0/Zb8XrfM4buoxN/7SxhrMpgNS9i314de8CGjJRp1/aFK5XIeCfF8DIyIWQ8sH2bV8ZfVSohxYRk+pruR612Qrrbt8Z2HaAPPiCqFCKpu9EchwWiBJVsCSkCk0XZ1Qg8JvZWRm2u8l8CkY9AzIW9KaBnAQLYqJUV1nSv8dcHFrskfCDyM5PJopLk6HSpMgnGrQ+WECGBM4FRLCKgWTJ7pc7pm9pafX7adXlma5hgbD323MuxK845k4VXJTP9O60fKOkMZejr7gNbnthd8O/RQWqz4IXrAtiMEW7ngwcRyzTyiQrTBX4TXRzXcW67VutKKcMLahb1wFBr3q1bADzoRAd+puHhKO4lGje8O3/qptkJm37O1CPl7byoj+dXyjOnDqCjm5iS9m7b9LiTkUZjDU1WOW+9Ikl6rS67dmhDWgmgiVwDdj8j9LjEBxs0NY1E9EIvMKOrXOgpR0sjw1KdlG0LSrojVPWb4enbGt7zlsbO6lYQhg3W5NzhvPuKqVydBeA20Md0VR2n3fSBBTG5QsXDMOAySx5qNp7M+3nL0PG+h3p3hPYePApTomDM+jL1xxNR8hEewvMaipmC0qpiQ8SetH2sK0j3v3fB393tumn/ZUHiOL7Wf2uX/crbv/bMTJoZ550rANOR0j/yFFHsXqCygXFQ6ckhJIYhhQ+/Ir33KVUHsJd9jTe0SFYb/b/qBWMCsSrtfuU0LYocRwECbBpFn8H3DZRcTGkOOFJ4j+FAgYdkjeV6NA83XIZhL64z+6GSON0DyI+oBreFZU/Ohj0/w71wWi+DqFG6YSKikN43pEoTZp+1lPWG8HWiJHnYRgep+jENEpE9aFIwq7B9AZDeRY8fYt/ql1nLEB48eH2Suz75mqZn+sG56yxOdlbwiEsKcncUNAvGjqGA9qXk9rYI6yu34NDHnbWyvnLY+eMhJZsmxcSIWeiEACYHV4qlaGWOXanLqb+dB9r1XRFjCj05+H6zpTo1OotPiCNdxt9a2SoSjb8axhIhS74jkHcBbMXWV4TAqIXvVoUpzr765Gc5h++nGTWzs03/Fq+qxNovWlq/xj1JJGRi6EyLrM9m/FhNtR3Um42ndki7G+2Y9ggzRGhSdmojojitpNesmYiLCVjd9A57ZCMC+L4aGGNhr/7tTV7dSG9txgixv56xmd8fjKmRLbqSjiOmRVbUHagZaD4b7tcu6AFhrpjOdqa49nZM480JdVRizv2/S6WyhzTVUc8gsigrGbIXY4mf0hFIX4frdWvLQ71twKyrbiEEwfV/cbzm67KPj/tf8poKSagNNmQ6R4Dv3WfObZ36Ni1B/0h1Wz3GrreHhtyWQs5h5ztzSTIwQIkCed9kqmV6mKmTTCkGNfNSQiE8NusrDp3Sj/4kIlomecjypyF20+RiW175ApFtdpJnz4RwGDKo1H6iCQ6DhRGh5/oZHZLdSMdxDG/8IzYqz1XNx16vuIl/3qjqrtubBt6p8PkPIurm/qsbTK1pRCaNwexwWNgR8rQpW/ZQBTzyjjK8BP+eg77885Enzk9l15ntipGgzNrArFeDaTLtS/vn7qFDy64DnLsd/JAE2lO/jFvLzMOQls1mlHCsVBeDLS3W9mN4Jp6MhVwSadrCRquYxe/b60HlYNMSSdVy3JoSkSfWAxjb5RGSlsx4VdMPJ7Ez4jsl7eFvppLQKC7KRc6TvM+6LnC3XyYHip82Ho1k8xiQ8jBwp5zRdF2NCgmqAnD153ewYk2iz3xhJb6uX+K2tWs1zV3xzYEbQhnXBaa8TUgKog51Gd8UsgsfncydU8wtHzgTpjWEib2OzpBVK5VA0kiHRdQ4f/UmG/XdkqsODHwxtn/hZYICTN0rJGXqSXi7x6tlmuS9xG9T8GZ0kX3fon9qLbjfBFYSFJ7B49XuhXopqaPThMgK1LxUSrIc61VrRxBYh99AIdaYgL8m6Vo52IafxdWEW82uu+lCriif41jNOGIlPEPDvm05JT3IlmfVAjsoYnMU79FTro1L4O1jak2fb21m1YCrlW5GtuoBDL/rJoOKfbMf0VMDByoURkGgQS90lTfwZszsReo+d6Ml5hOr7gmD7g0AOICrENJyMKCbCTGvPqZmd7BTBXibVwk7OByEHxA3fRdbL5E5NVP7/tJ+r1xvOTN3xnkFweSZ5mrV0anxg8Te+UTQwnhcVZ187SyrH3W0emqzYB3osZkxGoo+DuSBbKagZSUtpDuj/0upwoQqo4voqtlmbk0r05A2AdsGtfNZNPaD1J+17anClMmYLqC92qVj0NWSMM/39CnJcR3lmde+yKbNKcWJ1CAgfkvoLnMGtsJKEp/HzA4nXou3iXWYBSzglUgfnWagBwihFJ2GikZb6nc7aj6WAFz+Hv09FKvEtFK1GngE24vXoM0K7UaykYCY8OKpiV4vesVI6R1Opr/4q8qyNO8OZ+9DBPIfVtddfsmGSUIoW116JC/ELRAikvhXQ6LX2pMSPqRP6iguQinU84on1Wt8HwGOdH3nVrHFqNO+XruHl6BaQ8uVcg++k95LzcfH2DoGy9qLfSfmMdTw1aqPExrQtBthGsTu1IAudJaS7srDCk8pa96prDYLkpB2EcRdskAM8Fxt3L7qlW2lTyZxQNTC/Gqq5OtO09UdLTsnorB2YRQaR5oxnN9RMGuG1W5xX0pTloTubneBfngLa8de4g9uSZUKMtf44pbeu/QjOeDyMcfj4qFiS2ulZZBDGG64HZFOYAJFVPIYt/dagUoCCqccrwF79qiJ6WLaroywRKc7BQrie3Idfgv2MdXdDaId4evx7G1PtuPTI0L5JTf0tI3bisnvTsY92+mOqIHlg3ZmwaNf6gYWeZ7/B1L6iEB/Vf4TLYNdOUqZuZYA9UjLcmvnpUUjBn1vGKzlmILps1APxq6W/xtpZdk3aknorcjv0dx439oV9+0efVCJf4EF5eP0myBVRQdFpUYUyAPsXw2XQPS6Wny0q98LcCZix1qaQ7mEu+54ZIvpAeRZYwoIgpZsnaX0BxLvhnYJDvmq9tbC2u6AzEAw/ecxWnTGzqDua10xSzZJm1JHAVZuxfbkoswk5sOcHUqdU0c/Bt6EXnRDOXQOVRZcI62V69h6ziTv8YB6tUQ9bj9Iq2HM0wU7uc4FHYVSXYc0sqyKcSDaacul2tDJOjrsh7N0nh8o77ehpRiEk8AH7NEi3fxjXINT1hTmGASBi9FgekvisLaRlhGsSO2nzaPbieSZ3+qZgkOhflobAGH7KWPyPOmGllpnCpQiHakFYLUBaKUqs85tW3pTuD4XC5qHebyMW0CJ0MoMWPAiwkF6aWz62zdIUEFf5N8Odeeb5+AwuHN2cKf0sU6QiCl79aUe/Wqd23Qe0iZppP6occb6hnSIVJpeY2U7Gr86gA+HvSgEOyHbOsuyobA+CIlKFsok81MbkZPQVrPBkbIOiPeLf8P57pGhMKc7i6OHyD8q3k27SwYtHetWgTjlDLa0QzfeO1TylbDWI+yQyPw4uXNV3C6PJFW2Mde/fSkFxyO9eZhADHHdAybnjUug3/b5pHl6vOiZOxdD2GH/NTDqHRaOxwkKJOJpF6Lttk7FNxDdN/2kpPEtAnT/1Cy0UU55TDwMd3eYYQ7B/utjso4xzHTznxsnYFn7nIwQYL9ZbX4VTClV7G4aZJXeeSfHHJQ9zei+q+duLKTNeFan/+CgU/cky1cKaVTOpTKPn/aochiyQDRko8lX1jccmcuKV82EFZQeYwzvL2yfGibBD1TqSHKAb/k3MQROb7wKJt+xKCydScR8YT44SmNXCKQum9yxpj23KphypxfIxtK6VeyiP9DNOR1uyapeNoHy9lH3DeEE0PhU6aYIs0SwgQPIy6snhfDQxnrozTzPCOYovy/eAa9LQVi7xMv5I1ujvRHngH6vbgMbUqxJCqx/DyUU3pOTYL8kVUuSzrdBaLkwNct/eVHkSNIZCnRnScL0KA6cbgUff1ppBs+Sux8Nhbr405SdEvTiXToY1i3cN+Ns/pF8rKYxW5WZ6GuehR0fx2QR/3zcjGyfObdcPdP5nQmkk1cDC0i7ZSbHSlDaSnMpD1zIIB8Wn0q6v49Y0iXvuNNt2MaE/fNDYZbziyyhFmGcmXe6d/fDSmRC0wUaTGgLFPGC0do8tet+Dpu0d/8j/dQ6T9MtYIRjWWH9pwmtHZof+D+3PzAhyvjX8dAUh9IWMkd4U+PYEztcSBz2HrA5sbe897MMtVBGC6esKInaIsgtNgIkdaaVTQBgNjoTbuGPJDSmT6l89/q6lk6IEeI3zQeMIZiP4EvbW364c6FWlt8xCZaVDpC7FadbGuzYmRVG8+3oVCCO7gOjmZaW9iCht7lwA+bY9nvdvkt/mG9SQTqJINFpZ3bCIu08DEkjC3CZml8rBmgvd7SwoHzvUozaXCOqhmTN3mlINHRjvBmVQlE/aKy0i4jQJjn9u7TXsaUlzWXF8erbwg+PO3M9K9sDyh0hVvxNVRiOZjTF33ChQbgd7J6Ed7C+mvq0qAySGOToO/LiLyemME3LC3+gLEuTVkJvqde3Z/ZUWwD/VEWjPDSzBInUOqr0rqb3whaOlmCBdl8RQnR2xue4m5c5KSwkRmIZeDOFTIjTMnAIJe3bn8xLBdgz6E= + ca.pem: AgCuIB23QMlqfgV8Jyft1SyURxQ7t0TsTVRy/4k3Hl0nqUNZOctoteCkpq7RT/nMt43bcxUThIbv86I96G0Qz7l95AStYrcGXqasvRCVEI/p9OvZjRTebusLq4OOaRIPUMMX4t2FrWibcNXX7wPFjdZWOvL8Peqv5JMHQMeFK+DTu0N02QycMB0Z2oXHANh2JM6y54lu+UeZzBQSn0EyE7A+KMayR6a5JT0gLUi5ZqpaFtdSTII3dIENHxXTEVcQULfW8xsBmaYobv1thSSEfBYlUYOLaOoAlrsKa33Ql7ECuUNxbGjFJ+u6VnwRxp8qXAuyBcAkZj9dz7iNz7SWGXthu2bsieb1jtNiOKyN/5gv1Dun9xZwvZMq8QSncuAPMxo/f9M4khqPMq7Vcm2KnWVT1EkkRRYy5ZOhiO3qkWtij6pXLyCjdPLf07nVg8ZKPABSDCLml5sCfpZuFLoA1bFQFQXRPHe95foPfX75Lj+VjelLD3RzPm5lEoUGJFisplGtC6PhCLmgeSvDJV90so5k5PpstzoG69r/9M1Xp82l/fBDmApSOC3cwIgHVC0itJSw5IhSsYy62XABnoRPatHMd/dK/WIAWdAkej2z9jp/M2XNo6FLZFkqQ6KymsZRJJZI8HlHEXn3W3OwK23sGsDf0bVvP2bqWp8u+/T89s3/Qlwwk8BJOcr7iqg79lWjv4RBOWod5c25Tdlhg7alzLyJo9L1yzbSR3UI6EXujX7gjip4vLGbUUCk95oJ74oaBPDqcevJZUARaVNHdVHt/loY7r8IUIPh2e/J7tak31MRTq5FEo5qNWaRgpOrA8XoYNURg4hzzBwd4B8Az8Scc5WL3ur6GSOcUvjt2gDgnlqAB0fyjBz6MHhpUp/4mJ3Xs+ksiRZYFJ/bGTzGazOd7ibhliO2NW1I0DfwCmK0xiFDoG8GxPn7JOyB6YmEoK/GHC+ve21SVytxJ0jKcvM9ML4ak9AbG3I1OP10npTofdtB6hpVVZxX6lfR4mJA3Gpm0UMGW+5PE7U9RZlTquyhho+Kfri+UYytfs8xTy+3dZYmGkOgHC1YVVXCsk9nV7MIe+qJyp0vBUU7RpmjNYX+Hiyeksny7sDkELlPqvkiEdkbDdDsrjlAH3S2JAC/c4R+FRegDjJz2uIoyaBhyTcDlNb+LsDazY9pcdt1Miz37yKduE416FULBHzJ8d304VewhW3YMioryoebYQCwI4Qec3ZRD+1s9edIUapjaR6MJ9LKBmZ6gd9rJX+xSUPLp+ewj4ZVlmidKvvEQgROLzQMLAlj1ftAAskDIMXRnIKiv7OfKAj6nh/3rgfVj6PE4KKssnedbmWv9Q9NM5pjZhB2yzPuhxxM3MjDgOUZ47V/4u3PLnp1l9NCSCeYFePlPk8F1jzu3vEz5kdAtFB4tCYZcWhRj5FQtBRQSCk+9ORRrmAk6panuLJL6M021J7SjESRcUvMeklGPeNmj6Gz0eSWAdJ0JlUDun1s44bsc6a7QqEocayrYN1FCVs6InXEhk7ri2LWJA1yrDnMQ0w1kTMG8v/CCXrIez7G1d7TizxiPJW829PnE1vInBcrxsVkKJSovqJSdaHHU9KmfWyPEv6n4McrqVLbwPlCL0Yx5GO/AK4zX7nBsD9PtwnRyTw9HNObnE+5eBAuqS+bJrlJPPfv5wSKU5zrj2LQNpBsUTIxux9oswCmvjFtZkfT3pwqhnXXVa/CCM3mGB6HdLrqzSQ7emZ+ZOgOoJWXshXXEPPsoVdqobfcsB4wvTUt3oyXmoQ3YrIBghvOssnCG2wrQ1WUe0HsrhxCQn6YDiejcRMHSQNqLbYOCywKe1M+/OCTHgcJnPoZpTrqhW2SW299tiuGnp9GCuVm+sczNTRV03HN+XSRwruSOsArYCCGbablbeRNt5m5jlIGqbO9dmAi/hkcQXwbEwtOqDuWiizVfJbKd1JIZcrE0qhKOFzno0tqo8AGoXHoVnaDIxO5Qa6wL4Ca207IlGEtUFQkAtPE0kQJaWT5WbL4ba4w0gRLygGeGycVUDnICUvLqps1pIbnGTf2kBiOhXcIXFreVfk6xgq3iVsc+b6XNLj9YWLLBbyAnzzDiKTPdS7fKX993Jhd4GZ8vfGi3TLtLXJvFYIvDrI+dIYH7pT+0iBbC7S+56HZzFjfnJzA5eS46wQtmRffL3/Hq02GQHO9qnmP6u/D+QqKOPRieMlxNaTujjqIM0AYVTEk4hykD2ohrA5x1l8qctPloGPksenVKxFo3Dct63ByJXrQUWNcI1RlKxx+nq9LbbelT6REgb8vIzrTY4km1M88Vh6z7HGpsVGqdD9QqVMmi6ocxS5p8Q7cGJtI7k3MdIPpVmFSkVL1O5uncw99w4tMPxzJ1w8zUr6OzFZIwFzyIp9lKWX6FPfrT+BV3GQsgVjvLVPlNh9Jbgt6wlCOs7GCf3fl3ip8nt9TBzgi0x3mal0ClDCbC6MbH8ts11JqLaOD/OQXHmEy5eycl0344mQd59O2bZlbxhV2U4R8EpmOzrd8UDwsDIAIjrr83DBnizIvsBocOMooWUOj6F6UsCxjT/zefofQfeO8X4tVvb/q4hwiGAMzxleYh5FnHlCMxHwdPJZus94FY8YPVFYjA9C3PEbLrl0AfOpCbC5dWbC2kZsd5fh6Tl1ER4HFBCE/Fn3afgBIo/01vvASybES/N+oGm1u/IFzf/wBAL9ZGxNR90QQAX2EUpLhS4D7XhqO6Alt4l8HCqvSutF5xY+IIBOI+FUdr7RzVaMxebi4NvcLuORfIPlrWwhiI4E/8hH1Agk6ZOz3NH4Tl0gZzXkGJ8b9KtpCNBtG/hn1/td2xRBo+NGSlOnFqzwJIPhebdhkD2553AcVVSxdL/+S2INBT8hn+CCxqm3I6OvqUNDFLDnq2ITuoWksq0AMtEL953yYhY4Vw8wDR0MsAKmOg0S1G/RZqwnR3uSTTFPP5Tqx7BRdd+PAbONRN1WH+U5j2kKtMk3ydh65/ok2v3jRc6PPqh4E4jbicLwCMNGoRnmYAxoDAdnmQLvcE29k9C/B3QRlWQAjpFqUKZDc1yZfSdlGenGhXiKwFU53grAfa00cndRFkGnNiva6WzfsX0tFpKVAFxA0FPXTRoWNgF55dy9V2wD7tRPIu/OGbDLrpBXteyLa8YH53dBeLJRgBkEVCb2Cp1j5NI8StZzR7Gu6gc5XR8wUVbg3MaqCWfQCkfgESJoZICVHxznRGO+/v0vVzeadfu9XI6abhe/6w4ODgsufik022flC8EEezer092zL0CpS1VVLdtg02jNCC1QnBibpiCzY25/d0rJMYk3krKtxEWLFXmwBSjPZUSb4/aa8AJK73fbb5Tzdmc7S0HUvFx2EQ2NC552EqcXeHQQjzH9R+stQZA7IAIHLLGiEoq+v7K8VvLHoaKX5EWRN6dZZr8Xgx74jG6akITDn1JIyHJqaftRCa/e4ntmZFJg0iyiMIqWEbPUMl26Ey2rxzq6vjfVuPFZt1yRymrAT9JhOpu/zzGb7BN0I7/UCDsFiPVLzwVu51cWctzuVf73O/ymJ8KsIoY2/DgZsITgTg88uSIIlMLMaREjfAGCoLAs+7xTR/9ed2jzxQWqHzjD12FPeoqAvO0Hi0fTiPILh9N8+tsfj+fX3MlyNzhYsskVCB1O2gcFrQw51KCUDUyNngHwDzRqArOulCWda2HB99AX/fU8WwZFB2yEtMLM8zGS3DMHczdt2UBmR55HUzMN50rZNZ9lH2vpe07NFYn+m2iQfuEFNkayqR2qnwn3rHY+Vy4Iq3xb3UQBFuScUuHLwaK4se0ndOMX3w44EeJu5xztm6qEIuJnbWWIZenjSC31QFHgeCjb1RuehjnLN3M23nz6oJgQHxLBTAVeRzp7mAqUx7Y1Yovhf/4eSu2QccfwnoxCjz2H//eKtpckdnwvNXZxkUyE2tNxZbfqgMAeFwdSjkRLffiqSn337OLBqD1uCGELmYnjqm9Q+Ap5Dm2zBcZ8YICfwB7uzxhv6jOzJj1fuOlxnA7lFclLSBYkILQj5Of9HACBpmOG6SEAma0IFLEJH2Em9cJCxzKK9NSUpaFeDff+VfBgB2fZN08kLwuxbNU0qb6vyscpEbBrzqrhvZcQDVmwjFT2Mv/qV1E45lOduLmKeo7YchUo+qdH5kte71jU1CrKziAH/5kPQVyt73evp6FJxcddQ4h1QM8x0obWthwi8JSm24fJdc5We0zB0n++50eW5XEcuQnXCv8gdM7uj8bl21B/ERWufKWXj6yqCSh9TpWkUUJ9FCS0ovmZaBMC1h9zchrZgbEWdl+DduetK90HZJgjYKnXrQ8xk22OKANUWt8dZi0bGgQzph2ssA/pvo9cNcJ2RpQiwhJEcBvF2RlL3x6JhDWbpIie8ynI4IIn79LkQyCUb6hDmarBTTUyruTgd6AE+ea8VkwuW6B6libWvk9frwhjH/7uhDmRGBOYxhicJ3A78DZ8ONMTbC3peOHr0OVJFodBoeCiZq8qnxqa1N1hWj3/ZGhFxGhKNhUyZ3SzdG7aPyuZKShB3lpcbLB2JFNEJU1LrdmIY9OPZMWO5qBm/HyCUEsDL95k8eN1flYIfMjhSkjbHF1qozndrmSFxvJEqCpaYxOWiT6/pV0e3QTF66xSIfJJVDuMNeVAtVz6XhKktv41dtZV+v5tJCg1qipHjPG2hsvaJIs4gqGRjMRQg3fXcDiqtgRT+aoluHUYGqrWNqKlMXir68nNZngrf6gp2P+EuvKJp3Qs0c9d6aaPPJcvD6ktODM8+CGc4xl35oWY1UP2axg9zEh36vhcX0sKww9PTvw22I0XQjaaJPU1aSrqVxWiQXmBJv92ShtdNefEef33EsGMlLUnfYM8P/cvMsAxWI+BnTck/8So3lQ4snyZzDry9xicVGcBcEz5mdKxLkWBy604HESP6B4WcjMyAfHBkdW8ucwhLh9V6LpGDwNGenLWWV5U6LJOdaIdM0H5cv8pdSneHVAOwgt+Ux61bs2zFoEFXpehXgQH6QLMvM9NHYNwJWEW/J+58fQrIopHmFGDoBSfyzBROeCyb6GgmOxCzcSJ3xJwwuVhELUoftwdz1gV/ENKvcrROJYtIy2+5QvAf5l4U3T4nOyS9tNQSBT4UnvVT6OPSstAzdJWP26tERe0osYlgqtEVDffoVIEucPxBSqa0wkIIUJlugO73MMqxW0E9MvOr/pcfJZo8GvPAr4UDtssIJMPPDfP2Z046oyU/bZA3uPaTJfri2TQE45gAH4R4VlnauqbtudjTZXQh8yiJAEbrsKfpjJDW+vEf2iZKGDfa3CDI1YxrOIQ4CCZctfymfkzJneUNB0IMsY2V7W5kOOXM0UCuW7fcJny3NnlFtCVEYdO55pP1kYHXZBr5vmfBnfvxj74IGzc0rjpYNtMdnhxQ55VHqsdJmBI0IUks7wiYm0sIofhsea1MqTk6ohOju2rZGBR4638n0fbWdeWwjcRnPEAy+CgVgSS+jSGK/I4TP1RFoVHw4PvW11LfMJIpvBeajw6FULQIBK+Y6qEflRk5w9PwtVQORe3gXQQdqJnCiflgxb8yYGdEjdRSDCHZEE1pejm863rvzxk7PKuQh+k1EpeIcvQY04FRQyCuwwQtRRhLLefpd3fWq4SoTf+t44RGIfkMy2keKNevVDPH+Sf15Q5JOa4mnPtMrRjtbYAEz5H1sh/K0S6cYOot2jKkFQ6y0ifMg1REklEup1nrHn+0AKfKPpfum+MDX4zyr6cG/osmYrJhYhCwRbT2FGAUURRGk0eQiZqC2BJYrG7RtipGjmEvaT9vrS/thUzRgXs7wi+WZagd6XChFHubQRoizBs3ntvB8xJ2vCaL8i/+9lxWNc+/1gXASbbrt1Rj7wAcx+9BOJvgcbs/M1p9d/qssfOdPlSDC47SMhrOxsKr6FqhLGyuvGic98m21ehUjJIn/m43Hp1TrTnREvWoLi67BgR8InAg9tZyNlMm32+0CpS0cZMQkUUpuNa0Tl10RMqGNbRtYdVi69D+DdCzANix23Mz8oYSAMDGBQLAQUeJ/kPq9Yr3evM4kzuIsjvgJLkMvTTMX1mrLBSeIc/IXulmmfYFDH4Tdu//ySR9FwVPrio5DdeAmubOzj85k1uVooT325Q6lLO7kZEIbEXBjTREtrHzgZQQc3bpFbATS2ip5G7fcQ+oMbr5jTrgWGrkSMluJwLYKtUBAMGU26sghQl6iyITYrBiUEy5Gt4XPCsWR4MvwDDZDxmQDBDTCKINMGCRwxCdkXTY/GN3zpZOa9uX9YWmgP08OWS13NQ/sWdbt/rRj1kqkqv9GYcJ2pgTp7O18oNDKegsRnkp47ahPA/SK+49SpoOMMxQ+J+tui3+vLBYASNB8WrXRC2U2qXjCZzWpk/tKdT0GDUjGyohqme4+SMu7Hz7dXERjFKyNObTdLfuS2XWVsqLrPOJzlBJJlKTiUceeVp+XIUjWZwdL2AH54Y3O0dv+W9PfmcoBUVuVKTgimmtEddWZV98r+on0AGwzomvYBV9YRxFhrWwvbsiyi+p70I5z+LnSSDqUAD6qj2jorWfW7OXNjrTlMsV/J4+O2im8eLY48dWIO0LNz6HD4Yi68q3Zj7befEC1mtwysOeG3q4XMt56toA8iugkgKf+Bd6G8P+wgYZs2p4oD/uv2Fg0bjAkMhoOVTrYHjltYJGoQkJbqS7msOj+Sxzjsfugcxx4t3VwYnEaxkYDJ8yFKxjMDOy1RytPKrbCzxQsNByNpNaKHmstW3QzUPVnq2BikuTEty9Vc91TeYo4yM46E/5JgS+2DXCUyybZW8xlr/zLkBX4T2O5f6AAZ+Hsa1lCKBUrrhv88Lv2t7M4ujoKJGLKkSXnI5mh6Pdv4W+8n3PzGW2ZWnR0N5pUkS5NdO1Xh4q671h6Ox7cYjtO3+YrYSTlGvm2VutfF8Mgd0I2wyoWJaCW744piLShOz6t7/BzZKNK0QyIdSyUAsQasdtPOfm3MAFuma/2H3tNHpAve5TRmmo2N/V+5HuEAFtn9ZA/JFRbjuYxN67Y/KGIVWO8u7AN13wYtu1LVxuV7EC9Kwwj05A07Y0wRPRxB8O05MW+nyb5JoBqGpYmqy4bzo+yUK2tD4Pkq+1P2BAAKFJd/qg008LgOKxAWqt45XooS3IQ8wXzycrBAr++nNKKn16DsKIQuIrfThNO36m7/6vxaNVC6btgSJOwOB7EDZz9i5bDYgLHopFk05fy/sc5M6pyFGhcPpfOHyQZPpU0rfd5GIKG0F4OFVdOgRjwQ99Ih6rKXu4TrKWgBO13mtyK4K4G/gkt7rCurgHAxEvjAP+H35zrLLGTNoLDlQCIQutKB3PHPtPPplLirUvPan317qGaKa0KxMVQTzRQMJghDliTDcNW9BU9kzD8Dg4EiAIoLeRbqMdSLwZTbAl0ZwVIccb8H9ZcVUjFpMo4wu8AvIOuvSJgWi2H7uDHxtSH+NQsJV7dCdv7gPh+9aQxWYEmxUHNxC2Iqxcs6AgCalenb+QlrwhAtGaKeNtNvfS8I7PnRaRskaC1NZX2IHrAiFvUyDmHjxeoMANClQbUMHJL9ZSRUKKYjeF598PcbwIULFbxCZ8cpvB9CLUM9DbTsagAuPoE2ZE82Luy7JkmkljdDPTh+s1LYBQa64reE9fC343CybUjH33S2nIXMkRHX9e7rX8Y7ZPU3iLxxLV8XxEdyXKmsUUXPuDolJTM6wD+IdXPFoYYWxiGm6/FemG1+pWdfpP+0Z3WbgSwJ9ez6LaVBGMCuMN87aAlkBUnuufaDW0ZwYBlpcDFgco4MPjseg5eVJ8aWmSFq9gRXXOInge1ajnF6S9EfEC/Zl6cCEBeTlEmZRY4sHeg7rsIhus0WEg6TKM+gpoHWoF/lP9B+0rzIpuNfiUnzd+Iemnh3PjcEHiMV252UgNdMcF4G3W7x3JXGzq1PUY3PI6zvKUH8YQiEHHSynu02LdceMHhrepixsCBLRGwGZ7wlCyVjsOnMQIWnb/y7m5kBa8QRqJlKU8EsO9mw/GiM4X+upEwq9KwphqcqVyRmm0RwyUSJ++9ZcWo+CQ7F9VTb12E5QON/ACMq4QhGFcorlAbff3KJdkA8v40Bmkfa21lilFvaRMhDA/X4QH1L5Ks28Xys96z0YEgXSk3Yc02nxhr1g+8dIhDOUm79I4S9OO598sGHMn+ZAbYk+/XM3+uRntH6Jvjhrn+GsrNv84yOTqF39XqKCTZ44xaaOV8on2raD2ncdyYgFztBtFwadvDPtMlfTumv3FbQis5m5161Kp8chFyxFi3UkRqEvfPdch5cpae9XvXD7IW1VL+iCq/6lqNNZ6XPEPQ5XdanGa/WWf1gU70n9WtPoki6/P6+gUURWoLBQENQjoDLd+hL2oIYUTUygLA5YdkGrZI0j8EdmcCFgIpMA9KXZSW+BNRwuYnQrZzYw+uWhCPiSL+ZhbxSvOm6cfCTM7SzoQ8gjY+EzErWfzPVPSpYsMGWiFCJz6gFlusQOFCpHiT9fLKP5kKGrFVpKDqyDKL+eKkPkKgalQZq5Qk75GsC18MzY1cp9cc1RwP5J2OyqNEr444lR4cWeY72NXnmgxKiTezJcYN+qmjfwq4a846cPnkZ78IrRvMSGFzrU/ICG3NYqHM8hw4HJRS3bdjt+B6De4CKE5+II8IVjlkNe8rYKuyNbOuQ+jlGkIJIoULe2wZwB/sBmEADYeNedeZ6EuIy/s9uMHUj95GuDYzV4JhedPsj6r8ccH8wXpxYtnHkmqKCVOYc2ZPwSNjI727nbnK38xc8VZ3EOU3s3ve/Qx7m0OungNb0HQ04nj/vXR3LY5D2jPXghfDxiQUdb/q+GcdF3c6v85/tNmNpkb9oCNTpilBuJv8sXMxmctsNwE3HhG2MoYXOTLp9Ug0hDi/itYBxv2t7EyXyIE14vxV1vkr2S2l668kizqs8akxklP6DZTQBbOtzFu2qc7/Wk8V0m8WWGoO0nQ5cojcgmzXMa+/JX7qsY5YnU/Ms7Ee6ygbHqW08M8qmUTJv7DeMW21eh4XgdHn3NtBGBN6vIk5+0MW2wr03djMTColxsQtLAlANWcB1ZRrN1Ax02L2+H4HxYOjhtFdnh1C7M2alSNMxC5f9aCdlb04Qy/75oOA3pjaoy8a5XIfO6mPfHGahYfGBwPdoH11zcQA7kLHOb4wB1LFZOINEU6PQWAIgJlV/AZu38mZAWfZHssIvLMaTVhe+tsXoZbuttsRcoYAq35uVIm//42qr1vmveJrRzloJz/syQWPQ7kIgRw8ye8Yi4EmkF2T0KdmcZVmBCLabHy/m7tqHzAcrjTxgMCc9DbuelN5GagD1lk7mbvw+UfiLJKA49NCuucsti5DZUxpxpVaPPuTCxE0muxFO1WDMo+dDzEeMe6HGEn5mQNCWkoamYGke2JBBGnKbr6QBI+9h39S0G1uycaEYACcztQq/wibzA7VYkzzl3P1VkeiyH1rl7uempeksJRQRiQ1AulHa8JwYC0GgDBsvtpW7h0Q9Q08u4Wd68aAxK6tyECYQcoOKrIuMPqToizMEUcQu+Tr8nn+6XrU1k2z2Q7TXLRu+jwqZRSiDp68hMnRflJQZN8Q46fR67z7WTGQV4W1smac75QbVm6VdB3KSQHtVdhmWQncSPKFdQqxn5oy5zLAkIUgQ2BBpMAbyEKsxctrgQqER1UGcB5EItxzX/Mf9nLsct76BovYBV70d4sAQss463aw4Ag0Cx4Q8FevIGRVvLBaX6IBAlw/xtrqKq/EgPP4dCTqu4zx5R9sh69omx3ElS2sRWLI3gDGsz4hhhYSW/wM7VZTAhSA2s4sUlR4fUe2enTMhrkrdt9WheqH/tVUQGgP3kHT1Ju3m03IhtgwwdBAkRsIoqJhPtG7c7kja7N8uoAB91Z7Jvk6uBEM7ZOhvD8AINtR29JQPZm2Iwp0vq3jc7oZaLz5kA4zVEXgJ6+W6Ds+i3YD/hBPM0paBIpeOPl7egPkR78Le3hVUHaTb/uMC5kNAA0eXlmr5fuRwGtTiRyWOypC+kIqV5Y4T1dKDYWt4wvikmhTd76s4crGAuKlMYeAsyhd8f7dkLJgqKJDgIMLaaTEeA0vrWTu/7ZTVswwtmTerykifuhYdHQEwKVCpzR7W7oH69BwGebwIR/eEkedzz99iyTJObIoy0Vm+VGeagmy4jvhGTEJMYOpc+WTefF6nvoG0NAqC3xf899U4S5y8NBkjNq439VAxHYJ8gjKkxNi49pnm2G48drY+QtFyHCyf1dKCWPGULMeGg8GGsMCKByRCRcHUZzvVRCMTNNtSk6/AblIVtDHZo8hRepJi/LIvCY+fZpB31sexk1ANY34mQcmEydEs+j6asUjX79MtqWkV/HnlhLMgf9rMEf8E6gVM0eI4A7PQ3sJGjQWLlorlKFbyeIzOi9Renpq4cOG7k65pgDmTI2UGyTMQlimRNxqpesGB8mpFUl307P2Gl2oHQbtnyVnM8KGhmimQGjweUmrAAA+2t6f7NlaGOEnTFcQzAyfDgdDJDd9iXtrtTxujGHoJbw8VdrDMe7ZxcX2v3rY5RkEKqMXcneMzFx7n03Qc1N5KJIV9tiK34arwYv4w3ty58FMbNK0w2l5krUGcQrgLI19j7Gghrsi3nKdYUoCChZWeVtEYLgk0BVXBu3+5NSXp927nwCLOI+YWhdLQ0FPgOITenJVUD8cuZIc9Wm9w0QQffaLKpPePrJmtYVxKqStsCVy/UMgCD2wzsdLotha+oxRnMAHxfU4idTDJGv/vR7GFlrY13XOjUo8bIA8s+c5i+9YI8fnpYhLYnyR5Nu/6vL9UQw4NaUatiJLQqpwdISMilDHNyM6SOTrfmwiscov/KcCHL0yD6f19v+z/CTHotl8jlKTUbJngcNHpUexOTvqDhE0BIp8eWIJg5069Ynv4yAZab+2Ptqnj86ixOz7KNzQ6L/XzrPIp4FZSbl+RWEFIuKUc6pGRWYr0DiT0mdL6Hi7/eD/gXFnuZHdOffutnqePiDa24sTu6xj3s8/5lUFcqpGNWNR9tMckF6xHpue7kEc2tnuAVhCs4TtCjbU624WQqHDWAIqb6Kgh+G/T4iKGwnzvJxqFjb1CTuonRL8TtD7O79SHakgMICZOx7OqkIEQLzqyhoEYmulrBQEMbsgfOxWm7DuAI/Ez9/m0RfuvI8T1954VviPQSoGu64nCrzLI6XtnfLD+ook9tci90l0cSPUQybdn6uybHO1CYu4dCwuLgpJSibXBC3aO64xlLfs7EBgljRfPrKey5jMGlw8LytRhnnXX0MqXKahP9yY1qJuVd0JP9keIH3ks/nYo6SCkaWUso9DM3kXWSlGeOwnOcP+MiSOEM4JWnJIa7NZgtrIcgJp5Ie1918Wv+M0B5m+tGqW65VTA68cqcIAZMiKOVwl88PBZRi10eBWvlo1LOdksjwQfQwVFfFLAzjY02tZcfalvbcmxIHCkE+hcz5zeTug+FcpJ6M0a8uTyzlZvO6y9sl6kqm/RRArq/sDCHjoWQpxbFibfE6SzOHUIK5/pX5A5vjEWiis6E+1DwEMfJo4fcbuCfG/TYgE6XQShEilz6Mw7mqZtMlZnrnmVdUdkZrOGEmj/PqCG8vtX5TLnKWsYvBhXWZaZ5qhYb3JERlHb+USTCfn7NlqH7w44707e0NxxCovTuWAFh5XzNgcXfRG7rTCtEjOwOz2e78sCnSDxEqaF6OQ0BT8GAiBEcySsSGVhTJ2C1nRKm2R+kmE0Rw6s+4mj7RSWGw+09sv2RvaGitooGraUS77WM3KjSBxkCyrZbG1/5CAaNtZRDo8E74qrypTqA4+Ju25exHi82JTJA4Lq0R1efBmtYEgodD/uDnXioH9o886QMdH8sYJFzjR5K76O+sKgjOYIhcnsY5pVo/hVoqoyzGXCoiElQQwYDUvsZZgqfVVLWB0FoQv7aYdA3FDzYaVe6jKKPJuxGBoo5Hq6WYvyBVBSuGh7mcMqNBJ4O63uhbc83+YuGFbYdctywfaM28J2poPxSUDoqZhaeo7WiWyZ1fKwhL5cKsltCfr2PN+b8aXmpCuFIMVGCpeU3iHi2qgcRdiQqQyRoRo09KuiO7jJueCgkyBrzK1UuC/yC/c0avTQOxraQIV0P9BydMS99sVM10DrTZEa13wtIoSuzYWlebYBNo2iJizurkj01+msqyNx2qqHKCrxlW84Fy/mWPwwp7ZMrCulh4X3uYBV4OQ631SWTx4o7B7pTaU6+S8hboZ1vKyoMkNkKDT1x5avI06wsdTJ9io2f75aGMsTrl9yEQ4j5f0KZMZmsEWaVQ2J4dcecJ61hliOIX2J0IdhktS73ttW2jCaL7Q5JEJci4WCezdnL3hxZ4bHkTc8gSGi8fKqEmF9j7+GebuqCbp26cHidlxzSIjP7TTorX8XEtZSIilo9WkVdo9fhgwvnbQYtYWJKQtQXfKsr+NQNbbj10hzHDSy7YoryOzimMqKFo1ZLpDt3mNPFyokH/z6I9EjSG6T7YltC2I6pSnm9A5qLgGU7jhE1rvVBf/a2Fq6Ww/2sIGxtWMwxmOBkOz71EgLKaPQDKKqCmzHMVR9aw6b6ONnaV8UNuSVdDaUwUmFY44rBHgy82PqCHi2Ic23nFdVcyoGCZzbopK2oP4g8HXu4zuhroolMg6rGEpvcR8WBquw02YqAXIVOQq2Qm5/RUKixkV1PCOsebd8PiHHEq5wxSgQoOeATU4ybdXDx7yNxh3cIxycL8FtW0zNER65g9nZfYd57LIL5ieuWO2FoafgHWEnnQtF1phWjFBwoLytSdcSDDHheFP4dGDC97BWCKg/YVTUA0rchsyie3KyJqTQWT+c1dx+pX1nzJyikzCpph5RaFfWGWU6PA53SCKT3el74zUV1C9ZLshUq/8vzWlqia9hikR1ruNXq0LL1fqdYh/YlCo4NM6FA2yCbha/49J/Ycs6LFvaRnYdwQ6puZPafGJ3V11/3FwuTCHh5yDBIfyPUvfvnUZu42+QGRwVUu2bCGxjmI62w8/0SJ0jw0nNuBv/6kGsexT3134t51JlbezfUwJJPf3+QOiInG8gBTmLeIozx2TfCK9pHLM9R9BHCA+p18hGyDjV//EiyTou1p0PVgIrJr1bubs4+XHuc3CvC/1GK7ZIPGKWTgIhUT6F3KHopjX0tlfLzJxsNcAWsY1bMhUP762rs4AEn1Ubl8wOD6oVFgBN+O26ISG7/imaWZGiVbFh9u7sk018lcBXgRO7siIk+2y3udtj7pJtbQTVoa3r2ZE8t0IcAw7Gs/qbGoBCxtH713LT9AEEthP4+sfEfjoia7pu8yE1H1iWTu6K8r7WXlbHyFnAVwlmNgF8Z4Xjg8+8ctRpzBMYCKrTiEC4lTYx0tpdui5sNK2zFIXzrSzCePmSy1LIhCdlRNLMY6mSF8bCcX1eZk5PsE88A+johbO9nJNKz5oJGv1zUVr32strFmJtxzjVQS++LpiOh/JC0c1qG+8cVwJZqaRv9MIfbjVbr89ICaRA+h21weqEA1cQTE7X+Kj8TmJbU6qzdWtrPg64WYPFz0q5XS7wF6CTulvzXoRWdZYE63KYXgGlNugh4tfhBLNhey2IkC0dR2gwBnKx2+WptMCs8zob3ZbSudm9ek9LAhmR8zTSTI57wAGDXz92yymHyCTF409959z+paOxUo7SJKevwmNlDqYkXzv87/SfUdjn2y16x7eiREI0IgZVGxBDf5LATch02zZgnwnipq0wyJeL8RchAn6ALW6GlT43pp9HyC8GtnvU57Zdfhg8YzUMBAMzfr9l5hdF5SOJGruDP49B++kMNLPN7DN06ChZeykJqj8Iu6qIRCtMfVOXRpqPkT4qjRPigGgXGxDsjL3sfxZVi8weTqfYkHLbgx7EDN1x+WHK0k2DeJnLmVyuiRXhvEAdiTtTL4kgALUgY3i0gTgk7fk37kyzOQsye1zOVR6ilcxUvvBK3vqeoCxTP0lhIa6uWMdxU9Po2SzsQM5SYaqM5xDBknene6htKPZ6t+zPGvBS6ZEAlZ4vKKJl9NFJ2NSFN/U5TIw4NTzjrau1PXxJbBLCVG8bDrcSWwVFLSROqjAOH7X9HaX4v7ZRaoG2ZkZVnbEZKgyyav4wfHUEL/tMIyTWYxSFsa5DpRf2g9Z4IGF/0HXBts+PtlPDbQFxRpNyrFPEEOyXgB/FjpKqaJKrtHUpI8D3towBnLKhn23obZ17uNnCSzXjBIQR5q5zi0oUMM665/itE4UBvFcjPPt2IoIO7BQMHuNNjWIlz3fyNxwW+P7raZjuLDDVM3R+3QKPLSsG7d6+F2jijxI1ULOSSZN23grbgM16rYQGWn1LKFF+ntJXet0tI0kupNW2WqKOJmzRjmvgDS04Od5Fo7Cnhs+1YwVh4RjhOx6aYl4GY5Ph/AwXLMnM/m7t5G+Ohda5NHzJ7jy6zLZgfacq/PxOLHJfd3nVUfyAqqVSNxdqjIU8WwDzZe00nzPEHxh9nN5uZm/k7OLnMq1FUGpgYvZkNtKLl2I6rdv0mFHVPUiwSYPYLQYLwMetPaQ0hDeUWkW7zZpLcEiGFqm+KLJV8dUyWl+XK0PnxOjwthdx4= template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-hostcert.yaml b/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-hostcert.yaml index e3f157ff..5cead69d 100644 --- a/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-hostcert.yaml +++ b/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-hostcert.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - hostcert.pem: AgASjkI160BCrhd2esQx/YFphMgjuNexvvSQwp6c6CzOKseTm/1q/l4MM5qpQNpjlC/uNPduaB9ydxxfWofr3JR5LKj2MlBTeOw9Sb1eQPrc0ETx3e0Fs8aAuX8fdNtsdpYtUid8i2j/V5P/Tu4TX/8uqOUgwPWOPw3AgDRuAUkovoO6S3n/rMjuLYMkijzd6tDDWYR+5524am2I1pP51/lnN9ozr1kjCPmfbcRRKL/IyQr5a+wM6/dyNnQn/PmfG6ttShVtbHUj6B8wrTkQzJzYGCsGa2Osg4ABuRbWE6TD1sbbJx+8xQLKsLkSAc6jIKYMfm1rATDVuP8j024ikVCAWMud8wkESnjriq1NRn/ZzsJ+jamxBS95allGqwj1cdkVv8T6fWg3+JN/ltTMfhYmL2JtgLzMQjKXAWVaObHdIPXSd3WPd+Sr0wNoDZyXTET5apWpK5L3ggz9dp95uotGabmf72eDCJ6IdeE/jIUMu3vCCOgA9sqaVuW7TcyS7PzcxG6ofAU4sAxyCuiZhpRM6LXiJdn5YVfWo/7eSZu2X72FHVP5k5DgCZKYn0oAt1nvQqBGEf+A484NfJHGpz+BTkC69Rh5gipjsbzjAFAzJ6Z0ywtOVpYb544QQ2msgsXDsV7kpjjtEmk4gNkhY1LdL+Xbxi1U3S7KxNn92RrJKiJTSP94k/jzZFsy1TuhgitG3fnHB6oHpdmuaQ7DGCnEZANSwu+Z1IzrhbWKVVyV+s1i0F4jfBqTbUiXYhUgEEzHxSfTdj8DWiHdSpQTfNzOdzhdOxmqngUMkq7kySzJmYGgoIWSPLrTTf/5AimUEC6Epm3OdPozMp+kyQgwTLyrn3wck7bjtstQ0h8IrsHWWrBLD+DWJCo+AhflSxRdP90LcBhjigdW/WuMBHoSmWgoG0/86RL1oO5xujiO2j3zPrY/yWXkGdKDZFIZJ5CdJZzhkvSj61BoyrklJ3/bFl60iqfWdFfTJ4WxvrX0KiDCiCDdKjXjXMb8xvKRXyKTSELGS12zY/s/ydnwrOnTA7Nc7rvfPz2P6RgrrerD/ZngoZcPa7gZ0oYraDZWxS0Y3YzrEo3a+rP3AYLUYoyJiC+GNGh1pM8zemw8eBIRE3q5oYbRpE+CN4EFrM15+ENCYwZytH6O5CYWb1X6m7ZKA/gSPQEVoUuuBTZog3cu0ZBrzsB/pKcvOKkeFqqnCDQ6U0irz81a7iUVi0737r5+rhySbE6jlb+Yq2lmdHB84TzvHKDgQRg6CJEF1HD3hppapWPZqxXfL0U1Qnudvojr4unJl88NtXFpe2flhjGLLT2/OM3/cROZv85rt6QvEakWdkEgSKLqWy64q2RpJw2slCKr2OxZ3qzECnGSdXDDsUjw8wzbbYrryoUZvQ+muH4IN4G85x0exWJvon9T96sF+r1Gl+G5OV8T+ee8805SrF4n40DoBDYYl8V2CzknFh3mLUDd3SZBmdaXttzYg2V2gw8Zk7nwWt+8iTHBdTpBGKv5mG5YwSF8Nc6rpRoqt/WBi5zuRVX6hYXGy0/GqE+OsyC/kzaGizsUFB5t9T9j0Ngjf2myKl04s8+ZPTmy0fi/ZpycyarknAhXR4aQ04M8Rk9mKoqB6H1Ng+CEdqfXHAybee5Z47cpPWUSijmeBqf6JOkAkdEPzhYBaOMphb+EN5fQXw8TtmVJ08H9oy5F91DqmuRdChgtvOWKHclsFGrcZqVhG7XRNCFyvOnT8F+VC2DVOxZ+1k3loXCntvYd+t7DzBi93PZrIW2mO8bzncJS/Sgn7wjvx101jHrw6CCxwJSgJBNjHyZZQQBZGlmH4IrXL2pRSeHGn4M/EYCEiYcepCazqFCQWRZeJtXEr8q05PCsntiXWK1D/hcoIAcdt1vIzlAWIRG+syUpZI6rOvlAyZZtNivrYmZUzaxzqErUeB1/MWlO2L/+XPFi3fqTVxFRKwZ6WAu8ZsF3vFfrJCXVvpGlpSXH10zBQ3FGBRewYhj1HcQ4sY9l73Rpy4bhBrde9Z+Seh2rJf1hHOwQv2htmGz3uzNWACJ7cyfo5JOzHfCo4dNdOVA24HVHF2siNedb9FMa0uC+VspADkhy20TZYg5TlwECwODQ3PKZiSerx/j94dbMGWnRUFmCg/eod7M7/zvu2TPbizly6PCRzQ1qjBI5O7nvfDmrR8wHm+hIMRkg/yAAVxmsgZSJLEpjflHnrzcqJRQaqcpX71AGinjO+muJrx/3KZGc2bxfVLBj9pDoasQm8VE/YynxsuHV5x0likSmDUX3r2y7PzpADv+qj5d3RtV47mC8Lj9+GtmJoc0FSrD/hNzezpPIss1nh6sUGjNRLtluNZvb06sMEBUdiwgPoiUIp7wUqKPf3doAMcMSH1rgpFPmlQBED8SHLSMBmfFzaE9niUlwNvFvO3pXDPtBicl7x27RnlxwLuCBT5iVY0tXb8ZrGbtK5/d7GKtQ/rBZt03e8GCfFxo2PnFnmjI+bUUK+bZ+v8ip9noL0/XB0aGV7BxAXLiz1/WDRwKlc4TnzHTMhhvxln8NnwNAr1fyT3+FvnHunAhx24H+Q32Z+cuzmBqd3y5XtaufchICOY22cT5UMs7K9nKJFB1lfPcw8LPSJiW4BiUcMJVeJFoZ9xUvf6vVq1mB1ht9Rd2HIEjHhb1QZymQ4db2ssX8I9xledAv26l3V53T/34u7XV/TiXA+f+yxnenPvuEvtBc9DvxmkXuq0UmTF4IqZOaq0Q7H5Vid4jFZjD7aQzZTp4y91nBCmjQ5z4buZ92Rv6zUS01nCcXlgIIy/999o9PPrAr+FHSbpzzJGNkVo0jxlaj2yU1wLG7qUhkappkuBk23/19nXTqAbfPrc2xrGRrcoi92Gb36z9Eg2G9L13skiMy0CizU1PWRyeiWS17BsaZpXDoIgsn8p/DZBtZ72UJ1024a09SLNGjvsWyNDTP/vSSAIdsVAEmMXaBNWxYO2pqfV5A4KdkDmNThYMaj+a4RJUON0h2ZwNJqZHXuw5OpcUef9LmHNdqMaywFCImZ3tYL0wD+Xa+s0pORdKuw/ELMWa74w9IH919jayVbymiN+E2jYXLc21uA/SijFOS3DL5CheVpLjfa+fCVH1U5owx4nCq24ISgYaRAkluP//eESPevtAYF23c05xTKrKLtTL2QEgvhWlfIoMKaC28F1sZrhbVGtkLkaORFtruCh0DPPk8LbkqH5JdKvTsTJV0jMtSYCMLGogj8t3VqVyOA0IeiwwXEITkGVbBMJBnI/FuP/+HGaQambdtl7OJuWIzh1VKvR9MIEkAswSN7JEOFtmoVM7PGfT1jS0jHxHJs9T+c53Gare2SQkzyhNM6x8ymFz2pHAafVuWAD+7yJALIAKPeosEY813dDLV6XV9u08MtXLQaElmm58tS1oV5CLc4m17gU7SxNkRGY98/3fv54/M/QChjuzPEBJ7cQlssu72rCXRxsCzfKFRavd0/OYPOxM3EJVeOoYRwqD0SLuCgcr2m6eo14WIxJNAFQ3uv48VGpPhO+Msr+b5patV2x78IuTce93xZ10k10ypafccwGu/MTTzObq8OYZg2ShAaMkGogaA/vmyMtijvrHS757eBZWaxhjckyC9xe1H0OVzwpSrj4bG19cO/d7rfQLagnpm67SxaZ4PUhrlq3efbwDSBFAW5jNFH2uhll72pZfAH3l9F0gZVz7g5+USaOOEvROvG8ptqpTYD0HYyAGb850J2r1TOkViH44FNh/7PE8kecXxK7kjOVrajOL7aHSMO7k8QAcitoH0UqOMOo+t6lHRowfJ7FzQf8/LBxbC0wxtqCPmQG8kL7NGvB+WPdTobXPCaz0DhaZMHHUCIzEEvqg5sXFTnpJFjHe6QE6m7iXzfAQ8RREii5+xrkOfiicIteRqk7YVyqxs1FDwEmDNI4IV9JaFHw484M16zXqeQzvUA55ZB8L9CUGA8yivUFjIL05mKTiCuyrTSPjmoBJSRgGCHSiPO0fhuYGuBcSQe6Pe5yutuHWh64To4ey2fMIJrsRPCl2c3TwJsU0J4P8dWiS1uoOrxBFW03SrK8fVBqFKDyhnFYXah9DJXDostZqJKI+7nPNgExMltmrLMEZCBJfhOeC9FgbApI0nslR1+WGPenf4b2VtUqArkbwQPZpMaLdtFuYJstHAQ2iS/ciaQ7OeNDFLzklJNwTZc0vv1ScfWkq1hBAtq4g2Mh/CILsv8jIEg4HbMM8srfFRSN8P6+I9xrPsMTkswn+ygQLc4zGh04d7noxhLXn5GMhUHU15hs3eqTJ1eEFVvkQtAAPGgufcLhpAYmZQ0duoieAbzRNeVO3wD+Xi4rf/sh5qLtwj0EgKzOvPUeoP9lwCTukWmVBzY+bzxRFCa8uRaZ75sjKU2+zmYjTyztN3+Wcyeo7hYsqvBbhSlb/qTn6tVIzKqMibV9B9Il5t/iA2eqwOIi7E9PzIqsAgSthCZX/5oGFSyAF0qkBaLC5QTPWq+NvRBLPHmzYJs+bNWEAJFZJRSA94GWV8ak8wO0ivNjGZr2ZS9np6bQlENJg1hUHx4tQk2BwBQPO9GDIobuzOOCb5WCtdGrCDn8z5PHDJBSrl/VzhWQBfORhQySdmgYnnYGZcC5zBeoH8dedx+HCokqoyzafSRbklooaBZaKTpyV8Z0jb5sjOv552/lOJm9hcAbl+z0gqSStcuwyRPM4u+o2HZZxaXV0nZXaDF8R/114bxL1r15tQ04+2d/RbCTCOSmnV4Fw38V4i+AGvwjFh9WpbOS6PHOgokgYfcVsUjLZC1KOKqLuM9A== + hostcert.pem: AgAgneQ8cXc6wi0DcJcSPiIx7ZyPbS6w+k2jeUHljZlS+3j+fFLDNgYqj5v+BrzFtqnEJCSsPrmbsDp735aogPj2yu3Or6vx2IJmk3XpWYLq8wXRe373nOvZ96ZWXMZzOtXEsGsU6BgPyq1h9ZTrgoz9f3TbJq0hSxFQ3r8QOl0/iCgIlpgyda0QfczHNWZR5+Mlren0Afl6irJFO8jVhvSmgNMneGTaqin4c5mvAyATrm5rXZkExpJnFwoTMEaYQ48rcW/mqpIKo3+jfZUd95uvk3EeH9ZE0f9iO7Fr1BmI53swg5+K07EkHgu2d2QY4yW/qlH1HuC7ZTQqPe92e3dl9A5OaSi7E7gwiQ+28si2NcCUJ256+19hRE3RYMOeRIOUdc4peytJFLQseglLFvcs0BrF7DP/4JV7oVf533plYwN80UVchywJ+jBUfNuGdJ7RcvosOF5NGTr/2wQgFm5JDS4fv1Jl6p7JQh6Haqjnz1nH0zTygu6NrzNFPm/vp1x4ja5jG5NZl7J4dgjr9IHE0rUT4cyBmaYYlHppWaoJ++Em9AODml/wOFYZLacMWTpQPIRq+Q7PSV4Q3z9mQeyTNN4EhQwaRM7/+rI4uBTP9Bnd8QPYi9mE9gt5natoleRJ5RVw7Iwnjv0iesX6/WflkCh/0LzsB9bnHCPaoC53pmLWhWRZflCzWJt6pi4o3BeBvTfFKVtSkK27nyW8xucBJvBWIP+QuQWZuoY6KKfDtHM78EtjJBidKALODGy56cyFT0kCJ0CDd03P+ONeSoBNIBH3qVmJx6nC0E5ytVyHtx8FKCO+ls1a29Q59w6xRA/U1alQoojaAFjbMcZSyRVHVahPTKnx8rvu72jZpPZRFcmJ00mkFzqr1W4cy50gsoOT8BdOmWPhmpEVeNQT+2WDA8cCi7xnlbioLeD74sgeu8xaqU/8gmDNBZXw02+GGZVQH8ybyKF0spAeDXBBvNErbUk6k8GCllJseoz8bcUqYc4jrVhCXFQRzAziH3YqE01UbBH4/8C1dT4+TqIYcOJZJCOJcuhqeHbSrE2iaT116a+r8i+G9M8xUNsnuf81yS4FLP9prJrvC1DoFozLiBXbF551AfRR1oYaxLo0kW9iPHDeOq/4yYdDFnc1bDGVkqPYBVQuwrkln8c2e3f+fPVs7Y/xQlH8DjnIljCJpKeMwS0YVrA5PfAqFjlC3JRjouO+wu/FWcxxQgxA5FI7c4qFjJf8WIkfkMJc/qVE26OTV6Yx/qgrofMPAAYksWDrvJFxj7e/CpCB32gwJHC30Jzncres2JaVcsOHw4vi/9uv0yWNbp53t/GvQLZfB8L1hTzR5Fsk4o7Hn6aYTWeeaXuWORpF6sSS4e9nC25My8vPSsj0kSfxqW05bInV++zgIyMb8gqHTcC1H042NutUpWGhLro1xQrM3joptqrm2S3SMHfDR8ofRZ6POLeWwewvHD/dEU6PkiKdlQUneg/Ucv/Dw6uNYNBeKcYaG/xAX1Y3voyC6lG3CciCh1YVaGoMAWsSOMLUAsvHk/COnzk23zAcpkqoUnpQL9eFdyPHFkAJKt1HAs6xwuXvYI1YxjPxi9UPJPVUWxjAnIqH33oGvoD4ZYOAfy5Ozu7ZdNt9wyMExP3clSQQDtFV9Qqlgg5owq+8zIA7wJd86Dru7nfI5fop/KCWJzwRUUM2iEG+qel1mk6aFR9eF4tInhbTF2ByoLo2tvkBmfsf5ukksFAf0tkKnV4yZ/ohHnHMhDOxn6SGyZbqr+RFcS3/8exLDf7Pkv1R2FFajMrxkCAje+DBAhwyo8cLbt4btGGmzl/edpHx6gIyzY1UDiPJSFlangUiY2oiTxba892bVwpJ14x0dGFljTS6tIeZiuuM0wDiPB/cRRN1ulTJ1lm0zzpcMraldq61sEf8f/J3HwzifMI8NDGPYJIUS3jvea2S9He6t5OB5rYnJT6uZ1Az2KY8sEtFvRS8OotcavQYhmxi3gJe8xR4u5OOLRN5tX0ddi6wrxwQf+BLTfxy9tZZrWDyFt2l8/H+K3gyl55UgKaK1C9pSdZd8WlNAkEzLvmHs/CGB20sMfjdhVM2C4lBPf7ObHTlmi3j2+oI+R68tb4tjK6hGWVVsMbyu4d8PpB2U6QhoPCyygKZQA2RgEEOABQijYtcahd7IWIPxfNK0MuTTZk7w4NLCIB8+5C1jETxStUsHPI5TrEpuqI+g9XC81BsyXQg21AZZytyY6QNgkdsNIL2r2Iq6jdrr33DqRwzpl/YDapECXOaKGtsaHksWuWM1mFFg5MPkfMuHSnXo5ljTfNkxBuFyDoOjq2tPjvn/nnuCZ8K8YwKCKlQI/3rlNg4GF7SxxDawXnwDQ6AHx5HmyzFedKv9dmqF8ve2tMhwXvvcJVFssk7tROSX0iM9mjOROepLRHXGXJjgQM72nveg3rOw27KgWYY7wC9TmU/dk21ik5ykM3Qq8LRL7MVE7rXf9wKidT2gmMMU1oN5i139bF1yAAn6NhN7JBfRj6HugL6HCX10cg8sWPmaJoNKVa+HGl/imc0LaBd0s85Q1uOWwd81dUp/QzGD5CDitv+usE68WSSWqn5cknzMgXkC7TSNNuNZ+l23yHnfb99ZzXrm86uweaztQpU460QEAp/D9I2RbMHw8DCNTUHffKuik8RcD0bxWqaUTdfny63dkpXphNTAtMkBYniKtfpiWM+pbEgZP+t0qPjXG/i8PvIIZDfBceAaxjOCqQihm3bLnMXL8VBpMvGqv4gskVSJPhFR4hhgSPflwh373n2GXk7zchUz0DmIk8/uYzzPTdlVbGPqyIccCQB1QDQ3mw/NgHnbL+VsZeIaTi5LO/S7pgzRIEmo91K5oKcNCI8hGyWQmveo8wU9hvZnn3V21Y06YFDpKzIebsSSNVFqUqg37//GKA+ewmJzGkF20x6zl0wwSH5mIcBmB/jGT3/Kc9nM9K3QiIYD8+EFEa+tJ0OtmgnS4QxmzU7tSVTUZAzvJ12yeJDe3C555B4IdRUhf5k/nS6ZFEPsZsrCW+2l+fU9kNnGlFnQyM/rDq8dbn9tlQUfvGCLO9XWgU6i09WcH4QsBB3CZnCMWTACOAy/8qf4SUHwg6l3XHdGLDhkd85UsH/jxl4fqov8Twjj/2JD4qmbphwV/p/d0oYSsfmUjsZHxb8k88ed9EwMNNW19aPjbgs49xUZUBF3vm+4wWQ+6yrBfSXA/Satc9UJ54tXP43y9UcbjyuoGbqhPj+z6IJE+AnN7cWdW3RXIFnfKNi8MCdEkEW8KxHpFDx3MgGbjQPW+6+wsXgUbD6FJ01+ahohVV8SfadgLocudNP2R7y2CFIlUQRuKFr5/525qxiN82d7RhYWpwcVpHsdktubPj52b/uXxefCcbAxTS58tc6QpMEr25F9ERS/MpakwPAOjNnxJzzV4h/ZYFrWxPpCmoe7q3Wk5Yim7u70qlQq6Nnu2I223y9gWbFZ/IS34PtFNw8KiThKuD4Xb1y3vKoq6OmCSQ7gAH8SAdWLTMmWaJysywyYKqa6IeYerX5D7nGe3Dd06mUmmoE7l4ED6nAKCz4f8N98kaZNpupfvE/bmhbccJ0i6BPb1B+62XIig16KAy1nLdbr+j6Gi34Nj/QPT1KKvAVGO53tC3DFp+ZjO/MtHo9CIRm9iIH7Jkz05b8Xa2prRs1akHQHIH0CzBnhT98YArkJg8KguniDBI7B4VY46t1tdUkbMz0MuJgpptAYQo11bN1QH615oAu5L8o3J5xbo2d3dqCyjfOLgOMK291KksCRCV1CISeVMn2bzqx/vqufwXsavi0GJjoKhKJ81Ucin33ojNvQR+w0tOVC5K5PnUgFgRfikSVqSoEUp5XzGZk9GsP+T2Ttr74Qa0ooPSsjpTA3DBmGx2/MTBolBd+GFq7EKW17dgY9ixvJuA4CLPvbMluNEl2c0VxLINkjTlwFudtILfZl8+PK2TUh3CJ7VhUa0BxNjoU6CX+KY7m1OKoJLld1G7Xznf5Ys4biRDbqN0Y73DXualhuGocsbBhIRzm12zIR6yIXK6ZFbynMSuVQN0Ta8x4jUELuUzFGRREYi9FJnBZA0BR8ORyXL6MB4IMbPkn9bMJ1KKZ/sJ9nZgwTLcqBzZEwlpRPmYMMbwCbVecAjLU+vVVTs8s5EgS3qFDmfOccwx312bF+PRpUQc7WEPmKxI2dTtMYJeDoTyzhxBc/3UnNTrtJpKs8clIsxWQUTHWwyNXgK6Qxb7icl6fePvi8SpsZMGnGZBkUUtGuq0LX8bYfBcEb5IRuV+IXeQsjxGzKuKZuoKtTPvSlsP5Rlvv2EhJj/Y5dRp995N2eN6w409KKZ9txiwOy5JsRQUnMNX2YZC8ODRX5A9veMexbHyEbFJnVeIiyS8Yl7FeVVcuQLwVaKDLZpn7xf3n3yUldN+iiinOH2BnqSITmWuY9FRQSQTJ0Zyx11wzgaE+kfFXcmXBvlEMtcp6vpnQDYE1Y0ERZxMR4tjGztNMxI488by5zPI9gbW3wTWQBm0DfwjnHuIbv/dJnEQlWf9C0t5D+sqa1kJXWdGYJVot/ZZFdpiMwiL92Mm7lFVTYipEZFhfieFaMt+i0llHQLnpRtlkIn/Yz1uAAud5Mg3f/mQ8ergT4cHSIWbmNFdyPzFeItzjVuiKUE69mLpvszLmo7mwQF9joQDFrjY6jq4R9sR08ZMXxcyYQe+y6/S850b5UlUdaFGjJAXXcKihDnogeUC51k+T86NwjV+2btiEVK0TvpEQLbM01+P4/xxoJ3Xv3BM/9igv6BFn8A== template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-hostkey.yaml b/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-hostkey.yaml index 72eabd11..91291d67 100644 --- a/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-hostkey.yaml +++ b/infrastructure/secrets/rucio-vre/ss_servers-vre-auth-hostkey.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - hostkey.pem: AgBjK+T9ufKXl8Jhyp1/0cBQOyh1sxsyJWpWx5vhQWp5f/mRcrBcFJ+eu0tmWPphnEMjYPeK8oupLn7IqmHar6DLIuUIFCf+Dzbk9ZiV9Vl/WgwIeOFNhHRsGcbX9tPJhu9iX8pJL/2wSJkUvVXyOV8Y45JzcUUBERuwkYeFKTTALXWWyYuWnbhKVOoYoBzDB4lCHWJQmyM+bdmrvy4d0evc1lTZft/pKcqTHZBp3SI7lVfcaWzLxrCrbMmV+j5I5N31o8k3dTPmWnimDuHUchtyZy/Sz1dPrI8ySbkxL3I4sH+0HNJfcq0p3laFxQpC9Zu7FJFRB0iR6DTYn5xcyaWZoeHnB7GbWlPO9KK81Yfl3Rhgmp3x+XlKuPR3GQ23qhGj4w3xyX5irFQLZn1fsyGfCb5J9CtyLSkXLprK4q81e0KM7twx2fPAaau5lLKbcz76w7sOL3Qk1NNOBpi+M4MvS8+2rqikdRRWpoNs45aemExWC5uThyHDlc/QoLTOdBNugc8JK1GuBf8pL9ioK+fGZMtnvaSIK1vSLR1QSDriUPedqWdHf6OqB3WQpdDs0CYkcrYFOxFa5M0Dt/DA2cZyYcmJAUgoJFA3zRKSA6JsPJ4ARnXy2sgLIp1b4lWHsFgZX/DJ4sE4rxTmrryK24x28IFvva6y0mgGvHgeeF6szw+vRyy5CTf+91sBF0VQbSraDOi7z70IRG+rWehwMtPL3ypq7bg1WbDla5GQ1HJ8mUi41re2Vz4ZImlmtpiqbJq5ScqP4CrIYrZxVfE9xM1NjtrOYp9iO09wtG7RfoZwwWhQlPjD0upu4FOgQmV3ISMY7atPCwoYky/dG5o1sySPaYzhBVzi13sIZGfKNdWO+AJUgAZqmkPp+sCvQ6mlGZk1O8w+zxr+/C5J7xZvZSVXhscCbjBstZYEGXXuNXWoc5GS83hKyMm9ezVy5UrS87g7wnF0YEQcF04vr7AzkFzLFwo6r5dYV8c/Te8G5gOZCCxgBk6cgmvQIsXIBJ/84scmaxW0AOXQu2umo9IqpmnifBxmO7iOiU6+cSC7cs4jhVN0YgRh6dHr8aEN4yzGBQ1dxYrsSedQtqK1OhTzxEYXcEBYubvL87BWWbRn+D0unItLkhvlhhwu+M6XnsGL/iLsTwZDusoNKYBSwhXeKwHVZkwlgucdXMUTW83tGd+bUAq1XT4fLSPi79grv5pkiIe4FPE21+hjQW39bUROxXf7NIj4uFSBs9LjQxNv0I/CNy2pPQSiK8e1zl8XtGbcGSaCwRz4jsF8mBIhk0d4z1Ic2uoSHofQgAeUzaa+E3s+Wze6t77WFRuG5NohPMHMFaCwr/WgWXC1Z9Wx1O5hW9Q22tXg5It+R/ArCG2anXxeiP3VO2JOlXLWMGIi5cgdqm4kBfA7Dpcd0UQVXB6ItqbcVA8LE/1jluYqZnWEEQIqfKg33NW9a/FZUvQI/r6wwXc6BfH1Ica1IOEwJa2FB15ZFFyV048Y75raIvpgW8r8bELRYjyz39Lu/5zapRP/SJqrxFwRBTZeAU7FlnMeGa5MYt/6kMdeZwJp/XZ3hFxnKoUdIvjByPL7K4eAbfejb0nnakBx5rc3R6PUQ6BAttedcIo+PrM8p8WpP5ETrD9AK/IFTUoAElga7rKk2DZUHSIM+kQaj82UYoEzxy5G4iTSjfFolzOO5/0UJyJZXsjU+aOf05mOvNMNVyNvfvENSn7Z7TmsgPMxG9daj5/eWWePbC+Z7+L1R6t1nAnzxrmWcGueNlepAlCREDe6KNt3cbCm3ZLnmso4LYarnKxNHCrod7FNYrehy5GH/QfYj0OOw6bFkdqXEBKZTccGLeo+QIeyhMHHSmy097qd2ddYdDcvm2Bgg2dxLMHJEFybc3lApY2YF4IZHWnOKuYsTjpQTewS5Mt6vXx3lsNVFRd5YWdzykLK650nqGKpKmsed2R3fKbrm/m27IP+0we0phZR6fqXLoHGkmYZhy/SXR0Y+zxC1HonejqOEpXBvi4Hhb2iRTxcOkGvG2qZecs2N8kVQw27odFcKWQAJQgYqK/ENixd+WFaXB59+XwKM6eZv+EiqIEGVvji+9mweErv8g0fKKhWPHDqm70AFAl9+g1FenRFt4NfU/EIDvqaQOEGhF//Qfeily6ebZUJ0QqtDfC6HFBREAyuyz5ZWJ010c6GRns9MpyVAIAsuaXiTrErCGXhGkTVeV3tHlmc+P3oQAxChvhkj3Kt0R6jeMCtccLuCZ1rYGerokfWAmE4QK3XLjniHaGQHnPaB8bzo0i0gOT9J9tsTZC6LPsjZ2DEU02aK0qfQ3nDDVXTD+MEFsoCO6A3MLRpp09r3/32O/ujxXjuL1nsqYZABg6IY/ElT4oxyhsOIFmMD72NdZxONVsQ7HYWM5UILC2a0Qr+JNTh0uf2sj6fGj8g69kULYZQcDwEtbXEtQhCVnmNoSvCqfURjHbVjJiHTyR1QaeJhBbXfRxlLU6F0f9x5OdSHhEEAjgMZa1I8/yzh3jR8wvfawyIqZhm7yjvB85y7CO9m7+VZHdT3IYoXUWZH0O3GuUTVAGlXTkElfsHFnkFKax1O3Xw2yag6nzlSF4ZV/6QlMZexNvCzLLoiRAs/Idthi5GnitwcMAhyjFG4auAVwksC9FQ1I2/2G62ym999n2fPE2dKiSOMYKU3m7OgyFSDlZ9V7RZMaJqzDCeyfTqjvh5XTYUzvQ5GGvtYmRvX/caYLl6tQURYMWrsi8GAx0PFN0Eaen/wsiUZL4knllFgS0GsnCFzJv8kOCFYN7XZBxss9EgelZrnqHqoNABcs0eMH0ViXY0/JauE+nOF2nFiogwIReLO62y2NNaWmet5m7kDW8AjgHI1ud3U9KpFwDW6eJgWQE8JrvckgsPo8b9Dqvex4wkg/Z0DVpBOAFukJI1PXG+0k27Z7hUJKxsQNA6gfY0atzqXklkGA5ZwNjLkIHwCmkU+VA5lBeurCWA6kAmCmhzkTptwIESrlImNyeey+V1TaNTJF5nUdKBVS3HC1Sc4WwcHHiuoYDsivouqTzStQ8oHc1oYlFp8HPCv83B0b6F8J1sW6jTuNPhO0MbAs5PjURRFazZYnnRIQRCsCfI1pG/dZGZGLyYPMoN + hostkey.pem: AgCEqotSZwsyJFAlPNemZzyyF0SEACOQgE9O9D7pVO7PwoUUhfoAsaFVIKCXNR9mBS5gd3JCb/qEQAroD90OoCme7vhN4cRODx9Cr4tvmNPNCZVzL0CWVZ+vVaE1tKHf21+1dfDsPlnxQ4A7durH612sOGeUHNAS/KFFgY9uofdUNlFV37uGCQ4VFWRrKbTgpW8LTMZ9pU+qoGd3RM3IOTdevsSq09govc5O6TPIDXKnbFu/WAGaOIaOXCWcZ/sTnnHKbCKdXWQcLrJG4n40sMI59OyLK4kz/n/4N0MvNSRw4XJse0cmFIm3+K4ODURP9lDlyD1Rb9aKV+UD3ThOkvw24QU1g4BVRBoXNHfJiwzXgSjKWvii+MP97eSOXJiioFtMNfDiWiXKoXh33bD/L4CClT7lpIvS5sMZzud9ir4j3S8qTOWyMdtWGzzNgnySyc2X5R1fD0Nl2RKOyrpgXFjALG0lwWXdcpzKtk1D+oEa6pV7AJs90Fp5dZuSkZqf5nboYzMiB0EMeIW5mvvuCUnS9ekoiQ8niQecSj4GxlKKeNhvd+DrniZJWxjcCL0wYYn0vWHZ0sGGGB/ixZ1he1N8WeX8atUtCiCyXODSPzM7nhnYEpyhpyvvXnLpa54z5v+vjQAps3Ru9Cp0i0seSDwtD8vml21bgPf2yuy22cc8bPl79U1eypZlynzPvU6+xscSbC6S7urITloWjR7TwoDQcRL9LDwCQFbYswQcvAmFDrotJwAKHdTQsZMBkI7F7DUFFxVZQENDsd2WoO8xbikcsm3CCjUr4nyvvECApWAnp8QScut0snoyhHFz6N3tfTRoJUN4zrtkcumYhcS3tBibyuAC/AVio8azUJUbO4n5Ij+fFoTEh38ghIhOlWV8OqkcvG9unEQ87rUWHeJ7G9AVgy6s9JaAgtEC37QDZDZ7YRnfucCExSBZcRdEqSD9Iw720Le1Yqi2INwIe+YVCeyvoTxhXc+JWwvu/b52YK3l98CtPH01jxICnB3cdAlbvL3Rq2oEckneUfpgZ3o+vaigxU2xSqdrkDD16Jp40GRpSPxa79VsjJ9AeKsMH3LTuV9fSjP8HPnB6X8iYP7QLks8y1UBRF6ZjpUOq8cMkVj3fCgDU7c0V0ZLVMwC2dwIQ1jQ5Kwqb/npTMSmXrE0DLIOx9EJMqhwiI1ih3aJsPJr0J9kLqyTCUk1JNClAgLcqWGhG60DoSZlULu4IdM9QTS+U2ZyRUgPLe++xOED3xXEp2sRSpjsVkClWMmub5SyAY8EYZoGCEMqrgnGa/K5BDgOaYuKYPCwak6eBDK/1rp+J1y6I7OKAn6lYuTiz7T9tecFEvlrv5kPYqT/IO7OrZqqswQyfJAQxJfH60Ui2E0Tm+iQ9HovOxFaLezX0hRkS1kEBCRhFyySbMQC4RqLclw182ElCdQ4xyGFFIuIyJuRjf0P+2syWXDWknWYEIWgVavC9nNZVWRQzgD8ljd2T/e2he8A5DeMK2quiMGYxCUteL74VJ9WmFPJ6Fcg9nPK6gxFP01wrX6hdFRp+PybQKw9D7X789ifmthud+9mjya5SMlnhBIFSfYC7+jvgTr7ZPW1mbgdYNcj5S/ATRNYylkraZ6ub04KxcQzGYUwHlJiu/gZvtJDeXSYrNkCIx+lF2rJZkZa23EBwYclsyk8kSI2lU+O0XTmIcR0RFafD2J4aiDabGhxlhTqxHccS7yQJdA1mh9bTinUUj3rHODg0/Z5A6Q5Ut3EgV6aMnzW0UCLAywgQksF4Me6outzAUeKp3mpb1JbvOg1t+bDy9Pf73dAmVYtrVgM8xO8eKSLEasDU8P5/HxQTQjvaNxMAD6B2qJmBdUFUm2/4knYMd+l7CMX9GMh0uQUi047dxfRrEgVPfm5pVLyljQhxzRcdWDjJzkfxAVOJwWBpckYJaFFJxJvExHpSMRGqDItJQuacKWHRq3Ts6iePWSEPWOYIzN1c6F80t3qmHwasxu7fTBIIkC+uvpk3lxWmr37hIZkEAHnWh/Gscz8tNW3H8tSCBg0o6rmSKHyTwKzo/295Q3fBLPlHXO/E3lNoowpgEM74PNdszOhkjKNr0rI2xh0p26LHFD/ShoMpBOUDLUdhB7ShEYjeOfjXR4GWorZMcMsKXGB+3iiOcWf35YjjoP6rnKmZkw+NLUd2PXba0FuFkpnsDgnN6G2Oa6282Q8tL8T1d2CU1k1rKME++qVBqc0wTQOSS+T1AY2uqi6CsHgw7Ai4vcs8qCtRX9EGrPZaHRPZwqXWi4PpFRJasoP0KORe1aJbKWU5Sy5EK5hwzxsgXi1njsdl0/n425mTGoTQepR2Cim5qq798/Q5HqgaLPmRCAnWpRu4E9oPC6iACYEbAcVJbQYEFTvvykKqocQmusMLMWiNA4a+8aSe84HK4jeHCMtZtckNW96cui4GChM61M/WdbhYqGJUuIpEusaxr3fesGp13c7rPVScHsaf4eNK9tRed1SuPF3tyZDY6u2qGHiCR1HvUdkc7UBv1fjaonp+oOR63OP2rmVpXePICZpdL+GigSVUeC6Gu0dOfuvBrXS8L+VJHci56KBBp1AqaMqj97l72Gv+l/NViHbKNNWKCP/CR9Vm/NrGoClqYlSzasGacsy+/6HqHYeZKCaCNYqEzmoaD1kTR2ANc2YAg1Cz4GAAheuvaovf//hJ9ZzgthHfMu3qixhiawPo9ozmV3VWgNy78nIcUiVqAghMcoeYHF8Z+6+1YSGa26oiYKdZX5AIRIVgGpGcfcyliuqkBZpcL2t53G9y/ALGHeXm5GZHDaeDOxvFjw9ojcjSrohjtmnYvEBIF6Jj5zN3dHjaH0MwbfiwH7h1haAjcz76O2uGW96FvXkmNnbKoJT7hu7RREm7H+NV0N1s1SQtL9Sm13/pD7ONwdID/ObwO8vuCoTBTFYZst+AtujYCqm4BU0Krj1gGN8gowj3VfBY9RxBAl2o+qfy99xKXXJhOrJ3uCrjG4EA9Rd7aYzPF65A1aQ1ACME4dD9Fa5822fV+WJa6LSSyxP+u89585u23Q/3UaccKeaHfCmL0sT42YJDpLSqEtkB/vfaTTo5bxD6BDiWbP3FkMCDWIu2FAWXvKqLn9fCRcMCssa3uHP template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio-vre/ss_servers-vre-server-cafile.yaml b/infrastructure/secrets/rucio-vre/ss_servers-vre-server-cafile.yaml index 62549913..614f0cad 100644 --- a/infrastructure/secrets/rucio-vre/ss_servers-vre-server-cafile.yaml +++ b/infrastructure/secrets/rucio-vre/ss_servers-vre-server-cafile.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - ca.pem: AgBbsChVU+tOgWLgEHTaXzm3qr3NfDMrTcBW7tLkSakfShihKx8PXmNtPfdUVZ65PY6a744XtoihDY9bou4tJFJ3O2bHsRgZHL3W0B0CMfjXA36UQdqHuyoXhwWbfR8B04aBhpmEtYoEk4iICSH3toy2oxYg8gzN2XlNeGGDQSB3Xw7dNqwCDv6htSJ5Nt5eOATd8BK/88I1WOYBixlWEobFJPkFUvSMq9ZmVkdJ4K40UuYF7YxHLgnPO2o1rBPGB5vwM8YG+5/nJ2RHJhPcvrmN9W456oU7njhhys30Jcu5yeYPUThV8aVbCxMqnPt5PLtd/J29UjoS/8oZW7k8LUVydN9o42m/fr1pRdRDuTZ03FZWRugkIOOezS/j9+acek/HZAtOWbOGZxk0hgYMUSAn3Eb/391jVcAGRcyv4kQMRsZz3MFIQ09IxTVpc7FoSnm4o5du5umnzZrgVOLT2rolFH3Gat94JFq0D/1t4WA/1JOuqQnsebEeoQu17rcevalfigxc7/pzwoJ3BZmRp2k0Sk6yvg0KV57RX/gXQC1DM/uLSRfGBaLMVjT6kvr9Cjs/obxQS6HvODkJrZYQKDthYlWhjbjngqJB7DP7Pn7FkjbsaUeqn2attSBcF2IWLhY5g2BrdNn8yH3CyAGJ0yGp8xHvelh5cz6+fijoON3SYujS9M3gbQ1+jealbvZMD0k42uIDctiPxpFRiYgRW0AIcWvTYu7Iutw4BTmjOsFghn5TClRqehq1ESnAue6aTfdvHIbt9PiTp2jwCyG+s/lwNxGgaFngQTr15bx+oZogWa/JesK7GTZhybqZwqxeM80BZlS3PEHb0XOT577kdX97tcSJWkrO0xLrjxN1GzyQ7MZotrDkyZR5p7/67TvFE8Sd5nfEqylDx+otrzUag9muaAfaxWTRX/DDYecZItAcq47iIUebw5rWsPqlbv6ypy6eA4ofSG4plKzI1E2y8y8yojdI2rSGdge9P+tQahzr/tEhzDErMWZ4xttFPBYM7Wp/5GEbc9dUnRdUR1qG0weNqv9sVEWOJDuxlwT6RK3dn1elC4R2cN4FuYC9Wkaxjc6kg2ryNfy9mvGCj8PCYN1gcYtQyTnN92GP+LH8JRWafvJq5w6SQvJC5o7p9lryf8KXs/9mHzVcEyh6Iy8lv4QXo4QJlofohnY8wj/+NFOmVIdKyRZwztUPz9C2HjQDpQ/DgsW3mZM+TJjV/GhxQgYNgllB3ZsUHXEyu2UiW/EAf/jEqYkByR8bVF+ULdF+BfLZFM+UFAtPd/0J3lmFTW5drDZGBH+tmY/qnJPtrht/NfbhAdpRuRqFISraCzY/rmyGEsbzwwr3d985XInGKLodzxH76c9oyNBCEMmDlMpPpZZmTYTkTdqa5pAhnZsH29MIJOQH7mtfCI0s29oIM5m+hoeYzA8lOhSvszKEaADI5xmKCyVzDb4DtX7sqjv8riCdSeKOYcjGBCof2AYvKh8dp0yuzycl4oHMkoYzKWClqMr084FUfpmBOcK2HRQqS1JJKPYTjlKBJNTCu6yqMBQeiulC8bQRv0w9aA0Y7DtumD8/uWTMX3griffB1q0di1SvKYUAbdHnCrN3g6w38jyhY6LzM1tuiTvKf37AKavLW0oM9hsDW9S2PEFjXFkrdu+IHkSVq5n1spQP2e12E9fJnRvd1KBqS+favsmhAX7BpvRsCW8HIyAJPpP/wlmiTT/CrAx1afACpsPJb6B4tSkmLrNa7NRln+jnrGj+tSTM4wf6Xrb6ABwcDfWmW1O+0zAkvC2K97vqKpJz55Lkvuy2LjqhYKKBKRjB99m3mEGHB+Oc8wlMLfy7ihoNIGElwhyc9d2Svd6jUnkn+XH1W6+WEBJS8XdCSTZwAcN9ubmjj0uLPRpXKBOZpTU5vKJPyvhpYFZ55mEbdeXNGgu4c5QUpzkS4OM8zR6fPHiNH+MdmAZ/4qn9qk0dzvhGMvgF9nSLo/RaiZGOtY1Hagv8F4YmlFdmbkSuWa6AJBsXE/c0e5jWpz7R+meobobQFkmc+AB+X8YXx+TqtSF+ckXo39mbRunXFJfZjLSvUcGJ1DkoQIN+sKD7LMrtXcPQmqleu/5U28tI0jM/Y2V5/QDyi6q1fK1s4JmB2sQvpQN0XQqbJrrQHKwxtaSHyNChwj4eJiyEgTXCKoKg2vbxWTseb+cUephcZ/weBoNrlCn4NlT2wmzFHYsFKDfar15ljegsF6ZYBT+kuCNokK57ZAXrkF/Tzy3AryIeAty9kkm/55wT/b23nkxv01w+Vg+kFb8v7GHMV2DSGx18Er7GunBaug1TQ3rjGahA56zGGtNyG1qvCHm1Vm7Ikgai5l3mdEtfLbUgwryHdVJyp82EoSsGP/10B+qVG6qa7ZNBOvDg9YQMYbjb5N6VqPqgcId2ITlK04lA/t4keQ9aQfh2meu9rIicDIQ/0Vguw3sA5zOkXecbe3zcmvrpnjjxf7fTL2iN5k71IhqHQNuOMIeQA/Tg7lXq2OhUbOE+lgM2ZBMdZCm70Cw+m+0IcyDUY8zFsESGVpnbSVlh0ENzFii6s+CQWPQOqSCMoylmK6zg30PC/+oj8IS/BzueUWCC3z1Owuu940bFUbOc7zAyTo8zo4gCZehaxqgmfKtFeYFZftStEcAvpeegTgw0zlstQMUzvFr07eaZir1ae2nKg8OZ1oFu+qQWOL8I3pGh8K3b2QbGeFJBJExr4aY6KEFhyR5HPF3C8NNMBcCX28UD7RvlP+1jsXGeLKlZB+siZWs4KnaKx3q6OEczQ6lLek/ttnGO0tWjy8bLcXuJEqeRPdS+cAK0H+HYCQjH9vPkHuFSgc8s8u7a9wrWda5jtXW7XdSFNe2avPH7nxILPrP+pFpEYBwe+MKoHnIL7o/HrfCHWej4ZMZ1mN97KM1G6SKLM8p0Jnyj7uon72epWxzCG1Mb5ly4cRd2+3LBoTaHq+3IiiHhCFYwZeE0svJXFno30Eu4wIlOQ/6EEcTI7GG2xjQ9UvnO86eVWoTVX9bqbBNV3sbyEP3TANJAZ3nVOwdrtrySPHODdBqeEN0eodZ4Z9IJ5NUovASX+mKXAzr5i43HY9Q8lXQB0CjcdBSVwZ1iCZyqAuQir+RLz1I4DumgBnwGRmELbJE1yk9uvQozWhc35QyXjwqnJ0HFsZGwPvdDwM0Sl4lvBOHm2zOPybE8vYhrOCTEAMwTpOzvv8WNklLStoiUdpd75DWthctzrht8B8P71WrH0N0ekdll4vc16eN0Y00HXuZeFCgDc5g18ZWsxRj8Eu5bkcB9DPSFC7S3esl8XrxuZPBLR6QW1lnMQzALmni/4abTLB/rRo89ymk05wWKva1IuJPPGIvHasnjRJhN5yV6lVP54sgM97ErU92GjbRzJe00yd/zly552Y9sxNXCmAvIqT60FtlWvz7pdsjRlNr41kLLb9q3NCnS0ZjAllAhGMyjHm2QHy7LjvRkcSo4rNj5YCdXvkmSFW+vSDLR0fmcilJec/0h8ZWC7F4nSydgvTqqqR9OfZAEPGO19LU4hTGX02N50FijwLGacFDmBREB0nZ4xQeDRlk0C0ub/tgNERA5D5UcXHC7jp4zmTwH13KfRYvERtNc+R7X1/ekN4MiA5Mv1PmnntvJ/0nLuXAOgP8u/xQRkAfhXPjfsnRRVm+1VHQJO2Hkru7n2EHrh831i5osoLX/zVk/8PHlMBR1y8qJ4XGyFxZudo4t1G/W+nly9IvJYUmMZWz/Qn99l0bwhlp7uSe+mJk88074cHkOdOmKwBd3VBxEc5Rki/8PFhlRhdnlcBap4C/3u/Rn/Rg5QqJfdgSdZ2DhYxmwaKWiKmz4FKYVXqqUewEKxHHRE+43xF1e1aUcUUTyWUnmWNJXks423aT/q+RlxSTXFIqw9jexg6JEwLjYdr0ruBIavk3/auyDw0nYcfWN2eRRV9OI4SM7XwoDvm3MZ0p8uDWFteo97MxOi1JAkYnUVDEk9k1H+0LfQHcBOcf2bC3LxveMoaZsijYXE4xcAo3C6HVCOkTp59NNo4XrSuGFFxW1NBeaCFFJVssPs6UlWbZrTKizt6v1zogF02dOUNejtrZduNkh4Mol6r3fLH33lfjja6yaVIvpSFWVhGTSqjZoF/TxESEf1W81jW+TQ+hmXjkAXVIeOf8gOEbSDrA2czSSmo1vd2dDuD9jtQ5G/lXkA06L91vmiGvw24aSdjkmJ90K+60tUB3yIDypL0fjyDvoWWOTCVQncAi0+8okforpyW9ax/HkWvnl7wE2HcGV0ncIszamTHOfCR2GH5VIaEVWJ823cq0cCDMIVXJWPBRx8YPnFiAyEpALNuRMfx+iGTEEL03aD/gfSmVZ5xAiSWmaAlJLH/TIWR5o/cEQIwqd984jwlaPByzBYarU/JcV/KvWLNM1GUvSmoN3PwB/SzK7wVqZ8SFi0hW2coBZ0afD6shhoJxA7BuVTOi9KLaKnNFXq+PQ9+truA+qU2akvSJ0eozbWDcgeEjfJz4CiQOCrFSjoLc0dTsjjPBJwU9fUBQjfKhjCtOQzBw8hU8CuqqC/tt4IR62yizjf1joKm9dA4Vmy4YN94EXs2NaNJgj/4m1ACmtD8pYEI7RXJO6zQ24sckrph66JlhSIg/2YmvgdIQRCCzUhR2OL6KBnYOiL7xt5UzTpWBZNrikL8M1+DVIKfRkKTa2bYf+p3DRp+XrjFgFoMk1RL21+PWpsqAxL4WzHcVl2IcRm44dh5bHjtfW5nvkFRRt/V36Bl58Bab3LgriOKytLoqcV2PbG8zyHibmoXpanlZqcBx16C4bvbWyPFsanTd1AX6V6O+Ui3yIEAX0biPar/5X0PHLyNcbjS818gBv8huIt5ptISAcE+2o9SXBcZkq0jDl3NmDaymVNBSo/vjx6oIKy3pY/MsSCm20OBGy3yF7yJt3B+sSt2N/OTmgON+xW6egMltCkkuFf+hIX7A4CRiTADinpogcany+1R+jHBoBWb2rtsIx59kE988l2HgH3MJCMbj5OlgT5feFo4J8AL9zGVyCQl/zujWyTjSpjWhzkSquKp/py3TwvKo6AAPV9LGyG8C8k3vJhQrGFZIKpqAX9vig6IZFhiRPeZt96QDlB2SksPJ/bfz54JhsZqYtlsPlTlSPpZrL7nxB4xpB3akEODLGu4iMQaPOPLoq5SmwaZ5E2moc/hO/qZnZRo8FNoHNzm6LisUR01I76QhVD6GxARfRGp0xjlkDtPva3v+zigxyP5RWRyIeQTZprCEz34gyuG13/4jdW+kwrc7h7N0rVygbVPq863HFSm4kohVh9eLglt16qXwE+FwROCj+BSVBmXA+nsnmSN2RwvfHuc4YvF5NS91m1BIJ3XtlYq4iyA0i8IE/Wi1jly6DuPjFP2Ki6r5xb7gmMz0j3jZEQVVzKQ0sRczMOfBUPvUtCNhKKTFbdKr71QTQRmS55eqQ7c8EuUrCOqX6nwNS2Wo38FKLHPEZafv791YUkLVUIDXc3c+5UHPB8zvfhhE6XLYE84BxjQznfUYFX7AgQafPNP0E3KoHY+0hhaYS1Wy7fP2i8Vt4TAcqCjrSkpStjGDVPtUyLlEK8b40WHvFYwYPQ/NUpJsaAPs5UzbG+ziInCdE3vuMA23A87PXP3nDN/iYC1JRIE4dIMZelFZYB3ZE4ycm8TEaEtSAk64WL2YJiFXZmxbL4porknro1H/jC+ulOYUe0S0v8qaR1abu1MgaViMn+KHqq8XrJBz/flVVbuRZMPqTbrw9OnPw/1c0EHWMa8MA0XlERDrWsUtGsbtAp1nP9ljb6vMR7IZ0VqGDlS3q05LCLhawJcCmtOX//Ec0mUjMFToOKDqEcIFTK2L8JHa9OHt+16dUDa2C5gmZWa/mCbVvlr3yvk1vZoHVNKQqNUrenl7RmhCSOxyS4hAPtp6pz74KEk0FLvd6JgYegQlau77+GGCmQxbWjA8YWq5oqSqH1T2RUdy8nvk6Bg2nb2e0K/rOD/BYvEx+2QJ5kMF0o1Acc3fXqBIZ8c+6arfOA9VwBHhcx/qLsxsz2jwWIuSRHo7h0VofBRt3+PU7kU0GP3kKHos4FkWdLLyDgD1FVV1tA3w5CuKne0OwmzCgefPc0wcn5oXSXvgx1VoVkgf2lon1rc43dhTFKkb+ItaABG/RczMFPDEG03z77O1xPwUJE2c0NHTTjYIiSCCA8lchmITjVmulVj8fzs4n4aNrs21L/oRnyFlQ9EXhdzOQfju8Lznw9HhELhKImyLufgB5+3e/pqVt4f6/BJLW6rR1IiRhqWCbTneDiz3AZ49sfplYaQ3D5fPVUGA8ss2scmuemK3LUcybPL7y/h6vU+CFYRg7yYjn3ldzC9BTlB4midTkqR+ip2YyIS1gRCbTfO6U0D2kPRPD0e3qG3vGloGeoBCtJc1bHbYy6fCyl9khoWK1Mi7cn0nd1TOvFgDpBiVYBSn89BeYGsxb+0GZAKWB9mngT2EYs/MS+V6Ilk0loELXjRPBl6IEUbyWQoCADX/LaXIctzR006ikz7werFXXNjPvUv4mXWvu61btVKyTEuHOHxtPE95twP3BHuD9w3vBGrLhKoaeZcpGKH3c6KwggTs7dyU+q5n2mS8RPEuEEUvMoAokMIJLG7gpXxPRRLuLFNs7juqhCgL+abn7H3j3TCaZxpgp4p1yRMwTU8/irpvm4eqRdehf8Mnme7iCBz9/UdNK51H7FD2UVDv3sKoCVxndHvlehH4zJ2+4tmf8XL/GgYa2Pk83lZxqZplyjT4r8zq+JFjXVAbNxKOp4UIYyfHmrzDHZdQImXm0Jr85IAVjDjUezGULPy0S7U3ziskeXvaNiprYfBm5db5qRmecuo3zrcR/dKSQjDLuL4PC5WWWKxFKi24uT4pSHJGlhDlytGyZKJBGZId3HC1S/0RXpzbUx3WMQDpWGF71eke5TBv0MC9wdyJFhAmBVB8TRpOfwFNx9CplGKebhoMSanHXKnjHDUSPTq/ckHzpytOlFpxt+CCbKbnnKCoPgRU7hHdOoc6F1jph7N7+y92eAnevD2GFb0Ybiv2fspEZMVBO4zMDQB16jeuBcJtO9LKDajCeVAHQ4ZhaZAdZbgpwthaYStZT0Y+c0NaeS93RpxS9jsZpwys5D+hb1fyj62biRU6b9hvbyA6eS/3FS3jn4ve8/hH4dsr6BRXp2GBq+HXXuAIBKeSmpmgSPnwXIUyb2HSmDlQjDweBppd9M0mgefYKXPaW621bzS2CDciPCq5B/3Szf1joImTh/wa6amxVOeTbZAShnbmbVSaOnR3LuDgPHXR9s45o5CpxYOFkBFylfjE24cRBxw9LIJUgpgnE6kULOAEw6xXz8wpg6dBuY2/Ry9KasCdIENd32RmrWfj4KMnmLzG5OD9US9AHtI96tbGT2OTXPMY6abdSCJXUOi6gYgNPizgoiM1WMkyQdeJ42w37L0zZe2mThsC2DnA95n5fvVOJVcuAJThXd2kjN9Rx55BsTFJPjXH36Bh/kKKB58oekbTl3eAMFglZ5X9hsEL9vyzckPQD1eU+LFSNEWg7PN1wS5o5bih+znP19ZJNnMqM/2N2twOcNOM2WTA1qZ14I7lD+2pgPqeUV1hsEBkGtssgt88mFwiAUlAay4nRtYsxxJo4/Tyk4KWq4bHRzQTks2+CiQGvyV3R0AOgiEQjzEdOQmLwEobbfIJYu3ceuh9QiMfGmtZswSsbmDUMKqss0xBNL3GncAt4hh3J9MDhtp8zAU7P20XnXWmGxaoqXA2nrYm1AaGosuK+BwN23OX720Xo12wZZPCsSqdpoPBh/o0IU/ftT7qvBiLp/1+5v3DsVNTKkZA5gnSH/ooMHmF11BF0hXMvhd5AvHLvdto3MgoUXTcJdsTCyWa6d2NicC5HxEKNthSNlGItRlK47X7mGQTAzWWPzx6oxqoMGbdx5iWLzmtEhzZi+7JYyJi2hitPGQT3yteibQ+5XbV7SFdQNA/X0t9GmdXdUR5KTRSWCB+DVyiWj6eaWKN+X+RMm7vs5QMcUVsnlxzJu/Bpz+fVGa3M3uswrT/xjqmUzlBfSnTAxMmaMPtDzYj9ynvH4JXPb5y13Me1hL9qs81YR3v5XmNdQ+9KQDR+0wCTXIMmwLnDwjLZOQAglK8J31Plo772YMYD/6deZN/HNdUa+2XU1ZGJllopCw+DX6fccyJ+lXhszOmK0hqC4PHDq9miIZnyeNsuFkqk/uopa2Bx9yB/BSp5C/NfwFW5Rz6K+WYaMZKAyhM0whxx6i1J+MZA1MrPVpfeoh6IbDSp5v+XZTvBA5o+NC04/lFWGnpPj+fKoVU+auE6RF9tgkMDIVWU2gKiMHGW3DyIZVg73MPoBGUAo5srbE0L4t8t/158jw0Rte88fiHphOOpSKXpPWPlz97JZb8PstWTdRG5lWiXrFWMBQM6FHLoGdbRty14Gvd6NS3CnzMwSy7dcEj4MmoPMak1SG60VEB9gjk5T90pJJSj15wY70obawfDVTXKTiGuVUu0rC1bu3FePKyP+gjzQNGJkJyvHPr3doqyoDOgmYQDzZnzNX8rczPMFsaj8uO4v1xSUEQZoOQOohJ7YZ95T6AlA3ZA4O7Lm+v9sBJYEkuTrLUhD/AL54+AmQ1/ZCee5RwEJ8QJpewzaM1Sf0Q5QFYimfgnCHO8Aew7k8yTwgbN1sH0lyTMUSKmgOC+OB3a5ZMBxReds+TT3rYvAKY2fvxUVVIGaBzigc/AfCgQ9jLraQc2niGsk3i9fuwtQLfJErcEKudr32WOamPjMmzlKvV0UcbJoTsoF9hfhAVc85vVj9RKWOkCP+bjx+6SdmZm0+6ZjbWq9T5VKcjvn/3m5fk4O+XfN85HFOhb7CJrT12+F3w2M10GZFhDHLNxmjG1J6nW9mHlI39s0Y3z+X3TZacpEbyWNAhJ1t/pwQd+GDj+AahKwh+hha8L1nVV84VbEQCNEceSM0OcFxThhepVZYOk4a2rm6cywfPVpPiv3cvLHdlW6llusL5RXIuu4KAnlL+1PemYbbxKM3adv/19W+AdR8iHBfgayEuuoZbhhGhqzjaHBxS8pjnRG5HqHjkxhnlBDfx9arTBSRT2peJyxcsf/GrROys9J1dDOT0so+XgRIXfbj3ORrUx+Lo3k7nnnzEmpykApe5mWi6YkPjeRrVqjHCVCo4OwoH7mNh/JsROFuTppQIx7Ir1nwLz9cqR4UTP3vKEHZoDVW2NCmb5nZ6vUczPUwdkno9W2PBTeBAWcDIQc4J1XwWUiJG2OShiC+FDz9DXE+rscXco8QUStaqCB76vL/OUHK2MTo3Njh3eU/2TQxLLCqCxsZnE3naMPdCbF9T5Eqlgb0W3/btsb57C2+/vAayAq92clCjdXRSV1JSuT8lVbJObzebH5Lmcfm3HuJ7dKaXx6yLzGhPzJSnOXe/Jf1KyAcFUfNYibB/JSXjRC6csahZrEj2BfyvMcdcupDwfWXVG3WrjDq8ZDkDlXrZ2Vd7qsgD9w51sPG7e80wmJyucXCIEDJwR/ApiYsMnW8o3tYtHESBMDjH+p8mRlNw6ZutxghoU/Ld9clc09XAlgeDOZVjmz79tS2utY4aLUt8H4z992GyULzYWzOoXao72TPTdq0fmA0ESIfBAB1WDvpwPfkAX93zacx7UaX3VyPNJ4bmNqic7UX0DYe9tpmnAD7OL18PoMqatjxYInJpFoLdFtCoUHOOy9bVF/cbmHxbkhyikbrsg0siL2MzF+9WaEloXofrfknpodMiY6TkpV2/foxDfL8QfkwDMCSEpnFFNYTQq3lHnc8+2sFPkKpC64U/vJkqKD/V2HGmi1MBVD3HY34czrxsVgn8rMXPUEnJEfOIiS3UpU3eSax5poIusYxL9Picj3cU7TmKQ2xGqILGgTBacXscAo2xDOFOCvHhciwf51GW3IU+6sP7DXiPM1dEclSe88ItwJWibIIjL0qQrbR9HxtHguU/LH7w3b+ioUffEmYA4eUyBnvOBHz5bc5nYp+gdgpyQdUqDDkwSZp+WweGPX/rLPVtnHlIpfwjZCQ2whx1A1tG8LB3AnMX0MWTyGH6H0dq9PwSLt7W9IM/neW1mHpwyckeE5U0nJa4DTqD0Op/+mpRm6IzocRE6t0PDY2Npe5QmluwB7xRD0KzMLCeRjJUIdIwaji8H+vl9g7cjCFi7VCFuq87EvuJCvrgXoqjI23E3hPs3n9run6TMcivZOLrhFj2H5I2l6S0jd7GJOAKTq5gvy9etDeGldDzsewbIKc3MCX1ztl+OHzcNR1hXc7HjMfJMiOZJaBChQYhhv6rl8yxjAr48R66XM9q3EqWZpnJDpafxGCmqhqGdyd7vf29Gb5pXfUE81snN16s/EcTjML7SaXfE7A66FnAUhZuCd0NvcsnnfAPdYaYN1AcEt8DFjXdBpu02j/1u2hsuvHuSqpTTTf876iCNTIlkJd8TBSIqqTCY2D0NEV0zXrvfVQxCd4s8R3tW4Dm3F79BaK0T3ohYJ9hFVgLVKKA2eYdXdIdcwdPNL6+z+k/4gmrlapj/1qO2fveFgu5ETbMtfG8DI1Nsi7eGPbgULUKkUyoJHBmLwsLGxvEiXAqAUfSKGLdHHguQ/CPnjRKXY+8Xvl7O1dOYfc+W93+ZeEsBSMbett0ywsmqeLCb46dusOz9zovgf1Xu5goCqPG7fYCiZn+SE6FWbhzHXw0WUzJ2AnXROxKOk9+UQzNb6evfi4Tte3rP6V61QwDkwnk+jP6K5qj2T40T5o6/T1sGxS6HMEzlAHT33TC/8Kh7T69hMeFO4/P5l/g47ZNk38Qd0+GitFLsMqrvIwNDGBtpY1foCzGzSa2dEUzuTnCqTGAQAkPmCpOROtXub/sbDkXNNkLmggdwScCRoqxIekgFvxHMK6u8CUAdKDVfBgVrSTle8slfNMO0OOAc/W8b52eH/C2LZqqDGjL/05rBy+bcHksMJ3XZEENAoA5gP9qdIkBEZKvQccMTfzW8i/Ov2KTYmo72+mGh8tNn5tEwpjX3UtqGf8imGz3ELTzj/V0KRHuemsP69SErbNK+0EG9W2Nxv0hS/EnHTnXIBB6wpSj2FlThdWJgJEOkMb969q5DbGVU1NeW/VGrfeM+brPWfBZ9BYvtTq/rSTHVDjpKHDJj6CmhAv2LbjJMQ6SLCLHouMvo7bciTpUGw5lcyWqudLs1aIBT/zp+SEqfNz3oe9alUiH7E5EMNaY9UMMSEYYllS/9EdAHcSMoUfvYxwQw32RHVOepioCfHoNhYGYuqNGkEwbAfNDifnOTCwiYIqNxxrLmFQEI2XJgNYNk9txk+wtCpD4YI6VQILAxjpnfswq6Riy7LUh3eazJPLOpVCcPqeYal51biMjXgxIZeDNkmQJYen0gVm/kLLkarZ9/2LeioSzoO0fugIXMKSWYIBJNf6ET65LqvXxk2U414wikaHYWFUh2Z9kJrz2nYwQYBj8obbh5u7KeoVRKAqU45nBozCabR2KWQBKxd1d+pxj7EV+Qap8sauzy8i7yoIqS0yYKlD6qSzj1TNnwt7S+wREeN0vXOAdpWjQiTCG9MNFOHusIarm4tHFhk23Z/fgSkW8H0ps6F94yy58C0/S0jyKXcmw1o4Uh0nrmVJPbGzUNMlrl6KPQk20+DazO+wiSOonPoTAhMgC3y4SrkTjrOaGZt2feSwSWyeP++4khzlZuSiGwjfCmnn+BLxNu3UrftVqWyDjJ8NPTjhhA74ibE+Kh4/0d7REC3Oz3oBg+2ZedI3GPeS+SjBDyC3MzZCFiF/cWrTq8qxeXGHDSGayLXhtOFtiQ3/SXKl5iGJBWUmB0eqZNlvuRGUnRp62CuV+XqAFCPIzoa/4o4SnBfl6nL2Es2B+37ZPJRa2eibrHWurCH3WK1UZ+7f0/T/zcIxP8DScCoN/oz7kjGkOGOLgOoGijYoFQBzgnQYqAx/V+URMzt+nh0BeW7FsSwJopRZVGtRSNjhIaOLi1WbznSUUtdlz0rGnpoz/PhD/w2qGx8FLaIkRrGuwrn6MGYsYYkJO+IFSh6I/Wi33hBeiyBp8o6x1HRN8Rrfc3fj/04BoEHpOVcPjvNCCuXkTpCX/RXVMA/9IVzxcpIdFuLHxN/BRBXX1WXIWXVar7VxECj6xooUji/0t/VNmnqGRPps7WbGzwVKKkFDYRPnU7jE2vn64MkGQLfXtQvZnpRHq5F456O85anzqbneDJNwQxFiRFCvic+zrk65pVpzh/OcWgxjbWyJnpqFsj3/bIF3urcimeWhv9JA1k5BW3mjrS+ePPxbDelPUzrCUF9xvP1XtI3Uga6p9Xu4vAV80PKho3N0axnW+Din+eplYoHH1Sv23rf1G5cOWqpM/JawvJQkGUttGolXYHuMPs68q+LSh8XQcrz3dIRh8ZB3dpbomTDGdSQENo3bhalyB94Y16qVfZ2L3r6QG8UuV8FEi4fUxbqRjz3dsxpHK9fAD/lmVgOdRvM5Mqko3NJlTXRTxx2h2JYl6ouW+lLcLtXHdqMO707NjLnSZwgiKA2A8uuannjP6TB5+p8EKIDGQnZHNdkCjUziMV/yC02X4KuyL2jozLsLJhvODFBW6tVztBU5QQoEk2h3P5DNzaAMPTMgqNsILWOjKhSD4TjcchBq5s6PcYvLqlCa3AEcpxldC8YxrrD9VMrLz+0lcndEaqhJqQRCvH0TKIG6pypLMwO9g1mrtzUocdPQtBkg6tEm/Ng10426m+S1EpwREdqVruPcV5sZi8hLplJWdwjqXGqasqjyCDFlyZ/UfGua7OI9CFTa30vifhPFhenzbVcQp4ubZoCt1O4FSeiF+9QB1TEs0CWRK+OuFs5uyCowdU9Z//RmdNqisDT2aiEr3LRY4wEo7vgfesFyQwTgU10epOzhJ3a1CttLaHTzUT/FOQ9H/frjsrqiUFpN/gSNNF8nBTWYWRRcltf8WO00kuZskLt6rntt04Q7vGEaglS2qv2Krkkea9pt9JSXeJQSTn3q9qO8jqOq9VLFFRJD7a/5MCKPfVJbEXCjZ5tI5FJo5Rv07ci/8kyOg3UWCFwUucFT7/6lvwHHhI3rxYq69lu4IHhhJvQ/8a1iRGSWjjvcgZc3mNLLwaJe4b9tf/FSI70W4lw6A5ZoseHTxPDfVczlLQvkiNDtt7mgYigggKHJ9RJLSMRJpGcKl6mJW9am/fpcMF1q0naSxRmaNO5LrejcD0hjMUUoTRVOwaAKcN6d3u5B/PE7hjMQHGHONk1DuwS9sOXoJ9ALMWoBGA/qevp9sBa1YDimHpEO5SF9tmJscJslIgeHOYb9Qmx8HfHfTMwv/DGxOVuH02/loGCB3TrzOm/GiEef55TBo3J6Q0HG7+CZe9fN4Lg429rupBNmEm/17pGg6ikJrLiTU7kNbRfP4yDNILzR7KmOdqMQtbEY8AUwUxB992bHuQ9EOLIdEgPhmwqoTB+YJANq/nagaE1BKHExnUXrxOWBdxA6+KxkTlGeQkT178ovd3Yi2ngHrEJ7U/IR0odReE+EhjBka3x8haIfY9V1rW2UcKYW0LY/IGu90FE8CVkSEU7igOXNwEGrUFhhpmCLdTIF8wW8PLTgUg9wldbYFsVh97W17c7JQM492p3uS/L7dD2pRjesqFbEDBHTVR7/++cUiuEN6fBaNTbP3ZwUktk4JHkQnjcrPNOyQhTkRKw2W40KfOWqwE5Tw2vJPHmKAy+l+nHU4NjnghaIfgEiaZeDMUaPWZwtUJvzCV90+Qk0/6bs8FCB1g8J1E1xGCUBGnQlIbZH74Gn9CAZrcoNIQ3ZqrL/3n39AArw0sCK76bay4J+Q1ZYAyM1RwbJfPWOC7FRLSIO/IIlklytSYgS4F9xVrKj/xnQAMaWkf/tb6NnWsxGvG2mqB0uwkQDzF+WvLNE93SVtHEMD+jxKJiLrxPIVXdc9Y5V8fIfjJIPqz7GJ81mzBwBrMhn1MWFGN40gD4BVB2XzevSg2lxsDImY2yW/B9ntIsRJrTE0G9QgLqhEhTNKIz9MUlLVgw+flWepLh6/ledZDUnOoKoHYoq66zO29SVwiBNtJUarqKjPAA8yrLO+M40SJFIcsoukiiOYIxB1iDCZES58Xx6kpiaPemY3w1wzxOGKSOz7LwXWoDAujSkit00Ef0YyVfzlr0hi/TzEXd/OFJxV+x5mpp1Wy9BDv16vpe7IYflSFsTDcS7LUfOcpIgs/ToQUovWBJsaHZrx2Ki46194xoIpAx2XMLB70pFxtICWXcKf5VywxAAoMjQY4SHtypgJea27Kh8bn/v/Z6m1qDad/hE2uvHkKTn9GN++1eIuYRCPzGdvhZ15w8YofYTyfQ+/M3asfui2DLrR5eNSbdl7KbmJzcn1e7Vj5DeZNViMzzGRuSPQ1XvJ4bBjdMhKcslcXgO7nmQBqhomJB8x+74AxcBd5XvxKWUc7c2LiWkiPN96gNRFrO4nJc5PbbsBOGnBX29z4utkfu1wjcDqbPc+JH1EP7i4lXZ0IukoDIdMZVmTjJlgS6eA0GryBwGYo+W/+IgnKqYAwtCVEsgqdW6peBaku3I6z+1u4wgfbSQsgHYcVDU6lvCKOB+PDVIC1xs4zf7mOAxQ= + ca.pem: AgBxyxl8Q14G+NYb8ubL5wmu1w70+3lWTr4bL3KM0wBmLT3JmvD34eT2kEvcBw4nBVGAZELsJbY2Z7lmitfwhDbkA4WMsrzGHL1QmArelU4qxOAJCO+0qx/dGGYTIggMmcH8lU1GffoHuLNJ5ZVzGhW1ga6cWoFv9B+ZcqVgYdwwKedQS6Qv4gH3srCqJZ54tzByQKxEAdQziGZ/k43I25SZbmLbeS1FgqU882ePHcwZaqRJ3v00XA74aM8E5u4X80bj66b+/GFc7KdQ4/TbEEWcM6WYoXV4GE7Yfi2Gq6MgStNqb7PVuOnNzM4uL0I7k+hrgP+Nqzv/0xifb89e9nulJKbZjfgPQD2ytoCarg89Hkw1Zx4wOPz89NAMDRJQDB33FQTbIyz5wz40kj3oeOoYz0q1VZ1t4TAsyPQNfrNVpp9ZZKvF0RwOk1p5xoMuu0degLj3O4Bf/sblYhyLqQoQOGic4LZBpkr0jpnVQd7tQcpc3w9h/wSsbf2AwVbMKB30SFNSWobtoOChJI+dowaVYwlieIOgc0l01nZUOWL2MKrpTrjRO6hUNZSGrBFOzfUu7uTVfY7fHHDNdnAS1+5/zsiXBC75G7fvl22FfjdEFBFi1nU7dpUkczOmcMsoFClttRcxveVQadGl5udYzzroQLP5ZGVaWDf7zqkyp6W7/sIiuUNNfdHub8GBJQP/tDBs3rgCcdMm7TquZX1Ul0J9u0KsdeOdJgod7cujqpkTuITzdl59phsPSRcem/IWs54y+63zpIEMxo2dTaUVxRjeyM4JtgtP1T0jv5ZshuH0mSxKzwvIXIVKJNq4FRBSydNSnmUcqEC2UMZIDaoKMjDRABXB2igJt4aorHmEE0PQ5mbRvxBb3dHHPfP9rblfPISUn+2MZ6fun7qHq/9Rg8vQBQqQVLaUIWielhdTVKJWuVxz5d9n19GxCQbK0C+fFSrbl5fMYv0YoWYS3ece8+ytTyZRQScAsHMePgfUrdbvYC/5cFKN36i6U4DYNFC4KhLc4ZGTVkxgDKk4/LryUrodNw6xSK0trtzvkCzEgL80rosWSP3zhqbAMl6S8xYd/TJOfK+w+RsemB9WI3yAFrLT2pLoJhReS4RoHCuuLcESXPJ8+r+1eAhvmnoQL8X764CMF+HqMn60G2cIcRlFfaLkqdFlFSqdJNKYXUkUPh7W9sVziGq/cJwGh8yXqZDOPjlPNdjiUH9KjAW6crzwlFnsuHxtIQwaAPwtLKdMexg/MozSwyPaWrSf+cvC7kEHE7TBYJxcGXeTcmQHBWZKiDCQkHLcxlEjiRAfspOY+c+3vJL/zm1CkLbL4dt4FZi3PkYcO3Uvab6/URJFw+t2sPin848nsyIQh/WDb1ylS1TsYZMCYgoZmQeqTeLeIgY8RCfdSVPJLtgdGcWdXE0Dwi2Lhysc+4pw7Gna2Uuv5MtFjKiZsWqPPeVWJ8WFmlSDBO2ZPOVyX0yuWVLI80e55rVC3n5GPdUkNqldLcSYhk5Mx7mACA+4JaQLPFBaa738zEiZIWYM482yBCN52jPtaPDvyP6f5dhURIcazft1axqY5cXrX+cp90QtmLbQPjc6wTSeiR5948SCN/wku1IGVMMf2r4cOx4X3n6F4deKDcIPLpYoP1icJYJV7DHmKDneYHVoxsSAORunCPPPzmDVWXcKwvplRkr8bE7cbhdE4WqSGGLHUgV8oKvF4AmFk2tVDPqKobhY4fnxczRO6QrKvjtTQVZ1Etc73q7fOZsnLmnU6phkbaBAwz9OCEVSfSFq25yPUaeKgQpiGfSUNrMmtSsGx/1DsEq4npkUMac+MwCd0zSzWgWemgSTmkHK/FnwJqKTFRnlZjCDZTaqs1ytkCuSznkTrLIHiTzDFMmALMYUEs8doFnQHFXw20W0d0yRVY3LZzw24Brd4yjveznspmryVCwvO/YTD+5VOLl6bMuPQVBKJHXjUW8FID+/Dxg7GmF5dtxT7dHkB+X5sAp3XogNxJwMT/w8dJqtRvzYXWLSs33GFlKVswdWd+RfKywJ6G5ConUjUctrIM2Zit5Jns07HhKyB7A22ezaSvyu2b6f7wo0T9zfnRbPkJ8H7hx91MOQBc0+Q6vRqD4FBQHcpAbLivhBmqojSo2Ve94cjE1xwgFL2LQOGwVnpm/c6jPL6ZrF+7Ll7+M7M62hiFJm1XEiQ+SJ/8nf0292Zogj4ZR0/j36isXe9F1jEr+lhPusM7Iy/UlY3TrCj10RUSjbXqEHl3RvTYpHZRozyKkjI+VPzppQ/oV84jAANdIGFeWihVDGtBgZWVNXkzV/LqMkJB3Mc1Gl/onBJA3BwcQppNWjCNxeRs+RG4K4dfYhyFTTt/j7wdbxnG0qB2/2nHWETPo6VgGi2E/JSyFs9Tk5N6iWPXAS0a6MTGC+F98KEf/1mhz+m3cMpZt+dXx3BpI9PqBEB5A6k2NvgLTDHwrTh/TjDYjea+RGLap+U3oOcP7ViY8MNiwWehqY6Y8VZXeOxNdmHov/IxgmoQ5m5EwECZUkyV4qIkHCIY06qeThpyhX4AxybT/A15osc4GrdntFGL7XrUsfWNqaugeQQju83unpAham/QQ8e8dDlO5S3QHZCtP/ZItelJFabnvJapMMFjF3INxBc8WhKl807O/YATHXwpW7bgNz9RChVrf+f7O3OkCwsekz+dQBjWxEXIjHUl6WpefiO9vXzFK853WkSs65etjjtZtO5bkLV58f+M1C7ME28k2a0LfMYg63ulPheQTqzSELSQiTcDnHJmCghEY8FKs6KCBgFO4Si+FprJcWyKIGZ3ApTs9SO3b1qNgrPgKqOYXb3EGji7e34+kx1qSBzYs6FbGMoT9HfsDxyxkg6yYMXCFwLbZQ8Q3AYzFoM6pvBLM4PfgvSR3O+CcFQyHrILaxj5ReVKMY12OWB9kDuC4xYorkUiQFGrvsYptV1isYLW1BRQaj0LiO7Ih58PkSCj8yJkWhZ6nvUjvw+8KUskPVQy78fvuNf1SzzyMkIGTvboVa5NgIb3MK0uWRaWuqqd2PJnyk4WPXy2BGbCZh1R4IJdzQflkkpuSl4Kj1I8C13Ixm0z/M35ptlxxNzGtI54+uA4SSYgIwdfhy1H51laTirFVRinyNyQ4qGMnoaiHdwdfGkyV1idoXFf54SWGE3h86tIqa5yw/sGNs9auStF/SmMfJgOmrlo9efhjqSF3U3GzmU0PlM+Ej5XEDNZwUu5Y+YNGzTGfUYGKZdQ3jAAg+gq9nPgAKe7u0RpxlsI6R8wIMlC7XgZjTIpIENyvAXEhnYiQeShOj54VebSJvaa1Q4nvD9TUI74FOCfP5aNGYMXl+JOgON59sj7o62gKzKpkoumqbyFQkw9qFKnLxVIhFLTI58iEHgt8Dt9UaQBOFiQIkKsW84GLHioYiZXvVwMrfGVjnIzqXR8dlElikW2KTad8igabIi5UV6htOzBJWo5xbmI7P9Q8MDcAZjCLdFYKh92WsFx86gmzwvYr43OBj4j/hK67KHJdYA2z4hHzsL+g2YtZD3yOBiqAGB+bTGxbIYcgTI8HRYjBRcRj6CgpCyKnW13Nz6rw+24TtFnMjI0lWTIZS1Fwx2cC8t3jVh3FEupoixU8qvM+uP6aPOEqju7C0ghM1kBudgQ7ZsCoiYfba6EQhDF7q7hy85ujGLkWrF/P7XXsn31j/g/75hK01oexCC0iQehWI/BGm5phRId9AMD+Ah7W2Xf/RJfG6YzRUTaX63YWNSK7QNO9YOaDf90aoZSk/Nn2/LC6MRS30D4FfFJHfExiTpy4wZuweMPUXZhpyavRwRxInukjVsrgm39MoOVVpgkCrqdnsjDjql+mgpQI4K/DjRcs+p+OSBFK3zxfHJoO6xQAqAlffQuALqj/kKFBCp5+tQQsLPrTjPUt8lwS0Z2e74U/IPv/giwYaknGvjK/LFWEULBHg604tImKOn0HKhdaRVHiSukgs6kVZjuvLgI6nBtqip7LxpDGJpm8ghJeplEqKF+hyBx0kCS+FRv1c8U7u94sz+F9KcF9UK5EmX/gHsjGdnDd6MgX/K/rzlJFFaJ+1+NHWeXUkHW95Zgbeb00BTFqP3bTCXELzMCKgWHOnrUuDeuKR53CtJRyjCAOmNegJqoy83ymPlu+MpcipaJrO11BQ2WAfjMIEmM5BEW78Ug42eF7ZFCrWhEzKWZYj1vDbjIbxpJ1RGZa0dfq5JjYxm6qJK73bFhHgBdNJm7zxMGN2Yq8bkyq/l/Z75s4XYc0TRWB6ZUBxXN6HcXVCMCfrtb6VO/Bxd8oa7ZDFsETcsCswniwAQr2uFYid1qXHPBpk37M0B6ws5Wx3vlF+2N8w2B9jbd3wD8e9WncOxLbs6MHyDf5L9Dd9WU1G9IW35p4PyGwIvjG7ZTbfiv9ZKv8s7Huuz+zazv1uhVvIMoS9OtcIG0rI8QIayG7dV1oSwD9/Ay/bFFkxweUy2m8jJNOzPX9RmsSpfkTSkK1XYqFdoR1g78lqHRtUWlHTFfsLeyqy5r+MxtE0bM+xZP3zA/yClwnrcbZaaDg/FB05mnqNH5TvjvIQqK/iqjacj7FRx6V32l4LRJIu6kMnDqmPSa1YAwe1mgT65NppcNSENrLV27TPFjRYS6jBpdmyWCcXA96HiGEClPBNRqS4LK0zhVoHYe/erq8MIFMfVq8tEogcJoKvusTl3xz8eghJ47l/KHj7nRomdasIYeiqgGo1ChFrwVIHwYPLcSW2riXkFQq1nL67Ejujmj0w7udkRFtMjQY3q7DpHirskY3TpVvknqMQlDKARdRdjHDV0VwsWRVxNpW4QiKWTmsFnHo+5TvCJTYW7FLuJ24wdSK+3p4WEHZWgvRYzIPUyVmwkx8xi0qprpvANMvQq+O4/dA+S36JSAzsJ2g2zQP4d4PpUO9v9dBLRdKDqCMhFM8TH+Ks7FJaQIePvIvfl11sunYhIXdHeK/0tx/FAO42LWgdF3Zg4aSfuBKtszVLA27q2A5H+9kkLqhgOLXj0nHNvNApbpqbTzNc3kpqToB5/VLC/dVup5GGy63Z0MFzi+Cm5Wo8cWtSMhvmT4JRPzQ2kpM76tccUz5VL8ZC2bXSruJdu474UXg/O279Iwg2trJtM5Xyh2qvaVp7vDMalEfZbMfSRKP2jgxUPTI4pwZDe7duqpO7d8bW3d+GZDz3mIOGzJjAkWDjZhTAo6uCTStcHcA88D47sBBazel2m9lSH+4greRNCs3SSWsNcrGvN7lZ0BPGG1J1iWfZICdQb0Od/axdRIIMSnRVYDBEaM5O3k4Td0qO5lyfw6kP7UG5akbbt79bJFHDfPmI0uxffLAzexhc0LpUcsjQ+fO2vGXmPM1KtjyLaDLgKNricwqZ9IgUK4ru4VDyEo1wC4c7A/cdxmMjcoZzUTleSP+iC1EHaerIPL1dTZdbotBsmelyCzkD1b1u6QzG4RyYHdbI2z/0wRAVNT/EUfPrnaK5oKuiupAHUJHLNIQIzQS34gVntFkjcMvFMmYlcj7+rQUlxu2n8xDuUL8zYkaWtBLclXUytkB0a+BgQwc99svE/RB1qVmtAvfqUU59dilj3utxzcGMZzdkN1CdjJLLARTNE8pme1TFe9l5hl8yhCl46XsxI3rKheyWCg6Q6kaqRX7AeFSejWT5uR+JzAQHZcy4s/zC0JhLsM4zcnuqml6/Hx2QMVNeX430wsGNBEn4hrKLCObqaxJOUCtWh4DmjV3ZYu73TvY8uNMLtN0aX0KPbSKkoWiGUVLNmeTyUe2DHEXQoM1JdFYVcGebMtu9i9O3/erSpN+waGzPHpJqJaGBnc5MYrQfKmImsB6OPxHwJx1J50O/waorDe/FyK1q2V24sEu4AwwxCwo7Agz1sMcN8b/osJDaIdLC/JESbav4Ag5g0TSxmq6qdcDv88L/Ff6KEMn1HqHL3ezFrS+0B/z5KFDUM7NymKOu92mHT45k26dgSzOhxmHbNvLiaJLjdKSlzYEnhQcZZwimA/2ni6VW2+6Qij1zw33DmNAM2nqaDLbCdblu12nckC9FuAZ7eN25a7BE7SfcJNfroyC+E+Ka/DPu5wRJZ2GlSprU6y6DdAlREMzQu44VPeOs0kldMc5+7EGtVr/3SwFp5hJEx5coLDF4E0I1cX3feDiDDHQPyvtnzsKUP2cPMuSAOzBjTuUCPRSUulgKgT5pEkq+g/DvCIauVs0CbTfcFO3Td3aMVetH9/CA/oxKguKePuWCeJ6d4hye0LEZp0L/TWPB0i7idVXOylMOwuFTSVJQ4hACA0kNe2RmxRbN/uefItbZ5ofDN8V4HxXgMpU15K9sG1ovfP76U3Pcr0thqp/ocf1Jbhxm6AxnNE10LLnNa1Yi8n7zMaXWC9/D/SKhoijhrPMOXF3YVicwGXjAaXxEh7qZ9enU/0N9zKu1FUFtFJ+8xVMibYYj2ygE3yNcYc1ovsjTyaRuPO/Zh5yZO8w4oWoLX3RQ8WuhX12q19JwqF6fGj9eyH7gyVUNa+pISb5NTbKWAEGNhao1vNmN+IeVSXX44OLGiOlFOhLQiPPLbFs3nDLOC988Tt1C0hTGpokx37FP/EMC5exwveM58A25y3iQJi0sYTYTsjeMPrKAr/lh8ogDuG9froUNWK0kN3ydZ2zNoG5KvqwRxY/xMePf5zIpHe6NV0XUSwCBjylBrwOzBh8B/Wb/LiP8erU6r2NkC/xbIauU1dLV6XXRKmsIQrn/XXiS73nOCk/KmW+D54cS0des9AhmnXHJUooPVzT+sNgsQcJpYM3IotnnZx73noxgRLjmqhN4wj/2EOpz2V1aJoDvrCixZlZ3E6/nVo2pOSYemdA6O9+79Q2pY/GOX1pxuhKxtLhcm+4IulvCAx2WXr7AJ24WS1PtGfK1TPMFT/mhvDN3xNwQt3lNWhxzaAf9VMEA5RRr34khfiA2U/L9k6oTzMp3kg+8TB11VvMAKhgAEne7bbOL2l6lEsi9FA20LJszA7Y2GsIbwM+38/bzgoOzdn9cVQ2pHPAaPLQDxtnblAmuW1DOr9oFPcjIY81rRSarBkjZVJSJv+xnNi00bxDJ8BsG7PjAsIFJ074wuxPgCULdtID9ELMZEqidPqDoL3GCLPfCp1x6+y4FzsYSJjJpr14on+x2QH6f+p6++y4jEBMCm7dkVjFaMU9hx8FkOuiJ8nCBdDT/bs65WEGw8pDkR6yCgJFOURmalbCD/iIHRfvJgC1ym03lKt49m3ytxgH7xxOXOOET8MoivR1ahsGK4ux2OFf5z3heyjNohRhgD9OcsKRhMNX8dMsrgpcWs8VhaejH7SYwqc4CDdUP2PykiffrJnuugXckFaofbBB8WKS1Yycs+Uqhtc8STOi2faBvbHL7G+p/NykxbEyxQ00Cxj5OTnVxTTXDQHMVKY4ZEqaNJVjJ/s5WYlObeUj1gtGsB2Sek+z/nFZVSSjI4cm6aEVI/UBu58KZE8L2oedc3jToY6RAWJJk7GeJFyFZQ05ewh3SVMyg4IVLGguJTs8j+2aTch83NgOZVFYUHWqRW/vDH7mwRyp5sS4sX/vuxPq/Vx1a9SNqD9zyXdxLIXO/OafIWr5mwM7LfOoT7R3Rwz0V0O61ClaE9fmxMU+vIkFuk4FHwIk5gVPgXrzOkOg5cFSd094YCoZa0q1/2jfbCUlC5Kq53juz2VnyAsmn6LrJ4YdWxzSCTDuXpCdzaUtDT64TwD/epOAINIYInMY4I1HwgX2vTMnZC3A53n8XsviojxEjptIogbSG/zjTrxCzQZdRYHKeDEDUL4EL+QHXxTm+RipZJ2jM6C4lcS2go5x5S/uvkFcPMywF8nwqZwpB8XnUjzWaDl1v6TLggo8flafvzwc9kVUK5HRTo5rdj4cxF09jAPEiurkWNnNz8o8vX7G8OZqmfkOEENNJLwuMtvTqdwbTcSB7mRsZRPxFPzVolr2LhOH+buhP98xIQnzKdT2w830eroPZKwqsaEBDPyVg/PQ349stYgX2/AXfn+ADaL4dpwK//DHVsoEPr9x8oAUPCP8dFupU3S/vH/7ijuu1ASJnoXqCfy0tBHg5J79bIik9ZOXOh8+KqrK7pQ7BqB275+BlQbsnyGYgKHOPpopvALQ5PHA6npD3rbZ10rVqJ7Jl3XOM0LEJecbvkAm+qfKfRPVOz3Zp6c5VTP4fcU5YHQWeZQPL8g8pWKf0BTnTtqfCqwX80b0NJBeaEl5x9grZU+K7HLIcm8vnrw7OKI8mANjQ33GnSYw2tauEwVo2RZfGO2llaChMrIfXepq65iJrbLw0l9rXU8snoczdJKZl3XjjDgIR6LQUbZLMrShf21CeFogz7Q0wh458c5DzO6T1hvh5z7AY3I1rEl5yAJd49NiekdIYzaudk3sJZV6zrpPRBjX+mzIyOEs7o5KNMcT2YmMcnMKOfQMREDXc+SWEaABhijeS46M87jgT+3U2lgYdCC0+HpNxDG2tYWqcy1Ek8QShj9vDeAe8R9nB4YLbqOeqXFz81//r0U7n6vPkBh96Mvi993Ennf8BNyXDaHkQMdzIq9uDIBO724+4KGC+ddgkDeQPYdNmnvg9v4zhAjbBs98HugbkyxUe4Ez6Z6zJ1Bq6armdfWW/Jscsyb5Z8y8+Q5aB6d0CgroNEqw6DCceJIAWjBTqGdgndZm5JOL2suD7v1w1TUnGtHxgKEQJldCWMeChwaAVzYLpN8P8vjc9n80x1vSg/XiHpjLcRfUqY6F3o1ju/ills8PkxDiETPdmLISW4R/uH+cpbaGvBl5z3pOlAlC51fAfbqxuyg5O7zeOxWyNhT3O2b9tsiKhPNFXSnHwex7l0rwOM9iz5m6BJ37Q23vFu7ynEErThNkba1JVyxsWTAsuImFu+5EWqngT9j5OLo4AvDe/C8AG0jfPTSUIpHqf92PnrLLU0tANfIxRR3gGASi/sKR0fuuGlPJGv2mQNnTJ06aDbxGBhb/2xqZnUVcvRE6G6lCzFy16DLu4rPnYjmKapbZRalF+3C2kbt6vtzGSgRObMBRjDUKgMEBKPqv1F41kxbkyH9ejo3Hk+Ty4fBahZe8vpXol6H8UYeFCoNy4mAWqN/f3JN7ZUSAVKTVl0fuj8ydRavNy48Tkhxv88xl8Kj6jD/d3+j6oeoHsxfOn7HecpqO5lpBqV6bQkUjs7OWNJC6hulfuqtEhMmvcn288tC7VD4MtbCVJuUbtkSloG375TbnLFIPrzu2qO4q1iSeh0riqkJ+83fKV443TFgCY05K2Bnuh5ZCPROncAukt9qGqMKDYrzXo4C6X5TZbf4D+j5NUaSwQTg1g/2u+TmbvIXXyQUrRa9RC+Y6qe8juJcVNlOjM8vFTE7XZrBiItiue8dOE2A9M3CTPCPGUmTBbH5XuM6xQ5cnj7ZTZBLAfBgRRgOfsC++JgnCYldkahODVsvj9F2apijdeSNDdwlLXQ74erz1+MPFf6WGobG8PPsvIacPHBRwnhstNuonETmvWFtiwoQpl/aqx2Q7/6S037GsPXc1OjNJfn3jWzuiHkCcDfNaURlKFtxCGW7fD0FxzZwmCgjkxOeUAPJ87fa6XlP0ruNesaN6tDQlz2KYdxSb4dQ0xo9lZj/5NGNtTgMaVdnN3Ly0Xa6WXeSS0/JHQupqF/Zf7qWaSqiHpLUxKU1vfaZf2Z1IzwXdafHiLiR4czqTYJzpljAXu/WD0UZQYcJyPop18OtA3R0sElcZYcH+lL2Krr8B346RACM1BymRbp1rBvp9CPW5k5Mj9Zo1rHSbsKiScIxykjrUZKRnY1XImYUN5lPLbDjg0QaY03zWESUluZGnn6QTbyyKhyDc4xAd/hpfn0oKjM5nqjNDybf4GENMVD6hbyFdnpMuSUpczkx3Hunzf9cATxAajdAVN2WrEcmiojaULI6r+aX4Womhm+lA9IMGJpffem5dGAAZU0KtV/WL1C9i4Ouan+75CVt7TF68dF72msIef0I25pZqPr/tZS2fX+V7gPgDcTznTBFQSwsa6KMCD01t46YQ+AB0MhNViOaa8AY/+s+clXSUSKMa6EgV3EPhORFyzRmlZU9AdGy9WRN6OTpbosKzqTvAX/aP+EDbQyUkoJ/3BbQc2lcMCtkVIb7MEF37CBH8qq4eoF+m5XFiUGQra/ED404F94Lao0jquGZ1Z94hTi/DKGvBKGKnn39eP1bR/NMopb9JyWtI3hps5vsQxQkK0C3oL6+3PK9hZG2FYCDuGJjyoMdNf+3jdAZFPthcAmElC1M86CBvPQqL5U3T4dwc9Lct39yiKHiODGKzhesfZrhhW9A1OOnHWwpL4FQnKUQ11+Sn87+s8Loa10oUAkJ3r68HjeMGAJB7IeHnnkm4WPyLs5lKMnfQkqdTSWuaBV1P14Ijj0OOSNkEGK1/3rZfeq1v1/OK0Qb2uYJTC3Q+XR9WNsRAzmQngR+IyEBP8xw4uUKWJmnTVbvncYF/2LuW1X6VGCrdixV4BeMtKiB+NC8FB02XoRPbJemswyfaW3uvViQ5m1g+v6jL8yrCVo0LGqOILryZ6B3NR4usbHvJuh6igcYgZdrCpkpc81DpBUp/ULx3gNL4MfIwG5vUZ1MJIy8Rz2IH0hkfTnEZEnlabZsdvylzRPyy+BrVrbx1MUoPAJV55EdC14Zg7tDSwJNaDMVm3nRa5FzxeGhG/MwQ2X7L4biFc6PLtHljGYPMcRj+vA0sjzCyqpg4/c9JoSWQ36/ZQQADFAVpZl6YRK/lwMlkZ2BDxyiABTESoWSJykmeZemAgBeSqK1jkERRvG+zPd9sW394gaEFXxecjZiVHH+7VyDzbd3oxzib2j+Jd21jyFVj8vH1Ko0SUeNJQQJzxBs3gp01IM5aybNTKbVm9vhqijuYtN1UJHcQN5QbF3WldudBfKiNF188NCyO15jjuySH8Hx5K0mrYpZZJcnkQnKajVER1J3d/KBA6WfC/WdmAqBadRR2SuOlhM2U69SJL8p0b0H5oBSCpOT4cf0+ER3gpBzFh6hXAs6uxUOBW2uJsT6ulP4Ht4oJP8LioxKwNuRp7D+fZv9KjZAD6VWPFNSvWl1V1La/6Jx5lYfIth86z/dKdHbqbRIKIHxhiAaAZgTa8MeHwv/EOqVD4pyb+AsONz8bE7YHSiDxjFCOzIVSZ6gW1wRtnYLxcg/Ym8C5o2cMVf+2BV7jQ2k0XqHVheXD/nmrWUGqoN+tx3xuIfD0vAhcO6TnrAiUe9ACv7t+PDoy8Cq6Dy3sxMhuk0i/0Yh1rWjRuB80FxyRRsttUMjcRToCjEArhfWWx6r5st3Sl6KY4Iz1NplyB/R0/7ylXjt2o54nCrjz29GTKZLwPrtmgu6nx2UZbEOLJQ8dk1rrmlpXi/XBdnD4+5T12k1IGjjwzXrHWHPjwYaXNOgGY8k3YdzpMaQMKCOEIPCNfY0d0F7WEh3nFOmGRcwdPg6SCMQciWCZ/MJ17uXgFnFQtCNYO16aoTGtCNj6NckNnLou/sG1xCbAHDkpm6kIhEyFO+A1+5K92FonuSQrCnudYDw1VaRdqRXeA+QLoQWTQyrBGVB1FsfLDRryMBGFhfhmWyuVj+dDcGLoz3Fre5ZRPui/lf3N+HtXcJQulMMkR0DFMrMl4LpFEVrn+vYz7qFq9Qjk7S7P05fh6FVh5O66nILlC9IV4YVi5ArlIxRMnu+NZG9HUSCs83RQX2kREkIpUC6jA8FoPfcNhTvhAOCNitmQWjR439yzJ3hl2XxU8HZjQPRY1heX4E/WUK3T/p+69OU3RK0W14YWPevUjEtIX+BwHcwdmoscAxzcoXVaR1P+OnBfEdoHTdM8CCmn/f6Q2OTbTnNoNPmXZ5RMsFM2KNBcF+jhWhpO3rfXLJs14Nz1QMjSZbUk6X8XhIwen8O+kLf6xUckMYOntQENZFDcg5NPLlIBe3upEU8PtjVTL2rTrG3NfWgJGGgudQRp/UhUd09UkNTNn+3W43+GrT7H2FwaF0XwhiftJrNqmvTdo56DrXISeyEtyorbpameHYDGd5L5zQF16mf3nzmWYM74zkCIQx0NMomOJqb2GPZBznYEjOj8galXthouqDZwMRKeEv2erYrCDj+hpVc3IdcRn6b0b/Bmu1f6ETH4Y67qnJpsN9SVtYcrK2BqaYjsOVuQmISKt7rywyPHYJY0fZkQ0W5ykE1FOzX8zbDxCn7HwzJOqWznQ21bSpNQwFLCJpAn+8H4ayZBYV8+6LAGyWRERUW7r5mU+hm9akDZgcsLDu/6rFpkUURsNezgM7lXbS1rDb7sUnfcglYQj2g/xb6MA8btHkytowHQm7KtS/4Ovc+vFz7G+SeHXNlOXsgiBPynfK5I21ZEAEGfQOER04BVu/v+esp8ToQ0cIadtEFoyLLnuGAeyFRK5qC2lQdJL4J6Ka+Hv2OnFfV+OHJiWPBgw0TdIGn7G1N8OooY4uH9xwY87esoXoe+1bIxr49YnzxNFPcLig+zHoVHXlo4do3mnd8ppPhJtlokmNBMLngfOFkiBDQ2RLhLLgnUOvz6GRI+wiC4M3Ur259MBvuwPrEQtP/TvEvzVfkmH28PoNDCBWb94vcmWOa2WuvdHE3uz17jU24QfeUzLbsF/d9AboLJsKX9sDJzKj6UeZd0NUyR6GQCxXoZqA85xVHZxB7SXA14AeuEBhgup/ZCjT0oQVlYzevC9NwPk4WxiEP+2zfsDMXa06ZIosT65pQsEYN/E+h0dx5Xki3D0fmpchLAom/woQccwZE5KFGPKWA2SYDaHS0au4ic6vDiSi71vTBFz7us6Q5CjNJapt+gb4SiDrTOTEFh+RjXv1Y6vLcKSvPlEWG0joKCgK0YE8PAxEFFxsgwjhiV7+23Bb8pn2XOKFRWC+fS8vacXMifeWDn8FouvRWQ3xSWIAMBlUF7KbO2PFGrKuDoTHLLytw1XQ+SUwM0Ht2XFAuAuO6AMRWhPCSatvCFTEamOsEFsB0QSCECBPr4DxHBFQuSJR/R6tDT5jBRAOzdS44Sw+JL9V4xy6ZpRpjC3gj4zOlqz3A6n/DgR1wOApiNDiE+IR0iaJP/asvSZmM7hZBiO3RJ9FMjAQBMor45FDNE6ODf/CRyLzMIcG+BASrWmgrEJiSmUQlX+FZkWGa/aMF3+yx3fNRq78ZLL/xnW4/3nKsLFiswZmLph/JsIt9+7vRBrkEhkepyoCY1yBXyZwtPKzgBNVVE5R+kvLq+U2Nx6tnHFdhjIzMgxrqk3e4EK19bjEmJGeNzoSnzPaRpwg47sRVe397e+KrJ12DjBWqrouuv5vtu3HfCZcFaprbCwUQpH/wWZmT66JTi0fFjaRCHu1Ntw9eyHQSFUxH9FCzkgNjAD9nHzVz8xg5GERdDwnk2BankT5lpq+R28ddSL5ubb7MVGAqCu3yXghHHsT/N95VYuGP00/znNrt6Vt3lzB043ZjpkNB0LJHoae+I1woDhWfx1DnXgxuRUcAdHTLb9XWadg6Tn1n5jDvzFV7QMXY2UnSkwrj+QPkpObPUodZALRlQiUQy5IUAPW3Dr4P8tZ05UlL5QgxGasXTc5icdus07dqNO7Wrdeh8tRhX2PQQQtgds7NE+cJkJrfGEsGImwJDrNYBshcaY40oAcyD4qoe2uNzzS9M8Get85eW6lmQd5mBHxJx75efNeESOut9L3tX2D/OIShnEnr9/gxKvQiuCodF5tef5468Y3SvhC7ujcA+P4/I1xiF9ylyu17eLJnxdFWuv/qFoubbsP5CekltOUNJtSGViE3AbhDmHjWHC24p7hkz5qgYT4oiOYXf4fscSEyGMiQ/G6O92L6WUyb1b2+f4kiKX6ck7xm3mfCGk3ofSComf6bQHYki4cQGmxGC7RwATMn48G0lDWro2Jdd8hV+G5HDwYASlTUDmElj0LqSiXLk9kn9coVk4KNJinWB7cZuKQnFCoa8xIw1ezaJzUC1fPeExvNmTgl+qBUr7XmPtKVKwhjpedDS++wifVCuRDbDYxn4IRdIPnrHWC2oj5bo5XbKVwkthnDa3HyBUwSqIdXq+45B47NWcMoBDjHjGIJU4fJ8xLYux+VMGh6A2LmLJErMRh1B5jJqdPMAzPXxcLZv3uY1uiXxGQDQw+3/LSC4uTQit9hzSwgKNChztxyan5FpAKPjAWlmgmrSt+roM9of/GTKBK5WNyS7uO3TsT6rN+92K/AQkxbggpqn26x7FmjAnjqsnOlZV56OzaCa3s+uT+/iTa+C5hDPC8pEhntum9AKM+Jqbapgq7vu5Cp7I7esuVmPY0+Lp4FUVuJsswDiVWufgdvZY2wKitsBlZtyv40TSwCJ/ycyOHViBLevC5YLDXn8PByjuMBZfJGhnu5HPGaLMjc089mkXeSlaQHYGqX5NQTFPIUQuj/gZr2phfl3dlD4/xaiNg47mBa+aF4bAkYKqWZgRKI1VXr0p5KqxTKJicx6bR4N3AwvBWc5j07o4V6+N7FYBSB8zfDa1kUk5tx9MImM03Kzw0XeC0IhqT54RDugLk14u/NVVLeiWQ0tb0dNitonLKdWY20alO0yb78IVOv4IzgwnY2qXzRn6wK9YtyUT6W3XGrOvqaamn9uw2ANzUFCbpPOWlTEj2+123BSPHRRw3yY4Erw= template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio-vre/ss_servers-vre-server-hostcert.yaml b/infrastructure/secrets/rucio-vre/ss_servers-vre-server-hostcert.yaml index 6d8a4fe8..f677a6a8 100644 --- a/infrastructure/secrets/rucio-vre/ss_servers-vre-server-hostcert.yaml +++ b/infrastructure/secrets/rucio-vre/ss_servers-vre-server-hostcert.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - hostcert.pem: AgCKFLhmX4c9ki7idUToWS7JWfcfQzlmI252M3RuVTH1RSZwZ52pIw7rFzL36Opk/2NARI38yZx1em6d/9woBruzp1Oyx04BDFsXRp6CimTYqhWyO/X7MDZe2rIl41LbP55vGm/sHWpogn69F1x8fW64KxqbTZL/rAVYYshNhiFUt72Tqqj5M5AE6G9z9gyMJfpY/RARa6Z5Mn+EypaOQTyDHi/pZHgfoi63JFJK2Mz50qmxhlQLelTdTHSQ4jL+KV2VxWZTDw1vkzpbjn84aC3ni/LP34kQ349C7h+uu4UJo1Ji6zh/VPb2wk8L8Z+kNqkcz6u37xX7Q24dgXsA4IscQ2HhCk+kUUNrz72ZF1E9ivLi2kmHA1TZ2LzKVOloNDkdGWeEPM8rSTjFRW9bHdf7PhUcApyXwff1tbU8sXyj3mIWJbNrFGN82+JOctwuVI2fALflFZUsRYc9oJYbxz/Vyl+CwRoaG/QPmWnxxOY7VkKG4QSoijAJD9xuyyLqCs/ttFbeBi51tHdRD+gtsvmg+1qPxEtIP3hljL/w0a2ImbYwN1xNWvGDAkn3YjAFn2EvMnOCnEhsQz68QZ5CJl2MWml3W8XBQHm/HqdJOBUA8h5cr42Xea0ixWpLX4mfVxrZJHHX5ty3oTV1Zq3gl+E/+sE22kgOKgCNjZbuV5cGHLlROLvuBqfPjSlneAEO5cTGFAYcJGFvchEwkm2Slprwba3aeQYiRbFAkEx98HFmcnZVwWnP+inhsEODQIDpZgYIar+FyES0Ls0XGQfI/kL0dd6vsqancwguU2K7THM9IVPDYJrdrAz9GaQt6MmRxea+PaVC97hVozXBNXxsOG7zTLZZ7+WuggAzZ/vHcYaNqJnIQ5uE9scBPvhxu409NkkAZTFHRk+xVqZjc+bEjfOBBarD2HTpJlqc1WoiH/5h+dUnQswSrmsbbXka7TcS1UypnF9UhOpOzksrOebwuGkez0tywqL6xaphBrGZGa4eGGCc2moRWdDLrXBLQmq+kfYxtULLMA93yPnPDL6yxB5siULobFg7DShBaidOVYjOdjJEhOF2g0sQmyoBCbMqVdZVrrdbrMkYkcnLLcU+fb6u5nJE+Q7+EKOcTV/5DEFkzdhe3pA4XuLdFoUEg8mxGkuKxT/Wovx4EPE1oGwuTIGFD5jj5JR7nDYn0CWo5T4ndo1dYmfIL692gMXRfvn5RTaUjo7DMIP/e7qYm5AXpzP0APQV6a2glgqCyVLCiltFxoRWR+TkAiXCa6nhrwBglvCSm6gS61P9ncnbNSdWOmcAkMfMST02TrQUq59a5TSeDS6W5TEbAjZhrkRWDAHRgegdrMGSdFKEEqtEGlIxjsn85UmyNlEaFOdM29JT8Y78ZF3e0z6xw0YGsZeIq89YcNn2pcf9NIYRxo+KDOUNZWp2FUUdzNrOwY5DOtIhJvMH5+CaclDm8SwSSyhT4VOpMkBXFYAhECyCkRynUWKfDyWP1W2SZO1MNNbijNGoz57aMU7+CgkuIFImLgZhmAIfyy25ruiZO2s22AIXQyplIgErPgZ67TJ6jls1n0QeOMEpB3vqf8Yn0nUjRrawOWa9pYXeLVAFIFG0FlKCNJdRAYcxkTVB3VbHtr71ptoOb08JGoVBYQViVgxDmE3climZwA2fqsiNANmbA//JsD2zVgxLBgyM63aEsWH5truG/TCGXIPdALBUbjvpfu3bxwgte9aFOG/mBvHpmo9cz0+p4vMgm25qK7/txwu6DrCjj7Nko1QGikj+04A50lW+sj8li6k6o/ju+7KMP8WZESTdeSAg/GTRJ5C4Hi6M92R3B19D78PG2dc6nVbwrxDNSNcjBZlwlFx7rpwhbZi0IwdkBzp4FiVvVUDsyVrKYv4zxaMRCmHKOXdZ2tvN3NvxgqiMPWgncrrzHNpUjsuLfcVUNz/cmz2ZLq6xSlp5afXmFwnmn60eyWOnLhYNemLbX++MYK6lNbUBUxodkdSXI4QW+I1NNS3CRX5+94UmEz1lDR+jGBIZHy43b9vDzIqO2xqQZBNv2R8T02EqHDG7e08LUiS/3ZlDrOmnybmY/jcesaR30loxJ5vJ1AwAifo87sSzD7afC2aPpnnAkqFCPl9tMBugjRbiMSPiK6+UbRyEDYma6rbzIvf68nbRMPiXp+okVbMR4aR2zFUGpdLxKeACrECXJMCBUbCWileM09jMci0am3HnbGFKI5ktgIG0EQVLXA/DooIb6GnOUA6kbRlNu15d1hRw4DcnT0CFk6scM4PTWpXBM98L4pxlaaoOWV+TaHSkJ7EbvtS4JpjG9xWXgvHcbvQPFyxvoU3zDHjxif7dawekbam51eWKXCFTBXaA0C/wx5I+yzN2NSVhx6D/1QoJeoOROI2S6wzMeabbbQ+DSF/evTgpAspbudpk6QbP591mx6M7h3TMz07bHnhoNOnoUixRC2ET5wR0v9nDWPCR/zVkepiAIwPiWoLRkqETeWNLs89DlJIlRfenyGjsvmEw26D3LYOAI3N/H2SUu4DKxp6OT4RFjpDn8I/+m6vzFjTp9twFmjA2nP1RAiqgDQW8WCznSyStvcbLij9zS9hBdj/F298GrHIeNSIQjYCIAogmWPWF0otE1PcA5272C/Dk0IttGlCZO/P4diAypowCsZ5IFv/ly4mQZ2y7/P/osAnHQ6AWE7Qt3icmtocCZCHJCZhNkyxhrWbUscluOa8J5O/eEAssFDs77FSR9HiITRKMKqRPz1wwJ7iZxgWRGxVcYxmxx/eo3+oDXx4F33kp+vecbL/PR1Zzu8HC6mj+LJl6wWUGRaUNO2bxx564g47PA/rD7WRkR/HvXM8vZT2kQQS1Szx5ZUo0PrPmiEbiHb8n+wRL6m4AHKPcUVq+VZLgDpw41bNUdOeDYfajlajxJ702RdV2aA/ALPOMKHXiNPhzyGQfnS2oMMXHUS6BXdcmzgWbz2RJmFVlmlt8tzLh017my4CRGg+wQsE70Y3U3OZ8gEAFSk7rMAhmqn/O4RIBOOTC/JcOQNdEI3laeu0lq1MKBvGr3e3OCeBu7pyOO6XppMhJd7QBFtWEILBfbhR1OJtBX3VMEtzbj/qExYMsqBOXaR0bvlX8fKKfXhUXmwLQr7vj38qCJiXIvkjC6m82LloTJgkFT3UBgWDcvi5bO7wYSkscNImN6KrPuv4c+lUijp2ibic9nJtEtRfkZlxf1SFqcx2Dj+3biGoWULpad2BDZZLy+zGTOhl/7WafLUFCXdJ8REY7p9CvtM1HU7T019vWVrcm571fIsnL5R7vGYp9seB7Wwx1OewdvxklEepUnPRw3OaEgnpkr2tjsvNanO9LAE7I7RhpwOe+ejSovsvDZZHisvG+dV2SjE9qHexHq4yNSbS5xmKflFmweNcKVZLRSdSicP16g4pcoIaKP9pV6wff5IgfW+oGIrXY4wzh/IVxnEdW+/TyrZms7+r5B5dYH1VOZytFG6byTPJjIvTb2StvXfLqnNkxyWMigL0kxau59yYPId8KU9N6IMieMLHcmZ6l7u9mlC+XF2avWRWi4Q8T352wd4OIxkp3ETmQbfmj75yIcCmyLiCqEECkAn55DoVyEIGZUoGDxE+xG2E/pI7gHP4Jvk/POD/wAXx+D8LjYy4HBHb8OrBwk0k/B1kv6PKhHWkGuE92WUBh5NUWdHtrjjffv9IjU5Gs85iIWygMn99PEQJWUb6ZWhzvly/PNamxG/aaDJWK6ziom/gv1SDVjhzRwCgPpCVJV5z5ujmwrVNzRMhXv9UmH+plZkW6+BRWtSS5+b4wau1iMa/41t6uT2vzotE914Gz55lCdwe+xzoCEGXjgduPilm+4MVSdQCJun1Ccos4/e3WAGJcS4lwtD9xuPxurguc4nplnYlv8YnqdAvDmMnYzloShpVymepy4yXIeAmufiag20kT4MKZA/ur+FpQeqFJ5f4SGeSWBC7jAvgvU63irO9e0fGqE0H785Rg+HL5V1AEVWL6lqhRjBho38IsTIdbETBqX9Bz7xo2WMeDdLxOqkvoXpH4ognvUvaWalIYVW6koDatG9i8uf4G1YEbK1KIaB6Altw2eb2wJkiPeHzY2FOUwQvMk1g4w0wNwjHvubKTV4mLeLc/T/bI72OrdeSp8PLctcsRGlTmaEItJipP2axsW7aNWAar0kXviqs2XmzVyfFpd95asvi3SW5bCn1QaayWBSGreHwZm8htqNC0AY6eeEj8HruvhXPmAET5KXnLJUIoAELvhU95A2rfopUL0NJZqdKzGxlePNdWUz62zoiNDpMVpcwu68ILi7yXbIrwoh89DMLLMoDwXdSPDSZ9FHZcj+TRb2UGiTPfVNPKZGcyPeJm7xsIThYcDxugYMamqi+RikLC1a80Zs9sA7bfvw6dOi6MzUl9ekNubPEFtqzVNX5T0MlhOyfhgW4D7WmFQXNTn+Oo55x1bNION18/xRvekkSxhKzpVn41cREkhEjDTLINL/1HYFioNOka4nG0+/AzPyr21bvFc2Xz9X3rx+yE7HNNMzVUHHCxZVYUAx7WREZVy5pXZ/8mBusPL8AxErgq/dIqJ5fcFQJqPAGBORpk9cweNTjB9sTbepDWG5WTrn8+uxB9RWFy+dyzFHjXlDYsr/9pJytt/dR1hcbFNI9Lj+ORaDdbCQ3vMqKOz/QgeU9rx2umPOgeKrC8Xy8Jn5CImKIzvfj9JE4NWs0bsieZOe3CBywYT1ERVykklyjMSjLF57IjTAK3jm48rrNov0ehF9hlhkvTbr5siA== + hostcert.pem: AgBylcu2MVd04u6bElafDClAVNbj2EkU6BJhj+to4+Bs4/11vSwAztZQ2D/fDAekkEgYgOt8iCsRYWtmUAFTJK11rL1ePUKZpLxB+e4G/Ss5ozH27ocBrZ8+GAwSft2qV+h3mU/zvab/iDzMOMbRn/CSZasa16zQetM8PXQjFDEXfsYS3lo0nBRkhzYpwOUnTEikigIAidKKVQRtyQCslknTi/+A460+EsQCZuv9JGFkWbzhm6RhhbqnvQmLjFTWLlyP3c0qHwHcyFZ4WSBk8hoHw2xlwrj4JpRiZryuD7BXW/ko3uNw7H5Pr+jthd708GZWSHW+YrEmynVc0aZCaSfgbpe+Wsw9e8hP1nym1dH3nA/6Bqesf8u4DwoS84PrboT6HP/fNsIERM+oaEofixPsdzmf3JGRO5mVbeB8H0iNShVSei87OY99aDpFWD7bkdjLZ+z1/vQxfylPBwXAsUP7uszLUwVJbtBbuVLv5U0wuPZG65X9+hygTihVtKeIlviCsf82pbWkfgLa2eFk3BH8GbWGsiKbRcoMklTdggnW0iBXtQZTSsRrZHi859PUxix63W6gJWi83becaxYXgIk9yxmRLD9VnSBkKw3JOmNjWvdqIJVDa1lCum1IMhLP8XZbHiGRxecmPWdPHoVmL84XzqcNAd3EwfddSxeCx5RIBErV+hBeu7X+E7EnYlRahLexyQLYWVO0e5gy20ljJvhNFPbfNdVOrjYe8yKyf+Q+e08g41zj8VvPC6C1BThzBAbtofThwAQNjd/LBSBi55+4kzcNvbJjQ8vch73Jui2qPJgm/iFpW+RCUAVCv721/bJAp7ZRIMeiNTOSwK+Fz7p16rlBBrLDE9i6na8fQlkYinhx0uAliEy8PdlVaAvBdph9AHAX0mllkLo91d+YAvvEeNQRrCC1/MfFFPgOo4pxJmePaAXN7/x/4hTdmVtqD/JovXQ+T9m7ueRv8Z0XW8tgfFwDoLSxSI1m50U6a0P17+5WV7fF5mNyFSwJ8gPhEDJMnyDeWEBYu4nTex8gwOt8nlO9wEQZLpcEk5B0w5viHafOT6vvh3RPBbK2eJfki4un8Nqrk1nl89okHfARIsdOpJ+Na3TvB67XkriGDV/nbvQ8Et+A16MJ9k28m19gDhDzZKqxiLcrMtxBVD6ePvOu6p9gekTJ/XgSTM11z2LB4pLulZbti007VIatnd7wQNwy+82b1FO0sXLhpTViQNdhMr0hj3c0bBq5JHms+5lLHGXGU8U2IXVgOMR4m577td7ipMjoelNkcsjgaphtxwLgqKzIb77DpnmzDb74M38SbOUfZnDj4+ePQp9BfgWGlAoWvqfUtn8PG7kMx2MbEMcVCmuUkIbeYk/ijDrCTLjkqwXCutMFeqmp7x60xdl2H0drrXLDTk9+cUtqn2VuYlBMPiYJTtAQ3FLmtJK5f7ULNVpGYLGykOcO3TyGxqTKMTK5m5Nfu03aWByNO64jTKpQQNvedJWUTPXBOgSC0jV4K7eypVaPB3VosSLaVMf5udMeyE1sbvfUv5vIPRWlpfrz3fcZKdFZbL2GtIC00OijoWA3fpwrM1pKcDnzSMzT17PBPazwL+F9Thz8rJXp8g3RDy1Swk9/6mo7riuWmBgykLUoDaN4yDCnnuSMtqll8GG7/MI8l/b/QIWPXTLMXG/4FtgNOyTFrL6tEwdXMcpJRAEq2V887rk6MtzQvu+RCyamaoOMN492MjxMG79uLY0cGujInfqTor8+P0F7lGNA09PIvpZO/oHKbC/ODX+9TtzEiyegQ9nfVKEXQ/Slu8zqNVv8xZ7wPqkarNr1XItEcUfRRCuNkWYAu+GPcbahdonoiOZB2XYpNuDRR5e93ejZvSd+2jcqPRHPl3rJaTLTBeG/7WSoOsTcrcRMq5KjYhKPRneF+zahpQ2bt0ep2D/9wWcDLLYFD1GpcXOnBBNQntrdGCP8S6WTIk22+eKNIyHqs0urbvPIW0NE2bbAfLwSwDpC/QSbObSC0tJK3Em+aE4Bx2uDWmmIlAiNKlCc5uV4ppVSFWBsRPesJ5oqIwrD9cM6wjS17gwy8l/bBGz/cz6uMGbohFQb5a4OM5jIByrAc6ZZ38jQui0a0J6BhuLXQ0Qy4hWIQKGz3tmefS7BZX44Ev9+wbVthseHHcO/mggU53nMv3arVOlgBk0A+Kt2+7zt3uf+DruAfEgl0Lad18+G4XamavMys+ARc4b8UmZk/MIxTF32eEgdS0lNdjUiKJMkHO22SvLE4Gacyz3GVbSQWaM9w9Y40JG09TWkO25A/QATtTefwK9b7PTjhH47tqIqOmRafExsxmgUW1J24XfTkm0vVeWCg+4pj+KrT7mRO+dF8dZT+jCx0U2pKYPnZaRxBHasFoOnSiP5m7xHsgkko13/o/4CPgJRjbsj3GTzH4buu54/DbNkn29ImkmUGX+PqHyK6FBF1gTYutmvtIG36pvgEVB672R1298uGq245qyYS7MJm0Ka38jv1t7SbbZPR/4sRflGkBrc8KILTA9hLR+e/Si30hRKg9Drs7uAvKlhEQgTGv4brsRommDS/ysXMDbbWTgSC4Fjyo91jDCfXJhOCs2X+RRtBsBY3NFlq6PIuFODrJ2UHjCtegP0ATF0uOElLEq8bp9nmjx1maXlwyR4iObwbt7ojiQVug75wDn/BbSUi9pXfJbejOEtBfUItBzvEuITMmw3jlJtrklDQi0tDSUSyskI54Ldpbjcm5+7TTh4u9mn7H4fZ7ByvvbO/BTvmMQZ9tBTTVcENUjlHyrI9OPEvcalF2EHHdgS3drkfpAG0joox3X272yuNC88TMr3YtAIE2IOiIvIL9k4eyIUQWhYd3TtQiMxv8D5jjRnO4PT8rEBnVPxZKnO0PwleMIUpkNe47PkjS32l2pZ0skDzA8LswTGeBkDi7nGR3m9EYQ1exzU9xPcg6znzQ7cDfVGSO5bYbyRyWq1r6ZKW8MQJFSoPcWOvjGl8W+zMrkv3zGVc5+Nz0yFc0y6u0NURt0aW3/qCucRWdITW6VVsUOtlomo3dQVGh+XehxY8BWtm9ifyBLCjBgrlj0HHbG5KBEmz2nBffZJlYZNuXuko7iJHWrjXtLojMJSX4ZmKMwAagIggGP1Wd4owI/9BsHJnk0+X28sdcv9OKyhM14mZtIMc0g/oUUbm4ZaQuoT7iUSO3wumM54Pmx5EOysapJYdWhE+nxmDMlWqKgxr4BA3+byatjeKJ0cy/gA67107VXNt576dDVCBr63Kl29ztWLAfHlF+cWoSmLMPZFTcZ3TEifDdLehdnaFixESKLF3MLxSKdQ9gGRGI+0MoXnfDRl+k1dH9LpPR/YfRjNEzzlo2QeFpgotUG9dvwpUPAg8GC6Q22k6keAyLdVTq8+C7sTwubuH/UW/SNNeeW5Rgsk5RweLtqpTPTyXbDmZKAoOoCuYr6rgalBIpZGvFTKa1TBF5IJ49nLwYkTbP10XF66r7BsuFtXDhTbZSTU+OE4qdRC6RkAcolrcGsxQQq8TfrQryhggWYyd/L1dvvjieuoObpGOAcgZ6Jq/bq6mZA+LG+Y9eXUzsy1JjOIY7TbNyzhVUpsx1ywgP8AcsugOuO9iS4or0gjPX8le0jzqE0pQdxyi/pHeIPpp+P+S0BwYeixjA2qwXCPCV8LVZslk/8FoeXTACzwEfYALzQGZms7wsYLneYNRiG2jRJQc+PPzj569whqiQSYsOMy6A5LRTz6ZT5O0h29GD+lTqLo2wcjI0+CzNVvIEn3udjLuGzBKJ+pOgAyWn9jMiMdrpz93lb+GXSYoZ1Q1nLBbH8tatII1Uuw7V3oZPnmOqS5iO8QN+JVm/VLUNefZHJ5SSh/cD9saPRm+RZbCrGZ2goHY2t44l/4sIWJo1fdl3mKVIsoMsoPctOwcOVqpLxTbeKN/fKO+7WdpgTiWDx4r7POH/s0JXK2g2IAGMhyc2AyK4j94VdmVu4dlrRYV/zHwYGlNTbYp31b9E9GRZ8whpDn5OkJcbrOrj3Y0+qHKUfg9IhSUFS1osU/wQmgziuhPEF6ywB8Rri41Vjsfmit2he8pQqmMeCd01SD39CmBsZaf9U4YuqK3//sLQcX4fg6tkJcbP4WrBO3Y2h4RKSKuyVzw1zEaXvab/EVX4jitwmZ3fDsTIhZ0J18ie9NWVu6DiKij60zMObJxmYhUK0CQnx5i5jcuWzeLccVrIhYGXkBHVxwkj//cvJxgmscTmERChsYzzltq94wqJMsnvfWzILjcKG0eFQ49e5t2BETC97hvZOE3s5009aPWP0Z4VnrhzeI+HOZBWjBS97WArmO13gNZjRO1bY1ABy6j3/Bxhwa95/1o+pVx+G+ZS6yN0JewaT8Y7Oe9iYlG70bi9tZksd2WhGnEgDITCmvfQIW/Ce/7Ui2D78nRop9iK0g4zCLdeuIlgkuta8o9E316JTpZl/xTCjur/Z146AWr42IgYaoUJAltCo/prGQ/h0MCodJxPawY7yOt6iuj5qGz2CPSPDgXbNcI8mmgQ1/Jr3u7T0qlEJcSbtcP43rr2kA+Acl1TnWmkkXSGWGBczp9ol38XK1ELLKjI70scrxcm+aBRaDQgHRMU/nRArNpVUG4gpbVxSRifv+6tW1n1YfsoyqLt7UhNk0pvuXh5yUrAzBVMgeQHPaxo4MobCtHhufwZyou+PMGcouske69pm/LMoFIRsc4WzwcIHfDl3tP3U8Ws2zGyhV6Bt46/GMlSp6+0lQgRD657r6aimhb+AXa61crQ== template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio-vre/ss_servers-vre-server-hostkey.yaml b/infrastructure/secrets/rucio-vre/ss_servers-vre-server-hostkey.yaml index d9a25792..af2d63d9 100644 --- a/infrastructure/secrets/rucio-vre/ss_servers-vre-server-hostkey.yaml +++ b/infrastructure/secrets/rucio-vre/ss_servers-vre-server-hostkey.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - hostkey.pem: AgBogefPY/MPMUk5M6AfLhKhj9+trhjSCr3Uxlk5HzJkqWjXLXvcVlr/WWAqoNOvM162mrm/FXSujOsRbippL+ptclkelmkURPFTxs3akQVS78krFK4YFvHoI0N8Eyl9E6ucmnN7yKjLEAHZdv9b7mwjHYwcS8IAtCkp1u/UmDl0b4G4vZBE7v3comAd+EbLm53ALads5014HsYR0965hcKuh8N5SfFO1PVm7xrD+CzH0+Upz7zBsIVBzP7HcGTd5RLB+pM8CbkMqi/RD/11w0WJahYHsCAihGMjx9Q5kVUXBgjxBETKXj77CaxCAp7ksxduugyfA5bgW7DV7uz8L+n1wJo1TUIr1j+KlGbCOayRceB7670NCDzMlkUYulCoUlroW7tn+vD28xxLqk0tMWQVGaLINXDQxRDMFsPjz7kPuM5Ls7EP1nYp44l5VXzUxYiY1wzT5HsaKIRVu1rySWN7ACvBG4Dm8e0z/2WAGzG+N5gczyczplxTHadao31ndIPDMIakTu2vxYVxR9Cg6/Bv+1+XbQ9qfqAS6fB/06EWOUb5fNBNHZaot8YRB3khfbu0UT7G3wmy74MmeetIxqwQ3KQegZ1aubkGAfOkZUCjI81+4CAvyHXrnAUe5mgthdwjiAP5EgWqs4LuAsldUkiQBeb/P93iFFBGm9MCPoA0GF60+1C9Kfwp4gRu2054hOciRNhLniChFAY7lBulq4y6iyYweO5x1pv+GZWWrlM7e63YRb/yVP/kFZRlgaZgR2Qml7pIItMrlDx4/s0lgFuufQGqd8Rhk6oAUImU+NxZ4rb2unkWtRU1UX1Stffb7bndunE/nrUv0oggfDos7za3u4p1pSI97MsrU5JpaBdT+GZGFYEUVrOfg5jtCLakAEDEwEvnySJlIFlegBftafS9gS4LCTtZQQYBK8PLJKY/TLSjoFUCSNWD2/1/uMKnkEeROrA5XBlGHcLSJOA3UHlDeUTU9511oyO8Xulsqd7WXiDIZ7f1P8+sWSgYR5oqf27A2DG1hoNh4vWsOL3/Rq0unlqNZsI25+zicTezUtKvpUGk1ToYV6zeqV3wfqqef4ypTt/23BJdESLGLkKN3FFjTuRtXbqw40wo3PGMYikWowvkF4uCHrX/gz7g13UWAHurOFbMwA7Qld5FplpaZaI+tmDCjAiRQUpq6mHX/cfXt//+TrffWr+CIuTXXwtZ+PPE2Uvs0WXNs4KOB0qNZtUiS5G5h6GXKwm3X8rJxFrdwa+bmsFAlDIs5u2fvKjHrz76r8tZF+J3a9VdLHab3fjOsWoEkLyQ6gehdEGt2e83YWaGi6f8l9TEFArTH8kGqrt6RQEjUPhLjocPOlrUPqD5u3fsT2OmDt+bmi7tVZkeMlSyKYNzXsWEZTz1YXsdJSUCIFoxtMjJlccDSZD/iLwH+EGzry4HgVfZQNO2t7cLi7W9cnnViu7XCdPtrXbly591hqa0wO/KMVuAFXeS/rx2y5FM3Adk3ksTVbzKrdqZObwQCMoHWez9zX1t3IiptKKaVv8f+KIk+PvxMX/nHiPLfFaaAap+UK/AFBcagYvMBCPorgRf2fGr1uoCTdp4l4G6zMSM6qxYToJZD3oJ9GArvM1Mz7ELsLvMxJC1h5E9BcmX1qj1dV+Y7P05jXuz5yOJZt9IEZsVEmj2JPaprzRB5EuDRpofrw1dNwrqZ9LTscvhUyadLSnZFNRQriYSfkJJPhImULTDa8SMGM6ZY5pMYbR0yvMh+Ip60VEVtPFK3UfCPDOHMsV2TDPj7hHDT4rJPS4d9MqRvnqC/hLl+ZIINvO4GF4wl+dRZwrpyMncN3SHrWKZO012c9BHZzuXeHgxm2ThTBlCN/IpsXFkEVqPc6zavDFJX7KXnHkgUTT1xfWBXqxPxfNpttevrBjo+g6LdPN891Gz9UKT1RrC8RY+HpHzQ5SLATqyOjHCsN0U96JNnCt/OI+EaGuITnFfILJvB3YyhSPadXZo/AYzYwSAFFNThW2D7L8xppzXXqg8HxnmWEXjkXvtv3uokgNFOSc1RZYsZYaiRRrrB/TubltPKOMWfKSvjdHHpllA9hb5Zu7b/7Lx/kQGgjKrbU25Mwk3F6NpMFogACDFUzM601L4Ch0aJDb6vPXUTdpEpCWGioki0fpWtCJHpD1c6rEtOgHtk6Q9dBV/tq0VmlT0zSCWIxJSZo2KsUjIHRecNLFgS6RsUJcbB5FA25xvdbJCCdivKBbScFeynjOAf26p4wVeRyIWIUatM9G+rMGv1gf1pWH3TWrttVBXsNSGuRB3PsLLWrVqEsswiDi8yXCWxMG+dAWAFBg9epxLokwhUS2Vrtf9XqZd3ZPEXQV2oT7Omq17faLwitaD9BN6CT032QZOWqp7wCtZcXkaGku08Ix2IZXrtjePstRqKwuyo1l9DU+l9J/5S/IdCbvlGe0jkvML9OvBNKMSl8BDO/kLF7Obe289BShMf0hTrzHzYGMFcZ4gvCQsJyavDXlLj8Qy0QsgndNnW43oa4Gj/ufK6Oq3oBszX+S3nswxJa2Gqqjl5mGgeRIUXMTXToQIhbsH9uleruCqUKGN00px245LEJSyscWscr1eyuaQrcpDeu+lwA0Pd/FUtKyzhDI4O2iT0ABO96QilCBCKqWRq3DBmPmgaP8tEeqXXIpxe1SFneJFS/DXa6LiszaGwtL3t60ooTXUBGNoPGDUWpm3nPFnzhcVAF4mdMGAHMjFisfM6hdvhO1eFB9BdRnyxl4UoHNidvQA2Fb99Jd/6qmiuTo6funZoQHcdP/BgFeEEHOkl9KmOL2KXWUKHDwoBL9eaXL6vmvJg4IpDmm/eHo1hnrb87in8JcHc+xoRH9IUhYiLB3jpMezAkLM4ltbtmcLMQkpTDCYTIp8gqZbdX1NKafeOBmAMGGj2WICshs7ikIfgGE4/aqtbF/uLICL6Plnq6rptxlF9o63RiY+FMQmuYjhFAmlQN6LSIyaISFQ1jJSCUHk7l9d51wyB/SGE0j9vzLjBUWwGnF3Yn75BOn+J+1yUZDYSDmM+yP0Vy6dRI4gCxl47VqzeMPbJ0MDgh5N12rFB6ekgyXFUjS3zBf+et23u7DpZMzbGy0yD0XI3vH3OS4L3pgcoJ3D + hostkey.pem: AgBx9H1nq8Qm7HQkKE1CAO9ZtUfYAgOd4XfcWiFbRfV440KQ3ZO8gPJV7Goj0tuDkI+JjzFcOl7+AuAYk1eB2e+u4TJxFbbP4q2ZhDukUkNnpn8BtFYeCAQNJlwr+mZppDIS4P9fqkvZCxG3gHVlWj+S7zJqHGHxAeeWcRQknXN3rHDqRTpLzUjwjZudtMBxxPynSeQgLravLGOErTCFeu99UKusvNkWM07WgUGHbMvK3w7lC8gnllaNkI6Tg2LZIGSWPS8MqYACcLRw1iaPHo/kAFr2Svup7HmEKNqZD+JB4QT8XXyFI0fLlYq4lVdVX0rXOPQopgIJMTjBCiogTdCxhvIruGyyCVct31ETSUx0uc4ZJ2QZiBtdFtbL+kXgCDWi/QAzPgNr3nSBTu7EEF6PYcvsRXnlwQHeVikl5aJnGLpk7ZDCIbOLy/lTSKGekHBkANdm0AoDkCCqsvjNSyZkERuMs5srUAtEyHx7Ms/GzYwfJRS6ql0ndE/V0yC5cxeXcsK5PSSo0hygze/3TUTnYEg55isx2qAxANSMZeg92m/adw5U9lQkvwhJcIn7jOFupgNGOSSUaExtBIhNkLM2H/p1ry+bojc1H+61DTJnAD9djTGtR/qgpyuXwWLhUJ85tVQCLbOhuEqOBNnnt9CIiKF5u2yd27L16rU4sz0bcSQyMz0v8vcMqH3lcJcvxiGbRtyy98uaCv/NloS3c0X62t9jjGe+locdzLBtDzOe1kjSYJvOqd/D9pMVdomlEtfAeP5JJqxaNgwVM9CJUTwbDQPRe7+wXa8LPlms2J5XLUmlyczi2URxxiw6gKxXHn1QTm4ibTnu9lTRmOuHEf6HXxO+mHEyMDdXplVP2/JNwg+0Gc56Q0xc5tH2rwb1UAlJZD+J26+l7oDaQnxE0w2FlAURUI7tTVo/0OhwD5pUeIXzil/0ohgU0xv2KjG/AaVfZ+A/nn/19SeuFDmwUnbAKXK4UOcFu48nNatiSSUwgs6HhuUXhM1wiyg+atYStMIQAqxt6EcBKPVVS02TE+2Hv2VjIUJBTMH6oDpmnrDh7pPjd4H39ZOqXLiFwOB+a7jOzeeNXTj6A2X69/JuyU6F7reucHVVItPYR8waGwWD+N0l23I/lAisAQaBHL8oh+AKgBKVHDFZE+O8zzMXk4zwlNzQYCW9md8haxV2j+uFYJh8dxx0kiNZ+5qkfrtqO7F/SevtRfHy6AaNSBj8hG2TVtzWDESbIJnKqE35Dfw+sglh2GM5mxFHdAZduYvUTeVg4iQgJMmY9eJuynwFxqOTudITrsQZfdIwNeQc9HVf0DknGbkZ0C5BHcwZ6Q5smDMeGOYAlULMCC3sgx9dO7PJaXdrtM37+oaAaCxNJe98dm6RYtWaw0hEpXI8b0DgmIGWUR6PJZc/am7XqD4htXGkH+mdEhe7Hru3rJoZKk++0l65up5fAjqJsVWOWj0lF41qNiM7scFgh/ndd+IqZqD9wm4b6c3EDhNZgbPg69+M5wBmEbrgE7GWHQgVRVOb7ASpavjEEK6jAwWf8x4x9VV47f6Q7cforyjtlY37oPkLURPbOPLGu9yZplHe7FPcYl73rO09YNeGBNtTIqcv0g010qVijDZUTpIQA+9jVmxLjxVUSyyxRlEJuWNC7WUJVCRZl1/LW0HOeLuNrfIEv3SjF2VrElYg0BsmjObfHEg+seFR/BBvza4vZPtmJ9GRQAMJhvgvil/SvZ/1lQ2YWwZ9P9qFe8gaj78jSJOC0G5cHRVaL29NGEpt4/JiBkf4ryqSslskTqPj4Kq+i5WU0dX6AjgupeeUU1GTUZiSroA43uxohGGZOSAeNi80gerLBnyyIXo5hK1zkfuUAuh9UiPc7HO3NPMSnN+MxsvEsb1O0ovYoTGrO4EpC1mXPXB4vlW1TQ7dw/fqe/b52/4Q4pR/rrhMw7DADq8i3H72gWd4FJ0816aakwTCJiltGqlMg2tl3VZdeE7zyL41wEfrXz1wyb6rU1bqKi/8DtR6i81FfVGd4Z4lzLhUtgjzhQgWLyPtnjJ4K+29RgaeQnE+kDdAUgPFJfHROlrw1ymDRaXVpUA8R7a3I3PITDGe7jXxRinZPjtbfnJtzauocZA4SznXmTRLFGqx/6dOk9y+2cNM5xJylzznzZ4R5VqOLwSHfAtjTg76xiptMu9DfC+jRCXM6cc1C0y13GteuZ/qTs+v+mWzVK1kjvvPPjHvHX4CF0sw3tGYtA26mMskgpff6kXdZQOJl2jsNu6d8u/90mRt3rkPuclUnA4GE7aDFevgyYjJcqnhWEWc9WdYJjz5VghEfrS88C3QHhIA2GhfZ270ydOTp4H4JB9ZPPMdg6+J95oxePUksXFz7cs0PDcZF8tMu6UBVwOan+yczTJWwNPw+vPx3Ox9D8zrktAX/y0EankDUJsSch/S+mIhf+NjItWIt7Z8RpDZTxLxW3incYLw3i8WrwIwQ1vCyAlVRAoBFyHwruJmR1bcSCdUBSWQqQ+/lmzH/2Fuk9g6jxFH0rxx2jfAJLat0JptI/jUoe8bc9OAoAdGSrzQLFSEj3aD9mOLctw9x/D1/FVbv9chRVpMF5tA5QwjeHqqWx88Gl7uwTlioKQKSse+BlqmkJ3376BhlrnSRaL+FS/OAI/1Wf+97LT97pb+3qdmwJBJOEg8X3S+CE3eaV3zGva0cpM8N99vhgjYmozzyX7Yju2Fz38Hbv4zmHj6t8bJXspFA6LrE8MzZ+zxuOGWa2fm0D3NYNPZgzMW1KgYzSZoUPsy354Nmw/NhfMO36woQVIoi/dKsAAqeRa70v92w8LLnP5SblqRD4hXS4NCGPppIC1HimXBHI8LZixIsxzbKkjneTuLC5gIv8texXxDdNjE9PiTeqRYtBcHhGXzTk+uwsFIDevEgAzxJrJ+Zm7vZRMNI4ZKTEquKl8RMzi3noQ8a09FxrBs5CQZv6cIN8Z9s2Q+uU3neZ+2xyN9o6a8cCP6/3BFJ6Qvtnztb/f0CbVH3W3wnzLrvV4Zeiv1v82CePguCUxuOdluCPRF4XHFUIm3O/jRgaxbNkRxS9XWmyavgv5cuFWXPQqFr3tMcCQ51YpEEEMspxKicEEokC6N/kg2Cox3/kF3x404 template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio-vre/ss_webui-vre-cafile.yaml b/infrastructure/secrets/rucio-vre/ss_webui-vre-cafile.yaml index 2a8586b5..1a17a0eb 100644 --- a/infrastructure/secrets/rucio-vre/ss_webui-vre-cafile.yaml +++ b/infrastructure/secrets/rucio-vre/ss_webui-vre-cafile.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - ca.pem: AgApDyM0tJSttI+Gy6TRqBykst+/NOSN14FaIccvoeEsmtcY016BDUbjLpd7wcyqMK5yAjIJJREPXjKhyavQEHI5gOCzrwTm26eS4bhsiHWcYIV51EcjxixEU0P4Fz3fpVapG9t30VvoSa9Y7UJSr1Djc1ryBv+NYHLdkC8GgodzeQ6UGppFREwPHuVGH53rdu7x3F5P87iv6sepp/9cR9PMNPeLPUIUDdZqf3jWj5PyBpq6eRJNGFbg4lrwZiYapg08OprwwFiS/PhfO9BY+ZexyaXB8AcdP/BButRKd32jxJeCtQW71k9ecPurcEuti60Hz1DvvYC0rGz+84pXHV/RBb44EmyzBdenzvsj1ByfajkcYo82t9Dy84FOt/YZEjxt08t5tsBWqrH4sLsaCnVYe25qMKzkPDvt/0I7GVZJFIkEPsTl5lgofPmbHQNTF9xFWNXVu8e1y7UhfLnxMCy/ceIrskVpQmFQxwQS2Qvo1Vb7xex3TRjn1KtUz9cWeMgLrMs2vMjfkxrMN3EMQRPNHOlrYqpa3L5QOBAk9TK+TREV9+d+EA6NwVLL475Y1SPh+9Ak8HlC4l7+XX5QRJRAKTCGOUabqbvt8JR6y1xOxYTDgROR0ZckCaEwBhLLudvQ5cxtn9AWZuRdrlhKSfDEMiHM8yUySsA45LMr1f2rEonZXwTOKtyTwlBxoxP/kMZKh0NnylzCoMOC2bc6UR1WpKlumTO0ILY4f7xLfewIUvE2VZUJYTVRi6TiVVu1c275KnlJSue/55NOOMDzMcgoCUfUFjyl271M71AtZZF2EkhNLEHRCCvXYK2ZojGCQ6+9a24a0IaV3txR2Op+EBsWel/9QZro4S1YARvES3TzP3TQK63mneRPqdT2vGoty/Uqq0kxTUAy/K6Hw+fYR2+0ZiUrioy2SC/EFkIk+IJ0RmvEQgSMqGwB/V7fors84AKCFoLxmRXGxda7ISD+RT74ZnnRqcCKYbEACLNop0b98NeNrbykXb0Znx5Ewml88ivoMn+srAr0h5N2Nncg5uq+ZOj8YkmdQURBRonBrZcPPChQSg0fMWXp5zjYPySZAkcabdjoOmh4iYDcolkagDe9LFJtbHnoblXeDyhThBO5GGloxmtSs6aVAyqXD6MIEtbhQgYb61JaAu5unXbdAR3x5XZTRhTDDvA0s4ZGV1kshtR908vWo+iUfB5nQhdvVeqY4U9rh2Nc9THlXjbyCeQHCsy1aYSaXPK5Ejoyu0n4sEEY4WVzdh2tprOQycf9miNN/wILIi55vD+3VamiK40/PbFdbD3mtX7iPkYYisa4LUAWZIArbNmLTDrnwaCAV/gdIUwTYxC0gP78N6XwLG3SznsnGEdNACAckiPf/C7ThWdO7sQCciHhS8RsMox+3/UjHgj6HTv85hiJg1qgsm3pxjjxkqmPoRiJHeNNLQF3I/BlIx5xxCbuCP2Ph4cJLeikK3ituMqiQ+3wIjJn6q3EkOfBy/egHk4xGfmyhbYzZjRwRbzMD24o1eOkGfJS1dQ5Ro5ryngMGD+cuxjM8oIJ0qI5zQbSX1QAyJWZTFH2tvYXwZWz0gbWSde1QfnDEJ6vExrWU39xbl/9Em60TYoQhRdB92NjAxa/3SZXph8satHXJFytA5/6sCyjo3uekF05YeWMM1F4nJlp7+WYOWEYQdM0iesDsdh7DEZV9/+DpUjJfGCAdhE2klcfzDUVkI/4Atgm/Z0t8zuGMmkQrLGx6f2GyRAVCeRKRtbYZsXLsQiRB0VbJtCmVCNcsH33FjmDRPydyujCJl5Up9zH+D99sq6knfxP/UUoGmFnYdjrvKHsTL3TdZ9aBt7mVUY6QxKMRP8tF+Ix3Y1kruO9tuBXXuGOnCxkgu3v23gowh6X7Hpia6JqqFXEn4FXGxNxtV/40Oy5J2SxrnaErFVqwxsJWAPjM7z/Rc4YLrAZVophQvbn/0SmjPvx5DHutaATe5NkPEU95Ob/axtqLbrH4nCaBe2tZR4GUkXBUA9ROZ+f0uD4oYth0zE1iV4mvoFUaQCDtHkjtK6Dp8+X43nciocebF0Z/JUhrqLxX2YA7QcXvD7x+KzzSr2cb8e3/GVnCJcuXdluGFcCm7rSsYmKutsRxqiWTUVh0vbU/Rxls46jp9btSySoItADgPvx7o8pG6ABbIRFLW9Z4O90nMVk0fMinX6COxIxQzIIsvp7Bm9m6fgWOuQEun7xcxA1lPzjTQ/QayifGE6NQ6Mnh+I2sWKJBe30GGLz018SiDZU86Rq3RqwekWNLNX1ZqbJO5P4OWI/vhHjFNW0IJy4Bt4iv/jXEh/Y7cMckcRajB5u60T40sPBAUNJpefnJtWL0xf9LfxeHYZ3kads4aqF3FN1rvMlrX6PEMcIuaK0pmMOMZZG+WNMs3Lx2LjHLt3Ei07PaDLpahenqGIwcR1cVoCRIglw5VHSPpk/ukNf1XGsEUhuYWT+4xsm8GchXXVckZ5krXaIOWkt8Dl9jBSFNOxNlXsRII2VsZb1rC7XscGtzdWWGhNFWlXB+XfUHGvlFNvIVdPYOVyKiFkoXGgfStIqPgf12TInowSgiMTSVzpaSyC6hlPbgSxag5pRCaXKpZCIC4q782aCHmmMevSooe6FF5yhhcW+2AZ9QDFFas/KbkP6/YgAHuPqOTQ14/aWZjzLVRGewh8Q6sOgZc1TejlAt57eT+Nr1V/Xu3/O4wY9EbX0f5cHbhjjpxBL2mJYHFWruIq7oo9HGpbv0x0UHxdImpJIG29rY4sP8D6y+KYfMj55u+n2Vph4HpuuR1PFGylcIuGhDhwW+JdUGZsEdI6lbH2B7W1U4SsEEjDrRx2ST4PlefQv+9PjJKo8cey8CaeB19sWCq9kdSsZUFMnn+O6q24jfud74LbSMjHg++HkXPZGNm9v8ZtP1ZzkBB96ykUPh3VCSX3Z5RGbbRUU1vDLC35Vv/yYWdc38wnnzNYPzgQE0U0wEfR2l/ZJzOfNZycpjsY7FHMzVhaOzMlt8tH/yr6u2KUj4D1zRZat4UCaudeNWn2yveX7mQM3ha21LwZ1XrPMywsLr7z1Xv4EpwarAuNKU67gc6qUNtolC5dUYhlv4ilcBAtUk1BmoaVnuxSNO+tdN2Z3gVhtXpx9vFuziit3RVD9P26Itpf7WR8rHP9T3+1YdpFgDGXHrdDlarh/rf0oTNoNxGVSiQIa80MjhVojIk5IrtDVpYalVR8Vnb7Sr7THGVa2OhoXlh8nGGo70dpeYEop4sZkzxPAu0GNx2qyy8TEhl7sI8Qg9ky6pUS9ojk9FvZi254AXujciICwcAIQXkaBZgIyK/wc28KTRdaS8+HbJbqvubDI9a+qmiklHJ9MwTF5td7e7A1NAhaM7HuBbKiXpjhxoTASWVBXpt3kDLK4cXAzN2ADT/3wuyZyP5LCzrckFBONBIPgIPx9CvUIndJP6wmTpog13mWJQbBt7Q8JyIN30z84ky/1XnZKb5K+OMHuMDxrP3KtiZ6rtCxemjif6xlJXjxMmnSyzacaL2Z0/CVM54aViCmwbcoXg6DzQ0uv6Qbwvkum1VOTl0lUwuLId4gyI7tPhFaaEqbmYrlqKJ8vVCHVx9v6QFleWzYBJWFVPROW3LHeGmOvOwErys6gFfT5x/Nr+uq5do1ay+Q9cTDnvZKwZROCAuAvUQ5POCyry7OcOjh5esH7PgFADU9Hka/1H2zxbtMPK5LSnhUB9eb4m/AzW9Rpz39rTiVu39Fe2pcd3F+JGtEswO2hS2yKxlm/UBisCIfXdC6soAxUD3w+gCFOvMSudmUMtuqMCf1jFeqsr/TgyMy0FVu6xGXQ/dhBm3tArtSmuSlWqhOYOEZftIWCsh73sjVWac4vhi7tN9+SNqY1UXvV4ZGj7/vja6aUUWPAB+Y29Qaaw8ISTCn7AVH6uHqdLl+L2okZYOctQxoYNLqAWxFWluyXVShDioeKrrG6JLfDcHYHUU7JG0s+kj+2H62TlTmdZ/e0CKo0057T4Ub4/18MVdP6jo37kNxNW5QVHqMCT09cU9whjEgPqQQVjw+Dfk1LrXAJDnn6heSCTVYThh1peUc84iLHAYQRrd/xClT5bLc4IQ0Y1qPF5RqdTLgnUhbel8MUUdBJGzDKvHrG0Z1RYMaeto3+4FuuOxrZXs0qXyD/Z54DkLyIfnMi/cLQSzWpVCgPv4HQZhVO2c/dfQIwTVGzgJEOFF3cmiIroGmKkJzIOuylvtVIUzl4NVNFrNKSybLR32mRNyQ4y7m5J+S3RZen5Pje9j1Pz6Z8T8qC31H+h3dffY36W6mwwUiNYEzeRjRTyuzk+ezpN5wEXtN1Hh8w6ePWFRDVC+JSzVzt/8pPsdLQNZAvsim9ibeN792I8mbOxL276cgaQn6y6xJ8WHKXo/TN0Tcnncc/SiS5RB3ohQKLHw99J6DGyIS2TLRqquADRM/dgVdGl3slbFsSNC87PmG/UJOvdZ0XDQ08dB43/t8FKsGIv/NaQ7LSHVJxlvxtgGtV+AJnMTd/+aotzAugvqIEnnoLW4EWjhBSGblt4gJtArncp1V96V+ILaVtCgBpjGyAqvzb5lTa2mtoj2IWLBXaySBHAxBn21Z5TaH4qCuw36tWi9QZjFQ8npt4aJ4kdJlPuEhbpWnev+hsuBbA69nep2teM2ii/rWBU40HjUZJQ9G/87pmPZbISmPIMBbbtf7VARyLDHCHfQgis+/0OydpGIGTyTG/2XEret2FNeKc096Ziqucdnw45RVBmAqBkd821IMeuQXbfFLyTmjWnOMmMJ8t6957Fz5x6WdD2veeiZIM9JRlSA3ZLGi8csjJLHRjATEG0T1sxilcu6GE09BZdtj+76ltqCP0hMSLn5c8fRyJRvAZO2znxMaRE4RLTKgMwvQcGeSmethSBeLA7xHYwOUrx/QzdO+DCBsI1m0k/ga4kcebz3yuu9CGPiGUBQZgxNKwHiNYXPZZ6iRbMCUF4gm0uOw58a5cK/V5Heq1vifvi/9dRs3GBA1FmSns2b9YyNzV+QMMw7Pw2GBXVj3qElNqPqMQgQCWbdoJrbTE1qbMP3Cbr2ek1kI7eLF2NHQUkLUp4+XYyYp4HS3FVxOO3c2huiUd0SXhn7DMvrVEp1grV72MmFZrYVeDagIUhhzJQW5NZeExvf2YCZB1lIUZsfAEQhKv5BecDpLev3FJQZeaF/jdXmSqgllkSJeREZYBroQQKN+BwS3KTQ00li6kzs0G3RRD2UlEaI5prxg4EAo6uhD0+KdO7Xv2Gke02zsxepG0oQuuG7HZ7Ys0q62oCh9wi8tfp4qYF/CpcMKV/Mg37Bf565H+9kM0kN2Wx5ps5uTIW2dVE48S5vMFTTSFmXg+d5hkdnNEYKelHx0AR3xiiVXTuj0+WSbIPoXlbT2zjuDdFn1zYjZpqyUK2RkxOU0n+kHce14ttq/ej33VF4tzvqHn35OjtPYcPSFQtRXiEHbYdPK6YYU9JjlA6k4UQMFxWfvMGeWrKdEbFEzEjNp3i2VJqeeZpezrA1R4Rt8MaR6vlWzTgodIGlMdgwdEoy6FR1Bq5g4m/2pyZ+mCF3Mq9OWR+7AELWWmuh+qbcmamCFyoaaUaiKmb48mDCLZaMvdy4rSyIuRuPwYW2XffumupCR4sf8JxQEQIXVPBkvr1tZfLbCficv5FqXXPIFwf0WHJXDHcSaxw3YD6hPgtB/EZ69fyObyW0zQAlX4tQ5ARSCD+ZD2F3pFsjIfLsbW4X2Wgedyn56Q5Ce6sqilcjjop7n3B2n4XykB2lnCrSmPcC/L04NG4ONiO5DP+DFNWkUALV8Rbf+jjfB1xMe7H9zHloKUnqHzkJG2jYabvOFPSOXxCLwCkIz6N3tPrleXdco0Qju7UffWgsRXwiBfmQcQZhYb3oCStZw84y1CTlXshBlPU1DM8hSlq05fOACopcwAJ8f/oEUmrEI/FP7JDcrsBv+AT+lyiiKJHDIUfqVoJLBHAo4r97qV8PQJjoG7Z+1+P8x8H4GyCHAgAaVUJWvksUf6KXVghQCSikVdB4Llfm0DfpYpu71FrPXNYnPxd2kGkqIGnh/jNUVkIb4flbQY7iWYiG9It8+XOleNQQD5+VDfJYtddORtyjxBT/gkhy3u4gH77HWevjp4Qn1uAisiNceAywFssQ7fdT4ql5V2bOiAxrNJfQwQr72b8wO5pEavXDI8E7kfiV21pZlKOJBDPLuYp2gjGmPhkiwhdzWw6ezMeSlbC0xItKghYsU1CEHmDSL8KoPq+Ah9thESJttyIOEdqPT0Gw6cU+njcA4Vd5rZ3Txhim/BOHyUjlC4kWG+TyQkt30eFiFAUsx8VHmpvZyuhR0XSUbfaOeLx81mmBbeYkvtrYBscMj6Hu01Ap4mwlN/yMSCzfgTczS9Wt2lWqhsqcTjDzyKhlzSLy15QFeT1oqPG85S2dtfimw8Jy0LuMliIAFCReUHvZcae7VXGup9/pTPEXaXvf22u3mu6u1HT8pBAjwr4ilwxG5yZ1MBsvC/yW18JtWOnO8H8tT72dq3XE6SQ+x2PhS7oHKm68BDGRXia4969x01emfRsO7JzW5/fitkhg/4va3vTbfNtCY92RvmXtQF6EimZKisB/EA1acHVQ1nSFIuI4WDRDiNKc+auESDmuLy42XqVmUNGvUa0dQ1FcGpS/SwIvrgJgrkMAS1Y2LoQdg+bux/DzzUOPlZjPDaUp4oMIpHQomGdq8Nk50HLi59Vg65WHpcwOUu4c6jpEWB6tqv12leYdGc5JEndhS6/i8zJg/y3RMbJtB8tfwx7RC/HN67i66o+Q0smwXQlD615Gh0g+oqkIJTYlPtE799RxkFBsShTYb7UxSl0gAIifPGAx/ppteyQuX5E0AI7QqAUv8ERE0qNWSgRHGtwWmDKvGWpDs1o7u1L9ixsrHJoSvFfrokFuPlJoYGE92jy84FMVjMIWQiXyef3uAzsoeXQL9qtfIXwhFNO3t+zt0HlUSk7E4Zx4ARFl5eXTxBfyOo/PPyZdQmFJwA+dOI37ETD8rC4T0IpuB37CRvefBQtJ/M8jfZFA6ZC+liLBkmsew3SeHHypWTkFvD+pWmh3aJBT2byF+rbhhEU4rEROoDr0JbLzkCw724gm2ig5oj1ExTbDZXhf31BhHYsSfGxQJVMbJINxf0PbhGi3NCjME3q5oE4zlMUZ03TaJhL794paESIucihEOrrlDRd544QzWM4ebzufLgpzLglyOG6zN9RkGVxa4RFwETZ72m8pB4n2xS3DUB3jlGCbCWcpP5TWqcDKzZuL3imUHNtQhPjznuZynj1tgCDMpQk3zD3bzf6TG0U0I+cFMkRmXBsBL6XX3DMu0HXt0YXtlBJL+Qnxz3XqEjb4gLE6Lj3ihYW1IaRiCaxg5ojOzH+eFFroio7g8y/AKZZVPrIARHBz6a4U59HozCAXppr6wiFbBqI6Bqh2fsJnbmWzd7IvzB/eBe19ZCLH7CYGWseDuhbQJu2xgFODbicyh/YVlWVk0F4oHQhgrSuxfQ02dHRTImHdP4NUWGGYb0EgJitF0sg2r4bOyxPd8lcOnPiKWwIFniFBweX5G/noEwza41P1La54+pCPOuFoO+R0r7XWHAdrdjM747ULyp6XHqLrQ9GvgVbLHjQo0wZUPsSyCtBbErB0wZX92ToBz1B9ywo4n+5vRltPq6+gpsEp0ZbscXMDVaPdkAJM8xij5/JA1ucCqNFhJfuTBWiy4lqx44UWnK1Vr3iMIc8ba1QdOIwrQ8YUQcwS8ELIYOvh5TIDTGRsUc8gwUaVNSeEv09nakRpPHnuv1p+38E7pqgYXgp/1oSe/SwFr3szu57nvUXB1HTR8QA/YE7VJydnVO6EDH5dOTib9kqeL1JHVi11GjqbBGmGCNCvu3yHg8mXyLahzZtCiY0XONMaKHBMRAq1V/7W7WbnfculFpf1EGEB1gsatC4uY0jY8zIAjcPGhjUeAVJIeyDOYVMosgktFiU5uMks8Y54NSJn8RrPdgnoakhkanVKoJQ+GO2TCn6sEVuUFKCyRdKRl1EdA4zrNYXu0GJkoeH3sW2NGe2eQJy3odYgdTLNWNfluNAcpKBAA2dw9J0f1Pams8nwa0OZD+p9aUzUxFlxJLpdeZrnkw8bm302N0FduQXmuZ8DkVvO5No+CwEuAyToYl9YbU5e3/mWpFr5Rmmv4aosaQFYBICZ4HOolxM6gE5+O9FqLW273REr4yZwysDxwQpzXF+bkmjfNuLjfGxa8ABsV/TIA6CWDfQA4Rn1D3kcQRRwZo6KrIRssgoL5NMOfw76+4q9h/ZQTWvRoJM+IYsY+Fat6lkuLGi9PMwKQdq3ptNxqiTEtPutm4BQzF/Ndjd4UuVbos/BW5CL3Op9/dpa3Qh8TJCPkbcJQ1/XQJJ3JrgvFsUADfXwvM9FYyacoTqXlPqNhnWjwNJiQAEm78/m+xfuFzIlbbnYId9zypyouyLZAJZUjOxUGEHTYjgq8wkfBl7RPaeTJj0UhHlWBeWjq7p9Syc61Y2/2hOkx8MrAT6J9BpR5sIuKJKIEboBUtefMbDHeY4bhNTcvMKE9kcZP2slmxW+YTs9aN0nfXpOOMh+hmB9IuH1xuZu3YJ+S2rctNjmTLuSdnjkX0tc8u3bjcbPd+qKaBvkVeHqFhM0UUahHA0PMEa3LKQHpwr+VJzj4hl8uA+4V/vnpL5bR7VvOjGggnPu6/62KxUVeteQ4izksEoYKQE8/o6qSg3Nc990Z8y4LQMfCcJKY36Zo4tIOCP+a638YYgoYjr/HyZCXUCZvrr9Wjd6geuuk7DW+V3sZBlLSVHC3VZSbeNnNKmxY6kGCXg2ueO7ZLiYI4kc/FOyRTpmBs8HY0QD7LkOMmBFMzJwxmg947cp2I4kovABqOmW1AHfGMhXNiB5dCBJjrF9rY6wMH9K9WvbCyRvdsMfQr3TeSk8ugISJobVy9H95Q3051h35slMyZJhSE1DxbTBAhL6n01jC+z+niggt6363wTvb7cGULWiJpagV6W4TZencfivdB3l1bBkfQEH2/q2QZdFgNn66N+jMAIBgssZ6NvfPjYyk32btRMojJb+Sj9XFGGeKnXwjhRWixKd7y0IeJpbfkHyiM75lv7iDqlIOL8DXMSdE9cSmQNFHPDwJh8yh7/n10FOpeBoDzOGrqlsf8bObSnpOEilH9g0Tvjen2W3VF5rsv8PBDITIZ2tTAS5dCX4fR+drPY1WLNim1W2a5tidGJViB2riAepeZnn4VuTB4hU3ksIpe9ZvmRwJUSwAjsANUzetFqZJCEPYBGHmyRTjywJ/+sJtM90zMd4l/CCKPu19+9Pn1bNpPPDrQaPCh5JB7ywiDM8JkU0aoB80W0jcwqTMm+NpBIgOMPv+jxF2SH+nphseIaJ3sASKt1VN8DOr4+GR9sOUWxNj1Afxyyc7k/fNsZuOTRhe6lqmtD4zWh6DXr28Y9DzF2mTLFBWIfRXN/md66JbHuJ3VQn9tD+pgUpmUIJltXpa3fTC8laCutzelGiZ94E1ZqdwRlCzqzvfOBuxMjo84WI1/1nKeRjAQaW7lZTNRjwSikJ/Sh7eLbLdWyOMVw+IQakvN29TfMNq5FwNpT0yO/mgGbcabDMBtDIWUmoM/6h+pWpdyleZJaouP0xlbnNdbVan8zzW8wvdc6pc3qnGXfcf3zM/qd084GC5XnbEM+gl70t9g3VgiSOAfEDiuPYNKDQ1GEa+Y7UBwN2gp9WFKZIw+9e6B3D9OOsBUMwoY0bXpgV15ScpzeJqz2A2IhIxo3T0WAztv8WDjFCmFC5pz1bmrXR2WMEAGsZqaHlTxbJReTtpZdILsH67IjwyJgSRiZ8uM39+Phyw9dKes5HJCfQ9Qlep3d4W1my5qauppZ4qRBPA8VIVHoumsGjCp5dA0180z85QXxDCVugBA+2+co9LO5u2QO86yDCUQBfjDDIHmGnWWcfmB3fCW723vehKIfI2xT+YiI8Dq3t/YjLqWp7x8wJEp+AbVvEMbCyWeyhXdbfjKTwjTLefQBR+JXsKVpyhQSTSJShKG0XQPzy+ZXwBOjxr+OYc229tV4Eo/T6jRydLRJRoeOU+TBEbLSiWET3SXp2PKJwss17txAWeW9Psf3Ar5v0ViX1Sz5oSq2zawpNNIrs9qI8EtPev9wbo2Dl+0ztcQJlQp01Dr8q2fQSXC22k8uajN1TXZ/p5xgX17X63XCnE76vuQbxknnzqHVGFtbi68WUxZ4bJ3cznyB1uIIcb6ziSUf+rIpG0NSfLPa5CHUrXKxK6oXtFZLlx4Kwa46QTh1sCaFeBy2chTFocK74VMx4U2gvNmBaOniLFaokfb0EbMubDgDWNH/rCJsTIE1oFnrVJFMrTQHxl8RMR+pBR5lp22R69EioBI7IZDIu28BU1I5+m6qof+hbka7AQHNUe16lwiCv3O4gNef+SSBu7OSiFvPThq8XCJ0C8oc4SFdizO4NVFA5q2Pzv9r5xUz5XBcsygPUBiOgh/GqSJT7FHXzjS93VhsaE+j3gsgE3GgKQaCJ7rhXtgr2FhKC+IAMB1fDuF/R3YIkqKF73BWglzB8pOtcy3TvJdne6l5bFVWytpBx8UuQubYu4IZQ8RwWsJBVoeirWiHmTITVOYh8WJmrGLZrks39Ma1XputsIAdD2ocgSZz2nOATgLHQLXuvn0n8P8uT3AWEe8zk9gra2IHohCcp1QUOyYUvILdlyt1nAs3u/8jAr6SnNfeU2zUlmR1oVW16xpgSksMKwXeyKXpuSt/+wsoOy4ePesI7oW8N40gXkROeVE5LahmjPNO6EEIwc9FYrj5/4kXub8OCyMXa15HAnxw4oKamgO/zH3RIRiHCFafKGvBAVy52jn8UHpfA6IvRxUrgoyoQepMehmPw9mh2TDNwr0ieiU11Kn5VbXfxfGd33VWzlFPW3HHMEf7z1E7vzid8y6kHzEXZqUy/kPEL2y4yXcu7a03vj7FHVRwvWaDbvWaPOCo9Ji3NIG2u7Up8LPbauOEgnG0WCbFy0PlYJFGJiIuahvuPNlgfhfYxn0trRP3WsB7a5Hh9SNykeOWf9fMM/YMSSUzgo+SXiQMpMmPPZsmFJHNuVB/bL7iqYaSF1TQKzCRgyZuHTKKSG5MVusjSIoCyU0rkwdjeXe55QiiPLpYzJEZnVAVYsmuTT5YmdwEWfmDGY+1VQBJVU4Db4ISidz4LIpuFhFlN48ybUEBsiwZUyoJEbYq7zIVAU726+/EiGCLLqWMQrp8GaIgwKCaC78/D4Y4c/8QqCrP5hzB7Hc0N2zb4lflF9uGbd60R8C1aDzHaXbArvYOXk/hMteapk2oCo8EDQ8trC3+PW+kFq0aMey6ezd7Mj9hrdBx/OlMF/8j/s2c49cAG4Y9ZdpMHEsnwPg9KMJqG4q0J3/8SneLHWvVgnbZGoVVKaD3H0DUUlRizJvQ99pk82TQ7JjwVg+t5h0xcsKDWAIyZo3TkN03jUkIf1rGKuK0kbuHlAvXRcLrw8WCBHfNblDlXYErgFOR1On7dzvPztspL8WJEHYuBCsnIR7AnFzpz+J6lbOx0KodLcEW3qFrNqheWlhjEpM7GgpwNvXd7AKv3GQGW5t0I/43OnjjlQ3HDebwrnOueZPymQ2p4mMP9q3KedMo6arcwgcZ+i/UPbmR8krY48tDngmAzrzZTFJLX+ife+qXtn46r5JFUsGdZMdnd4998kSdUehtgK5AS4MafKo9KijTsIhJvOdUv1cO/LOdU+DXOLHSJhOcGrDY0xMpIfWEG/E3Qbi7NDVYD5i6FtVUoUVv46f+gAO6rcbko5hzIsJzJP4t99tc3rS0sx2263JNF1j1iD46XjlcDkNyYPnKFS1sT3QOsIkRa5ODb4PamKRhuik67rs7QhaKOtloNDHPtnGDngbtHVWa6gU0nxBHARO1Tx4/EcpnWnI3s0jzwJzHH5zlGxKlCLiJwSdJYO0hINOzgE08h39j9f5M8Pje/eODQZOfnfKhDtUIGahSGAzra+qZStDnw7l9GqFfmYUFoFSLq+4mx1sGKO8amhamcdfddWk7HCsPTYLc8UQAslsWDIOgnqLVSfoTWcoJcmtFTKy542hbRgebSk7iwBaPBEYhxNUMBc8hEtU0nHqz1zCuTXT7qTQi6+fLetEsaYxREAE0mGRyn2P13zeoDLj69lk+c0iV5DPMdFiX2yLJU6A3b0jZDcze0YovPsTVUdXWUIFZdeh7M+qUCpIgksQ9coa5qreMA3uB6Z/EtQpVv0kVtysaNJxxR/badsPxzumg5SVrR/GSga2ZFOBK127RXDgBIMhuVyI8IxIu7bP4u+iZCz5GI1XdEzFaIaCwvjgWt7FbjPN13qFNd01eiHeBryfrdbi9USe+wqmZAMN3jV0ROlShhEMQc/ookHjhBrM12L1F9+MIlC2DtDy0wK3X2RBl7kcu8DCH9uA0WcwmGL4V8/lAsmTV6mOhkRHFJckx3O5wJDIiu3GkTiKX8R0WXI0QHvC6CRDzxQdrYEGqyuFg6nDBFWGANdYsgfqlfMIS6gmzhsBl+TqftIxX1r5BTr264it4bsIUyilQ5VTghMKkEZYKdZviVV1v6LDUvOKpGPPeBCzM5fluoWhyAER94mBPnHFHzMes0MtjKGcQPVds/k/mGe6TFA7ktGQ8TfG5Rr4nSnvJVn+j096gBw4rK6GKjh/RbqX2T6xklQ8RNuc4K+Ar0MlOF4lNMh9FF/cD4SqATllInEf3ufFNUhdAmwkd1HWe45pP3509y8CMTEz8UvZlxqtriuQIvepo447I2QX9zYecdeFBycJy9YhVACFBjHAplQ/IHMOYTssImqZmGAsQDw/Z2ojIpjccDeqOlYtQwvlhAy+3NDm6ggTy30OHON4cXqOyo37Y6Cl+AxMtqbSN6Tt1AS9rE+ilwaFMvG0ELLe7NvYZROtvlVM2pKGmttwSimUNv84j+xM9s+13tlyfbj7p/vlzR81BsjvxrMPAnoJfA2P71b6Ly3nZLHTPCE0mOsNJACAuwYRkbggU+oa+2PiR8Nvj5e0G2egePSL+OMeMUhwjkasN/UpQaRdAgMxW2wiR5oxVZlR75JKx2C+WrTNu5N7lLUBSCe0rV3E1XIIoDfj78o/uFIoAidyEX0jQOGmVrmPD/+mrl3nwBv5Wh53Sp3sFjnKBATTG+v9FPF8x1glaaxxAi0jGpZ0G56LO50BOaGcID1laygxkGbuKRGJWDLKhW4ycFxh7ditgc42T+Di+QPMXkNEs5Vr82PU4MlvE6EQLj0PqESeFUX+XncI/ZzlUfaWKcEiUm/V1OHRvs2pf7Lmx4ucRKD1v45lJlwOacEa4kBaE+rEFaM7kwnNsNY+xhUZAbhNpEwJY1ZJhBKiSwHJ4zQfKkYovS4L450aAGTYse333dZo86JSRGYQUaQjTrevXhiIff+s8RS01M3ONZMpeW1Krt75wZgRLsmQA97+IT5+79a3HifKQVNdkUnPfvUBTO65zSUzx7/GfX5wSFB0fveRBqeovBC7NjdXX7wgy2h04qWaNNzQwVsSYsNM6hjbLl1MUR6GqBvMNmIK5IpquA4diiV4k76FnRez+cZQH19DvVaJJ8o67UpELjyb0TMj9gnw7+4w8NI57JIMA9BqNXj/+fWP5u7597/O2HRze9YCcXKMqi1DsQT083LpthLTr9rf+wfcQkdJWL1BjEV6MTU/KEQI23RkcpamTI4ljNBBpod6XpoknfgBoRmYZNK3+nRWexYBssiiuqG0deBt82BUb1OxIMpe4BSG+CXxxd7YjZMNHLBKGc6nF8Ch3cdatr8l48jV3rLpEUfVUNBrXccZVH6Z7SUzktVInO1Fwz/+dtSzWf5HoLqhQFszkn3YzKGGIwZELX6L0QlWUei1OzRXW2M9AzePgelpupbuPTR8gvmFJlZWGFsyg7Hkpqi3O8gQQnbUd8NEh0T4KTYV7lPTpniiriqkvETfm/47Mi4R95DoMerAygwNeKlsPi4pYZOPUBEnz8O4PREBx85DIDzagVnRQx6042z6S+mH9yRkZQst/vhbiQa1A78Nh4cRig3TSjoREGVJHy4jniHtwG7nqictL17R+90e5Ao44UCy4KlGlxq7j7G9kFt5N4qmm31Kk87+Aq0nxcqi13Fa1IgBQbU/1gOk0gKJ1JWoCPBSwQxHphnHAMv2PNyAS0T9fclSaAyoE8qSRqmzQGGLQaTs2TQFOZpfjJE1YHdsaNMLs4xjT6oqgKbYGdjzDzW2z1emmS4q4huEiiuxhCk1bRZnPPGGMHPK4oIAwQ89N1ci4IQqjBpnC1hdn4A/dGQJvYxN2Jwa8j+OWoly5o6tJpincidEDLEY2xzhO6JMUf8hHuWx3C6iJ3/J6lPPwAfq+yruEfd6180EIhkJwjJYTu+KafefhRmt+pfDBBR5CQv/aCNilY7uk8HnULrKFgxyx3k29DHg1SvEOwRJi7YVp2l2i7VhwVZFxZvMqbKqWBwzBP2ndayZJCchvWM+gtlTW1PoBwk2RiZUSIUhwLrR1JsHonrZm+ylIiPbH6lRUUvkw+fPMgH9iBstlQpM7llY9VZkJ9RcmkbMlVFpNAZREK+a/81VEHSxWhAm0sI= + ca.pem: AgAb5rqhjHsWucqv0KdY6xGs58u2CdeIhGeLSumbPDOoQ8fhUt28figTJ1xQhqIybeL1vPuw8xSLFrHgn3vCNFMxdeEUvyl5CkwtQlXYoQWkueQjAQWFX5eJVbi74rXnCImO3ZcziXOBlw2FmA5BBQmszyTmMc9r/TmytZPsUjEpQGAtoHNhLTbQSImTY08Ih0rraEHMOJiYtPT6OpnPQ3us4az7QExPJ8kt301MFYWLDq8JIrB2yiP30dL/tGOIPrscjKd63K9Gy472P+UPWoEXETp8fZUzPOASpMZIpuqJ+lSeA62j80mIvFDG7XciE1Re/fv78zfJN//wpO/jQSUuYW8aKZCAuRTLwEJsfeeimoW4fr7Ab4CL6oZ9KNUlyh03VtFA1lqIAPllSgZlttRJ35rorHEY+92jT3xvsFBXaaHdsr+U/BAEBUc2v8NS0h2MNrnqtNdM7LuzzWY5/cAUBxpF8LKB01Ro9Ty7ldLeU5bsrieN0Xnlc2JQ3zek1EKN3r/yYt/3xO+OlG3tnMUiZHkdjJeQYg9Dgj1r6hkwyT0iE2jHlxLxzMWGAenplsp1f7RjAeZnVH97+bk89oGXGXsmOvx/mBEHyJQQrYAXIVdpPZYfDBpR/evCh1Ve6iz0tUv1Ywu9rWNoBXYlpO+lzlQvZeYroqZog6Yza8hD973pYNAOXuBt8hTiYIh/bkRbZPiNMrCapQv/T1itIarc3c8gx7CpPSGeBWB6nbc/vzzqk/9Y3zn0jA7JqZwy2Ucqcn6QFkoqzXWKO42zLoUiDyXdQ58kZNE3MevqY7vCxOobiamcyfcbBzQEoxj5Jye6xtB0D4F+AN62mC0TbxCBdlU7k16ii4aMwoDY2WS85b9Fy4Bviimo/d/3eBrkb3/klsvGW0ABjwh2C8eniLBIoByJAD9ZEkbvOCzRr3zkv1zKk63T2hvY9T171hJRvLEKTRi5ISMFXyifxomPgomuxUy7i6GqccUhG0mifq+N0ek5WUUvGJHEKmZS9Y/aXCtwegoaOKhjZ3jMfIUd4AcdMhVak1u9WePV2T4L4TO4lWBscrRdcDkOovPTTBThqXNeeiOBQSCMqG0GU8n3O0BrOBVa0lEi8bieFkompRNVnnv/j6ikCxqvj/ZdIEE9i67ESXg3Nqgyp+3g/PA4bX8l/fvAZWuvE4HX6kuShPoOQzqMrGNvLSb2IQFFL/L3m+3Jl2zjd32nQqm4Xsw4mT2hb0We9c8et1ZvXzwnrYK3Cs3N+rPFX17/pK6kGfqVcNjHE0LelLXH29NxXy44tKR+jTDlYXqJMG4j+3uXyYn4ajkrbVhz87kO8qNMQuel+WW++UQ6oPB8ylakM3PtLl4Gpxex1kJs5ZKNRbwy/tip9phDr4x5vtLyfmr4smVUF5oGt3qBdc4q+XDhF9CWVtBOEPHboEBp3L19DYhHV0sHA4aQEYHzm56lousju6ua6TlEVE4NABnTclpa3k3nUDdAA/5vy8nm+4il/gbyNWNySeB/lxoszVC7Mo0mIa1Oqaq1PxVMyTzgBAeGDe3auTEPGuOGG9NAhgQoa8SD31G7FHAwa1G5/mkW0cYwzYy5c50FjfHDgQiNGtgweEL9pJnWAz9uPE9TDGIqgF1v2Ax+eBdpWdoTodI9k8YhC5Im0gahPo/3qZKjPyCKoZL66hGN+rTTNUHR1Wo98QRA5MvXAIRGetYW2m5XicHw3qJnjbM463XKT74s7esie3f+T6WjUl0bW8KXisM3p5ScZMMAbc32cdhc42fhJ2Pok/7psYAXn9WSL6pKWhUIRfKlOhWkoqKdBSd4DiL6P+2IXRUD28gc7aLk6btJ/uTPVG/z0YUeXAjqy2VHNJ5UYQiRg6RRCyvVrTgTd5W1wrQrmld1FBviE7oDzhDc/DMH1eu2/wFELkqMMwuOci8JGNCA+FYeOOXE0CJdq+IY7JtUZhbuvnMXDGDgc320t0ynf9krZT/RjQxyoJZ2+u8/gs8oi/qcPOQkm2HPk+dwpAgRNf8jG0ynNJtIU9ZbSMuM5bDQBvHtIBxZhPIWUAC+PbrFDhzU33I1SZt8gMlleJEM6ALWpIQckbPd0ZhzKesUFrX5MtKWJVIZdYSXvkpyresukw4UZIQ4SfckGAI/AjgHzfPqVPcpYQAJO0Avr2TCOR3OBTVgUGhzW4DLDyn5BAEcEIaApq3pked5kTSInXBE27JMzEWaToP+ITgf/N5/Oh6UBONAf2yMR7hgQP2kAYiWW20WmYmgP4Aiwl5La/WNPqirhNMFhgKcXjexAd5qq9C276C8DdDB3bX4TEBaYiZZFpVZd5ANR5jSTlEpAClnUJEGZ1r09RjPzFkgS6l5vvh3cWeNk/vL80XCBHOnsSs+qulm9CVamTKGk6ZxQ1hb/sWkXHZfovLabRk7PsV/4fptgtaB7u31Qkp2Oq2dtosn7sIX8eRX3FabOTAw8I3fpOCPprELJvtF7YgBuXB2LCjQbZduDdhEi1nA30QeRJLDY/tOaYENYN74KLKGn9E+qMuvxn/bMnmofd6Sxh4IuDRL3Ub+l7xgbFkHzRmxnNqFsbSS3lOzUIjhebDvaZaLKsvZlddsQe5UhacMYOUzDFx0RZfEc4Uoo92s8dzJ4pUv3dYvMeLOc7GnuwN1KeBmAKIkkMVO3OLdshOAYpvWnbwrZ3oPJFHikwyzcqZ+IMBZkeUr0CtppW4/ABk9ziO1Vidoi25cD5KRfzItOUAg3tPBf9ZcF1MsjJLMFbh2KSEfa9r/g4UKNa4Z8OT2bqBWcRXIpzoeDvH4wUnX2XTmrIgG/vESMs532PmnPT8PpC2EtXvHEkNFljuL+WW8+NwWDT1JGKHH7z8aOoi6lZIsChvlaF/8mvWPbyFh7x5FSiJW1qMbfPjS1JzR1QmO0h53+K9r4wo4/BZwCOkFpQ2cm+xddVr3P/OT9WG6R7J8XjwTdeZCNHxC8/gT/fHPWMQJV/eBlqCwluyc5uzvtY3Fm5zaRsm03wmLQXAt9mHGVrkqCM3BQ1H34/QwiHvBX7EbRIpkuAhCHmeBRvvNX7l1ZCX5AMMXxKW7C0BPChrJojolxbKWb3vjqjUkjv1zA+kH2RflQ5QCoAUVNJhp3KNPfWyLMgG4tcjiOjYK4b+ZmpXH6wB0V8Qp+YbcUE7GfZ64ZOtDn8tYEvJu8Jx/yJnF16Rmu/uZ4B6NwakSUQropL5KX+tj9q/0NwACsrzj7HGY2kIo3GfA3+0yM4uBIxIVLbDloo9GOORuPr0Z9Ht/31N+ZLsHmYu843RJkAKQxkMaUSc9B0XTwyRwdFRwfzWX5mK8UbVXqoDDz864fy1jr7v4lQ9+FTpndxjMyeISAwJQm+lnGJ1UuomLr4915IZZ4ZOZBRGpFbrBegqV+/92A3B6sEsHGhgM6uSJfjA3/PhDzzips4Tvk9CIP2rB1xhnUeno7I9NKj8hgN84GwwxOLB9ijjz3xDrJBjBp/X0hZdfTVYrted9ZAFUwGjHLyxumhCQEXXNz/ha3NaJTHtvtc2mFPMSkesotepuJDaqEnhyoJTPik8lKbyU1tM23FN/Kkv22LhupK6fWNy+mYGMmj23zGb7F83zcGs5pTIGJkMydEVKcgFjpQPMaafoqBK2wvnv9od2t2+I+OpGSQrxBJ+hvW6c1sXCxohexcfXErQUqws52kZhE2H/mZo3VsQl/RqktiIx49O5esl4h0PGYCX6BjVl44T9ETAM4sou9swzJQlepAhBPRUqLxdMqgMNRsNQIYOC6JHZf+mFqdBU1FH/wMvMwI9huF9DjwIvEa21fxSvCkCHCyxLq5zanakPpTyNF/EZs1IvpVCcmkqsDDciRLb8ubw5bO9m2HLrkVn6em4p3rInkbGwFRXzwY3obImKx84u4vZP9fNrZo88lhMXveJYR89ZJPFJPK755wdI6W8EwUQcW7k9A7o7i9/RRP4PzpHiYQKRTk94eYdFeZj1ISrVG3GLKCCGFzgutst8ip3VfDm0JF2pfT1UTfKmXL+tikqOtvEnEIaoTQ95EaGD47Eno9JS0OJ/X57/d3DelxXz+FkYsDcnfGoBsfwK2yaYXVcaoXxle+yWk4wrOGDlzTjT8kHyVt+RbW9kRyf/fFTs8E6EKe/ovxxTdS0IpMcE9HoTOEKKykrS0pBYnH9h97r4ewPwc+tMBbZZ0qzBW6MziekmlhOUZ644dNZt/FCHElhviGK5wVUOG1wM+zB/L1fuBwIFKYSVzkgdA5yAWfCqdmigk764W+1pmxMshJe1kZT9roqjdV79OJfktvzW4dEslRc1ZmzQbvV9CEFZyQQ4OIx/ykPyA2D3knj21W4UGDkajf1DXbNZZoD7XQ3DMl8T5xaeKyl8cOXS01QWpqBH2DNQf2q4kIzOq2PhtM2sZrmNYxNxUfPEI6qzAdcIbWqA4BRFCMhzQQ+I2f/SIaLVDQpkNCZxY48g6WKgAx78Hn6zEKgBTByBQ5gLwcuk6NfyvVFICE+kVqVqGUe5LSno2Uzn0HGww7NOj7XrbvWqWdeX9gtujCnCep/CJptbjfc7kZobqnu8Uc2bTnpXXOXAZFELIKZshxa+rKHyURKXf+jYg9LPM+xVev5uf0uBIdI5Xjg0NtH6gtyCpZnY44o7DgGQW3gg8mF/NJ3JFm5BeNIIIF8eyU80BR0GlCAI/fdmxLXJsmK+0Jodjhu7c4UAyEDg3J7H+G3q16nqzi7fjQl2AjneMOyqp7vKaduNSetkLjUsqYFZXCQ3/TsF+dAZPLzJD+XcLeUXUYQZhL9VkrQM9CPgDqPc7TN8bL1T6xrJi8F33GMyRXlXdVmT4YQYl/WcsCuLEU4Cq1RJWyKwbUkdjkZCS/S5xuhAiuy7wfChKNwJcC4ejNmZewlgUAVE3O0ubKgzk6Lv6kRHjtD8udFILr0CFI8G6TELxbBD9T5u1v0yyTIj13teelv1Css6QJmpW3LDj81kgSz5Q/BEHc9HnKotfy1ssUgeiUkNukuLI4c//4r1XyRass3G2tR/7R4FDXTQyQNRjiZRCwFD3uR/AfK4HJcrHPMXFHzudOxV9tw3Qf3/hBkuWxwMLa8ScuggoXZ0xOSXA2ch4nOJOtpECDBrIEZJ+CecIMEGEMM0SajomNjnyI7vpwrovbpbAZdoYWOQWKG12GSsVGQS0pxuq3hBSLMCgXN7rZHfMJMuKph+I0kdHK5uhjxZfIfUw6K4CW56BlNvz1pmtibbIhGaHVLYrZqJsOHdAIpx9NFKFlZDJdutunE0zd9e1opUd+PZpDAazGNOfCssU0Q3xer5IiolKavNRsR7VG4yznF65x3XKDEvbwYwnr2G84Hs/2rRNnRu55kjdKUPivV5tlxG+L19SkfMQbviGmjKTcuGpFkotH65J71uwjkCxtaaRj3omdKyK4ix3TC+Qbc9NG/hgexCSVDYjjzmmD1BVGqXtYaz/juKNMze61bvFeVTCJxXK0ZAoa1weGNleeCQZBuFU3KKXFGczdvCcXGMN4CQJFHnIY4h+SnBH1SjuifDpvTbVrXmPrfOw7G9Kt4oWn2ej2dNTI5hAi2XHUJUiYYpCO4TkRSdwsg7dDz75s2FnFjX9maklhnMcMj+9kllyARGsE568fVl3MEac4awY6f6Nadb77cXFktASmZEak6UYKkEJO3zKFEWgE4bbyuECF33hE0Ff5wj6TShaovxKvmNwg7iurBM/E4wEwt9Ftnpn+BdEA8LmERUVSvFX7Wb60kJOAkdTHlvRvQdfZc+WXrDR38LMflM3AaRFjZ9UHj0xITP3FF2gml4/PdXGS4W7RAGuzRVkv701F0EKQJ++pbWEU6wz/on66xts3e6bFdD7z4dwP8+1333b/z3rBcUD5Qu0kyYOhZB51mPhWwdfg5vA9sQn8fyEwfz+cbo2mz7vfxjxr9pMyENGNxU3XWucEA/3gPkhplHSo4OoacA33meJgY3C0oHS+pwIkuAE8wtmbI6dY44zSS/Fw5DTkaUHGzJ+8vmUB3NwjYgkuPeMEnUrtyXWloa3SYbtlc3UrcYshaspvBeHaG5US3myUXo82J0IAVV8zMgNYqvfQNzlULFFs3yXKF96I111Zpm6J9b1wr1SUm/3/5T/L2OQqqk9KZAyrBZ/swlbBsGkoJJLRRuoTmkwZIGVNBFSl+yDI2JhgdeW3hPSJ7AfG2CPW7etbjkUVbbGLE6q/TZ/A9vM1cGIQ6YyClGz1gAvjYzuKC2A61g07TWrFI5fzffMQNJPnVkBYRQr4f4Z+DhpMXYBcfNKZCVcku9xtaaddbIEXlo+V9qsnJOxUkr9TqLfgcEZsJZUlqHFeIDq8pJVub9OKZnNW79bDz2L+yOSiHT/iuInZJJrxaT0MFbPt2IxBfNGN8XAffaTz+tJR6DEhZIuKpmjKzZEm9rrvhpbhy/aHNcyiKzGF8RIXEjJGBiJex0hC94ITL3TNWdsQN7LI/juj58mikpoV7LPQm3505oRO11kMI4m/TLIqH3W0Q959+peAiSj2JdOV8t3CaYOWTMwBqFuMdlH4q/aO5cqKzZ7+gNGzB0nZnkrh5ugmwvzODMmK6RTxhojJSAu3LNeuDNOzjsPXQjFPlk8B0k3pNKPmsoIXLk9YHy7e0gAMGvO+e/RUJvwC5YddRQonL70qzSUnjSvV0Xd7HtV11/DplaCSido1xTuv/oQn28kjhqQkalJBISkzhGYk2bK1/EW8hWHS9hADcDWs2Mf1SyyobNUC2I3CvagUjQokegVjloxbD1/2NWN82WEHsL6Sleh66iMyqyjoS/a+HJ5fflsqkAGdYG6eLP50sM8C+/mlMuNsLgevAs7WnpjwkVvpCFsXWL3LpOx/MOukjKJRQEJtvmHpZWyy4As4PCZbjQqIILArxA89VKnAcaH/yziN/PmWKZVuv5Puqkdg+lhwBGO3sAg4QM8s7m1MRUotUDZ4AaBRXo+cnQwt0MErE670QkecsM3RBmQ9qCyQqxnNS+0QrLAZBX2O4xo7EHPlaTHfn/x5+22txlivTGkTWk9Km0PeVxhKEAMyCpx4gOtVkoo94PUWtL6UJ/K8sZyAwfzC1nRmAQiT8HDvQX1iXlGtFf3lZYFZSuR9i3XKa38J3zzFdFQl6/evp9t84tyMvknStyFwQmUc9M9ilceAJlU6AfajdaWI5t9dRJtM1B74JuKKGpsrfOP/Oh1XK+CDa0lMzwlvKCaiFq6n+260KbvjHzsQWkMix/RLYIIVuafqxTZQNqy9X+Awtzqyk/t7CV49Q30K5eEkAedP3HJ90zkyjCKmk8bQrQjJeD3tss76LfNXYpXHGXe6kVE76nfFuoitfmQRHcuOwZ+DPQjbba3WTC+ApGCOazUo05MptlzZoX7JIZ14YaRrjJRa3ihcmAAaoBx+ey6HTs0X3HCIiQlupvB8Y/uQ6nR2rEtrzwTvHaFzzjiPSbgy1sF6VTODs3FCmE4akmAn50wLGb21Q+QG6WvRWmYz+otHTHfvGrnCNJeJuXejfA+fz38WcMBQkb4LkVShky9NXf2IkkvAmaDNeUt3jh6HAQNWYk6ycN+ac8I6OcjeNgI7RvI1drXqKF9vaYdFffE4xodTlMweu5djYjGJ3XgzebDRwRHQc+KXIFEnKauPweM6PufgsZyc3TcheH/eJ6bij6bHyVksSD9/GXzTb8smtxp187yDm0+47Or1Oxql6+OFpFhkp4QxasRdgifwPHBaKB0nTadG1RhRq3FUMHawVL9h2KBTy5lZtV32EbtYw0MC4/Qvlc5lcaruMz8BtPA1OkR/GEu4ZkCowtnfVCCwhZnibfv0UtcaKBalQSDxCEyiMJlL5woDudXU9iN7bHM5rbDJheit6ywcbJaOjjX2RdbdAcC3erA3nptBp5ISCWVnPlQ5b+8KQiH8TRaOIbLnMfuZoDAZixt94UV0QpOZhF4Mb9wh74zYcCWqPIHqaah7wf+tlh+j4WCDOPlFThdMe/DBIsWO6uCpYx0Pc+19Sd4bbYz/2dVjnnBseMOgqyjOSNn0Ls8GXNb6Tt/kugCt3YdiHK+JYlWAeAnUEro2/WdfYAdCe19N4vhaM9FO6A+qyMIQPfRzHzZPftPnUsTXtwYL91UmiQEQnh2SE6N5+eFEG/fdivOFp/rXHezml86xLtjh/yKzQs6KdYsaKYDpO1NDwLvdfJKLaUaq+c0hAn/gUIZ0N8qXSyNtSZLFyEgzewOAXU9secnTBHyjwvqAkp4Bi/s3anT3Znvn9dgD/5NJyroCeJS8GirYY42A+YcH//nFock+cd5rm29TiV+btd3feknMqEHq2n3eg08mvhODfKAzWqmQppGgo8lfHZH7PigppQu0IXpdWOarcNZUMcmyDwkIAIt8S8tPYIAGtMCdhB7jIicFTV9eOW/AMdjz4ayvM286pNIi/eJDcbU8huNt21/KAvQgq4QhCXPxH6ehgk2hLLoll2oLggV2r21VDUhtbn/2/A06PhWxcZVPIOSR9x09BmBCkC8smHc1uVykxm/INVmcoynT/hPImZP77XG3JU9nB2AvzZXYJyVstWHAyHect/Pti1JfAkBSxeFC6cwuhhxMEvVAp7gcsUrZk8+aOwDvnbx07JRBhuAoPkfashyWDt53o0SZSejpkZYnzWCzl5x1hA4VyxNpLG0hj/RBZ76XiNVRWqeoP/mHJNd1OUrapRHObd4pknNbE68G7Ij9VGPwRmDRFlqGAxWB5z1/eSb98LB3DqcQikseGlTgGsnePFul9NyRyYHvk/EiaY5r43LTrrXOfEzyS9JZDoKuW2Z6lUlYBkUyc88YLeNKrfl14wW0WsXGGHqSAvlwNHIHp8lQfo0DL3KxT0JnNsUoCoePokoK1Uw2xgPlRDaaQjuj3DrFWMHzT13UQcLJSgh26Lz0/XGjfkuj+UnrsGsBd/Vu+NO9Wrwso9Nfs46F/60rbXa1ctLC0zMMf8v6sDZjlBUj2ps1FgxglUy2X0wC4y4+FObt8yK77OIjRTuhVAQUff7d9MwaHcABT1umJ1j4HSA3kjrJT+8GoHvtI79zEYGT3Gm8Z7DlErGTd76VLoUbVa12uL8Rtv82yGQXajs7XYomdfRWcvInzhWU2GR5iSVsbDsAVZkkztVPlAiLd/Fr9wEwuKQPa0HDGWR8f6QOzDbP6rLaXatEWjHwz5A133xnSNFwJcSCYlJvndlhGLMWd/FmWx0vKJK7XF3T0LuXxXR7+pGZsb/3C9zSfCIrcTt96+lavCf3q9KT9Lp0cpCrrhG7cSuLwd0PhgxaH1TdxtN/AKzOfWGRBUPYvZ2lJ2ngBswoBKdUDoN3pJiT/LcmMkUIeynTOqw6qQHPGsc24VwTFI+4UtDndo7BJ2bwZypwL9fsu+VedLAJZTn7z9dLiXEMssew9Sbv3oMFoCuNw6qF3LZB5dOp8FJKE+9o9l4eZDlc5y9cBhjre/JWSlVmv9h0F1P+DkLNBa7EC93IZ07LTTPXaWoOggMEn1oglLWjxz39ZPCjmcntT2crwCZw4WmBJ2WsMHXweOYUmOZFdAYbGkv4avdmyXhPQ04h5M/JLaefkcRCkm21FOemJK4WoDXbIQdcMWPZCjtJeT9v7MZmXowYedDy0ehih9K7Mj1PUMZKMdrxG62bVMzBU0Vy8LmAMzzfI6jaYjZylObjOFdY1pdqWTrKjg3CFwHEIYtA3rFktWYDE6gFW7g589RqyRjHMs8/yvY3T1vraHEyz/E0G7YdzHRmvt/d4xe/NcmxnaqeuerUwlUTzdJRd0NukjuuMvD8Cu3FGE0A3OP07A39/m9hkBuw/pe7HO5s3FJur+m9TX5GDoVROkiGl2RgX+64yPK4JtAGvlJlq5gf7XydjPtXXfqfwOCfOLZu8NKdJOqcdoYZ61SbXWnxOrfbnXO0b10OG1gAXhPzTnibTzBrV33nfKyQ0yrogiAwf900pJUMm9jEuAiMvnCPw0ngIv+hKUqWIzicnVjuuprS+H7uNCUXskelWQOLhzDmpo4YELgiIh+iQbqwJ+/qrbkC1ichdSeQeGWAUjnB9/9kPyEjKBwhPqsNTc8uPNp7fn7V4ChCcIjZ+/hO+hBgFNS3SN5iEg3QeuCRG9pPaGSGt9lOWr0ziDrkAXUf1JZKZ9REZ4e1obuUgYt8Yf3q4jrHCnQkm2f16RuT4xi8dueeD01zjRRCUi3DGMzywZB0c3sak+TKnvjim/02oocUHXXm07DBQt+tHfMviRplD79Rn4TMEWkuFd4/lygyZIiMHUXZ+Z7M8f5bRpn10YaGnmHqipjY1pTftsnnVy6bux6bU/u/N872c2sYpzJinyPAaTQl7I3A7bhRzhvzHncaTlbhxzBU0eC/D5PxiPEMN7sLvAunyv9fbt86foKIrjNSExqT0GgftNSPDnrLgGHfx2NrEsc/VvJu23L58DWgZP/JVfYGB1FFKT2D/temzoAHCVMhW1w7sVWXo/vxDbviQMbMNxpjfhA9cBPFK+ar1cS5Y7GVII5GEbSN09G6V7n5W6MdqGoTC2C1kmCAzEV7IlFtqdB1+Q3JOOYj39Z9JnqXS55p/oQKI0O/2GZPBHIP1vWklX2v2cWpafij8t8Hl+XjoNI/Pe+rUSM1p97/N04FQyRauZv5E8Qaa2uvxpbclwlS+2ev3BtPhp4LEn8pe38PvGsTEugiIk3576kiWWS71YwwZ8uG91YLKK6mOR63bGgBcLgBsx3cfJYigvTWpXlVI8fMgZqccbbm78l5og/nJqBcxCsvzc1YpWqEQ7eDEsj/Yv1B4AUqs3+Co8JuRwQ+bpbnBI6SWwKXNczzXh2pluosYHUys9InIaKT320sIBy86pPvUwz4qeBu6I42+NRS5wyY5bU4wk0vdYtSe+cftcvwnWt77jN6je56oSPXeummgT78qs0ERnUDZOjJ842LLuWqyDot72Mx77x7lIjSOm+e5kyqQZAnUVVGOq91FGoboW85OOcIESVwLcCo+BvDv/g5SwnulcH+JC2p+2KDnGvQtKXCwlWXaIPx95HxrKeO8NwM0LtpeYtCrR8lx/HY1H4i0X/B4Wu5IjY9iviQTU9pcWuzVndebDLyf0AjHyK/xVIOOJcKIgkvA5ob0ji2A2qmdwD3ojRw/IktOFoNdAR41WEtdPKIiF9aBlKzc0o6LcPsW0rdSbJoXE82L/ql7PQKWYo52Zt6ccV3h/tNKQu23w2cWdo6K8m1b+l9SZHJeKjW/DILyV5IoeQWZQSDz8XcdU0tpIoYntiag2lkS0ZyzY+mc/Cneiu1pJwizXbRo6ElnID3tLGLQrkPYpddVU5f0waL6oUcsZs0hkPREVziDj4mGjNVhA1KyOOATX+gof0Pc8+r9gN5N3qCSQtZSW4lFO4XzfNbAhxjaeDvVtl8uWImcoaA2iC7Vb+r8cePjyo/gUq8jMa07q5+aogMigMeFEfm3EIHX/10PMVYyoVzG0WrU2A5yet46/rUbgjrz32n3IL15dlHtuDj6DIYPK52bwoXNm2CiZKU5ZmGfXsZaAFq6vsCpv1G+TWk6dZ6lYIVLYxUy+YRmpob7W1auYhOvRbUNx+SivEpnqz8hlei9XSjqDf71A67Ej2b+UTE3zK9Q3HNZBAeCUY++JFP64/g15ORx5oUF99eYIdOIFoChZt22hgTxFxMgENDmKOsO9qKDW/JN/zG8IyokQzg0C5Jxht5ndf8qNfyetaP5kRKkOUXbWQCLe/EGUiBsGjiE9MFltRCNGU51UwyiDE6nY+fPsPlu1ZmI48nGFPLle3VGIRBSa8a2TzPW5mDlGOaQOEWhlfsk14/SY5QZR220VAky38I1rLDe/pe98/XHewcuXxXYZuG22k+YTDn06pRcoPC5IF3JX0FWLce4DA35B3zY9SzOgRxv4vWShB9SOhGe3xRxpkHg52xFa8PwUFBuRBWWWreJn4POnHaPJ4BOCI+WkblURfgG92uAWGfnAdVVEiN5+VV1DpXYYYHWRYffs12kYBZOrs6gKKfM5Fnhc8J7s6vL99aAatxkhU2yagJYovFvDRQBx4pj5p+VvSi7eMlPpJgG8hrCIRcHcS3Woaghiai5NeO97FNlYFljo9hPZc+EFZJ8QZee1FagLZCkLBiNVAaBIFR3F4McQpMihOLCH//fZc0SZm/aq+kHNkk7BW+3l/U8GphXP9QYMYbaMBAdyaZreK9uN2MNiUbAb2dItbPuLi5ZeoR4EAWnidFVgwifSInC9IV5EGqv3SFy5UW/yTO9djrkwWea8Z1DqN9RQXnacvmjFd7hEr0IyI02b3gV8G7n0LIOG1fV+Ybju+BFJiILOdFysQWzTrhnJPcox/DN6Zm2sh/0YCXclY91SCup34rKzBh0VcrQ01z7zC8srlr94nPwGYhVMwcTnq4UGxRlQEmqI+zJXk/alauh0iiO8uruPT2ijkN5Ej/dIumFVuKHEozDPoNJ2SSwz1CxqmEn41osWOJu2F5RRF3SRy5EL2Upk5+r2JbYTzhELd7lfnEe1Qjmz6QDUqYb+Vp30kJqLUW7BeEwhXvS7MtvNSheoP2auo1uqCwdAbg8rm46FOeMjbrtQgU/KN60kS63Gxp+mZE7Fl+zXzHqqOL7EuLKrrZN7SLAkG9D6NO/TsAIy9nU163DJmw8FEM2wN23A457KgDKKAUvzlERxhObkZ4PZwh4Z/bBqwSBEbxUZET5YHqvhbnl6ogNhDGbz+doe7Twj4EvnhJo3uytjAtqOXse+prjTCOBneYnCul1YeoYPHFecOmJTMiKIBFQKukaysDTgBCvywRqatHOCTxn0dj9XCnPdPydQcBRWdLK4L/OMcY+K4qtqPBSTP5/47cw9Do27WYZB0lKwG72etIOtcdm1vxzug042VgOWssI1ANwx6F+72lO5AKEWW4kHr/lge2rTGQl7CDZ+tFHdEZSrPYKvhOpyF9ivslA67BQoH+iBgoD8kHN+2IkaLuEmfOgr0LLhmp6d+EqvvSgPszBumHq/hrnKNPd/u47mhXm4g9xUrHhcMa4gxYyni1MWh4E6v59w01+gDO2+I1w7E0xyNhoXTJc9WzwjEXn/RPZyc/k9VcW/3z+K0AhfXDB0TdmkL/e20YH1+dtZ080waPPXNxfs4P6TAxIdP5vRK5+z7OaCHH0zXFf0nZD6FBP2YBz6l09Qe2di1c3sUms7lbjarr0Qutn/E2ytY8LvjYYY5uj93Kf6v5mY1KzbLcrSYm4Q6JdEB8EbAF1vfPUV0h8OhomFG5u6UwDtkSuNsZtFW3OXeGvp+39KAR8saCVgoe1NkkL37uQWL6CEfPXACGGi50kugE1K7avcEQIs2in+sqWD8yukVEcawVx5iYljt3XgeyKut97yKSz2V1UX/bZKUoFc3h79r8h++P24F9VPwFBJ+CCuemBst63ar70zYNsrhrM0TPtY2PBsRkdBcp41CaR+EdEvMZbAP7ISi3koTRinMbdct5iEGA5MSkqiB5nRzpqyJyIC+obLHfEBdavVix+XyypTx1jGvuy6JDpFCAU5YgTeZ40ggJ3qWSiwd5Z21LJOGSpNoCRgAGeBWWHThFM/2VsMgJR4qCvxIIfAYxAqqKXpB2vRC4kiU7JBu73RZY5/ywr+eHHkPlkSMxTs7LqbCfP9BRWG9qSPYY7tsEaBDtOr9YFHZ+le1BSQ3p281vByMeKp3QiMmeocFacILMN8l8flZzpssnYUxH8rchcCktTtJXsAzLgGotKwP+vNWtvhTqf0v/nSPZ+5zcYWRKt+GHhu0DVYR97b/ghrMCq4+ocrnQhhk1JLQ7uZKjnjPOZrmg7ZX6F85IC4iHvS6paC1gQzg2A937xU1ldFK71P8irAlb3byelmRg+KBBaG5imNYA6KHBNON1znfKRi0ksUtZtWthSy6UD9UKPYfFKiqzbNCRX7ceIrDX4Tg/wk+t/4uKgj7nK31sN0NFR1F2rIkYqN2ItH2A8nbydTEdc796GasP5JiivUqyBJrOhiCNWDKJUK4FmHUBMowmEFs0ZDQpf48olzn0l/Re0TMRjugpcbH6lNhJ9YpqvGLU3MNnCB9DvbH8oIafDpxK3X+lIJwvV9qu2kNGMGkiYc7QOGN0CwmzhPzAv6k+JEhUw1TkH8m4syx6pujqEA27LdwUAQeYt3L7bbBxR3Wqt2WeoUWhj8k2WcaHgzMzgBOzVGcb7QgHVmTzJ861z3MPzOuWPBPix5qcGz6bvTXnrsiUX1XoeHBjb64iLL8LiQikbR3oKOb/W0zajEY31X8xOpa/+8Kf6gASGha8v1nGurMEBZTp5gnsK5nnoJQSuhk4WGxYGhYnGsyARrEO5yWajktudzWxTPicMrIO2iJIS5M6zmayVXTZdDv3DZSKd66WttoxlumPhwBDChxxTErZCVoZY9kSzX1/4IAcB6+e9vlctssuLTsGZ5DU0nsC9Hu5bkV+dVGczPapLchUrPx7D4cSdjYHmU4ItlXdMmxDwlbj98mJwn3tyzNd3j3qIH1M5pHKH5557x3NBdSRBTrBMxpqfLl6iA0zeGgpBDKdzjQZ0xsojTaBdCK5B8sleMTcRgMFj2+wxYLOEYg37315aPwjSxIt5LI7Q8H3BKKPhBz25EH3JOEqZGS6gSeUdxk7OFVt8Ryj8= template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio-vre/ss_webui-vre-hostcert.yaml b/infrastructure/secrets/rucio-vre/ss_webui-vre-hostcert.yaml index 02903f05..da5b4cfb 100644 --- a/infrastructure/secrets/rucio-vre/ss_webui-vre-hostcert.yaml +++ b/infrastructure/secrets/rucio-vre/ss_webui-vre-hostcert.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - hostcert.pem: AgAAiSaxcEsKadlnTHdRPQcVqs4jvOw+i3nB2XwM0fUQM9j+RODqk8ZMTc0zfvFqHgYl9b5gSr4DwnlHBu+bTSs270gTSYH8SJldCe+3vgnfqZtTc2Pv+uEY6AcXLdbAU8c4QOqsLALHPJji2fL4ebySzdzw6FltWQRABHrNRCQX3nxR9am5EO67MVD/q+ULd75veCH0PY2qqE6f36TR/kek2Jn7bIMENiS3GAAMQK3Y1Q+Jd26+Su8bgugaI4hGwsOkr8PPdSVrJBJM7/ZPhrY1Eute3pIguxCd+Q5K9VKC4aODDGLRMjgjRmN+Q3PT8uwT9Jc7EILly4sd4XSI4GRTZlZ7TwVg757M4Om6vuUv6rIX2wt9SEHzUo6/DLCGoMQ+GsgbfKjUnmN5btXkKl+fuW/e1hBnZWZjAGyYzevW2iHrFOZKL+nwwUFG+tJm1wg61dl1YbvHrdvYvq5tnBmUXmFYIgjHBKo+AUloieYrwbS/ZTHIzGWkn9lH5K3NS/Q0EP19G79fvlsnc+s9rZfpm7uys+24ZDp3F8pXNB0Bk5Cx1C0AKhFV1BzcuQCUlc1CrTyyu2Khr4jrEfqhzYWhd/MSwyAHfKIsXveg8ZZ6mzoZdZO7yQx6E+sr7Yl9VQjH2BX0JI585mHyQXYSSrVKCg15bXpoEbijo8QL38eOENX715f8zKesynmuZtppW8zqOK/iE8RbiyS4RgEXO1KBOKQ4cs7ALFSprIsYryBZlrYrX3V459TxGKnQ6RuclpKTRG9xbtOQ/uXkps2EO9dTqeiEBV6GKxcUd15qQEX4L80ChszO0Wpc5/Ye9hX0rh+K4xNgaxlN8HQjiE5wautF5wzIKGjXnFZzLUo678nV4BVDG6h2dEQDW5JovvkCXrAroPcMnyKGlSxa/aDp56HVfknejHqgD+xHTaMIo9pYqmR0XLTJk2p4I21zgeAIZXdUGr6PDT1pRm9dI02NOdXodgAWaZ78SAFIfCAG5DQKSzURnMl40wQtccPfNU0jGjhHxGosTw80mSDJUkuXhvysEJkgHBd9aKLg5neM7JljaMXwioGTIEW0cr++9e3YcMpLZ03Oa61ea6iLdDoN1YIyP1+3o3aH/RZUcB/2C+GqK6d3XcumJ1aQ/dNoWxDa7T56dNVNEeKPCCWwFq7hbb+iUi39U/bnv05j/cRANtEkT6dXP1oMsEAqb4QrDxXE/lCb7tgD/JdFACiz/E97r2V4rFTQPTM/F1JiPciKXwOCiyVFXW9PJb0gnHrd3j0XOivqwXHlbQoiRQxA4VfvmuGbZjuceS4vg4NKD/bKoufhBqEiTONGcvA9BQ0S79fh3uaDAuDqUH0lgJKQOyH8W/mh+7d9ut7cjHqioiWcIcvAw5g46qMJKG9TPTD9PcCjC1byI2Ye+Hr5FHqIOWN66u83j0wUWjeVrdsZQ4u27gNiBe0Wk/rLpBMVxXlgke1JleL4nZPAZmF5lG/2LQJJZr4fq2UdZ8R3ZnI4lGXNdwHqJipWm+83hkwleAmm38muBAm0yU9IOv/R9E+5FTFWDtQWaeyzM16x+p3Flwv1QAmDde7lEmYS6glQy18oz2fNbLQFVtWdHVI9fzmwBlUExtTOrf6zNGGuyf3rgIu/MxkETINCVnlbK8HZYInhHaCpF4JsGG1oypFvXmaDcGbHqQ2m+GOSyKkWryTNnFDY3+jawGLoe507wrDp0MzmyvfacHQCRfesVyBdR7Acu72kyhxqcMAmdmHmx4CdI4CFMrOcVjHkeX+V86c2KjUiyrrHvkPbsw4WX4CfSBtHZpuoRSbsWrwyof0IEPdR/gSK20Nr2AmaKwxHBfJVuQPwxQhV5i79gbmEBYtyRvZ3iUx5EAsAUae7OkyhdOHfhAmKbsGbndIcpTda2lwHxcwrcBsbfUqHnAlNmodxf8ozJ1cuGP51mW4JRu22y9xAqDfNI9xqVAekHq8V5YV+PMqsQjqn3Ka0hgZ/zvhM6h94eEu6IMuwYcM2wt6Fcqbue8ejDThfu1RGJM0MT4GhtT0xgBA37Ap7E5QmYTEMSgmt8tGicgdHvtNazKjHgZTVlwsSZo4Cdq1Tw5BdiOwCX9Nj7Ym7ESYhKYVQCDABsKPCHHo/R5HSQ0tPz785uJoA/mhvay+poADxSUawh48+eIR/tT9BeyUO1DbzESyPTw5Ku9kFsJeIU7CwsABZv1ExEALjAJKHZuFuQAgFlPvptoJ5tP57ale0bAwjeC8vZOaIaeDpDoQxy38oZIrV3SZwsk5p9GW0T4fda1nRrmMXDGfMI/l7UqXl817TDeOfb4MIecMEpb/YEviLeBH3RE7C8o9ZF524PbKDoMZCuNLCCRXLA8m/EwZB5RyYL+jHcyOt2X1HY0wvBdqC0E4jqC7/CZFgC6UZxPnleXp5Fdxb7MFhm1flla7KaJLFWwRmQS3YuJCqeoGjCP5iRE7MvarPViKK4ExH0ZhwqXvt6mF9nyjhsIUI0HXKGJIiT3fY8OLYRPz/dHx7M3tGBwt4vjlsbu3GwJeJhlva8C8KSVvswDs5LS3yn+i/NA5MNwmd58DnVD03Y9XBzdM0pcBB6u0kuFLAHXGm8syExVg2tvTkr5dgoWU3rt8qEvFbU5Q723oAx43et6TMXuoakAkaf1kRV6FPZVubCBLdXjidb8rDahHzVHTnS5Fo0vVx7M1KnQa1PpxWBnidsRzejvXs1tevAzVZRjpvjE0SjSYv8UgsCMqEwRUJT3k176TXGisxKrsnwgRITMfjhT/qw2F1Oj2/gAAKz9Xzmw+bT2pqZ1xWs7DnjH7fuh3SfjuKngqHfMEptl5eEo2e4iTWKQQzxChZKsvTssPJZ8Eq2+nMrMutLqLg0Uxe3Ks9LQUmw2SB5CwHbRVY0dyVmfB4drtrzAx0UL+OVK+EBccLEXAJzpGW3EHozz+qxGLnoxhrB1QcRcb7SR9FiWOx3Rts4sWob7pPvGsJG/14BCkOs14llU6c2305o4Xd6IGN5TV1mpzOALiINIaQLqQgiVA+aSDZtya+7qV63nY1PjNcr3EHEmCWijzCKkO6UD6SIj7VPrHlFqSjz4JXBfpRMwAeIW00U72PtWsVjlXkoNwNgHePl9lt88x++QM4oXSEMgpw/bSulj9RMrE72Yv3O7Se+QzG8G9ccheVefWNDOASIi7Eq/ciJyadar/ODzvquJRYIzBoHHQatu6Lt6cdxtjDueTFZCKSYB4O/yYjTPSX4Mm8Y6Hq1Xkq8BEAVMLPjIRbws4kRjI4GjSLzMZ8G0GRtZj7woUlBMQ3EGBZ3XrwoquItCQrRK4aLZQcGI9lm7tJ0A7h/DeRKq9zObD2IYXosEtIE+kiF+6vX+1wOdG9yudyeJCPjaUDUkGlWmUW/xZxEpHrbBvp1P8sZzUFDQXJazHTm4EdfqkqVPwLJhCFCiCh9dDEs5nBkR+Bza1NiveX6VNajm/YTXNCmvnwxZcABEG6HCsl7l3ay/uQiq81xzU2Pjw7hIzsc+wrBjlHuYmqogdSzvX0994TPBGnmXBrVnSx9TyfXUeHNGCBBInqwjLoOzRl/hcQhRH6OIOzeCVlU4OTw5ggessws302CNv8uQOB6FKbvogmq5UkxYQxUYvxp1FRhmS3NsPzmWA2HGjJoiRMOPCJfomHDZcrxA9KYb8MplHKmFvAW7VlpguHCcA7kpqVT6G6n9tgfe7ATzTkzpzit2Ec1j2iBsfoIS+GAbqw9W04QDN9/6c6qRDT+eGi7llF2FXHMIpBIyJfoRxQilf54tV6U+QpN9LiNICtOW/8vor4ZB6dSuzbeaw4W4hreAiaOh9X4BW3DODbpTQ714eE7UhQdE26KMbOMnme074QGnpcPu4WjwSKkphghwTOG5mCXSgfNy4D7GZt2uXBgsqgdlibpBJv5EkpyydLzxjYPFswGq1/0zIGrF2/lBTMn+9edFOC+drXNACvDV8KaMDNWIzMaF7AnT68JiQ45hYR6jOfeB6EBmzhjZheIOG9EMqleHbppAV4n8L/jtrjeM6yKCe2xTrbKO+38at9sG5UdURYGMShNj2eVASZU7U7qDcx+62d3RtsEz8qUe6rPIC4R6znqSK7rmO2xhRtOaJxNPFW5pamGJXplOdOjw4vEmtMCpPqF0SHu3sRFjrIV8yoOGG7V2NwKM/aaGAJdwdbzIHD5BJLcP+16uYcNYW/pyZqKlVDMVw7oOg08E329Lvt7YmK/8zDQpWauu8zSA7crtM1o0xweddk4GPy9j/DvbTLlUy/ne6hvbCC760Fw1h+wk5biq8NI4M8BI61+8rtxbCrUNG8kmAfa/eTVJR5BBpWrg3lEEjstDWaRhXQDNi3iB4DeD4iIu56e78Il4lNLXIBhCEutI/g/i0vmPbemR3AcGk9auSB2uYii9yNtiIHr8S2CtgbO1oS17Sldd195KQOrv0ZS7cDQdABmaFUVCfV2lNr/aQY09oTzFPAmUlRMMY3THlI1etdqM61/q4fBtwMS0QMkJYX78h8pctcFFgge/YgBLXc8wryeV8x5XWCcubahTzUbp7VLR5552xhAC+UsRiTZRFcRsdf0ZryruF0Zgzco79kmOg+jQeTDDIE0fDNjSxus2rY3gb7Z5iEXPpZ7vgJYtH+3KoqMmDNHsUU5bMaX18SvLQs8EC78l+1QkxqRyKM9x/t+s7cO2sQMhQ/w96EL0rXxrXdsNyG+3a3QuARCPxiYlX0Ss9W6lkfcA56CcSiRRfSGFj1sz/xj7fEu+ipOf442cyvQhVVW8uGSdRCE6JPwbJXFcm0DQ5q + hostcert.pem: AgCse9CeyW0pcXe5PfULtYWG4gI+3pG4Unz9vtorABHdIStyTIyYB0UB5Xc7X/aRbNjkUMngfFflJMwJha9shHDbbgTfFqyba1Q0DnlRY42i2mxI5pwSKYS67I27mlXl+fLCKrWq18YNL9GV+nROL4cui0s1WCi5VMAaQnEdsheGrkDy2G9KUNv81WwXVkcypDF0IK4apQKf8QpJ+cTOmyvB98xXyg+PGQ20kVJUGyF59aPxqvvIFhX+Hs3dn6le3BNFt8vQHvOScgTn/f5eo2t18YvoKZvS9C0tFgXOXC0o8tg+/pQlA0MG8Y5rG5Ayp40hVfsUXBDcsHkFErB6O+d7PwcFtjPiuuAogWK1uirl51MK6z6INBs7DNyUAaxuDGt4dxGMEng9uprE9GcmC2ttDpOFJQjpeBnsrkVeQAudiNoL7aj29uPajgBz/A2cWyLzq5Og/zHX4tuNMh2Jd0hy3JebMcRh1EHjgOqkzFlLNr3rscHuk5hDkwBFN086RUiFAP4tJgBjkianT3boEQoJ0F/UeVLks37eFP4bbOpN/ka36K3T3RlJZVL+f3suAdOZlU4glpciPJYFrrysDPWwOSTpKWJTzy+0fuB6ZqYeySOxnUscxC0AdxxLAfDTbZmyVsPQII1IalOVhOuHQ5erL0wW0NqqCRtYsaH+veXzDbkIWTHbGTeMgEZyrXSti7GNT0RtD3nJthE7WMmBCEpRa8IcJr0p7b4gG7bT5Oj9UUF9gguL9t1CishcgKAzD5TIrg5u+BVrcRLPuUGbAwZtZmegh/U43Yi6sqRZVNuA4tvC/uXEqZh0oD/JeZkbn9Km+36agFHPKzEeZhh8VX2SJM9LfepZESkQnPDH6eBR4Xc5kkbZ0Di/dPxuHEFLm61ODtWF0ILwn/Sj0Zx3wFOEImgG5Y+L2DSSA7pdEkoP3YHmNQMbe/t2TzUE25LzGbVHfCnYXNOD57MMlmcR4NrKAM/2Qg1WkIz3WmTCxAyAcEGtDxghehS4eXedCp+JUve0PRkLyN3rP3dknsJdgoR8ZoCqeeViwhEEfxuLSZCDUDhWOl/EYU+nj7/u1kwWAp1J4JyXkt9lWZ15+u3gUlwP40F0fG0xIjdMQu1geEt8XrJfin6aqwFTtxPcTjO9MsT9njVIjNHhBYvdRl4UsjGS5AGBYlIeGVi6QMncjdXP4mDNjzytrCC3t11xFOfnjVen5AmF5xK8SVpw78lWmV+QXHyjp2lAoAtuWgBbv3wQcRSYuiXs19EbH6rqLa7MVSwfwmTq6RH1s/+PbeYMgxnWyo4IbZY+HAfb/HgQHAM4AbMuWCoqUAhper7FfnSQyZ2335cDuopzcvyXlII8yeHo8yTmy1diR/SqgpVQslXdo5UjN45Gl0hpRAnwU8TUlNmDNcP3Ga0C+T/cF6gm5X9g7NSDswjznjmZaDD7AzJLb6ubqC7Hj37AXvlxGQpk2ZrkUy/65YuyOn/he19qTsRZg1Y4zGdQKwmpJRtschxlKZsBFlHqSyVg5Wa8IrgIKk17sFOg+sfJmA26YXV/wBeQMDXHxbsGwfsiOcBzt/1kPbrdaB+Pjjx1/wJU/mE/Y1rKXUrWiqbD/67lv7y9ShiHsMr5KRLZeHLbapen2cE0LgQGOuciyvVloumQnVZM/RUWttXiQJLOLEJvPJoFaItxH/iSLAu00cRgK1QMI92JkDpb1aeoAsG+BxBUnnSQg/LWYvXbL0vk7KfVBi8ZQ3w6VAJY1NrPbwkPkz4Nw0PlSmwkJIlBWjBQYhGCTx+vy6b03ORE76bixAtopprTYr7Ha13TXQi1VPVkjyb6ckpovZL+zXW/cpuwMzWl4lBWkA69bjGbQB8YH+X4gElVAyqVoe+rZ0QIig1r8rDwclArCrx7M1NMCzn+NET1MZ64wzosezFSw1E+MWA0NEiL9cahkZPid/QNVvAOSvizEMKPKGWeIFYpAm6aJuXpyuAMmhUxlenBiimWDhgS/zsMyTE2Mt8RbYcXRwUsNW10rnOPQDEvTduZB/5LOp7x0We87n4B1zV6JhKHigr8sK64eTDb5McTlFQiRCoU4Ac0rbgJuZf3lb+s3+DkbpHdjvFYsKMTVddTfpxb1RJfYiJVXo0A2dgurWoKDXnLcxT3KAa6rG0IbKthJ4ZXegfMpyZxKz7KKajDYbVPehBFnsziG0SikYvTN6dfOEIlDSCm/NI9VyKMMq/Fb8Vhgj2eLNb6J71kINDeOdkMjjHBm3FKtjtLjtsBsePgcQyy8hMzuiFnzy6Nsnv6FhEPYbTjDhHeIr/uE1nIXFoKexwhWm4F+/C2XExnNhMLtU84bsl9V3chKn1rgs5nJJ+UHyO0EXzpSI7o2wCiuRPA+C5HTmKzkrCLbUNKcg+u0eE7xpjJ8JhQUYCpghKcaOnVFiQs7ypRfxq8EyL91tgWWH0XaT2IE1zccuSTRgMmh1tfJDsBjexQ3nVzsFDT+OqnHG0ehuNNBo2jCXnnCJ7c+1i+v8CP4CZZU0TCnN7sHSYQEq/h1EMvXZProJ3OAxV3EeVgqxMiBkWsdC/FuVhbPlGnCsexd29bec/cd7baFarhkxnoWGC9w4h3B6HeEG0+OzOfOu+N7gkwswWxcEsiSCrmxWXjD4XGw952hkdL9qvryC+ZY909nza11CPNHkSbL0Y+IhByEZoy0LI99vmWejd+ssvSrAOu2AAOtosQle+2kSlZZI2AOMMuj/YyGtlq/p3mKnrZFXIms7JBF/p5zRzjq0OH3Nc7wqdlWGAhLVV/16eNkTDU7irgWacYC6xoFvuGTiS0TbDbp+jxZA1zRRf5j2JZHZMTIQm8hUmQ2bGleXF2TJQOnGGxnnZVB0wIycArULliGISUVSZzPffP6RNOblfjDiUf8Lc1Ub0FFe7dWH6eLQpLGZIy/WBsGi/JmG9Ck6MVNblZNXB5RCaRshMBoVr3OLJl1kSZxTV2cd7t6w83Oxxu31TXAFjX08O/BXuDBwSvlOZyb9IckRxz/+xqFgSXIrTqcb2DxOgtl7wv2DBwZCWfQCJQe/YZ0FtHfIEBxZ0kYSriYRulcCqRWXLR+3bnFMVEPtMQSXoVadAUQ2WNNl4DrgKU7qvk0Ja99eRjllEDCCuju33IDKL4W2kmhELMZF+H3OKqAPj9VLHkAWzgCpLuEtr/zR3sAfJ0c9Yu51xPSJtPPKXttKCp5MxyYP/+kXu7eQRRgEb3HGgzgH9EsgUZqRC2SUULhETRkyCSNdBPJSD+gDs6goKNYuB2aV5GClUIVQw/iTkOulrgutoW3/Pc42ue7QAX/EZbJf3HTeqOTubEvSU2fk6yBxdCzIvwP7qTyV7GeIwQFYYn7ZhCDpjE7F4i4XMKMgIeLLQuZv/0vzRMo1QHBy2E84Qg8m0zsCR2w6H7ghusysoMC6oRI2A6paJwsFPgcdJji5G19/KgMPw3sdHMamou5+LiT1PWOKkjXmP80aGRQi95vTlaXZ7HuBwYfQ2RY8Ck5s2vemz0pzY0BBRCuyf7kfBMSbO5UeeEEpykXxUQ2DfZ/ni/DWgpVdAI9RighBV0OeSVxdkOyha8bn7iSSWvu9PTtMJGmIZ4T8zA8/38csqnvwzoqAsakrrGFtCUX6Gmi6CXGbICbQ8LPMGG/+NHRpMPmV1imP79e1mbDU2x69pzj2R9Er9wKbwE+mjLtQ0NguFbRKAT7aLqveR5A4aQ19OjRPNnOgQijPuH13+xhQ0z5HCZA4fUzCl7CVT6EfAUwMsII634F2/Aa6UuSQrCj8hv1rCYDut6yG+RjMg/a0QoCNhv4g9q8tg+sRw+iTg6qUJQBuy3ECMM+1jDih2Ha4LOT05j9a0ieFb/GnTNC1sj5lOKLjH5JzjJNN2JIU1p8OAeW5Q7nUGxsKfFflIQm+MhRsPtJX63so5OVCg2oPEH/9vqCim1FMbrVtNPsDR1SuEkvF0WEM2L99EOb6D3fMshiT5Hj5U9QSIduuZsYiGF3uvqKGIwhOfjjmL6fsI3hPI/IxcE9VlFpXeY5KwYlUc4H8/qlrqmbyRW1GTnhQ3RmoiraVB0dOXLFANaKG7bhiGw8TRWBKlzJOwE/vRIk4y8qkaRbyjX8wjkBZhWeBO6TevBXpdfdJWyNvAvWZ1Kl8O8wLPdrNNSyzYwc8A7auAcPtnqv2f6owEtCohl3ErQlO1TEP89DzANjnnYGrwEN5XEY6OJuoa/F3hptqJSwX099LrQQes+QQodYrhwqQT9LBW9dfWCMtBO7ZIjha1zkw5Vu1LjMCeb9PdR4TMibFkMNCqvlDiPqM/AlQfBxEjzhnjw5H7G/QsqN76fWPRIXWKF/mVfeCSrcrK94Rqo7/tE1+RuFMQur5CitBFUpRkIyfIqyi5ZISzG40YXEe7Md5vJNwP9d4ESLFr1jlVkN67PK0+g1AIoh9P17ZmQOwE+44s6eBHe3sDROBL6i7lyrY6b5nv+jhUVJ3EWF7Nmy9oIq2BRRLMKQbCldWqnWjB3rY17syaa6l0UxYbytlYV9X+NOZjIZyYpaAK99QTN+apaGRfktIj/3/YPhJSNb5JXPeKExmBZRitUTIVUJt3Yfra4KmZJ/w+04R484zKsGuzO+dcZkdruUGT/8y6/dG79D9PuMuanlZQyoMLdNqw5IM15WHYyGI+EE1xIcqhOwwUxnJaKXcXSrQhCTaIeASenQrnKc6n3WUQzr36ZWDh0LN2MGeADRIWvSQ3F2cpoHysGCoXB6zZBcsSiOWMPLxSVzksxJNRqLfeXJIb0+nYEIiR+yCRbzufolxEnqyVa template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio-vre/ss_webui-vre-hostkey.yaml b/infrastructure/secrets/rucio-vre/ss_webui-vre-hostkey.yaml index 6824cdea..dec240f9 100644 --- a/infrastructure/secrets/rucio-vre/ss_webui-vre-hostkey.yaml +++ b/infrastructure/secrets/rucio-vre/ss_webui-vre-hostkey.yaml @@ -6,7 +6,7 @@ metadata: namespace: rucio-vre spec: encryptedData: - hostkey.pem: AgCPUFO7/4ImAJyjt2j1pkh02hK1WSfW0BCvdp4sm+HAVlPTExgropApWFJDLdEy+DGxHAhJGBmYZkAVqUZb1Y4oEjTe+qa245ng+xfH7+D6TfpEbQBTghkb9ruf71ikQjnr+i+WH8yYWG4XNsX45XA9Y/mIlI7Kt4+hlBj7uJN+QdpFZRCZD7Sk6oBem3vGmpAsAGa5TNaiMSE9hAslXoOa9BD17u3jYNfKCEatPNMCbI8zufbPd1H6UXXxvfmZ23J9GZ4ZRZJOwjEWFyhERh73T7HbiH1XjYPEFIT3OrgxUYRkiiQugWrFdlJSlUYBcpxWMPi8Eq1uxywamtBFGQqnplr4lXMUhCT3MUsNLnDA+CL+tLzpeWlvQGQRvTkp3lL4/33TWAibQUI9lViY2O2tme3nfBOs/O53xjXnudycStfdStOCe3Yb/4byVo+sfvU9WOMYx1NAygL4TI9KhU/oCPFN/MKjJbAcafepSLXCXi84r8Mj/T6kca8w9iN8Q981oOwLtyLLiX/UuLUoDyKgsWa0SOk6aFoj9dJUq/KrApzfbVYbShwH5YQ15Nspihpz2afwGWG8ZWRbSp4PF38ZxjcAMYadQ/hqsrg4/fqpT3Hz6x1a9aR8qo0UJfUYX53TbBUYJRxvQQ4AYWILkVMn8QuD6ybEuLvF5b5HXxBbad/M2ZNiPFC8PXgv99mhXHMUwCx1NZUedQlbElOQpFvYukbeq97d3RJC1WnZ09WcDgiUQu10iOXaquoGH9IGG+q8HIPAGyBA93zGWjk4E/PYdii6KoRrBNOIaONwSioQ5Sra7d6/99HPlguNfXZBeoWsUhHS8Kv62Ro4gSpNPfOBClfMD6j3padgp4dloHqoinSixKTDY8eFkMz0WBaMa/NpcAPm3zkUk0GbuN8i/+PxPhOY4+Lzuex6WisyuQyan+unGgE6LGZE23aqCpgMHzHFNUgtEcFUO9Le+sNKm0YL5PVNOGmLfagtnZnPS9NK1MwIswa3NKLhlHkTdPRtUn8XPglOE7uWK9KMKfkiGACmEwnW67+SwXZHT5kVu0DU4EFA/Lq8dAx+wBnJecMsP1hXBSazc7nJBj5R0ekFIZG852PKCXvrvWWFJc1l6TU2oyUa1Y/5dY4UBdfF9vClyHcsXq9NLK4izv2Reo+YHuclYAa3lYi/nqLwi6FLbz7s+PKGJfzE9j06tXH4rp16kvq9y6kC2Z/fGIi2k0X6eLE+08A+TdosywWj/KGBUu3nqtvlcoJxBGIc92LaJ5ozCHyo6GlxkxxdCGPhEAnuvIgnHtzBiCdT4o1DLiGpRh/52p+hYCiwgY5En/2rcfA18bWo+JJChmiXqaLsyYnDuKjX4WzUZ83JH+ES53rraR7pzQTTO2QVADZpBBHnltMftXoi06jecouhasfHfSFWcefuevpO2huI8DDaYfEGnj2Y+dNAB1y23c/p93hYXB1sohMxVSxxf+OqKobQgKS2+MSzirwVreMB+tV2C+IIUk7Zq8X0XMCZy/+llg1OQ6clUeW0VrohS/ZpLEgV7+DiCSRjBznc37BinbhFD7OZ4MBhJ4Uv07i5U1o4Nn/03Bi71v9wD5U4PYcW/C8pD/rjBITU5Hdrhc2VMcKClwnwj1OpMBhYSsy7VAXIXN9yJXgiwOlzw8MqbE6/kqcHRnVe63Epr+xS4h1aDejlfjwXz2errNUDSeLDq14Wsd2goFIpfD0gSf71b1S5AiQ2bnBLTp9FDNHPPMpqtt6SgADwtAa/WHIEQR02rzXas04/CI0QzpDkdvWEGhYdc2I9/tSr0vq2FVoy8s2/3LXwIVx4jIfhe8t2zvvycXUjbRZRWrmTlnJNTl+wD+AYE4KImKd/e0aiw6XEJ8NmGyxIQS0P8dmDKVtksgBdDnd3m80jKwPdjKhhVvxuVICcsXqdPYT9T4LodV0kpoIaXnf7KZX/tNCyvGuRoo5iiyxRAwS+TYbR/j3GuNs+GmKU74QBfYv43A20R1giNJYnwkPKrYw+Gyzr7wxw3cWQcfI5V5ZIR8esliydurr1zE5vrvxoM2Fm8e+MziqwcAU8ki2wEYSavIk511iItQTdWWQ+jdmJSH9D9pBOXV7Aw20IzJvhoyTV7CmqK/kBTCfvyKUPkQaCQTQljiideq69XRDVq2Fo/XHtwLtQgcCFa+Zja5BSB6RG7PKC1Y0flynzEI8Vu6Ox0p7z2HgT65nW+P+Yn7QFmgk3ao/8UiOVrtnfzbBCcpey8BLK5rBs539BuoiwpJRt3iCMHwRStmxETy//BHAURigFygiOdF/fcB9uhAJoiOF79XJ13zBBWf+aLBRkwwxlO7WPRGIquetZaALjBDjNiuhUXenRSHgmFFLFD5zuxi8wUT0WwlSgT2nexgeB6A26p0mut2ZWL3j9eDdhmNz051XJr4qrJJLC9W972RERJhh5/h4z09fo595i/8mer/ywCUqcOFXRJ1ha8MNian4uxAVNq3DCVPbeH5F61d4d8d8Ovq7ulWDXGPwSMz+N9bpDqBdKwOoxeQBEaJPuvSFB9fjvEunKTJucPxn+26kLqepKRACNPPYMQGEWqvBkQgMB0rqKNUnvlZ4YTv+57Uq7QIGoEyr/BCNTL0LSzcG5+72o/d+smCHlUKC3EfQTvLuJrGW3racC6jmHQoY6EvJIsOAhguC4FbijE7k47Jp/Xyy88nCFS0rFtOCquAzY2daaU1ZmjYEmD73XAsJPkAX+LwN8/JL84JLLcRs/WTYsosap5sYWs8M5gVEpA0wW3O1Qi8C0VEE7124zKqGJmM0b4hnEXQZYRNjzAfgt1pEgU4vG4LfgKEu3vwwJ47Ag2mBLnM/cyRiKMctfpahCLK+NgrZFCXGF6vgtHVictRRx/ITcjsbY7Kj9wfetWwTqRSYvDq6pcyZfRI6FyTh+JtcC7l3KrnK70Tns71scduSC+k4HdCdYbXrPbagt8wdBQQspyDr58w8G3hrMbRN8BkbeYaOm8Kq9MBNQq+YK2SsO8bAscuWyWDj0hKmUjmKLILAU0wI4fjiluAOsSeFPn4dzkqG2/2NeD7iVV3XRC01lt/5Ia7WOkEnCbBblQCSLI+jZ9EXO4asybSppwCqwa/+XhmOLOzqSxz8d + hostkey.pem: AgBgMSjaRf5McnbCU5YVxRk7J7Na09uXhcGh58eqqnM9OZB8wfyNjUWUyw0QPhWnrim2cMI6a11vsEpS3JkF2SlPShlu+ZSYrJ4a3vz8JOkD/+tICW0jursL0I8HkA42JyTa3QQJkEQZdC7ndlunY+5eu619Zr7bRrR6xHhXFFSEA5QjpS+lqUeuzcPblCSyIQyUz5v/SWjH9t5McS5qp0+EErjPUHYIixsgWDCelD6abWtMM96p51t3+EQx+2OcDGt7vtr8X/2+HOXSRC5RQjQ1UhCkLwglKx383T+eGY5U91nCAQnjuHBa3dy+jkDRWB7hZDtnnJ90w+3o2nkMsax19DTFybNtut6Mi7C26/JH1pSWjQxNTXVZ0589xAc6sIwWRUgRJvG7cS6Qyb90PkkxdXp0ePYCrE99k4+oDQe/KUX4kYMAUiG0/mG3VFzS4wQfmyq1n1Vy8kjRFtTSGoO9tCvcSKODmviFxZV939aF4FWtg6fLeIlboXJc6Y0KBurHG+WJbFaNUnbFr5rz5UV64GpgCocXE6KvnBxAGF7GDEIJuvNMTMjVtxK/rxn7iehi/m0x1Jj8HQ/weepoBusGtjOoYGd+z5vFvX40mBrU/vVKIWO642eyS3CJaseyVHp7m1VwDh8yyUgDhzEF/vBRBRZ9aiBL1paw/Vs8PXkr9bzeAPaE717qlInkuqAVMcRf+4FBEviIygTrtEF/XD7PYa6cXCMA6YJza8llmDx6hRE8y3upWqKOgYH1eQ/ssYpmi2ys+Br4XAkI1D6sZuhpHszK0hgUdQw8RsOnymVA38DaTZTFDLOh03Nlwdt2CyFbZ331HHySUkY4dRvX1lOwyCo4emJCMbUncTphaZQWBP1/mG5it150mikhhlgJ/K86sdtPd572d7fESCzx7OKp4h4yF5UFLrfrFDicwL23/U8z7gj/VQoAY4f678iqn4lyR5z+8dBqjW7pN0kGEbMl5J8YuJDOz5nykVaVR80b4aQ1KSRogwUJZJmeVV/fhUH8DNtWsBkIEuDguvZsG5t4Qa1hksXWm/3/3FUDsqVFxwvzlSP7Mjaoq0CKSnODnuGYDlKEuq3/IDuExikpKXOBe7cOV0plvQS4zKg8XAPj0Akct3znnTTBWReLarBpQSKz4D6T8OOFcR3wI5vVnrdpu4ykh3r+fiQQ3pd8LkLGsmA2i8qzQxK0C7nqCUqJz3X/1qCNttQ7KINrluuhF3KdbATTZUp+ryRs1Zaf4xK9/BHciF+ncE9pxowJ48+mtfsQWHCQmrnQQts8AMc+Xt0QAr+JzQIhYSYEeSdfvWN9ZywvMdDT+mG3+dkH3vzDRtzoIG/WDaKLRpC0JKudJNR2JGmUNvvbK3bqZ20lWWv2NqVLiSB3DjlHbr4i2kY+dUUhurPoWW2Bt3Ql1jMttRGG8MIjRDRKW/9dMyIdkn8glWkDMqqt/V8nWRAJI+RgS0g4pr/+NZKbRN2Fjdrbb0HAXsF4xpmYFoAaOuLLYyrG8nywor5f68PgVO0Qh05uZ9FU69DyI8iVawzKgluqmfOsCvQsMnQaRyy/51NkQaSxxRpkWy5GA5OnRXpysHjLQrcbqerd/z3WxLDGuTlDupVL6+eX4H+5Rc4h5iFfPVwIPhMecxh3D5c0iaPQRVsqO45Lc6/Z5I+cNRDaZTegrYX7pc/3HYP0+U8/qZ+wP0EN1z90lw4ywomISA7RJSzf9SQ/n/mHXqm+TXA5Sz/E+ZtbxN91+tSxAP6ycfvcJE+d9ZrnAj3hui2dlxvzYCqKMhJcj88ySWbS125Wc0KvPyxCM9LD4lO4lR5DlvGmLp93hiZumx/igqOufJOVR43Q6te5DiStCES142rZP5e8f8VGwFxAmd87l+FuhXZ274F1lgu6JCYdfeI0HxCGGAzKF6DZI+AqIi9jL93zpg1Of9YfZgNZ/q2ITuyH4smoRSyTiN1TP2tpsaRym05gpySnuXlnAarkhATgG934WPpNIZWHkAzA9/kW6GwTrnM1dMxHeUeFYiThFGJlNJehCaMz+3KFx2ffHjmf/lsC1ZHGZJRF6NrApWoZamw7pvUbycVsLtFSGjlhqFOBg6rh2sEHy0QdbOu8o8pQM0w2hSH6b/VJsbHKRmucdgLxFjgfxHilre0/xBBMI0WSAkSsxJvxhH+2aNk34xqfx+cE9GAtttJKAvPWmjWSj+ut7NR27ec+Q+oSwdLrXSOf8pwB9G9vbY1BQuudMcjaIe80/R7rXsJRojti+sluJHC6ttu2cyY/ZQyDzKGZw3yNt8HN6FNELwhEC7sbJ3xO3kqLMyxyrdvqtyoyeva3kO67E7CmQganpGjUNCzCLzd7eNEWmYyyNixBaqoX5xkkznSXkWqLZpz/fYM4+ze8VaTN15D2GDNAi8igzj1pgTqEM8vy+aLTh9173CvxytZNSgBTBmCWoiTeJvFq8l1eFMWbVV4NrXEABwxcUjvsfFao1YYK28qM8RHzuiccNHx/Pi0TfjdC0/RJuyD/2PNcoFsj244Qfur7oSdyHXne1hq0Z4vdpha05gQhJZnGNrj6K4j9xn7/XVXwIn46FWRlVdpiK0rHlmnSW/dWXnvswxcDJ5o4j/qYum30wPhJxzkK+6DwodvzcRBWWw2z9UhyMcHXxLLKzJ0ge6f9qAuaAQalWf3Y9+NH4C3kmV5q3QwDGhuiXlx//r4PrxacFMqZ1PT7zXLuYcdlsqfLEbT8xKNm844WegbCAo3+Xs4bjWdL8YsUfF7DDBP6AHXJvwHpspYTWGrcFJ+4m3qRXGpWB4kTNsbgZpghwgK46w8B5RLmrq5hO/T+4n0H0/fZ9oG1KQVMrD5cRbVJLeO0avRJSJIg6V6aRcyykxAj03KJIAjma8fjpMIdYSHrChrj2aJ/rQeXZFVi/bO4EOy9CBBCaGO0/yCSO0w+qaUhZnrpslIfRQk5QbJq8rTgdmMRZlk4xnDkOSUk2Bc4tE+/wAtic4f962cRWkaz//eJt7p3k7oWhbF7iCsZphdfl1anrO+FmhLGdurE8eh6hWZLgvxHmHDn9X0UHWGwzxqnlVOZvsMmub3TbjnSloW/IBBlxsxosXBr/xgt83BuC8wYfGtmkBz0Kdrx7PgrBdJ1dbE9 template: metadata: creationTimestamp: null From 09d00ed5c1913c614759b142c6023e6952403460 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Wed, 24 Jan 2024 12:54:35 +0100 Subject: [PATCH 02/69] fix flux sync (#271) --- .../cluster/flux-v2/jhub/jhub-release.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 09e367af..988f68b4 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -192,13 +192,13 @@ spec: # jupyter-role: singleuser # elena adds the volumes with dask config - volumeMounts: - - name: dask-lab-configmap-gateway - mountPath: /home/jovyan/.config/dask/ - subPath: gateway.yaml - - name: dask-lab-configmap-labextension - mountPath: /home/jovyan/.config/dask/ - subPath: labextension.yaml + # volumeMounts: + # - name: dask-lab-configmap-gateway + # mountPath: /home/jovyan/.config/dask/ + # subPath: gateway.yaml + # - name: dask-lab-configmap-labextension + # mountPath: /home/jovyan/.config/dask/ + # subPath: labextension.yaml volumes: - name: dask-lab-configmap-gateway From 9fcee003566bab27ea4c9f6c76936f9a8d51b91d Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Wed, 24 Jan 2024 13:01:06 +0100 Subject: [PATCH 03/69] fix flux sync 2 (#272) --- .../cluster/flux-v2/jhub/jhub-release.yaml | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 988f68b4..7631472e 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -192,27 +192,27 @@ spec: # jupyter-role: singleuser # elena adds the volumes with dask config - # volumeMounts: - # - name: dask-lab-configmap-gateway - # mountPath: /home/jovyan/.config/dask/ - # subPath: gateway.yaml - # - name: dask-lab-configmap-labextension - # mountPath: /home/jovyan/.config/dask/ - # subPath: labextension.yaml + # volumeMounts: + # - name: dask-lab-configmap-gateway + # mountPath: /home/jovyan/.config/dask/ + # subPath: gateway.yaml + # - name: dask-lab-configmap-labextension + # mountPath: /home/jovyan/.config/dask/ + # subPath: labextension.yaml - volumes: - - name: dask-lab-configmap-gateway - configMap: - name: dask-lab-configmap - items: - - key: gateway.yaml - path: gateway.yaml - - name: dask-lab-configmap-labextension - configMap: - name: dask-lab-configmap - items: - - key: labextension.yaml - path: labextension.yaml + # volumes: + # - name: dask-lab-configmap-gateway + # configMap: + # name: dask-lab-configmap + # items: + # - key: gateway.yaml + # path: gateway.yaml + # - name: dask-lab-configmap-labextension + # configMap: + # name: dask-lab-configmap + # items: + # - key: labextension.yaml + # path: labextension.yaml cmd: null From 41bd70e21be6567895845672ffb149eeab0bb661 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Fri, 2 Feb 2024 16:27:06 +0100 Subject: [PATCH 04/69] add WDF v2.2.1 env from DLaaS infra (#273) --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index 98ae0998..1cb36734 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -30,6 +30,10 @@ data: description: "Contains the MLFermiLATDwarfs and fermitools libraries" kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 + - display_name: "VIRGO - WDF environment" + description: "Contains the full WDF v2.2.1 environment" + kubespawner_override: + image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - display_name: "Dev enviroment" description: "For testing and development purposes" kubespawner_override: From a70cf0f39f487e009b1074c16e6c6e0a51a89d29 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Thu, 8 Feb 2024 19:32:55 +0100 Subject: [PATCH 05/69] Update dev env --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index 1cb36734..44e44399 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -37,7 +37,7 @@ data: - display_name: "Dev enviroment" description: "For testing and development purposes" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser:dev + image: ghcr.io/vre-hub/vre-singleuser-dev:latest - display_name: "Dask+ROOT" description: "Gives you the ability to spawn Dask clusters" kubespawner_override: From 516d0a8382515ac3190ba429f94b3648d2ed104b Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Mon, 12 Feb 2024 17:05:19 +0100 Subject: [PATCH 06/69] Test wdf env --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index 44e44399..9bf2fa3a 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -37,7 +37,8 @@ data: - display_name: "Dev enviroment" description: "For testing and development purposes" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-dev:latest + image: ghcr.io/vre-hub/vre-singleuser-py311:sha-bb2dc16 + #image: ghcr.io/vre-hub/vre-singleuser-dev:latest - display_name: "Dask+ROOT" description: "Gives you the ability to spawn Dask clusters" kubespawner_override: From 4cc4a6d05892b37a79ab9a38606f8617f0a9dddb Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Mon, 12 Feb 2024 17:45:24 +0100 Subject: [PATCH 07/69] test 2 - wdf env --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index 9bf2fa3a..bec1ef34 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -37,7 +37,7 @@ data: - display_name: "Dev enviroment" description: "For testing and development purposes" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-py311:sha-bb2dc16 + image: ghcr.io/vre-hub/vre-singleuser-py311:latest #image: ghcr.io/vre-hub/vre-singleuser-dev:latest - display_name: "Dask+ROOT" description: "Gives you the ability to spawn Dask clusters" From badd9276b72ce8953bdc582134ca5c1fa49b35fb Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Tue, 13 Feb 2024 10:03:33 +0100 Subject: [PATCH 08/69] Update jhub config (#274) Latest upstream images raise the following error ``` Leave $JUPYTERHUB_SINGLEUSER_APP unspecified (or use the default JUPYTERHUB_SINGLEUSER_APP=jupyter-server), and set `c.Spawner.default_url = "/tree"` to make notebook v7 the default UI. ``` Testing if config is compatible with old setup --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 7631472e..e448f365 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -217,7 +217,7 @@ spec: cmd: null extraEnv: - JUPYTERHUB_SINGLEUSER_APP: "notebook.notebookapp.NotebookApp" + JUPYTERHUB_SINGLEUSER_APP: "jupyter-server" RUCIO_MODE: "replica" RUCIO_WILDCARD_ENABLED: "1" RUCIO_BASE_URL: "https://vre-rucio.cern.ch" From 6ef1924075d8dcbc19b84db78ff4c90899b9f305 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Tue, 13 Feb 2024 11:38:17 +0100 Subject: [PATCH 09/69] Revert PR#274 Updating envs and images would require update of jhub too --> TODO --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index e448f365..7631472e 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -217,7 +217,7 @@ spec: cmd: null extraEnv: - JUPYTERHUB_SINGLEUSER_APP: "jupyter-server" + JUPYTERHUB_SINGLEUSER_APP: "notebook.notebookapp.NotebookApp" RUCIO_MODE: "replica" RUCIO_WILDCARD_ENABLED: "1" RUCIO_BASE_URL: "https://vre-rucio.cern.ch" From 4ffd02648392ec9e1e5dc7349d9d4e05e01008ef Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Wed, 14 Feb 2024 19:34:01 +0100 Subject: [PATCH 10/69] reshuffle computing resources for ET school (#275) --- infrastructure/cluster/README.md | 45 +++++++++++++++++++ .../flux-v2/cvmfs/cvmfs_deployment_test.yaml | 31 +++++++++++++ .../flux-v2/dask/dask-gateway-configmap.yaml | 2 +- .../cluster/flux-v2/dask/dask-release.yaml | 2 +- .../cluster/flux-v2/jhub/jhub-release.yaml | 15 +++++-- 5 files changed, 89 insertions(+), 6 deletions(-) create mode 100644 infrastructure/cluster/README.md create mode 100644 infrastructure/cluster/flux-v2/cvmfs/cvmfs_deployment_test.yaml diff --git a/infrastructure/cluster/README.md b/infrastructure/cluster/README.md new file mode 100644 index 00000000..b10dd4b8 --- /dev/null +++ b/infrastructure/cluster/README.md @@ -0,0 +1,45 @@ +# CERN-VRE cluster + +## Cluster administration + +The CERN-VRE cluster is composed of 3 master nodes plus 20 worker nodes, running on the CERN OpenStack instance. + + - master nodes: `m2.large` flavour; 4 VCPUs, 7.3 GB RAM and 40 GB. + - worker nodes: `m2.xlarge` flavour; 8 VCPUs, 14.6 GB RAM and 80 GB. + +10 nodes (0 to 9) nodes are "reserved" for infrastructure management; k8s, rucio, jhub, reana ... +10 nodes (10 to 22 - nodes 14, 16 and 21 don't exist) are tagged for computing purposes; jhub-sessions and os, cvmfs and CephFS "connectors". WIP: reana sessions should be spawned here too. + +TO date (14 Feb 2024), nodes have been labelled as follows; +`kubectl label node > jupyter=singleuser` + +Each Jupyter session is assigned with the following resources (declared on the jhub-release manifest). +Resources have been assigned without much experienced, based on the following +[zero-to-jupyterhub-k8s documentation](https://github.com/jupyterhub/zero-to-jupyterhub-k8s/blob/main/docs/source/administrator/optimization.md#balancing-guaranteed-vs-maximum-memory-and-cpu). + +```yaml +singleuser: +# cpu: +# limit: 4 +# guarantee: 0.05 + memory: + # ratio of 3:2 that is lower than the 2:1 suggested (on the above link) + # This should allow a + limit: 4G + guarantee: 2G + + nodeSelector: + jupyter: singleuser + extraTolerations: + - key: jupyter + operator: Equal + value: singleuser + effect: NoSchedule +``` + +Notes: + - `cpu` requests have been commented. From the avobe link one can read on point num 3 **If you set resource limits but omit resource requests, then k8s will assume you imply the same resource requests as your limits. No assumptions are made in the other direction.** + - A ratio of `3.5:3` on `memory` will be set up on the cluster for the ET school happening on the 20 February 2024. To be elaborated / linked with a **leassons learned** post. + - `nodeSelector` and `extraTolerations` would need to be applied to the `eos` and `cephfs` `Daemonsets` too, so that they are not deployed all along the first 10 nodes. + - Investigate how the `prePuller` config and the `continuous-image-puller` pods can be reduced in a `nodeSelector` way. + - \ No newline at end of file diff --git a/infrastructure/cluster/flux-v2/cvmfs/cvmfs_deployment_test.yaml b/infrastructure/cluster/flux-v2/cvmfs/cvmfs_deployment_test.yaml new file mode 100644 index 00000000..ff96cadd --- /dev/null +++ b/infrastructure/cluster/flux-v2/cvmfs/cvmfs_deployment_test.yaml @@ -0,0 +1,31 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: cvmfs-all-repos-test + namespace: jhub + labels: + app: cvmfs-all-repos-test +spec: + replicas: 1 + selector: + matchLabels: + app: cvmfs-all-repos-test + template: + metadata: + labels: + app: cvmfs-all-repos-test + spec: + containers: + - name: idle + image: busybox + imagePullPolicy: IfNotPresent + command: [ "/bin/sh", "-c", "trap : TERM INT; (while true; do sleep 1000; done) & wait" ] + volumeMounts: + - name: cvmfs + mountPath: /cvmfs + # CVMFS automount volumes must be mounted with HostToContainer mount propagation. + mountPropagation: HostToContainer + volumes: + - name: cvmfs + persistentVolumeClaim: + claimName: cvmfs diff --git a/infrastructure/cluster/flux-v2/dask/dask-gateway-configmap.yaml b/infrastructure/cluster/flux-v2/dask/dask-gateway-configmap.yaml index 48970be3..aa6f929d 100644 --- a/infrastructure/cluster/flux-v2/dask/dask-gateway-configmap.yaml +++ b/infrastructure/cluster/flux-v2/dask/dask-gateway-configmap.yaml @@ -5,6 +5,6 @@ metadata: namespace: jhub data: labextension.yaml: "labextension:\n factory:\n module: dask_gateway\n class: - GatewayCluster\n \n default:\n workers: 2" + GatewayCluster\n \n default:\n workers: 1" gateway.yaml: "gateway:\n address: \"http://traefik-dask-dask-gateway/\"\n auth:\n \ type: jupyterhub " \ No newline at end of file diff --git a/infrastructure/cluster/flux-v2/dask/dask-release.yaml b/infrastructure/cluster/flux-v2/dask/dask-release.yaml index 859d68ed..7dab6151 100644 --- a/infrastructure/cluster/flux-v2/dask/dask-release.yaml +++ b/infrastructure/cluster/flux-v2/dask/dask-release.yaml @@ -34,7 +34,7 @@ spec: pullPolicy: IfNotPresent worker: - replicas: 4 + replicas: 1 scheduler: serviceType: "LoadBalancer" diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 7631472e..820da077 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -187,9 +187,16 @@ spec: name: ghcr.io/vre-hub/vre-singleuser tag: sha-423e01a pullPolicy: Always - # nodeSelector: # Keeping it as a comment to mark it as TODO - # # makes sure EOS eulake fuse mount is done on nodes designated to have the fuse mount - # jupyter-role: singleuser + nodeSelector: + jupyter: singleuser + extraTolerations: + - key: jupyter + operator: Equal + value: singleuser + effect: NoSchedule + memory: + limit: 3.5Gi #4Gi + guarantee: 3Gi #2Gi # elena adds the volumes with dask config # volumeMounts: @@ -214,7 +221,6 @@ spec: # - key: labextension.yaml # path: labextension.yaml - cmd: null extraEnv: JUPYTERHUB_SINGLEUSER_APP: "notebook.notebookapp.NotebookApp" @@ -236,6 +242,7 @@ spec: RUCIO_PATH_BEGINS_AT: "2" RUCIO_CA_CERT: "/certs/rucio_ca.pem" OAUTH2_TOKEN: "FILE:/tmp/eos_oauth.token" + ingress: enabled: true ingressClassName: nginx From debc324f4f20ae74bc67d69f7f43bc5310a441d1 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Wed, 14 Feb 2024 19:41:26 +0100 Subject: [PATCH 11/69] fix traitlets.traitlets.TraitError: 3.5Gi is not a valid memory specification. Must be an int or a string with suffix K, M, G, T (#276) --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 820da077..9acf8fa4 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -195,8 +195,8 @@ spec: value: singleuser effect: NoSchedule memory: - limit: 3.5Gi #4Gi - guarantee: 3Gi #2Gi + limit: 3.5G #4G + guarantee: 3G #2G # elena adds the volumes with dask config # volumeMounts: From 36cc527ec64483c108c3cb2bd945de963a08def5 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Fri, 16 Feb 2024 14:40:49 +0100 Subject: [PATCH 12/69] small details preparing the ET school (#277) --- infrastructure/cluster/README.md | 46 +++++++++++++++++-- .../flux-v2/cvmfs/cvmfs_deployment_test.yaml | 31 ------------- .../flux-v2/jhub/jhub-profiles-cm.yaml | 8 ++-- 3 files changed, 46 insertions(+), 39 deletions(-) delete mode 100644 infrastructure/cluster/flux-v2/cvmfs/cvmfs_deployment_test.yaml diff --git a/infrastructure/cluster/README.md b/infrastructure/cluster/README.md index b10dd4b8..c5733b22 100644 --- a/infrastructure/cluster/README.md +++ b/infrastructure/cluster/README.md @@ -12,9 +12,11 @@ The CERN-VRE cluster is composed of 3 master nodes plus 20 worker nodes, running TO date (14 Feb 2024), nodes have been labelled as follows; `kubectl label node > jupyter=singleuser` +and these same 10 nodes need to be tainted to only allow jupyter sessions too +`kubectl taint nodes jupyter=singleuser:NoSchedule` -Each Jupyter session is assigned with the following resources (declared on the jhub-release manifest). -Resources have been assigned without much experienced, based on the following +Each Jupyter session is therefore spawned within the above nodes (by adding on the jhub-release manifest the `memory`, `nodeSelector` and `extraTolerations`, as showed below). +Resources have been assigned/organised without much experienced, based on the following [zero-to-jupyterhub-k8s documentation](https://github.com/jupyterhub/zero-to-jupyterhub-k8s/blob/main/docs/source/administrator/optimization.md#balancing-guaranteed-vs-maximum-memory-and-cpu). ```yaml @@ -41,5 +43,41 @@ Notes: - `cpu` requests have been commented. From the avobe link one can read on point num 3 **If you set resource limits but omit resource requests, then k8s will assume you imply the same resource requests as your limits. No assumptions are made in the other direction.** - A ratio of `3.5:3` on `memory` will be set up on the cluster for the ET school happening on the 20 February 2024. To be elaborated / linked with a **leassons learned** post. - `nodeSelector` and `extraTolerations` would need to be applied to the `eos` and `cephfs` `Daemonsets` too, so that they are not deployed all along the first 10 nodes. - - Investigate how the `prePuller` config and the `continuous-image-puller` pods can be reduced in a `nodeSelector` way. - - \ No newline at end of file + - Investigate how the `prePuller` config and the `continuous-image-puller` pods can be reduced in a `nodeSelector` way. --> `Jhub` undestood that the image puller should only be on the nodes assigned for jupyter `:)`. Although there is a `Daemonset` that controls them. + + + ### Patching the cluster + #### EOS +`Daemonset` `cern-magnum-eosxd` (`registry.cern.ch/magnum/eosd:4.8.51-1.2`) was deployed by default. The `Daemonset` was patched as follows + +```bash +$ kubectl patch ds -n kube-system cern-magnum-eosxd --patch-file node_and_tolerations_jup.yaml +daemonset.apps/cern-magnum-eosxd patched +``` +with `cat node_and_tolerations_jup.yaml` +```yaml +spec: + template: + spec: + nodeSelector: + jupyter: singleuser + tolerations: + - effect: NoSchedule + key: jupyter + operator: Equal + value: singleuser +``` + +**Open doubt** Not sure why the tolerations patch needs to be applied to the whole `ds`, as the `ds` itself it doesn't use these tolerations. However, the pods spawned by, contain both the `nodeSelecter` and the `tolerations`. + + + #### CVMFS +`Daemonset` `cvmfs-cvmfs-csi-nodeplugin` () was deployed into the cern-vre (not by default, manually if byt the k8s team, if I recall correctly), and patched as follows + +```bash +$ kubectl patch ds -n kube-system cvmfs-cvmfs-csi-nodeplugin --patch-file node_and_tolerations_jup.yaml +daemonset.apps/cvmfs-cvmfs-csi-nodeplugin patched +``` + +#### CEPHFS +Done nothing for the moment - not sure if master nodes (or any monitoring) send/connect to CephFS for any reason. diff --git a/infrastructure/cluster/flux-v2/cvmfs/cvmfs_deployment_test.yaml b/infrastructure/cluster/flux-v2/cvmfs/cvmfs_deployment_test.yaml deleted file mode 100644 index ff96cadd..00000000 --- a/infrastructure/cluster/flux-v2/cvmfs/cvmfs_deployment_test.yaml +++ /dev/null @@ -1,31 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: cvmfs-all-repos-test - namespace: jhub - labels: - app: cvmfs-all-repos-test -spec: - replicas: 1 - selector: - matchLabels: - app: cvmfs-all-repos-test - template: - metadata: - labels: - app: cvmfs-all-repos-test - spec: - containers: - - name: idle - image: busybox - imagePullPolicy: IfNotPresent - command: [ "/bin/sh", "-c", "trap : TERM INT; (while true; do sleep 1000; done) & wait" ] - volumeMounts: - - name: cvmfs - mountPath: /cvmfs - # CVMFS automount volumes must be mounted with HostToContainer mount propagation. - mountPropagation: HostToContainer - volumes: - - name: cvmfs - persistentVolumeClaim: - claimName: cvmfs diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index bec1ef34..c9bed2c2 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -18,6 +18,10 @@ data: description: "ROOT v6.26.10 as well as a ROOT C++ and a python-3.8 kernel." kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-root:sha-c94d95a + - display_name: "VIRGO - WDF environment" + description: "Contains the full WDF v2.2.1 environment" + kubespawner_override: + image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - display_name: "KM3Net Science Project environment" description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries." kubespawner_override: @@ -30,10 +34,6 @@ data: description: "Contains the MLFermiLATDwarfs and fermitools libraries" kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 - - display_name: "VIRGO - WDF environment" - description: "Contains the full WDF v2.2.1 environment" - kubespawner_override: - image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - display_name: "Dev enviroment" description: "For testing and development purposes" kubespawner_override: From fbdeeff64af49dcf3064dc6c711bc21c19bafdb6 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Thu, 11 Apr 2024 15:35:54 +0200 Subject: [PATCH 13/69] Update jhub-profiles-configMap.yaml (#279) With python3.11 + jupyterlab v4 and rucio jupyterlab extension latest version --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index c9bed2c2..64bfea74 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -43,4 +43,8 @@ data: description: "Gives you the ability to spawn Dask clusters" kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-dask-root:sha-7805adc + - display_name: "Default environment - python3.11 + jupyterlab v4" + description: "Later rucio jupyterlab verions - under dev and testing" + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-py311:sha-b30b19b From f601bd0ad59da85da9b87eea5d0295a2ceb45a80 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Thu, 11 Apr 2024 16:50:47 +0200 Subject: [PATCH 14/69] Change to latest tag for debugging rucio jlab extension --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index 64bfea74..f9920b32 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -44,7 +44,7 @@ data: kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-dask-root:sha-7805adc - display_name: "Default environment - python3.11 + jupyterlab v4" - description: "Later rucio jupyterlab verions - under dev and testing" + description: "With latest rucio jupyterlab extension version - under dev and testing" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-py311:sha-b30b19b + image: ghcr.io/vre-hub/vre-singleuser-py311:latest From 03017ed40944b1aa5c40f3387c4f7427efb3486c Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Thu, 18 Apr 2024 14:44:26 +0200 Subject: [PATCH 15/69] testing flux --- infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml b/infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml index 5876b7ea..68d32d0c 100644 --- a/infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml +++ b/infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml @@ -196,7 +196,7 @@ spec: authServerResources: limits: - cpu: "1000m" + cpu: "1500m" memory: "1000Mi" requests: cpu: "200m" From 8821ff364e8ca3ea2aba7d94d8d19f35bc6d44e5 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Mon, 27 May 2024 17:36:04 +0200 Subject: [PATCH 16/69] Update jhub-release.yaml to chart v3.3.7 (#280) --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 9acf8fa4..6b7116eb 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -14,7 +14,7 @@ spec: namespace: jhub chart: jupyterhub interval: 5m - version: 2.0.0 + version: 3.3.7 valuesFrom: - kind: Secret name: jhub-cvre-iam-secrets From 15c63b9974ef03ab1e802f7a1db68a1865aa8be1 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Mon, 27 May 2024 17:47:07 +0200 Subject: [PATCH 17/69] Update jhub-release.yaml to chart v3.2.1 --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 6b7116eb..bfc4ffcb 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -14,7 +14,7 @@ spec: namespace: jhub chart: jupyterhub interval: 5m - version: 3.3.7 + version: 3.2.1 valuesFrom: - kind: Secret name: jhub-cvre-iam-secrets From 7b7d4d78991359e289a3a256bbded223bb06519f Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Mon, 27 May 2024 17:57:12 +0200 Subject: [PATCH 18/69] Update jhub-release.yaml --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index bfc4ffcb..626ab73c 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -14,7 +14,7 @@ spec: namespace: jhub chart: jupyterhub interval: 5m - version: 3.2.1 + version: 3.0.0 valuesFrom: - kind: Secret name: jhub-cvre-iam-secrets From 717ebc1c0101f9eff4169bcacf13fa8f9e668e4e Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Mon, 27 May 2024 17:57:54 +0200 Subject: [PATCH 19/69] Rollback jhub-release.yaml --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 626ab73c..9acf8fa4 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -14,7 +14,7 @@ spec: namespace: jhub chart: jupyterhub interval: 5m - version: 3.0.0 + version: 2.0.0 valuesFrom: - kind: Secret name: jhub-cvre-iam-secrets From 34743cf6c99ca6daae4d0b602ce8e073cb2edbfe Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Tue, 18 Jun 2024 17:45:09 +0200 Subject: [PATCH 20/69] stop reana --- .../flux-v2/reana/reana-iam-cronjob.yaml | 138 ++++++------ .../cluster/flux-v2/reana/reana-ingress.yaml | 84 ++++---- .../cluster/flux-v2/reana/reana-release.yaml | 204 +++++++++--------- 3 files changed, 213 insertions(+), 213 deletions(-) diff --git a/infrastructure/cluster/flux-v2/reana/reana-iam-cronjob.yaml b/infrastructure/cluster/flux-v2/reana/reana-iam-cronjob.yaml index 7ff13941..2227e976 100644 --- a/infrastructure/cluster/flux-v2/reana/reana-iam-cronjob.yaml +++ b/infrastructure/cluster/flux-v2/reana/reana-iam-cronjob.yaml @@ -1,76 +1,76 @@ -apiVersion: batch/v1 -kind: CronJob -metadata: - name: iam-reana-sync - namespace: reana -spec: - schedule: "0 1 * * *" # every day at 1 am - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 1 - jobTemplate: - spec: - template: - spec: - restartPolicy: OnFailure - containers: - - name: iam-sync - image: ghcr.io/vre-hub/vre-iam-reana-sync:v1.0.0-rc0-35-02757b7 # to be changed to correct version +# apiVersion: batch/v1 +# kind: CronJob +# metadata: +# name: iam-reana-sync +# namespace: reana +# spec: +# schedule: "0 1 * * *" # every day at 1 am +# concurrencyPolicy: Forbid +# successfulJobsHistoryLimit: 1 +# jobTemplate: +# spec: +# template: +# spec: +# restartPolicy: OnFailure +# containers: +# - name: iam-sync +# image: ghcr.io/vre-hub/vre-iam-reana-sync:v1.0.0-rc0-35-02757b7 # to be changed to correct version - env: +# env: - # needed to poll the iam service +# # needed to poll the iam service - - name: IAM_SERVER - value: "https://iam-escape.cloud.cnaf.infn.it" - - name: CLIENT_SECRET - valueFrom: - secretKeyRef: - name: reana-vre-iam-client - key: client_secret - - name: CLIENT_ID - valueFrom: - secretKeyRef: - name: reana-vre-iam-client - key: client_id +# - name: IAM_SERVER +# value: "https://iam-escape.cloud.cnaf.infn.it" +# - name: CLIENT_SECRET +# valueFrom: +# secretKeyRef: +# name: reana-vre-iam-client +# key: client_secret +# - name: CLIENT_ID +# valueFrom: +# secretKeyRef: +# name: reana-vre-iam-client +# key: client_id - # needed to add users - - name: REANA_ADMIN_TOKEN - valueFrom: - secretKeyRef: - name: reana-admin-access-token - key: ADMIN_ACCESS_TOKEN +# # needed to add users +# - name: REANA_ADMIN_TOKEN +# valueFrom: +# secretKeyRef: +# name: reana-admin-access-token +# key: ADMIN_ACCESS_TOKEN - # needed for correct DB connection - internals of reana - - name: REANA_SECRET_KEY - valueFrom: - secretKeyRef: - name: reana-secrets - key: REANA_SECRET_KEY +# # needed for correct DB connection - internals of reana +# - name: REANA_SECRET_KEY +# valueFrom: +# secretKeyRef: +# name: reana-secrets +# key: REANA_SECRET_KEY - # to connect to DB - - name: REANA_DB_NAME - value: "reana" - - name: REANA_DB_PORT - value: "6600" - - name: REANA_DB_HOST - value: "dbod-vre.cern.ch" - - name: REANA_DB_USERNAME - valueFrom: - secretKeyRef: - name: reana-db - key: user - - name: REANA_DB_PASSWORD - valueFrom: - secretKeyRef: - name: reana-db - key: password +# # to connect to DB +# - name: REANA_DB_NAME +# value: "reana" +# - name: REANA_DB_PORT +# value: "6600" +# - name: REANA_DB_HOST +# value: "dbod-vre.cern.ch" +# - name: REANA_DB_USERNAME +# valueFrom: +# secretKeyRef: +# name: reana-db +# key: user +# - name: REANA_DB_PASSWORD +# valueFrom: +# secretKeyRef: +# name: reana-db +# key: password - tty: true - imagePullPolicy: Always - command: - - /bin/sh - - -c - - date; echo Hello from iam-reana-sync container; - flask reana-admin user-list --admin-access-token $REANA_ADMIN_TOKEN; - python3 /home/generate_email_list.py; - python3 /home/add_reana_users.py \ No newline at end of file +# tty: true +# imagePullPolicy: Always +# command: +# - /bin/sh +# - -c +# - date; echo Hello from iam-reana-sync container; +# flask reana-admin user-list --admin-access-token $REANA_ADMIN_TOKEN; +# python3 /home/generate_email_list.py; +# python3 /home/add_reana_users.py \ No newline at end of file diff --git a/infrastructure/cluster/flux-v2/reana/reana-ingress.yaml b/infrastructure/cluster/flux-v2/reana/reana-ingress.yaml index 71cde86e..0c468abe 100644 --- a/infrastructure/cluster/flux-v2/reana/reana-ingress.yaml +++ b/infrastructure/cluster/flux-v2/reana/reana-ingress.yaml @@ -1,43 +1,43 @@ -apiVersion: networking.k8s.io/v1 -kind: Ingress -metadata: - annotations: - cert-manager.io/cluster-issuer: letsencrypt - ingress.kubernetes.io/ssl-redirect: "true" - meta.helm.sh/release-name: reana - meta.helm.sh/release-namespace: reana - traefik.frontend.entryPoints: http,https - name: reana-ingress - namespace: reana -spec: - ingressClassName: nginx - tls: - - secretName: cert-manager-tls-ingress-secret-reana - hosts: - - reana-vre.cern.ch - rules: - - host: reana-vre.cern.ch - http: - paths: - - backend: - service: - name: reana-server - port: - number: 80 - path: /api - pathType: Prefix - - backend: - service: - name: reana-server - port: - number: 80 - path: /oauth - pathType: Prefix - - backend: - service: - name: reana-ui - port: - number: 80 - path: / - pathType: Prefix +# apiVersion: networking.k8s.io/v1 +# kind: Ingress +# metadata: +# annotations: +# cert-manager.io/cluster-issuer: letsencrypt +# ingress.kubernetes.io/ssl-redirect: "true" +# meta.helm.sh/release-name: reana +# meta.helm.sh/release-namespace: reana +# traefik.frontend.entryPoints: http,https +# name: reana-ingress +# namespace: reana +# spec: +# ingressClassName: nginx +# tls: +# - secretName: cert-manager-tls-ingress-secret-reana +# hosts: +# - reana-vre.cern.ch +# rules: +# - host: reana-vre.cern.ch +# http: +# paths: +# - backend: +# service: +# name: reana-server +# port: +# number: 80 +# path: /api +# pathType: Prefix +# - backend: +# service: +# name: reana-server +# port: +# number: 80 +# path: /oauth +# pathType: Prefix +# - backend: +# service: +# name: reana-ui +# port: +# number: 80 +# path: / +# pathType: Prefix diff --git a/infrastructure/cluster/flux-v2/reana/reana-release.yaml b/infrastructure/cluster/flux-v2/reana/reana-release.yaml index fbab844d..14780c71 100644 --- a/infrastructure/cluster/flux-v2/reana/reana-release.yaml +++ b/infrastructure/cluster/flux-v2/reana/reana-release.yaml @@ -1,115 +1,115 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: reana - namespace: reana - annotations: - flux.weave.works/automated: "false" +# apiVersion: helm.toolkit.fluxcd.io/v2beta1 +# kind: HelmRelease +# metadata: +# name: reana +# namespace: reana +# annotations: +# flux.weave.works/automated: "false" -spec: - releaseName: reana - interval: 5m - chart: - spec: - sourceRef: - kind: HelmRepository - name: reana - namespace: reana - chart: reana - interval: 1m - # version: 0.9.1-alpha.4 - version: 0.9.2 +# spec: +# releaseName: reana +# interval: 5m +# chart: +# spec: +# sourceRef: +# kind: HelmRepository +# name: reana +# namespace: reana +# chart: reana +# interval: 1m +# # version: 0.9.1-alpha.4 +# version: 0.9.2 - valuesFrom: - - kind: Secret - name: reana-vre-iam-client - valuesKey: client_id - targetPath: secrets.login.escape-iam.consumer_key - - kind: Secret - name: reana-vre-iam-client - valuesKey: client_secret - targetPath: secrets.login.escape-iam.consumer_secret - - kind: Secret - name: reana-share - valuesKey: share_id - targetPath: shared_storage.cephfs.cephfs_os_share_id - - kind: Secret - name: reana-share - valuesKey: share_access_id - targetPath: shared_storage.cephfs.cephfs_os_share_access_id - - kind: Secret - name: reana-db - valuesKey: user - targetPath: secrets.database.user - - kind: Secret - name: reana-db - valuesKey: password - targetPath: secrets.database.password +# valuesFrom: +# - kind: Secret +# name: reana-vre-iam-client +# valuesKey: client_id +# targetPath: secrets.login.escape-iam.consumer_key +# - kind: Secret +# name: reana-vre-iam-client +# valuesKey: client_secret +# targetPath: secrets.login.escape-iam.consumer_secret +# - kind: Secret +# name: reana-share +# valuesKey: share_id +# targetPath: shared_storage.cephfs.cephfs_os_share_id +# - kind: Secret +# name: reana-share +# valuesKey: share_access_id +# targetPath: shared_storage.cephfs.cephfs_os_share_access_id +# - kind: Secret +# name: reana-db +# valuesKey: user +# targetPath: secrets.database.user +# - kind: Secret +# name: reana-db +# valuesKey: password +# targetPath: secrets.database.password - values: +# values: - shared_storage: - backend: cephfs - volume_size: 1000 - access_modes: ReadWriteMany - cephfs: - provisioner: manila-provisioner - type: "Meyrin CephFS" - availability_zone: nova - os_secret_name: os-trustee - os_secret_namespace: kube-system - # get shares with `openstack share list`, `openstack share show share_id` - # YOU NEED TO CREATE AN ACCESS RULE TO GET THE ACCESS RULE ID with `openstack share access list share_name` +# shared_storage: +# backend: cephfs +# volume_size: 1000 +# access_modes: ReadWriteMany +# cephfs: +# provisioner: manila-provisioner +# type: "Meyrin CephFS" +# availability_zone: nova +# os_secret_name: os-trustee +# os_secret_namespace: kube-system +# # get shares with `openstack share list`, `openstack share show share_id` +# # YOU NEED TO CREATE AN ACCESS RULE TO GET THE ACCESS RULE ID with `openstack share access list share_name` - components: - reana_ui: - enabled: true - local_users: false - reana_db: - enabled: false - reana_server: - environment: - REANA_USER_EMAIL_CONFIRMATION: false - # reana_workflow_controller: - # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs - # reana_job_controller: - # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 +# components: +# reana_ui: +# enabled: true +# local_users: false +# reana_db: +# enabled: false +# reana_server: +# environment: +# REANA_USER_EMAIL_CONFIRMATION: false +# # reana_workflow_controller: +# # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs +# # reana_job_controller: +# # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 - compute_backends: - - "kubernetes" - - "htcondorcern" - - "slurmcern" +# compute_backends: +# - "kubernetes" +# - "htcondorcern" +# - "slurmcern" - notifications: - enabled: true - email_config: - receiver: escape-cern-ops@cern.ch - sender: escape-cern-ops@cern.ch - login: "" - smtp_server: cernmx.cern.ch - smtp_port: 25 +# notifications: +# enabled: true +# email_config: +# receiver: escape-cern-ops@cern.ch +# sender: escape-cern-ops@cern.ch +# login: "" +# smtp_server: cernmx.cern.ch +# smtp_port: 25 - reana_hostname: "reana-vre.cern.ch" +# reana_hostname: "reana-vre.cern.ch" - db_env_config: +# db_env_config: - REANA_DB_NAME: "reana" - REANA_DB_PORT: "6600" - REANA_DB_HOST: "dbod-vre.cern.ch" +# REANA_DB_NAME: "reana" +# REANA_DB_PORT: "6600" +# REANA_DB_HOST: "dbod-vre.cern.ch" - login: - - name: "escape-iam" - type: "keycloak" - config: - title: "ESCAPE IAM" - base_url: "https://iam-escape.cloud.cnaf.infn.it" - realm_url: "https://iam-escape.cloud.cnaf.infn.it" - auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" - token_url: "https://iam-escape.cloud.cnaf.infn.it/token" - userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" +# login: +# - name: "escape-iam" +# type: "keycloak" +# config: +# title: "ESCAPE IAM" +# base_url: "https://iam-escape.cloud.cnaf.infn.it" +# realm_url: "https://iam-escape.cloud.cnaf.infn.it" +# auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" +# token_url: "https://iam-escape.cloud.cnaf.infn.it/token" +# userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" - ingress: - enabled: false +# ingress: +# enabled: false - traefik: - enabled: false +# traefik: +# enabled: false From 6abfb6a26102e5307e70805a7b37aa871116ac3b Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Tue, 18 Jun 2024 17:53:21 +0200 Subject: [PATCH 21/69] upgrade reana to v0.9.3 --- .../cluster/flux-v2/reana/reana-release.yaml | 204 +++++++++--------- 1 file changed, 102 insertions(+), 102 deletions(-) diff --git a/infrastructure/cluster/flux-v2/reana/reana-release.yaml b/infrastructure/cluster/flux-v2/reana/reana-release.yaml index 14780c71..71332e97 100644 --- a/infrastructure/cluster/flux-v2/reana/reana-release.yaml +++ b/infrastructure/cluster/flux-v2/reana/reana-release.yaml @@ -1,115 +1,115 @@ -# apiVersion: helm.toolkit.fluxcd.io/v2beta1 -# kind: HelmRelease -# metadata: -# name: reana -# namespace: reana -# annotations: -# flux.weave.works/automated: "false" +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: reana + namespace: reana + annotations: + flux.weave.works/automated: "false" -# spec: -# releaseName: reana -# interval: 5m -# chart: -# spec: -# sourceRef: -# kind: HelmRepository -# name: reana -# namespace: reana -# chart: reana -# interval: 1m -# # version: 0.9.1-alpha.4 -# version: 0.9.2 +spec: + releaseName: reana + interval: 5m + chart: + spec: + sourceRef: + kind: HelmRepository + name: reana + namespace: reana + chart: reana + interval: 1m + # version: 0.9.1-alpha.4 + version: 0.9.3 -# valuesFrom: -# - kind: Secret -# name: reana-vre-iam-client -# valuesKey: client_id -# targetPath: secrets.login.escape-iam.consumer_key -# - kind: Secret -# name: reana-vre-iam-client -# valuesKey: client_secret -# targetPath: secrets.login.escape-iam.consumer_secret -# - kind: Secret -# name: reana-share -# valuesKey: share_id -# targetPath: shared_storage.cephfs.cephfs_os_share_id -# - kind: Secret -# name: reana-share -# valuesKey: share_access_id -# targetPath: shared_storage.cephfs.cephfs_os_share_access_id -# - kind: Secret -# name: reana-db -# valuesKey: user -# targetPath: secrets.database.user -# - kind: Secret -# name: reana-db -# valuesKey: password -# targetPath: secrets.database.password + valuesFrom: + - kind: Secret + name: reana-vre-iam-client + valuesKey: client_id + targetPath: secrets.login.escape-iam.consumer_key + - kind: Secret + name: reana-vre-iam-client + valuesKey: client_secret + targetPath: secrets.login.escape-iam.consumer_secret + - kind: Secret + name: reana-share + valuesKey: share_id + targetPath: shared_storage.cephfs.cephfs_os_share_id + - kind: Secret + name: reana-share + valuesKey: share_access_id + targetPath: shared_storage.cephfs.cephfs_os_share_access_id + - kind: Secret + name: reana-db + valuesKey: user + targetPath: secrets.database.user + - kind: Secret + name: reana-db + valuesKey: password + targetPath: secrets.database.password -# values: + values: -# shared_storage: -# backend: cephfs -# volume_size: 1000 -# access_modes: ReadWriteMany -# cephfs: -# provisioner: manila-provisioner -# type: "Meyrin CephFS" -# availability_zone: nova -# os_secret_name: os-trustee -# os_secret_namespace: kube-system -# # get shares with `openstack share list`, `openstack share show share_id` -# # YOU NEED TO CREATE AN ACCESS RULE TO GET THE ACCESS RULE ID with `openstack share access list share_name` + shared_storage: + backend: cephfs + volume_size: 1000 + access_modes: ReadWriteMany + cephfs: + provisioner: manila-provisioner + type: "Meyrin CephFS" + availability_zone: nova + os_secret_name: os-trustee + os_secret_namespace: kube-system + # get shares with `openstack share list`, `openstack share show share_id` + # YOU NEED TO CREATE AN ACCESS RULE TO GET THE ACCESS RULE ID with `openstack share access list share_name` -# components: -# reana_ui: -# enabled: true -# local_users: false -# reana_db: -# enabled: false -# reana_server: -# environment: -# REANA_USER_EMAIL_CONFIRMATION: false -# # reana_workflow_controller: -# # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs -# # reana_job_controller: -# # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 + components: + reana_ui: + enabled: true + local_users: false + reana_db: + enabled: false + reana_server: + environment: + REANA_USER_EMAIL_CONFIRMATION: false + # reana_workflow_controller: + # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs + # reana_job_controller: + # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 -# compute_backends: -# - "kubernetes" -# - "htcondorcern" -# - "slurmcern" + compute_backends: + - "kubernetes" + - "htcondorcern" + - "slurmcern" -# notifications: -# enabled: true -# email_config: -# receiver: escape-cern-ops@cern.ch -# sender: escape-cern-ops@cern.ch -# login: "" -# smtp_server: cernmx.cern.ch -# smtp_port: 25 + notifications: + enabled: true + email_config: + receiver: escape-cern-ops@cern.ch + sender: escape-cern-ops@cern.ch + login: "" + smtp_server: cernmx.cern.ch + smtp_port: 25 -# reana_hostname: "reana-vre.cern.ch" + reana_hostname: "reana-vre.cern.ch" -# db_env_config: + db_env_config: -# REANA_DB_NAME: "reana" -# REANA_DB_PORT: "6600" -# REANA_DB_HOST: "dbod-vre.cern.ch" + REANA_DB_NAME: "reana" + REANA_DB_PORT: "6600" + REANA_DB_HOST: "dbod-vre.cern.ch" -# login: -# - name: "escape-iam" -# type: "keycloak" -# config: -# title: "ESCAPE IAM" -# base_url: "https://iam-escape.cloud.cnaf.infn.it" -# realm_url: "https://iam-escape.cloud.cnaf.infn.it" -# auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" -# token_url: "https://iam-escape.cloud.cnaf.infn.it/token" -# userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" + login: + - name: "escape-iam" + type: "keycloak" + config: + title: "ESCAPE IAM" + base_url: "https://iam-escape.cloud.cnaf.infn.it" + realm_url: "https://iam-escape.cloud.cnaf.infn.it" + auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" + token_url: "https://iam-escape.cloud.cnaf.infn.it/token" + userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" -# ingress: -# enabled: false + ingress: + enabled: false -# traefik: -# enabled: false + traefik: + enabled: false From 0a1fa81ad84e91e99b630692dea116ea6b1b4970 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 19 Jun 2024 11:00:35 +0200 Subject: [PATCH 22/69] stop reana --- .../cluster/flux-v2/reana/reana-release.yaml | 204 +++++++++--------- 1 file changed, 102 insertions(+), 102 deletions(-) diff --git a/infrastructure/cluster/flux-v2/reana/reana-release.yaml b/infrastructure/cluster/flux-v2/reana/reana-release.yaml index 71332e97..c4b47223 100644 --- a/infrastructure/cluster/flux-v2/reana/reana-release.yaml +++ b/infrastructure/cluster/flux-v2/reana/reana-release.yaml @@ -1,115 +1,115 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: reana - namespace: reana - annotations: - flux.weave.works/automated: "false" +# apiVersion: helm.toolkit.fluxcd.io/v2beta1 +# kind: HelmRelease +# metadata: +# name: reana +# namespace: reana +# annotations: +# flux.weave.works/automated: "false" -spec: - releaseName: reana - interval: 5m - chart: - spec: - sourceRef: - kind: HelmRepository - name: reana - namespace: reana - chart: reana - interval: 1m - # version: 0.9.1-alpha.4 - version: 0.9.3 +# spec: +# releaseName: reana +# interval: 5m +# chart: +# spec: +# sourceRef: +# kind: HelmRepository +# name: reana +# namespace: reana +# chart: reana +# interval: 1m +# # version: 0.9.1-alpha.4 +# version: 0.9.3 - valuesFrom: - - kind: Secret - name: reana-vre-iam-client - valuesKey: client_id - targetPath: secrets.login.escape-iam.consumer_key - - kind: Secret - name: reana-vre-iam-client - valuesKey: client_secret - targetPath: secrets.login.escape-iam.consumer_secret - - kind: Secret - name: reana-share - valuesKey: share_id - targetPath: shared_storage.cephfs.cephfs_os_share_id - - kind: Secret - name: reana-share - valuesKey: share_access_id - targetPath: shared_storage.cephfs.cephfs_os_share_access_id - - kind: Secret - name: reana-db - valuesKey: user - targetPath: secrets.database.user - - kind: Secret - name: reana-db - valuesKey: password - targetPath: secrets.database.password +# valuesFrom: +# - kind: Secret +# name: reana-vre-iam-client +# valuesKey: client_id +# targetPath: secrets.login.escape-iam.consumer_key +# - kind: Secret +# name: reana-vre-iam-client +# valuesKey: client_secret +# targetPath: secrets.login.escape-iam.consumer_secret +# - kind: Secret +# name: reana-share +# valuesKey: share_id +# targetPath: shared_storage.cephfs.cephfs_os_share_id +# - kind: Secret +# name: reana-share +# valuesKey: share_access_id +# targetPath: shared_storage.cephfs.cephfs_os_share_access_id +# - kind: Secret +# name: reana-db +# valuesKey: user +# targetPath: secrets.database.user +# - kind: Secret +# name: reana-db +# valuesKey: password +# targetPath: secrets.database.password - values: +# values: - shared_storage: - backend: cephfs - volume_size: 1000 - access_modes: ReadWriteMany - cephfs: - provisioner: manila-provisioner - type: "Meyrin CephFS" - availability_zone: nova - os_secret_name: os-trustee - os_secret_namespace: kube-system - # get shares with `openstack share list`, `openstack share show share_id` - # YOU NEED TO CREATE AN ACCESS RULE TO GET THE ACCESS RULE ID with `openstack share access list share_name` +# shared_storage: +# backend: cephfs +# volume_size: 1000 +# access_modes: ReadWriteMany +# cephfs: +# provisioner: manila-provisioner +# type: "Meyrin CephFS" +# availability_zone: nova +# os_secret_name: os-trustee +# os_secret_namespace: kube-system +# # get shares with `openstack share list`, `openstack share show share_id` +# # YOU NEED TO CREATE AN ACCESS RULE TO GET THE ACCESS RULE ID with `openstack share access list share_name` - components: - reana_ui: - enabled: true - local_users: false - reana_db: - enabled: false - reana_server: - environment: - REANA_USER_EMAIL_CONFIRMATION: false - # reana_workflow_controller: - # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs - # reana_job_controller: - # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 +# components: +# reana_ui: +# enabled: true +# local_users: false +# reana_db: +# enabled: false +# reana_server: +# environment: +# REANA_USER_EMAIL_CONFIRMATION: false +# # reana_workflow_controller: +# # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs +# # reana_job_controller: +# # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 - compute_backends: - - "kubernetes" - - "htcondorcern" - - "slurmcern" +# compute_backends: +# - "kubernetes" +# - "htcondorcern" +# - "slurmcern" - notifications: - enabled: true - email_config: - receiver: escape-cern-ops@cern.ch - sender: escape-cern-ops@cern.ch - login: "" - smtp_server: cernmx.cern.ch - smtp_port: 25 +# notifications: +# enabled: true +# email_config: +# receiver: escape-cern-ops@cern.ch +# sender: escape-cern-ops@cern.ch +# login: "" +# smtp_server: cernmx.cern.ch +# smtp_port: 25 - reana_hostname: "reana-vre.cern.ch" +# reana_hostname: "reana-vre.cern.ch" - db_env_config: +# db_env_config: - REANA_DB_NAME: "reana" - REANA_DB_PORT: "6600" - REANA_DB_HOST: "dbod-vre.cern.ch" +# REANA_DB_NAME: "reana" +# REANA_DB_PORT: "6600" +# REANA_DB_HOST: "dbod-vre.cern.ch" - login: - - name: "escape-iam" - type: "keycloak" - config: - title: "ESCAPE IAM" - base_url: "https://iam-escape.cloud.cnaf.infn.it" - realm_url: "https://iam-escape.cloud.cnaf.infn.it" - auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" - token_url: "https://iam-escape.cloud.cnaf.infn.it/token" - userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" +# login: +# - name: "escape-iam" +# type: "keycloak" +# config: +# title: "ESCAPE IAM" +# base_url: "https://iam-escape.cloud.cnaf.infn.it" +# realm_url: "https://iam-escape.cloud.cnaf.infn.it" +# auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" +# token_url: "https://iam-escape.cloud.cnaf.infn.it/token" +# userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" - ingress: - enabled: false +# ingress: +# enabled: false - traefik: - enabled: false +# traefik: +# enabled: false From dbed06770208f6d9249071cb00bdb63a0424a8e7 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Wed, 19 Jun 2024 13:50:20 +0200 Subject: [PATCH 23/69] reapply reana helm charts with new minor v 0.9.3 (#281) --- .../cluster/flux-v2/reana/reana-ingress.yaml | 84 ++++---- .../cluster/flux-v2/reana/reana-release.yaml | 204 +++++++++--------- 2 files changed, 144 insertions(+), 144 deletions(-) diff --git a/infrastructure/cluster/flux-v2/reana/reana-ingress.yaml b/infrastructure/cluster/flux-v2/reana/reana-ingress.yaml index 0c468abe..71cde86e 100644 --- a/infrastructure/cluster/flux-v2/reana/reana-ingress.yaml +++ b/infrastructure/cluster/flux-v2/reana/reana-ingress.yaml @@ -1,43 +1,43 @@ -# apiVersion: networking.k8s.io/v1 -# kind: Ingress -# metadata: -# annotations: -# cert-manager.io/cluster-issuer: letsencrypt -# ingress.kubernetes.io/ssl-redirect: "true" -# meta.helm.sh/release-name: reana -# meta.helm.sh/release-namespace: reana -# traefik.frontend.entryPoints: http,https -# name: reana-ingress -# namespace: reana -# spec: -# ingressClassName: nginx -# tls: -# - secretName: cert-manager-tls-ingress-secret-reana -# hosts: -# - reana-vre.cern.ch -# rules: -# - host: reana-vre.cern.ch -# http: -# paths: -# - backend: -# service: -# name: reana-server -# port: -# number: 80 -# path: /api -# pathType: Prefix -# - backend: -# service: -# name: reana-server -# port: -# number: 80 -# path: /oauth -# pathType: Prefix -# - backend: -# service: -# name: reana-ui -# port: -# number: 80 -# path: / -# pathType: Prefix +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + annotations: + cert-manager.io/cluster-issuer: letsencrypt + ingress.kubernetes.io/ssl-redirect: "true" + meta.helm.sh/release-name: reana + meta.helm.sh/release-namespace: reana + traefik.frontend.entryPoints: http,https + name: reana-ingress + namespace: reana +spec: + ingressClassName: nginx + tls: + - secretName: cert-manager-tls-ingress-secret-reana + hosts: + - reana-vre.cern.ch + rules: + - host: reana-vre.cern.ch + http: + paths: + - backend: + service: + name: reana-server + port: + number: 80 + path: /api + pathType: Prefix + - backend: + service: + name: reana-server + port: + number: 80 + path: /oauth + pathType: Prefix + - backend: + service: + name: reana-ui + port: + number: 80 + path: / + pathType: Prefix diff --git a/infrastructure/cluster/flux-v2/reana/reana-release.yaml b/infrastructure/cluster/flux-v2/reana/reana-release.yaml index c4b47223..71332e97 100644 --- a/infrastructure/cluster/flux-v2/reana/reana-release.yaml +++ b/infrastructure/cluster/flux-v2/reana/reana-release.yaml @@ -1,115 +1,115 @@ -# apiVersion: helm.toolkit.fluxcd.io/v2beta1 -# kind: HelmRelease -# metadata: -# name: reana -# namespace: reana -# annotations: -# flux.weave.works/automated: "false" +apiVersion: helm.toolkit.fluxcd.io/v2beta1 +kind: HelmRelease +metadata: + name: reana + namespace: reana + annotations: + flux.weave.works/automated: "false" -# spec: -# releaseName: reana -# interval: 5m -# chart: -# spec: -# sourceRef: -# kind: HelmRepository -# name: reana -# namespace: reana -# chart: reana -# interval: 1m -# # version: 0.9.1-alpha.4 -# version: 0.9.3 +spec: + releaseName: reana + interval: 5m + chart: + spec: + sourceRef: + kind: HelmRepository + name: reana + namespace: reana + chart: reana + interval: 1m + # version: 0.9.1-alpha.4 + version: 0.9.3 -# valuesFrom: -# - kind: Secret -# name: reana-vre-iam-client -# valuesKey: client_id -# targetPath: secrets.login.escape-iam.consumer_key -# - kind: Secret -# name: reana-vre-iam-client -# valuesKey: client_secret -# targetPath: secrets.login.escape-iam.consumer_secret -# - kind: Secret -# name: reana-share -# valuesKey: share_id -# targetPath: shared_storage.cephfs.cephfs_os_share_id -# - kind: Secret -# name: reana-share -# valuesKey: share_access_id -# targetPath: shared_storage.cephfs.cephfs_os_share_access_id -# - kind: Secret -# name: reana-db -# valuesKey: user -# targetPath: secrets.database.user -# - kind: Secret -# name: reana-db -# valuesKey: password -# targetPath: secrets.database.password + valuesFrom: + - kind: Secret + name: reana-vre-iam-client + valuesKey: client_id + targetPath: secrets.login.escape-iam.consumer_key + - kind: Secret + name: reana-vre-iam-client + valuesKey: client_secret + targetPath: secrets.login.escape-iam.consumer_secret + - kind: Secret + name: reana-share + valuesKey: share_id + targetPath: shared_storage.cephfs.cephfs_os_share_id + - kind: Secret + name: reana-share + valuesKey: share_access_id + targetPath: shared_storage.cephfs.cephfs_os_share_access_id + - kind: Secret + name: reana-db + valuesKey: user + targetPath: secrets.database.user + - kind: Secret + name: reana-db + valuesKey: password + targetPath: secrets.database.password -# values: + values: -# shared_storage: -# backend: cephfs -# volume_size: 1000 -# access_modes: ReadWriteMany -# cephfs: -# provisioner: manila-provisioner -# type: "Meyrin CephFS" -# availability_zone: nova -# os_secret_name: os-trustee -# os_secret_namespace: kube-system -# # get shares with `openstack share list`, `openstack share show share_id` -# # YOU NEED TO CREATE AN ACCESS RULE TO GET THE ACCESS RULE ID with `openstack share access list share_name` + shared_storage: + backend: cephfs + volume_size: 1000 + access_modes: ReadWriteMany + cephfs: + provisioner: manila-provisioner + type: "Meyrin CephFS" + availability_zone: nova + os_secret_name: os-trustee + os_secret_namespace: kube-system + # get shares with `openstack share list`, `openstack share show share_id` + # YOU NEED TO CREATE AN ACCESS RULE TO GET THE ACCESS RULE ID with `openstack share access list share_name` -# components: -# reana_ui: -# enabled: true -# local_users: false -# reana_db: -# enabled: false -# reana_server: -# environment: -# REANA_USER_EMAIL_CONFIRMATION: false -# # reana_workflow_controller: -# # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs -# # reana_job_controller: -# # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 + components: + reana_ui: + enabled: true + local_users: false + reana_db: + enabled: false + reana_server: + environment: + REANA_USER_EMAIL_CONFIRMATION: false + # reana_workflow_controller: + # image: docker.io/mdonadoni/reana-workflow-controller:0.9.1-7e03f0a-cvmfs + # reana_job_controller: + # image: docker.io/reanahub/reana-job-controller-htcondorcern-slurmcern:0.9.1 -# compute_backends: -# - "kubernetes" -# - "htcondorcern" -# - "slurmcern" + compute_backends: + - "kubernetes" + - "htcondorcern" + - "slurmcern" -# notifications: -# enabled: true -# email_config: -# receiver: escape-cern-ops@cern.ch -# sender: escape-cern-ops@cern.ch -# login: "" -# smtp_server: cernmx.cern.ch -# smtp_port: 25 + notifications: + enabled: true + email_config: + receiver: escape-cern-ops@cern.ch + sender: escape-cern-ops@cern.ch + login: "" + smtp_server: cernmx.cern.ch + smtp_port: 25 -# reana_hostname: "reana-vre.cern.ch" + reana_hostname: "reana-vre.cern.ch" -# db_env_config: + db_env_config: -# REANA_DB_NAME: "reana" -# REANA_DB_PORT: "6600" -# REANA_DB_HOST: "dbod-vre.cern.ch" + REANA_DB_NAME: "reana" + REANA_DB_PORT: "6600" + REANA_DB_HOST: "dbod-vre.cern.ch" -# login: -# - name: "escape-iam" -# type: "keycloak" -# config: -# title: "ESCAPE IAM" -# base_url: "https://iam-escape.cloud.cnaf.infn.it" -# realm_url: "https://iam-escape.cloud.cnaf.infn.it" -# auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" -# token_url: "https://iam-escape.cloud.cnaf.infn.it/token" -# userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" + login: + - name: "escape-iam" + type: "keycloak" + config: + title: "ESCAPE IAM" + base_url: "https://iam-escape.cloud.cnaf.infn.it" + realm_url: "https://iam-escape.cloud.cnaf.infn.it" + auth_url: "https://iam-escape.cloud.cnaf.infn.it/authorize" + token_url: "https://iam-escape.cloud.cnaf.infn.it/token" + userinfo_url: "https://iam-escape.cloud.cnaf.infn.it/userinfo" -# ingress: -# enabled: false + ingress: + enabled: false -# traefik: -# enabled: false + traefik: + enabled: false From f08eb6c41efeefcc81dff4ccb0e87b5111f770b1 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Wed, 19 Jun 2024 14:22:09 +0200 Subject: [PATCH 24/69] re apply reana cronjobs (#282) --- .../flux-v2/reana/reana-iam-cronjob.yaml | 187 +++++++++++------- 1 file changed, 111 insertions(+), 76 deletions(-) diff --git a/infrastructure/cluster/flux-v2/reana/reana-iam-cronjob.yaml b/infrastructure/cluster/flux-v2/reana/reana-iam-cronjob.yaml index 2227e976..d104222d 100644 --- a/infrastructure/cluster/flux-v2/reana/reana-iam-cronjob.yaml +++ b/infrastructure/cluster/flux-v2/reana/reana-iam-cronjob.yaml @@ -1,76 +1,111 @@ -# apiVersion: batch/v1 -# kind: CronJob -# metadata: -# name: iam-reana-sync -# namespace: reana -# spec: -# schedule: "0 1 * * *" # every day at 1 am -# concurrencyPolicy: Forbid -# successfulJobsHistoryLimit: 1 -# jobTemplate: -# spec: -# template: -# spec: -# restartPolicy: OnFailure -# containers: -# - name: iam-sync -# image: ghcr.io/vre-hub/vre-iam-reana-sync:v1.0.0-rc0-35-02757b7 # to be changed to correct version - -# env: - -# # needed to poll the iam service - -# - name: IAM_SERVER -# value: "https://iam-escape.cloud.cnaf.infn.it" -# - name: CLIENT_SECRET -# valueFrom: -# secretKeyRef: -# name: reana-vre-iam-client -# key: client_secret -# - name: CLIENT_ID -# valueFrom: -# secretKeyRef: -# name: reana-vre-iam-client -# key: client_id - -# # needed to add users -# - name: REANA_ADMIN_TOKEN -# valueFrom: -# secretKeyRef: -# name: reana-admin-access-token -# key: ADMIN_ACCESS_TOKEN - -# # needed for correct DB connection - internals of reana -# - name: REANA_SECRET_KEY -# valueFrom: -# secretKeyRef: -# name: reana-secrets -# key: REANA_SECRET_KEY - -# # to connect to DB -# - name: REANA_DB_NAME -# value: "reana" -# - name: REANA_DB_PORT -# value: "6600" -# - name: REANA_DB_HOST -# value: "dbod-vre.cern.ch" -# - name: REANA_DB_USERNAME -# valueFrom: -# secretKeyRef: -# name: reana-db -# key: user -# - name: REANA_DB_PASSWORD -# valueFrom: -# secretKeyRef: -# name: reana-db -# key: password - -# tty: true -# imagePullPolicy: Always -# command: -# - /bin/sh -# - -c -# - date; echo Hello from iam-reana-sync container; -# flask reana-admin user-list --admin-access-token $REANA_ADMIN_TOKEN; -# python3 /home/generate_email_list.py; -# python3 /home/add_reana_users.py \ No newline at end of file +apiVersion: batch/v1 +kind: CronJob +metadata: + name: iam-reana-sync + namespace: reana +spec: + schedule: "0 1 * * *" # every day at 1 am + concurrencyPolicy: Forbid + successfulJobsHistoryLimit: 1 + jobTemplate: + spec: + template: + spec: + restartPolicy: OnFailure + containers: + - name: iam-sync + image: ghcr.io/vre-hub/vre-iam-reana-sync:v1.0.0-rc0-35-02757b7 # to be changed to correct version + env: + # needed to poll the iam service + - name: IAM_SERVER + value: "https://iam-escape.cloud.cnaf.infn.it" + - name: CLIENT_SECRET + valueFrom: + secretKeyRef: + name: reana-vre-iam-client + key: client_secret + - name: CLIENT_ID + valueFrom: + secretKeyRef: + name: reana-vre-iam-client + key: client_id + # needed to add users + - name: REANA_ADMIN_TOKEN + valueFrom: + secretKeyRef: + name: reana-admin-access-token + key: ADMIN_ACCESS_TOKEN + # needed for correct DB connection - internals of reana + - name: REANA_SECRET_KEY + valueFrom: + secretKeyRef: + name: reana-secrets + key: REANA_SECRET_KEY + # to connect to DB + - name: REANA_DB_NAME + value: "reana" + - name: REANA_DB_PORT + value: "6600" + - name: REANA_DB_HOST + value: "dbod-vre.cern.ch" + - name: REANA_DB_USERNAME + valueFrom: + secretKeyRef: + name: reana-db + key: user + - name: REANA_DB_PASSWORD + valueFrom: + secretKeyRef: + name: reana-db + key: password + tty: true + imagePullPolicy: Always + command: + - /bin/sh + - -c + - date; echo Hello from iam-reana-sync container; + flask reana-admin user-list --admin-access-token $REANA_ADMIN_TOKEN; + python3 /home/generate_email_list.py; + python3 /home/add_reana_users.py +--- +apiVersion: v1 +kind: Pod +metadata: + name: reana-client + namespace: reana +spec: + containers: + - name: rucio-client + image: ghcr.io/vre-hub/vre-iam-reana-sync:v1.0.0-rc0-35-02757b7 + imagePullPolicy: Always + command: ["sleep","3600"] + env: + # needed to add users + - name: REANA_ADMIN_TOKEN + valueFrom: + secretKeyRef: + name: reana-admin-access-token + key: ADMIN_ACCESS_TOKEN + # needed for correct DB connection - internals of reana + - name: REANA_SECRET_KEY + valueFrom: + secretKeyRef: + name: reana-secrets + key: REANA_SECRET_KEY + # to connect to DB + - name: REANA_DB_NAME + value: "reana" + - name: REANA_DB_PORT + value: "6600" + - name: REANA_DB_HOST + value: "dbod-vre.cern.ch" + - name: REANA_DB_USERNAME + valueFrom: + secretKeyRef: + name: reana-db + key: user + - name: REANA_DB_PASSWORD + valueFrom: + secretKeyRef: + name: reana-db + key: password \ No newline at end of file From 2536e152d864686fe60cdf653934bbd31aa36bde Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Fri, 21 Jun 2024 18:32:06 +0200 Subject: [PATCH 25/69] Remove tolerations jup (#283) * remove nodeselectore and extraTolerations from jhub release * add manifest to remove/add tolerations --- .../cluster/flux-v2/jhub/jhub-release.yaml | 14 +++++++------- .../cluster/manual/node_and_tolerations_jup.yaml | 12 ++++++++++++ 2 files changed, 19 insertions(+), 7 deletions(-) create mode 100644 infrastructure/cluster/manual/node_and_tolerations_jup.yaml diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index 9acf8fa4..d34f7a6e 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -187,13 +187,13 @@ spec: name: ghcr.io/vre-hub/vre-singleuser tag: sha-423e01a pullPolicy: Always - nodeSelector: - jupyter: singleuser - extraTolerations: - - key: jupyter - operator: Equal - value: singleuser - effect: NoSchedule + # nodeSelector: + # jupyter: singleuser + # extraTolerations: + # - key: jupyter + # operator: Equal + # value: singleuser + # effect: NoSchedule memory: limit: 3.5G #4G guarantee: 3G #2G diff --git a/infrastructure/cluster/manual/node_and_tolerations_jup.yaml b/infrastructure/cluster/manual/node_and_tolerations_jup.yaml new file mode 100644 index 00000000..3b608488 --- /dev/null +++ b/infrastructure/cluster/manual/node_and_tolerations_jup.yaml @@ -0,0 +1,12 @@ +# K8s manifest originally used to patch the cmvfs and eos daemonsets + +spec: + template: + spec: + nodeSelector: + # jupyter: singleuser + tolerations: + # - effect: NoSchedule + # key: jupyter + # operator: Equal + # value: singleuser \ No newline at end of file From ad52272a4ed7e352ed0579c958df15a8185bc723 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Fri, 21 Jun 2024 18:41:20 +0200 Subject: [PATCH 26/69] Update infrastructure README.md --- infrastructure/cluster/README.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/infrastructure/cluster/README.md b/infrastructure/cluster/README.md index c5733b22..f08249d6 100644 --- a/infrastructure/cluster/README.md +++ b/infrastructure/cluster/README.md @@ -10,11 +10,14 @@ The CERN-VRE cluster is composed of 3 master nodes plus 20 worker nodes, running 10 nodes (0 to 9) nodes are "reserved" for infrastructure management; k8s, rucio, jhub, reana ... 10 nodes (10 to 22 - nodes 14, 16 and 21 don't exist) are tagged for computing purposes; jhub-sessions and os, cvmfs and CephFS "connectors". WIP: reana sessions should be spawned here too. -TO date (14 Feb 2024), nodes have been labelled as follows; +To date (14 Feb 2024), nodes have been labelled as follows; `kubectl label node > jupyter=singleuser` and these same 10 nodes need to be tainted to only allow jupyter sessions too `kubectl taint nodes jupyter=singleuser:NoSchedule` +To date (21 jun 2024), nodes and tains removed. +Reana was not able to reach cvmfs (ds was not deploying any nodeplugin on the nodes, because of the above restrictions). It was easier to un taint and un label everything, rather than taining all Reana deployment. + Each Jupyter session is therefore spawned within the above nodes (by adding on the jhub-release manifest the `memory`, `nodeSelector` and `extraTolerations`, as showed below). Resources have been assigned/organised without much experienced, based on the following [zero-to-jupyterhub-k8s documentation](https://github.com/jupyterhub/zero-to-jupyterhub-k8s/blob/main/docs/source/administrator/optimization.md#balancing-guaranteed-vs-maximum-memory-and-cpu). From b88026213a51c3f9692936e0dab8a1f1de686079 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 21 Jun 2024 18:58:16 +0200 Subject: [PATCH 27/69] remote the tolerations --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index d34f7a6e..b249490f 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -187,9 +187,9 @@ spec: name: ghcr.io/vre-hub/vre-singleuser tag: sha-423e01a pullPolicy: Always - # nodeSelector: + nodeSelector: # jupyter: singleuser - # extraTolerations: + extraTolerations: # - key: jupyter # operator: Equal # value: singleuser From 6ef872eaed370ab2f12abd0077a15071d66ead64 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Wed, 3 Jul 2024 11:33:58 +0200 Subject: [PATCH 28/69] vre-singleuser-dev:latest image --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index f9920b32..c99e2945 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -37,8 +37,8 @@ data: - display_name: "Dev enviroment" description: "For testing and development purposes" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-py311:latest - #image: ghcr.io/vre-hub/vre-singleuser-dev:latest + #image: ghcr.io/vre-hub/vre-singleuser-py311:latest + image: ghcr.io/vre-hub/vre-singleuser-dev:latest - display_name: "Dask+ROOT" description: "Gives you the ability to spawn Dask clusters" kubespawner_override: From 5c45e3b82d1bb10babc137b3f6efdd348bebb768 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 3 Jul 2024 15:51:20 +0200 Subject: [PATCH 29/69] fix dev image --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index c99e2945..4d86f7d8 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -37,7 +37,6 @@ data: - display_name: "Dev enviroment" description: "For testing and development purposes" kubespawner_override: - #image: ghcr.io/vre-hub/vre-singleuser-py311:latest image: ghcr.io/vre-hub/vre-singleuser-dev:latest - display_name: "Dask+ROOT" description: "Gives you the ability to spawn Dask clusters" From c3d187ea2ede84fba8da983f9b022c3b5d361b72 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 3 Jul 2024 15:56:08 +0200 Subject: [PATCH 30/69] change latest tag --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index 4d86f7d8..52c5323c 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -37,7 +37,7 @@ data: - display_name: "Dev enviroment" description: "For testing and development purposes" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-dev:latest + image: ghcr.io/vre-hub/vre-singleuser-dev:sha-42bc682 - display_name: "Dask+ROOT" description: "Gives you the ability to spawn Dask clusters" kubespawner_override: From 416ca4af08b38272a250981069e3d6634d2ec245 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 3 Jul 2024 16:00:57 +0200 Subject: [PATCH 31/69] remove tolerations and nodeselector fields --- infrastructure/cluster/flux-v2/jhub/jhub-release.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml index b249490f..d34f7a6e 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml @@ -187,9 +187,9 @@ spec: name: ghcr.io/vre-hub/vre-singleuser tag: sha-423e01a pullPolicy: Always - nodeSelector: + # nodeSelector: # jupyter: singleuser - extraTolerations: + # extraTolerations: # - key: jupyter # operator: Equal # value: singleuser From 9d109d24342d174df1a11e58319bc67897177270 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Thu, 4 Jul 2024 10:28:33 +0200 Subject: [PATCH 32/69] add new envs to jub --- .../cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index 52c5323c..bea91024 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -42,8 +42,12 @@ data: description: "Gives you the ability to spawn Dask clusters" kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-dask-root:sha-7805adc - - display_name: "Default environment - python3.11 + jupyterlab v4" - description: "With latest rucio jupyterlab extension version - under dev and testing" - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-py311:latest + - display_name: "REANA dev environment" + description: "For testing purposes" + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-reana-dev:sha-7220d31 + # - display_name: "Default environment - python3.11 + jupyterlab v4" + # description: "With latest rucio jupyterlab extension version - under dev and testing" + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-py311:latest From 1ecf567e1eb20059e3cad02b7e6e4c3422601288 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Thu, 4 Jul 2024 10:37:51 +0200 Subject: [PATCH 33/69] change reana dev image to latests, for testing purposes --- infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml index bea91024..3b703bee 100644 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml @@ -45,7 +45,7 @@ data: - display_name: "REANA dev environment" description: "For testing purposes" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-reana-dev:sha-7220d31 + image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest # - display_name: "Default environment - python3.11 + jupyterlab v4" # description: "With latest rucio jupyterlab extension version - under dev and testing" # kubespawner_override: From 01fbc45563c7de70f9fd34cc4cacbb7ef8b929a0 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 5 Jul 2024 19:11:15 +0200 Subject: [PATCH 34/69] remove dask deployment --- infrastructure/cluster/flux-v2/dask/README.md | 32 ---------- .../cluster/flux-v2/dask/dask-charts.yaml | 8 --- .../flux-v2/dask/dask-gateway-chart.yaml | 9 --- .../flux-v2/dask/dask-gateway-configmap.yaml | 10 ---- .../flux-v2/dask/dask-gateway-release.yaml | 60 ------------------- .../cluster/flux-v2/dask/dask-namespace.yaml | 6 -- .../cluster/flux-v2/dask/dask-release.yaml | 40 ------------- 7 files changed, 165 deletions(-) delete mode 100644 infrastructure/cluster/flux-v2/dask/README.md delete mode 100644 infrastructure/cluster/flux-v2/dask/dask-charts.yaml delete mode 100644 infrastructure/cluster/flux-v2/dask/dask-gateway-chart.yaml delete mode 100644 infrastructure/cluster/flux-v2/dask/dask-gateway-configmap.yaml delete mode 100644 infrastructure/cluster/flux-v2/dask/dask-gateway-release.yaml delete mode 100644 infrastructure/cluster/flux-v2/dask/dask-namespace.yaml delete mode 100644 infrastructure/cluster/flux-v2/dask/dask-release.yaml diff --git a/infrastructure/cluster/flux-v2/dask/README.md b/infrastructure/cluster/flux-v2/dask/README.md deleted file mode 100644 index 7fd195f8..00000000 --- a/infrastructure/cluster/flux-v2/dask/README.md +++ /dev/null @@ -1,32 +0,0 @@ -This deploymewnt allows multiple users to spawn multiple dask clusters by creating a scheduler each time a user asks for it, following the logic o fthe [Dask Gateway](https://gateway.dask.org/). -The deployment is done on top of the `jhub` namespace where the deployment of the Jupyterhub service is. The Dask packages are available inthe image called Dask at notebooks' start up. -If you decide to select this image, you can run a notebook and check that you can spawn a cluster by running: - -``` -import dask -import dask.distributed -from dask_gateway import Gateway -from dask_gateway import GatewayCluster -import dask.array as da -import requests -from dask_gateway import scheduler_preload -import os -``` - -To check the service of the `dask-gateway` is reachable, run: - -``` -requests.get("http://traefik-dask-dask-gateway/api/health").content -``` - -And then connect to the Gateway: - -``` -gateway = Gateway(address="http://traefik-dask-dask-gateway/", - auth="jupyterhub") -gateway.list_clusters() -cluster = gateway.new_cluster() -cluster.scale(4) # to create 4 worker nodes -``` - -You will see the scheduler and the worker pods appearing in the k8s cluster under the `jhub` namespace. \ No newline at end of file diff --git a/infrastructure/cluster/flux-v2/dask/dask-charts.yaml b/infrastructure/cluster/flux-v2/dask/dask-charts.yaml deleted file mode 100644 index 61c39e49..00000000 --- a/infrastructure/cluster/flux-v2/dask/dask-charts.yaml +++ /dev/null @@ -1,8 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1beta1 -kind: HelmRepository -metadata: - name: dask-charts - namespace: dask-vre -spec: - interval: 10m - url: https://helm.dask.org/ diff --git a/infrastructure/cluster/flux-v2/dask/dask-gateway-chart.yaml b/infrastructure/cluster/flux-v2/dask/dask-gateway-chart.yaml deleted file mode 100644 index 40f596ac..00000000 --- a/infrastructure/cluster/flux-v2/dask/dask-gateway-chart.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# apiVersion: source.toolkit.fluxcd.io/v2beta1 -apiVersion: source.toolkit.fluxcd.io/v1beta1 -kind: HelmRepository -metadata: - name: dask-gateway-charts - namespace: jhub -spec: - interval: 10m - url: https://helm.dask.org/ diff --git a/infrastructure/cluster/flux-v2/dask/dask-gateway-configmap.yaml b/infrastructure/cluster/flux-v2/dask/dask-gateway-configmap.yaml deleted file mode 100644 index aa6f929d..00000000 --- a/infrastructure/cluster/flux-v2/dask/dask-gateway-configmap.yaml +++ /dev/null @@ -1,10 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: dask-lab-configmap - namespace: jhub -data: - labextension.yaml: "labextension:\n factory:\n module: dask_gateway\n class: - GatewayCluster\n \n default:\n workers: 1" - gateway.yaml: "gateway:\n address: \"http://traefik-dask-dask-gateway/\"\n auth:\n - \ type: jupyterhub " \ No newline at end of file diff --git a/infrastructure/cluster/flux-v2/dask/dask-gateway-release.yaml b/infrastructure/cluster/flux-v2/dask/dask-gateway-release.yaml deleted file mode 100644 index 1e8ba389..00000000 --- a/infrastructure/cluster/flux-v2/dask/dask-gateway-release.yaml +++ /dev/null @@ -1,60 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: dask-gateway - namespace: jhub - annotations: - flux.weave.works/automated: "false" - -spec: - releaseName: dask - interval: 5m - chart: - spec: - sourceRef: - kind: HelmRepository - name: dask-gateway-charts - namespace: jhub - interval: 1m - chart: dask-gateway - # version: 2023.1.0 # support for python 3.11 - version: 2022.6.0 - # version: 2022.4.0 # support for python 3.9 - - valuesFrom: - - kind: Secret - name: api-dask-dask-gateway - valuesKey: jupyterhub-api-token - targetPath: gateway.auth.jupyterhub.apiToken - - - values: - - gateway: - # extraConfig: - # clusteroptions: | - # from dask_gateway_server.options import Options, Integer, Float, String - - # def option_handler(options): - # return { - # "worker_cores": options.worker_cores, - # "worker_memory": "%fG" % options.worker_memory, - # "image": options.image, - # } - - # c.Backend.cluster_options = Options( - # Integer("worker_cores", 2, min=1, max=4, label="Worker Cores"), - # Float("worker_memory", 4, min=1, max=8, label="Worker Memory (GiB)"), - # String("image", default="ghcr.io/dask/dask-gateway:2022.4.0", label="Image"), - # handler=option_handler, - # ) - - # Number of instances of the gateway-server to run - replicas: 1 - - # prefix: "/services/dask-gateway" - - auth: - type: jupyterhub - - diff --git a/infrastructure/cluster/flux-v2/dask/dask-namespace.yaml b/infrastructure/cluster/flux-v2/dask/dask-namespace.yaml deleted file mode 100644 index f6250a1e..00000000 --- a/infrastructure/cluster/flux-v2/dask/dask-namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - labels: - name: dask-vre - name: dask-vre diff --git a/infrastructure/cluster/flux-v2/dask/dask-release.yaml b/infrastructure/cluster/flux-v2/dask/dask-release.yaml deleted file mode 100644 index 7dab6151..00000000 --- a/infrastructure/cluster/flux-v2/dask/dask-release.yaml +++ /dev/null @@ -1,40 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: dask-vre - namespace: dask-vre - annotations: - flux.weave.works/automated: "false" - -spec: - releaseName: dask - interval: 5m - chart: - spec: - sourceRef: - kind: HelmRepository - name: dask-charts - namespace: dask-vre - interval: 1m - chart: dask - version: 2022.6.0 - - values: - - jupyter: - name: jupyter # Jupyter name. - enabled: true # Enable/disable the bundled Jupyter notebook. - rbac: true # Create RBAC service account and role to allow Jupyter pod to scale worker pods and access logs. - serviceType: "LoadBalancer" - servicePort: 81 - image: - repository: "ghcr.io/egazzarr/docker-tests-dask-root" - # repository: ghcr.io/vre-hub/vre-singleuser-dask-root - tag: "latest" - pullPolicy: IfNotPresent - - worker: - replicas: 1 - - scheduler: - serviceType: "LoadBalancer" From 28a0ca1d0cafaf1d36d0dcc6bccf557f8cf34e22 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 10 Jul 2024 11:59:45 +0200 Subject: [PATCH 35/69] remove jhub deployment --- .../cluster/flux-v2/jhub/jhub-charts.yaml | 9 - .../cluster/flux-v2/jhub/jhub-ns.yaml | 6 - .../flux-v2/jhub/jhub-profiles-cm.yaml | 53 ---- .../cluster/flux-v2/jhub/jhub-release.yaml | 257 ------------------ 4 files changed, 325 deletions(-) delete mode 100644 infrastructure/cluster/flux-v2/jhub/jhub-charts.yaml delete mode 100644 infrastructure/cluster/flux-v2/jhub/jhub-ns.yaml delete mode 100644 infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml delete mode 100644 infrastructure/cluster/flux-v2/jhub/jhub-release.yaml diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-charts.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-charts.yaml deleted file mode 100644 index 80668168..00000000 --- a/infrastructure/cluster/flux-v2/jhub/jhub-charts.yaml +++ /dev/null @@ -1,9 +0,0 @@ -apiVersion: source.toolkit.fluxcd.io/v1beta1 -kind: HelmRepository -metadata: - name: jhub - namespace: jhub -spec: - interval: 10m - url: https://hub.jupyter.org/helm-chart/ - \ No newline at end of file diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-ns.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-ns.yaml deleted file mode 100644 index 63228c74..00000000 --- a/infrastructure/cluster/flux-v2/jhub/jhub-ns.yaml +++ /dev/null @@ -1,6 +0,0 @@ -# kind: Namespace -# apiVersion: v1 -# metadata: -# name: jhub -# labels: -# name: jhub diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml deleted file mode 100644 index 3b703bee..00000000 --- a/infrastructure/cluster/flux-v2/jhub/jhub-profiles-cm.yaml +++ /dev/null @@ -1,53 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: jhub-profiles - namespace: jhub -data: - values.yaml: | - singleuser: - profileList: - - display_name: "Default environment" - description: "Based on a scipy-notebook environment with a python-3.9 kernel, the rucio-jupyterlab extension and the reana-client installed." - default: True - - display_name: "Default environment - python 3.8" - description: "Same environment as the default one except for a python-3.8 kernel installed." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-py38:sha-7ed7d80 - - display_name: "ROOT environment" - description: "ROOT v6.26.10 as well as a ROOT C++ and a python-3.8 kernel." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-root:sha-c94d95a - - display_name: "VIRGO - WDF environment" - description: "Contains the full WDF v2.2.1 environment" - kubespawner_override: - image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - - display_name: "KM3Net Science Project environment" - description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-km3irf:sha-c1e2a18 - - display_name: "KM3NeT and CTA combined analysis environment" - description: "Contains gammapy=0.17 and astropy - python-3.8 kernel." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-combined_ana_km3net_cta:sha-520edf8 - - display_name: "Indirect Dark Matter Detection Sciente Project environment" - description: "Contains the MLFermiLATDwarfs and fermitools libraries" - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 - - display_name: "Dev enviroment" - description: "For testing and development purposes" - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-dev:sha-42bc682 - - display_name: "Dask+ROOT" - description: "Gives you the ability to spawn Dask clusters" - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-dask-root:sha-7805adc - - display_name: "REANA dev environment" - description: "For testing purposes" - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest - # - display_name: "Default environment - python3.11 + jupyterlab v4" - # description: "With latest rucio jupyterlab extension version - under dev and testing" - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-py311:latest - diff --git a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml b/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml deleted file mode 100644 index d34f7a6e..00000000 --- a/infrastructure/cluster/flux-v2/jhub/jhub-release.yaml +++ /dev/null @@ -1,257 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: jhub-cvre - namespace: jhub -spec: - releaseName: jhub-cvre - interval: 5m - chart: - spec: - sourceRef: - kind: HelmRepository - name: jhub - namespace: jhub - chart: jupyterhub - interval: 5m - version: 2.0.0 - valuesFrom: - - kind: Secret - name: jhub-cvre-iam-secrets - valuesKey: client_id - targetPath: hub.config.RucioAuthenticator.client_id - - kind: Secret - name: jhub-cvre-iam-secrets - valuesKey: client_secret - targetPath: hub.config.RucioAuthenticator.client_secret - - kind: Secret - name: jhub-cvre-dbconnectstring - valuesKey: dbconnectstring - targetPath: hub.db.url - - kind: ConfigMap - name: jhub-profiles - valuesKey: values.yaml - - - kind: Secret - name: api-dask-dask-gateway - valuesKey: jupyterhub-api-token - targetPath: hub.services.dask-gateway.apiToken - - values: - proxy: - service: - type: ClusterIP - hub: - ##### adding this for testing - services: - dask-gateway: - # This makes the gateway available at ${HUB_URL}/services/dask-gateway - display: false - - service: - type: ClusterIP - # network policy needs to be modified to allow access to the Rucio server - # (disabling it for now as a workaround, see also the ones for singeluser and proxy below) - networkPolicy: - enabled: false - db: - type: postgres # secret dbconnect string set in main-helm.tf - config: - RucioAuthenticator: - # client_id: "" # set through secret - # client_secret: "" # set through secret - authorize_url: https://iam-escape.cloud.cnaf.infn.it/authorize - token_url: https://iam-escape.cloud.cnaf.infn.it/token - userdata_url: https://iam-escape.cloud.cnaf.infn.it/userinfo - username_key: preferred_username - scope: - - openid - - profile - - email - - extraConfig: - - # 00-add-dask-gateway-values: | - # # 1. Sets `DASK_GATEWAY__PROXY_ADDRESS` in the singleuser environment. - # # 2. Adds the URL for the Dask Gateway JupyterHub service. - # import os - # gateway_address = "http://188.184.76.40/services/dask-gateway" - # print("Setting DASK_GATEWAY__ADDRESS {} from HTTP service".format(gateway_address)) - - # # Internal address to connect to the Dask Gateway. - # c.KubeSpawner.environment.setdefault("DASK_GATEWAY__ADDRESS", gateway_address) - - # # Relative address for the dashboard link. - # c.KubeSpawner.environment.setdefault("DASK_GATEWAY__PUBLIC_ADDRESS", "/services/dask-gateway/") - # # Use JupyterHub to authenticate with Dask Gateway. - # c.KubeSpawner.environment.setdefault("DASK_GATEWAY__AUTH__TYPE", "jupyterhub") - - token-exchange: | - import pprint - import os - import warnings - import requests - from oauthenticator.generic import GenericOAuthenticator - - # custom authenticator to enable auth_state and get access token to set as env var for rucio extension - class RucioAuthenticator(GenericOAuthenticator): - def __init__(self, **kwargs): - super().__init__(**kwargs) - self.enable_auth_state = True - - def exchange_token(self, token): - params = { - 'client_id': self.client_id, - 'client_secret': self.client_secret, - 'grant_type': 'urn:ietf:params:oauth:grant-type:token-exchange', - 'subject_token': token, - 'scope': 'openid profile', - 'audience': 'rucio' - } - response = requests.post(self.token_url, data=params) - rucio_token = response.json()['access_token'] - return rucio_token - - async def pre_spawn_start(self, user, spawner): - auth_state = await user.get_auth_state() - pprint.pprint(auth_state) - if not auth_state: - # user has no auth state - return - - # define token environment variable from auth_state - spawner.environment['RUCIO_ACCESS_TOKEN'] = self.exchange_token(auth_state['access_token']) - spawner.environment['EOS_ACCESS_TOKEN'] = auth_state['access_token'] - - # set the above authenticator as the default - c.JupyterHub.authenticator_class = RucioAuthenticator - - # enable authentication state - c.GenericOAuthenticator.enable_auth_state = True - - if 'JUPYTERHUB_CRYPT_KEY' not in os.environ: - warnings.warn( - "Need JUPYTERHUB_CRYPT_KEY env for persistent auth_state.\n" - " export JUPYTERHUB_CRYPT_KEY=$(openssl rand -hex 32)" - ) - c.CryptKeeper.keys = [os.urandom(32)] - - singleuser: - defaultUrl: "/lab" - # The liefcycle hooks are used to create the Rucio configuration file, - # and the token file by copying the REFRESH_TOKEN from the environment variable to the token file. - lifecycleHooks: - postStart: - exec: - command: - - "sh" - - "-c" - - > - mkdir -p /certs /tmp; - echo -n $RUCIO_ACCESS_TOKEN > /tmp/rucio_oauth.token; - echo -n "oauth2:${EOS_ACCESS_TOKEN}:iam-escape.cloud.cnaf.infn.it/userinfo" > /tmp/eos_oauth.token; - chmod 0600 /tmp/eos_oauth.token; - mkdir -p /opt/rucio/etc; - echo "[client]" >> /opt/rucio/etc/rucio.cfg; - echo "rucio_host = https://vre-rucio.cern.ch" >> /opt/rucio/etc/rucio.cfg; - echo "auth_host = https://vre-rucio-auth.cern.ch" >> /opt/rucio/etc/rucio.cfg; - echo "ca_cert = /certs/rucio_ca.pem" >> /opt/rucio/etc/rucio.cfg; - echo "account = $JUPYTERHUB_USER" >> /opt/rucio/etc/rucio.cfg; - echo "auth_type = oidc" >> /opt/rucio/etc/rucio.cfg; - echo "oidc_audience = rucio" >> /opt/rucio/etc/rucio.cfg; - echo "oidc_polling = true" >> /opt/rucio/etc/rucio.cfg; - echo "auth_token_file_path = /tmp/rucio_oauth.token" >> /opt/rucio/etc/rucio.cfg; - networkPolicy: - enabled: false - storage: - type: static - static: - pvcName: jhub-singleuser # manually created StorageClass with Retain policy and PVC with 800Gi (refer to main-k8s.tf) - extraVolumes: - - name: cvmfs-cern-instance - persistentVolumeClaim: - claimName: cvmfs - - name: eulake-cern-eos-rse # mounts the EOS RSE needed for the Rucio JupiterLab extension - hostPath: - path: /var/eos/eulake # This is pointing to /eos/eulake/escape/data, defined on the eosxd/configmap - extraVolumeMounts: - - name: cvmfs-cern-instance - mountPath: /cvmfs - # CVMFS automount volumes must be mounted with HostToContainer mount propagation. - mountPropagation: HostToContainer - - name: eulake-cern-eos-rse # mounts the EOS RSE needed for the Rucio JupiterLab extension - mountPath: /eos/cern-eos-rse - mountPropagation: HostToContainer - readOnly: true - image: - name: ghcr.io/vre-hub/vre-singleuser - tag: sha-423e01a - pullPolicy: Always - # nodeSelector: - # jupyter: singleuser - # extraTolerations: - # - key: jupyter - # operator: Equal - # value: singleuser - # effect: NoSchedule - memory: - limit: 3.5G #4G - guarantee: 3G #2G - - # elena adds the volumes with dask config - # volumeMounts: - # - name: dask-lab-configmap-gateway - # mountPath: /home/jovyan/.config/dask/ - # subPath: gateway.yaml - # - name: dask-lab-configmap-labextension - # mountPath: /home/jovyan/.config/dask/ - # subPath: labextension.yaml - - # volumes: - # - name: dask-lab-configmap-gateway - # configMap: - # name: dask-lab-configmap - # items: - # - key: gateway.yaml - # path: gateway.yaml - # - name: dask-lab-configmap-labextension - # configMap: - # name: dask-lab-configmap - # items: - # - key: labextension.yaml - # path: labextension.yaml - - cmd: null - extraEnv: - JUPYTERHUB_SINGLEUSER_APP: "notebook.notebookapp.NotebookApp" - RUCIO_MODE: "replica" - RUCIO_WILDCARD_ENABLED: "1" - RUCIO_BASE_URL: "https://vre-rucio.cern.ch" - RUCIO_AUTH_URL: "https://vre-rucio-auth.cern.ch" - RUCIO_WEBUI_URL: "https://vre-rucio-ui.cern.ch" - RUCIO_DISPLAY_NAME: "RUCIO - CERN VRE" - RUCIO_NAME: "vre-rucio.cern.ch" - RUCIO_SITE_NAME: "CERN" - RUCIO_OIDC_AUTH: "env" - RUCIO_OIDC_ENV_NAME: "RUCIO_ACCESS_TOKEN" - RUCIO_DEFAULT_AUTH_TYPE: "oidc" - RUCIO_OAUTH_ID: "rucio" - RUCIO_DEFAULT_INSTANCE: "vre-rucio.cern.ch" - RUCIO_DESTINATION_RSE: "CERN-EOS" - RUCIO_RSE_MOUNT_PATH: "/eos/cern-eos-rse" - RUCIO_PATH_BEGINS_AT: "2" - RUCIO_CA_CERT: "/certs/rucio_ca.pem" - OAUTH2_TOKEN: "FILE:/tmp/eos_oauth.token" - - ingress: - enabled: true - ingressClassName: nginx - annotations: - cert-manager.io/cluster-issuer: "letsencrypt" # this issues a certificate for the domain through cert-manager automatically - hosts: - - jhub-vre.cern.ch - tls: - - hosts: - - jhub-vre.cern.ch - secretName: cert-manager-tls-ingress-secret-jhub - From c1513000c6606c35826c6d8d03a651e25c9fa100 Mon Sep 17 00:00:00 2001 From: flux-ops <> Date: Wed, 10 Jul 2024 14:29:39 +0200 Subject: [PATCH 36/69] Add Flux v2.3.0 component manifests --- .../flux/flux-system/gotk-components.yaml | 12385 ++++++++++++++++ 1 file changed, 12385 insertions(+) create mode 100644 infrastructure/cluster/flux/flux-system/gotk-components.yaml diff --git a/infrastructure/cluster/flux/flux-system/gotk-components.yaml b/infrastructure/cluster/flux/flux-system/gotk-components.yaml new file mode 100644 index 00000000..8fd99ab9 --- /dev/null +++ b/infrastructure/cluster/flux/flux-system/gotk-components.yaml @@ -0,0 +1,12385 @@ +--- +# This manifest was generated by flux. DO NOT EDIT. +# Flux Version: v2.3.0 +# Components: source-controller,kustomize-controller,helm-controller,notification-controller +apiVersion: v1 +kind: Namespace +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + pod-security.kubernetes.io/warn: restricted + pod-security.kubernetes.io/warn-version: latest + name: flux-system +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: allow-egress + namespace: flux-system +spec: + egress: + - {} + ingress: + - from: + - podSelector: {} + podSelector: {} + policyTypes: + - Ingress + - Egress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: allow-scraping + namespace: flux-system +spec: + ingress: + - from: + - namespaceSelector: {} + ports: + - port: 8080 + protocol: TCP + podSelector: {} + policyTypes: + - Ingress +--- +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: allow-webhooks + namespace: flux-system +spec: + ingress: + - from: + - namespaceSelector: {} + podSelector: + matchLabels: + app: notification-controller + policyTypes: + - Ingress +--- +apiVersion: v1 +kind: ResourceQuota +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: critical-pods-flux-system + namespace: flux-system +spec: + hard: + pods: "1000" + scopeSelector: + matchExpressions: + - operator: In + scopeName: PriorityClass + values: + - system-node-critical + - system-cluster-critical +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: crd-controller-flux-system +rules: +- apiGroups: + - source.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - kustomize.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - helm.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - notification.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - image.toolkit.fluxcd.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - "" + resources: + - namespaces + - secrets + - configmaps + - serviceaccounts + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +- apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - configmaps/status + verbs: + - get + - update + - patch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- nonResourceURLs: + - /livez/ping + verbs: + - head +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + name: flux-edit-flux-system +rules: +- apiGroups: + - notification.toolkit.fluxcd.io + - source.toolkit.fluxcd.io + - helm.toolkit.fluxcd.io + - image.toolkit.fluxcd.io + - kustomize.toolkit.fluxcd.io + resources: + - '*' + verbs: + - create + - delete + - deletecollection + - patch + - update +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + rbac.authorization.k8s.io/aggregate-to-admin: "true" + rbac.authorization.k8s.io/aggregate-to-edit: "true" + rbac.authorization.k8s.io/aggregate-to-view: "true" + name: flux-view-flux-system +rules: +- apiGroups: + - notification.toolkit.fluxcd.io + - source.toolkit.fluxcd.io + - helm.toolkit.fluxcd.io + - image.toolkit.fluxcd.io + - kustomize.toolkit.fluxcd.io + resources: + - '*' + verbs: + - get + - list + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: cluster-reconciler-flux-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: cluster-admin +subjects: +- kind: ServiceAccount + name: kustomize-controller + namespace: flux-system +- kind: ServiceAccount + name: helm-controller + namespace: flux-system +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: crd-controller-flux-system +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: crd-controller-flux-system +subjects: +- kind: ServiceAccount + name: kustomize-controller + namespace: flux-system +- kind: ServiceAccount + name: helm-controller + namespace: flux-system +- kind: ServiceAccount + name: source-controller + namespace: flux-system +- kind: ServiceAccount + name: notification-controller + namespace: flux-system +- kind: ServiceAccount + name: image-reflector-controller + namespace: flux-system +- kind: ServiceAccount + name: image-automation-controller + namespace: flux-system +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: buckets.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: Bucket + listKind: BucketList + plural: buckets + singular: bucket + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.endpoint + name: Endpoint + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 Bucket is deprecated, upgrade to v1beta2 + name: v1beta1 + schema: + openAPIV3Schema: + description: Bucket is the Schema for the buckets API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: BucketSpec defines the desired state of an S3 compatible + bucket + properties: + accessFrom: + description: AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + bucketName: + description: The bucket name. + type: string + endpoint: + description: The bucket endpoint address. + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + insecure: + description: Insecure allows connecting to a non-TLS S3 HTTP endpoint. + type: boolean + interval: + description: The interval at which to check for bucket updates. + type: string + provider: + default: generic + description: The S3 compatible storage provider name, default ('generic'). + enum: + - generic + - aws + - gcp + type: string + region: + description: The bucket region. + type: string + secretRef: + description: |- + The name of the secret containing authentication credentials + for the Bucket. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: The timeout for download operations, defaults to 60s. + type: string + required: + - bucketName + - endpoint + - interval + type: object + status: + default: + observedGeneration: -1 + description: BucketStatus defines the observed state of a bucket + properties: + artifact: + description: Artifact represents the output of the last successful + Bucket sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the Bucket. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the artifact output of the + last Bucket sync. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.endpoint + name: Endpoint + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1beta2 + schema: + openAPIV3Schema: + description: Bucket is the Schema for the buckets API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + BucketSpec specifies the required configuration to produce an Artifact for + an object storage bucket. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + bucketName: + description: BucketName is the name of the object storage bucket. + type: string + endpoint: + description: Endpoint is the object storage address the BucketName + is located at. + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + insecure: + description: Insecure allows connecting to a non-TLS HTTP Endpoint. + type: boolean + interval: + description: |- + Interval at which the Bucket Endpoint is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + prefix: + description: Prefix to use for server-side filtering of files in the + Bucket. + type: string + provider: + default: generic + description: |- + Provider of the object storage bucket. + Defaults to 'generic', which expects an S3 (API) compatible object + storage. + enum: + - generic + - aws + - gcp + - azure + type: string + region: + description: Region of the Endpoint where the BucketName is located + in. + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the Bucket. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + Bucket. + type: boolean + timeout: + default: 60s + description: Timeout for fetch operations, defaults to 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + required: + - bucketName + - endpoint + - interval + type: object + status: + default: + observedGeneration: -1 + description: BucketStatus records the observed state of a Bucket. + properties: + artifact: + description: Artifact represents the last successful Bucket reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the Bucket. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation of + the Bucket object. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + BucketStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: gitrepositories.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: GitRepository + listKind: GitRepositoryList + plural: gitrepositories + shortNames: + - gitrepo + singular: gitrepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: GitRepository is the Schema for the gitrepositories API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + GitRepositorySpec specifies the required configuration to produce an + Artifact for a Git repository. + properties: + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + include: + description: |- + Include specifies a list of GitRepository resources which Artifacts + should be included in the Artifact produced for this GitRepository. + items: + description: |- + GitRepositoryInclude specifies a local reference to a GitRepository which + Artifact (sub-)contents must be included, and where they should be placed. + properties: + fromPath: + description: |- + FromPath specifies the path to copy contents from, defaults to the root + of the Artifact. + type: string + repository: + description: |- + GitRepositoryRef specifies the GitRepository which Artifact contents + must be included. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: |- + ToPath specifies the path to copy contents to, defaults to the name of + the GitRepositoryRef. + type: string + required: + - repository + type: object + type: array + interval: + description: |- + Interval at which the GitRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + proxySecretRef: + description: |- + ProxySecretRef specifies the Secret containing the proxy configuration + to use while communicating with the Git server. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + recurseSubmodules: + description: |- + RecurseSubmodules enables the initialization of all submodules within + the GitRepository as cloned from the URL, using their default settings. + type: boolean + ref: + description: |- + Reference specifies the Git reference to resolve and monitor for + changes, defaults to the 'master' branch. + properties: + branch: + description: Branch to check out, defaults to 'master' if no other + field is defined. + type: string + commit: + description: |- + Commit SHA to check out, takes precedence over all reference fields. + + + This can be combined with Branch to shallow clone the branch, in which + the commit is expected to exist. + type: string + name: + description: |- + Name of the reference to check out; takes precedence over Branch, Tag and SemVer. + + + It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description + Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head" + type: string + semver: + description: SemVer tag expression to check out, takes precedence + over Tag. + type: string + tag: + description: Tag to check out, takes precedence over Branch. + type: string + type: object + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials for + the GitRepository. + For HTTPS repositories the Secret must contain 'username' and 'password' + fields for basic auth or 'bearerToken' field for token auth. + For SSH repositories the Secret must contain 'identity' + and 'known_hosts' fields. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + GitRepository. + type: boolean + timeout: + default: 60s + description: Timeout for Git operations like cloning, defaults to + 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + url: + description: URL specifies the Git repository URL, it can be an HTTP/S + or SSH address. + pattern: ^(http|https|ssh)://.*$ + type: string + verify: + description: |- + Verification specifies the configuration to verify the Git commit + signature(s). + properties: + mode: + default: HEAD + description: |- + Mode specifies which Git object(s) should be verified. + + + The variants "head" and "HEAD" both imply the same thing, i.e. verify + the commit that the HEAD of the Git repository points to. The variant + "head" solely exists to ensure backwards compatibility. + enum: + - head + - HEAD + - Tag + - TagAndHEAD + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing the public keys of trusted Git + authors. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - secretRef + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: GitRepositoryStatus records the observed state of a Git repository. + properties: + artifact: + description: Artifact represents the last successful GitRepository + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the GitRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + includedArtifacts: + description: |- + IncludedArtifacts contains a list of the last successfully included + Artifacts as instructed by GitRepositorySpec.Include. + items: + description: Artifact represents the output of a Source reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of + ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI + annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the GitRepository + object. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + observedInclude: + description: |- + ObservedInclude is the observed list of GitRepository resources used to + produce the current Artifact. + items: + description: |- + GitRepositoryInclude specifies a local reference to a GitRepository which + Artifact (sub-)contents must be included, and where they should be placed. + properties: + fromPath: + description: |- + FromPath specifies the path to copy contents from, defaults to the root + of the Artifact. + type: string + repository: + description: |- + GitRepositoryRef specifies the GitRepository which Artifact contents + must be included. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: |- + ToPath specifies the path to copy contents to, defaults to the name of + the GitRepositoryRef. + type: string + required: + - repository + type: object + type: array + observedRecurseSubmodules: + description: |- + ObservedRecurseSubmodules is the observed resource submodules + configuration used to produce the current Artifact. + type: boolean + sourceVerificationMode: + description: |- + SourceVerificationMode is the last used verification mode indicating + which Git object(s) have been verified. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 GitRepository is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: GitRepository is the Schema for the gitrepositories API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: GitRepositorySpec defines the desired state of a Git repository. + properties: + accessFrom: + description: AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + gitImplementation: + default: go-git + description: |- + Determines which git client library to use. + Defaults to go-git, valid values are ('go-git', 'libgit2'). + enum: + - go-git + - libgit2 + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + include: + description: Extra git repositories to map into the repository + items: + description: GitRepositoryInclude defines a source with a from and + to path. + properties: + fromPath: + description: The path to copy contents from, defaults to the + root directory. + type: string + repository: + description: Reference to a GitRepository to include. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: The path to copy contents to, defaults to the name + of the source ref. + type: string + required: + - repository + type: object + type: array + interval: + description: The interval at which to check for repository updates. + type: string + recurseSubmodules: + description: |- + When enabled, after the clone is created, initializes all submodules within, + using their default settings. + This option is available only when using the 'go-git' GitImplementation. + type: boolean + ref: + description: |- + The Git reference to checkout and monitor for changes, defaults to + master branch. + properties: + branch: + description: The Git branch to checkout, defaults to master. + type: string + commit: + description: The Git commit SHA to checkout, if specified Tag + filters will be ignored. + type: string + semver: + description: The Git tag semver expression, takes precedence over + Tag. + type: string + tag: + description: The Git tag to checkout, takes precedence over Branch. + type: string + type: object + secretRef: + description: |- + The secret name containing the Git credentials. + For HTTPS repositories the secret must contain username and password + fields. + For SSH repositories the secret must contain identity and known_hosts + fields. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: The timeout for remote Git operations like cloning, defaults + to 60s. + type: string + url: + description: The repository URL, can be a HTTP/S or SSH address. + pattern: ^(http|https|ssh)://.*$ + type: string + verify: + description: Verify OpenPGP signature for the Git commit HEAD points + to. + properties: + mode: + description: Mode describes what git object should be verified, + currently ('head'). + enum: + - head + type: string + secretRef: + description: The secret name containing the public keys of all + trusted Git authors. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - mode + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: GitRepositoryStatus defines the observed state of a Git repository. + properties: + artifact: + description: Artifact represents the output of the last successful + repository sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the GitRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + includedArtifacts: + description: IncludedArtifacts represents the included artifacts from + the last successful repository sync. + items: + description: Artifact represents the output of a source synchronisation. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: |- + URL is the download link for the artifact output of the last repository + sync. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 GitRepository is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: GitRepository is the Schema for the gitrepositories API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + GitRepositorySpec specifies the required configuration to produce an + Artifact for a Git repository. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + gitImplementation: + default: go-git + description: |- + GitImplementation specifies which Git client library implementation to + use. Defaults to 'go-git', valid values are ('go-git', 'libgit2'). + Deprecated: gitImplementation is deprecated now that 'go-git' is the + only supported implementation. + enum: + - go-git + - libgit2 + type: string + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + include: + description: |- + Include specifies a list of GitRepository resources which Artifacts + should be included in the Artifact produced for this GitRepository. + items: + description: |- + GitRepositoryInclude specifies a local reference to a GitRepository which + Artifact (sub-)contents must be included, and where they should be placed. + properties: + fromPath: + description: |- + FromPath specifies the path to copy contents from, defaults to the root + of the Artifact. + type: string + repository: + description: |- + GitRepositoryRef specifies the GitRepository which Artifact contents + must be included. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: |- + ToPath specifies the path to copy contents to, defaults to the name of + the GitRepositoryRef. + type: string + required: + - repository + type: object + type: array + interval: + description: Interval at which to check the GitRepository for updates. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + recurseSubmodules: + description: |- + RecurseSubmodules enables the initialization of all submodules within + the GitRepository as cloned from the URL, using their default settings. + type: boolean + ref: + description: |- + Reference specifies the Git reference to resolve and monitor for + changes, defaults to the 'master' branch. + properties: + branch: + description: Branch to check out, defaults to 'master' if no other + field is defined. + type: string + commit: + description: |- + Commit SHA to check out, takes precedence over all reference fields. + + + This can be combined with Branch to shallow clone the branch, in which + the commit is expected to exist. + type: string + name: + description: |- + Name of the reference to check out; takes precedence over Branch, Tag and SemVer. + + + It must be a valid Git reference: https://git-scm.com/docs/git-check-ref-format#_description + Examples: "refs/heads/main", "refs/tags/v0.1.0", "refs/pull/420/head", "refs/merge-requests/1/head" + type: string + semver: + description: SemVer tag expression to check out, takes precedence + over Tag. + type: string + tag: + description: Tag to check out, takes precedence over Branch. + type: string + type: object + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials for + the GitRepository. + For HTTPS repositories the Secret must contain 'username' and 'password' + fields for basic auth or 'bearerToken' field for token auth. + For SSH repositories the Secret must contain 'identity' + and 'known_hosts' fields. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + GitRepository. + type: boolean + timeout: + default: 60s + description: Timeout for Git operations like cloning, defaults to + 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + url: + description: URL specifies the Git repository URL, it can be an HTTP/S + or SSH address. + pattern: ^(http|https|ssh)://.*$ + type: string + verify: + description: |- + Verification specifies the configuration to verify the Git commit + signature(s). + properties: + mode: + description: Mode specifies what Git object should be verified, + currently ('head'). + enum: + - head + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing the public keys of trusted Git + authors. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - mode + - secretRef + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: GitRepositoryStatus records the observed state of a Git repository. + properties: + artifact: + description: Artifact represents the last successful GitRepository + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the GitRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + contentConfigChecksum: + description: |- + ContentConfigChecksum is a checksum of all the configurations related to + the content of the source artifact: + - .spec.ignore + - .spec.recurseSubmodules + - .spec.included and the checksum of the included artifacts + observed in .status.observedGeneration version of the object. This can + be used to determine if the content of the included repository has + changed. + It has the format of `:`, for example: `sha256:`. + + + Deprecated: Replaced with explicit fields for observed artifact content + config in the status. + type: string + includedArtifacts: + description: |- + IncludedArtifacts contains a list of the last successfully included + Artifacts as instructed by GitRepositorySpec.Include. + items: + description: Artifact represents the output of a Source reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of + ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI + annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the GitRepository + object. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + observedInclude: + description: |- + ObservedInclude is the observed list of GitRepository resources used to + to produce the current Artifact. + items: + description: |- + GitRepositoryInclude specifies a local reference to a GitRepository which + Artifact (sub-)contents must be included, and where they should be placed. + properties: + fromPath: + description: |- + FromPath specifies the path to copy contents from, defaults to the root + of the Artifact. + type: string + repository: + description: |- + GitRepositoryRef specifies the GitRepository which Artifact contents + must be included. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + toPath: + description: |- + ToPath specifies the path to copy contents to, defaults to the name of + the GitRepositoryRef. + type: string + required: + - repository + type: object + type: array + observedRecurseSubmodules: + description: |- + ObservedRecurseSubmodules is the observed resource submodules + configuration used to produce the current Artifact. + type: boolean + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + GitRepositoryStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: helmcharts.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: HelmChart + listKind: HelmChartList + plural: helmcharts + shortNames: + - hc + singular: helmchart + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.chart + name: Chart + type: string + - jsonPath: .spec.version + name: Version + type: string + - jsonPath: .spec.sourceRef.kind + name: Source Kind + type: string + - jsonPath: .spec.sourceRef.name + name: Source Name + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: HelmChart is the Schema for the helmcharts API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmChartSpec specifies the desired state of a Helm chart. + properties: + chart: + description: |- + Chart is the name or path the Helm chart is available at in the + SourceRef. + type: string + ignoreMissingValuesFiles: + description: |- + IgnoreMissingValuesFiles controls whether to silently ignore missing values + files rather than failing. + type: boolean + interval: + description: |- + Interval at which the HelmChart SourceRef is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + ReconcileStrategy determines what enables the creation of a new artifact. + Valid values are ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: SourceRef is the reference to the Source the chart is + available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: |- + Kind of the referent, valid values are ('HelmRepository', 'GitRepository', + 'Bucket'). + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + required: + - kind + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + source. + type: boolean + valuesFiles: + description: |- + ValuesFiles is an alternative list of values files to use as the chart + values (values.yaml is not included by default), expected to be a + relative path in the SourceRef. + Values files are merged in the order of this list with the last file + overriding the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported when using HelmRepository source with spec.type 'oci'. + Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified. + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity specifies the identity matching criteria to use + while verifying an OCI artifact which was signed using Cosign keyless + signing. The artifact's identity is deemed to be verified if any of the + specified matchers match against the identity. + items: + description: |- + OIDCIdentityMatch specifies options for verifying the certificate identity, + i.e. the issuer and the subject of the certificate. + properties: + issuer: + description: |- + Issuer specifies the regex pattern to match against to verify + the OIDC issuer in the Fulcio certificate. The pattern must be a + valid Go regular expression. + type: string + subject: + description: |- + Subject specifies the regex pattern to match against to verify + the identity subject in the Fulcio certificate. The pattern must + be a valid Go regular expression. + type: string + required: + - issuer + - subject + type: object + type: array + provider: + default: cosign + description: Provider specifies the technology used to sign the + OCI Artifact. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: '*' + description: |- + Version is the chart version semver expression, ignored for charts from + GitRepository and Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - interval + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: HelmChartStatus records the observed state of the HelmChart. + properties: + artifact: + description: Artifact represents the output of the last successful + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmChart. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedChartName: + description: |- + ObservedChartName is the last observed chart name as specified by the + resolved chart reference. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the HelmChart + object. + format: int64 + type: integer + observedSourceArtifactRevision: + description: |- + ObservedSourceArtifactRevision is the last observed Artifact.Revision + of the HelmChartSpec.SourceRef. + type: string + observedValuesFiles: + description: |- + ObservedValuesFiles are the observed value files of the last successful + reconciliation. + It matches the chart in the last successfully reconciled artifact. + items: + type: string + type: array + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + BucketStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.chart + name: Chart + type: string + - jsonPath: .spec.version + name: Version + type: string + - jsonPath: .spec.sourceRef.kind + name: Source Kind + type: string + - jsonPath: .spec.sourceRef.name + name: Source Name + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 HelmChart is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: HelmChart is the Schema for the helmcharts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmChartSpec defines the desired state of a Helm chart. + properties: + accessFrom: + description: AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + chart: + description: The name or path the Helm chart is available at in the + SourceRef. + type: string + interval: + description: The interval at which to check the Source for updates. + type: string + reconcileStrategy: + default: ChartVersion + description: |- + Determines what enables the creation of a new artifact. Valid values are + ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: The reference to the Source the chart is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: |- + Kind of the referent, valid values are ('HelmRepository', 'GitRepository', + 'Bucket'). + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + required: + - kind + - name + type: object + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + valuesFile: + description: |- + Alternative values file to use as the default chart values, expected to + be a relative path in the SourceRef. Deprecated in favor of ValuesFiles, + for backwards compatibility the file defined here is merged before the + ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: |- + Alternative list of values files to use as the chart values (values.yaml + is not included by default), expected to be a relative path in the SourceRef. + Values files are merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + version: + default: '*' + description: |- + The chart version semver expression, ignored for charts from GitRepository + and Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - interval + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: HelmChartStatus defines the observed state of the HelmChart. + properties: + artifact: + description: Artifact represents the output of the last successful + chart sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmChart. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the last chart pulled. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.chart + name: Chart + type: string + - jsonPath: .spec.version + name: Version + type: string + - jsonPath: .spec.sourceRef.kind + name: Source Kind + type: string + - jsonPath: .spec.sourceRef.name + name: Source Name + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 HelmChart is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: HelmChart is the Schema for the helmcharts API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmChartSpec specifies the desired state of a Helm chart. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + chart: + description: |- + Chart is the name or path the Helm chart is available at in the + SourceRef. + type: string + ignoreMissingValuesFiles: + description: |- + IgnoreMissingValuesFiles controls whether to silently ignore missing values + files rather than failing. + type: boolean + interval: + description: |- + Interval at which the HelmChart SourceRef is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + ReconcileStrategy determines what enables the creation of a new artifact. + Valid values are ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: SourceRef is the reference to the Source the chart is + available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: |- + Kind of the referent, valid values are ('HelmRepository', 'GitRepository', + 'Bucket'). + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + required: + - kind + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + source. + type: boolean + valuesFile: + description: |- + ValuesFile is an alternative values file to use as the default chart + values, expected to be a relative path in the SourceRef. Deprecated in + favor of ValuesFiles, for backwards compatibility the file specified here + is merged before the ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: |- + ValuesFiles is an alternative list of values files to use as the chart + values (values.yaml is not included by default), expected to be a + relative path in the SourceRef. + Values files are merged in the order of this list with the last file + overriding the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported when using HelmRepository source with spec.type 'oci'. + Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified. + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity specifies the identity matching criteria to use + while verifying an OCI artifact which was signed using Cosign keyless + signing. The artifact's identity is deemed to be verified if any of the + specified matchers match against the identity. + items: + description: |- + OIDCIdentityMatch specifies options for verifying the certificate identity, + i.e. the issuer and the subject of the certificate. + properties: + issuer: + description: |- + Issuer specifies the regex pattern to match against to verify + the OIDC issuer in the Fulcio certificate. The pattern must be a + valid Go regular expression. + type: string + subject: + description: |- + Subject specifies the regex pattern to match against to verify + the identity subject in the Fulcio certificate. The pattern must + be a valid Go regular expression. + type: string + required: + - issuer + - subject + type: object + type: array + provider: + default: cosign + description: Provider specifies the technology used to sign the + OCI Artifact. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: '*' + description: |- + Version is the chart version semver expression, ignored for charts from + GitRepository and Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - interval + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: HelmChartStatus records the observed state of the HelmChart. + properties: + artifact: + description: Artifact represents the output of the last successful + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmChart. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedChartName: + description: |- + ObservedChartName is the last observed chart name as specified by the + resolved chart reference. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the HelmChart + object. + format: int64 + type: integer + observedSourceArtifactRevision: + description: |- + ObservedSourceArtifactRevision is the last observed Artifact.Revision + of the HelmChartSpec.SourceRef. + type: string + observedValuesFiles: + description: |- + ObservedValuesFiles are the observed value files of the last successful + reconciliation. + It matches the chart in the last successfully reconciled artifact. + items: + type: string + type: array + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + BucketStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: helmrepositories.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: HelmRepository + listKind: HelmRepositoryList + plural: helmrepositories + shortNames: + - helmrepo + singular: helmrepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: HelmRepository is the Schema for the helmrepositories API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + HelmRepositorySpec specifies the required configuration to produce an + Artifact for a Helm repository index YAML. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + + and whichever are supplied, will be used for connecting to the + registry. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + + It takes precedence over the values specified in the Secret referred + to by `.spec.secretRef`. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + insecure: + description: |- + Insecure allows connecting to a non-TLS HTTP container registry. + This field is only taken into account if the .spec.type field is set to 'oci'. + type: boolean + interval: + description: |- + Interval at which the HelmRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + passCredentials: + description: |- + PassCredentials allows the credentials from the SecretRef to be passed + on to a host that does not match the host as defined in URL. + This may be required if the host of the advertised chart URLs in the + index differ from the defined URL. + Enabling this should be done with caution, as it can potentially result + in credentials getting stolen in a MITM-attack. + type: boolean + provider: + default: generic + description: |- + Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. + This field is optional, and only taken into account if the .spec.type field is set to 'oci'. + When not specified, defaults to 'generic'. + enum: + - generic + - aws + - azure + - gcp + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the HelmRepository. + For HTTP/S basic auth the secret must contain 'username' and 'password' + fields. + Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile' + keys is deprecated. Please use `.spec.certSecretRef` instead. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + HelmRepository. + type: boolean + timeout: + description: |- + Timeout is used for the index fetch operation for an HTTPS helm repository, + and for remote OCI Repository operations like pulling for an OCI helm + chart by the associated HelmChart. + Its default value is 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: |- + Type of the HelmRepository. + When this field is set to "oci", the URL field value must be prefixed with "oci://". + enum: + - default + - oci + type: string + url: + description: |- + URL of the Helm repository, a valid URL contains at least a protocol and + host. + pattern: ^(http|https|oci)://.*$ + type: string + required: + - url + type: object + status: + default: + observedGeneration: -1 + description: HelmRepositoryStatus records the observed state of the HelmRepository. + properties: + artifact: + description: Artifact represents the last successful HelmRepository + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the HelmRepository + object. + format: int64 + type: integer + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + HelmRepositoryStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 HelmRepository is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: HelmRepository is the Schema for the helmrepositories API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmRepositorySpec defines the reference to a Helm repository. + properties: + accessFrom: + description: AccessFrom defines an Access Control List for allowing + cross-namespace references to this object. + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + interval: + description: The interval at which to check the upstream for updates. + type: string + passCredentials: + description: |- + PassCredentials allows the credentials from the SecretRef to be passed on to + a host that does not match the host as defined in URL. + This may be required if the host of the advertised chart URLs in the index + differ from the defined URL. + Enabling this should be done with caution, as it can potentially result in + credentials getting stolen in a MITM-attack. + type: boolean + secretRef: + description: |- + The name of the secret containing authentication credentials for the Helm + repository. + For HTTP/S basic auth the secret must contain username and + password fields. + For TLS the secret must contain a certFile and keyFile, and/or + caFile fields. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: The timeout of index downloading, defaults to 60s. + type: string + url: + description: The Helm repository URL, a valid URL contains at least + a protocol and host. + type: string + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: HelmRepositoryStatus defines the observed state of the HelmRepository. + properties: + artifact: + description: Artifact represents the output of the last successful + repository sync. + properties: + checksum: + description: Checksum is the SHA256 checksum of the artifact. + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of this + artifact. + format: date-time + type: string + path: + description: Path is the relative file path of this artifact. + type: string + revision: + description: |- + Revision is a human readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm index timestamp, a Helm + chart version, etc. + type: string + url: + description: URL is the HTTP address of this artifact. + type: string + required: + - path + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: URL is the download link for the last index fetched. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 HelmRepository is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: HelmRepository is the Schema for the helmrepositories API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + HelmRepositorySpec specifies the required configuration to produce an + Artifact for a Helm repository index YAML. + properties: + accessFrom: + description: |- + AccessFrom specifies an Access Control List for allowing cross-namespace + references to this object. + NOTE: Not implemented, provisional as of https://github.com/fluxcd/flux2/pull/2092 + properties: + namespaceSelectors: + description: |- + NamespaceSelectors is the list of namespace selectors to which this ACL applies. + Items in this list are evaluated using a logical OR operation. + items: + description: |- + NamespaceSelector selects the namespaces to which this ACL applies. + An empty map of MatchLabels matches all namespaces in a cluster. + properties: + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + type: array + required: + - namespaceSelectors + type: object + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + + and whichever are supplied, will be used for connecting to the + registry. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + + It takes precedence over the values specified in the Secret referred + to by `.spec.secretRef`. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + insecure: + description: |- + Insecure allows connecting to a non-TLS HTTP container registry. + This field is only taken into account if the .spec.type field is set to 'oci'. + type: boolean + interval: + description: |- + Interval at which the HelmRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + passCredentials: + description: |- + PassCredentials allows the credentials from the SecretRef to be passed + on to a host that does not match the host as defined in URL. + This may be required if the host of the advertised chart URLs in the + index differ from the defined URL. + Enabling this should be done with caution, as it can potentially result + in credentials getting stolen in a MITM-attack. + type: boolean + provider: + default: generic + description: |- + Provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. + This field is optional, and only taken into account if the .spec.type field is set to 'oci'. + When not specified, defaults to 'generic'. + enum: + - generic + - aws + - azure + - gcp + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing authentication credentials + for the HelmRepository. + For HTTP/S basic auth the secret must contain 'username' and 'password' + fields. + Support for TLS auth using the 'certFile' and 'keyFile', and/or 'caFile' + keys is deprecated. Please use `.spec.certSecretRef` instead. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend the reconciliation of this + HelmRepository. + type: boolean + timeout: + description: |- + Timeout is used for the index fetch operation for an HTTPS helm repository, + and for remote OCI Repository operations like pulling for an OCI helm + chart by the associated HelmChart. + Its default value is 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: |- + Type of the HelmRepository. + When this field is set to "oci", the URL field value must be prefixed with "oci://". + enum: + - default + - oci + type: string + url: + description: |- + URL of the Helm repository, a valid URL contains at least a protocol and + host. + pattern: ^(http|https|oci)://.*$ + type: string + required: + - url + type: object + status: + default: + observedGeneration: -1 + description: HelmRepositoryStatus records the observed state of the HelmRepository. + properties: + artifact: + description: Artifact represents the last successful HelmRepository + reconciliation. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the HelmRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: |- + ObservedGeneration is the last observed generation of the HelmRepository + object. + format: int64 + type: integer + url: + description: |- + URL is the dynamic fetch link for the latest Artifact. + It is provided on a "best effort" basis, and using the precise + HelmRepositoryStatus.Artifact data is recommended. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: ocirepositories.source.toolkit.fluxcd.io +spec: + group: source.toolkit.fluxcd.io + names: + kind: OCIRepository + listKind: OCIRepositoryList + plural: ocirepositories + shortNames: + - ocirepo + singular: ocirepository + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.url + name: URL + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta2 + schema: + openAPIV3Schema: + description: OCIRepository is the Schema for the ocirepositories API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: OCIRepositorySpec defines the desired state of OCIRepository + properties: + certSecretRef: + description: |- + CertSecretRef can be given the name of a Secret containing + either or both of + + + - a PEM-encoded client certificate (`tls.crt`) and private + key (`tls.key`); + - a PEM-encoded CA certificate (`ca.crt`) + + + and whichever are supplied, will be used for connecting to the + registry. The client cert and key are useful if you are + authenticating with a certificate; the CA cert is useful if + you are using a self-signed server certificate. The Secret must + be of type `Opaque` or `kubernetes.io/tls`. + + + Note: Support for the `caFile`, `certFile` and `keyFile` keys have + been deprecated. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + ignore: + description: |- + Ignore overrides the set of excluded patterns in the .sourceignore format + (which is the same as .gitignore). If not provided, a default will be used, + consult the documentation for your version to find out what those are. + type: string + insecure: + description: Insecure allows connecting to a non-TLS HTTP container + registry. + type: boolean + interval: + description: |- + Interval at which the OCIRepository URL is checked for updates. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + layerSelector: + description: |- + LayerSelector specifies which layer should be extracted from the OCI artifact. + When not specified, the first layer found in the artifact is selected. + properties: + mediaType: + description: |- + MediaType specifies the OCI media type of the layer + which should be extracted from the OCI Artifact. The + first layer matching this type is selected. + type: string + operation: + description: |- + Operation specifies how the selected layer should be processed. + By default, the layer compressed content is extracted to storage. + When the operation is set to 'copy', the layer compressed content + is persisted to storage as it is. + enum: + - extract + - copy + type: string + type: object + provider: + default: generic + description: |- + The provider used for authentication, can be 'aws', 'azure', 'gcp' or 'generic'. + When not specified, defaults to 'generic'. + enum: + - generic + - aws + - azure + - gcp + type: string + ref: + description: |- + The OCI reference to pull and monitor for changes, + defaults to the latest tag. + properties: + digest: + description: |- + Digest is the image digest to pull, takes precedence over SemVer. + The value should be in the format 'sha256:'. + type: string + semver: + description: |- + SemVer is the range of tags to pull selecting the latest within + the range, takes precedence over Tag. + type: string + semverFilter: + description: SemverFilter is a regex pattern to filter the tags + within the SemVer range. + type: string + tag: + description: Tag is the image tag to pull, defaults to latest. + type: string + type: object + secretRef: + description: |- + SecretRef contains the secret name containing the registry login + credentials to resolve image metadata. + The secret must be of type kubernetes.io/dockerconfigjson. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate + the image pull if the service account has attached pull secrets. For more information: + https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#add-imagepullsecrets-to-a-service-account + type: string + suspend: + description: This flag tells the controller to suspend the reconciliation + of this source. + type: boolean + timeout: + default: 60s + description: The timeout for remote OCI Repository operations like + pulling, defaults to 60s. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + url: + description: |- + URL is a reference to an OCI artifact repository hosted + on a remote container registry. + pattern: ^oci://.*$ + type: string + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + properties: + matchOIDCIdentity: + description: |- + MatchOIDCIdentity specifies the identity matching criteria to use + while verifying an OCI artifact which was signed using Cosign keyless + signing. The artifact's identity is deemed to be verified if any of the + specified matchers match against the identity. + items: + description: |- + OIDCIdentityMatch specifies options for verifying the certificate identity, + i.e. the issuer and the subject of the certificate. + properties: + issuer: + description: |- + Issuer specifies the regex pattern to match against to verify + the OIDC issuer in the Fulcio certificate. The pattern must be a + valid Go regular expression. + type: string + subject: + description: |- + Subject specifies the regex pattern to match against to verify + the identity subject in the Fulcio certificate. The pattern must + be a valid Go regular expression. + type: string + required: + - issuer + - subject + type: object + type: array + provider: + default: cosign + description: Provider specifies the technology used to sign the + OCI Artifact. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + required: + - interval + - url + type: object + status: + default: + observedGeneration: -1 + description: OCIRepositoryStatus defines the observed state of OCIRepository + properties: + artifact: + description: Artifact represents the output of the last successful + OCI Repository sync. + properties: + digest: + description: Digest is the digest of the file in the form of ':'. + pattern: ^[a-z0-9]+(?:[.+_-][a-z0-9]+)*:[a-zA-Z0-9=_-]+$ + type: string + lastUpdateTime: + description: |- + LastUpdateTime is the timestamp corresponding to the last update of the + Artifact. + format: date-time + type: string + metadata: + additionalProperties: + type: string + description: Metadata holds upstream information such as OCI annotations. + type: object + path: + description: |- + Path is the relative file path of the Artifact. It can be used to locate + the file in the root of the Artifact storage on the local file system of + the controller managing the Source. + type: string + revision: + description: |- + Revision is a human-readable identifier traceable in the origin source + system. It can be a Git commit SHA, Git tag, a Helm chart version, etc. + type: string + size: + description: Size is the number of bytes in the file. + format: int64 + type: integer + url: + description: |- + URL is the HTTP address of the Artifact as exposed by the controller + managing the Source. It can be used to retrieve the Artifact for + consumption, e.g. by another controller applying the Artifact contents. + type: string + required: + - lastUpdateTime + - path + - revision + - url + type: object + conditions: + description: Conditions holds the conditions for the OCIRepository. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + contentConfigChecksum: + description: |- + ContentConfigChecksum is a checksum of all the configurations related to + the content of the source artifact: + - .spec.ignore + - .spec.layerSelector + observed in .status.observedGeneration version of the object. This can + be used to determine if the content configuration has changed and the + artifact needs to be rebuilt. + It has the format of `:`, for example: `sha256:`. + + + Deprecated: Replaced with explicit fields for observed artifact content + config in the status. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + observedIgnore: + description: |- + ObservedIgnore is the observed exclusion patterns used for constructing + the source artifact. + type: string + observedLayerSelector: + description: |- + ObservedLayerSelector is the observed layer selector used for constructing + the source artifact. + properties: + mediaType: + description: |- + MediaType specifies the OCI media type of the layer + which should be extracted from the OCI Artifact. The + first layer matching this type is selected. + type: string + operation: + description: |- + Operation specifies how the selected layer should be processed. + By default, the layer compressed content is extracted to storage. + When the operation is set to 'copy', the layer compressed content + is persisted to storage as it is. + enum: + - extract + - copy + type: string + type: object + url: + description: URL is the download link for the artifact output of the + last OCI Repository sync. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: source-controller + namespace: flux-system +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + control-plane: controller + name: source-controller + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http + selector: + app: source-controller + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: source-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + control-plane: controller + name: source-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: source-controller + strategy: + type: Recreate + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: source-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local./ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + - --storage-path=/data + - --storage-adv-addr=source-controller.$(RUNTIME_NAMESPACE).svc.cluster.local. + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: TUF_ROOT + value: /tmp/.sigstore + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.memory + image: ghcr.io/fluxcd/source-controller:v1.3.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9090 + name: http + protocol: TCP + - containerPort: 8080 + name: http-prom + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: / + port: http + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 50m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /data + name: data + - mountPath: /tmp + name: tmp + nodeSelector: + kubernetes.io/os: linux + priorityClassName: system-cluster-critical + securityContext: + fsGroup: 1337 + serviceAccountName: source-controller + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: data + - emptyDir: {} + name: tmp +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: kustomize-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: kustomizations.kustomize.toolkit.fluxcd.io +spec: + group: kustomize.toolkit.fluxcd.io + names: + kind: Kustomization + listKind: KustomizationList + plural: kustomizations + shortNames: + - ks + singular: kustomization + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: Kustomization is the Schema for the kustomizations API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: |- + KustomizationSpec defines the configuration to calculate the desired state + from a Source using Kustomize. + properties: + commonMetadata: + description: |- + CommonMetadata specifies the common labels and annotations that are + applied to all resources. Any existing label or annotation will be + overridden if its key matches a common one. + properties: + annotations: + additionalProperties: + type: string + description: Annotations to be added to the object's metadata. + type: object + labels: + additionalProperties: + type: string + description: Labels to be added to the object's metadata. + type: object + type: object + components: + description: Components specifies relative paths to specifications + of other Components. + items: + type: string + type: array + decryption: + description: Decrypt Kubernetes secrets before applying them on the + cluster. + properties: + provider: + description: Provider is the name of the decryption engine. + enum: + - sops + type: string + secretRef: + description: The secret name containing the private OpenPGP keys + used for decryption. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice + with references to Kustomization resources that must be ready before this + Kustomization can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + force: + default: false + description: |- + Force instructs the controller to recreate resources + when patching fails due to an immutable field change. + type: boolean + healthChecks: + description: A list of resources to be included in the health assessment. + items: + description: |- + NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object + in any namespace. + properties: + apiVersion: + description: API version of the referent, if not specified the + Kubernetes preferred version will be used. + type: string + kind: + description: Kind of the referent. + type: string + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - kind + - name + type: object + type: array + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: Image contains an image name, a new name, a new tag + or digest, which will replace the original name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace the original + name. + type: string + newTag: + description: NewTag is the value used to replace the original + tag. + type: string + required: + - name + type: object + type: array + interval: + description: |- + The interval at which to reconcile the Kustomization. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + The KubeConfig for reconciling the Kustomization on a remote cluster. + When used in combination with KustomizationSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when KustomizationSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + namePrefix: + description: NamePrefix will prefix the names of all managed resources. + maxLength: 200 + minLength: 1 + type: string + nameSuffix: + description: NameSuffix will suffix the names of all managed resources. + maxLength: 200 + minLength: 1 + type: string + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + type: string + postBuild: + description: |- + PostBuild describes which actions to perform on the YAML manifest + generated by building the kustomize overlay. + properties: + substitute: + additionalProperties: + type: string + description: |- + Substitute holds a map of key/value pairs. + The variables defined in your YAML manifests that match any of the keys + defined in the map will be substituted with the set value. + Includes support for bash string replacement functions + e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}. + type: object + substituteFrom: + description: |- + SubstituteFrom holds references to ConfigMaps and Secrets containing + the variables and their values to be substituted in the YAML manifests. + The ConfigMap and the Secret data keys represent the var names, and they + must match the vars declared in the manifests for the substitution to + happen. + items: + description: |- + SubstituteReference contains a reference to a resource containing + the variables name and value. + properties: + kind: + description: Kind of the values referent, valid values are + ('Secret', 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + default: false + description: |- + Optional indicates whether the referenced resource must exist, or whether to + tolerate its absence. If true and the referenced resource is absent, proceed + as if the resource was present but empty, without any variables defined. + type: boolean + required: + - kind + - name + type: object + type: array + type: object + prune: + description: Prune enables garbage collection. + type: boolean + retryInterval: + description: |- + The interval at which to retry a previously failed reconciliation. + When not specified, the controller uses the KustomizationSpec.Interval + value to retry failures. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this Kustomization. + type: string + sourceRef: + description: Reference of the source where the kustomization file + is. + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + namespace: + description: |- + Namespace of the referent, defaults to the namespace of the Kubernetes + resource object that contains the reference. + type: string + required: + - kind + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent kustomize executions, + it does not apply to already started executions. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + timeout: + description: |- + Timeout for validation, apply and health checking operations. + Defaults to 'Interval' duration. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + wait: + description: |- + Wait instructs the controller to check the health of all the reconciled + resources. When enabled, the HealthChecks are ignored. Defaults to false. + type: boolean + required: + - interval + - prune + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: KustomizationStatus defines the observed state of a kustomization. + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + inventory: + description: |- + Inventory contains the list of Kubernetes resource object references that + have been successfully applied. + properties: + entries: + description: Entries of Kubernetes resource object references. + items: + description: ResourceRef contains the information necessary + to locate a resource within a cluster. + properties: + id: + description: |- + ID is the string representation of the Kubernetes resource object's metadata, + in the format '___'. + type: string + v: + description: Version is the API version of the Kubernetes + resource object's kind. + type: string + required: + - id + - v + type: object + type: array + required: + - entries + type: object + lastAppliedRevision: + description: |- + The last successfully applied revision. + Equals the Revision of the applied Artifact from the referenced Source. + type: string + lastAttemptedRevision: + description: LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + deprecated: true + deprecationWarning: v1beta1 Kustomization is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: Kustomization is the Schema for the kustomizations API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: KustomizationSpec defines the desired state of a kustomization. + properties: + decryption: + description: Decrypt Kubernetes secrets before applying them on the + cluster. + properties: + provider: + description: Provider is the name of the decryption engine. + enum: + - sops + type: string + secretRef: + description: The secret name containing the private OpenPGP keys + used for decryption. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice + with references to Kustomization resources that must be ready before this + Kustomization can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + force: + default: false + description: |- + Force instructs the controller to recreate resources + when patching fails due to an immutable field change. + type: boolean + healthChecks: + description: A list of resources to be included in the health assessment. + items: + description: |- + NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object + in any namespace. + properties: + apiVersion: + description: API version of the referent, if not specified the + Kubernetes preferred version will be used. + type: string + kind: + description: Kind of the referent. + type: string + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - kind + - name + type: object + type: array + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: Image contains an image name, a new name, a new tag + or digest, which will replace the original name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace the original + name. + type: string + newTag: + description: NewTag is the value used to replace the original + tag. + type: string + required: + - name + type: object + type: array + interval: + description: The interval at which to reconcile the Kustomization. + type: string + kubeConfig: + description: |- + The KubeConfig for reconciling the Kustomization on a remote cluster. + When specified, KubeConfig takes precedence over ServiceAccountName. + properties: + secretRef: + description: |- + SecretRef holds the name to a secret that contains a 'value' key with + the kubeconfig file as the value. It must be in the same namespace as + the Kustomization. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + the Kustomization. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + type: object + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + patchesJson6902: + description: JSON 6902 patches, defined as inline YAML objects. + items: + description: JSON6902Patch contains a JSON6902 patch and the target + the patch should be applied to. + properties: + patch: + description: Patch contains the JSON6902 patch document with + an array of operation objects. + items: + description: |- + JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: |- + From contains a JSON-pointer value that references a location within the target document where the operation is + performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. + type: string + op: + description: |- + Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or + "test". + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: |- + Path contains the JSON-pointer value that references a location within the target document where the operation + is performed. The meaning of the value depends on the value of Op. + type: string + value: + description: |- + Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into + account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: Strategic merge patches, defined as inline YAML objects. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + type: string + postBuild: + description: |- + PostBuild describes which actions to perform on the YAML manifest + generated by building the kustomize overlay. + properties: + substitute: + additionalProperties: + type: string + description: |- + Substitute holds a map of key/value pairs. + The variables defined in your YAML manifests + that match any of the keys defined in the map + will be substituted with the set value. + Includes support for bash string replacement functions + e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}. + type: object + substituteFrom: + description: |- + SubstituteFrom holds references to ConfigMaps and Secrets containing + the variables and their values to be substituted in the YAML manifests. + The ConfigMap and the Secret data keys represent the var names and they + must match the vars declared in the manifests for the substitution to happen. + items: + description: |- + SubstituteReference contains a reference to a resource containing + the variables name and value. + properties: + kind: + description: Kind of the values referent, valid values are + ('Secret', 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + type: object + prune: + description: Prune enables garbage collection. + type: boolean + retryInterval: + description: |- + The interval at which to retry a previously failed reconciliation. + When not specified, the controller uses the KustomizationSpec.Interval + value to retry failures. + type: string + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this Kustomization. + type: string + sourceRef: + description: Reference of the source where the kustomization file + is. + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - GitRepository + - Bucket + type: string + name: + description: Name of the referent + type: string + namespace: + description: Namespace of the referent, defaults to the Kustomization + namespace + type: string + required: + - kind + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent kustomize executions, + it does not apply to already started executions. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + timeout: + description: |- + Timeout for validation, apply and health checking operations. + Defaults to 'Interval' duration. + type: string + validation: + description: |- + Validate the Kubernetes objects before applying them on the cluster. + The validation strategy can be 'client' (local dry-run), 'server' + (APIServer dry-run) or 'none'. + When 'Force' is 'true', validation will fallback to 'client' if set to + 'server' because server-side validation is not supported in this scenario. + enum: + - none + - client + - server + type: string + required: + - interval + - prune + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: KustomizationStatus defines the observed state of a kustomization. + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastAppliedRevision: + description: |- + The last successfully applied revision. + The revision format for Git sources is /. + type: string + lastAttemptedRevision: + description: LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + snapshot: + description: The last successfully applied revision metadata. + properties: + checksum: + description: The manifests sha1 checksum. + type: string + entries: + description: A list of Kubernetes kinds grouped by namespace. + items: + description: |- + Snapshot holds the metadata of namespaced + Kubernetes objects + properties: + kinds: + additionalProperties: + type: string + description: The list of Kubernetes kinds. + type: object + namespace: + description: The namespace of this entry. + type: string + required: + - kinds + type: object + type: array + required: + - checksum + - entries + type: object + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Kustomization is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: Kustomization is the Schema for the kustomizations API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: KustomizationSpec defines the configuration to calculate + the desired state from a Source using Kustomize. + properties: + commonMetadata: + description: |- + CommonMetadata specifies the common labels and annotations that are applied to all resources. + Any existing label or annotation will be overridden if its key matches a common one. + properties: + annotations: + additionalProperties: + type: string + description: Annotations to be added to the object's metadata. + type: object + labels: + additionalProperties: + type: string + description: Labels to be added to the object's metadata. + type: object + type: object + components: + description: Components specifies relative paths to specifications + of other Components. + items: + type: string + type: array + decryption: + description: Decrypt Kubernetes secrets before applying them on the + cluster. + properties: + provider: + description: Provider is the name of the decryption engine. + enum: + - sops + type: string + secretRef: + description: The secret name containing the private OpenPGP keys + used for decryption. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice + with references to Kustomization resources that must be ready before this + Kustomization can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + force: + default: false + description: |- + Force instructs the controller to recreate resources + when patching fails due to an immutable field change. + type: boolean + healthChecks: + description: A list of resources to be included in the health assessment. + items: + description: |- + NamespacedObjectKindReference contains enough information to locate the typed referenced Kubernetes resource object + in any namespace. + properties: + apiVersion: + description: API version of the referent, if not specified the + Kubernetes preferred version will be used. + type: string + kind: + description: Kind of the referent. + type: string + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - kind + - name + type: object + type: array + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: Image contains an image name, a new name, a new tag + or digest, which will replace the original name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace the original + name. + type: string + newTag: + description: NewTag is the value used to replace the original + tag. + type: string + required: + - name + type: object + type: array + interval: + description: The interval at which to reconcile the Kustomization. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + The KubeConfig for reconciling the Kustomization on a remote cluster. + When used in combination with KustomizationSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when KustomizationSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + patchesJson6902: + description: |- + JSON 6902 patches, defined as inline YAML objects. + Deprecated: Use Patches instead. + items: + description: JSON6902Patch contains a JSON6902 patch and the target + the patch should be applied to. + properties: + patch: + description: Patch contains the JSON6902 patch document with + an array of operation objects. + items: + description: |- + JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: |- + From contains a JSON-pointer value that references a location within the target document where the operation is + performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. + type: string + op: + description: |- + Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or + "test". + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: |- + Path contains the JSON-pointer value that references a location within the target document where the operation + is performed. The meaning of the value depends on the value of Op. + type: string + value: + description: |- + Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into + account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: Target points to the resources that the patch document + should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: |- + Strategic merge patches, defined as inline YAML objects. + Deprecated: Use Patches instead. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + path: + description: |- + Path to the directory containing the kustomization.yaml file, or the + set of plain YAMLs a kustomization.yaml should be generated for. + Defaults to 'None', which translates to the root path of the SourceRef. + type: string + postBuild: + description: |- + PostBuild describes which actions to perform on the YAML manifest + generated by building the kustomize overlay. + properties: + substitute: + additionalProperties: + type: string + description: |- + Substitute holds a map of key/value pairs. + The variables defined in your YAML manifests + that match any of the keys defined in the map + will be substituted with the set value. + Includes support for bash string replacement functions + e.g. ${var:=default}, ${var:position} and ${var/substring/replacement}. + type: object + substituteFrom: + description: |- + SubstituteFrom holds references to ConfigMaps and Secrets containing + the variables and their values to be substituted in the YAML manifests. + The ConfigMap and the Secret data keys represent the var names and they + must match the vars declared in the manifests for the substitution to happen. + items: + description: |- + SubstituteReference contains a reference to a resource containing + the variables name and value. + properties: + kind: + description: Kind of the values referent, valid values are + ('Secret', 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + default: false + description: |- + Optional indicates whether the referenced resource must exist, or whether to + tolerate its absence. If true and the referenced resource is absent, proceed + as if the resource was present but empty, without any variables defined. + type: boolean + required: + - kind + - name + type: object + type: array + type: object + prune: + description: Prune enables garbage collection. + type: boolean + retryInterval: + description: |- + The interval at which to retry a previously failed reconciliation. + When not specified, the controller uses the KustomizationSpec.Interval + value to retry failures. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this Kustomization. + type: string + sourceRef: + description: Reference of the source where the kustomization file + is. + properties: + apiVersion: + description: API version of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, defaults to the namespace + of the Kubernetes resource object that contains the reference. + type: string + required: + - kind + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent kustomize executions, + it does not apply to already started executions. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace sets or overrides the namespace in the + kustomization.yaml file. + maxLength: 63 + minLength: 1 + type: string + timeout: + description: |- + Timeout for validation, apply and health checking operations. + Defaults to 'Interval' duration. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + validation: + description: 'Deprecated: Not used in v1beta2.' + enum: + - none + - client + - server + type: string + wait: + description: |- + Wait instructs the controller to check the health of all the reconciled resources. + When enabled, the HealthChecks are ignored. Defaults to false. + type: boolean + required: + - interval + - prune + - sourceRef + type: object + status: + default: + observedGeneration: -1 + description: KustomizationStatus defines the observed state of a kustomization. + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + inventory: + description: Inventory contains the list of Kubernetes resource object + references that have been successfully applied. + properties: + entries: + description: Entries of Kubernetes resource object references. + items: + description: ResourceRef contains the information necessary + to locate a resource within a cluster. + properties: + id: + description: |- + ID is the string representation of the Kubernetes resource object's metadata, + in the format '___'. + type: string + v: + description: Version is the API version of the Kubernetes + resource object's kind. + type: string + required: + - id + - v + type: object + type: array + required: + - entries + type: object + lastAppliedRevision: + description: |- + The last successfully applied revision. + Equals the Revision of the applied Artifact from the referenced Source. + type: string + lastAttemptedRevision: + description: LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: kustomize-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: kustomize-controller + namespace: flux-system +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: kustomize-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + control-plane: controller + name: kustomize-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: kustomize-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: kustomize-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local./ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.memory + image: ghcr.io/fluxcd/kustomize-controller:v1.3.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 8080 + name: http-prom + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + priorityClassName: system-cluster-critical + securityContext: + fsGroup: 1337 + serviceAccountName: kustomize-controller + terminationGracePeriodSeconds: 60 + volumes: + - emptyDir: {} + name: temp +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: helm-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: helmreleases.helm.toolkit.fluxcd.io +spec: + group: helm.toolkit.fluxcd.io + names: + kind: HelmRelease + listKind: HelmReleaseList + plural: helmreleases + shortNames: + - hr + singular: helmrelease + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v2 + schema: + openAPIV3Schema: + description: HelmRelease is the Schema for the helmreleases API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmReleaseSpec defines the desired state of a Helm release. + properties: + chart: + description: |- + Chart defines the template of the v1.HelmChart that should be created + for this HelmRelease. + properties: + metadata: + description: ObjectMeta holds the template for metadata like labels + and annotations. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + type: object + labels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + type: object + spec: + description: Spec holds the template for the v1.HelmChartSpec + for this HelmRelease. + properties: + chart: + description: The name or path the Helm chart is available + at in the SourceRef. + maxLength: 2048 + minLength: 1 + type: string + ignoreMissingValuesFiles: + description: IgnoreMissingValuesFiles controls whether to + silently ignore missing values files rather than failing. + type: boolean + interval: + description: |- + Interval at which to check the v1.Source for updates. Defaults to + 'HelmReleaseSpec.Interval'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + Determines what enables the creation of a new artifact. Valid values are + ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: The name and namespace of the v1.Source the chart + is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: Namespace of the referent. + maxLength: 63 + minLength: 1 + type: string + required: + - name + type: object + valuesFiles: + description: |- + Alternative list of values files to use as the chart values (values.yaml + is not included by default), expected to be a relative path in the SourceRef. + Values files are merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported for OCI sources. + Chart dependencies, which are not bundled in the umbrella chart artifact, + are not verified. + properties: + provider: + default: cosign + description: Provider specifies the technology used to + sign the OCI Helm chart. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: '*' + description: |- + Version semver expression, ignored for charts from v1.GitRepository and + v1beta2.Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - sourceRef + type: object + required: + - spec + type: object + chartRef: + description: |- + ChartRef holds a reference to a source controller resource containing the + Helm chart artifact. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - HelmChart + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referent, defaults to the namespace of the Kubernetes + resource object that contains the reference. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice with + references to HelmRelease resources that must be ready before this HelmRelease + can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + driftDetection: + description: |- + DriftDetection holds the configuration for detecting and handling + differences between the manifest in the Helm storage and the resources + currently existing in the cluster. + properties: + ignore: + description: |- + Ignore contains a list of rules for specifying which changes to ignore + during diffing. + items: + description: |- + IgnoreRule defines a rule to selectively disregard specific changes during + the drift detection process. + properties: + paths: + description: |- + Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from + consideration in a Kubernetes object. + items: + type: string + type: array + target: + description: |- + Target is a selector for specifying Kubernetes objects to which this + rule applies. + If Target is not set, the Paths will be ignored for all Kubernetes + objects within the manifest of the Helm release. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + mode: + description: |- + Mode defines how differences should be handled between the Helm manifest + and the manifest currently applied to the cluster. + If not explicitly set, it defaults to DiffModeDisabled. + enum: + - enabled + - warn + - disabled + type: string + type: object + install: + description: Install holds the configuration for Helm install actions + for this HelmRelease. + properties: + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Create` and if omitted + CRDs are installed but not updated. + + + Skip: do neither install nor replace (update) any CRDs. + + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + + By default, CRDs are applied (installed) during Helm install action. + With this option users can opt in to CRD replace existing CRDs on Helm + install actions, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + createNamespace: + description: |- + CreateNamespace tells the Helm install action to create the + HelmReleaseSpec.TargetNamespace if it does not exist yet. + On uninstall, the namespace will not be garbage collected. + type: boolean + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm install action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm install action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + install has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + install has been performed. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm install + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an install action but fail. Defaults to + 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false'. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using an uninstall, is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + type: object + replace: + description: |- + Replace tells the Helm install action to re-use the 'ReleaseName', but only + if that name is a deleted release which remains in the history. + type: boolean + skipCRDs: + description: |- + SkipCRDs tells the Helm install action to not install any CRDs. By default, + CRDs are installed if not already present. + + + Deprecated use CRD policy (`crds`) attribute with value `Skip` instead. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm install action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + interval: + description: Interval at which to reconcile the Helm release. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + KubeConfig for reconciling the HelmRelease on a remote cluster. + When used in combination with HelmReleaseSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when HelmReleaseSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + maxHistory: + description: |- + MaxHistory is the number of revisions saved by Helm for this HelmRelease. + Use '0' for an unlimited number of revisions; defaults to '5'. + type: integer + persistentClient: + description: |- + PersistentClient tells the controller to use a persistent Kubernetes + client for this release. When enabled, the client will be reused for the + duration of the reconciliation, instead of being created and destroyed + for each (step of a) Helm action. + + + This can improve performance, but may cause issues with some Helm charts + that for example do create Custom Resource Definitions during installation + outside Helm's CRD lifecycle hooks, which are then not observed to be + available by e.g. post-install hooks. + + + If not set, it defaults to true. + type: boolean + postRenderers: + description: |- + PostRenderers holds an array of Helm PostRenderers, which will be applied in order + of their definition. + items: + description: PostRenderer contains a Helm PostRenderer specification. + properties: + kustomize: + description: Kustomization to apply as PostRenderer. + properties: + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: Image contains an image name, a new name, + a new tag or digest, which will replace the original + name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace + the original name. + type: string + newTag: + description: NewTag is the value used to replace the + original tag. + type: string + required: + - name + type: object + type: array + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + type: object + type: object + type: array + releaseName: + description: |- + ReleaseName used for the Helm release. Defaults to a composition of + '[TargetNamespace-]Name'. + maxLength: 53 + minLength: 1 + type: string + rollback: + description: Rollback holds the configuration for Helm rollback actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + rollback action when it fails. + type: boolean + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + rollback has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + rollback has been performed. + type: boolean + force: + description: Force forces resource updates through a replacement + strategy. + type: boolean + recreate: + description: Recreate performs pod restarts for the resource if + applicable. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm rollback action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this HelmRelease. + maxLength: 253 + minLength: 1 + type: string + storageNamespace: + description: |- + StorageNamespace used for the Helm storage. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + suspend: + description: |- + Suspend tells the controller to suspend reconciliation for this HelmRelease, + it does not apply to already started reconciliations. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace to target when performing operations for the HelmRelease. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + test: + description: Test holds the configuration for Helm test actions for + this HelmRelease. + properties: + enable: + description: |- + Enable enables Helm test actions for this HelmRelease after an Helm install + or upgrade action has been performed. + type: boolean + filters: + description: Filters is a list of tests to run or exclude from + running. + items: + description: Filter holds the configuration for individual Helm + test filters. + properties: + exclude: + description: Exclude specifies whether the named test should + be excluded. + type: boolean + name: + description: Name is the name of the test. + maxLength: 253 + minLength: 1 + type: string + required: + - name + type: object + type: array + ignoreFailures: + description: |- + IgnoreFailures tells the controller to skip remediation when the Helm tests + are run but fail. Can be overwritten for tests run after install or upgrade + actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation during + the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like Jobs + for hooks) during the performance of a Helm action. Defaults to '5m0s'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + uninstall: + description: Uninstall holds the configuration for Helm uninstall + actions for this HelmRelease. + properties: + deletionPropagation: + default: background + description: |- + DeletionPropagation specifies the deletion propagation policy when + a Helm uninstall is performed. + enum: + - background + - foreground + - orphan + type: string + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables waiting for all the resources to be deleted after + a Helm uninstall is performed. + type: boolean + keepHistory: + description: |- + KeepHistory tells Helm to remove all associated resources and mark the + release as deleted, but retain the release history. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm uninstall action. Defaults + to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + upgrade: + description: Upgrade holds the configuration for Helm upgrade actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + upgrade action when it fails. + type: boolean + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Skip` and if omitted + CRDs are neither installed nor upgraded. + + + Skip: do neither install nor replace (update) any CRDs. + + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + + By default, CRDs are not applied during Helm upgrade action. With this + option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm upgrade action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm upgrade action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + upgrade has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + upgrade has been performed. + type: boolean + force: + description: Force forces resource updates through a replacement + strategy. + type: boolean + preserveValues: + description: |- + PreserveValues will make Helm reuse the last release's values and merge in + overrides from 'Values'. Setting this flag makes the HelmRelease + non-declarative. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm upgrade + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an upgrade action but fail. + Defaults to 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false' unless 'Retries' is greater than 0. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using 'Strategy', is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + strategy: + description: Strategy to use for failure remediation. Defaults + to 'rollback'. + enum: + - rollback + - uninstall + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm upgrade action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + values: + description: Values holds the values for this Helm release. + x-kubernetes-preserve-unknown-fields: true + valuesFrom: + description: |- + ValuesFrom holds references to resources containing Helm values for this HelmRelease, + and information about how they should be merged. + items: + description: |- + ValuesReference contains a reference to a resource containing Helm values, + and optionally the key they can be found at. + properties: + kind: + description: Kind of the values referent, valid values are ('Secret', + 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + description: |- + Optional marks this ValuesReference as optional. When set, a not found error + for the values reference is ignored, but any ValuesKey, TargetPath or + transient error will still result in a reconciliation failure. + type: boolean + targetPath: + description: |- + TargetPath is the YAML dot notation path the value should be merged at. When + set, the ValuesKey is expected to be a single flat value. Defaults to 'None', + which results in the values getting merged at the root. + maxLength: 250 + pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$ + type: string + valuesKey: + description: |- + ValuesKey is the data key where the values.yaml or a specific value can be + found at. Defaults to 'values.yaml'. + maxLength: 253 + pattern: ^[\-._a-zA-Z0-9]+$ + type: string + required: + - kind + - name + type: object + type: array + required: + - interval + type: object + x-kubernetes-validations: + - message: either chart or chartRef must be set + rule: (has(self.chart) && !has(self.chartRef)) || (!has(self.chart) + && has(self.chartRef)) + status: + default: + observedGeneration: -1 + description: HelmReleaseStatus defines the observed state of a HelmRelease. + properties: + conditions: + description: Conditions holds the conditions for the HelmRelease. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + failures: + description: |- + Failures is the reconciliation failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + helmChart: + description: |- + HelmChart is the namespaced name of the HelmChart resource created by + the controller for the HelmRelease. + type: string + history: + description: |- + History holds the history of Helm releases performed for this HelmRelease + up to the last successfully completed release. + items: + description: |- + Snapshot captures a point-in-time copy of the status information for a Helm release, + as managed by the controller. + properties: + apiVersion: + description: |- + APIVersion is the API version of the Snapshot. + Provisional: when the calculation method of the Digest field is changed, + this field will be used to distinguish between the old and new methods. + type: string + appVersion: + description: AppVersion is the chart app version of the release + object in storage. + type: string + chartName: + description: ChartName is the chart name of the release object + in storage. + type: string + chartVersion: + description: |- + ChartVersion is the chart version of the release object in + storage. + type: string + configDigest: + description: |- + ConfigDigest is the checksum of the config (better known as + "values") of the release object in storage. + It has the format of `:`. + type: string + deleted: + description: Deleted is when the release was deleted. + format: date-time + type: string + digest: + description: |- + Digest is the checksum of the release object in storage. + It has the format of `:`. + type: string + firstDeployed: + description: FirstDeployed is when the release was first deployed. + format: date-time + type: string + lastDeployed: + description: LastDeployed is when the release was last deployed. + format: date-time + type: string + name: + description: Name is the name of the release. + type: string + namespace: + description: Namespace is the namespace the release is deployed + to. + type: string + ociDigest: + description: OCIDigest is the digest of the OCI artifact associated + with the release. + type: string + status: + description: Status is the current state of the release. + type: string + testHooks: + additionalProperties: + description: |- + TestHookStatus holds the status information for a test hook as observed + to be run by the controller. + properties: + lastCompleted: + description: LastCompleted is the time the test hook last + completed. + format: date-time + type: string + lastStarted: + description: LastStarted is the time the test hook was + last started. + format: date-time + type: string + phase: + description: Phase the test hook was observed to be in. + type: string + type: object + description: |- + TestHooks is the list of test hooks for the release as observed to be + run by the controller. + type: object + version: + description: Version is the version of the release object in + storage. + type: integer + required: + - chartName + - chartVersion + - configDigest + - digest + - firstDeployed + - lastDeployed + - name + - namespace + - status + - version + type: object + type: array + installFailures: + description: |- + InstallFailures is the install failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + lastAttemptedConfigDigest: + description: |- + LastAttemptedConfigDigest is the digest for the config (better known as + "values") of the last reconciliation attempt. + type: string + lastAttemptedGeneration: + description: |- + LastAttemptedGeneration is the last generation the controller attempted + to reconcile. + format: int64 + type: integer + lastAttemptedReleaseAction: + description: |- + LastAttemptedReleaseAction is the last release action performed for this + HelmRelease. It is used to determine the active remediation strategy. + enum: + - install + - upgrade + type: string + lastAttemptedRevision: + description: |- + LastAttemptedRevision is the Source revision of the last reconciliation + attempt. For OCIRepository sources, the 12 first characters of the digest are + appended to the chart version e.g. "1.2.3+1234567890ab". + type: string + lastAttemptedRevisionDigest: + description: |- + LastAttemptedRevisionDigest is the digest of the last reconciliation attempt. + This is only set for OCIRepository sources. + type: string + lastAttemptedValuesChecksum: + description: |- + LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last + reconciliation attempt. + Deprecated: Use LastAttemptedConfigDigest instead. + type: string + lastHandledForceAt: + description: |- + LastHandledForceAt holds the value of the most recent force request + value, so a change of the annotation value can be detected. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + lastHandledResetAt: + description: |- + LastHandledResetAt holds the value of the most recent reset request + value, so a change of the annotation value can be detected. + type: string + lastReleaseRevision: + description: |- + LastReleaseRevision is the revision of the last successful Helm release. + Deprecated: Use History instead. + type: integer + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + observedPostRenderersDigest: + description: |- + ObservedPostRenderersDigest is the digest for the post-renderers of + the last successful reconciliation attempt. + type: string + storageNamespace: + description: |- + StorageNamespace is the namespace of the Helm release storage for the + current release. + maxLength: 63 + minLength: 1 + type: string + upgradeFailures: + description: |- + UpgradeFailures is the upgrade failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v2beta1 HelmRelease is deprecated, upgrade to v2 + name: v2beta1 + schema: + openAPIV3Schema: + description: HelmRelease is the Schema for the helmreleases API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmReleaseSpec defines the desired state of a Helm release. + properties: + chart: + description: |- + Chart defines the template of the v1beta2.HelmChart that should be created + for this HelmRelease. + properties: + metadata: + description: ObjectMeta holds the template for metadata like labels + and annotations. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + type: object + labels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + type: object + spec: + description: Spec holds the template for the v1beta2.HelmChartSpec + for this HelmRelease. + properties: + chart: + description: The name or path the Helm chart is available + at in the SourceRef. + type: string + interval: + description: |- + Interval at which to check the v1beta2.Source for updates. Defaults to + 'HelmReleaseSpec.Interval'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + Determines what enables the creation of a new artifact. Valid values are + ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: The name and namespace of the v1beta2.Source + the chart is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: Namespace of the referent. + maxLength: 63 + minLength: 1 + type: string + required: + - name + type: object + valuesFile: + description: |- + Alternative values file to use as the default chart values, expected to + be a relative path in the SourceRef. Deprecated in favor of ValuesFiles, + for backwards compatibility the file defined here is merged before the + ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: |- + Alternative list of values files to use as the chart values (values.yaml + is not included by default), expected to be a relative path in the SourceRef. + Values files are merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported for OCI sources. + Chart dependencies, which are not bundled in the umbrella chart artifact, are not verified. + properties: + provider: + default: cosign + description: Provider specifies the technology used to + sign the OCI Helm chart. + enum: + - cosign + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: '*' + description: |- + Version semver expression, ignored for charts from v1beta2.GitRepository and + v1beta2.Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - sourceRef + type: object + required: + - spec + type: object + chartRef: + description: |- + ChartRef holds a reference to a source controller resource containing the + Helm chart artifact. + + + Note: this field is provisional to the v2 API, and not actively used + by v2beta1 HelmReleases. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - HelmChart + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referent, defaults to the namespace of the Kubernetes + resource object that contains the reference. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice with + references to HelmRelease resources that must be ready before this HelmRelease + can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + driftDetection: + description: |- + DriftDetection holds the configuration for detecting and handling + differences between the manifest in the Helm storage and the resources + currently existing in the cluster. + + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + properties: + ignore: + description: |- + Ignore contains a list of rules for specifying which changes to ignore + during diffing. + items: + description: |- + IgnoreRule defines a rule to selectively disregard specific changes during + the drift detection process. + properties: + paths: + description: |- + Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from + consideration in a Kubernetes object. + items: + type: string + type: array + target: + description: |- + Target is a selector for specifying Kubernetes objects to which this + rule applies. + If Target is not set, the Paths will be ignored for all Kubernetes + objects within the manifest of the Helm release. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + mode: + description: |- + Mode defines how differences should be handled between the Helm manifest + and the manifest currently applied to the cluster. + If not explicitly set, it defaults to DiffModeDisabled. + enum: + - enabled + - warn + - disabled + type: string + type: object + install: + description: Install holds the configuration for Helm install actions + for this HelmRelease. + properties: + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Create` and if omitted + CRDs are installed but not updated. + + + Skip: do neither install nor replace (update) any CRDs. + + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + + By default, CRDs are applied (installed) during Helm install action. + With this option users can opt-in to CRD replace existing CRDs on Helm + install actions, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + createNamespace: + description: |- + CreateNamespace tells the Helm install action to create the + HelmReleaseSpec.TargetNamespace if it does not exist yet. + On uninstall, the namespace will not be garbage collected. + type: boolean + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm install action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm install action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + install has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + install has been performed. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm install + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an install action but fail. Defaults to + 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false'. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using an uninstall, is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + type: object + replace: + description: |- + Replace tells the Helm install action to re-use the 'ReleaseName', but only + if that name is a deleted release which remains in the history. + type: boolean + skipCRDs: + description: |- + SkipCRDs tells the Helm install action to not install any CRDs. By default, + CRDs are installed if not already present. + + + Deprecated use CRD policy (`crds`) attribute with value `Skip` instead. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm install action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + interval: + description: |- + Interval at which to reconcile the Helm release. + This interval is approximate and may be subject to jitter to ensure + efficient use of resources. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + KubeConfig for reconciling the HelmRelease on a remote cluster. + When used in combination with HelmReleaseSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when HelmReleaseSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + maxHistory: + description: |- + MaxHistory is the number of revisions saved by Helm for this HelmRelease. + Use '0' for an unlimited number of revisions; defaults to '10'. + type: integer + persistentClient: + description: |- + PersistentClient tells the controller to use a persistent Kubernetes + client for this release. When enabled, the client will be reused for the + duration of the reconciliation, instead of being created and destroyed + for each (step of a) Helm action. + + + This can improve performance, but may cause issues with some Helm charts + that for example do create Custom Resource Definitions during installation + outside Helm's CRD lifecycle hooks, which are then not observed to be + available by e.g. post-install hooks. + + + If not set, it defaults to true. + type: boolean + postRenderers: + description: |- + PostRenderers holds an array of Helm PostRenderers, which will be applied in order + of their definition. + items: + description: PostRenderer contains a Helm PostRenderer specification. + properties: + kustomize: + description: Kustomization to apply as PostRenderer. + properties: + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: Image contains an image name, a new name, + a new tag or digest, which will replace the original + name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace + the original name. + type: string + newTag: + description: NewTag is the value used to replace the + original tag. + type: string + required: + - name + type: object + type: array + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + patchesJson6902: + description: JSON 6902 patches, defined as inline YAML objects. + items: + description: JSON6902Patch contains a JSON6902 patch and + the target the patch should be applied to. + properties: + patch: + description: Patch contains the JSON6902 patch document + with an array of operation objects. + items: + description: |- + JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: |- + From contains a JSON-pointer value that references a location within the target document where the operation is + performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. + type: string + op: + description: |- + Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or + "test". + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: |- + Path contains the JSON-pointer value that references a location within the target document where the operation + is performed. The meaning of the value depends on the value of Op. + type: string + value: + description: |- + Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into + account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: Strategic merge patches, defined as inline + YAML objects. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + type: object + type: array + releaseName: + description: |- + ReleaseName used for the Helm release. Defaults to a composition of + '[TargetNamespace-]Name'. + maxLength: 53 + minLength: 1 + type: string + rollback: + description: Rollback holds the configuration for Helm rollback actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + rollback action when it fails. + type: boolean + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + rollback has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + rollback has been performed. + type: boolean + force: + description: Force forces resource updates through a replacement + strategy. + type: boolean + recreate: + description: Recreate performs pod restarts for the resource if + applicable. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm rollback action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this HelmRelease. + type: string + storageNamespace: + description: |- + StorageNamespace used for the Helm storage. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + suspend: + description: |- + Suspend tells the controller to suspend reconciliation for this HelmRelease, + it does not apply to already started reconciliations. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace to target when performing operations for the HelmRelease. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + test: + description: Test holds the configuration for Helm test actions for + this HelmRelease. + properties: + enable: + description: |- + Enable enables Helm test actions for this HelmRelease after an Helm install + or upgrade action has been performed. + type: boolean + ignoreFailures: + description: |- + IgnoreFailures tells the controller to skip remediation when the Helm tests + are run but fail. Can be overwritten for tests run after install or upgrade + actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation during + the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like Jobs + for hooks) during the performance of a Helm action. Defaults to '5m0s'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + uninstall: + description: Uninstall holds the configuration for Helm uninstall + actions for this HelmRelease. + properties: + deletionPropagation: + default: background + description: |- + DeletionPropagation specifies the deletion propagation policy when + a Helm uninstall is performed. + enum: + - background + - foreground + - orphan + type: string + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables waiting for all the resources to be deleted after + a Helm uninstall is performed. + type: boolean + keepHistory: + description: |- + KeepHistory tells Helm to remove all associated resources and mark the + release as deleted, but retain the release history. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm uninstall action. Defaults + to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + upgrade: + description: Upgrade holds the configuration for Helm upgrade actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + upgrade action when it fails. + type: boolean + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Skip` and if omitted + CRDs are neither installed nor upgraded. + + + Skip: do neither install nor replace (update) any CRDs. + + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + + By default, CRDs are not applied during Helm upgrade action. With this + option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm upgrade action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm upgrade action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + upgrade has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + upgrade has been performed. + type: boolean + force: + description: Force forces resource updates through a replacement + strategy. + type: boolean + preserveValues: + description: |- + PreserveValues will make Helm reuse the last release's values and merge in + overrides from 'Values'. Setting this flag makes the HelmRelease + non-declarative. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm upgrade + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an upgrade action but fail. + Defaults to 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false' unless 'Retries' is greater than 0. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using 'Strategy', is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + strategy: + description: Strategy to use for failure remediation. Defaults + to 'rollback'. + enum: + - rollback + - uninstall + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm upgrade action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + values: + description: Values holds the values for this Helm release. + x-kubernetes-preserve-unknown-fields: true + valuesFrom: + description: |- + ValuesFrom holds references to resources containing Helm values for this HelmRelease, + and information about how they should be merged. + items: + description: |- + ValuesReference contains a reference to a resource containing Helm values, + and optionally the key they can be found at. + properties: + kind: + description: Kind of the values referent, valid values are ('Secret', + 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + description: |- + Optional marks this ValuesReference as optional. When set, a not found error + for the values reference is ignored, but any ValuesKey, TargetPath or + transient error will still result in a reconciliation failure. + type: boolean + targetPath: + description: |- + TargetPath is the YAML dot notation path the value should be merged at. When + set, the ValuesKey is expected to be a single flat value. Defaults to 'None', + which results in the values getting merged at the root. + maxLength: 250 + pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$ + type: string + valuesKey: + description: |- + ValuesKey is the data key where the values.yaml or a specific value can be + found at. Defaults to 'values.yaml'. + When set, must be a valid Data Key, consisting of alphanumeric characters, + '-', '_' or '.'. + maxLength: 253 + pattern: ^[\-._a-zA-Z0-9]+$ + type: string + required: + - kind + - name + type: object + type: array + required: + - interval + type: object + status: + default: + observedGeneration: -1 + description: HelmReleaseStatus defines the observed state of a HelmRelease. + properties: + conditions: + description: Conditions holds the conditions for the HelmRelease. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + failures: + description: |- + Failures is the reconciliation failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + helmChart: + description: |- + HelmChart is the namespaced name of the HelmChart resource created by + the controller for the HelmRelease. + type: string + history: + description: |- + History holds the history of Helm releases performed for this HelmRelease + up to the last successfully completed release. + + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + items: + description: |- + Snapshot captures a point-in-time copy of the status information for a Helm release, + as managed by the controller. + properties: + apiVersion: + description: |- + APIVersion is the API version of the Snapshot. + Provisional: when the calculation method of the Digest field is changed, + this field will be used to distinguish between the old and new methods. + type: string + appVersion: + description: AppVersion is the chart app version of the release + object in storage. + type: string + chartName: + description: ChartName is the chart name of the release object + in storage. + type: string + chartVersion: + description: |- + ChartVersion is the chart version of the release object in + storage. + type: string + configDigest: + description: |- + ConfigDigest is the checksum of the config (better known as + "values") of the release object in storage. + It has the format of `:`. + type: string + deleted: + description: Deleted is when the release was deleted. + format: date-time + type: string + digest: + description: |- + Digest is the checksum of the release object in storage. + It has the format of `:`. + type: string + firstDeployed: + description: FirstDeployed is when the release was first deployed. + format: date-time + type: string + lastDeployed: + description: LastDeployed is when the release was last deployed. + format: date-time + type: string + name: + description: Name is the name of the release. + type: string + namespace: + description: Namespace is the namespace the release is deployed + to. + type: string + ociDigest: + description: OCIDigest is the digest of the OCI artifact associated + with the release. + type: string + status: + description: Status is the current state of the release. + type: string + testHooks: + additionalProperties: + description: |- + TestHookStatus holds the status information for a test hook as observed + to be run by the controller. + properties: + lastCompleted: + description: LastCompleted is the time the test hook last + completed. + format: date-time + type: string + lastStarted: + description: LastStarted is the time the test hook was + last started. + format: date-time + type: string + phase: + description: Phase the test hook was observed to be in. + type: string + type: object + description: |- + TestHooks is the list of test hooks for the release as observed to be + run by the controller. + type: object + version: + description: Version is the version of the release object in + storage. + type: integer + required: + - chartName + - chartVersion + - configDigest + - digest + - firstDeployed + - lastDeployed + - name + - namespace + - status + - version + type: object + type: array + installFailures: + description: |- + InstallFailures is the install failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + lastAppliedRevision: + description: LastAppliedRevision is the revision of the last successfully + applied source. + type: string + lastAttemptedConfigDigest: + description: |- + LastAttemptedConfigDigest is the digest for the config (better known as + "values") of the last reconciliation attempt. + + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + lastAttemptedGeneration: + description: |- + LastAttemptedGeneration is the last generation the controller attempted + to reconcile. + + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + format: int64 + type: integer + lastAttemptedReleaseAction: + description: |- + LastAttemptedReleaseAction is the last release action performed for this + HelmRelease. It is used to determine the active remediation strategy. + + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + lastAttemptedRevision: + description: LastAttemptedRevision is the revision of the last reconciliation + attempt. + type: string + lastAttemptedValuesChecksum: + description: |- + LastAttemptedValuesChecksum is the SHA1 checksum of the values of the last + reconciliation attempt. + type: string + lastHandledForceAt: + description: |- + LastHandledForceAt holds the value of the most recent force request + value, so a change of the annotation value can be detected. + + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + lastHandledResetAt: + description: |- + LastHandledResetAt holds the value of the most recent reset request + value, so a change of the annotation value can be detected. + + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + lastReleaseRevision: + description: LastReleaseRevision is the revision of the last successful + Helm release. + type: integer + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + observedPostRenderersDigest: + description: |- + ObservedPostRenderersDigest is the digest for the post-renderers of + the last successful reconciliation attempt. + type: string + storageNamespace: + description: |- + StorageNamespace is the namespace of the Helm release storage for the + current release. + + + Note: this field is provisional to the v2beta2 API, and not actively used + by v2beta1 HelmReleases. + type: string + upgradeFailures: + description: |- + UpgradeFailures is the upgrade failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v2beta2 HelmRelease is deprecated, upgrade to v2 + name: v2beta2 + schema: + openAPIV3Schema: + description: HelmRelease is the Schema for the helmreleases API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: HelmReleaseSpec defines the desired state of a Helm release. + properties: + chart: + description: |- + Chart defines the template of the v1beta2.HelmChart that should be created + for this HelmRelease. + properties: + metadata: + description: ObjectMeta holds the template for metadata like labels + and annotations. + properties: + annotations: + additionalProperties: + type: string + description: |- + Annotations is an unstructured key value map stored with a resource that may be + set by external tools to store and retrieve arbitrary metadata. They are not + queryable and should be preserved when modifying objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ + type: object + labels: + additionalProperties: + type: string + description: |- + Map of string keys and values that can be used to organize and categorize + (scope and select) objects. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/ + type: object + type: object + spec: + description: Spec holds the template for the v1beta2.HelmChartSpec + for this HelmRelease. + properties: + chart: + description: The name or path the Helm chart is available + at in the SourceRef. + maxLength: 2048 + minLength: 1 + type: string + ignoreMissingValuesFiles: + description: IgnoreMissingValuesFiles controls whether to + silently ignore missing values files rather than failing. + type: boolean + interval: + description: |- + Interval at which to check the v1.Source for updates. Defaults to + 'HelmReleaseSpec.Interval'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + reconcileStrategy: + default: ChartVersion + description: |- + Determines what enables the creation of a new artifact. Valid values are + ('ChartVersion', 'Revision'). + See the documentation of the values for an explanation on their behavior. + Defaults to ChartVersion when omitted. + enum: + - ChartVersion + - Revision + type: string + sourceRef: + description: The name and namespace of the v1.Source the chart + is available at. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - HelmRepository + - GitRepository + - Bucket + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: Namespace of the referent. + maxLength: 63 + minLength: 1 + type: string + required: + - name + type: object + valuesFile: + description: |- + Alternative values file to use as the default chart values, expected to + be a relative path in the SourceRef. Deprecated in favor of ValuesFiles, + for backwards compatibility the file defined here is merged before the + ValuesFiles items. Ignored when omitted. + type: string + valuesFiles: + description: |- + Alternative list of values files to use as the chart values (values.yaml + is not included by default), expected to be a relative path in the SourceRef. + Values files are merged in the order of this list with the last file overriding + the first. Ignored when omitted. + items: + type: string + type: array + verify: + description: |- + Verify contains the secret name containing the trusted public keys + used to verify the signature and specifies which provider to use to check + whether OCI image is authentic. + This field is only supported for OCI sources. + Chart dependencies, which are not bundled in the umbrella chart artifact, + are not verified. + properties: + provider: + default: cosign + description: Provider specifies the technology used to + sign the OCI Helm chart. + enum: + - cosign + - notation + type: string + secretRef: + description: |- + SecretRef specifies the Kubernetes Secret containing the + trusted public keys. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + required: + - provider + type: object + version: + default: '*' + description: |- + Version semver expression, ignored for charts from v1beta2.GitRepository and + v1beta2.Bucket sources. Defaults to latest when omitted. + type: string + required: + - chart + - sourceRef + type: object + required: + - spec + type: object + chartRef: + description: |- + ChartRef holds a reference to a source controller resource containing the + Helm chart artifact. + + + Note: this field is provisional to the v2 API, and not actively used + by v2beta2 HelmReleases. + properties: + apiVersion: + description: APIVersion of the referent. + type: string + kind: + description: Kind of the referent. + enum: + - OCIRepository + - HelmChart + type: string + name: + description: Name of the referent. + maxLength: 253 + minLength: 1 + type: string + namespace: + description: |- + Namespace of the referent, defaults to the namespace of the Kubernetes + resource object that contains the reference. + maxLength: 63 + minLength: 1 + type: string + required: + - kind + - name + type: object + dependsOn: + description: |- + DependsOn may contain a meta.NamespacedObjectReference slice with + references to HelmRelease resources that must be ready before this HelmRelease + can be reconciled. + items: + description: |- + NamespacedObjectReference contains enough information to locate the referenced Kubernetes resource object in any + namespace. + properties: + name: + description: Name of the referent. + type: string + namespace: + description: Namespace of the referent, when not specified it + acts as LocalObjectReference. + type: string + required: + - name + type: object + type: array + driftDetection: + description: |- + DriftDetection holds the configuration for detecting and handling + differences between the manifest in the Helm storage and the resources + currently existing in the cluster. + properties: + ignore: + description: |- + Ignore contains a list of rules for specifying which changes to ignore + during diffing. + items: + description: |- + IgnoreRule defines a rule to selectively disregard specific changes during + the drift detection process. + properties: + paths: + description: |- + Paths is a list of JSON Pointer (RFC 6901) paths to be excluded from + consideration in a Kubernetes object. + items: + type: string + type: array + target: + description: |- + Target is a selector for specifying Kubernetes objects to which this + rule applies. + If Target is not set, the Paths will be ignored for all Kubernetes + objects within the manifest of the Helm release. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - paths + type: object + type: array + mode: + description: |- + Mode defines how differences should be handled between the Helm manifest + and the manifest currently applied to the cluster. + If not explicitly set, it defaults to DiffModeDisabled. + enum: + - enabled + - warn + - disabled + type: string + type: object + install: + description: Install holds the configuration for Helm install actions + for this HelmRelease. + properties: + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Create` and if omitted + CRDs are installed but not updated. + + + Skip: do neither install nor replace (update) any CRDs. + + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + + By default, CRDs are applied (installed) during Helm install action. + With this option users can opt in to CRD replace existing CRDs on Helm + install actions, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + createNamespace: + description: |- + CreateNamespace tells the Helm install action to create the + HelmReleaseSpec.TargetNamespace if it does not exist yet. + On uninstall, the namespace will not be garbage collected. + type: boolean + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm install action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm install action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + install has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + install has been performed. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm install + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an install action but fail. Defaults to + 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false'. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using an uninstall, is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + type: object + replace: + description: |- + Replace tells the Helm install action to re-use the 'ReleaseName', but only + if that name is a deleted release which remains in the history. + type: boolean + skipCRDs: + description: |- + SkipCRDs tells the Helm install action to not install any CRDs. By default, + CRDs are installed if not already present. + + + Deprecated use CRD policy (`crds`) attribute with value `Skip` instead. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm install action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + interval: + description: Interval at which to reconcile the Helm release. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + kubeConfig: + description: |- + KubeConfig for reconciling the HelmRelease on a remote cluster. + When used in combination with HelmReleaseSpec.ServiceAccountName, + forces the controller to act on behalf of that Service Account at the + target cluster. + If the --default-service-account flag is set, its value will be used as + a controller level fallback for when HelmReleaseSpec.ServiceAccountName + is empty. + properties: + secretRef: + description: |- + SecretRef holds the name of a secret that contains a key with + the kubeconfig file as the value. If no key is set, the key will default + to 'value'. + It is recommended that the kubeconfig is self-contained, and the secret + is regularly updated if credentials such as a cloud-access-token expire. + Cloud specific `cmd-path` auth helpers will not function without adding + binaries and credentials to the Pod that is responsible for reconciling + Kubernetes resources. + properties: + key: + description: Key in the Secret, when not specified an implementation-specific + default key is used. + type: string + name: + description: Name of the Secret. + type: string + required: + - name + type: object + required: + - secretRef + type: object + maxHistory: + description: |- + MaxHistory is the number of revisions saved by Helm for this HelmRelease. + Use '0' for an unlimited number of revisions; defaults to '5'. + type: integer + persistentClient: + description: |- + PersistentClient tells the controller to use a persistent Kubernetes + client for this release. When enabled, the client will be reused for the + duration of the reconciliation, instead of being created and destroyed + for each (step of a) Helm action. + + + This can improve performance, but may cause issues with some Helm charts + that for example do create Custom Resource Definitions during installation + outside Helm's CRD lifecycle hooks, which are then not observed to be + available by e.g. post-install hooks. + + + If not set, it defaults to true. + type: boolean + postRenderers: + description: |- + PostRenderers holds an array of Helm PostRenderers, which will be applied in order + of their definition. + items: + description: PostRenderer contains a Helm PostRenderer specification. + properties: + kustomize: + description: Kustomization to apply as PostRenderer. + properties: + images: + description: |- + Images is a list of (image name, new name, new tag or digest) + for changing image names, tags or digests. This can also be achieved with a + patch, but this operator is simpler to specify. + items: + description: Image contains an image name, a new name, + a new tag or digest, which will replace the original + name and tag. + properties: + digest: + description: |- + Digest is the value used to replace the original image tag. + If digest is present NewTag value is ignored. + type: string + name: + description: Name is a tag-less image name. + type: string + newName: + description: NewName is the value used to replace + the original name. + type: string + newTag: + description: NewTag is the value used to replace the + original tag. + type: string + required: + - name + type: object + type: array + patches: + description: |- + Strategic merge and JSON patches, defined as inline YAML objects, + capable of targeting objects based on kind, label and annotation selectors. + items: + description: |- + Patch contains an inline StrategicMerge or JSON6902 patch, and the target the patch should + be applied to. + properties: + patch: + description: |- + Patch contains an inline StrategicMerge patch or an inline JSON6902 patch with + an array of operation objects. + type: string + target: + description: Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + type: object + type: array + patchesJson6902: + description: |- + JSON 6902 patches, defined as inline YAML objects. + Deprecated: use Patches instead. + items: + description: JSON6902Patch contains a JSON6902 patch and + the target the patch should be applied to. + properties: + patch: + description: Patch contains the JSON6902 patch document + with an array of operation objects. + items: + description: |- + JSON6902 is a JSON6902 operation object. + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + properties: + from: + description: |- + From contains a JSON-pointer value that references a location within the target document where the operation is + performed. The meaning of the value depends on the value of Op, and is NOT taken into account by all operations. + type: string + op: + description: |- + Op indicates the operation to perform. Its value MUST be one of "add", "remove", "replace", "move", "copy", or + "test". + https://datatracker.ietf.org/doc/html/rfc6902#section-4 + enum: + - test + - remove + - add + - replace + - move + - copy + type: string + path: + description: |- + Path contains the JSON-pointer value that references a location within the target document where the operation + is performed. The meaning of the value depends on the value of Op. + type: string + value: + description: |- + Value contains a valid JSON structure. The meaning of the value depends on the value of Op, and is NOT taken into + account by all operations. + x-kubernetes-preserve-unknown-fields: true + required: + - op + - path + type: object + type: array + target: + description: Target points to the resources that the + patch document should be applied to. + properties: + annotationSelector: + description: |- + AnnotationSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource annotations. + type: string + group: + description: |- + Group is the API group to select resources from. + Together with Version and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + kind: + description: |- + Kind of the API Group to select resources from. + Together with Group and Version it is capable of unambiguously + identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + labelSelector: + description: |- + LabelSelector is a string that follows the label selection expression + https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#api + It matches with the resource labels. + type: string + name: + description: Name to match resources with. + type: string + namespace: + description: Namespace to select resources from. + type: string + version: + description: |- + Version of the API Group to select resources from. + Together with Group and Kind it is capable of unambiguously identifying and/or selecting resources. + https://github.com/kubernetes/community/blob/master/contributors/design-proposals/api-machinery/api-group.md + type: string + type: object + required: + - patch + - target + type: object + type: array + patchesStrategicMerge: + description: |- + Strategic merge patches, defined as inline YAML objects. + Deprecated: use Patches instead. + items: + x-kubernetes-preserve-unknown-fields: true + type: array + type: object + type: object + type: array + releaseName: + description: |- + ReleaseName used for the Helm release. Defaults to a composition of + '[TargetNamespace-]Name'. + maxLength: 53 + minLength: 1 + type: string + rollback: + description: Rollback holds the configuration for Helm rollback actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + rollback action when it fails. + type: boolean + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + rollback has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + rollback has been performed. + type: boolean + force: + description: Force forces resource updates through a replacement + strategy. + type: boolean + recreate: + description: Recreate performs pod restarts for the resource if + applicable. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm rollback action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + serviceAccountName: + description: |- + The name of the Kubernetes service account to impersonate + when reconciling this HelmRelease. + maxLength: 253 + minLength: 1 + type: string + storageNamespace: + description: |- + StorageNamespace used for the Helm storage. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + suspend: + description: |- + Suspend tells the controller to suspend reconciliation for this HelmRelease, + it does not apply to already started reconciliations. Defaults to false. + type: boolean + targetNamespace: + description: |- + TargetNamespace to target when performing operations for the HelmRelease. + Defaults to the namespace of the HelmRelease. + maxLength: 63 + minLength: 1 + type: string + test: + description: Test holds the configuration for Helm test actions for + this HelmRelease. + properties: + enable: + description: |- + Enable enables Helm test actions for this HelmRelease after an Helm install + or upgrade action has been performed. + type: boolean + filters: + description: Filters is a list of tests to run or exclude from + running. + items: + description: Filter holds the configuration for individual Helm + test filters. + properties: + exclude: + description: Exclude specifies whether the named test should + be excluded. + type: boolean + name: + description: Name is the name of the test. + maxLength: 253 + minLength: 1 + type: string + required: + - name + type: object + type: array + ignoreFailures: + description: |- + IgnoreFailures tells the controller to skip remediation when the Helm tests + are run but fail. Can be overwritten for tests run after install or upgrade + actions in 'Install.IgnoreTestFailures' and 'Upgrade.IgnoreTestFailures'. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation during + the performance of a Helm test action. Defaults to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like Jobs + for hooks) during the performance of a Helm action. Defaults to '5m0s'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + uninstall: + description: Uninstall holds the configuration for Helm uninstall + actions for this HelmRelease. + properties: + deletionPropagation: + default: background + description: |- + DeletionPropagation specifies the deletion propagation policy when + a Helm uninstall is performed. + enum: + - background + - foreground + - orphan + type: string + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm rollback action. + type: boolean + disableWait: + description: |- + DisableWait disables waiting for all the resources to be deleted after + a Helm uninstall is performed. + type: boolean + keepHistory: + description: |- + KeepHistory tells Helm to remove all associated resources and mark the + release as deleted, but retain the release history. + type: boolean + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm uninstall action. Defaults + to 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + upgrade: + description: Upgrade holds the configuration for Helm upgrade actions + for this HelmRelease. + properties: + cleanupOnFail: + description: |- + CleanupOnFail allows deletion of new resources created during the Helm + upgrade action when it fails. + type: boolean + crds: + description: |- + CRDs upgrade CRDs from the Helm Chart's crds directory according + to the CRD upgrade policy provided here. Valid values are `Skip`, + `Create` or `CreateReplace`. Default is `Skip` and if omitted + CRDs are neither installed nor upgraded. + + + Skip: do neither install nor replace (update) any CRDs. + + + Create: new CRDs are created, existing CRDs are neither updated nor deleted. + + + CreateReplace: new CRDs are created, existing CRDs are updated (replaced) + but not deleted. + + + By default, CRDs are not applied during Helm upgrade action. With this + option users can opt-in to CRD upgrade, which is not (yet) natively supported by Helm. + https://helm.sh/docs/chart_best_practices/custom_resource_definitions. + enum: + - Skip + - Create + - CreateReplace + type: string + disableHooks: + description: DisableHooks prevents hooks from running during the + Helm upgrade action. + type: boolean + disableOpenAPIValidation: + description: |- + DisableOpenAPIValidation prevents the Helm upgrade action from validating + rendered templates against the Kubernetes OpenAPI Schema. + type: boolean + disableWait: + description: |- + DisableWait disables the waiting for resources to be ready after a Helm + upgrade has been performed. + type: boolean + disableWaitForJobs: + description: |- + DisableWaitForJobs disables waiting for jobs to complete after a Helm + upgrade has been performed. + type: boolean + force: + description: Force forces resource updates through a replacement + strategy. + type: boolean + preserveValues: + description: |- + PreserveValues will make Helm reuse the last release's values and merge in + overrides from 'Values'. Setting this flag makes the HelmRelease + non-declarative. + type: boolean + remediation: + description: |- + Remediation holds the remediation configuration for when the Helm upgrade + action for the HelmRelease fails. The default is to not perform any action. + properties: + ignoreTestFailures: + description: |- + IgnoreTestFailures tells the controller to skip remediation when the Helm + tests are run after an upgrade action but fail. + Defaults to 'Test.IgnoreFailures'. + type: boolean + remediateLastFailure: + description: |- + RemediateLastFailure tells the controller to remediate the last failure, when + no retries remain. Defaults to 'false' unless 'Retries' is greater than 0. + type: boolean + retries: + description: |- + Retries is the number of retries that should be attempted on failures before + bailing. Remediation, using 'Strategy', is performed between each attempt. + Defaults to '0', a negative integer equals to unlimited retries. + type: integer + strategy: + description: Strategy to use for failure remediation. Defaults + to 'rollback'. + enum: + - rollback + - uninstall + type: string + type: object + timeout: + description: |- + Timeout is the time to wait for any individual Kubernetes operation (like + Jobs for hooks) during the performance of a Helm upgrade action. Defaults to + 'HelmReleaseSpec.Timeout'. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + type: object + values: + description: Values holds the values for this Helm release. + x-kubernetes-preserve-unknown-fields: true + valuesFrom: + description: |- + ValuesFrom holds references to resources containing Helm values for this HelmRelease, + and information about how they should be merged. + items: + description: |- + ValuesReference contains a reference to a resource containing Helm values, + and optionally the key they can be found at. + properties: + kind: + description: Kind of the values referent, valid values are ('Secret', + 'ConfigMap'). + enum: + - Secret + - ConfigMap + type: string + name: + description: |- + Name of the values referent. Should reside in the same namespace as the + referring resource. + maxLength: 253 + minLength: 1 + type: string + optional: + description: |- + Optional marks this ValuesReference as optional. When set, a not found error + for the values reference is ignored, but any ValuesKey, TargetPath or + transient error will still result in a reconciliation failure. + type: boolean + targetPath: + description: |- + TargetPath is the YAML dot notation path the value should be merged at. When + set, the ValuesKey is expected to be a single flat value. Defaults to 'None', + which results in the values getting merged at the root. + maxLength: 250 + pattern: ^([a-zA-Z0-9_\-.\\\/]|\[[0-9]{1,5}\])+$ + type: string + valuesKey: + description: |- + ValuesKey is the data key where the values.yaml or a specific value can be + found at. Defaults to 'values.yaml'. + maxLength: 253 + pattern: ^[\-._a-zA-Z0-9]+$ + type: string + required: + - kind + - name + type: object + type: array + required: + - interval + type: object + x-kubernetes-validations: + - message: either chart or chartRef must be set + rule: (has(self.chart) && !has(self.chartRef)) || (!has(self.chart) + && has(self.chartRef)) + status: + default: + observedGeneration: -1 + description: HelmReleaseStatus defines the observed state of a HelmRelease. + properties: + conditions: + description: Conditions holds the conditions for the HelmRelease. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + failures: + description: |- + Failures is the reconciliation failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + helmChart: + description: |- + HelmChart is the namespaced name of the HelmChart resource created by + the controller for the HelmRelease. + type: string + history: + description: |- + History holds the history of Helm releases performed for this HelmRelease + up to the last successfully completed release. + items: + description: |- + Snapshot captures a point-in-time copy of the status information for a Helm release, + as managed by the controller. + properties: + apiVersion: + description: |- + APIVersion is the API version of the Snapshot. + Provisional: when the calculation method of the Digest field is changed, + this field will be used to distinguish between the old and new methods. + type: string + appVersion: + description: AppVersion is the chart app version of the release + object in storage. + type: string + chartName: + description: ChartName is the chart name of the release object + in storage. + type: string + chartVersion: + description: |- + ChartVersion is the chart version of the release object in + storage. + type: string + configDigest: + description: |- + ConfigDigest is the checksum of the config (better known as + "values") of the release object in storage. + It has the format of `:`. + type: string + deleted: + description: Deleted is when the release was deleted. + format: date-time + type: string + digest: + description: |- + Digest is the checksum of the release object in storage. + It has the format of `:`. + type: string + firstDeployed: + description: FirstDeployed is when the release was first deployed. + format: date-time + type: string + lastDeployed: + description: LastDeployed is when the release was last deployed. + format: date-time + type: string + name: + description: Name is the name of the release. + type: string + namespace: + description: Namespace is the namespace the release is deployed + to. + type: string + ociDigest: + description: OCIDigest is the digest of the OCI artifact associated + with the release. + type: string + status: + description: Status is the current state of the release. + type: string + testHooks: + additionalProperties: + description: |- + TestHookStatus holds the status information for a test hook as observed + to be run by the controller. + properties: + lastCompleted: + description: LastCompleted is the time the test hook last + completed. + format: date-time + type: string + lastStarted: + description: LastStarted is the time the test hook was + last started. + format: date-time + type: string + phase: + description: Phase the test hook was observed to be in. + type: string + type: object + description: |- + TestHooks is the list of test hooks for the release as observed to be + run by the controller. + type: object + version: + description: Version is the version of the release object in + storage. + type: integer + required: + - chartName + - chartVersion + - configDigest + - digest + - firstDeployed + - lastDeployed + - name + - namespace + - status + - version + type: object + type: array + installFailures: + description: |- + InstallFailures is the install failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + lastAppliedRevision: + description: |- + LastAppliedRevision is the revision of the last successfully applied + source. + Deprecated: the revision can now be found in the History. + type: string + lastAttemptedConfigDigest: + description: |- + LastAttemptedConfigDigest is the digest for the config (better known as + "values") of the last reconciliation attempt. + type: string + lastAttemptedGeneration: + description: |- + LastAttemptedGeneration is the last generation the controller attempted + to reconcile. + format: int64 + type: integer + lastAttemptedReleaseAction: + description: |- + LastAttemptedReleaseAction is the last release action performed for this + HelmRelease. It is used to determine the active remediation strategy. + enum: + - install + - upgrade + type: string + lastAttemptedRevision: + description: |- + LastAttemptedRevision is the Source revision of the last reconciliation + attempt. For OCIRepository sources, the 12 first characters of the digest are + appended to the chart version e.g. "1.2.3+1234567890ab". + type: string + lastAttemptedRevisionDigest: + description: |- + LastAttemptedRevisionDigest is the digest of the last reconciliation attempt. + This is only set for OCIRepository sources. + type: string + lastAttemptedValuesChecksum: + description: |- + LastAttemptedValuesChecksum is the SHA1 checksum for the values of the last + reconciliation attempt. + Deprecated: Use LastAttemptedConfigDigest instead. + type: string + lastHandledForceAt: + description: |- + LastHandledForceAt holds the value of the most recent force request + value, so a change of the annotation value can be detected. + type: string + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + lastHandledResetAt: + description: |- + LastHandledResetAt holds the value of the most recent reset request + value, so a change of the annotation value can be detected. + type: string + lastReleaseRevision: + description: |- + LastReleaseRevision is the revision of the last successful Helm release. + Deprecated: Use History instead. + type: integer + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + observedPostRenderersDigest: + description: |- + ObservedPostRenderersDigest is the digest for the post-renderers of + the last successful reconciliation attempt. + type: string + storageNamespace: + description: |- + StorageNamespace is the namespace of the Helm release storage for the + current release. + maxLength: 63 + minLength: 1 + type: string + upgradeFailures: + description: |- + UpgradeFailures is the upgrade failure count against the latest desired + state. It is reset after a successful reconciliation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: helm-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: helm-controller + namespace: flux-system +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: helm-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + control-plane: controller + name: helm-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: helm-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: helm-controller + spec: + containers: + - args: + - --events-addr=http://notification-controller.flux-system.svc.cluster.local./ + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.memory + image: ghcr.io/fluxcd/helm-controller:v1.0.1 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 8080 + name: http-prom + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + priorityClassName: system-cluster-critical + securityContext: + fsGroup: 1337 + serviceAccountName: helm-controller + terminationGracePeriodSeconds: 600 + volumes: + - emptyDir: {} + name: temp +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: alerts.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Alert + listKind: AlertList + plural: alerts + singular: alert + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta1 Alert is deprecated, upgrade to v1beta3 + name: v1beta1 + schema: + openAPIV3Schema: + description: Alert is the Schema for the alerts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AlertSpec defines an alerting rule for events involving a + list of objects + properties: + eventSeverity: + default: info + description: |- + Filter events based on severity, defaults to ('info'). + If set to 'info' no events will be filtered. + enum: + - info + - error + type: string + eventSources: + description: Filter events based on the involved objects. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + name: + description: Name of the referent + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - name + type: object + type: array + exclusionList: + description: A list of Golang regular expressions to be used for excluding + messages. + items: + type: string + type: array + providerRef: + description: Send events using this provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + summary: + description: Short description of the impact and affected cluster. + type: string + suspend: + description: |- + This flag tells the controller to suspend subsequent events dispatching. + Defaults to false. + type: boolean + required: + - eventSources + - providerRef + type: object + status: + default: + observedGeneration: -1 + description: AlertStatus defines the observed state of Alert + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Alert is deprecated, upgrade to v1beta3 + name: v1beta2 + schema: + openAPIV3Schema: + description: Alert is the Schema for the alerts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AlertSpec defines an alerting rule for events involving a + list of objects. + properties: + eventMetadata: + additionalProperties: + type: string + description: |- + EventMetadata is an optional field for adding metadata to events dispatched by the + controller. This can be used for enhancing the context of the event. If a field + would override one already present on the original event as generated by the emitter, + then the override doesn't happen, i.e. the original value is preserved, and an info + log is printed. + type: object + eventSeverity: + default: info + description: |- + EventSeverity specifies how to filter events based on severity. + If set to 'info' no events will be filtered. + enum: + - info + - error + type: string + eventSources: + description: |- + EventSources specifies how to filter events based + on the involved object kind, name and namespace. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + exclusionList: + description: |- + ExclusionList specifies a list of Golang regular expressions + to be used for excluding messages. + items: + type: string + type: array + inclusionList: + description: |- + InclusionList specifies a list of Golang regular expressions + to be used for including messages. + items: + type: string + type: array + providerRef: + description: ProviderRef specifies which Provider this Alert should + use. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + summary: + description: Summary holds a short description of the impact and affected + cluster. + maxLength: 255 + type: string + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Alert. + type: boolean + required: + - eventSources + - providerRef + type: object + status: + default: + observedGeneration: -1 + description: AlertStatus defines the observed state of the Alert. + properties: + conditions: + description: Conditions holds the conditions for the Alert. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta3 + schema: + openAPIV3Schema: + description: Alert is the Schema for the alerts API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: AlertSpec defines an alerting rule for events involving a + list of objects. + properties: + eventMetadata: + additionalProperties: + type: string + description: |- + EventMetadata is an optional field for adding metadata to events dispatched by the + controller. This can be used for enhancing the context of the event. If a field + would override one already present on the original event as generated by the emitter, + then the override doesn't happen, i.e. the original value is preserved, and an info + log is printed. + type: object + eventSeverity: + default: info + description: |- + EventSeverity specifies how to filter events based on severity. + If set to 'info' no events will be filtered. + enum: + - info + - error + type: string + eventSources: + description: |- + EventSources specifies how to filter events based + on the involved object kind, name and namespace. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + exclusionList: + description: |- + ExclusionList specifies a list of Golang regular expressions + to be used for excluding messages. + items: + type: string + type: array + inclusionList: + description: |- + InclusionList specifies a list of Golang regular expressions + to be used for including messages. + items: + type: string + type: array + providerRef: + description: ProviderRef specifies which Provider this Alert should + use. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + summary: + description: Summary holds a short description of the impact and affected + cluster. + maxLength: 255 + type: string + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Alert. + type: boolean + required: + - eventSources + - providerRef + type: object + type: object + served: true + storage: true + subresources: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: providers.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Provider + listKind: ProviderList + plural: providers + singular: provider + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta1 Provider is deprecated, upgrade to v1beta3 + name: v1beta1 + schema: + openAPIV3Schema: + description: Provider is the Schema for the providers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ProviderSpec defines the desired state of Provider + properties: + address: + description: HTTP/S webhook address of this provider + pattern: ^(http|https):// + type: string + certSecretRef: + description: |- + CertSecretRef can be given the name of a secret containing + a PEM-encoded CA certificate (`caFile`) + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + channel: + description: Alert channel for this provider + type: string + proxy: + description: HTTP/S address of the proxy + pattern: ^(http|https):// + type: string + secretRef: + description: |- + Secret reference containing the provider webhook URL + using "address" as data key + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent events handling. + Defaults to false. + type: boolean + timeout: + description: Timeout for sending alerts to the provider. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: Type of provider + enum: + - slack + - discord + - msteams + - rocket + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - azuredevops + - googlechat + - webex + - sentry + - azureeventhub + - telegram + - lark + - matrix + - opsgenie + - alertmanager + - grafana + - githubdispatch + type: string + username: + description: Bot username for this provider + type: string + required: + - type + type: object + status: + default: + observedGeneration: -1 + description: ProviderStatus defines the observed state of Provider + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Provider is deprecated, upgrade to v1beta3 + name: v1beta2 + schema: + openAPIV3Schema: + description: Provider is the Schema for the providers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ProviderSpec defines the desired state of the Provider. + properties: + address: + description: |- + Address specifies the endpoint, in a generic sense, to where alerts are sent. + What kind of endpoint depends on the specific Provider type being used. + For the generic Provider, for example, this is an HTTP/S address. + For other Provider types this could be a project ID or a namespace. + maxLength: 2048 + type: string + certSecretRef: + description: |- + CertSecretRef specifies the Secret containing + a PEM-encoded CA certificate (in the `ca.crt` key). + + + Note: Support for the `caFile` key has + been deprecated. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + channel: + description: Channel specifies the destination channel where events + should be posted. + maxLength: 2048 + type: string + interval: + description: Interval at which to reconcile the Provider with its + Secret references. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + proxy: + description: Proxy the HTTP/S address of the proxy server. + maxLength: 2048 + pattern: ^(http|https)://.*$ + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing the authentication + credentials for this Provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Provider. + type: boolean + timeout: + description: Timeout for sending alerts to the Provider. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: Type specifies which Provider implementation to use. + enum: + - slack + - discord + - msteams + - rocket + - generic + - generic-hmac + - github + - gitlab + - gitea + - bitbucketserver + - bitbucket + - azuredevops + - googlechat + - googlepubsub + - webex + - sentry + - azureeventhub + - telegram + - lark + - matrix + - opsgenie + - alertmanager + - grafana + - githubdispatch + - pagerduty + - datadog + type: string + username: + description: Username specifies the name under which events are posted. + maxLength: 2048 + type: string + required: + - type + type: object + status: + default: + observedGeneration: -1 + description: ProviderStatus defines the observed state of the Provider. + properties: + conditions: + description: Conditions holds the conditions for the Provider. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last reconciled generation. + format: int64 + type: integer + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta3 + schema: + openAPIV3Schema: + description: Provider is the Schema for the providers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ProviderSpec defines the desired state of the Provider. + properties: + address: + description: |- + Address specifies the endpoint, in a generic sense, to where alerts are sent. + What kind of endpoint depends on the specific Provider type being used. + For the generic Provider, for example, this is an HTTP/S address. + For other Provider types this could be a project ID or a namespace. + maxLength: 2048 + type: string + certSecretRef: + description: |- + CertSecretRef specifies the Secret containing + a PEM-encoded CA certificate (in the `ca.crt` key). + + + Note: Support for the `caFile` key has + been deprecated. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + channel: + description: Channel specifies the destination channel where events + should be posted. + maxLength: 2048 + type: string + interval: + description: |- + Interval at which to reconcile the Provider with its Secret references. + Deprecated and not used in v1beta3. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + proxy: + description: Proxy the HTTP/S address of the proxy server. + maxLength: 2048 + pattern: ^(http|https)://.*$ + type: string + secretRef: + description: |- + SecretRef specifies the Secret containing the authentication + credentials for this Provider. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this Provider. + type: boolean + timeout: + description: Timeout for sending alerts to the Provider. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m))+$ + type: string + type: + description: Type specifies which Provider implementation to use. + enum: + - slack + - discord + - msteams + - rocket + - generic + - generic-hmac + - github + - gitlab + - gitea + - bitbucketserver + - bitbucket + - azuredevops + - googlechat + - googlepubsub + - webex + - sentry + - azureeventhub + - telegram + - lark + - matrix + - opsgenie + - alertmanager + - grafana + - githubdispatch + - pagerduty + - datadog + - nats + type: string + username: + description: Username specifies the name under which events are posted. + maxLength: 2048 + type: string + required: + - type + type: object + type: object + served: true + storage: true + subresources: {} +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: receivers.notification.toolkit.fluxcd.io +spec: + group: notification.toolkit.fluxcd.io + names: + kind: Receiver + listKind: ReceiverList + plural: receivers + singular: receiver + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + name: v1 + schema: + openAPIV3Schema: + description: Receiver is the Schema for the receivers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ReceiverSpec defines the desired state of the Receiver. + properties: + events: + description: |- + Events specifies the list of event types to handle, + e.g. 'push' for GitHub or 'Push Hook' for GitLab. + items: + type: string + type: array + interval: + default: 10m + description: Interval at which to reconcile the Receiver with its + Secret references. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + resources: + description: A list of resources to be notified about changes. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + secretRef: + description: |- + SecretRef specifies the Secret containing the token used + to validate the payload authenticity. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this receiver. + type: boolean + type: + description: |- + Type of webhook sender, used to determine + the validation procedure and payload deserialization. + enum: + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - harbor + - dockerhub + - quay + - gcr + - nexus + - acr + - cdevents + type: string + required: + - resources + - secretRef + - type + type: object + status: + default: + observedGeneration: -1 + description: ReceiverStatus defines the observed state of the Receiver. + properties: + conditions: + description: Conditions holds the conditions for the Receiver. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation of + the Receiver object. + format: int64 + type: integer + webhookPath: + description: |- + WebhookPath is the generated incoming webhook address in the format + of '/hook/sha256sum(token+name+namespace)'. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta1 Receiver is deprecated, upgrade to v1 + name: v1beta1 + schema: + openAPIV3Schema: + description: Receiver is the Schema for the receivers API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ReceiverSpec defines the desired state of Receiver + properties: + events: + description: |- + A list of events to handle, + e.g. 'push' for GitHub or 'Push Hook' for GitLab. + items: + type: string + type: array + resources: + description: A list of resources to be notified about changes. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + name: + description: Name of the referent + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - name + type: object + type: array + secretRef: + description: |- + Secret reference containing the token used + to validate the payload authenticity + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + This flag tells the controller to suspend subsequent events handling. + Defaults to false. + type: boolean + type: + description: |- + Type of webhook sender, used to determine + the validation procedure and payload deserialization. + enum: + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - harbor + - dockerhub + - quay + - gcr + - nexus + - acr + type: string + required: + - resources + - type + type: object + status: + default: + observedGeneration: -1 + description: ReceiverStatus defines the observed state of Receiver + properties: + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + url: + description: |- + Generated webhook URL in the format + of '/hook/sha256sum(token+name+namespace)'. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].message + name: Status + type: string + deprecated: true + deprecationWarning: v1beta2 Receiver is deprecated, upgrade to v1 + name: v1beta2 + schema: + openAPIV3Schema: + description: Receiver is the Schema for the receivers API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: ReceiverSpec defines the desired state of the Receiver. + properties: + events: + description: |- + Events specifies the list of event types to handle, + e.g. 'push' for GitHub or 'Push Hook' for GitLab. + items: + type: string + type: array + interval: + description: Interval at which to reconcile the Receiver with its + Secret references. + pattern: ^([0-9]+(\.[0-9]+)?(ms|s|m|h))+$ + type: string + resources: + description: A list of resources to be notified about changes. + items: + description: |- + CrossNamespaceObjectReference contains enough information to let you locate the + typed referenced object at cluster level + properties: + apiVersion: + description: API version of the referent + type: string + kind: + description: Kind of the referent + enum: + - Bucket + - GitRepository + - Kustomization + - HelmRelease + - HelmChart + - HelmRepository + - ImageRepository + - ImagePolicy + - ImageUpdateAutomation + - OCIRepository + type: string + matchLabels: + additionalProperties: + type: string + description: |- + MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + MatchLabels requires the name to be set to `*`. + type: object + name: + description: |- + Name of the referent + If multiple resources are targeted `*` may be set. + maxLength: 53 + minLength: 1 + type: string + namespace: + description: Namespace of the referent + maxLength: 53 + minLength: 1 + type: string + required: + - kind + - name + type: object + type: array + secretRef: + description: |- + SecretRef specifies the Secret containing the token used + to validate the payload authenticity. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + suspend: + description: |- + Suspend tells the controller to suspend subsequent + events handling for this receiver. + type: boolean + type: + description: |- + Type of webhook sender, used to determine + the validation procedure and payload deserialization. + enum: + - generic + - generic-hmac + - github + - gitlab + - bitbucket + - harbor + - dockerhub + - quay + - gcr + - nexus + - acr + type: string + required: + - resources + - type + type: object + status: + default: + observedGeneration: -1 + description: ReceiverStatus defines the observed state of the Receiver. + properties: + conditions: + description: Conditions holds the conditions for the Receiver. + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + lastHandledReconcileAt: + description: |- + LastHandledReconcileAt holds the value of the most recent + reconcile request value, so a change of the annotation value + can be detected. + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation of + the Receiver object. + format: int64 + type: integer + url: + description: |- + URL is the generated incoming webhook address in the format + of '/hook/sha256sum(token+name+namespace)'. + Deprecated: Replaced by WebhookPath. + type: string + webhookPath: + description: |- + WebhookPath is the generated incoming webhook address in the format + of '/hook/sha256sum(token+name+namespace)'. + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + name: notification-controller + namespace: flux-system +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + control-plane: controller + name: notification-controller + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http + selector: + app: notification-controller + type: ClusterIP +--- +apiVersion: v1 +kind: Service +metadata: + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + control-plane: controller + name: webhook-receiver + namespace: flux-system +spec: + ports: + - name: http + port: 80 + protocol: TCP + targetPort: http-webhook + selector: + app: notification-controller + type: ClusterIP +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app.kubernetes.io/component: notification-controller + app.kubernetes.io/instance: flux-system + app.kubernetes.io/part-of: flux + app.kubernetes.io/version: v2.3.0 + control-plane: controller + name: notification-controller + namespace: flux-system +spec: + replicas: 1 + selector: + matchLabels: + app: notification-controller + template: + metadata: + annotations: + prometheus.io/port: "8080" + prometheus.io/scrape: "true" + labels: + app: notification-controller + spec: + containers: + - args: + - --watch-all-namespaces=true + - --log-level=info + - --log-encoding=json + - --enable-leader-election + env: + - name: RUNTIME_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.cpu + - name: GOMEMLIMIT + valueFrom: + resourceFieldRef: + containerName: manager + resource: limits.memory + image: ghcr.io/fluxcd/notification-controller:v1.3.0 + imagePullPolicy: IfNotPresent + livenessProbe: + httpGet: + path: /healthz + port: healthz + name: manager + ports: + - containerPort: 9090 + name: http + protocol: TCP + - containerPort: 9292 + name: http-webhook + protocol: TCP + - containerPort: 8080 + name: http-prom + protocol: TCP + - containerPort: 9440 + name: healthz + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: healthz + resources: + limits: + cpu: 1000m + memory: 1Gi + requests: + cpu: 100m + memory: 64Mi + securityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + volumeMounts: + - mountPath: /tmp + name: temp + nodeSelector: + kubernetes.io/os: linux + securityContext: + fsGroup: 1337 + serviceAccountName: notification-controller + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: temp From 2675b25e743ccad175eaf7340e9430ea4aa10bce Mon Sep 17 00:00:00 2001 From: flux-ops <> Date: Wed, 10 Jul 2024 14:29:43 +0200 Subject: [PATCH 37/69] Add Flux sync manifests --- .../cluster/flux/flux-system/gotk-sync.yaml | 27 +++++++++++++++++++ .../flux/flux-system/kustomization.yaml | 5 ++++ 2 files changed, 32 insertions(+) create mode 100644 infrastructure/cluster/flux/flux-system/gotk-sync.yaml create mode 100644 infrastructure/cluster/flux/flux-system/kustomization.yaml diff --git a/infrastructure/cluster/flux/flux-system/gotk-sync.yaml b/infrastructure/cluster/flux/flux-system/gotk-sync.yaml new file mode 100644 index 00000000..558d4d5d --- /dev/null +++ b/infrastructure/cluster/flux/flux-system/gotk-sync.yaml @@ -0,0 +1,27 @@ +# This manifest was generated by flux. DO NOT EDIT. +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: GitRepository +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 1m0s + ref: + branch: main + secretRef: + name: flux-system + url: ssh://git@github.com/vre-hub/vre +--- +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: flux-system + namespace: flux-system +spec: + interval: 10m0s + path: ./infrastructure/cluster/flux + prune: true + sourceRef: + kind: GitRepository + name: flux-system diff --git a/infrastructure/cluster/flux/flux-system/kustomization.yaml b/infrastructure/cluster/flux/flux-system/kustomization.yaml new file mode 100644 index 00000000..3842229e --- /dev/null +++ b/infrastructure/cluster/flux/flux-system/kustomization.yaml @@ -0,0 +1,5 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: +- gotk-components.yaml +- gotk-sync.yaml From 9330139abf142fa035f61017d63e30ac2c32b939 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 10 Jul 2024 15:33:51 +0200 Subject: [PATCH 38/69] deploy sealed secrets on new cluster --- .../cluster/flux/sealed_secrets/README.md | 7 +++++++ .../sealed_secrets/ss-helm_repository.yaml | 8 ++++++++ .../flux/sealed_secrets/ss-namespace.yaml | 6 ++++++ .../flux/sealed_secrets/ss-release.yaml | 19 +++++++++++++++++++ 4 files changed, 40 insertions(+) create mode 100644 infrastructure/cluster/flux/sealed_secrets/README.md create mode 100644 infrastructure/cluster/flux/sealed_secrets/ss-helm_repository.yaml create mode 100644 infrastructure/cluster/flux/sealed_secrets/ss-namespace.yaml create mode 100644 infrastructure/cluster/flux/sealed_secrets/ss-release.yaml diff --git a/infrastructure/cluster/flux/sealed_secrets/README.md b/infrastructure/cluster/flux/sealed_secrets/README.md new file mode 100644 index 00000000..b0fd3970 --- /dev/null +++ b/infrastructure/cluster/flux/sealed_secrets/README.md @@ -0,0 +1,7 @@ +# Sealaed secrets + +Sealed secrets (chart v2.16.0 what brings app version v0.27.0) charts were taken from the [official repository](https://github.com/bitnami-labs/sealed-secrets), installed via flux (using the manifests on this directory) on the vre cluster. + +To correctly interact with Flux: +- First create the namespace and apply the helm-repository manifest manually. +- Then you can push the release manufests. \ No newline at end of file diff --git a/infrastructure/cluster/flux/sealed_secrets/ss-helm_repository.yaml b/infrastructure/cluster/flux/sealed_secrets/ss-helm_repository.yaml new file mode 100644 index 00000000..f487a579 --- /dev/null +++ b/infrastructure/cluster/flux/sealed_secrets/ss-helm_repository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: sealed-secrets + namespace: sealed-secrets +spec: + interval: 5m + url: https://bitnami-labs.github.io/sealed-secrets diff --git a/infrastructure/cluster/flux/sealed_secrets/ss-namespace.yaml b/infrastructure/cluster/flux/sealed_secrets/ss-namespace.yaml new file mode 100644 index 00000000..b2d09047 --- /dev/null +++ b/infrastructure/cluster/flux/sealed_secrets/ss-namespace.yaml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: sealed-secrets + labels: + name: sealed-secrets diff --git a/infrastructure/cluster/flux/sealed_secrets/ss-release.yaml b/infrastructure/cluster/flux/sealed_secrets/ss-release.yaml new file mode 100644 index 00000000..77c7beb0 --- /dev/null +++ b/infrastructure/cluster/flux/sealed_secrets/ss-release.yaml @@ -0,0 +1,19 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: sealed-secrets + namespace: sealed-secrets +spec: + releaseName: sealed-secrets + interval: 5m + chart: + spec: + sourceRef: + kind: HelmRepository + name: sealed-secrets + namespace: sealed-secrets + chart: sealed-secrets + interval: 5m + version: 2.16.0 + values: + fullnameOverride: "sealed-secrets-controller" From ddc6b3b66060247685cca278431593ce9f729bd1 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 10 Jul 2024 16:01:35 +0200 Subject: [PATCH 39/69] adapt jhub secret script and add jhub secrets on new cluster --- infrastructure/scripts/jhub_secrets.sh | 21 +++++++++++++++---- .../secrets/jhub/ss_jhub-vre-db.yaml | 15 +++++++++++++ .../secrets/jhub/ss_jhub-vre-iam-secrets.yaml | 17 +++++++++++++++ 3 files changed, 49 insertions(+), 4 deletions(-) create mode 100644 infrastructure/secrets/jhub/ss_jhub-vre-db.yaml create mode 100644 infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml diff --git a/infrastructure/scripts/jhub_secrets.sh b/infrastructure/scripts/jhub_secrets.sh index 7855f9ef..e771df54 100644 --- a/infrastructure/scripts/jhub_secrets.sh +++ b/infrastructure/scripts/jhub_secrets.sh @@ -1,5 +1,18 @@ -kubectl create secret generic jhub-cvre-iam-secrets --from-literal=client_id="" --from-literal=client_secret="" --dry-run=client -o yaml | \ -kubeseal --controller-name=sealed-secrets-cvre --controller-namespace=shared-services --format yaml --namespace=jhub > ss_jhub-cvre-iam-secrets.yaml +#!/bin/bash -kubectl create secret tls cern-sectigo-tls-certificate --key="tls.key" --cert="tls.crt" --dry-run=client -o yaml | \ -kubeseal --controller-name=sealed-secrets-cvre --controller-namespace=shared-services --format yaml --namespace=jhub > ss_cern-sectigo-tls-certificate.yaml +RAW_SECRETS_TMP_DIR="/root/software/vre/infrastructure/secrets/tmp_local_secrets" +SECRETS_STORE="/root/software/vre/infrastructure/secrets/jhub" +NAMESPACE="jhub" + +SECRET_NAME="jhub-vre-iam-secrets.yaml" +SECRET_FILE=${RAW_SECRETS_TMP_DIR}/${SECRET_NAME} +echo "Creating ${SECRET_NAME} secret" +cat $SECRET_FILE | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_NAME} +kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_NAME} + + +SECRET_NAME="jhub-vre-db.yaml" +SECRET_FILE=${RAW_SECRETS_TMP_DIR}/${SECRET_NAME} +echo "Creating ${SECRET_NAME} secret" +cat $SECRET_FILE | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_NAME} +kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_NAME} diff --git a/infrastructure/secrets/jhub/ss_jhub-vre-db.yaml b/infrastructure/secrets/jhub/ss_jhub-vre-db.yaml new file mode 100644 index 00000000..491db7c7 --- /dev/null +++ b/infrastructure/secrets/jhub/ss_jhub-vre-db.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: jhub-vre-db + namespace: jhub +spec: + encryptedData: + dbfullstring: AgAAczqDWstQ8KHT1a93Mc8gHZ5u2ZDLZsBDC5F2kvAVXJesorghxK27V7xjRxwBALGaIvbtJdvVvaDemVkQS/eHA2wGVufcDnz6w2InnLnv6DGf4AHbjXRHXoqqBODaY+QsAtv47QgwjKKsC3lGAwf34nHew1N1ISfK4MdbGq8lZaWNcPh7wMdgf6P1fNHw0ivfosiavaKqczIxzu5dJPYE/+4EMJiQ9pxGW4qQKCO6x2xurHSV5QiAnRs/ha8RcXL0WTsW8VD2V3eJvAx9Iyzr9kGrBSpemFvygo+86ARvF6VKS/TTaW4r47DyABMBYM+zAd89A3u4YMK1ZAc5WUWrV+jBZ7UQBmaj3BQWg1+vSaJsdfCabLPkdggDTIaMZwEs1Smy9XlFEvotFUrMmmsPMxBnLl9znLqnb0dEj2ynHbc67i3FOmrXt/PqPrQKEfUCBssKBOC3oaLP7pmv8t2tI+oIZHfMlqWCjWSjNPACgmMXZuw2nwpdl7MdrzZai5XZnqdYSTlNuW1f2A4BInOV70Tr64lPDDj5Uoeq3qYZj6FoznJ/W+Wjz1Eg7xHpWSLVxg7T0T7GoSSgjfx43rwToqZf5eLvBBPgM8Is17PQ7Z7bhpxlKKrPwmnOJk9RFiU/49Z5rpsbLfljZZCD19S8EzJCG5ozyDuk7WcBoFFc8MIzM0JNHQFvJRVefjhnJSdfu6VMYuvVbmkOiiKcrYKVJ1DYhfmMrosiJYvV9mgYVROKz+OrDflXRgYsYWLe5/sQCXKOy0fY6syZlqv9lnOT0lX4XmPDq8SK8h9WFwU= + template: + metadata: + creationTimestamp: null + name: jhub-vre-db + namespace: jhub diff --git a/infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml b/infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml new file mode 100644 index 00000000..9b3470af --- /dev/null +++ b/infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: jhub-vre-iam-secrets + namespace: jhub +spec: + encryptedData: + client_id: AgBO67T7tMt5YePQHu9FWTqsQLkQ+Wl+pePpv06Hd9dOF9ReUuCrNdfJNoUHIq9yqN8Nm1nmiq+yDKJ4KLlK+aIesf4iDN2HneMBChb2jsEcgvvGK77k3esGXg1eEZnvgHkDj2vmEo6G1W+9RHv74i/ude649LdDGMrfTqdPy9qwIJubrK0bCugJR55oTfmV5mL7tmH9sMQcUvthivOLfigZa8hYQ+3UgLNw6NfRHqDkGFuL6DUgXZuMLb9xPPJs/5AQOTvTuUqRU5ewi5tNJFh/28V4BEJkQaScXevrvf+luGVQo/p07jaTsjsflFbekitGWDT81VyzHYquNtbx9cxoLFRJ/1aRArSkz360w9nlfGAcHK8oeZwBAh1rgVt9Y+NtPyIIdLEH8Lr4XoPXPfVPn/S6PkN7sSv4MW8GDGjBziTfdqd5fzpUR0TVoavDM/L/NPGjTC0kEBaUoAvhfGF1gz7G9IO6sJP7EhUnbPFaun5jlJ0MmLOZTMgYzOa16WShrfIhFHgJ7qdg83IrDi295EXr+X8smla3jB/a2HA9u6vggMvthg5X1sORC/hN/XKStuh4ym+cW6akQljcy32g9xrTBaPWHWZljVt/+n3K6z5UWOxSHndVmM1bfCvMOBNZpSJQ+1ZtXKYHwVjqObWIEd0P4hY9cCVMRzO7KRQvNls8RI/YxXpP3ejIGux/QaDLtKjCHHdq7l33u/a9SzXxKuyffPgYmFUMKAmLkRQQj7GORKc= + client_secret: AgA5wJzk6+kY1aa0tix10u7KLsDZ5X4VYYtrAko4MaYS8zLcq1AcFcDWMNFanFp/a03+l+DnC8D7Iqm3BURmCJ1gyCQETIxPGJxWnr0UjQ4Gfrm+bACawQ+ybWsng7wB1rutV1oMPp8Z+fDYlJsjiC4tBySzTZlPfhXVT6lmOE9kCibzxfnokpnf+yKIOGS6KzTpWrRiI4ktPyAw9pVbF1p/EaEaabtFrSLX6xqHiAO5TgjOcTQ366nQ81LxpxOSMb9yh/NBn59C4rbxCzyJPPxlDBp0n289DMMoE1a17x0mwcN8WZvHEtWOEa6JstIVCuMTro/hDO/9xFATZTMyIzSVPw/4UquexY0aEabAxyhcgm6cUIcsLjcdk+29+1yjcTV+lCpY6MdXHUXE3zM5Lh7ZqaXMVAzObUzFua/TZv5GpmQtfcDOmLc+8o5RbHCqdMlXy9DlbXtysJdPHYOHDyld72/i8jZK2t7kt9HcNgPdHZjMqC71Jq19iXDJI0SUenWu55uI8QlauwVt/jTlMwr+ksolV1fAHs1+5WwKjhMxuXAVOUTvrvLOBu4tERjW+ee95DctaNeiWzszMkNwh27LeXyDMEIIvSXupFoNShCBUdMRjuHldaLZN2nMsh1fzjAehkHp00bYELOTRjMcD+AlRDwH0pGR9k4x0wrJX86AZ1omw4/4Y6zvckeLGX9WP5xIZC08uOX/Fg7pXcrEBjsOOoz1RXCI9QaMei6wEe+nMZ6VQ+Mz8W3MiEhLFKrO1ApEFRg4aKn2CDahEp3H74x3TyWqG/TnE+oX87S1PCLHDMqHbshToQ== + template: + metadata: + creationTimestamp: null + name: jhub-vre-iam-secrets + namespace: jhub + type: Opaque From f841d0533305a78473e538302e3a7c039f494304 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 10 Jul 2024 16:08:51 +0200 Subject: [PATCH 40/69] update readme of the cluster --- infrastructure/cluster/flux/README.md | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 infrastructure/cluster/flux/README.md diff --git a/infrastructure/cluster/flux/README.md b/infrastructure/cluster/flux/README.md new file mode 100644 index 00000000..94a4e44a --- /dev/null +++ b/infrastructure/cluster/flux/README.md @@ -0,0 +1,21 @@ +# VRE + +This folder contains the new deployment of the VRE (Jul 2024). Most of the services were re deployed with a newer version, also the k8s cluster running on OpenStack @ CERN. + +The VRE runs on a k8s `v1.29.2-2` cluster with 3 master nodes from 4 (up to 20) workers. + +## Flux + +Flux `v2.3.0` was installed via [bash](https://fluxcd.io/flux/installation/), (see bellow). To install a specific flux version run, for example, + +`curl -s https://fluxcd.io/install.sh | sudo FLUX_VERSION=v2.0.0-rc.5 bash` + +Flux was bootstraped (sync with a repo) manually via: +`flux bootstrap github --owner=vre-hub --repository=vre --branch=main --path=infrastructure/cluster/flux --author-name flux-ops`. + + - To bootstrap the repository you will need to pass a valid [GitHub PAT](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens#creating-a-personal-access-token-classic) - `Settings > Developer settings > Personal access tokens > Tokens (classic)`. + - After running the above command, a new `deploy-key` will be automatically set up in the repository configuration under the username of the person that run the command. + +Manifests inside the path `infrastructure/cluster/flux` will be automatically deployed to the VRE cluster. + +Refer to the [official flux docs](https://fluxcd.io/flux/) for information on how to add manifests e. g. helm charts and add kustomizations. From c27e197739622ffcf87cd5e29db7eb48570e13d6 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 10 Jul 2024 16:59:01 +0200 Subject: [PATCH 41/69] re apply vre db secret --- infrastructure/secrets/jhub/ss_jhub-vre-db.yaml | 2 +- infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/infrastructure/secrets/jhub/ss_jhub-vre-db.yaml b/infrastructure/secrets/jhub/ss_jhub-vre-db.yaml index 491db7c7..27e4006b 100644 --- a/infrastructure/secrets/jhub/ss_jhub-vre-db.yaml +++ b/infrastructure/secrets/jhub/ss_jhub-vre-db.yaml @@ -7,7 +7,7 @@ metadata: namespace: jhub spec: encryptedData: - dbfullstring: AgAAczqDWstQ8KHT1a93Mc8gHZ5u2ZDLZsBDC5F2kvAVXJesorghxK27V7xjRxwBALGaIvbtJdvVvaDemVkQS/eHA2wGVufcDnz6w2InnLnv6DGf4AHbjXRHXoqqBODaY+QsAtv47QgwjKKsC3lGAwf34nHew1N1ISfK4MdbGq8lZaWNcPh7wMdgf6P1fNHw0ivfosiavaKqczIxzu5dJPYE/+4EMJiQ9pxGW4qQKCO6x2xurHSV5QiAnRs/ha8RcXL0WTsW8VD2V3eJvAx9Iyzr9kGrBSpemFvygo+86ARvF6VKS/TTaW4r47DyABMBYM+zAd89A3u4YMK1ZAc5WUWrV+jBZ7UQBmaj3BQWg1+vSaJsdfCabLPkdggDTIaMZwEs1Smy9XlFEvotFUrMmmsPMxBnLl9znLqnb0dEj2ynHbc67i3FOmrXt/PqPrQKEfUCBssKBOC3oaLP7pmv8t2tI+oIZHfMlqWCjWSjNPACgmMXZuw2nwpdl7MdrzZai5XZnqdYSTlNuW1f2A4BInOV70Tr64lPDDj5Uoeq3qYZj6FoznJ/W+Wjz1Eg7xHpWSLVxg7T0T7GoSSgjfx43rwToqZf5eLvBBPgM8Is17PQ7Z7bhpxlKKrPwmnOJk9RFiU/49Z5rpsbLfljZZCD19S8EzJCG5ozyDuk7WcBoFFc8MIzM0JNHQFvJRVefjhnJSdfu6VMYuvVbmkOiiKcrYKVJ1DYhfmMrosiJYvV9mgYVROKz+OrDflXRgYsYWLe5/sQCXKOy0fY6syZlqv9lnOT0lX4XmPDq8SK8h9WFwU= + dbconnectstring: AgCpiwgEsS7scPrHG2S5mTAVTp3n7UkAv5rl1ggCcPbLIfWDupzgUKTx5u/7xXIqx8Y4Mvrqpy3m3fWGEDR7VrXYYpQcU7XN0az8OiYWfCFRsyLrgrrBJLNgqfVT+t/hld2a6KrAOWaeD+fRNeCqCeCzjnxfb8pzFNCIE0257CkUcTJ/c7jwApaGFIJDmM9k5zPBHeVvrxM/HGC8MYMjs4IE4WSGjHofth57BM6Hi40fMie9rKnSOJt9+xeJEsW/fF1h2mY1U9/nMi2CN+q/vY8nZ8Gsr4D3/y675WlW28ICbNxmVNqY1CbWLQYVg5V9GBp3GMCjbGz4MXiNS3Syl04rnHv4wJUQqUy/MkC4j9ezodJmKTS1TeHmjn7Ussgdf3f1nL7ZVFT+VAJC1obL6IvpJGV6JeESA9IExU6zQZYFQimQXW50Uc/g8yuNA7qMJfFCe8eF2iaDXsj/qm2h/pjApTEardXCaXYJ+ZE+X/v6ldY/zMP0f5XANOE9mUFUjwUrR7DupJPECe/sAOa3jqf2tF7scT8sm6SPITXJnp6Xomxu6K0hDaWYz0CTsKEZn9ujSAdGQKfY1ZIlpP+T0bJaDP09a5FxIYAMstIWanvhABFUEVfjeYZwuy4mUe7Gln/ykTfec0lvl7AWkRoDufXgpCYsdEiYN4F15A/semAYDljZ8lewH5Kf0Xy5ye3QdwzNHgBpk3apmgKFva73j7TaWMe0KMY0iRatUrZRZRN2IWi/+sbYD5FzIRhzYT1I0OlBeZeWqzvtTNE4Ta9p1GBnzXIQf1iAuEanlWMdlo3EuA== template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml b/infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml index 9b3470af..c4a6b78e 100644 --- a/infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml +++ b/infrastructure/secrets/jhub/ss_jhub-vre-iam-secrets.yaml @@ -7,8 +7,8 @@ metadata: namespace: jhub spec: encryptedData: - client_id: AgBO67T7tMt5YePQHu9FWTqsQLkQ+Wl+pePpv06Hd9dOF9ReUuCrNdfJNoUHIq9yqN8Nm1nmiq+yDKJ4KLlK+aIesf4iDN2HneMBChb2jsEcgvvGK77k3esGXg1eEZnvgHkDj2vmEo6G1W+9RHv74i/ude649LdDGMrfTqdPy9qwIJubrK0bCugJR55oTfmV5mL7tmH9sMQcUvthivOLfigZa8hYQ+3UgLNw6NfRHqDkGFuL6DUgXZuMLb9xPPJs/5AQOTvTuUqRU5ewi5tNJFh/28V4BEJkQaScXevrvf+luGVQo/p07jaTsjsflFbekitGWDT81VyzHYquNtbx9cxoLFRJ/1aRArSkz360w9nlfGAcHK8oeZwBAh1rgVt9Y+NtPyIIdLEH8Lr4XoPXPfVPn/S6PkN7sSv4MW8GDGjBziTfdqd5fzpUR0TVoavDM/L/NPGjTC0kEBaUoAvhfGF1gz7G9IO6sJP7EhUnbPFaun5jlJ0MmLOZTMgYzOa16WShrfIhFHgJ7qdg83IrDi295EXr+X8smla3jB/a2HA9u6vggMvthg5X1sORC/hN/XKStuh4ym+cW6akQljcy32g9xrTBaPWHWZljVt/+n3K6z5UWOxSHndVmM1bfCvMOBNZpSJQ+1ZtXKYHwVjqObWIEd0P4hY9cCVMRzO7KRQvNls8RI/YxXpP3ejIGux/QaDLtKjCHHdq7l33u/a9SzXxKuyffPgYmFUMKAmLkRQQj7GORKc= - client_secret: AgA5wJzk6+kY1aa0tix10u7KLsDZ5X4VYYtrAko4MaYS8zLcq1AcFcDWMNFanFp/a03+l+DnC8D7Iqm3BURmCJ1gyCQETIxPGJxWnr0UjQ4Gfrm+bACawQ+ybWsng7wB1rutV1oMPp8Z+fDYlJsjiC4tBySzTZlPfhXVT6lmOE9kCibzxfnokpnf+yKIOGS6KzTpWrRiI4ktPyAw9pVbF1p/EaEaabtFrSLX6xqHiAO5TgjOcTQ366nQ81LxpxOSMb9yh/NBn59C4rbxCzyJPPxlDBp0n289DMMoE1a17x0mwcN8WZvHEtWOEa6JstIVCuMTro/hDO/9xFATZTMyIzSVPw/4UquexY0aEabAxyhcgm6cUIcsLjcdk+29+1yjcTV+lCpY6MdXHUXE3zM5Lh7ZqaXMVAzObUzFua/TZv5GpmQtfcDOmLc+8o5RbHCqdMlXy9DlbXtysJdPHYOHDyld72/i8jZK2t7kt9HcNgPdHZjMqC71Jq19iXDJI0SUenWu55uI8QlauwVt/jTlMwr+ksolV1fAHs1+5WwKjhMxuXAVOUTvrvLOBu4tERjW+ee95DctaNeiWzszMkNwh27LeXyDMEIIvSXupFoNShCBUdMRjuHldaLZN2nMsh1fzjAehkHp00bYELOTRjMcD+AlRDwH0pGR9k4x0wrJX86AZ1omw4/4Y6zvckeLGX9WP5xIZC08uOX/Fg7pXcrEBjsOOoz1RXCI9QaMei6wEe+nMZ6VQ+Mz8W3MiEhLFKrO1ApEFRg4aKn2CDahEp3H74x3TyWqG/TnE+oX87S1PCLHDMqHbshToQ== + client_id: AgA2y7WhQ8eGh89DEFg4/1gV9I6sfV3Tb1TjZ9jmOktcFOoCmYN6xis2rQUnbN270Zcn2jNKEIHLHZo1By+R/SoTv8H5QfoxRl9ofga2SAJSO6iIndRwp0162e98DSxcjyX6kvbL1k+ZYc0cS4S4ipJQXMNCAgzBw9mosVbWe/Au2kandST0WeFCULb3kOZAzgNriEIu7av7x5RE+jkMa7UJqmpOYBc9aiEin1Egf8adOMkB9ObDeXLta0VortX9/+2NROgDCnlyIMyGSxSZjuyfRbY0xmVXt30V+nVZhKwYyNDLMbkEBV+pwJPQ85+3LxOAoUsDlOX//VHu92EAjd7X37n6EKjSVb2lfysJ8kbQA1oGLIm2/+EwQ5+rVqacU3Onqy6oTI3wQk2kDdBqLoH6Qzs40vOT7tqI+LM2q0VwQeVtnvjVNuDZH+UfG2IaovcVsWipVxI4RsCV9D/pmPbJh+RunWIMKGpMJtTg6iRJzpAcI4ScedJao9GdOaMzmc/q9bD873Hdn1xT/4KiGL5X2Ied4Kv461hfUqDIO/M1ZkY8kFlWyLGH0RIPEEVK7M7tPJ4fp9NgpNU36xVo/5psDDp/pqmHdGGYZmaa59oioaasN+QlcRbiSS57jaThKoTsq6R3X1ptnPL322T/eHKdGxq4vc8EkhhZr0PBv/hnYNsUtRGnfH5pw5BbJ1niXNrly9IUh6VKWP/Nqde8bSabWufWDFOiji+yhV5vp5D9RVtI8o8= + client_secret: AgCsPwFsI9I7sqoXlwKVAIgSwWfdIwmCZZ7DtHGkhEhGCFCtVyyl40d7E/8Hn+Cez6G3bAW+x/5yUCvwo2HUEzZCofnxUoAzCpKPUYfa60E7CSFySKZ68JnMa6NDdhBteH1n3iDj6N2H7fiKa1PRquOJTCffPgAlV+iMb51oC0D1w19v+i9u1oRegSuoECKz4XiNsMXBZ55dIdUFwwFkuxbRVF/VDBiDbyyhR6sYmKvX7IADAwi1cEeWRZk+SWyBfBVUVT7Wr8bNz2D3Yo0jV7VKHZyOQrkx0dWm2T6PLKLgT1/uk02fjqjlnPUTyvEl8/rwvMwBBEHPrf8NJKJKXBgRkQ8BDjRKltKADC18QCSEfCP/yCKgfZ3/DoqGgV5Qmp2JUqRrpB32piKrVOF/mWtVNKdjqISGEikm78gSOYBs3Sx7z7hGb2a3X8HlniNFryMMQkU9zwfCB0/KZ5CI39SOLTH7rec3rrdBh0icgqxPphqNkXK4x0P7iSyU88yOFCFKriM4uQkEGkOhUuWtyKzgPQGOZ5sXzbHOyRvU128V4pC9ULktuTTkJjYcyIjQb9i54cug/zdWl20L1MGiqq9ogkxqOJw6k3cSmVT27H4XdeQwZocuQVAXEwWhaUHN6iRmNrgVSnE8cqeKUnzZiQ0w7HTozCkCUaSJNW94uZQKq4AXT+XBgSIsxpfKh3u9ooG6mhk9eoc9LC64/TMMAswfEHnmRJp9AhXIpDapMwoEq5OL3/acFd34oeDuR798Wf8BVJdswTgKKB17yKePawWrvu1DJPlsWR953X+/0PAazWFCae/6nw== template: metadata: creationTimestamp: null From f776c5fe1b0cbc80692c619664486e42ec78b1a7 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 12 Jul 2024 11:37:22 +0200 Subject: [PATCH 42/69] update secret script and apply jhub share secrets --- infrastructure/scripts/jhub_secrets.sh | 26 ++++++++++++------- .../secrets/jhub/ss_jhub-vre-share.yaml | 17 ++++++++++++ 2 files changed, 33 insertions(+), 10 deletions(-) create mode 100644 infrastructure/secrets/jhub/ss_jhub-vre-share.yaml diff --git a/infrastructure/scripts/jhub_secrets.sh b/infrastructure/scripts/jhub_secrets.sh index e771df54..acd6aeab 100644 --- a/infrastructure/scripts/jhub_secrets.sh +++ b/infrastructure/scripts/jhub_secrets.sh @@ -4,15 +4,21 @@ RAW_SECRETS_TMP_DIR="/root/software/vre/infrastructure/secrets/tmp_local_secrets SECRETS_STORE="/root/software/vre/infrastructure/secrets/jhub" NAMESPACE="jhub" -SECRET_NAME="jhub-vre-iam-secrets.yaml" -SECRET_FILE=${RAW_SECRETS_TMP_DIR}/${SECRET_NAME} -echo "Creating ${SECRET_NAME} secret" -cat $SECRET_FILE | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_NAME} -kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_NAME} +SECRET_FILE="jhub-vre-iam-secrets.yaml" +SECRET_FULL_PATH=${RAW_SECRETS_TMP_DIR}/${SECRET_FILE} +echo "Creating ${SECRET_FILE} secret" +cat $SECRET_FULL_PATH | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_FILE} +kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_FILE} -SECRET_NAME="jhub-vre-db.yaml" -SECRET_FILE=${RAW_SECRETS_TMP_DIR}/${SECRET_NAME} -echo "Creating ${SECRET_NAME} secret" -cat $SECRET_FILE | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_NAME} -kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_NAME} +SECRET_FILE="jhub-vre-db.yaml" +SECRET_FULL_PATH=${RAW_SECRETS_TMP_DIR}/${SECRET_FILE} +echo "Creating ${SECRET_FILE} secret" +cat $SECRET_FULL_PATH | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_FILE} +kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_FILE} + +SECRET_FILE="jhub-vre-share.yaml" +SECRET_FULL_PATH=${RAW_SECRETS_TMP_DIR}/${SECRET_FILE} +echo "Creating ${SECRET_FILE} secret" +cat $SECRET_FULL_PATH | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_FILE} +kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_FILE} \ No newline at end of file diff --git a/infrastructure/secrets/jhub/ss_jhub-vre-share.yaml b/infrastructure/secrets/jhub/ss_jhub-vre-share.yaml new file mode 100644 index 00000000..a089fae7 --- /dev/null +++ b/infrastructure/secrets/jhub/ss_jhub-vre-share.yaml @@ -0,0 +1,17 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: jhub-vre-share + namespace: jhub +spec: + encryptedData: + share_access_id: AgC8ac1LoJVul+V9QUnWHovT0CONEb1cioD5xp3hFzU11WgMku8rC7jGD+30lK3DWhnL0y0vuxibLBKwCbDRGhWa7n1aCr0AM/AiSv3x/fnXOBkMPfR6yFFsEz3tpwxiNpqbTjecSIC0pD4N3XkQFQdsRuw3k2kNP6wfR7cM3oUZB8TalUZLO4om8RTfQUScUaoLsrnfEtMsEJxo+jw0Y9CsnW6rHk8JctqDHb9UO7xfkKcevr47btvrnbOT+ae3aLVMUG6kVTQSbX/02g9KTP+F8PaUKbORIbOvHvJZPMitdCnR3/6tZY5s2jheW+dvZ3u+YmuqmUuQQYqrFhBhev5hDYcwzrdhReHGKbsy0w23BYmcIf7V/+Ziasm2DVuGXVLxrwPyVVHZG3ZTIjltveiePu0hCavTTWmVAXyv5VmH7TotKJdpi9dOzSIO+WZLDRBxXzZXqag2Tp8jaKov6qL16FCeo+shDDNhcSH695VnLtonaAq4F3N9T2Db6CGLq2gNdFUlnanfG0smSNWlDC6x5Ra6vEp9FQyPMGH9tDtgG3yL584lclGHPTyl/FFeG0KXJZZgHF4b2pg6kbuJV4Llo5Q3UrtiHxVlF88wthjChFf+1nkSZzVGJlcd5+BFiS4h2WRXAEBBQBzv/f/F+iQ8OkRo/IVnDDV7vLooMV8qLN/PHipJRrOXOrD91tCzRHH+tGf5GfQmBe02gh/RofT3LO+Y5xQ3RpDPYlGdGkNntemYm1C0X26n + share_id: AgBufeVG2SGrmoW4i6shHwUOLllNZNeeMZhbC8W6gaeZkLrWYQ2cPkhhgV2D4xp1Xhul9yeVCyECUQUkrpiX7V3iVUn4/ivxGV7eRixy7sLo8qfji4PmQpZ/xpRCpSfqMv2EquhRwpmrsm4oppJRWDMeTCTXa1RO8ogJwogpwQaiZSlmDTq2OvrDBTpGlKcJgpNLtxJYmB6iJQrHUdODGPWYrLxZOjTh0gdgWKBfjHZTXpCoGCATqLyc5Xlqa4jOPn7VP/SbPIHFAW4FsfJ4tHjbC0k3IHSbMm6querIPRVQla8iqvtKXl2y4lGneQG++5PsMIgH89/T76LnS7Bnb3lnlCTlo5oUVhsbbsMyzJi3P//kh3XzeNQiOQ27PpAhBn9+/HScWZ/9RprgZJpBwtpWLo0oBt5LcHPGEgpWfimkCBm0FUKdV1BLuvK2fX1pydseGXv1YqTpqTxcjVmznfkmUAMs6lIVN7GSru6i3YOoOKpyKF2BjWpAvbYY+eXglwK8A1SSFzQO7cfCtjW5gFSHcPEz+akH6gmOu7g15ambjNcGkEdvDDTmXt3d7Fu7K2r1hb3WEFrii9BnAbPywMY6RkYsz14kqyo2rFo5XUqsk5e+1Vk/iPlfE5H9R+857Mr4AWmVmeBbyVUroHlssn/jUB8PWnp1gPuMZSKG/5N2wPJG6Zs2M69ukYg1lpktmlNOQGPc9xBFLqK4TLX8Wum7C0uhoXW+ZWguQKrlZRbPIdAz/gU= + template: + metadata: + creationTimestamp: null + name: jhub-vre-share + namespace: jhub + type: Opaque From bb2a73ee932557d45bb085a35b48c962eae4644e Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Wed, 24 Jul 2024 09:45:47 +0200 Subject: [PATCH 43/69] remove vre-share-secrets as they are not needed --- infrastructure/scripts/jhub_secrets.sh | 6 ------ .../secrets/jhub/ss_jhub-vre-share.yaml | 17 ----------------- 2 files changed, 23 deletions(-) delete mode 100644 infrastructure/secrets/jhub/ss_jhub-vre-share.yaml diff --git a/infrastructure/scripts/jhub_secrets.sh b/infrastructure/scripts/jhub_secrets.sh index acd6aeab..70cdf065 100644 --- a/infrastructure/scripts/jhub_secrets.sh +++ b/infrastructure/scripts/jhub_secrets.sh @@ -16,9 +16,3 @@ SECRET_FULL_PATH=${RAW_SECRETS_TMP_DIR}/${SECRET_FILE} echo "Creating ${SECRET_FILE} secret" cat $SECRET_FULL_PATH | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_FILE} kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_FILE} - -SECRET_FILE="jhub-vre-share.yaml" -SECRET_FULL_PATH=${RAW_SECRETS_TMP_DIR}/${SECRET_FILE} -echo "Creating ${SECRET_FILE} secret" -cat $SECRET_FULL_PATH | kubeseal --controller-name=sealed-secrets-controller --controller-namespace=sealed-secrets --format yaml --namespace=${NAMESPACE} > ${SECRETS_STORE}/ss_${SECRET_FILE} -kubectl apply -f ${SECRETS_STORE}/ss_${SECRET_FILE} \ No newline at end of file diff --git a/infrastructure/secrets/jhub/ss_jhub-vre-share.yaml b/infrastructure/secrets/jhub/ss_jhub-vre-share.yaml deleted file mode 100644 index a089fae7..00000000 --- a/infrastructure/secrets/jhub/ss_jhub-vre-share.yaml +++ /dev/null @@ -1,17 +0,0 @@ ---- -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - creationTimestamp: null - name: jhub-vre-share - namespace: jhub -spec: - encryptedData: - share_access_id: AgC8ac1LoJVul+V9QUnWHovT0CONEb1cioD5xp3hFzU11WgMku8rC7jGD+30lK3DWhnL0y0vuxibLBKwCbDRGhWa7n1aCr0AM/AiSv3x/fnXOBkMPfR6yFFsEz3tpwxiNpqbTjecSIC0pD4N3XkQFQdsRuw3k2kNP6wfR7cM3oUZB8TalUZLO4om8RTfQUScUaoLsrnfEtMsEJxo+jw0Y9CsnW6rHk8JctqDHb9UO7xfkKcevr47btvrnbOT+ae3aLVMUG6kVTQSbX/02g9KTP+F8PaUKbORIbOvHvJZPMitdCnR3/6tZY5s2jheW+dvZ3u+YmuqmUuQQYqrFhBhev5hDYcwzrdhReHGKbsy0w23BYmcIf7V/+Ziasm2DVuGXVLxrwPyVVHZG3ZTIjltveiePu0hCavTTWmVAXyv5VmH7TotKJdpi9dOzSIO+WZLDRBxXzZXqag2Tp8jaKov6qL16FCeo+shDDNhcSH695VnLtonaAq4F3N9T2Db6CGLq2gNdFUlnanfG0smSNWlDC6x5Ra6vEp9FQyPMGH9tDtgG3yL584lclGHPTyl/FFeG0KXJZZgHF4b2pg6kbuJV4Llo5Q3UrtiHxVlF88wthjChFf+1nkSZzVGJlcd5+BFiS4h2WRXAEBBQBzv/f/F+iQ8OkRo/IVnDDV7vLooMV8qLN/PHipJRrOXOrD91tCzRHH+tGf5GfQmBe02gh/RofT3LO+Y5xQ3RpDPYlGdGkNntemYm1C0X26n - share_id: AgBufeVG2SGrmoW4i6shHwUOLllNZNeeMZhbC8W6gaeZkLrWYQ2cPkhhgV2D4xp1Xhul9yeVCyECUQUkrpiX7V3iVUn4/ivxGV7eRixy7sLo8qfji4PmQpZ/xpRCpSfqMv2EquhRwpmrsm4oppJRWDMeTCTXa1RO8ogJwogpwQaiZSlmDTq2OvrDBTpGlKcJgpNLtxJYmB6iJQrHUdODGPWYrLxZOjTh0gdgWKBfjHZTXpCoGCATqLyc5Xlqa4jOPn7VP/SbPIHFAW4FsfJ4tHjbC0k3IHSbMm6querIPRVQla8iqvtKXl2y4lGneQG++5PsMIgH89/T76LnS7Bnb3lnlCTlo5oUVhsbbsMyzJi3P//kh3XzeNQiOQ27PpAhBn9+/HScWZ/9RprgZJpBwtpWLo0oBt5LcHPGEgpWfimkCBm0FUKdV1BLuvK2fX1pydseGXv1YqTpqTxcjVmznfkmUAMs6lIVN7GSru6i3YOoOKpyKF2BjWpAvbYY+eXglwK8A1SSFzQO7cfCtjW5gFSHcPEz+akH6gmOu7g15ambjNcGkEdvDDTmXt3d7Fu7K2r1hb3WEFrii9BnAbPywMY6RkYsz14kqyo2rFo5XUqsk5e+1Vk/iPlfE5H9R+857Mr4AWmVmeBbyVUroHlssn/jUB8PWnp1gPuMZSKG/5N2wPJG6Zs2M69ukYg1lpktmlNOQGPc9xBFLqK4TLX8Wum7C0uhoXW+ZWguQKrlZRbPIdAz/gU= - template: - metadata: - creationTimestamp: null - name: jhub-vre-share - namespace: jhub - type: Opaque From 5e2210264632265dfe33365330aab287f0953f12 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Thu, 25 Jul 2024 16:20:56 +0200 Subject: [PATCH 44/69] add new jhub deployment on the new vre cluster --- .../flux/jhub/jhub-configmap-profiles.yaml | 57 +++++ .../flux/jhub/jhub-helm_repository.yaml | 8 + .../cluster/flux/jhub/jhub-namespace.yaml | 6 + .../flux/jhub/jhub-patch-deployment.yaml | 9 + .../cluster/flux/jhub/jhub-release.yaml | 214 ++++++++++++++++++ .../cluster/flux/jhub/jhub-storage.yaml | 52 +++++ .../jhub/ss_cern-sectigo-tls-certificate.yaml | 17 -- .../jhub/ss_jhub-cvre-dbconnectstring.yaml | 15 -- .../jhub/ss_jhub-cvre-iam-secrets.yaml | 16 -- 9 files changed, 346 insertions(+), 48 deletions(-) create mode 100644 infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml create mode 100644 infrastructure/cluster/flux/jhub/jhub-helm_repository.yaml create mode 100644 infrastructure/cluster/flux/jhub/jhub-namespace.yaml create mode 100644 infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml create mode 100644 infrastructure/cluster/flux/jhub/jhub-release.yaml create mode 100644 infrastructure/cluster/flux/jhub/jhub-storage.yaml delete mode 100644 infrastructure/secrets/jhub/ss_cern-sectigo-tls-certificate.yaml delete mode 100644 infrastructure/secrets/jhub/ss_jhub-cvre-dbconnectstring.yaml delete mode 100644 infrastructure/secrets/jhub/ss_jhub-cvre-iam-secrets.yaml diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml new file mode 100644 index 00000000..9301be03 --- /dev/null +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -0,0 +1,57 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: jhub-profiles + namespace: jhub +data: + values.yaml: | + singleuser: + profileList: + - display_name: "Default environment" + description: "Based on a scipy-notebook environment with a python-3.11 kernel, the rucio-jupyterlab extension and the reana-client installed." + default: True + - display_name: "Default environment - python 3.8" + description: "Same environment as the default one except for a python-3.8 kernel installed. This environment will be deprecated soon." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-py38:sha-7ed7d80 + - display_name: "Default environment - python 3.9" + description: "Same environment as the default one except for a python-3.9 kernel installed. This environment will be deprecated soon." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser:sha-423e01a + - display_name: "ROOT environment" + description: "ROOT v6.26.10 as well as a ROOT C++ and a python-3.8 kernel." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-root:sha-c94d95a + - display_name: "VIRGO - WDF environment" + description: "Contains the full WDF v2.2.1 environment - Python 3.9 kernel." + kubespawner_override: + image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 + - display_name: "KM3Net Science Project environment" + description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries - Python 3.9 kernel." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-km3irf:sha-c1e2a18 + - display_name: "KM3NeT and CTA combined analysis environment" + description: "Contains gammapy=0.17 and astropy - python-3.8 kernel." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-combined_ana_km3net_cta:sha-520edf8 + - display_name: "Indirect Dark Matter Detection Sciente Project environment" + description: "Contains the MLFermiLATDwarfs and fermitools libraries - Python 3.9 kernel." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 + - display_name: "Dev enviroment" + description: "For testing and development purposes" + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-dev:sha-42bc682 + - display_name: "REANA dev environment" + description: "For testing purposes" + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest + # - display_name: "Default environment - python3.11 + jupyterlab v4" + # description: "With latest rucio jupyterlab extension version - under dev and testing" + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-py311:latest + # - display_name: "Dask+ROOT" + # description: "Gives you the ability to spawn Dask clusters" + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-dask-root:sha-7805adc + diff --git a/infrastructure/cluster/flux/jhub/jhub-helm_repository.yaml b/infrastructure/cluster/flux/jhub/jhub-helm_repository.yaml new file mode 100644 index 00000000..4e655c3f --- /dev/null +++ b/infrastructure/cluster/flux/jhub/jhub-helm_repository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1beta1 +kind: HelmRepository +metadata: + name: jhub-vre + namespace: jhub +spec: + interval: 10m + url: https://hub.jupyter.org/helm-chart/ diff --git a/infrastructure/cluster/flux/jhub/jhub-namespace.yaml b/infrastructure/cluster/flux/jhub/jhub-namespace.yaml new file mode 100644 index 00000000..c28b5fac --- /dev/null +++ b/infrastructure/cluster/flux/jhub/jhub-namespace.yaml @@ -0,0 +1,6 @@ +kind: Namespace +apiVersion: v1 +metadata: + name: jhub + labels: + name: jhub diff --git a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml new file mode 100644 index 00000000..a94fd6e8 --- /dev/null +++ b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml @@ -0,0 +1,9 @@ +# K8s manifest to patch jhub deployment to point to an existing share + +spec: + template: + spec: + volumes: + - name: pvc + persistentVolumeClaim: + claimName: jhub-vre-singleuser-preprovisioned-manila-pvc diff --git a/infrastructure/cluster/flux/jhub/jhub-release.yaml b/infrastructure/cluster/flux/jhub/jhub-release.yaml new file mode 100644 index 00000000..0c53bc87 --- /dev/null +++ b/infrastructure/cluster/flux/jhub/jhub-release.yaml @@ -0,0 +1,214 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: jhub-vre + namespace: jhub +spec: + releaseName: jhub-vre + interval: 5m + chart: + spec: + sourceRef: + kind: HelmRepository + name: jhub-vre + namespace: jhub + chart: jupyterhub + interval: 5m + version: 3.3.7 + valuesFrom: + - kind: Secret + name: jhub-vre-iam-secrets + valuesKey: client_id + targetPath: hub.config.RucioAuthenticator.client_id + - kind: Secret + name: jhub-vre-iam-secrets + valuesKey: client_secret + targetPath: hub.config.RucioAuthenticator.client_secret + - kind: Secret + name: jhub-vre-db + valuesKey: dbconnectstring + targetPath: hub.db.url + - kind: ConfigMap + name: jhub-profiles + valuesKey: values.yaml + + values: + proxy: + service: + type: ClusterIP + hub: + service: + type: ClusterIP + # network policy needs to be modified to allow access to the Rucio server + # (disabling it for now as a workaround, see also the ones for singeluser and proxy below) + networkPolicy: + enabled: false + db: + upgrade: true + type: postgres # passed as s secret (dbconnect string) from the jhub-vre-db secret + config: + JupyterHub: + authenticator_class: "generic-oauth" + RucioAuthenticator: + # client_id: "" # set through secret + # client_secret: "" # set through secret + authorize_url: https://iam-escape.cloud.cnaf.infn.it/authorize + token_url: https://iam-escape.cloud.cnaf.infn.it/token + userdata_url: https://iam-escape.cloud.cnaf.infn.it/userinfo + username_key: preferred_username + enable_auth_state: true + allow_all: true + scope: + - openid + - profile + - email + + extraConfig: + + token-exchange: | + import pprint + import os + import warnings + import requests + from oauthenticator.generic import GenericOAuthenticator + + # custom authenticator to enable auth_state and get access token to set as env var for rucio extension + class RucioAuthenticator(GenericOAuthenticator): + def __init__(self, **kwargs): + super().__init__(**kwargs) + self.enable_auth_state = True + + def exchange_token(self, token): + params = { + 'client_id': self.client_id, + 'client_secret': self.client_secret, + 'grant_type': 'urn:ietf:params:oauth:grant-type:token-exchange', + 'subject_token': token, + 'scope': 'openid profile', + 'audience': 'rucio' + } + response = requests.post(self.token_url, data=params) + rucio_token = response.json()['access_token'] + return rucio_token + + async def pre_spawn_start(self, user, spawner): + auth_state = await user.get_auth_state() + pprint.pprint(auth_state) + if not auth_state: + # user has no auth state + return + + # define token environment variable from auth_state + spawner.environment['RUCIO_ACCESS_TOKEN'] = self.exchange_token(auth_state['access_token']) + spawner.environment['EOS_ACCESS_TOKEN'] = auth_state['access_token'] + + # set the above authenticator as the default + c.JupyterHub.authenticator_class = RucioAuthenticator + + # enable authentication state + c.GenericOAuthenticator.enable_auth_state = True + + if 'JUPYTERHUB_CRYPT_KEY' not in os.environ: + warnings.warn( + "Need JUPYTERHUB_CRYPT_KEY env for persistent auth_state.\n" + " export JUPYTERHUB_CRYPT_KEY=$(openssl rand -hex 32)" + ) + c.CryptKeeper.keys = [os.urandom(32)] + + singleuser: + defaultUrl: "/lab" + # The liefcycle hooks are used to create the Rucio configuration file, + # and the token file by copying the REFRESH_TOKEN from the environment variable to the token file. + lifecycleHooks: + postStart: + exec: + command: + - "sh" + - "-c" + - > + mkdir -p /certs /tmp; + echo -n $RUCIO_ACCESS_TOKEN > /tmp/rucio_oauth.token; + echo -n "oauth2:${EOS_ACCESS_TOKEN}:iam-escape.cloud.cnaf.infn.it/userinfo" > /tmp/eos_oauth.token; + chmod 0600 /tmp/eos_oauth.token; + mkdir -p /opt/rucio/etc; + echo "[client]" >> /opt/rucio/etc/rucio.cfg; + echo "rucio_host = https://vre-rucio.cern.ch" >> /opt/rucio/etc/rucio.cfg; + echo "auth_host = https://vre-rucio-auth.cern.ch" >> /opt/rucio/etc/rucio.cfg; + echo "ca_cert = /certs/rucio_ca.pem" >> /opt/rucio/etc/rucio.cfg; + echo "account = $JUPYTERHUB_USER" >> /opt/rucio/etc/rucio.cfg; + echo "auth_type = oidc" >> /opt/rucio/etc/rucio.cfg; + echo "oidc_audience = rucio" >> /opt/rucio/etc/rucio.cfg; + echo "oidc_polling = true" >> /opt/rucio/etc/rucio.cfg; + echo "auth_token_file_path = /tmp/rucio_oauth.token" >> /opt/rucio/etc/rucio.cfg; + networkPolicy: + enabled: false + storage: + type: static + static: + pvcName: jhub-vre-singleuser-preprovisioned-manila-pvc # manually added an existing share (refer to jhub-storage.yaml) + # extraVolumes: + # - name: cvmfs-cern-instance + # persistentVolumeClaim: + # claimName: cvmfs + # - name: eulake-cern-eos-rse # mounts the EOS RSE needed for the Rucio JupiterLab extension + # hostPath: + # path: /var/eos/eulake # This is pointing to /eos/eulake/escape/data, defined on the eosxd/configmap + # extraVolumeMounts: + # - name: cvmfs-cern-instance + # mountPath: /cvmfs + # # CVMFS automount volumes must be mounted with HostToContainer mount propagation. + # mountPropagation: HostToContainer + # - name: eulake-cern-eos-rse # mounts the EOS RSE needed for the Rucio JupiterLab extension + # mountPath: /eos/cern-eos-rse + # mountPropagation: HostToContainer + # readOnly: true + image: + name: ghcr.io/vre-hub/vre-singleuser-py311 + tag: latest + pullPolicy: Always + + # nodeSelector: + # jupyter: singleuser + # extraTolerations: + # - key: jupyter + # operator: Equal + # value: singleuser + # effect: NoSchedule + # memory: + # limit: 3.5G #4G + # guarantee: 3G #2G + + cmd: null + extraEnv: + # JUPYTERHUB_SINGLEUSER_APP: "notebook.notebookapp.NotebookApp" + # RUCIO_MODE: "replica" + # RUCIO_WILDCARD_ENABLED: "1" + # RUCIO_BASE_URL: "https://vre-rucio.cern.ch" + # RUCIO_AUTH_URL: "https://vre-rucio-auth.cern.ch" + # RUCIO_WEBUI_URL: "https://vre-rucio-ui.cern.ch" + # RUCIO_DISPLAY_NAME: "RUCIO - CERN VRE" + # RUCIO_NAME: "vre-rucio.cern.ch" + # RUCIO_SITE_NAME: "CERN" + # RUCIO_OIDC_AUTH: "env" + # RUCIO_OIDC_ENV_NAME: "RUCIO_ACCESS_TOKEN" + # RUCIO_DEFAULT_AUTH_TYPE: "oidc" + # RUCIO_OAUTH_ID: "rucio" + # RUCIO_DEFAULT_INSTANCE: "vre-rucio.cern.ch" + # RUCIO_DESTINATION_RSE: "CERN-EOS" + # RUCIO_RSE_MOUNT_PATH: "/eos/cern-eos-rse" + # RUCIO_PATH_BEGINS_AT: "2" + # RUCIO_CA_CERT: "/certs/rucio_ca.pem" + # OAUTH2_TOKEN: "FILE:/tmp/eos_oauth.token" + + ingress: + enabled: true + ingressClassName: nginx + annotations: + cert-manager.io/cluster-issuer: "letsencrypt" # this issues a certificate for the domain through cert-manager automatically + hosts: + - jhub-vre.cern.ch + tls: + - hosts: + - jhub-vre.cern.ch + secretName: cert-manager-tls-ingress-secret-jhub + diff --git a/infrastructure/cluster/flux/jhub/jhub-storage.yaml b/infrastructure/cluster/flux/jhub/jhub-storage.yaml new file mode 100644 index 00000000..b4714e8b --- /dev/null +++ b/infrastructure/cluster/flux/jhub/jhub-storage.yaml @@ -0,0 +1,52 @@ +# Follow the instructions in +# https://kubernetes.docs.cern.ch/docs/storage/fileshares/#using-existing-shares +# +# Because we are recreating the cluster, the share already existed and we don't want to +# create a new one. We will use the existing share. +# +apiVersion: v1 +kind: PersistentVolume +metadata: + name: manila-preprovisioned-pv-vre-share +spec: + csi: + driver: cephfs.manila.csi.openstack.org + # NOTE: volumeHandle MUST be unique across all PersistentVolume objects in the cluster. + # The value itself can be arbitrary. You can use metadata.name for consistency. + volumeHandle: manila-preprovisioned-pv-vre-share + volumeAttributes: + shareID: 344b7a7f-6b8b-4eb9-8399-67895e1f1240 + shareAccessID: 690c1631-901a-4a12-9a3d-d92879adaf3c + + # CephFS shares can be mounted using either FUSE or kernel CephFS client. + # FUSE is used by default. Uncomment and modify the parameter below to change + # the mount tool. See openstack-manila-csi docs to see all supported parameters. + # cephfs-mounter: kernel + + nodeStageSecretRef: + name: os-trustee + namespace: kube-system + nodePublishSecretRef: + name: os-trustee + namespace: kube-system + accessModes: + - ReadWriteMany + capacity: + storage: 800Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: jhub-vre-singleuser-preprovisioned-manila-pvc + namespace: jhub +spec: + accessModes: + - ReadWriteMany + resources: + requests: + storage: 800Gi + # volumeName must match the name we have set in the PersistentVolume defined above. + volumeName: manila-preprovisioned-pv-vre-share + # Storage class name must be set to an empty string "" + # to disable dynamic provisioning. + storageClassName: "" diff --git a/infrastructure/secrets/jhub/ss_cern-sectigo-tls-certificate.yaml b/infrastructure/secrets/jhub/ss_cern-sectigo-tls-certificate.yaml deleted file mode 100644 index 08c05a8d..00000000 --- a/infrastructure/secrets/jhub/ss_cern-sectigo-tls-certificate.yaml +++ /dev/null @@ -1,17 +0,0 @@ -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - creationTimestamp: null - name: cern-sectigo-tls-certificate - namespace: jhub -spec: - encryptedData: - tls.crt: AgAU9ZovhJ1txG+u3Q4u9roXvU6V6oiUWCkUIUJ+jK/QzGoZqwFxs7V6du3yj4APScflxKdcwdbx+ILQ9flz4yZAfKio+rGiQeCGhH3dLsOfqIVsujoviKNH5+dMJ1GgDfAsThZ9lVuSMwFxkci9P3r9cqOiBuaJctujP2+552VV3BP7WMNmCECSCEo9361ePKEF7Jib9CG8fCRSXsxEls/bwgTuVLd5oUFuJxe5m9a9ggSCjsbV2tLEIcoOdTGODP+CkDSk0dwoua9IGi2F4R7Me9asLjACG3oBdhFCDk42af02jXwshfLG4V5eM5Jl6uPMwvNMzxyMgjwN8yhl0LuYgK4Qy8cP1T8AzckLzeXFWB0JqeLBfIIz4ze5v1/vDHvcV9S+WTspnkuV9nyz8JSwkgtvwZeZSoBoyGvO463QCcawfhbmYn+kCqHLs5h5TPuLSO/roS4wC7KnWJQYPMKPxG370o4m/laMe023fCPA9qJny0tj7JyPwJGNQkqn8ldXf1xu5g2rmSrzCqfXRzM1NU2Nx2Jl6ENgfpW2DqaUNn9pHgIE+A94lKxuECMz36Ez1YoF5ECnrw2XuzyWEAVp00y74m8kUHCjfqgOGMI27FX8BzElDXcaeH51Fb70pXL3ydmnKFnIla0QGgOBzZ//Th8BW3KeT/GFVR0mqVtkbmdzPHofPqVTcD+LqmrruHVXaAfuSZOGAhhsLWizWOuSVVnYvOH7Mq+suoshMws8hZd18IPcucEJyGRAFZdwwxHJDgiEwakTH8WdWFcrlCxYPZs3B5ADHO2y7GgHo9B6GuINRx5iEafo0QHa5uvwsKuVDmeo4YLBCeHOt6ez92V23aCAgIY86WVYMaPjNwHVTjNunR3B/LSF1T/Mv5QGoN5EPjWBsqUnOFDwDBoJrayyF6X3KcBmabl6DJ1m3rWM1XqMFciTYyBIs2fKyqfbHs0NBPJtAXjGP9BxDBT9sjEhFbS0DZfFW4EWeXBkF9rxLa8e7iTcwVu409RoZz6iUzySBJsXpsOtXNw30EGHvta1WEPEKVJ+Wr0LcTbgwjJCXIwefKTHDs+3zGIPOBZf1qbxI4Sv9QRn+8rUa0/Ac+bmoHKszqyH/AZXhhF26+lr3iBuyAQ+W220gmkOYyvEUPIMQGegvNAF8v18Dgl88mw0h3/EyEG1GQ4qGj7hxcSV20RbH1Zt4tPZkdCs5MNX0mWo4tzBpaaKC2XazfUxYdlGfpvGseD0jUidMCc0ng4b/ocO8W3T8oGUuCu4OAIFn8MEiSt5dFDvIQqNgQccu3Bdg+n6U0f2C2OLPJbSJ5W5wMBAMVuIuuEE/wgJVo2QfRDWyNOAGlgbiR8BxuG7iRn+PVtkT+8iemfFLNr0DuiWjjjuPz3Se5Hz7OxxxsdeqmfLJ8rEW9DWfeiFT9X68Q1FgxJQijchs/Lwbysp+i2H0qodKuOZEBFQ66+qf1zkkLEbmmbnFUoNZxPgNtoNLPbvReCuJHaWlLtIbQmQQUUNxKXL1UEK1ASOhD8ffI1rO3/WD/MHC9uZhBO+kMNDYZ2qaOdBU9gpMbl4vFDeSV5nf/00jtHr9bVFeIA2GjYD83x0U+zDcctxi0tE8KR1nRXYERj8AIGkkwDMqxCNtElHDdBR3O8kZkSmo0m3knnAaCBSsXcfu3Vwgd9mmfZmtLrbtq8k6RjAJTjxkZ/x/wZURVePD3EaM6xNw3DobAAd5/0Pr7w7H3NvmVbFVRnChoGvwLdwm3feBY2hyPBUnK4jIZMMZE+9vTmzNQ0LqcYM283ZeCI9qBqcFBtWuJILxGZsCzR5fPnLON/OWrgTTYKUAOoHBisk2Nv9511uot83XMSAVjLZjbFHAHbPoBKNl4vKFFrlbTifyk1a2pZjYjtTy6rv+wvXNOEglTDbBxntYAlxmpD8Ues3Dae72SAT9PD9gkCytWOb3i1ThB+4uJRq/x3rd4iP2LW773m44PsnTfceY+bmlNdPrID1LCp72/Vw3293pYvO1S5i6jsZt+zXU3/vx2X17oXghJne9tQfZUu0DtNWKhD00EqMMeXyZT+huRkAIsJlzWmUj8mHo8zyxat33oJVAnIMhrKl9huoEbvwhg92oTYeJ7dq15W1B/BmyD087NfoYysdW+p8kGpbZpa18yO+/qjlZzMg+00tUFga0gkWA4pnc2HtXCa+l5jPdaHjWsHkJi4GpLLjswbFLZRh4WjSLXfkR2HyOF2y7uoWrH+mW7jERyWJv+TQWJ9Q5aALQoAlHG9lb2jsIuquIOrbcT7NI4appjgYV1q622l0qGfE03ljp7YxVG2vgTr/qfQEAdVH6ER/BRhRA2zkf3s7sLw06orRcJyHNO/QO7CDGxmh5uDYKDVwnLqoGfUG8GuFU2/KQHzxCHpJNapQMFfiT8nzzu3LJTbfBknutGDUtfXRqTL0uLq2kbUU3wSPKgG+VfReIv0optVl3y5sgtdow95gpZWfdnx7ywRGSyVLlJB97Qn41tTEtRD/IxLLWzlH69eZxn+O89+NHxxGXlzDUqPZ918FkEm8Ud2nsMiZk9eKJkRS8pqO+Kxy1fdTAPKC0fYQgWhCTlF+j8V6wZJeIbPioQ6wfGXZBXMMKh77+3ixFzAJQ9zASVIWaeRxqYToC5tfMcnxuR6/vz1E7sU0g0ErQL8DDEgTyO9knu9o0jZekc+NlPfWuvbDQ/9Yp+1n+/gG/7H0AH9lgTqG9ETTtECoKXUmhOlELpv5OU3kRpBih3EJ2osox55q7Ed7Ec2+23yp7gGrcMsgrk84bOf281/Y0jNUfrxpeHxEC1dZ50/d0jC2jysNVO6dJADo0YkOd0/450sb3qkIX4UoPulitJUcds/N7bU4TExRVSOjIUzrOPHkBvF8XplYEjTfHJup9bDHCRZ+YwSzJ+FETyjczaJKKJY4NOc/vQTeGIloCRnECI7Znex+ycsBW85kJW8j1KcFCoJeEiWi9Ct/4j5YCK0rGyGH8CcdMR726Bppgk2hJfFSk3cdPIezzmGIjgZMhIs9lwo9WMLYkN3up/1OSfo2KPPf9rYw69silISEfx2OBQ9p1Ffp/o2880g1mJRbr78AvfHwd26JCFhpRnQ+ynU4omkzA/eK0avXOecQH1sJPEuXLllhKOQ3PpAzOxABKC9cLzV9xt2FOtm44WvgmZFYWnlb0+AWk11gfwwIntl5+HImPjnwrS4lzPZoIu0109ne7QbQCHMFze6dHi5gSCIbqS/Msdu0EMxbbf4EdXMqXVD3UcMi2TnBvTv0vnEDAGswY4xz5ji+0Mg3wqoJcYmO6sKbFzl8vZ2xMXmJOt65+MkjBvGoGpUP/EOYy5CKCGkqdBE1zWGYhbJZwXOJgnPn/ykDTcnTLyAXHP5TMV3cEPPkTtUc4w0e5DJEy24iGq9gvhbbPSF2KUrUadV4fnp4nxo2M0OR4rRKnO5p+tcdeKl4Zl9Y6RXfQzGtpIvW40FWPNto0Bu7dkJk/iuSArGdV5G+dz7v0tEb6mab1n5AYA4FIof63Y2dVBuE3Ls9POv5p0vDxZJn7uBXPD/CjsEqFBgLUtBXRtOB3La2e6Vgc4OLjjAPmSixnIw+X9JON2M/2ctVK44tPVtj4HfYtNC9KGmunJifH00GgFmf68ftOuqpi1FdmyADGUx1jskONdrv5xwAPUXFwIfmCESit0OyHu4qewkUerta4R4hw4uGJgS6Z/41kmLYjs1IZhSMQXh2TesgoTdy3MKf7gZvg8cVCIiKUl/5RSlFWbmZdVYWWvnf0/4bUwPG8+6fVdT0i01y4mys3gD6jRtlHpaVikoaogqphyccp37Wkw5YIO5A5gQkCGEw1BGriSE9ykmG7tObTKV27R4IXnSKSJhyXd1wITRFfLmPOWCGfvsjmecU4nHFhdxSwIQTLhh4fZEuTReQGfk0E8tz+y/P9vyhS47R9EUuMbMCxNywgztGKGypl/GOK6WkHzzYbJPJgUymirejLyg15ba22Y9EU7S+vDZyYheJ8+zPip6rb00J42++jDcFHvz7N9F2s1pdbeAwHrs2chMp9xu1RD2pSoqk5xAQSPj58yxW6WrYdBkHXYwKby6cV4bP7yHyp+qEPPl4GVpRxXSuDbHwB7eOr4dQFjHWET2lwhBdMjwFtCsoPsBojJc= - tls.key: AgBIhQWH2oSZHeFwfMremTuNk+waDkTBnnTFkYHUtR/j9C4mvORtyBtA8jA8JhH9vqcH94DhTCDnru1cXdrHs1hSIRFmELE1QXk0+mSMNiiqwF5CTZqy/LwhcJ6/DAM3ODqx5uszAIuZ3PwiZyqgNuReWpfjGa8b/o/om9a0io4wjL+YDThgBMzPvYrQgCujEhTfmGTKaldD/kYDI5sYICi0ObIIJKNMoLaNN7sBRHfO93TNsnryZECFIlQRECN1ZrAHqBehcWdIHuaRI73YLX4Egxqc1gAd407Zw29O5gl9bQuVSG6Bt+xkkQCAHUOB5ZgmrHGhqY+VkMKLpjVrc57nrEEssMnWfQ9y5/9jbhJzXyEgiy/3izmDt26gCfQsdzBegEomKihRGHRL8vUosqA1pzDCwNz6Jnn0ywre+V1IzVIB8VlBv+a+rUxUTAtrcn0Z1zph8FH55r7oHtsXG5IZJbBtS+bimg9KgfZ7fpz+XrAzSOYtXqwx25Ul4R+WbAkcTxGpLYBMzvjrReLOJgOEflyiE0ywqIHjsY45Mn6n41IeKeBnPHJexqVF+/M7gLHfvMotcHq5fn1nwUVh7+kbQu8yjEMmUgnu5n1U7i/p4ydO2X0N1AP+FdjqSIDLlrGAs42L5a0ucl6jK/3XTX72B8n0Xa/WYdD986no8m4smfsS/DK8moCwczgWiUoXsxuLtEzUjjonSIe/nMkF64iEXILTiOAM2aj4xaHbJCvTr4ZaZfVoLaj3F4HFiV5tgZm5K0z/iGyGYMxCTRuO2m4OgzB9KUPdfS4qKKVFbrjI9thHtX8kZmatcTgwA7wSStyzdxqSM8va/6EmHwa3OTbQSCsH29BfqEN2EXH7xKLf+ZYG2J03m+tLMKVXMUp608Lt+X+49Ru5uuxAoEUTHURLInigHUkNv3dPr6ggwgmAeaIKsvcZP+Frfro1cPs4uSn07BITci84pMbfOnsfGgU9IA/dNKANEN8F1UYBvzSmkArumqzv28n1Ji1MxMSutMCmQFYsC8tVk2SR68m22nW5TpmCS2iWgjk9BaOtv/4uPVpajuR+XUTBtznwBUI3vJFZX0J7/y/1Md+HF42Ukh2bEo+RvmDIOWuhMxIoVHKoNP34yVjTnpztZzk1E+MuimvDzDLTkw9NHF6G71fUYk5YTQFGM82FyZCZW6d6VH7EJYQ431k8Oe6v5VOBq4htS9XMSWaGkHe0YetzIMc/LWPx7vVZvwqLExkeudJBXYGQbKYwX+1N3kMJP/gyZI/qtX1O4bo6ljJLDDlndWvc0ubRshsUfgtA1RLfh7lPyoX4044IFPZDjV17EZZCnllJYtZFjv2AxIXoktDsKR7xk49+6z6jx2Qb88eKVTH72jbRtf/SOlEHuFHO0pAohOvV7D6YU0DWW+VVOMSAS+92uXy39usSJcYI+sR1uBo+qgy2swJKkGCrtzt6eRgivPI9LG/C4ZKWY6tM5HaAnDBax+6aSXvduXVrqpMe7AirI+/N1xw/onZ0PaUhzXjw7IcUcOK93NSYDy1oQCpb3j0brRbpZ8H9H1VeR5clvZoX8YAYOi0KLZajHZi5Z50C1AqRzTBf243RvsCejEgGm1e+jKjpMU0Hs+qqoEBlZdCEPy/dudzrLpei5BjDg+CmJ3GVo+/TnH5K4HjwoldPwATGgV7GAWKjbqx77nZQxTMp/B8pKdd8wtejkQiXutqAnin/WmtCQrt6SnrCPgZqkhN2Da46TSFW/UaWK3u5eWrBn2Sxt6H0a25tuVVwF6JkGQjbiwPWJskUk23+ZslghbUJpW2SMPSlraIHNB3rFSCeY9VklfCevq4pySvWoFvTa8JAf5YSr9bm99XgKaqvHE3AMHDEMS/yhQ6P+JjfTRhmERSiNFfziQA1lC86J1tOliF+To6u6eb+equT+nVYcU9E40Jo1TWe1mrhaHXbZtL+YFAlH1N4Nn9h6M0dU7nm2qoahg2MuoU5o1VayVBWcW2FLhveEliBElo4rqzXR6Lxx1RshrhpfP+duD8bAsxy4t7ae4c+Z0sGN4xmYkkukOM3mtwAvKTf2KItuIwnoernMz8c56ueumHc7JHEazMxZ/SqMfSpZif0Um5ZOyJtmGD8K/DiQMMXzVzF26gd1yYl/Tpumo/70X7KzVJpXNh9ko2nubrYm0BWRoPG4fKZAiGr731YS8XyFBzugXQnM19+JdcR9yELguDcs5LSefq//VNS6t4oo1EzXNRJwhcfv1oO7ScqMWl7szAlILsRjBWggb+8sDUKoGnfMWkJsI1PFTrF1jLcBDYb8cCu5h2K/r9lu2at+z9aOc1wjcPRTbvFa2EDO69j+cIERphdLVA/Qqxt/jqW3ymQzmP1geiZcpzsG+awL5of830g9irbVXiBfqN36d9dgstlsn21vkLH01oaNmftzXA/N42G0VJv+OkJUrzh/ho3E1L5akhKZHhpeUYm2J3krB10vHx1j36vEmG0oJKwGPdzqgqbv/akBB/dMckIq/w5f4ksxLyclbZeQ97reDL41zqmxz16pFzykD2uG38D0uj8Yr6wXyMUl72LoZ5osqIc7Odob82va1XiG9/PO8ly9tvxJBbH4BhU+jdoSgRuxU0+d+j/j5TwAlcXmkSB2TB3fnPlOX18roAyJtmommn0pdF7B2GlmS7FIfc9aLVbjGW9T/yn4kUFnz/gJuoFzt7emvFCunLTQTJ00aB2gyPdjgs3IR62PUHb518W0NVYw1IXBLcYEg9hfoKwIvj7PmkuuZYBz89gTFUBfKeRQcj8j5Wc6/F8exi9vrqzND9YKoLlCbGgjeNii6j1LrzCaeqfeN+LhbXL0mIBvL9I4YBKTOye8gFvO3LfwZ/Yw3lrAm6WN1rLDqLVUbJT91iFjEHbvzN+iX05nJCD/ZhsMFZI+8sHOnbd/YzV8AANr7GP86IbbbrCupe3fxg12ZoKLOoOW0oXFxV/LcxW - template: - metadata: - creationTimestamp: null - name: cern-sectigo-tls-certificate - namespace: jhub - type: kubernetes.io/tls - diff --git a/infrastructure/secrets/jhub/ss_jhub-cvre-dbconnectstring.yaml b/infrastructure/secrets/jhub/ss_jhub-cvre-dbconnectstring.yaml deleted file mode 100644 index e339a528..00000000 --- a/infrastructure/secrets/jhub/ss_jhub-cvre-dbconnectstring.yaml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - creationTimestamp: null - name: jhub-cvre-dbconnectstring - namespace: jhub -spec: - encryptedData: - dbconnectstring: AgBbnLUYNK6O0JSTkepDwt+9stnmmW+E7LF9lLceA4ewhFRapsMLQwloZdBZjk22lRMzDsBS0Ru3UCzVBPEnGHCLTIyoT60FvZdIf+HwupEI09WcuG8Cimk7YPdWdMJsoIKCCepoQSOOdzSulxG002uQQOc3tIrd012I5PPlfudGC9dC8NWT0KQ+koF2Vzf3FpKtNZxzx54O7Se72jRfDNwCj/tbY2uG9bKJnIw+XyRjqntQhXcGb0oUJMwZ26gAwgdUf4WJvwnDVCWorEE2YD0M5lKDpfXgw39COkNw6/jPVzALjwUIw5lJ+arjPiKmmioZDE7/sud8B0lsqW13L9NGOGUPukXsVrPSjn6Oh6JwBlJK5l2iVLxsoPuhxfoooSQwOUwWXmMxcnPqAtWV4QpHkJhbxro1xHPE6P1Aqqwia4jx4pxT2paNb1Uw6E5o5HXmZI0mEkTHy266njrzbZHX90QhvwMTmIEY/XEHXsLudbbwzvPZeIkz22PJBb0VY+unpcVanJao3gAX3MMDqh+aAzV8SuKfhjY2nBRdIGBkkuWWWM5FE6XNN37a6IlKdTuqUvTMH43iHa/d9jrLYEGEzDCytcCxNe63g/8afBJAqlUXN5W7sB3702RBcfHX3O7Eqf2YXzp0vmXQ8KzgFkWxcy6UH0UFwc5KIPSN6KwQij/SmK24bnlSdK/PHJPrrsyIYBFO9S/Tngkl4pPUNgteCPGRlUsgr6A74lQEVcofpvwm0d7mgw7WEhZbJBmd2u3a4qpNYipLiTYzQJjYZLuN2I7t2nhYoLgeTfQFxxxuMw== - template: - metadata: - creationTimestamp: null - name: jhub-cvre-dbconnectstring - namespace: jhub - diff --git a/infrastructure/secrets/jhub/ss_jhub-cvre-iam-secrets.yaml b/infrastructure/secrets/jhub/ss_jhub-cvre-iam-secrets.yaml deleted file mode 100644 index f3052e84..00000000 --- a/infrastructure/secrets/jhub/ss_jhub-cvre-iam-secrets.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: bitnami.com/v1alpha1 -kind: SealedSecret -metadata: - creationTimestamp: null - name: jhub-cvre-iam-secrets - namespace: jhub -spec: - encryptedData: - client_id: AgCaFZeWxWqmGc7PVBY9O+B/qMFH69cSaNA693rzdqVxnYmLje/ofR0ILKpPjXeWGKHnq6CZk+pkdclkLaXr98DSEMWo0Z0K7iEaa5TbY0+fIb2H2Jokf+XAKRJbRmBtPPsRqmFbib3f/wHTIC36dMPq/RbcpYl3Ndi0SECIHOCXFafZFIb49vCQ9k+FrTSFW5riwOn6uFjGuaXKnj2F2StDcq249+Ig1yTmDA+8uYNZLZgNO2TCMmeioRWpKbqsVPJ12MPBPcLLJ3i0y7BmhbfQua65xhLhYH59JGoPpmu4E5BhCqHC22MUXCfHmHg61zgETLcp5777rFjqgxabRLHoLiIUsuQwPXEUDaii2dNp6/EzGivjdurSY5c2M4fxn45Nz6mB2EKvC5TujZfarq5lsOYArHX6kwFr6vhAUG9Rz3xYGxL59eU9+UgVoti5tZyIyZAE7SVI1Kgq2p7uelqo4yRGloSlvysFM0ZlgwEgq1lOP03HzZ/cXwogGJWQTZzlxv6m3VQQrkJPObS+GJms+9LQtpORTfN8qtu2dAPa42jdd4+z9fD5+y6BN853PTxb39kTKKZLWqsQTOGcFpYLf0NgW0CAElLiaUWnIH/9oRjBCT+bbeHKAMSf51EGjEjt1KDs/s/b35ORdFz0r5TugpeEQxKNvr2jQ1KFR42Q5zylsPcWc3QYwC0Dvguf6yU38C/epIXAHfBwYYP0xj5tg7PYLpmTnJWd/80yrJ9BMTxgaiM= - client_secret: AgC45AbZIae5aa1+ZLAhndG1KehXxwN6qddRqnWTXv1Cd3m8KXaIBW5AThpqCUFrP6BpN9Px9Sq/J/DzfEh/LHkNVPKrrapumcD3Yu1rOXXUeqt76+C6wJMsxOu5h6l45EVYpTn2PYEAS+zVeMKJG1USCQvg5HjACJRTX3Bfoa+cc9V//nkge7HXE9kMPZFT1UFDgl5SOUbPt2eoGjFwsx+xLVgTixkLbARknX5Qd475sle7cDBR77wohO1FBqNOTYNlQPuK9oh3nI2XS+CuPom4ITXV/YozgKlPYqMIA3fUam6CC8sxrRdsvfjkr3xanvt+DPjCCe+d0/69mbmO+q0YAMKbHItNuV2IZmVQEe3zxR08nRtUuhCxdtsaoo6UWCh5IpRjc7uHmKaInCBYwEscPRXaF4cWj6/M2uwJnFKOix1DEREDHnU4W3tgeXd+OWRQgLUjgSg9m5w4ZBdOCnzTGQrN3IIFqdwUZeRj3u0rsMVMJeqJDlMGnrmnJj+JmfNT6rpocdg95bss4ZsIPZ6Zwia4PVMDBv10Or3PTLAA+mnAnUUZBjntIicZwBOnzRQbDw1EOzsZmTgNhMebjsvJWPT6iDZsWeQp8gVY9dhru67UKvmH+tsy1Y+DgkhPtz2s4WJAJCy20Iz1r3Kje3kfYZybOt8PnMUTz0K2i1UHpba6uCGJ6iTrxNaeaY54QFZgPcDuT9QvHBu5rj9YwVhz8ukf5ABhwxaW2Rt0KbOsXETReP8A7aPSjplqHRT0XX21/qsk+QcLmk50ZzXWHuzU5j3oxKrvlmLYec+0AzxlbdrYoNSkVA== - template: - metadata: - creationTimestamp: null - name: jhub-cvre-iam-secrets - namespace: jhub - From 2766d346c88a23871e7b8c5033547b1595e126f1 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Thu, 25 Jul 2024 17:14:56 +0200 Subject: [PATCH 45/69] correct format of configmap --- .../cluster/flux/jhub/jhub-configmap-profiles.yaml | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index 9301be03..21913694 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -9,7 +9,7 @@ data: profileList: - display_name: "Default environment" description: "Based on a scipy-notebook environment with a python-3.11 kernel, the rucio-jupyterlab extension and the reana-client installed." - default: True + default: true - display_name: "Default environment - python 3.8" description: "Same environment as the default one except for a python-3.8 kernel installed. This environment will be deprecated soon." kubespawner_override: @@ -45,13 +45,4 @@ data: - display_name: "REANA dev environment" description: "For testing purposes" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest - # - display_name: "Default environment - python3.11 + jupyterlab v4" - # description: "With latest rucio jupyterlab extension version - under dev and testing" - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-py311:latest - # - display_name: "Dask+ROOT" - # description: "Gives you the ability to spawn Dask clusters" - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-dask-root:sha-7805adc - + image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest From 688c17bc88cb702ace786fc71a52655e0bf80a05 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Thu, 25 Jul 2024 17:43:58 +0200 Subject: [PATCH 46/69] correct format of configmap --- .../cluster/flux/jhub/jhub-configmap-profiles.yaml | 8 ++++---- infrastructure/cluster/flux/jhub/jhub-release.yaml | 1 + 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index 21913694..150d9bdd 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -4,7 +4,7 @@ metadata: name: jhub-profiles namespace: jhub data: - values.yaml: | + values.yaml: >- singleuser: profileList: - display_name: "Default environment" @@ -25,7 +25,7 @@ data: - display_name: "VIRGO - WDF environment" description: "Contains the full WDF v2.2.1 environment - Python 3.9 kernel." kubespawner_override: - image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 + image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - display_name: "KM3Net Science Project environment" description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries - Python 3.9 kernel." kubespawner_override: @@ -34,7 +34,7 @@ data: description: "Contains gammapy=0.17 and astropy - python-3.8 kernel." kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-combined_ana_km3net_cta:sha-520edf8 - - display_name: "Indirect Dark Matter Detection Sciente Project environment" + - display_name: "Indirect Dark Matter Detection Science Project environment" description: "Contains the MLFermiLATDwarfs and fermitools libraries - Python 3.9 kernel." kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 @@ -45,4 +45,4 @@ data: - display_name: "REANA dev environment" description: "For testing purposes" kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest + image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest diff --git a/infrastructure/cluster/flux/jhub/jhub-release.yaml b/infrastructure/cluster/flux/jhub/jhub-release.yaml index 0c53bc87..63e9adce 100644 --- a/infrastructure/cluster/flux/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-release.yaml @@ -31,6 +31,7 @@ spec: - kind: ConfigMap name: jhub-profiles valuesKey: values.yaml + targetPath: singleuser.profileList values: proxy: From fd857586349936ec91f647d6362b5407c1392094 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Thu, 25 Jul 2024 17:45:32 +0200 Subject: [PATCH 47/69] correct format of configmap, again --- infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index 150d9bdd..c803fd7f 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -4,7 +4,7 @@ metadata: name: jhub-profiles namespace: jhub data: - values.yaml: >- + values.yaml: | singleuser: profileList: - display_name: "Default environment" From 0598ba91e638449e76fdb51ebbe2dcb6499ed24a Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 10:46:27 +0200 Subject: [PATCH 48/69] add RUCIO env vars to jhub --- .../cluster/flux/jhub/jhub-release.yaml | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-release.yaml b/infrastructure/cluster/flux/jhub/jhub-release.yaml index 63e9adce..3704b7d9 100644 --- a/infrastructure/cluster/flux/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-release.yaml @@ -182,24 +182,24 @@ spec: cmd: null extraEnv: # JUPYTERHUB_SINGLEUSER_APP: "notebook.notebookapp.NotebookApp" - # RUCIO_MODE: "replica" - # RUCIO_WILDCARD_ENABLED: "1" - # RUCIO_BASE_URL: "https://vre-rucio.cern.ch" - # RUCIO_AUTH_URL: "https://vre-rucio-auth.cern.ch" - # RUCIO_WEBUI_URL: "https://vre-rucio-ui.cern.ch" - # RUCIO_DISPLAY_NAME: "RUCIO - CERN VRE" - # RUCIO_NAME: "vre-rucio.cern.ch" - # RUCIO_SITE_NAME: "CERN" - # RUCIO_OIDC_AUTH: "env" - # RUCIO_OIDC_ENV_NAME: "RUCIO_ACCESS_TOKEN" - # RUCIO_DEFAULT_AUTH_TYPE: "oidc" - # RUCIO_OAUTH_ID: "rucio" - # RUCIO_DEFAULT_INSTANCE: "vre-rucio.cern.ch" - # RUCIO_DESTINATION_RSE: "CERN-EOS" - # RUCIO_RSE_MOUNT_PATH: "/eos/cern-eos-rse" - # RUCIO_PATH_BEGINS_AT: "2" - # RUCIO_CA_CERT: "/certs/rucio_ca.pem" - # OAUTH2_TOKEN: "FILE:/tmp/eos_oauth.token" + RUCIO_MODE: "replica" + RUCIO_WILDCARD_ENABLED: "1" + RUCIO_BASE_URL: "https://vre-rucio.cern.ch" + RUCIO_AUTH_URL: "https://vre-rucio-auth.cern.ch" + RUCIO_WEBUI_URL: "https://vre-rucio-ui.cern.ch" + RUCIO_DISPLAY_NAME: "RUCIO - CERN VRE" + RUCIO_NAME: "vre-rucio.cern.ch" + RUCIO_SITE_NAME: "CERN" + RUCIO_OIDC_AUTH: "env" + RUCIO_OIDC_ENV_NAME: "RUCIO_ACCESS_TOKEN" + RUCIO_DEFAULT_AUTH_TYPE: "oidc" + RUCIO_OAUTH_ID: "rucio" + RUCIO_DEFAULT_INSTANCE: "vre-rucio.cern.ch" + RUCIO_DESTINATION_RSE: "CERN-EOS" + RUCIO_RSE_MOUNT_PATH: "/eos/cern-eos-rse" + RUCIO_PATH_BEGINS_AT: "2" + RUCIO_CA_CERT: "/certs/rucio_ca.pem" + OAUTH2_TOKEN: "FILE:/tmp/eos_oauth.token" ingress: enabled: true From ee18ac2cb3c46f527251d7f132cbfbe5ffd7a8a0 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 11:44:02 +0200 Subject: [PATCH 49/69] add patch compliant wiht flux --- .../cluster/flux/flux-system/kustomization.yaml | 8 ++++++++ .../cluster/flux/jhub/jhub-configmap-profiles.yaml | 8 ++++---- .../cluster/flux/jhub/jhub-patch-deployment.yaml | 6 +++++- 3 files changed, 17 insertions(+), 5 deletions(-) diff --git a/infrastructure/cluster/flux/flux-system/kustomization.yaml b/infrastructure/cluster/flux/flux-system/kustomization.yaml index 3842229e..a7b6cc51 100644 --- a/infrastructure/cluster/flux/flux-system/kustomization.yaml +++ b/infrastructure/cluster/flux/flux-system/kustomization.yaml @@ -3,3 +3,11 @@ kind: Kustomization resources: - gotk-components.yaml - gotk-sync.yaml +spec: + patches: + - path: ../jhub/jhub-patch-deployment.yaml + target: + kind: Deployment + name: hub + namespace: jhub + diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index c803fd7f..cbf301f3 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -8,7 +8,7 @@ data: singleuser: profileList: - display_name: "Default environment" - description: "Based on a scipy-notebook environment with a python-3.11 kernel, the rucio-jupyterlab extension and the reana-client installed." + description: "Based on a scipy-notebook environment with a python-3.11 kernel, the rucio jupyterlab extension and the reana client installed." default: true - display_name: "Default environment - python 3.8" description: "Same environment as the default one except for a python-3.8 kernel installed. This environment will be deprecated soon." @@ -27,7 +27,7 @@ data: kubespawner_override: image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - display_name: "KM3Net Science Project environment" - description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries - Python 3.9 kernel." + description: "Contains gammapy v1.1, km3irf and km3net testdata libraries - Python 3.9 kernel." kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-km3irf:sha-c1e2a18 - display_name: "KM3NeT and CTA combined analysis environment" @@ -38,8 +38,8 @@ data: description: "Contains the MLFermiLATDwarfs and fermitools libraries - Python 3.9 kernel." kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 - - display_name: "Dev enviroment" - description: "For testing and development purposes" + - display_name: "Dev environment" + description: "Development environment with various tools installed." kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-dev:sha-42bc682 - display_name: "REANA dev environment" diff --git a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml index a94fd6e8..5f9b92eb 100644 --- a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml @@ -1,5 +1,9 @@ # K8s manifest to patch jhub deployment to point to an existing share - +ApiVersion: apps/v1 +Kind: Deployment +metadata: + name: hub + namespace: jhub spec: template: spec: From bc2eff29ae27741bf3d1b24f1d73c6a80eb4b0f9 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 11:48:04 +0200 Subject: [PATCH 50/69] typo in manifests --- infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml | 2 +- infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index cbf301f3..9da21a92 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -27,7 +27,7 @@ data: kubespawner_override: image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - display_name: "KM3Net Science Project environment" - description: "Contains gammapy v1.1, km3irf and km3net testdata libraries - Python 3.9 kernel." + description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries - Python 3.9 kernel." kubespawner_override: image: ghcr.io/vre-hub/vre-singleuser-km3irf:sha-c1e2a18 - display_name: "KM3NeT and CTA combined analysis environment" diff --git a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml index 5f9b92eb..af430dd7 100644 --- a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml @@ -1,6 +1,6 @@ # K8s manifest to patch jhub deployment to point to an existing share -ApiVersion: apps/v1 -Kind: Deployment +apiVersion: apps/v1 +kind: Deployment metadata: name: hub namespace: jhub From a8f1d7839aa83b85a4664fb579575ff5014d9bfe Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 11:55:06 +0200 Subject: [PATCH 51/69] patch syntax --- .../flux/flux-system/kustomization.yaml | 18 ++++++++----- .../flux/jhub/jhub-patch-deployment.yaml | 26 +++++++++---------- 2 files changed, 25 insertions(+), 19 deletions(-) diff --git a/infrastructure/cluster/flux/flux-system/kustomization.yaml b/infrastructure/cluster/flux/flux-system/kustomization.yaml index a7b6cc51..fb38e847 100644 --- a/infrastructure/cluster/flux/flux-system/kustomization.yaml +++ b/infrastructure/cluster/flux/flux-system/kustomization.yaml @@ -3,11 +3,17 @@ kind: Kustomization resources: - gotk-components.yaml - gotk-sync.yaml -spec: - patches: - - path: ../jhub/jhub-patch-deployment.yaml - target: - kind: Deployment +patches: + - patch: |- + apiVersion: v1 + kind: Deployment + metadata: name: hub namespace: jhub - + spec: + template: + spec: + volumes: + - name: pvc + persistentVolumeClaim: + claimName: jhub-vre-singleuser-preprovisioned-manila-pvc diff --git a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml index af430dd7..b7d66e22 100644 --- a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml @@ -1,13 +1,13 @@ -# K8s manifest to patch jhub deployment to point to an existing share -apiVersion: apps/v1 -kind: Deployment -metadata: - name: hub - namespace: jhub -spec: - template: - spec: - volumes: - - name: pvc - persistentVolumeClaim: - claimName: jhub-vre-singleuser-preprovisioned-manila-pvc +# # K8s manifest to patch jhub deployment to point to an existing share +# apiVersion: apps/v1 +# kind: Deployment +# metadata: +# name: hub +# namespace: jhub +# spec: +# template: +# spec: +# volumes: +# - name: pvc +# persistentVolumeClaim: +# claimName: jhub-vre-singleuser-preprovisioned-manila-pvc From 94c34c981c20cae74a0c85aea560764773d1efe2 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 14:23:44 +0200 Subject: [PATCH 52/69] kustomization syntax --- .../cluster/flux/flux-system/kustomization.yaml | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/infrastructure/cluster/flux/flux-system/kustomization.yaml b/infrastructure/cluster/flux/flux-system/kustomization.yaml index fb38e847..637c25e5 100644 --- a/infrastructure/cluster/flux/flux-system/kustomization.yaml +++ b/infrastructure/cluster/flux/flux-system/kustomization.yaml @@ -4,8 +4,8 @@ resources: - gotk-components.yaml - gotk-sync.yaml patches: - - patch: |- - apiVersion: v1 + - patch: |- + apiVersion: apps/v1 kind: Deployment metadata: name: hub @@ -17,3 +17,8 @@ patches: - name: pvc persistentVolumeClaim: claimName: jhub-vre-singleuser-preprovisioned-manila-pvc + target: + kind: Deployment + name: hub + namespace: jhub + From a240cc5c7b73365727547a766e0e5100a2fc9f4d Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 15:00:18 +0200 Subject: [PATCH 53/69] test configmap and profileList --- .../flux/jhub/jhub-configmap-profiles.yaml | 74 +++++++++---------- .../flux/jhub/jhub-patch-deployment.yaml | 3 + 2 files changed, 40 insertions(+), 37 deletions(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index 9da21a92..8c12ecd9 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -8,41 +8,41 @@ data: singleuser: profileList: - display_name: "Default environment" - description: "Based on a scipy-notebook environment with a python-3.11 kernel, the rucio jupyterlab extension and the reana client installed." + description: "Based on a scipy notebook environment with a python-3.11 kernel, the rucio jupyterlab extension and the reana client installed." default: true - - display_name: "Default environment - python 3.8" - description: "Same environment as the default one except for a python-3.8 kernel installed. This environment will be deprecated soon." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-py38:sha-7ed7d80 - - display_name: "Default environment - python 3.9" - description: "Same environment as the default one except for a python-3.9 kernel installed. This environment will be deprecated soon." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser:sha-423e01a - - display_name: "ROOT environment" - description: "ROOT v6.26.10 as well as a ROOT C++ and a python-3.8 kernel." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-root:sha-c94d95a - - display_name: "VIRGO - WDF environment" - description: "Contains the full WDF v2.2.1 environment - Python 3.9 kernel." - kubespawner_override: - image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - - display_name: "KM3Net Science Project environment" - description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries - Python 3.9 kernel." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-km3irf:sha-c1e2a18 - - display_name: "KM3NeT and CTA combined analysis environment" - description: "Contains gammapy=0.17 and astropy - python-3.8 kernel." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-combined_ana_km3net_cta:sha-520edf8 - - display_name: "Indirect Dark Matter Detection Science Project environment" - description: "Contains the MLFermiLATDwarfs and fermitools libraries - Python 3.9 kernel." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 - - display_name: "Dev environment" - description: "Development environment with various tools installed." - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-dev:sha-42bc682 - - display_name: "REANA dev environment" - description: "For testing purposes" - kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest + # - display_name: "Default environment - python 3.8" + # description: "Same environment as the default one except for a python-3.8 kernel installed. This environment will be deprecated soon." + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-py38:sha-7ed7d80 + # - display_name: "Default environment - python 3.9" + # description: "Same environment as the default one except for a python-3.9 kernel installed. This environment will be deprecated soon." + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser:sha-423e01a + # - display_name: "ROOT environment" + # description: "ROOT v6.26.10 as well as a ROOT C++ and a python-3.8 kernel." + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-root:sha-c94d95a + # - display_name: "VIRGO - WDF environment" + # description: "Contains the full WDF v2.2.1 environment - Python 3.9 kernel." + # kubespawner_override: + # image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 + # - display_name: "KM3Net Science Project environment" + # description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries - Python 3.9 kernel." + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-km3irf:sha-c1e2a18 + # - display_name: "KM3NeT and CTA combined analysis environment" + # description: "Contains gammapy=0.17 and astropy - python-3.8 kernel." + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-combined_ana_km3net_cta:sha-520edf8 + # - display_name: "Indirect Dark Matter Detection Science Project environment" + # description: "Contains the MLFermiLATDwarfs and fermitools libraries - Python 3.9 kernel." + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 + # - display_name: "Dev environment" + # description: "Development environment with various tools installed." + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-dev:sha-42bc682 + # - display_name: "REANA dev environment" + # description: "For testing purposes" + # kubespawner_override: + # image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest diff --git a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml index b7d66e22..a18d049a 100644 --- a/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-patch-deployment.yaml @@ -1,4 +1,7 @@ # # K8s manifest to patch jhub deployment to point to an existing share +# +# This patch is applied via flux on the kustomization.yaml manifests +# # apiVersion: apps/v1 # kind: Deployment # metadata: From 6a917d90530c1d0bb0e3ce5a357606de3884da21 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 15:16:25 +0200 Subject: [PATCH 54/69] test configmap and profileList 2 --- .../flux/jhub/jhub-configmap-profiles.yaml | 37 +------------------ 1 file changed, 1 insertion(+), 36 deletions(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index 8c12ecd9..d709d4ac 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -10,39 +10,4 @@ data: - display_name: "Default environment" description: "Based on a scipy notebook environment with a python-3.11 kernel, the rucio jupyterlab extension and the reana client installed." default: true - # - display_name: "Default environment - python 3.8" - # description: "Same environment as the default one except for a python-3.8 kernel installed. This environment will be deprecated soon." - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-py38:sha-7ed7d80 - # - display_name: "Default environment - python 3.9" - # description: "Same environment as the default one except for a python-3.9 kernel installed. This environment will be deprecated soon." - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser:sha-423e01a - # - display_name: "ROOT environment" - # description: "ROOT v6.26.10 as well as a ROOT C++ and a python-3.8 kernel." - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-root:sha-c94d95a - # - display_name: "VIRGO - WDF environment" - # description: "Contains the full WDF v2.2.1 environment - Python 3.9 kernel." - # kubespawner_override: - # image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 - # - display_name: "KM3Net Science Project environment" - # description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries - Python 3.9 kernel." - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-km3irf:sha-c1e2a18 - # - display_name: "KM3NeT and CTA combined analysis environment" - # description: "Contains gammapy=0.17 and astropy - python-3.8 kernel." - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-combined_ana_km3net_cta:sha-520edf8 - # - display_name: "Indirect Dark Matter Detection Science Project environment" - # description: "Contains the MLFermiLATDwarfs and fermitools libraries - Python 3.9 kernel." - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 - # - display_name: "Dev environment" - # description: "Development environment with various tools installed." - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-dev:sha-42bc682 - # - display_name: "REANA dev environment" - # description: "For testing purposes" - # kubespawner_override: - # image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest + \ No newline at end of file From 8dc4d453542621b28091ef851d5c3d6dccba762c Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 15:21:37 +0200 Subject: [PATCH 55/69] test configmap and profileList short list --- .../cluster/flux/jhub/jhub-configmap-profiles.yaml | 5 ++++- infrastructure/cluster/flux/jhub/jhub-release.yaml | 2 +- 2 files changed, 5 insertions(+), 2 deletions(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index d709d4ac..beb640d9 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -10,4 +10,7 @@ data: - display_name: "Default environment" description: "Based on a scipy notebook environment with a python-3.11 kernel, the rucio jupyterlab extension and the reana client installed." default: true - \ No newline at end of file + - display_name: "Default environment - python 3.8" + description: "Same environment as the default one except for a python-3.8 kernel installed. This environment will be deprecated soon." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-py38:sha-7ed7d80 \ No newline at end of file diff --git a/infrastructure/cluster/flux/jhub/jhub-release.yaml b/infrastructure/cluster/flux/jhub/jhub-release.yaml index 3704b7d9..0f5f1158 100644 --- a/infrastructure/cluster/flux/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-release.yaml @@ -31,7 +31,7 @@ spec: - kind: ConfigMap name: jhub-profiles valuesKey: values.yaml - targetPath: singleuser.profileList + #targetPath: singleuser.profileList values: proxy: From 651fed615908f59e22dbd83f559f6011d815471d Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 15:24:36 +0200 Subject: [PATCH 56/69] apply latests env well formatted --- .../flux/jhub/jhub-configmap-profiles.yaml | 34 ++++++++++++++++++- 1 file changed, 33 insertions(+), 1 deletion(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml index beb640d9..98a4e065 100644 --- a/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-configmap-profiles.yaml @@ -13,4 +13,36 @@ data: - display_name: "Default environment - python 3.8" description: "Same environment as the default one except for a python-3.8 kernel installed. This environment will be deprecated soon." kubespawner_override: - image: ghcr.io/vre-hub/vre-singleuser-py38:sha-7ed7d80 \ No newline at end of file + image: ghcr.io/vre-hub/vre-singleuser-py38:sha-7ed7d80 + - display_name: "Default environment - python 3.9" + description: "Same environment as the default one except for a python-3.9 kernel installed. This environment will be deprecated soon." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser:sha-423e01a + - display_name: "ROOT environment" + description: "ROOT v6.26.10 as well as a ROOT C++ and a python-3.8 kernel." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-root:sha-c94d95a + - display_name: "VIRGO - WDF environment" + description: "Contains the full WDF v2.2.1 environment - Python 3.9 kernel." + kubespawner_override: + image: gitlab-registry.in2p3.fr/escape2020/virtual-environment/docker-images/datalake-singleuser-wdf:cd832522 + - display_name: "KM3Net Science Project environment" + description: "Contains gammapy=1.1, km3irf and km3net-testdata libraries - Python 3.9 kernel." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-km3irf:sha-c1e2a18 + - display_name: "KM3NeT and CTA combined analysis environment" + description: "Contains gammapy=0.17 and astropy - python-3.8 kernel." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-combined_ana_km3net_cta:sha-520edf8 + - display_name: "Indirect Dark Matter Detection Science Project environment" + description: "Contains the MLFermiLATDwarfs and fermitools libraries - Python 3.9 kernel." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-microomega:sha-5cbf4f4 + - display_name: "Dev environment" + description: "Development environment with various tools installed." + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-dev:sha-42bc682 + - display_name: "REANA dev environment" + description: "For testing purposes" + kubespawner_override: + image: ghcr.io/vre-hub/vre-singleuser-reana-dev:latest \ No newline at end of file From 3d509be88f3488c86fbd680024d021c088afd871 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 16:38:16 +0200 Subject: [PATCH 57/69] add CVMFS deployment and add the volume to the jhub release --- infrastructure/cluster/flux/cvmfs/README.md | 10 ++++++ .../cluster/flux/cvmfs/cvmfs-client.yaml | 20 ++++++++++++ .../cluster/flux/cvmfs/cvmfs-pvc.yaml | 32 +++++++++++++++++++ .../cluster/flux/jhub/jhub-release.yaml | 19 ++++++----- 4 files changed, 71 insertions(+), 10 deletions(-) create mode 100644 infrastructure/cluster/flux/cvmfs/README.md create mode 100644 infrastructure/cluster/flux/cvmfs/cvmfs-client.yaml create mode 100644 infrastructure/cluster/flux/cvmfs/cvmfs-pvc.yaml diff --git a/infrastructure/cluster/flux/cvmfs/README.md b/infrastructure/cluster/flux/cvmfs/README.md new file mode 100644 index 00000000..59f36c6c --- /dev/null +++ b/infrastructure/cluster/flux/cvmfs/README.md @@ -0,0 +1,10 @@ +# CVMFS +## CVMFS on the VRE + +CERN OpenStack k8s cluster v1.29.2 is deployed with a `cvmfs StorageClass` provisioned by `cvmfs.csi.cern.ch` and the CVMFS CSI (Container Storage Interface) plugin [link to github repository](https://github.com/cvmfs-contrib/cvmfs-csi). Version `cvmfs-csi-v2.3.2` of the CVMFS charts is installed. + +To provision a cvmfs volume within any jupyterhub pod: +* Create a `pvc` making use of the cvms `StorageClass` +* Add an `extraVolumes` and an `extraVolumeMounts` in the [JupyterHub release manifest](../jhub/jhub-release.yaml). + +The manifests in this directory will also deploy a pod (`cvmfs-client`) to access cvmfs from the cluster. \ No newline at end of file diff --git a/infrastructure/cluster/flux/cvmfs/cvmfs-client.yaml b/infrastructure/cluster/flux/cvmfs/cvmfs-client.yaml new file mode 100644 index 00000000..bc8e3285 --- /dev/null +++ b/infrastructure/cluster/flux/cvmfs/cvmfs-client.yaml @@ -0,0 +1,20 @@ +apiVersion: v1 +kind: Pod +metadata: + name: cvmfs-client + namespace: jhub +spec: + containers: + - name: idle + image: busybox + imagePullPolicy: IfNotPresent + command: [ "/bin/sh", "-c", "trap : TERM INT; (while true; do sleep 1000; done) & wait" ] + volumeMounts: + - name: cvmfs + mountPath: /cvmfs + # CVMFS automount volumes must be mounted with HostToContainer mount propagation. + mountPropagation: HostToContainer + volumes: + - name: cvmfs + persistentVolumeClaim: + claimName: cvmfs-vre-pvc diff --git a/infrastructure/cluster/flux/cvmfs/cvmfs-pvc.yaml b/infrastructure/cluster/flux/cvmfs/cvmfs-pvc.yaml new file mode 100644 index 00000000..64b04420 --- /dev/null +++ b/infrastructure/cluster/flux/cvmfs/cvmfs-pvc.yaml @@ -0,0 +1,32 @@ + +# Based on docs and snippets from https://github.com/cvmfs-contrib/cvmfs-csi + +# Create StorageClass for provisioning CVMFS automount volumes, +# and a PersistentVolumeClaim that's fulfilled by the StorageClass. + +# If Controller plugin is not deployed, follow the example in volume-pv-pvc.yaml. + +# Notes for the VRE cluster. +# StorageClass is not needed because is already deployed when starting the cluster. +# Othersiwe, have a look to the documentation on the link above +# --- +# apiVersion: storage.k8s.io/v1 +# kind: StorageClass +# metadata: +# name: cvmfs +# provisioner: cvmfs.csi.cern.ch +# --- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: cvmfs-vre-pvc + namespace: jhub +spec: + accessModes: + - ReadOnlyMany + resources: + requests: + # Volume size value has no effect and is ignored + # by the driver, but must be non-zero. + storage: 1 + storageClassName: cvmfs \ No newline at end of file diff --git a/infrastructure/cluster/flux/jhub/jhub-release.yaml b/infrastructure/cluster/flux/jhub/jhub-release.yaml index 0f5f1158..239e0792 100644 --- a/infrastructure/cluster/flux/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-release.yaml @@ -31,7 +31,6 @@ spec: - kind: ConfigMap name: jhub-profiles valuesKey: values.yaml - #targetPath: singleuser.profileList values: proxy: @@ -147,18 +146,18 @@ spec: type: static static: pvcName: jhub-vre-singleuser-preprovisioned-manila-pvc # manually added an existing share (refer to jhub-storage.yaml) - # extraVolumes: - # - name: cvmfs-cern-instance - # persistentVolumeClaim: - # claimName: cvmfs + extraVolumes: + - name: cvmfs-vre + persistentVolumeClaim: + claimName: cvmfs-vre-pvc # - name: eulake-cern-eos-rse # mounts the EOS RSE needed for the Rucio JupiterLab extension # hostPath: # path: /var/eos/eulake # This is pointing to /eos/eulake/escape/data, defined on the eosxd/configmap - # extraVolumeMounts: - # - name: cvmfs-cern-instance - # mountPath: /cvmfs - # # CVMFS automount volumes must be mounted with HostToContainer mount propagation. - # mountPropagation: HostToContainer + extraVolumeMounts: + - name: cvmfs-vre + mountPath: /cvmfs + # CVMFS automount volumes must be mounted with HostToContainer mount propagation. + mountPropagation: HostToContainer # - name: eulake-cern-eos-rse # mounts the EOS RSE needed for the Rucio JupiterLab extension # mountPath: /eos/cern-eos-rse # mountPropagation: HostToContainer From f7777b5e547ce6abba8c9747b653761de3432c47 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 16:59:56 +0200 Subject: [PATCH 58/69] remove old cvmfs deployment and clean old documentation and manifests --- .../cluster/flux-v2/cvmfs/cvmfs.yaml | 47 ------------- infrastructure/cluster/manual/cmvfs/README.md | 67 ------------------- .../manual/cmvfs/cvmfs-sc-pvc.yaml.yaml | 26 ------- 3 files changed, 140 deletions(-) delete mode 100644 infrastructure/cluster/flux-v2/cvmfs/cvmfs.yaml delete mode 100644 infrastructure/cluster/manual/cmvfs/README.md delete mode 100644 infrastructure/cluster/manual/cmvfs/cvmfs-sc-pvc.yaml.yaml diff --git a/infrastructure/cluster/flux-v2/cvmfs/cvmfs.yaml b/infrastructure/cluster/flux-v2/cvmfs/cvmfs.yaml deleted file mode 100644 index f995e70a..00000000 --- a/infrastructure/cluster/flux-v2/cvmfs/cvmfs.yaml +++ /dev/null @@ -1,47 +0,0 @@ -# Based on docs and snippets from https://github.com/cvmfs-contrib/cvmfs-csi - -# Create StorageClass for provisioning CVMFS automount volumes, -# and a PersistentVolumeClaim that's fulfilled by the StorageClass. - -# If Controller plugin is not deployed, follow the example in volume-pv-pvc.yaml. -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: cvmfs -provisioner: cvmfs.csi.cern.ch ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: cvmfs - namespace: jhub -spec: - accessModes: - - ReadOnlyMany - resources: - requests: - # Volume size value has no effect and is ignored - # by the driver, but must be non-zero. - storage: 1 - storageClassName: cvmfs ---- -apiVersion: v1 -kind: Pod -metadata: - name: cvmfs-client - namespace: jhub -spec: - containers: - - name: idle - image: busybox - imagePullPolicy: IfNotPresent - command: [ "/bin/sh", "-c", "trap : TERM INT; (while true; do sleep 1000; done) & wait" ] - volumeMounts: - - name: cvmfs - mountPath: /cvmfs - # CVMFS automount volumes must be mounted with HostToContainer mount propagation. - mountPropagation: HostToContainer - volumes: - - name: cvmfs - persistentVolumeClaim: - claimName: cvmfs diff --git a/infrastructure/cluster/manual/cmvfs/README.md b/infrastructure/cluster/manual/cmvfs/README.md deleted file mode 100644 index 6a2833d8..00000000 --- a/infrastructure/cluster/manual/cmvfs/README.md +++ /dev/null @@ -1,67 +0,0 @@ -# Manual configuration of CVMFS on the CERN - VRE - -Any CERN OpenStack cluster comes with a CVMFS deployment. - -The version of the [`CVMFS CSI` drivers](https://github.com/cvmfs-contrib/cvmfs-csi) depends on the `k8s` cluster and the `magnum` version used (contact the k8s team for details on these versions). - -## Instalation of `CVMFS-CSI` on the CERN - VRE - -### k8s cluster with `CVMFS-CSI` v2 - -Version 2 of the drivers should be available on any cluster created later than October 2022. - -If `cvfms` is already on the cluster, apply the following manifests. - -```bash -kubectl apply -f cvmfs-sc-pvc.yaml -``` -with `cvmfs-sc-pvc.yaml`; -```yaml -# cvmfs-sc-pvc.yaml file -# -# Based on docs and snippets from https://github.com/cvmfs-contrib/cvmfs-csi -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: cvmfs -provisioner: cvmfs.csi.cern.ch ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: cvmfs - namespace: jhub -spec: - accessModes: - - ReadOnlyMany - resources: - requests: - # Volume size value has no effect and is ignored - # by the driver, but must be non-zero. - storage: 1 - storageClassName: cvmfs -``` - -### `CVMFS-CSI` upgrade from v1 to v2 - -The following code snippets are derived from the `CVMFS-CSI` [repository](https://github.com/cvmfs-contrib/cvmfs-csi). -To upgrade the CSI from v1 to v2, please follow the instructions in this [link](https://github.com/cvmfs-contrib/cvmfs-csi/blob/master/docs/upgrading-v1-to-v2-helm.md). - -In case you want to deploy from zero v2: - -```bash -# helm cli installed is necessary -$ helm repo add cern https://registry.cern.ch/chartrepo/cern -$ helm repo update -$ helm install cvmfs cern/cvmfs-csi -n kube-system --set-json 'nodeplugin.tolerations=[{"key": "jupyter-role", "operator": "Exists", "effect": "NoSchedule"}]' -``` - -If you are also deploying JupyterHub in the cluster, please note that the k8s tolerations are needed to be able to deploy the `cvmfs-nodeplugin` pods on the same nodes where the jupyter hub will spawn the `jupyter-` nodes. - -Alternatively, the toleration can be added by hand as a patch -```bash -# helm cli installed is necessary -$ helm install cvmfs cern/cvmfs-csi -n -$ kubectl patch daemonset csi-cvmfsplugin -p '{"tolerations": [{"key": "jupyter-role", "operator": "Exists", "effect": "NoSchedule"}]}' -``` - diff --git a/infrastructure/cluster/manual/cmvfs/cvmfs-sc-pvc.yaml.yaml b/infrastructure/cluster/manual/cmvfs/cvmfs-sc-pvc.yaml.yaml deleted file mode 100644 index df9ec861..00000000 --- a/infrastructure/cluster/manual/cmvfs/cvmfs-sc-pvc.yaml.yaml +++ /dev/null @@ -1,26 +0,0 @@ -# Based on docs and snippets from https://github.com/cvmfs-contrib/cvmfs-csi -# -# Create a StorageClass for provisioning CVMFS automount volumes, -# and a PersistentVolumeClaim that's fulfilled by the StorageClass. -# -# If the Controller plugin is not deployed, follow the example in volume-pv-pvc.yaml. -apiVersion: storage.k8s.io/v1 -kind: StorageClass -metadata: - name: cvmfs -provisioner: cvmfs.csi.cern.ch ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: cvmfs - namespace: jhub -spec: - accessModes: - - ReadOnlyMany - resources: - requests: - # Volume size value has no effect and is ignored - # by the driver, but must be non-zero. - storage: 1 - storageClassName: cvmfs From ef09711bba742cde5434c7c73080e87753424b45 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 26 Jul 2024 17:28:42 +0200 Subject: [PATCH 59/69] add culling to jhub --- AUTHORS.md | 9 +++++---- infrastructure/cluster/flux/jhub/jhub-release.yaml | 10 ++++++++++ 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/AUTHORS.md b/AUTHORS.md index 98501752..586fac28 100644 --- a/AUTHORS.md +++ b/AUTHORS.md @@ -1,7 +1,8 @@ # Authors -List of contributors in alphabetical order: +List of contributors: -- Enrique Garcia Garcia -- Elena Gazzarrini -- Domenic Gosein +- Elena Gazzarrini (CERN), 2022-2024 +- Enrique Garcia Garcia (CERN), 2022-2025 +- Domenic Gosein (CERN), 2022-2023 +- Giovanni Guerrieri (CERN), 2024- diff --git a/infrastructure/cluster/flux/jhub/jhub-release.yaml b/infrastructure/cluster/flux/jhub/jhub-release.yaml index 239e0792..b09725fa 100644 --- a/infrastructure/cluster/flux/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-release.yaml @@ -200,6 +200,16 @@ spec: RUCIO_CA_CERT: "/certs/rucio_ca.pem" OAUTH2_TOKEN: "FILE:/tmp/eos_oauth.token" + extraFiles: + jupyter_notebook_config.json: + mountPath: /etc/jupyter/jupyter_notebook_config.json + data: + MappingKMappingKernelManager: + cull_idle_timeout: 3600 + cull_interval: 600 + cull_busy: false + cull_connected: true + ingress: enabled: true ingressClassName: nginx From 800f16ef0e68bb888d393828654eed2e8e34a879 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 2 Aug 2024 10:45:29 +0200 Subject: [PATCH 60/69] take out culling --- .../cluster/flux/jhub/jhub-release.yaml | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/infrastructure/cluster/flux/jhub/jhub-release.yaml b/infrastructure/cluster/flux/jhub/jhub-release.yaml index b09725fa..e9a2b855 100644 --- a/infrastructure/cluster/flux/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-release.yaml @@ -44,7 +44,7 @@ spec: networkPolicy: enabled: false db: - upgrade: true + #upgrade: true type: postgres # passed as s secret (dbconnect string) from the jhub-vre-db secret config: JupyterHub: @@ -200,15 +200,15 @@ spec: RUCIO_CA_CERT: "/certs/rucio_ca.pem" OAUTH2_TOKEN: "FILE:/tmp/eos_oauth.token" - extraFiles: - jupyter_notebook_config.json: - mountPath: /etc/jupyter/jupyter_notebook_config.json - data: - MappingKMappingKernelManager: - cull_idle_timeout: 3600 - cull_interval: 600 - cull_busy: false - cull_connected: true + # extraFiles: + # jupyter_notebook_config.json: + # mountPath: /etc/jupyter/jupyter_notebook_config.json + # data: + # MappingKMappingKernelManager: + # cull_idle_timeout: 3600 + # cull_interval: 600 + # cull_busy: false + # cull_connected: true ingress: enabled: true From 36c325237da45a018fbb0b2f3b1fd49227c23415 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 2 Aug 2024 11:19:04 +0200 Subject: [PATCH 61/69] increate startTimeout --- infrastructure/cluster/flux/jhub/jhub-release.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/infrastructure/cluster/flux/jhub/jhub-release.yaml b/infrastructure/cluster/flux/jhub/jhub-release.yaml index e9a2b855..3c18023c 100644 --- a/infrastructure/cluster/flux/jhub/jhub-release.yaml +++ b/infrastructure/cluster/flux/jhub/jhub-release.yaml @@ -119,6 +119,7 @@ spec: defaultUrl: "/lab" # The liefcycle hooks are used to create the Rucio configuration file, # and the token file by copying the REFRESH_TOKEN from the environment variable to the token file. + startTimeout: 600 lifecycleHooks: postStart: exec: From e3b89a9dddfa9c4bb4b418ae47feddf02eef6008 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 2 Aug 2024 11:23:01 +0200 Subject: [PATCH 62/69] remove old rucio deployment --- .../flux-v2/rucio-vre/rucio-charts.yaml | 9 - .../flux-v2/rucio-vre/rucio-cronjobs.yaml | 131 ----- .../flux-v2/rucio-vre/rucio-daemons.yaml | 521 ------------------ .../flux-v2/rucio-vre/rucio-namespace.yaml | 6 - .../flux-v2/rucio-vre/rucio-servers.yaml | 203 ------- .../cluster/flux-v2/rucio-vre/rucio-ui.yaml | 100 ---- 6 files changed, 970 deletions(-) delete mode 100644 infrastructure/cluster/flux-v2/rucio-vre/rucio-charts.yaml delete mode 100644 infrastructure/cluster/flux-v2/rucio-vre/rucio-cronjobs.yaml delete mode 100644 infrastructure/cluster/flux-v2/rucio-vre/rucio-daemons.yaml delete mode 100644 infrastructure/cluster/flux-v2/rucio-vre/rucio-namespace.yaml delete mode 100644 infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml delete mode 100644 infrastructure/cluster/flux-v2/rucio-vre/rucio-ui.yaml diff --git a/infrastructure/cluster/flux-v2/rucio-vre/rucio-charts.yaml b/infrastructure/cluster/flux-v2/rucio-vre/rucio-charts.yaml deleted file mode 100644 index be8c8514..00000000 --- a/infrastructure/cluster/flux-v2/rucio-vre/rucio-charts.yaml +++ /dev/null @@ -1,9 +0,0 @@ -# apiVersion: source.toolkit.fluxcd.io/v2beta1 -apiVersion: source.toolkit.fluxcd.io/v1beta1 -kind: HelmRepository -metadata: - name: rucio-charts - namespace: rucio-vre -spec: - interval: 10m - url: https://rucio.github.io/helm-charts/ diff --git a/infrastructure/cluster/flux-v2/rucio-vre/rucio-cronjobs.yaml b/infrastructure/cluster/flux-v2/rucio-vre/rucio-cronjobs.yaml deleted file mode 100644 index 1256d78f..00000000 --- a/infrastructure/cluster/flux-v2/rucio-vre/rucio-cronjobs.yaml +++ /dev/null @@ -1,131 +0,0 @@ ---- -apiVersion: batch/v1 -kind: CronJob -metadata: - name: iam-sync - namespace: rucio-vre -spec: - schedule: "*/10 * * * *" - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 1 - jobTemplate: - spec: - template: - spec: - restartPolicy: OnFailure - containers: - - name: iam-sync - image: ghcr.io/vre-hub/vre-iam-rucio-sync:v0.1.2-1-0487cc0 - volumeMounts: - - name: rucio-cfg - mountPath: /opt/rucio/etc/ - - name: prod-rucio-x509up - mountPath: /tmp/ - env: - - name: IAM_SERVER - value: "https://iam-escape.cloud.cnaf.infn.it/" - - name: IAM_CLIENT_SECRET - valueFrom: - secretKeyRef: - name: iam-client - key: admin-client_secret - - name: IAM_CLIENT_ID - valueFrom: - secretKeyRef: - name: iam-client - key: admin-client_id - tty: true - imagePullPolicy: Always - command: - - /bin/sh - - -c - - date; echo Hello from iam-rucio-sync container; - pwd; ls;rucio whoami; - echo $IAM_SERVER; echo $IAM_CLIENT_ID; echo $IAM_CLIENT_SECRET; python3 /home/sync_iam_rucio.py; - echo '* Sync to IAM * Done!' - volumes: - - name: rucio-cfg - secret: - secretName: escape-service-account - - name: prod-rucio-x509up - secret: - secretName: prod-rucio-x509up ---- -apiVersion: batch/v1 -kind: CronJob -metadata: - name: rucio-noise - namespace: rucio-vre -spec: - schedule: "*/10 * * * *" - concurrencyPolicy: Forbid - successfulJobsHistoryLimit: 1 - jobTemplate: - spec: - template: - spec: - restartPolicy: OnFailure - containers: - - name: rucio-noise - image: ghcr.io/vre-hub/vre-rucio-noise:v1.0.0-rc0-52-7e5585c - volumeMounts: - - name: rucio-cfg - mountPath: /opt/rucio/etc/ - - name: prod-rucio-x509up - mountPath: /tmp/ - tty: true - imagePullPolicy: Always - command: - - /bin/sh - - -c - - date; ls -l /etc/pki/tls/certs/; ls -l /tmp/; cd /opt/rucio/etc/; pwd; echo Hello from rucio-noise container; - export RUCIO_CONFIG=/opt/rucio/etc/rucio.cfg; echo Exported config; cat /opt/rucio/etc/rucio.cfg; rucio -vvv whoami; - cd /home; export FSIZE=10M; FILE_SIZE=${FSIZE} /bin/bash produce_noise.sh; echo "Rucio noise cronjob ${FSIZE} Done!" - volumes: - - name: rucio-cfg - secret: - secretName: escape-service-account - defaultMode: 0400 - - name: prod-rucio-x509up - secret: - secretName: prod-rucio-x509up ---- -apiVersion: v1 -kind: Pod -metadata: - name: rucio-client - namespace: rucio-vre -spec: - containers: - - name: rucio-client - image: ghcr.io/vre-hub/vre-rucio-client:v0.1.2-1-0487cc0 - imagePullPolicy: Always - env: - - name: RUCIO_CFG_RUCIO_HOST - value: "https://vre-rucio.cern.ch" - - name: RUCIO_CFG_AUTH_HOST - value: "https://vre-rucio-auth.cern.ch" - - name: RUCIO_CFG_ACCOUNT - value: "root" - - name: RUCIO_CFG_AUTH_TYPE - value: "userpass" - - name: RUCIO_CFG_USERNAME - valueFrom: - secretKeyRef: - name: root-account - key: root-username - - name: RUCIO_CFG_PASSWORD - valueFrom: - secretKeyRef: - name: root-account - key: root-password - command: ["sleep","3600"] - resources: - limits: - cpu: 100m - memory: 50Mi - requests: - cpu: 100m - memory: 50Mi - - diff --git a/infrastructure/cluster/flux-v2/rucio-vre/rucio-daemons.yaml b/infrastructure/cluster/flux-v2/rucio-vre/rucio-daemons.yaml deleted file mode 100644 index ca295cce..00000000 --- a/infrastructure/cluster/flux-v2/rucio-vre/rucio-daemons.yaml +++ /dev/null @@ -1,521 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: daemons-vre - namespace: rucio-vre - annotations: - flux.weave.works/automated: "false" - -spec: - releaseName: daemons-vre - interval: 5m - chart: - spec: - sourceRef: - kind: HelmRepository - name: rucio-charts - namespace: rucio-vre - interval: 1m - chart: rucio-daemons - version: 1.30.0 - - valuesFrom: - - kind: Secret - name: rucio-db - valuesKey: values.yaml - - kind: Secret - name: hermes-secret - valuesKey: values.yaml - - values: - additionalSecrets: - - volumeName: idpsecrets - secretName: idpsecrets - mountPath: /opt/rucio/etc/idpsecrets.json - subPath: idpsecrets.json - - volumeName: cafile - secretName: cafile - mountPath: /etc/grid-security/ca.pem - subPath: ca.pem - - volumeName: rucio-x509up - secretName: rucio-x509up - mountPath: /tmp/x509up - subPath: x509up - - volumeName: rse-accounts - secretName: rse-accounts - mountPath: /opt/rucio/etc/rse-accounts.cfg - subPath: rse-accounts.cfg - - # TO START WITH - - # https://rucio.cern.ch/documentation/operator/transfers/transfers-overview/#daemon-overview - - abacusAccountCount: 1 - abacusCollectionReplicaCount: 1 - abacusRseCount: 1 - automatixCount: 1 - cacheConsumerCount: 0 - conveyorTransferSubmitterCount: 2 - conveyorPollerCount: 2 - conveyorFinisherCount: 1 - conveyorReceiverCount: 0 - conveyorStagerCount: 0 - conveyorThrottlerCount: 0 - conveyorPreparerCount: 0 # for debugging, if it is not there the submitter will do the path computation adn source replica selection, and since the preparer needs a secret but I dont know of which kind, let's try without - darkReaperCount: 0 - hermesCount: 2 - hermes2Count: 0 - judgeCleanerCount: 1 - judgeEvaluatorCount: 1 - judgeInjectorCount: 1 - judgeRepairerCount: 1 - oauthManagerCount: 1 - undertakerCount: 1 - reaperCount: 2 - replicaRecovererCount: 0 - transmogrifierCount: 1 - tracerKronosCount: 0 - minosCount: 0 - minosTemporaryExpirationCount: 0 - necromancerCount: 0 - - image: - repository: rucio/rucio-daemons - tag: release-1.30.0 - pullPolicy: Always - - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - - podLabels: {} - podAnnotations: {} - - minReadySeconds: 5 - - # monitoring: - # enabled: true - # serviceMonitorEnabled: true - # exporterPort: 8080 - # targetPort: 8080 - # interval: 30s - # telemetryPath: /metrics - # namespace: monitoring - # labels: - # release: prometheus-operator - - abacusAccount: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - abacusCollectionReplica: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - abacusRse: - fillHistoryTable: 0 - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - automatix: - threads: 1 - sleepTime: 30 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "100Mi" - cpu: "100m" - - cacheConsumer: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "100Mi" - cpu: "100m" - - conveyorTransferSubmitter: - threads: 3 # atlas has 10 - podAnnotations: {} - activities: "'Analysis Input' 'Analysis Output' 'Data Brokering' 'Data Consolidation' 'Data rebalancing' 'Debug' 'Express' 'Functional Test' 'Group Subscriptions' 'Production Input' 'Production Output' 'Recovery' 'Staging' 'T0 Export' 'T0 Export' 'T0 Tape' 'User Subscriptions' 'default' 'DAC21'" - sleepTime: 10 - archiveTimeout: "" - bulk: 1000 - groupBulk: 200 - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - conveyorPoller: - activities: "'Analysis Input' 'Analysis Output' 'Data Brokering' 'Data Consolidation' 'Data rebalancing' 'Debug' 'Express' 'Functional Test' 'Group Subscriptions' 'Production Input' 'Production Output' 'Recovery' 'Staging' 'T0 Export' 'T0 Export' 'T0 Tape' 'User Subscriptions' 'default' 'DAC21'" - threads: 3 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - conveyorFinisher: - threads: 2 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - conveyorReceiver: - threads: 2 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - conveyorThrottler: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - conveyorPreparer: - threads: 2 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - darkReaper: - workers: 1 - chunkSize: "10" - scheme: "" - rses: "" - includeRses: "" - excludeRses: "" - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - hermes: - threads: 2 - podAnnotations: {} - bulk: 1000 - sleepTime: 10 - brokerTimeout: 3 - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - hermes2: - threads: 1 - podAnnotations: {} - bulk: 1000 - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - judgeCleaner: - threads: 2 - podAnnotations: {} - resources: - limits: - memory: "1200Mi" - cpu: "1000m" - requests: - memory: "400Mi" - cpu: "1000m" - - judgeEvaluator: - threads: 2 - podAnnotations: {} - resources: - limits: - memory: "3000Mi" - cpu: "2000m" - requests: - memory: "3000Mi" - cpu: "2000m" - - judgeInjector: - threads: 2 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - judgeRepairer: - threads: 2 - podAnnotations: {} - resources: - limits: - memory: "6000Mi" - cpu: "1000m" - requests: - memory: "800Mi" - cpu: "1000m" - - oauthManager: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - undertaker: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - reaper: - greedy: 1 - scheme: "" - threads: 2 - chunkSize: 2 - includeRses: "" - podAnnotations: {} - resources: - limits: - memory: "1600Mi" - cpu: "2000m" - requests: - memory: "500Mi" - cpu: "400m" - - replicaRecoverer: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - transmogrifier: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - tracerKronos: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "200Mi" - cpu: "700m" - - minos: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "100Mi" - cpu: "100m" - - minosTemporaryExpiration: - threads: 1 - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "100Mi" - cpu: "100m" - - necromancer: - podAnnotations: {} - resources: - limits: - memory: "200Mi" - cpu: "700m" - requests: - memory: "100Mi" - cpu: "100m" - - ftsRenewal: - schedule: "12 */6 * * *" - enabled: 0 #disable for now - image: - repository: rucio/fts-cron - tag: latest - pullPolicy: Always - vos: - - vo: "escape" - voms: "escape" - servers: "https://fts3-devel.cern.ch:8446,https://fts3-pilot.cern.ch:8446" - secretMounts: - - secretName: fts-cert - mountPath: /opt/rucio/certs/usercert.pem - subPath: usercert.pem - - secretName: fts-key - mountPath: /opt/rucio/certs/new_userkey.pem - subPath: new_userkey.pem - additionalEnvs: - - name: RUCIO_FTS_SECRETS - value: daemons-vre-rucio-x509up - - name: USERCERT_NAME - value: fts-cert - - name: USERKEY_NAME - value: fts-key - - resources: - limits: - cpu: 500m - memory: 256Mi - requests: - cpu: 100m - memory: 128Mi - - automaticRestart: - enabled: 1 - image: - repository: bitnami/kubectl - tag: latest - pullPolicy: IfNotPresent - # schedule: "7 1 * * *" - schedule: "10 */8 * * *" - selectorLabel: "app-group=rucio-daemons" - resources: - limits: - cpu: 500m - memory: 256Mi - requests: - cpu: 100m - memory: 128Mi - - config: - - oidc: - idpsecrets: "/opt/rucio/etc/idpsecrets.json" - admin_issuer: "escape" - expected_audience: "rucio" - # expected_scope: "openid profile" - - monitor: - enable_metrics: "True" - - policy: - permission: "escape" - schema: "escape" - - conveyor: - scheme: "srm,gsiftp,root,http,https" - transfertool: "fts3" - ftshosts: "https://fts3-pilot.cern.ch:8446" - cacert: "/etc/grid-security/ca.pem" - usercert: "/tmp/x509up" - allow_user_oidc_tokens: "True" - request_oidc_scope: "openid profile offline_access wlcg.groups email fts:submit-transfer" - request_oidc_audience: "fts" - - # this needs to be messaging_hermes and not messaging-hermes for some reason - - messaging_hermes: - port: "61113" - - nonssl_port: "61113" - use_ssl: "False" - destination: "/topic/eosc.rucio.events" #"/topic/escape.rucio.events" changed from escape - brokers: "dashb-mb.cern.ch" - voname: "escape" - - messaging_fts3: - port: "61123" - use_ssl: "False" - brokers: "dashb-mb.cern.ch" - voname: "escape" - - credentials: - gcs: "/opt/rucio/etc/rse-accounts.cfg" - signature_lifetime: "3600" diff --git a/infrastructure/cluster/flux-v2/rucio-vre/rucio-namespace.yaml b/infrastructure/cluster/flux-v2/rucio-vre/rucio-namespace.yaml deleted file mode 100644 index 8c82ca51..00000000 --- a/infrastructure/cluster/flux-v2/rucio-vre/rucio-namespace.yaml +++ /dev/null @@ -1,6 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - labels: - name: rucio-vre - name: rucio-vre diff --git a/infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml b/infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml deleted file mode 100644 index 68d32d0c..00000000 --- a/infrastructure/cluster/flux-v2/rucio-vre/rucio-servers.yaml +++ /dev/null @@ -1,203 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: servers-vre - namespace: rucio-vre - annotations: - flux.weave.works/automated: "false" - -spec: - releaseName: servers-vre - interval: 5m - chart: - spec: - sourceRef: - kind: HelmRepository - name: rucio-charts - namespace: rucio-vre - interval: 1m - chart: rucio-server - version: 1.30.0 - - valuesFrom: - - kind: Secret - name: rucio-db - valuesKey: values.yaml - - values: - additionalSecrets: - idpsecrets: - secretName: idpsecrets - mountPath: /opt/rucio/etc/idpsecrets.json - subPath: idpsecrets.json - rse-accounts: - secretName: rse-accounts - mountPath: /opt/rucio/etc/rse-accounts.cfg - subPath: rse-accounts.cfg - - replicaCount: 2 - authReplicaCount: 2 - - useSSL: - server: true - authServer: true - - image: - repository: rucio/rucio-server - tag: release-1.30.0 - pullPolicy: Always - - # The API server listens on port 6443 (by default). - # Therefore, expose the API server on port 443 and listen to 6443. - - service: - type: LoadBalancer - port: 443 - targetPort: 443 - protocol: TCP - name: https - # # annotations: - # # # These annotations are only required for cluster templates <=1.18 - # # loadbalancer.openstack.org/network-id: "798d00f3-2af9-48a0-a7c3-a26d909a2d64" - # # service.beta.kubernetes.io/openstack-internal-load-balancer: "true" - # # loadbalancer.openstack.org/cascade-delete: "false" - - authService: - type: LoadBalancer - port: 443 - targetPort: 443 - protocol: TCP - name: https - # # annotations: - # # # These annotations are only required for cluster templates <=1.18 - # # loadbalancer.openstack.org/network-id: "798d00f3-2af9-48a0-a7c3-a26d909a2d64" - # # service.beta.kubernetes.io/openstack-internal-load-balancer: "true" - # # loadbalancer.openstack.org/cascade-delete: "false" - - # service: - # type: ClusterIP - # port: 443 - # targetPort: 443 - # protocol: TCP - # name: https - - # authService: - # type: ClusterIP - # port: 443 - # targetPort: 443 - # protocol: TCP - # name: https - - # ingress: - # enabled: true - # path: / - # annotations: - # kubernetes.io/ingress.class: nginx - # nginx.ingress.kubernetes.io/frontend-entry-points: http, https - # nginx.ingress.kubernetes.io/ssl-redirect: "false" - # # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - # # nginx.ingress.kubernetes.io/ssl-redirect: "true" - # hosts: - # - "vre-rucio.cern.ch" - # tls: - # - secretName: rucio-server.tls-secret - - # authIngress: - # enabled: true - # path: / - # annotations: - # kubernetes.io/ingress.class: nginx - # nginx.ingress.kubernetes.io/frontend-entry-points: http, https - # nginx.ingress.kubernetes.io/ssl-redirect: "false" - - # # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - # # nginx.ingress.kubernetes.io/ssl-redirect: "true" - # hosts: - # - "vre-rucio-auth.cern.ch" - # tls: - # - secretName: rucio-server-auth.tls-secret - - serverType: - server: flask - authServer: flask - - # monitoring: - # enabled: true - - automaticRestart: - enabled: 1 - image: - repository: bitnami/kubectl - tag: latest - pullPolicy: IfNotPresent - schedule: "17 1 * * *" - selectorLabel: "'app in (rucio-server,rucio-server-trace,rucio-server-auth)'" - resources: - limits: - cpu: 500m - memory: 256Mi - requests: - cpu: 100m - memory: 128Mi - - wsgi: - daemonProcesses: "4" - daemonThreads: "4" - - additionalEnvs: - - name: RUCIO_SSL_PROTOCOL - value: "all -SSLv2 -SSLv3" - - httpd_config: - mpm_mode: "event" - timeout: "300" - enable_status: "True" - legacy_dn: "True" - keep_alive: "On" - keep_alive_timeout: "5" - max_keep_alive_requests: "128" - server_limit: "10" - start_servers: "4" - thread_limit: "128" - threads_per_child: "128" - min_spare_threads: "256" - max_spare_threads: "512" - max_request_workers: "1280" - max_connections_per_child: "2048" - - ## values used to configure Rucio - config: - - database: - pool_size: 10 - max_overflow: 20 - - oidc: - idpsecrets: "/opt/rucio/etc/idpsecrets.json" - admin_issuer: "escape" - expected_audience: "rucio" - expected_scope: "openid profile" - - policy: - permission: "escape" - schema: "escape" - - credentials: - gcs: "/opt/rucio/etc/rse-accounts.cfg" - signature_lifetime: "3600" - - serverResources: - limits: - cpu: "4000m" - memory: "4000Mi" - requests: - cpu: "2000m" - memory: "2000Mi" - - authServerResources: - limits: - cpu: "1500m" - memory: "1000Mi" - requests: - cpu: "200m" - memory: "500Mi" diff --git a/infrastructure/cluster/flux-v2/rucio-vre/rucio-ui.yaml b/infrastructure/cluster/flux-v2/rucio-vre/rucio-ui.yaml deleted file mode 100644 index 51bd68af..00000000 --- a/infrastructure/cluster/flux-v2/rucio-vre/rucio-ui.yaml +++ /dev/null @@ -1,100 +0,0 @@ -apiVersion: helm.toolkit.fluxcd.io/v2beta1 -kind: HelmRelease -metadata: - name: webui-vre - namespace: rucio-vre -spec: - interval: 5m - releaseName: webui-vre - chart: - spec: - chart: rucio-ui - version: "1.30.0" - sourceRef: - kind: HelmRepository - name: rucio-charts - namespace: rucio-vre - interval: 1m - - valuesFrom: - - kind: Secret - name: rucio-db - valuesKey: values.yaml - values: - - additionalSecrets: - - volumeName: idpsecrets - secretName: idpsecrets - mountPath: /opt/rucio/etc/idpsecrets.json - subPath: idpsecrets.json - - replicaCount: 1 - exposeErrorLogs: True - - # service: - # type: NodePort - # useSSL: true - # port: 443 - # targetPort: https - # portName: https - service: - type: LoadBalancer - useSSL: true - port: 443 - targetPort: 443 - protocol: TCP - name: https - - image: - repository: rucio/rucio-ui - tag: release-1.30.0 - pullPolicy: Always - - strategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 1 - - minReadySeconds: 5 - - proxy: - rucioProxy: "vre-rucio.cern.ch" - rucioProxyScheme: "https" - rucioAuthProxy: "vre-rucio-auth.cern.ch" - rucioAuthProxyScheme: "https" - - # ingress: - # enabled: true - # annotations: - # kubernetes.io/ingress.class: nginx - # nginx.ingress.kubernetes.io/ssl-passthrough: "true" - # nginx.ingress.kubernetes.io/ssl-redirect: "true" - # path: / - # hosts: - # - vre-rucio-ui.cern.ch - - ## values used to configure apache - httpd_config: - legacy_dn: "False" - - config: - policy: - permission: "generic" - schema: "generic" - lfn2pfn_algorithm_default: "identity" - - oidc: - idpsecrets: "/opt/rucio/etc/idpsecrets.json" - admin_issuer: "escape" - - resources: - limits: - cpu: 200m - memory: 800Mi - requests: - cpu: 200m - memory: 500Mi - - - From 378b2c0aeed5c4bf306ac0c2a6e2ba91f5a555eb Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Fri, 2 Aug 2024 12:20:16 +0200 Subject: [PATCH 63/69] add rucio db secret and script --- infrastructure/scripts/rucio_secrets_1-db.sh | 25 +++++++++++++++++++ infrastructure/secrets/rucio/ss_rucio-db.yaml | 15 +++++++++++ 2 files changed, 40 insertions(+) create mode 100644 infrastructure/scripts/rucio_secrets_1-db.sh create mode 100644 infrastructure/secrets/rucio/ss_rucio-db.yaml diff --git a/infrastructure/scripts/rucio_secrets_1-db.sh b/infrastructure/scripts/rucio_secrets_1-db.sh new file mode 100644 index 00000000..da1f0653 --- /dev/null +++ b/infrastructure/scripts/rucio_secrets_1-db.sh @@ -0,0 +1,25 @@ +#!/bin/bash + +echo "START rucio DB Secret Script" + +# kubeseal controller namespace +CONTROLLER_NS="sealed-secrets" +CONTROLLER_NAME="sealed-secrets-controller" + +# rucio namespace +RUCIO_NS="rucio" + +# Output dir +SECRETS_DIR="/root/software/vre/infrastructure/secrets/rucio" +RAW_SECRETS_TMP_DIR="/root/software/vre/infrastructure/secrets/tmp_local_secrets" + +echo "Create rucio DB secret" + +# name of output secret to apply +DB_OUTPUT_SECRET="rucio-db.yaml" +RAW_DB_FILE_SECRET=${RAW_SECRETS_TMP_DIR}/${DB_OUTPUT_SECRET} + +cat ${RAW_DB_FILE_SECRET} | kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${DB_OUTPUT_SECRET} +kubectl apply -f ${SECRETS_DIR}/ss_${DB_OUTPUT_SECRET} + +echo "END rucio DB Secret Script" \ No newline at end of file diff --git a/infrastructure/secrets/rucio/ss_rucio-db.yaml b/infrastructure/secrets/rucio/ss_rucio-db.yaml new file mode 100644 index 00000000..158fe50e --- /dev/null +++ b/infrastructure/secrets/rucio/ss_rucio-db.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: rucio-db + namespace: rucio +spec: + encryptedData: + dbfullstring: AgBPg/b31E7pfA3sPwzV3qbt7g+z8ecrdu6PA0lxsqxCz5IvfUxytCVQgN3/2ovzrrlQ4Oqo2i7/fLlns8lN6QvPaU/I6FTWEG+pK8JeeQ1ybm0CBBOWOrb3uUivTETewsToAnPejXsNATiyANj9Vf+dyhjffBN+LL3WzvYvz90Bdp+duU9/JMWdoUBRHAZwpOGSTF6GUct152JadYbaA263gKBQtAxW1U1EDfPx0nqMJaGj9vI8EJOAFSronQeKtUDC3OKm5G3og4qSfbigDGeYq/4Vh+YGUIW5SOsr5uGFpAvZcH0Xq7aQa2K7qOEyrCMPuqux0C0EAJwERn3wgxYQP6fVqT3qzwV3EZhIXWlIJB4VjFaaLpxGKAdV9hDF9mhuYBUEJMW5WinfXlV2lrqdF8IK6qvpYW9KTiJZbltWalVB4PCWl4g+vFBJJekGMFohHt9gnM7KtMswF33VQeyD7YleEi7c6LxsisdSvoFP+IUlJfa3aXwEaKf7tmqUME5YtPRigNyCgI4PvNzDWq8WLt8Q8KjWBKSD4Lcm9rNcDrrOf5RNKTZYP/Jo28wlnVk/q4cokiKZWf9LV++QlotOU1u7L6FKsdHfasjExJ2eJT2bZQ165bYjftt5kaguJ1RYHuYcK0L++En7AxhSeZh6nBW/DKutoVgbIhsB7ZP4EugT16CnYj2A5Fte6YfzafeZ1eglwvtDp7rXa1voozlSeY7ls3HIvv9qvzzaZMhLNxGPpWE36snG4NKvdVj0alvAFhH6hmdetrn4flQhOs/zzPF9maZiEv4P + template: + metadata: + creationTimestamp: null + name: rucio-db + namespace: rucio From e1821c370365d611daa7d59ec4e9b0b1db2815a3 Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Tue, 6 Aug 2024 11:26:47 +0200 Subject: [PATCH 64/69] add rucio servers and auth secrets --- .../scripts/rucio_secrets_2-servers.sh | 65 +++++++++++++++++++ .../rucio/ss_servers-auth-server-cafile.yaml | 15 +++++ .../ss_servers-auth-server-hostcert.yaml | 15 +++++ .../rucio/ss_servers-auth-server-hostkey.yaml | 15 +++++ .../rucio/ss_servers-server-cafile.yaml | 15 +++++ .../rucio/ss_servers-server-gridca.yaml | 15 +++++ .../rucio/ss_servers-server-hostcert.yaml | 15 +++++ .../rucio/ss_servers-server-hostkey.yaml | 15 +++++ 8 files changed, 170 insertions(+) create mode 100644 infrastructure/scripts/rucio_secrets_2-servers.sh create mode 100644 infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml create mode 100644 infrastructure/secrets/rucio/ss_servers-auth-server-hostcert.yaml create mode 100644 infrastructure/secrets/rucio/ss_servers-auth-server-hostkey.yaml create mode 100644 infrastructure/secrets/rucio/ss_servers-server-cafile.yaml create mode 100644 infrastructure/secrets/rucio/ss_servers-server-gridca.yaml create mode 100644 infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml create mode 100644 infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml diff --git a/infrastructure/scripts/rucio_secrets_2-servers.sh b/infrastructure/scripts/rucio_secrets_2-servers.sh new file mode 100644 index 00000000..46d7ddcd --- /dev/null +++ b/infrastructure/scripts/rucio_secrets_2-servers.sh @@ -0,0 +1,65 @@ +#!/bin/bash + +echo " *** START rucio SERVERS Secret Script" + +# Once the certificates have been split, provide their path to be read when creating the secrets (NEEDS TO BE EXCLUDED FROM COMMITS!!): +RAW_SECRETS_SERVERS="/root/clusters_CERTS/vre/servers" +RAW_SECRETS_SERVERS_AUTH="/root/clusters_CERTS/vre/servers-auth" + +# kubeseal controller namespace +CONTROLLER_NS="sealed-secrets" +CONTROLLER_NAME="sealed-secrets-controller" + +# rucio namespace +RUCIO_NS="rucio" +HELM_RELEASE_SERVER="servers" +HELM_RELEASE_SERVER_AUTH="servers-auth" + +# Output dir +SECRETS_DIR="/root/software/vre/infrastructure/secrets/rucio" + +echo " *** Create and apply SERVER secrets" + +kubectl create secret generic ${HELM_RELEASE_SERVER}-server-hostcert --dry-run=client --from-file=${RAW_SECRETS_SERVERS}/hostcert.pem -o yaml | \ +kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-hostcert.yaml + +kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-hostcert.yaml + +kubectl create secret generic ${HELM_RELEASE_SERVER}-server-hostkey --dry-run=client --from-file=${RAW_SECRETS_SERVERS}/hostkey.pem -o yaml | \ +kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-hostkey.yaml + +kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-hostkey.yaml + +# The content of this file is the same as in /etc/pki/tls/certs/CERN-bundle.pem but renamed to ca.pem +kubectl create secret generic ${HELM_RELEASE_SERVER}-server-cafile --dry-run=client --from-file=${RAW_SECRETS_SERVERS}/ca.pem -o yaml | \ +kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-cafile.yaml + +kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-cafile.yaml + +# Create server secret for the GridCA file +# The content of this file is the same as in /etc/grid-security/certificates/CERN-GridCA.pem but mv'd. +kubectl create secret generic ${HELM_RELEASE_SERVER}-server-gridca --dry-run=client --from-file=${RAW_SECRETS_SERVERS}/CERN-GridCA.pem -o yaml | \ +kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-gridca.yaml + +kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-gridca.yaml + + +echo " *** Create and apply SERVER AUTH secrets" + +kubectl create secret generic ${HELM_RELEASE_SERVER_AUTH}-server-hostcert --dry-run=client --from-file=${RAW_SECRETS_SERVERS_AUTH}/hostcert.pem -o yaml | \ +kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-server-hostcert.yaml + +kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-server-hostcert.yaml + +kubectl create secret generic ${HELM_RELEASE_SERVER_AUTH}-server-hostkey --dry-run=client --from-file=${RAW_SECRETS_SERVERS_AUTH}/hostkey.pem -o yaml | \ +kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-server-hostkey.yaml + +kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-server-hostkey.yaml + +kubectl create secret generic ${HELM_RELEASE_SERVER_AUTH}-server-cafile --dry-run=client --from-file=${RAW_SECRETS_SERVERS_AUTH}/ca.pem -o yaml | \ +kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-server-cafile.yaml + +kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-server-cafile.yaml + + +echo " *** END rucio SERVERS Secret Script" \ No newline at end of file diff --git a/infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml b/infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml new file mode 100644 index 00000000..959f13a6 --- /dev/null +++ b/infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: servers-auth-server-cafile + namespace: rucio +spec: + encryptedData: + ca.pem: AgAcde770m75GX5Rdz1Zs+kqOaFhlVEyU3jzEBTZFfcUDqMSM7Z3ixnxmBT1Xux/nHSGGwF5gU1B4oB9NlJFZ81blcYtOoxn2g8BxRBoJqfye6mdo8zLAjiAfrvHlDZubv1iIrjxZcNVvgG81bCiXXmCXTfCtcytrH8P5bk7hlPwQCAfUe5aViqdYMKJYrFbez6Rg/MbvHu1i/V6z/r57MDm7vySUpJKDSuMnwupqbkPkMBVJHDkcy2RMJ6mrf/5kvQrtt5zMmTzL/ir0zYlxbsZgVLFdpP8yLmbTVLjq4LsTWwcFoVVLK84lSds+HibnChFnvKN5a07LJLjmsYk52j2cBKticU4iPZktlROQ8hVpx1Hk1DVTsGVPMbTSZWwCpO+Rib3hGrP3jIdRKmBP1znWy9wBb36JqQFBYlrG8NOdHxXCSW9x7bXx4ArEZkpiWfukPSJs7ocpvh+dNBE7b3Tbn6vmufKwQgiDT6HqCXdq1bGdVm6o8tyQeh8kVfztA1HMSsVQ52Rd1eVwcDW8Xm4gIQkK1IoxyPVBwSAVdgkUvRvlVQosVzZqDiiKY7us3fotqtiFPNZGFwdT4sqoHUIgaKlRJL6pATf+Gx1tOY0aN6RjGnRgxWSWhGWiF4w3QYIyGwsAZkqaZdhTCftgVFG1+4pLBzLjSvAEYmLPDlV9ZStcAZmATwUgT0QfRZiAsRvQrIFFI4kzGKCHhZLXTWSg2Yq9mXAcTcYc/V7aOjX84cqlGv8Wzp+9BVcjWUJuOMkzSqmhxBWn3uS9DY48bQeRtlYSia3TC0Zg3jUP7cWcDeytC4l2/3CtrYJmiA2p+QUnapGA/RYwgs5A9qvrNgD+Te/MzoOihOYljh3IhY7quWJRbTyNbIBDVLxtCcbYjOyrUfG0wFC9sGXiS5p07e2trpuBYKYmNYEgbqYCGi7UO8kXBIucf4DxTHUIyqRs0HpfdCvlSNzbCMcMurQMy2FBs+I1EqP0FUgc4Pfrh00mPYyOXRFjRonR3AgmcBuvMNa9o296g6iJvFZJyknXKrizqiykoGnw3CH8L0sBVoE7R5VO+Lph2S1z8BUdoN1SUeufOEth1HauR6ID5JM41M122S15Ws0uIcK2pURXDiXv/0ZniHb45eeRXYY+h4kJs4l5o8ns2m8qZiPGfeTpIirsXavFc43JnXalyvy2BBCgc7h4XIeMDWY+kLV0G/E9axyyxM+bixioTc7CW04hh2fTnFFjKQAgpgAM4NanqVQKnIiqECWgIM+qy3y1zlF+R9ReU+MNs6lfrxzTJDw3whZOCksYdPd1bfUVzRtViJFjmDv2lnvyt0buw8xIjtqaUqICyg2jEsIl+9Sz/ME55XN6WvWFtDdWnFrsmXK1lU5OSO/aqJm1Mba+jdIFZyLBDazH3nwRgRpuICE7c3VD4cWMjignzhSJ7p96wCqmS1ujynEAPj0aZo+ayC5zxyhmpeZITXB6QYCTJMv1T/5YunH217zMvvMpf8LrYWaHhhuGkiW+Gs3YXHAy7cQt/HXWxakGxzUFUO/GFT0iZA2N8UpXBx0DH+M6U1MDo9ptetaa2FgoqwhwReVlJquh8n5xOHnd9FP/wVFni+2iat/9KJ3DgUGV8nlUlHoa3iXh3XzoHvNWzObs9BkBAwOqH4I3Hp9LtvIWUzYbYTBjuCZlhUhubfbPAnzg7Zk5LNrZbIqd5ai1CCcXeIQNUS3EBWIJ5sQlVMQcecNPq8q3j3C05v+SZmdD0sa1aAMeoP04Vf+NsNTouMz3k5t0co/wplbOCC6YoBrr8exj1Ei7R1BgVSR9yrCHxJkqzkobB3pOsNVDbRQxcucxIpUyvn8CbOmXS6MJXcImmC/zZK7i00gbtT9ZHDOjTDdbv9YwhnYWXo/hVswmhP2rEfmi6dgORqzOPxzKwOAIvFmYeSNLcElWnzzWwaQRHVVk6vRxacEe7KauxVAY4XHAqIhpDa5A904d0fk5YEQKBhQc38/eI/qvUHKzpy3VP1iBmwVMZKK0oPcEO7e6Pf7NVCa797oBvl0rEOB8Hz4iyhBbiZQaY8LO46oqcPrxDarQtP7GbKwYAfrktdGN0Hq2VxOMsU/qUFNya+Q0Nb3zWBxRC6TChZdZ/bBJNzwEwdhncto2YNorlwILOTQNsp8BV3TScrBZHDEv988UCMOC7LpPCTmux/e0Hznli9/WU8X3gtEq8BV1uEdWTxVPRpnuSguvTpgpEjOSsup8sdGuHJVOreTmUHLpIDxTUvOxWZW4xpFVPeYr502juRFWmMpcVSoGU1fk/Evw+ITs1+OlPpMWhaitbNKgwEwJp5lgeG7sVvRAvZOJ7+nGT2QUucWQBr/nBEf3FOh6t+RQczbyqRb2aJITt4homUs1TOW3wKbzxYpw2nWW8POme38km0dH8oltXAefWpCJ8ykqmC0aTUF582GItRp1Qis6L8BkwAXnpGQvaipRJTHC9M4MsanBKJgeG7LjPm5ezHBTFyh6bHqI7VhfqkPiRuCndHs3UtNjDWOCTtzhkeHfba2gIUiRxwijznFXIE9aQjV1R+5WcdkQ8W+Ne2MYAoum7oG//T3IR90kLQeiA8cBnpfuDT5bMcAt29cElcZ3kEzRhWxyLY0Qb/uFkaay2dTUh/Sjh2HLwU8EaMgAXlSbkELj4novgbgLaVb2T1P+2mVsn1lMUpkgL0hqNkgzhvoC21dzySpzIN73Q2JqvwqJEM58S+bdQ7LudBx3PGeKmA9VGhvcjwkzDCTG+eX1KaPhCiyowFqetetr2Sa4c6GrEl7AQHx00X4b/HdQzmLZnaW/Z/BgFKz1n7B9ndHQ9bZ/keGKLfVW1XJD1qN6FoBsQJ64K4X+MfRS19Z1nhG6uAnXw8rotUplaIGpDAvCP5LecovyU/Dj5YAS4VbCDV5bezyzPlWl3SnQXL+lqP8yeKbm/p/Kp6OPEyaa9raPz+EGEHeWgkbKhxMWjJ8FbkNWY4VOYnAczSPI5zBXQTPJCor6k+hGscpKhswOoenKSsyCCJJNhPPmMO8yjxgT8S61sTxiHCh7aBqGlmTs6itWBXkwM4Ytr2y4aPIgZCSQ/evSXsx7zH68yLAfakVtYDQjJElo8acB9dxMPsDNCRR7eBHVfTse6i4nDTyCPhST2vq+1J2quEl0gwQY1TluSOv5lFSl22djIYEMfqH7obJN9NJNUx2kCGoSNwapXMjBbgxBsgSZcI7UdsB/f9xf3TtYK1RMDYzjQ/CslISw34w6VRhOSocjmZdCKpxwtvYosD5kgWrNPwg7EVl0bwirFScQGhWeJWRJ+Vs/ydl0cakOvXOBPSFOdUCxs3BA0ffBrnm6mqMnipl8uInANxzOdP7h+w1QpzFsCVXH4h7/lxhKGLbCvpkvckED6FijETxIy3WI8wWV92EnYYM5kLiEckiyJQhby8+ie59SjN4edqHSuKQpsfARtRQv4HR4rudUtnWzmcbrISBwwI+0S+o1CeNHINsTZK7xagmQ9lyf9jbF/H6JoOAQp6JsRVmvorju16G0SbBKK+AwDmsmATrCC+/JvfHnhJUd6akJ1gCQScI8ZfdrTHm3+eomjMjG3Dwp9tZU1naqnNQdPCASlUktDvspXy4sRha+WAUauwtuAkG9BDyFA8qn8MHsASYIonQJ7hIfjq5/8YgOBDF4OdS190r84JZDUfLgFfdJy7I66T/fvpEpuiH6aGnn7DDhZkuuJCL77M29/0f06LjbQ5D0jvrzbOIPyUcK5xzcCp3cyo/UsxoMtqCwnDK326VvI5FTV/kadDL7fdLaHsmwD+rKPiffYpt7Rm/r9hfYpBCBKZALlh56SpjfgBntkCcV/OshOfR4Ew4cgmENKqci5KGy9hBAdkA1CQdTaBPTlLd0oHDRZ6kuZlGWx7dD2dvT+FI6BzuQeGgMRa6/4nw2UheasGvHc6uzljEgdW4ZrTYFJ6+vTL+lMSCFUvOLliO9T1nXYzPTwfj1gZarxl7V79coQj/mFIXXrRoRkIpXQvogHPooROa26ssXGffZGjV7UnZaLh6PF1e9MDwt9qmCSMXg0ao/f+SIJIxZk7/neUIZdBavqJFP4wrWHNOPsEoTDyCxqZUMGLrhCgWClcIjSFrTbuvGgfEDG2Tw3+2A6l6qT+j/Lu2nnzgduhG9c5YLsJhJwRBoWZy1617KEjLPLFRMcSvRNGDBXUksiykb3x5xw07z79YecJALsiSSM2Q4rmM+Eowi96P8bQWLKe0jrruif67/MnsLtdDVB6+P0hICo5oczy7tFekZXKTh+yYJZS8v9uiyJWQ4YxCuW57Hh0hNOsLujBIal3DjTR6ONzhjgz9bpi7Rcl2tjriJhirCLgdunwu1wThAcITfmDuB40EZfg8gpZAbROBjDFNkGk6h80E76T0PgQK2wXBd2EaAqK5swWnG1T+iCKOUoSbk3I0JLzjBynB1/oOAxZQle9+bF/09mPB+OX9y6pw/qMdWmUlZGbARBCfOPSK0kAUvrSRslakb/R8sRjNiz7qbHuRKBDeQ7E5qEHLxE8BgVjLU7D15mp10ns0CW/ESEC6uF+cfDczDOou926PfHKF1xboz88itloQ70a4wvCG+Vbf3n8Y5/U9m5E2ZayBl6Y/iZIKCmy1BkYHmq5KsJYrAYCX3MnfsGp++xcAApYC1smhGp9aVohNhck/npk9moibZDXbd3OQUtAQFfZ5eTLof8ifXambInUbQeKHnnPrYLzUF7xtxjnwvur5Qe4waskYDJNB2DSPsdir1YR7Wft4QiMhYD4TnggjuK7vIsAqIL8Itg5XRaocXD69KWUxgR59crCUX4MMRBNgTLnsRE5KdmmNAT8uskczQ9GdilmwjqvquROLZLfACI5KDx5SkFYAmwfMAii2A9t4xbWPnrC2n4F3avUxxBoSjk/LOgT+NBpQvAMxcqK0Ie6NnVAt0QlQQOWyu38lW1Zpv0dM7MJyc/Bpnae0viI3BGbPfbQlXKMB+GNrI6uTxk7lywHdMXWNKAW8wtsRatmsU6RTZ0WnfhGG5TmzPm1T0SGQa3ggfkmtXlypYlZKn/k3bmqqd1d6M42owmaA5gRbZUvhTyJxJ6wtbLcDmk2tTRpwENY7SGo7PY9nWyux8L3vZHqOoYMLloZe7NT5G+tbs3IgDzbgT6RLr414TX7wmiCcKrPdmbPtmyuvwww86yN+UmnP/qNPXjFGnEfmputa5eP+ElVSK0i0STmc1keMSvlxenXajCuATYHgNy8UH4l6Fj583NYNFKvd4hUvbAKGq2uaWZJWzJfxYoNai/u7cBc23HX0ds/rQaRbeVlSDJk0zJDVUXML18SUJ6bW58ATYaTnRJXgh9juAT5HXpxYTVXCuJG+r6SaDsPtIGVtnN3+Lgw5Q6KylhbuWYhK6IIHbSxnL54M41lpK8xafEhWwzmawGbVe2OTrR2aAGf1FF5J9x+YP2c2pP3ttyGXNFmzc7vb8aI/dL+J3qc6fv5q7+qAvHp2PTk2h/0NClFciUvno17Opo9J/xH6gjUdEjhI6oCNxPFFEsk+tR2LPagwNpMaNwYSc9rM1Ph3knUmGBbCFocCicsznRz9LG1dBFSmge3f59N1KK5COoV9PvbB5vhGMclKeUMmHo3wmBjbmfP44cEyACnzsY+8KAauZcI3pRDkiHO/8VWTap98zVWGU9MjXgYHcp7UegAUlG/0zeVJODz/ULH0qvB6FbyAGCrbwRcTvcdeyFTABcGeIXRh8x/uIM7TgfTfu4cdcXk1NIq+JqtV0MfFJPFkPtZKPmR8gL0WkbGh0yVU3mLNtUWXlR0o08lwootFiBpfTh1LucAjfBlVFAMRAILkJ3g2H9MhSXu0Kth6L3MzUSYw2l5moo7WZTQUzpcUYhrjBl3yMn26TgncTzdukRbbH1azOiGDmHMEj8/zJZcfQDod8oSP2rZo3JrCHU0OqNZ75EoEgnZGxz1Gn6AfibkS5oGmNeVNyH5dz4Q5pOtrF+oz9wYs33Eu1ZKqUiq6q54nnoEq5SGD6U+vYhbpCjy4geQe5vyGg6VXxetbS76wJ3k2fsdqgGvMX37ENibNzYSnJOGNZU5oeFnpCEBUYH1ym0SR9VrM5CNPz3SsCH2DuC68pJ66MPlyzYssTsGgYdg17iOKFpScSUUCiDAE4/tJB6wXJfOwzz4V28QQekwLi0kCQUJ24R1SOiaiDYbd97n15daVtN8Ph+z7Wz4TUngdrggI2PPVrYxLhBAHv3Pzv3I/ql9kAaPP98FI746BHS5/o37M3+DFeOaW2IpGGXIevD0Cl2ljR8SUWroGF8ndX6Mq4G1jJ4/XRVHHFMsHQ/rk82pDmkS2IU6AEjTeIiEiO0n1KnsOjgoz2Ug4Pc1ZLr0tF1aHqeatsyatT51Voz0EEXcQBuBZTHflGsOT4vFyWKWWnBmKQArTB1CQvoLuoWxoiRDyrtZpY853hHFtsxFiFhCdUeXyQ2fmOViiRG6wTLII1/kYmmmJAIvnxmzWIi+TVZZY1BHj6fIW4+LN7yzvNpPv9dDQhO6wAqgcUCZK6Z8imc8Byygn2jNocghb1d8Vuc+iC8YahC1B6JetPtFxqxjQJjtYxUYkxrrfheuTKxm813qfXy/mCf7exFCg5t9BJtNc65P5i/NPF9VYdgF5Dq2BUdrXVjxI/7cz5XoEE7MtqE2xk2ctGufwdiOMuC+We3/q6ZddhrdGeV7bLIovkBGYAGp0O/MY6p5x8rA1Cg+TBI+p78bkIBM/P+dnDE4jjtVjVphs7Z+dfqkDgmtiE/CLQANFF8DBhV/eBFtNZ0a3kcPRGNzcwWmNiUfxhte9/bIqG5dDWxjxZKB1uYK7VJcZWK7p7EwH7+MtWjyCCVlvFPaHBKTtFox5Jn67i2jIHcdYEyaygc5UGJO3K8aWqtCYdobq0Xh44fMzk4bcZYanEOxv647GaiO35RrC4lQgavjby5wZU0chUi1s/Qbba3SxJbECicj/cb+uSMhMMDglW5DcEb4yaiIF1oM1BQ6nwdVlIhUT07gdl72Z33w4SteKKexCmqoHKspbRduPDUjVqQB6/+bE6JXTELLrvO8sJuF8u6BSQPV6JIaZmF1Z0/MeqJp8lHPx+vh3AsnDDbAGVfQLkLAxucNpvT5gQ0Xh72Ko24V3dhT55zVouchjauqn95JDpaiTQyPb2gjpi6BTP6fW+mygLje2oV+dQd8v/7XdoSD77DZmkoR+RizcY5yOSjHoDnlh3R9RC4CvpRRDsR9UpgsQ2tKM9kqECDKSCbIuCpaTy/l9iGBTv99WPVHGxYHj2GhN2+O8I1Mdt70BkrmuOk0JZHeVOkWg6q/z9MNsx7v1tOGU2eXyh4HFZFjNMDtJz6Z8ZzIbPGc+ltEAW+nNMXIwI7LQpR+J1IsiNMWIdA8iyiNYnbI5n5+Xq54BgO/UzWXmIrRaTy9oQlAh9MwJhzysgF4pa0vFmgSyBuMtaerbY7FVuAEr+EuupTQST6uT5APCy1lOhr6KunbbbC2Vb9oktyTUsTNhViteUEYckO6jHW4hyAWvz2N9wBloCaX0wXf2LyDKg2ZxP7VEU5H5tHpj6Nci1Bc5YQK4cCC7PqgcMIgVpJMA8kSRriFhP8pHV5Q8l/SYoC0NVueYTz97Bx7qAXXkD3vtabKYgkuJbvxumzi59p/2RT6aG6K1f7YH7nzO7rcRICmlC1ynBMnKOhGsUiayD/G4ECuBh3XC2237MDuievFt28oQMUR2rJoqDwvgdtpMmdarMXNaESyhfOeI8jkA0mRV7yAVS6hjMyUI05IvLGyKreE5mCOgY5MPvwTORWM5FwBi6xZ4WP/uWefj/k0jx9VqhW//DmHvDxvk8gyD7M1/vCZNwsP2ep6uys0w16XcwW1iaSkfbV9WNI5HrAdl83bkqbXo/1kyp8dk0rKYdFHA6jk0bk+/tLeqv0bNSe4ysWCGAIj3VHpV0Yr84uqMgv1CJK7iPUQvW2XKXQ3LJWESg644OPq4EAOaFZLqFWkM5i03P6PeHT6UMjKrJ/Kulc5kifqtXujZGnaS5TGCzRrts14Mrgx/JQmBTu9p0erKrgM/eWd+FQkJmBQu7fxPMaAk1horZjm1YYQt/gu3rVxI8T7HhxFrUTa/UPxK8Q6qbkUUU3mvp6yHilNAw05zhnNUm+l+4l5BDMVhqdY5+WeunSy5VCTMQK7GLJPecdl86gkA72Lcnyxk8PYcz1G07uYeMXg4RM8WNdo9dbkMLAgRbYQYZ9j3rZ1UZmxhW3YGW4b9xlH8JipNS0z/h0glizIRxMZIRDGjTf8vncQvxAMGtmo8OBpEsn8HRpRfoVxjmnRiGD+E7vmFJPLg/MDw+ksjSQpofQ+cO/8B+DVWu1ueaqTHxi/Haoa4RNYMBagQzGRNViSskAjVNsiAC1ifOk4iIqpcmolT76587aH1/gAolpTX8ewHiBFx9btFRxw320VeUoAiA5oA8xGnFUoabjS56MCMDGAE4crpmjNKaRogOjgYbGbaaUGPnou5FwNCa/jHRbcuZcyXC4dZUqKhZT19hnjmGJrnlZRrqJ472tzKrk6qBGLlSTqy5RKiH4/Oj7CUOv5lbhW0KAyNdcTLbbrfVZJ2Q66aLUW8yT+JMG/2biT7f2DHF7+nPkIRVjDv7M6HX5OJXxxptXNulu2PCPd4qTV5hiqtWay3Lu78rBWkZjW7Xp+Fs2naRU5KDn8VOv2C7EuIO2bTKFOIxnyiSl7TzxNjQIQm6WVqx80Y3Pm32RNVTlzNhMN27uLZHOMEzJHm3dPMwgszwVrZCNaT2yLl3X+zRrv96x0jCgnvPJsUsAQtuh2v7uiLP1UHICWvbcwNDV28o1bEFMh/ljRDE30Yq54FlJbrdC2+BhW3JxSyKAXwKs5Gcw9ofV80tp8hwW4ZJSF1xh9MMT38BoVkt+tGU3QOlu/wwLRDNlDOvt30FyMVNfz+9q8F8hdqDzHPrt8NyCFbuNWaMsKiezx6k2e6to2EqFScLqJVKuCx0DQFTwPXr4ZgPwWHvpvB3NAbC6AHVq/0ecfLo/nBh4m/JhIfM4NxPkZwR78VS5vWRTTCRRKYvKcncTXtJvvc9ez05BsEw/stF1y3V9zubRoNEQP0aK/mVQZu81LOGNlVZux18YFXLfBqzo49RibMZuugopm7voZM8Ugt2vr/XdZzUJXbO146UBdmk2i9gKOl0tCiqIvo+SMgFBOjF7mo+gQf9tio4JQieYBddxyBh7vuK5+7YnmgGzCEKivs9KNHU6t0eUYyhu6BHQ15cR8/t65wGKLCJ35epBkVNQOvCkRAfoLz9YCpu+7oXVd+50j5UelcMyPjta9lZTqZpO1rRSFXgiAWBmYEqYzB2JA7XUjLvhyBlBGPsFB0FwQn7+48dA0IT6+1UMSYNRjSok/AxjtXV1K17DquZmKENkdYI6LRy5JMVzU/wp/R1DJS+oOcqQ07BNRjQ1y5y5+dTTGk4WFKgxyJRPJMASlsj9uFo3calUYcyQNCkYybuopChVUxjRrcaBNKwwTeLNLzlGpSpOcDq7+IAZVYUSKyBjPNma7eWLZ6romfX2M6tUGxCujIXuyL17a38PdJST1me7z7/hwmzLSMtDTkl4TrUFzF6LvYm7iWNqX9iC01+L40qiqH9HjGg0gRJF5BCHGpHdOg4kZ82HG2a7EmfY8XV46eTn2IET+PcsmYAuu967T2Frf8Vjca06k/7IaZmMAQ82S1pCDW0qsCNEjlC8aexPhlN8LAg7KjpvhbEtM9lPRt7/KQWaB4qIMPa2UoZzs/PILrTpNH1+1H5gcYUqQ7Azx176tn+fnjIiax/mHDuB/UAcagRLDMyGnZzg1nd7MLN+xEi/pFXqJH+5TuLTjY0NrfExK4oVSbj/07YtRV31jtaJ7HuTkM7PAtFQzqt/Ih7uw+BLaefZ4CIyF+M28McXWlZ11t059gkJQTmD6E2Yj4hn0L2tePhEjlLocDDc7L73/iBoyqDf5+XQvcwBQ0SLkZW8CkR7pTkLplTj5F/Mt+UlODdX3DkSFScrtGCNi4aEu48zFcBNMZn+oZ3ZGzp8Td08OPwPb3W/Oneux18Z6yy8q/HGc59Y9C4joJJs96WO5cueLOCZHF9+pfBNRaWCQ7gjMbl6lziv/InAfld/Z5HcZAd+rZ941TAWwJo7oIDwmLNWLyI6+RYUKAScAcIw3Mop437RE6BP0k4+lexAYfL540OE2RFMfhZGPAnLIyBE9QkHWjFPNQlsfXu0zOiE+2spLKiWNO/u5DYjtc1IDq98xqman5gol+4WsS78AEwKSiG7z6bmihsva62RHBohdE29tjYOwwdK18SOtNnqYY91JExrj45jaPIPXZ8NmtbP8qut2UWjW/0v5j4GTxeCzCoxL5wG+N3mFB5YGEcIZy2sGsBnwkhQFdAuZYubsj/XljTSc1RZLnEE2S4Jo0wuGZvbGwr6XU5dGv2D/4oBEEqkH8i8tdxMCV8LpxyW4Aslij8xcUBs0vd/16++vUyyEtljqbpSzTpAxjut0bk9RdNEzn3kP5TrG6MsW0M6Q3B0eN95TeD86rfqTgetBYUjAwC08pHfupkSJg7f/KeR6ygMyuveAXeE8rmM80LHgT5K+GwYoLF2wSM2J2KQqruzj3EKaJ2c+ffq1D8pO+LIZDPp1fhw4l2yDekprqCD0Gpbx7I0wfBAuwUxNH9h4+HZrIv6uzJ/iXTKiuKUpVCyqTWae2IG8pw/vYNiriRDPGLz7m3NypLlbnP3kCRTwhVm15k52XLr9bEpW/d4FemNiqZXzDm1LP7F3sp1HfGMxJIbWdfUQMLwWPcmHqdiGVN7VSHK/xqo7+ddCud0/xeVZHYuCxq/v6OB+cH4LNNVamTfv/qjV7B9sOfB5ivf/GF8CvUASyqw5vRYUF5JjBKBr1P8pPqRHdt8SnRnKOfmzuBmtGozZg8VQxWTwT0kNnOcxD/XtdWypbBcuRGmimijJrvqYsfmMIY/DafQ3wsa+4CzinA9ivSRNDDrQcARZartUBvtWD940QMyyQdkZdCBFz8rTm9II4ErhWPGlMNJYLX/aTSXVJjdIiF3y2ArlDYN0jJjpOmvGqMFOFOhfcTTWfHxbh3V0HY6PkKa/40rSR7brlSyFsngYK2+gEd30y3TGIOeSL7w2us1ePn4OXZgHL24shmVyl7dP0eRl/cf98odZDMPATJCrQPwM0CTRQbJ3gsCc6cN+7wTMB+Mb0LgIJXXUb2daiW4fJFbx0WbrnNQ+i+8Ko6I/vQoNyqTupluXSbwUQDQjb4/mv4fDD9c4tOgfLwH5p5ml8P5xVLJX01kjpVlbgX2MT47RZQfxAIwq/2Cn2m2laQHdm7ap56MN5nQdPYSeP2GX52xhvIxG8caC2rO3NTrGqq/Dnu/c497h2CAlNAdNoWDOGjPjvKDNDDn66knF8SYh1Q9xz8Kz28Ujf1xqAiHniLK0PIlGincJJmW0c/JJrsQpjkqBIs3lypqtQ+MiYXXbezTqft0nuCClOwcjEAh8kqzLObU+PpXXN6qAO4mAlgTl/grrn4RFT485CFEAUju+HcJUbEZCuTiKWpLG+XREuxM9hgCzIw93tfF///8C8xgPEotMi2/ZJEtoMgAZN94vwuxY8iO0SAWYN6qU8zALVav2srMevapSoSh1bLtAiw/sa441tzhMKsv5wrlDpR6NYbm6IQsT4WJ4mJYDPhJOmVbnDO6ed9MNghTSpWZLDMwuryndT0ezHM1ezNC/ZBGCJrSbC+81LS2ByV3mmx31hXB4LuTPKhdb1BpcXvrpdaVc1qysAsPkgmkcq3iKRqrsdXROHXJGumqHgPlbQOxLtfVOKCav5Er0bALhrSK3tgVY1JEvDKOCCVk+385amqb6VFLG0YXt0XmhT8u9O2zeDbX2nbf/slm5so2JHQfscnsqtR/JGC49f0DjmZ6CJnW2PbJuoRcQE07OS/K31rWAh54DO58yLvo2xzo9vl3Lc31KWMCJ2l8GQ3FflmgEg4zBNLpbbSRvOS3MQKhFGEI+PCIeS/FTsAx+4TPYZchpyVU5Bg8eU3DDTQT0kVAgNRMMim62ifdyJeg0CYHO1+os9EQ2jEX2mJ5fWSmQuwDwcBWzCd1WMDy2aYzzO6J7U/p9jslOG+FK8JnOMhWj1JXWMsoO1Do+0hU8o+6ZymBit2o+hSQXRpYVrcE4L++up5Yj0Q0OH4KERsuOCrlg6kpnMaRUboQTt7L/jZ9mQDI1pnrKf7t3Cy5vbGsoId99tiACFD5tQYeamfcWB+TLMxEgUmolizwEtAi3a1AceEeCyGW3/WoLOI3PbF8WQJyKnZoM6mTzgXnD8/OIuNulyNKvHipsK47gdRfnrGx92dqHzTXwB7RnSZ36+D6aAAcSlWEjIiBzJj8pd6RSp81iU0Eb+gtIoh/6nw6CQft8P11MQmv/bY44hKCmRWgn/H94z2XfH15EHGlm3/WZiBxPYH2k691RIoairQIBLAthXiCrcPMQnWCxeUTrEDHQ09HVWehKwi9dtueofot3qzKq9b5P7YkcC93Z0NGLWG8RsabAk+PDiEqSlFQFPAPXLXiz4vYYlnW0Nl04LXEd/wvd7BP/0Erbyf7uNi0vdpmu86GbTVFx6OEsFqDmX6cp0AuePHNYkiYT9OyfPIUcS5+BgobGIdqyM4YSmfqSwFMaXPsjdF2QkLqaSMU52zGXmgZ87nAH+jIUiwo+N4ii2n08vPcyWmfBebUdxK18kkr621/6jqYmQh/5mzTkrxjWy38rU9qsPeGVlzCXHfX/esOI0UFcAhkrWvAd1gVz5Lznwo8VU8PCYnqI33hTWsSTb7sW0UKl1jviq7a4mJuSjILyr//1/hKRVDSA7+qtrVcPSRfGyG/Zo1NEp5kWRNz1RuYl1q3TP4oLb9QvaUKrNBMtA6JZyRQFqYIeEIKjj1HHUPvaBhwEpIXRX6a3e7/SwPZFeYQ/0Nk2C6w+Bp7hqC6HIfNANVqfJvjUed4v70L1IYyaCEqu+QbA+9lf+lKC+9nhC4O3gsbZAqjO8VKxb3ECCjBt2JkR+0fQDAH5b1/IKyQeFeNgcxYHjmsBvTJ8A1Z3ypjMvgj9+enD1YG98bDla2FvESMNUw/4sHcEP72Puj6vagwNMf7VMerQ1TRFGaTDx6sdAerKZzxsjQ1nVArK7y2PxyFXMUst0TUZtb52VvXrsdCQYjt6JlTPz8AZ7GwMf0ULLzxguHtKE2Y6DMpfVtbwuZuYgIsFivr2NRoKRAf8Loi6xdwARlnJeRUBpyRi8FwYJrdVqToZ/NevhMr1o8lsXDUuwmqTJQL6QBXQrfJw09arYkUiM8qwpb6YM+J5ytoip0b605d1YKTVqXpbpFTnVIEBx3lPNm6dM5G6joW3HF2SgAzOk7nDpqMjev7zuIchMu+8R8ehWlpCRhLMkgTUv0thexOAXhvXpHYL5A0QmCTfY7tFb1k649QL1SuB94ZzL+neD4mUGFjl+dRq4C6Jw+p1RS05oACa4GdKo2f3x+853ql6o/7xKITFp24uLImNRQJ1W+/Btkt1jzhDNcrxrj+BBCm8jTghFP/poPUBfERvY30rzCK5i9ubbgRSCP9JA7rxkAbQ6UybEhFh/36y+0tkUop83ZIBqb5fC2pi3WQRcD0ssiP/LMTXFHjPJZsn7TQDUPg2hFfSdr1nAO2/7s4emobAGLOkTJqpuNAtJUD9h7puYWL7MqMqcOb3dq2KCpayS3lNPTFSG3EovvXDAvHgC3GNen0CS8o9QRV8sywfYJRxJNb6VSqmdfP+ZffD8nd9fnhURLbG1HtPG1xfgD8hjzyeQUbPJO1oKKIewOkQNFU3MLBwd2u6ewQ8B7vOY21+Zfzs6Bnkto7N4E3q+Te8z7d6GNKjcDFj58/i9BTUEpodx8iEak2oeODY2131fGMCPeeehoIgEMZQtI/Oi/wPaARRCKU3MDAjpt0aldOv0orXsOOlHFvHnuColeEFZXcVLaCDSCK79dKfUrzMrBzjlcn+1GNDIfLRRlR+6V/i9PahhzzyE7LAZqiBrcU3lQU+Kyu5aC6AjSkt2ooQ51WhHmOfeNTfYOw1uRJVp9I4ZhOnnt/5mA7aDvd++jwHjc78MHG9O2l7da1xydaiW2zLuf2E5U1uFyPAMiGsHOml/Ix0Jp3xe1JZY9uab0bjE3u4oiF/eUUe7+XP82PrMxWMHxIxUclOG5sivIwWWPDgHyKZoi49/8ovOiMyj3M/NrB7IM3gbX874LgRD+NSqCrmBPD4KL8NMI5eXVHHlg+Aq3Og41DB1J0nZ4F1hI7zllDPizsy1c701DQpjCL1Sf9SOmvCFPc6p8XB6IWEoXwruArFWAQbxD/sAyACxov8Tmbcrtw2piBO9b5ndf4/KPQ7GYGrxT/kFQeRglUZRklOiuNmIxAO/X//2v26tNbX8GQfeDmt11iy7r5XrM8QXvtRjAoF2ZBGdOe/jE4HJ54LsjU70+/C50zVvZ8F8u/slmbzblJLJBWkhm4LKMZTbExG1f4gTMooztnRg9RqHuM1j7B6c4jaX03Rv2G2UW/zv9lDkrcx2ua5lRAo5oB4qNcf0qEREpGsNopX6zp5PW8XpjnOTVEgxmDK7ag74f6MzXfs= + template: + metadata: + creationTimestamp: null + name: servers-auth-server-cafile + namespace: rucio diff --git a/infrastructure/secrets/rucio/ss_servers-auth-server-hostcert.yaml b/infrastructure/secrets/rucio/ss_servers-auth-server-hostcert.yaml new file mode 100644 index 00000000..b0c6051b --- /dev/null +++ b/infrastructure/secrets/rucio/ss_servers-auth-server-hostcert.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: servers-auth-server-hostcert + namespace: rucio +spec: + encryptedData: + hostcert.pem: AgC/o6hAW3PPLnIaDzvruEsptPAG1/5qJ9Rrr5scZrnklfcqGRNJ+24tWJuJx7QxxXzojSnp9W4HkMSiRKaM2m12GEIY3H6o+OI9x/ZL9mjncWciCLMatRq6j3SV2Jobtu8cHoIfdXUkwG+2+1Iasja1s8JB9QIInU+AB29d8xpScVw/gC9ssNy1fugkcarWHrK/ja/h0H69nZ3P4L+oWQgNjDkt41ir9nWGbv63c6T8r7v20kcZFY3DIsT0/bFnEUCr97ugwuHc8cjxK3pymI6KyqWRSvxXYPnEok/Md/IsNKz1meLywfLcPeWU2Ms6Glir5O0/Qkq3C2VdbEBJfZHdaVcY0wGiCsbcf8LCR75tmM1ikfWP7/fJzhF9GQ2wx8ZG02tMYV83J84iq648/pgIT7WcK+DTQUvHoHwYAOGG64bU4bV+trPqq5YkEWvZESSR4c0gi2Mb3IY0SepQ+/ujfQQzBFuBt33KVGSlpjxMMCV3rCx/6sffX8EFENq8SsIt3nYt42QJtoM5JFUZzgrADGo4RU6sgCxfP7IwnhQIPD4+GznTZcdkBQ/fG1y0tRtGebjCp2OUxmEiVWghxuI8YBfOc/dKlj+3ClgvFk0deZljTtYNPRVgXiEe/s118Y9y4lkoUODJ1pbE0gmdBWDbMnSlU8ENPaJl/h6RNLDAZYGqH/GAtUWZbpjoRE54glOxnRfMlt1a2rXYxq99b/njfkvNVpeZ1/yAvojV9zixTca/qmZlu5wxGhwWNJZXLZ3yjGV5E4/LRRn9De656YzPAywaNCym3pa/ovbx66Bv5MnguLOHqKQm0tSvoRaEl9h1TOwW2ixQG/uatujwyv8UOixQNtJkqles5OR1LztMVmpGEeFf4G7l22ZfPOOdurSIi/TC2At3LB2fipV9GcyV27gqP4K4b/W0tbH47xXaTeWjpT0hB4cY89Mk1zhnSv8no+jWvA4LPwPT5s/PX+ZhhlNNsSuRF/NIA2gR8sCan5o6FzGyVIXqsmiiv33j0SY5o8HN5CZ2g9Fxiu9O3aHWqKyuJeLnub7N6/lIeQ4Og4PygefkbEVJhHnwOBNEk0l/D031FA/PKHSdxIiHxRDZXfVaF05n2ztxKRvxMEkOjnBMmQoZLc7n1ZanNZJr8VWnL0Xohx2xhtXAnIotWxv7l1GL59gPvMcInaKwJGU2PuOs502Smqz/aeMvEucQpWiPESbIwA7DTbhxjlifkLWUuv7jM/ParnH9tSctV+SCGWCWw6r7NfU+OOrwS2yxi9LPvJwqi3aR8cnuUNQ/3UxSN5+VA3ury0sxJ3yKiVFOWWbLf9fRhAfzXRVHywIapMXg3wK21OZCxCkNL+dpkIXxvXiEh8IC7g3Xz6U3uQaM+Rwzfj4p8KRzBuxBPj64R7NjY31Ho6hRAoXjUSPw3vgWj4FP6pHIG+psKJZlF8UuRqxmHQGKnluOr1BP35z49ml0dO2A0DP69yR+q9WmzCtmgwg2rJi1Y4Dxc1qqeBtcw0/tdk5o2WEjVXRbC4hijbbLDDx+QkY9Uc9V60yXqv36HQQGVhm7fXg1s0rObgkpCX6jbQ/ohF3bVxr3wIRYQ4mBZPexBLqcDJCnaAC0LHpevrWyhDteI104gdC+HH3VlGKQbh5uaYcdxo5M96Hz5kRbCs/4yrQChx4wI7SblKLeFNImMWG9SgBOYMrzOLMoNjMSIDfFp+XW49fuQ3Qeei5dcBqCvHwsxkqAL2t1NhvBHw3e+7jkwygtiMKeprKFdVl/ojPOcbdUfPgTH6UtYJy66WGOqJYRP7HedhzTkqz+AK1DmfVKZbsj30jr3OF51lJBYssSQrWJlmAB4wB8XyW3rOT+WdHTB0rdr0ifYv94HurX/cM4u1kiIj1ACqSqjlm833WWe9R+K+Wun+a8iQNRQ73omM2CHI40I5eDis44os9lUtR1qp0PJax5KgHv1DUuLbF3UKi+x8A8NBITD3TZTDP69fTZNbEgLk6f9wLT0+S0sj7VIEbYOjhT9zrmIzfeWTISsA0DsVIYN8tCPXlNBDqQmcdh/2aJzqatHypdkRClbz7O56nFsIq7Ug+XU2zNebGQPlNKGA6uJ3NiPD05YwEk5hwINXYX6x/t09Ji/fmPld/aagJgPzxvJhd/MC1qZfWPg7JxiamvtZ21bHpk2HRV8iSmVb8/ZF0uYj65Rc+Z2qdxU+8YQFtO5Uwi5t7S4E372+YEuVXL5octDGFZhLIRLp3I2LObCbQpnSxFQPOIZnh5iprB8V9fivueHSAABUm1oOdyoNLjt0f9r8Kb2RteyY3g9hcJg6GrkTgIa/VEAsLDnUR8syrmHMuozbw/MO1LkLxbeXX+tpd8/b+hmXg14BAMXHoxsAnVt32yZp6NIJzdPWE/3TFOvcl7PO0NLo3iHYA3UjdSsDHWqfsZPDOoM5IXoi9EsfgbcoOedRKImlFGheP/0ymp2DF3zzL/rk+jqQKHAlw2pm2/jeQPEy3n1NZggFJpHL3HhYI6XFW8t9/i211ddjdBHRLaUvvpP4Qv7LcnyO0B0xtq2T4mc1XJaL3pdjzREo8hdDl4BS3T5tzLdRlyFNGHwc2zAe1NV7VYU9eSnD5SmZvFHBrJtmRGOe0FNpm3Vp1DhcgUZgunkgPQ6YIkCQ+TJt0qhOVJnJiZciHCtX7eSn4JJs+pQgOFJcmOfm5fEeGwBqgBvfXroUTFIJ9saq+XOjbuKmvg5rud4Z5XOn9NyVDMhty/iHu/YlyFhR6cBRya4bh/8WiVjSPtRqXhj7LvyeZCmF9uNMa5bslQf/lVQrscX7Lqw6hNBdIp9dFDdFwSTTUF5HYDRpNLs9lrSnp5YtpOnPCWtBrztZB5eft1RcFRKffIFuB69irQBHN6iCyzx5VhUCuQIgtAVLJxqouQmQcDB3gFpP/PV/ErL1JCloOojkYINp4qdC2XkDhWQXLaySBB/y3mu9wBXvFJcEelfkdsdUZyXa2XzMQR+yYKOVQi1htXBpa2CsZo+dAITA+XAaO1xntV0gBItMJg6Ul0KToXLrn0p6UvKzUnuPMwjTNnHiQ+AcctOFX8lEt+4ce+ou70qCUQoQgLsyD6JZbFPIrwskpWggUllCyvKqD4TkO5QH8KPfiMCqQy6Zej1p7bizwWCabPtE3gozUplWel09i+QkU82sGF0A+bxFNj4+tHLMuWjzDWhRB3rfD2iDzs6FFBl9M07sqkhqqytmx8mue3PcXBnWJWCskoH28EjYQpUy55GPU0xtk0DwPLnxkim5yteqa+1WX+6KjggialOQJjO7/7XmvmRq6ikL8/h/LxPlSV86C/QqpIWFWWa7KhZB3JCAfSd6JLRssP6yegUHG+iqRRVP5IHtrFPDojYcDfxr3oT+fc3XHUztd+QN+hVYEkt1H9JqFbhN1tT7JDymxGTkX/xwqKI75eHFqPVuxScKyTvamoTWj1Ia3MsatA9j7ltWmtnvi+WFXQMycScWuanYBv2MFi9rjSMpKn0Q9sStGDxRZVslpoqNagohVZAUdpHkw37dvxmhUPQaJIB+viI3rzuaX9J1/ouXtRhpr7Hjl51L/gh95YU1SHTtVb9G5dVe2b1MAPfM4EmVTqXfbq09/1mJOGs7B8hiRaadSAZli2FEWMas5adrimdufN40Gw9HSFKj0THghaX4wrc6NLyQguztNFauLLILfzK0bTLgoqjHBQ2ZwyC3neFduwWnnmCKOHd+YPSIh65BfLb9JxONCj467D3H4CIyxc9U/3HjF8iffj+kVzoVSHgNvPCGoxRRhZrTin+6umlP9NeV7280f+LOSMm4/trhBgILJzu5hIZDl6eMXFOyYy+5uSZk5074x3CJZD/pqsKoNQjieq2Va384Sma/83AvNJRLtCwF/+4xxpsxrYJs3xMW6eHL5JchqMKPcZjFEFhE+/R3MFWxF7A6pnQj0y8cuSg3k6VXoZUTMLLcT/Sj+CDXrrx5mW27dftVD8mznksZNUzOGLqmr9mYHW5nfPS+6LNct/XwmccWur4QP6SbVtjI/PIJaIfKHcSi/G++QUU6S59rvqjq9h0u75sd4fgZCVzoWcCSlSoz4Ja1r2dZgQxKMvTeuawIC46XPYB0XW6zFxB+HNLoFDOO3/3GUVWCrD5xSRIE6vSm7qiMlM37VtfuAqONEvkKOjk/szs3WwPrvXHmtg+Mxs+psT0kXCAIs068NSWhzx6W0DIpF6az8c3DWdNFI8VNoGKD/T/9LhuGxH/d/yuq2dpG5yBNrZbwf5W95rAEhZuw81K7+kkzQ5TsdmNZ+SS9zrwe6roP4t78NXL/91tCnWGjXhBK80T5zBPfy+FiZCuXi5EqeWjvuykk2FR0E2aeOxbH3eck005Nfg9PSN5qEOaooOKKEXJ+q4KK2dnWVWVKwCy0G8dWJ5Tkb00VNvm/g3fZcE82U3IBNjFZhXYKkq4PkduN1xiSAU/eLdx5VwM3SqRzk1NB3kxLjMuZwh8OvJnentRrk4YFi/rRfznL/xGFgOc0InYnygumaONpxTyJeyjq1cHRUdtF4b9awwOjIgsESb4MMDWq+osx7dGJFr5Sl/myxV+Ej90tMu8lecpymff2h3x0eLCOslvSrlRCjLZ7BXZyfXqunzWuY2isPlCo078zuERYWPH42U+HMkOJwMwOHBd/7vlhekv1JKLoT+lRvbToGaSf21GDW9UQY6aj+PRx8cnbXrr8zBVmia/95BozX6C/oejHPpYsX+Rh+gZ2mCERgzlB2eJRIyo640HYH9VQcR0do6o7nwnJwK8GTj+2gw8+Br24vhQQ== + template: + metadata: + creationTimestamp: null + name: servers-auth-server-hostcert + namespace: rucio diff --git a/infrastructure/secrets/rucio/ss_servers-auth-server-hostkey.yaml b/infrastructure/secrets/rucio/ss_servers-auth-server-hostkey.yaml new file mode 100644 index 00000000..da10039f --- /dev/null +++ b/infrastructure/secrets/rucio/ss_servers-auth-server-hostkey.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: servers-auth-server-hostkey + namespace: rucio +spec: + encryptedData: + hostkey.pem: AgAmChKnTSk9lurvIq5niXMSdJDhSVZs8DXpeov/wYmUJcYVNpUBC3A1pADHk24x5s7f25xF8v+kDBooiDqKm034vBYe/Lm1fEigZVSdTIn6UAy7VOI6StkringgXvlfADxTtq47g8AtZhMUe1+gLof5S8d8VEYTCzcZaM+y86ecf8J60zy5flrRKbCzZL3fyyS3c1e7m0kkaPjNooDu4VjLNSbcwc2Eif543QPpmq0/rVZrKbyOXs+QWV5uFMn+B/JJw0gd3U6tGgZxw24gDJXMlisL0aYhx1ZFPsRJh/lSfD7foeq61+rzpbXwOpctuNVKznt8DW9mSMCO45FMq1vSaEIxtdHPy+49NyeqFNHp7zPaSWo63Z7BXkHGjLxQW7VDjjKlTM1e6moFmywMW0MZegzShF1aI5JVugDby+gjzuWTtgMJYBRpydVtecHejw+k1jyaZWcPXlXj4gZBUE3ptgYIOvMpxDXuPXxF2uphTRsNODO9opH9A35jPPdPkPqy8e0cJ7sH67wQZuGWoUf5YmtrvWVFvp4p6QhnkgT881Vap+rls/6q7ueiPVFAA38vN2anU6eHC0lbSVJQshXtSmoAztM2C5/USy6k8OFML+guXChhthlPUbtoU7bU0HLk0nsV4vpWSUIXwKBVJHGkjr8rpubTaT8IA669lU78LkX+fjHzPgXF5Fkhxn41TfaW/Ln2UCWURM4JMAdzzfz9g+jtQXfK9cLzlBY7qGCZO6kUtKBWWXACf2RA+9RtTqes0BOjIo7hptJrbPjjymMqd7Tl2UIfpmwvb/mTHxMEcx8Yhe7Jh2GEVma2tscYwRmCdUNTgksMQ+gKsaCsKA6t4NmVpuUCJLuhiij8w2/xyMT5tuBdqK8AJp7eql6QkGc/sbxUKCnLo6pggAy0SIl7lGrHuTCSJ0X5pGYXPY8VDPW4Zet1UY3CikTYGTbc9/xQ4dsB+Mqq5wcsf5irC64d7xjiDLdd3zOb5tC/FxH0z1uVkbrzKlK+EOPn/iWxqeaENAysWXVyxBNFye81mXWWqQti08qAAsowp6F+LZEf6QfFz4HTkuLu5rviHLJpR3eTz5VlxEz8CyjMg0XquiPKbmbfjXentzyvwwKunVgrEkSXIokbqZJsu92FdLPK8Nx8Qsu7JCj0LssZFauNGtBFLzwA0lRSa/0j3GNEdsUE63fJBwHWlDng0ORKLq4i2nq6GLeTALJ06AGsrk8GAjQoocXqSu8viiUPYwse/7g6HswBXVA45kd+V+8DDAghhaJ9e9bcZ8V4V2PzF/uWjEIRGXjSoh8hKoIvTuKkti7J2tYjh1KVAAHJkB5VasDna1SN053x0+A76v+uP+tufmIzsmH/l2CtukAP+5jRs2bAK3IV425NQ7dfJ4TRFxHmi3nmZtzYY6Kmwi4dpp/YuYrstBe/+3gT2GNX+pltEyow/vkFpSufgbiPP6ITS61k/Xxh8aVDBliN7MFo5D2ItWwj8JB79TR5FWB7wlsRgKJFmznswmUtyrHnKUDvx5cXOVLsK2/xAjimZ4PisM+n44bbrfcjRCK3nkFqHizdr2rcaJNRPodtAyLn0acXuuC3uSpCDufMYUZ16iu8NNjh+s5NdycZW4eIbHWtuloqBB7rPWtjVeXsvL4l5vQJNqomTFmx0c9wFDhK5Rab2zDmyBXKcjL3LwMtHn+G5TazXbi1D0G6aEQLZS06ea9ebZOoCnpZpMvBTcNijn8yoy4m09GR833KNW5mkiEzw41A/MwSJavvb/8DMMFCCUiW+Zk3L9Haw3MPUDpzgnzyFRRfUOYupX3RvvjAovWuqHBfNpjyMmpBvK5EBWQ4lFXpHnVgBJsNRGHw4zP4snBVk2K388g1rLhVd/K7Qj3W71HqBRnHhVJ27NzqzgblfWtaXv9yYpi3obtkk3hpgAEycH97AdjYeg8ccrdElJmMo8p3rJUouY07qstnztosFP6vJxKJ5QQVAbUDBjZQRUrqvoF5X4JQwUDdWexpOFlpuzXXFQY0nAzYpljdOBgy5tPAejQG3s2k1dOOraAmw0bOVOhWXP7cPl5JKZO/iSTRY6jbhzw5Q48lu4cJJi8woUqF8z95QW/1FukUEzxSqQcT7+wjpWahFA410JhZEWLPmOaukaXKUqBSCPIvGEFCrVz+WI4XZwSAaP5/kDMi40wjGDP/OLVKmB5CNFDcAnW47g6Uti+AwdZmzGforjwCnwQXcy4WCMMWLPCe0PYqWa1b685nKZt0tqNBf3JRpwGV5nAdQwz1af117XiGr1E4zv2Vy5LimE9euJIqVQ4V4qh7PDcTophv1etVUy2cjHg0GJiVkvELTLVoRTHI+XbFRyJXOzQBe3DXpAPwnwVbMxJ02j/VIrOdDhbPSv38wG1CQ17gXJbP1iV5WCSjS53cBu+/pOR0ZBBM/IVTRwCuf21MBpV43Q5OaN7HT/+xawSpptyxnk8A4RKBczRAJIjC19brqSRbg0DbXiAmz56ZDJzxv8zQ5wPFksJBHR0e263jOcKzg+gWuCDCdLEoZGIFehKBy5PbzOHKj/qgMP1NmePFbZ9DhNQuRgrmnJClIooMMQGM0pTQOVLjEfLMSgwUkjB/X0oqWtkpkDG485FqV6uWioQCWBr/dJR3GH6n8ILMOJ9Y3Hzzlg/GbtMyW51QdwcBtw1Jv+cCapcNm5IG5g0cPhCYdyay39ajRCJ1MIp5eoS7SsxZnsYGQSB0e2q+vh7i63pxznjtw1NxTzH/6aGpZlXa0RH6s7TnUbtdRxRi8PG57MVUgwydfPD9ck8dfBs6pPFMrITzA4iHuAR8emIJR4WeyeV9BU6WfS6iFqG+MUorRFCMTX9UDjGOtYxo8bEi5LnhMtZBwXp5H6aiKQVe4KNGwrcLNbIZ5r8iedOYaoPCwBgNl/ONnrzV4bRF0ux7KQdPDO+VmXx0oIv2k3QK0XAu8LuqxJdS/61h1HqDrSOAEht+WWn9oN3RCna5LA3ptEnrCO5u6Y+rf2LE/5Y3jvo85c/7V5cAlyqYjd9C/1Lw9XycgcIdA0cdY6Eo5naLZn/8TXi2hqfJhQ1NpnjgOXAGwV4NaqsZ9OKwfeE/Qq23hXp7xz4xStINPws9cFKNf1kFgidFUXrq + template: + metadata: + creationTimestamp: null + name: servers-auth-server-hostkey + namespace: rucio diff --git a/infrastructure/secrets/rucio/ss_servers-server-cafile.yaml b/infrastructure/secrets/rucio/ss_servers-server-cafile.yaml new file mode 100644 index 00000000..fb197168 --- /dev/null +++ b/infrastructure/secrets/rucio/ss_servers-server-cafile.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: servers-server-cafile + namespace: rucio +spec: + encryptedData: + ca.pem: AgBWB9AMRVXao/FnW+BhayuIW/iUdWf3Xiuy3AQYZaqJg3bPNKCjdZuQGDAY22Bt07gpc8dOCEvGx4PrzrV5W2pf/Y5R+V5T3akTKu8zkNSe/QUzzr1gJU9m0Tnd0foTs7DXvipJOIksR3i7A4SV2su8MixIPJiYgpRKAZZEPtSUU4WzfSHmBXmcACvYsntTF3NHYcZuNZWfeiXzOt6sKQMZcfFDioLQL+qE4J3UCRsWUUYghpPTWwhuYVlfQNNjiM6U2EC1WfoyGh6i29O6a/+6WAK/bby1aSHD2bkaggg/mB+7VxurHjjpn+SAqwogFC10PoClClXpENhFgzaZqfsQu84NXwbZAjz7fVphAkecrhPdx5egayo+jYwY9IBxq2obUp3fmqbNAM4kUME+GDmn4snBQ8ZJQlQPfj903u4r1AweYFd66XrbA7FoAcOqPv4DvVvsBJfHmgFZnWLuhXap1inUQD1aWfbGDQWWhuA5P2qysWTVB3/Sc1r600/EXh+lXUBWrBC3/JyqjKDZACZAruUGf7GXzFGZ514LXqKhPMBVqIF+DeaKLpX/Ef75oSmh3wbXw4NPjLjIv8LQbPgT6xxmqWcCZZJiTq3jUCRR93z4Q8YVQ4HU1KpSQJ6P6b0tpWXmHX4yYioXSoA8gJbcwdrgNV7OVZEp9nB7SdIVeWwgRhHMr21SjLk+yTUF4kD4YlIseZo8mqqVnp3Wtk5Ej1EktEks8wznrBSPkO0X53u2hzxIofmcTH7/43TDlbnEg2iyBM6vCEao/FD83hh6GCyn6Ju6f1B8d4MoVFi8gNXBguH6zzGWGd3YW7Qld5PZNV391BXjOs1f4Gr31SbD/y3ihCTqdKikywW/pi8F6+8UnX4fcZEq2AG/I+zAO6S29WRn9uA6L0WoBwVEQW/YGsIxNF+VW9rgcdlWRQ9O4zzbryog1XEwkb2dNw+q0L5QRc9L12ImsDzbIj0dCOF2IDAUmP4muD7zpYjVE1eXOvZr8LleAZbODCOt8jLP0WcJ60KjtLn+/JrC8qxN3kqCqaQ6ZEBcv423unPeEjb2r5ockchrMO4lT2CBjej0SiEKIWZEgLcGVrRxvKloh40Rf4pjyohLIKJA8BFGaQ943LMWNoQmwQw9dd0VKdaQK0iHimF5uTdKOxZerLWbKsMs6zusZ9Vf+AAvFJYnRC1Ws+avS+FkoAqoUPs80t7fsLQm3dqtWgYtri31+3HYlwsYPXIo0U26HKxMj2A6lIJD0RtdtQfRJ3W2DPtAG1QT3Cq95T7phQgSQhQRaffMn71/CPHEeZ9G2X2l9McANPq/K0fkb6AJaj3Fkyn7EoWfpUfORS6ROsqQ5ONQspE1CLHkHkgxBcUNAGIPKLxIsG1qz4pLFG3tapH+6Q60ByuGSiX4KA97mHrW7zeHz3Qg+GH7715XLQyZVBrYvwAb6dIPmAOIb2c+Ys7UdTPQErA5UUoHPZWhoaF0+nvq8b+MKb52uyN1JCEWmdUTUixGhq1+nTleTF9gaeVlUrd7oInxe+p9kuFtAZB9KBOhSMtapH1o5mCNHbOBwFRX2wtq30+q7NGUr6qzLp2kO5kulALC6k2yWMlvLt8D2JVi2DUI+JnpXjujtkoSEt/0zY9wv7TnawQYAhj3EfQIMCih/iqyTepVtF5UC6OwD+RT8Dhtyh8GRIw6rv5ypnoLy/e58hBF/163DzwhAb9H0mUJvm8q25BFTPpLfzwZq/Iu8pbeesqstS9rO32pn/WGbFqvxPOgNgHM84PQDYnvrQ2ZdywfShg7ZMBJukiVFoF/Ho3KHyq/ohynDaWSYqJhGC5rAjhCDT/LtdP1+QxRA5drnG2ZZU0D/2FOzyKKJ5t7V1wPs5/dS2n3i5D3Pc+lIa7dNacqUq3ruNfLGhhF1g3qBxZ7ysYX3MsE18tVvbSIK89GfVznmyWHS9H9sDTNwfKt+rhLPaaoUS9uRMut+X3quq5DMu7ywBFkgL0bVt/o00XVpwwl7WCzim2LUljyrZCsORogFHIEPYqD8N8Eh9Ly8sLtG4NEiNCQ+5psboOwcF5eOuK6yWzuA6rugPFTMDrzq7GsBTOXe8V+XlffIaLMPXEOb1lIwc2xRRGCNUDWpPm75uXfT0H3noJZjDBsk7DoeqTollBvc/mTuSVCTTYqhXFAefAErD3MQwxWuD1G0petKODC5UdbG6LxGvdN1dDw82E6YeJzNtVKLlGeycY0nvswp5+Fma19m+fyvBVJPO6ky2ycwFZam7rG84joOQw5kWo21ik1zdnSlTZ1ILGvfqlM6lsEd00hhrTxMLmFfidV3T3sFTzhYwlWpPFk4cgON+WmCdl+LUJG64deHbFY+Te7Xku0e8Bd/DZzBdx2nMB7g07plWYcccou1KI4UvinoC693UjU2r57fc+hD5nFyh05QMXlwkhfU+HqFdPNXRt8pgGr90Se89YzxpSRsGIsIyvds6lQRplQ0Y8MxMinL6hStRecNUAYXcPl7HWkKE1yOvxHu9KHhrP11yOHXYL6VMQu6j1bknAI6RVVFmpxzKOmZNKYV1a1cm+DPquY2VdUzvM8PT9dF2IE47doBPpgfZsHpMcA2gk4vrTfaVPs+zpH5mCGoRsaRcOwVoedQD9omt0cY9H9lySnEnxPSgs44SkzbvNY3sjB4PDC9ZQYHZnaIJmTX5AJlZs4+Tw8c1E36d3t4pOHQupMVxuNiJm1JOOjJ1LUtlc15WTGCpyNbdAGu44WpW5F/mKrVFQA4uRLUZCN+NLc0zFwDFiO2ZmCr2CdfUxkZJynjd7ttNfYKGsqbvXcvRazu2OIRy2tGCViTPlr1dxeWLCe1qm7s+Pv3zK7nPW/8goYWGB7DcFxr0A3M1PfwC2d0G2QwlE38M2dAgvqjp0OqFuM+gcY45VPPxPgWcSPUwqfhgOOWA+AsII0BaiFdTTmBXH+sb218kqiPnmuZfLExpdRaC7pzCSsB53SViVRCW08gYPSfnOOI/mECNl9fpkWYDyIeApb8tITFDceeNqsGMAwZmzNIw72H0VNklObgoadvQekS9Zr3BIj8l/d1WEp1in3nm945qRkZRfVH3llaGxEch1FvjGr56xKVkeHGC45fnOPY3/VuCzNmGFgj1KN50/o4VV7is4ZnCuHG9AzwE5VoCcJBMY7bqYJqdGUP/EG2U/7YDv/YPAINVPFJQgZ5zkwxDhWoQRYXrZ+LDvi93gYGDOUP94Z+PMCIbV2ufYFFgl+fLVhGMBsxP5wEDF9Bb1Srll0IGi9Tg3xTLrQHKh0Jat3Gi1b4hIiX1Nf95hFQSXuDZtZKc25O9JpxRd0OwAYGLH3volXrtURpYQgvPcy04tHP5XJkvKT/5MGSXdMJJFkjetNX6+9Xia3AC1bemA+cPZrB0LxzwYGw6+yXdYtZxZCpN1NpzqSjl+a/IXQDD75+LFVdQAAznTJv3E/C7RQ8BelMVo5T/smikWZ4nFsxMQ3LXoEy3Me+/OH2gTZ1w9PiwHQFXkU49HOK2Y1glPlMzwX08MIPojAKdtZBjUMPuT7qMLg0ZlQaYTvVrguSzJDja6OFOvNwd807NN/acI233rvnu+MjCcSxV9qKcGda69E/dU+gwVoGciwnaTEqsw2izPCad9XExB/9avejocL8J4LYlGJ+u1T/ISznDChKNKCswZ0D+pcyXp0PZTdN+fUlPvGrnj4+D8PDVe4CfKx0WSzFq3D6BZoNp1Xrz9GU3KrchStP2JRYlG3IxtzgsRRGxHaWZ2VvOwagV7hyyOeroLBShlqcnYUtMLAtx1zx5eXU9CpIaWA+vfxPaH1LI34C1XyOy74sAUI7wEutL83YryqjZy8xlnJtHqhIZiae9vEex4wOMuXU2DVtxQjkhsUWMDPuYv403k3Q7SdLrI745sPLj+A1rZibS/s+FkmOdA3PzYQ59/UvEYovNGWaohYuIKubsqUfo59LHxiJZTcptKUnudvuA9dD+7tecmtYUUN+sNtowAoLMpY9WbUN5crlBTJ2FJAqZ/f0/r0OfevqOKEksLuX21anvb2j0JXdCLN9VwFUwHcBOj8SnfNo6w855c8gjfNSpMDGdFS3S7U461LOepgbhVVNCg4EJCrYRMcHfuzvYxgqPXL1+tnTA3JIylgmC5PkU3urx08i5/xuNlItIRtyTnmRY73o8mkMeuLoM8PidqoEd66mZ4oyfqkR9r2jfi29gv8uw5El8iG4uFywqr5hXKVxn+BW0dGTJQ+K/R3O+UZw3SVlnGyAm3rXc1kfqHUk0eNiEXeoxQLKF8OXRk5a2wmejDWWFQc0naZNl1xNGIlR6kFnzj6GZtIZJHytUAkZApjqitRLGSOaI2pqLoyd4sY1RfRDv47rCi/5joMAu4r5eUWhiwTYUV9VqLPNJVsythrMP70Jo5PS34P9a4cy00PhlCZhDiU+Gyh02FvDNuBfJT2CVWEZr7Wjt+lVuWk8SQFqP0Tq4LNxtwLldYeBo/3/D/Abc7TX2++sbUb3ip1lf7YKaOOrj764UqlFPRKNP66BvdmSR4P2SZT244+E8BW48AKeRqy5S6XQbvoZWZLjTmP19ma1qAUEJqQHLctvtOW55/mTdXtvCzPHB1jJWm3F7yScFcAorZVpHIvvgFWV+xlSvOpM41INSt+0gmZCLSxXIuSHKNhvZiVd5kp+yJyXKDNR1rBYQaAXwhk/QlVDAp1Bhvy2mH+YfqPctuPXFoRwr/kE+o7cgQNUgolJbuDHKAzo/e+fO/66iOJ7+BoCCcd8ipSjwsAzMuBgcY0bIEg4wau0AssPTjjkUaOGD875NdR01MJU6/gpKpQiFvIEJuGKVIojFgMvOWf/OxwowVHj/H2ATeCzA9FpmiD0FP2rdFWZc01DQ7SEfuWnyBDnq19K6EOXjZEqgpEMfWio3nGt8bnvP8WmGGpdb6/yLbCytjAQJOvNRdn0Rq0gaZ8s1qHxs2ylIzjOKhjvvo4I4edCeUm1hszbG3HueSgnSS0+FSJl6hsrC/gJh6OjqMSl3m9olZvkMpf8Mk1LBu1QEDv1uZzEwi5JIMIfm2g/wOlI3tSpxcPuHxbK5n0Lz9z36OcQdsfk3yq1o4aJV8ul9mZWki+1jyk8OGeQX+H0lMaZgPu5uSWXQ+T8VcLdj8COkfxjZZKOxEOMoWBj3MtBGH9Uw8KBYnHhFp9RcpMggEkQJwQtAexJads6/xrfZ6jDY4xGS1nRQAP6GfB88/EI1SVaC+PtYlLWH9+mkxvxrwuVQQ+KOLMCTiOriFB2y240uo7Ds4228Hurkr11FCPtcgDXoD6qW0ISN1hV85rz76MgXSmBE/DQczSEgA8iKB4LwENYXDclz83SHDP0pfFu/4M3yu7FIwAVQy4eAqRqBlw2zHLJywXbINxyy/feGroyls0EHrh+Xot98j6cs0yg+edcfFbF7mJG+4XIqd5ym2fyQGgxEooOoHNLeslU+DW/SSFf2LWWYoJnH72HxnAm1F7BuK9ISBNuAXdGL1RTxnbFDgfArKPhpyKl6lYxgmQcq6H8AWD2wX8HK+bOkJktRTS9EQthAAD5oLXJTrX78616lPi7I+oPN1zpDSi41Au/7xHXnNluMfaognGIkIndOemJqMTmO7U5yIoKpbWGUHbu6hywMPGGejjuqN46ed5Hj1WhNskHyU3fxutYtagkINLnZ8AuXdOq0MEfszxLhje4D+65Wb6VFqSdYBkQGGX9Y3SWgFuSXBOS/sQ/AM6tkE977bRvgZ4lnRomQbEjScIF7xEVY8yP4/35xIeaylVGoy7xY29EsLKQ/qfn6zyXUMmUrlJnifnYBE+8/kCXjfgnABQ69Of3KuydNMBY+WDxFH44rD7a82aQODioyA3d/8eujZ7mbQTUFPXuA/QOOgRsWlrEmuQoVBacCzrjCU6oIh58lqlUKJ5dkmVPKQTZ0tGOGGO3YW69I2jXuEmzQGX+cSo18l3cNq67aH0jIJbu/9pF5Q1NZRZj/RFjMFr+4v7spcLdrxLsxo0vfu+AZk8RBk50z/MCBmRdbqS9g1hMsHhto+LVdtcyZwtT0k1J96FxGCh2uRaqYqCmJkYMbEwpjlzLaS6ABMDdtOUWs3VrD31u9sz4dkHw2+8IrOqjQdbBugsBJgwGTkkWVe29yimRXlDDa06VsWz42++GyWwN3xI0u4ANAJrLGIHD2PF3RB686Vv6mBRL5ujP63i/igoFNnyUo0FRAPtFaUmIquDxfdtdNAt8YhkiDaYUToMH2+Jg69J1HuCcykagaGrX+T8gkmCtlaxjVdCmr0y5YZ/XTbOHZuQno4/8A2SDqh50vWhzqJYrap/xuIa8sLi2Jpwm9/RWK7xXatgvDYVMcsBSP1PXZAR2SuQuyH8nbEPKHplD71Hwr4V7+BLIn9aeB42aUCzghjI0LbeKylUysPab+GllU2HhfnjypMdSCHNISlA1MJaq/MwNwS+Iz9Hq14oHcZoLwHMqbg3k7CPD+efyo3YFr057n0qtXecZlSi/zSWT8C8XCsObVL5YFz40K9FtxVMGbpm/kMQ/tt6jOWudIVMbYN/BleAtV79lcI/MrWVhqL9jh3MVeTQkCZSzhUOS3CL+g6m4IeY4NqQdDtd3Z6230D5wlOIvVOn5XrOHMwu+O/yHH+FZ+IXU7CyeEDpJBUVHLULiDevDLu9WlZy9sQyZ2dAwtxG6a168sCl0LlvVAr+IzmxZfFcxz/7IaNbEL033fCDY7g/pE+8fN5fBJ7oGwUou4MaAmZ+vzUUom5P1uEkooPhqRn3IOxAcV4Hg5638OjSHz9APCs2b4v5tCaXpcfUaKmvgRJlQDJVzqDo8Ovnm62MISHiEacrbn9Gw7Dl/S0l1tePEVLi7l5QlxVeDaCr9BPUBX6L2I3KdfXHgp+okHhCedLJtR8ysYLqOVQpNfLQG9Mw8kGCdgTuwJrGqFCFBsJFbbb4k/u3zBijORh9Dj/SldBjCvXRIEFBdPFSl6s7IvXVhgF5uvS2AZdFZ9O2+SPIyiMgb8WlUW5ae3I2LJ7cEFYpUj3JLFVlh5qLijULFQvjf1e7loBu+PwzoSLerghBPMYEahzKoYGY8PX5V+Pt/NX5i6PRRrThd+EvU1lNPsjq/VY8nGhPTWIHXeG4gUMlkSiaY9fSEQsZDfX7et6pZ5KrXFqBtCmvfeKpsN5izsbv0YTNo//f8Q6VLb4c/MAY+C/OASz/1CmSfQE/nJBKRvIM2IqKotKk5WZCRT/qHZLdRcdOnCABYie0dB1Pvr1NH5EBEWGo3PApcuUG+6Pc1Rcv2UNV+gplXY7i3yjLjSGBwLYiW/qoSdmVDSNUnYJEK7r7BlfaaNf14qU7j9l1NFR+aZrqE+87vcjxZRvi+RPpYm6XKimdPVrQldFKKyRa6n1LqB2RvrnkyOrkIgRKRrX8jqrhnHlhm9J+CC+rTpYhXCssYWbnwwvOVX5s8bWPgXdNZJZt8SEN84JreqPKDu1QqRBqfNwHrC95gzozw0thkdRaxJ8H1XBD89Hlnk2zKK0fnZ5kUebDped0GxeXfoqpL+ANPOsuUiQ7yy7rcaQ0gCzH/kkeN7M8G9gB9k+QhwQAtsNl5INLGYT2V54QJgkazjvfBUis9RCD96xPBFQC1HmgYn6n4hiwsuZK84I4wJhRbK8v7ZoiLlo6cw+wsBzXNyVGkOJSC8BOrutx5QZGYSlitCIdlog2EhryalbQaDuCVYrqUGO9KzGKt+XDOvYJYHMtovT1gWUHU4B6Xs0Gl0LJxLqKRm5WtR70DeIRJav1xAUm5+4aJne5k3RVKOuG5IdFf5AaTalH7wSxHFQo/kM6Sx3DiAIlKFLCmIcYENS1v5Lr7JyYckCDAlY8fnN6UY2hKbKSKmNROQBz3QDPh/xTEmrTLTcOAqm36JCIqe7fG6DOLEp8hOzWw532D1sBdcpeX0XZ/B5EdYovS5xFq+VQkmvNbNHg9Wf/+WPNYyYbHzEqPzUFok70sa53h6YYmm8DvJhsJT5KIHXkxXEZ+Zg1E/BuFzIy+2XJ31XIG9Psa4KB6l7tSvA1urXZrPbyysMzLGExaieslUrpi+mMc1GyiBawV2FkkutZrJ+AUaEix5l4xYe8yMKT4Bk74Vmbe6exHYpqE+EdQoHYl+Hcs39iNGBJ7bshgugyIVIjm3DwobrtFQ5tFO05mka6mC07T0o/mnYt4HeIbSVukGMimuk+RdjuItgidayrf0ZHHEaLE59BiQrSnWBx4mg/90xbN0fXlJ+NFYrK9VC5HejdHvq3NEMPFTpf1L3oc+ZkYvTxABNxw3KFldKZLLl4P5YEZlzz+bZSrlPX09uFnCvDj4WuadTJ8mrewlhHSRjrF2l2j2BqECMnfiMSdTfil8eUleZHy7FJ65K1i6x0UPbs1ljyl2papqSbGr2iAba5GiM6ykX3B8cUzFO9bSg/Rn3r0KzqcaYxvDCQfpFJnyz2sfvkorZHas1O5Lta9DQL1MvDK3pqLLQmpMByS97qzJIipzmCdX6SYrs3vV/FYZg1Np4jFGO77MTBpDYQ3xTFzaZlDAlNEqv4NTAkgOXnhMfj0EDRc+sqUNGgxRy7esPRfjlgniscj4/PFmejLjcgSiYhXJPO6FnononAKVkudbPJVeiarRANYlYlr53tT1VxaVQcVMaT0C80ljGZCKCTG8oDV74boxkBp+rHKVWjExIbvCZGhQSfOTifZHzYyM8TvG69tg1GjgaUbIHWPaENUN4NgOQLCUZPccvjVk1OGh0oDpaliGMrxfBSXt/07hZD5fnesK6TFw3/nDCLaczLKONOEEp7gHWysmAnz9iGqle6ctm7FLCLDWw7tb83WFydXMbn0mVauEWGNcL/mbrFgP5z5UuW7lnR9lRjhVfVCviF58p1iM5K90TUwBKoGiJpYL81V8CQJEWIB0x9gyjdEGGuJW8oVgQ9dufq0ZuQ0PScNrladr+N3IXGN/5nUGw/E+RXjAcBZ1JQ+yFDC9FJ5TnAQbdeYMMjWOfRWAwfpx3PTHB/bGrbFzU+W+Bu77Xg7DdCDLAfMcfk03crO0sXvquH+vgDPK5K5uUyIsXLmzap9gVRCeh+usUcZmYAD5yMxgw31cTU9kVIA6+O9cirJS9Qu0QoP7O26pykfNFKFWplAJxmXsTUWJoTFIVKiWwQlZzERn5Ox1KbQTzjUjde3mEAwcclnkneEimO9xrFZ7FYts095josco0hHQmc8nYdnM3c36mCA1KCjHQT46QqZw8bEQwW+rHyojnBDSRhz6TWhzY9uz6ltA1zcWF2nv4+7HjKSV4QoeGWN6z4y/FGoc0Fx1f47ES1EJdy+46Tz1uVUngS+CJPzDpb7oIsenYA57YdkO/iP7W3/5seAdEHYdxlpyM5eu5MMXW2L+ouO/BvF6lw3Lki3sI8b5+WbCDnBNkRakZN21Vds0CRNFX1jYp88J8IO2jCq+Syd+eDgOy1ktOSi+E5dmkfyi7e7yYLIvuiL41nlYXRApcYvFekC8ewfowRr+jB6+x7g2sjEkfQmrkhU+Psz1vPiWi9OI9wKXwIvyLoUt/LC6UolnpLuG5ty1Zq5z7ATOhObac2q28i95yL3LR354LIZB41wY1sBXqEBR+s7LQ6KbYcMNad9dmpxnnSzLqOLF955sZwXRHO40pwt3DJLHZZK8869Z9pKz+WHGxq9XjMqLttvvh4EIwOE3FC24vAw+sB9GnLo1C9YMRjn7Gj00I/tsrcO2BMLTSHal7LKdYXAxpGUhdFdUrs9ek1WM5Z64Hfz01s6xOtJ7wsccn0z0QHSh/SJLXCopztd9Ow0eu4/OiPVK8JER86vTwO0x+MoK6kinqssKo5Rs1+oTQMnhbWW0f+b5cs50fxe6pyRmRMCl52RrHH+EePF+jv4TNNQE/OLj9PVmCdeJ5jnpKO3P9G3dpGGdEOoEHFhvJ5HXEgi7fmiwMEpqjdwqlHohq4/2IEz04FpDiG/GrlAXvelv8RWc7HP9Du7oJJAEkqBAXygLOu88MQWIA+PzZa+phYiJG5CkYkaDM08IqQqZfI3t2FVK6xXBYmGKOdWCnyZEWXYpT8NjPTjITNBLJGD8IMThpN8Cbp/JXiQOD+A/e5xkRRfysDXAe8W8iDpkfebbljnJxO6zVUYqS4OdcD+tKet+icZe/5QBRnTZ4sfcp1YQMu9T8Oep07EdylJIZHvVNOp3E3WYutkY30YBUH8c2Q6rCq9Kd7Gyn+ikgo0lfq6gDwJhmTQ7QutbgbczeGYzPHbMlzwto0J7qVoZNj6jzArtKqAGVbH9gcvWklg/VZGrFDQK2R2jBJ49du56/198hGS8iSGjD+M/bdOmJQ16PDk/WAJrymtIKYCxHkuJvG0TRu++pc3S2K2wlo6zXLQ+OCGna2mJbqUz+mtiiyKorkbFLxDu4wbIcapTQPywIlJXdfdzPFQN1LXpREoZ7a5OjnWV2flf2uRp4ayNFdKyqWBlBdOfy/zr9PXk51Vh5ZGrxMSkl9O7jFl36MAaV935aQ/ZrXVdz125a9VQc41A037FMBjRAgKJPyZEZ3djEcWrMYTMsGl0s65bKQBIzn1kElPcYcXY+/e+QIehFvAn5j+ybuBVx5vlRFPb7zqNTgsSKjel8eCPaxtFEmEml0jm/2ct0m/3uEMYlWDiWku8b9Nd9kCNVvjNGelMJzxt5vpQR61aaPDgWD0UwsJdLZbBWGmxj9NImAQJAYMx+4TslYdMpORrg8YYeX0BaX1Vr4qyeKL2o2wCVA0xpIkTmDvFsdxVc99aq+iFk17/ez/AcQRAQjBl61vzHoDJaj2l+p7Fz0P6i4/nu50uYES+X8Yaf8tgx9yjhWTuymxXPd8jiK7G3PJ/gLB9AOKIuw2QdTuwl0BZkT2PNfF7Pglb6IH6SUluq2kg7R7OOkqh4s3cLRLPMrfC6qHK7G/4PUmTooU5vCptcBAc54A3BSrsKqjvMytX5LDzWV2Z6lhE9GVNDGCGJotbNXW7/ZFxljJjq/H0Z3npdzWh/zO3slWb9UcnFeJ5XXVAkC0+FNJJyH4grOvJId874v2aI3LPDMeV9N0cbvbepoCCofAXe3eCeus3FnJNu3bagebfY7kEKb8WkRIeCd9opL6n7U+/LCoWJtVzY90gIuWsWCg/TgqdOZxD3I0qDWiwiEgZ9IezLrT8Dxc4o91bP61YfvufW0JqVQkciOQGmOybwnNm/CpIx1cHpyC6W9mfM5C7FEeSkfcqmNFLXiVeyA3Dq3pWIKfoiqTdihTIx02/SV8zWYK6/cphSnzqPHSk8vHSS/cdIqsTDk6O+DGmV0YYnDKinIA6H2MMyYsphLZxIlyjleKz7inzJpVWasELQ4hx17eNlXC+1EnE3fJcbv/BAEDOQw3VDyJveF++DGaNr1yjn71ei4q2/ixUgEPKviVEgciUBfC7HlFPxJrfBzGZGtT+yu22/Z4lS1yvJOq3hsETWe1bmZSjAqXAbREikraoGL4VIDQZzDPjd0Mq+/o5yQk5LEn3EsVOwHBjPN2f0jGjlj/IQjt4+HvR8k1FNS5FmmUSQwGLIW7eUY9498k+hMCE9q3YW87QcytmyPDNv4ftpfii3PfmNMtULdssFL72pdWy9q3Ay5TLZy0wSFfBTKRxQCXlcBY9ybHqlVC++yP+hFb7IIF3hBhfcidecaN33EguyY83gKMm9mUY17nBJCnRZ01C8qBo6mLg0PYDfprPFzOsttxO1hss8k+Fop0s7NRc2XcFFIW4WsP6X/mDci6iLfwhxCIqh2EINuB0U0ayyyeg6pquujRKFqMb+04rJvhE3A0WS1p4aYmInm4ljk7r+CXq/zAFH+5w0jataROJIwamHpSzqLI9hLEK6yjkGpTyjbfuAgLvuS2NNRWHlB/BwLG23bW/s6zO3RvzljpXk3GE94BECJBE3kxBdd6A0ekTptaUdyKLZ6HpV6TS1fGhUTuU7EHhJBNc0Q1cydb5O5S0TMl/NpLlaegFJGKzmbjyZgP3GT2EeIdkals6gFq6BHDAzsFjj7u0bogf9BX66Ayj+P4TCOccbHmDTBjcisCDEhRkNu8RJNyt/RuJZqGhsMjiiWXwEXzmjGz/a0MQnlN5eeF8XCfg0nkaru1yvHGjaFllghq/oBzUmPND79NzwQeJwzIOStx7GB5UcAlijtF4OXCYWqfOW4wsj0RIdK1PQ3rKN1CDZCIJVf9vA0TGi2W6Vmqa8roxKCvd0g60mOBJ6LHbJapKJhhfEzBOoRd726I4I7ZfWbS/MagaX36VMjenMh+u3gfOYZ+zNY7x/5gQWZeNZIiqK1xQ8j1eZm4f9sE++6vRzcdwp/W/KfDVZK9SqoJc3EmR77/9bEUpLeBsjdKYGkHUijMw5sq3yxGp4YALq77U1s7/zTIMxhAGt4XnYbkKtSmkJjcUjMWAfNwmXVywJAnMX+J3wuDsCBR5yoi98Tq4P843bTEBIl9zSzYv8W+GRLXuKTyD+72gBHey3YrCcYngl/GSu74u+V2ZPuhSZfYl7fgMDQphgU0M5IRD4X+4oPHYIN+VimkzAO8M2hMQApyqtDPGvqhNcs26463vVWQ7pCPhWB4RNdKx9o5Q7KDqUBdVb32Qb67NPnKDMMPI0L06Vh138uhJrGupEMAb23+pOSnQpvofNEdhUo9qgYt1abzXq+ct/+9HhLMPgOg3c09zP4ihu5fHO8g3wZHVJkahvSrld2OwgNZQJareoQMZnyJmSq6sa721yXcpXl17Xh8zz8rmx2eSfSXXwEJ7nQaEgEHUDCZ0UBOANGJiN7jurqs22BSvRUkbxZJM+vvNrhoaPM72FPCVsQRBFOX7e71N2d+hyVQCgdxvZTRNpHIpIx07mw1zU5UG92WI9L2Ei/4R4UN+YTDRkS0tZbIq+rFjTqQjCx/ABNUtlk+5CL0OFzcLw3V3uD5kD4++fpJTAO7c8RpZ35CSSfsDE3n4mfUxIEIpwznTR0dlu7iBGmcnFv+PA6hH4d6Hc3CVlH0wlUMYb3Iw/V0vBj0f1cbqlM1jT2cO6E2R0conSs3GRJ2RKfgOtyyHN+hfq/X4pNgznE1ilgJxfEuYooQuwOkCfMgoPT5SugC47R6j4U1sb73yIqACpnmm01hTYKAaMNDpBnX0z5RopGPXSh4fbyMOQWYPJiF+6wnVkCg9PBZWxGpipf51wAMHMkfAlthCa/W55VHmDKnmJ3zPunwcsAHs3YAdtzJaVKqRZv0gmewlQ2h/0Brx2Iac0oBm0bbyYq5QWThXFWOo4VrERo/fmdTGL/weWzp4OJrnNQ8cXWGI6rPQt/s8fBp2bOCCamw+M8M+IOtYWskvPGH1q+UgdC0ORF4gYJ7j/QnxXqLp3xrgDd3Cd2TllowRu1CPgrcMk2ot5o1MfOhugJ+nsv0cUBmBTdDJFAwMjX3Ypbm87SH3PDlABxmBImTEOJUOeaEEJWDvPMWVAsayWaAALVY6vLRLtj6nJmC6cF4zIDz/YoYTpA8s/jFNjzeDQ0QpcqK4T/yHBrGR6ladTGoPW+zQinRXUroNV7vrAbeuuxpPmpbTpG0w2tzhBxcDEOWoVQordDhB0zpytYl4XN4AKMlxztVpJ/GTiuMlDyWiNpuKHTJ9cvpWic1CKjVKJetgicMMku17mMXJ0RL1w05bJpwb/roSnrdsKzrHT7ulevD1+tjnuxTceAkoonl1oXiFLC3PKkeivaT85XeWlQ7Qob3E1E0FHBEzlPwaQAwK+cfP2vx8rCNWF4nZS75go4/jMFjqVvY5xD82snlSRFRaZXu1OmiedNgvrzcCB2rvAtFILdNrJca3Zf8YT2nwWwpssdsYkZG9BnTHuvDIMYIRl5IQRN+GNxXBUgXZTdxNr2edA/VXvyppumdKh+A5iMrgd3YefIV2AXaiHr3Xdg4CqFzWZRc6N3SzhAQMsUQ4I6brtbmzHV2ga+WivNeVMqZrZJkfKXCMhdiIfAL4zNARwVUxLgvDnqYvkDSqX5qBNNc0o0rHZhhrfwVARH2dZJcjV4Ok0kqzOSVzzHpwef2I04wvU4BodMWKiaWNB5brxI5WJ8bW4z/N2Q5lAgXzeoRpLoYbLHt6gRegHpT6cl8Q8be07x4hT90vR46WFNYl3SwRDnfNnCJQwt4M+oP1uejuarMrbu1esagecM/pS2fj/8YEa9PNc1hpq7+Dm/gd96b4KrN3rr9QPTG+Yzj/zEi3EjeGK5GUiLGQ8nRpk9ErmYj+efpKRkMXgN6rbz/V57GA0r0TPCxxgNAEXJ9EuyHzgEW6p9iW8JMGXwKQt7ZHojWNWcC3lLXWWO/ogzuVEsWlkcCzS52HYcsfGVc6zJiUjT5F5JhAQHRzXcBlKp1sSH0Lk4eLpZOimK8lKcoPgJESavjPgFgJuRlpM2WzuFfja1NDFUCGwzDncRDDv0LVjPYjiOjp/DFSaCV8lXb35SByKqqCbcbcMx+oPpkXPaO1PweEPAFLG2wuXaD33XA4NUT/+u/O5KoWZE87HicrPOahbzWmLa6LYiKPKGFeL1Qh92e87QLg+1zHTQcNTXMpmGV28LA/cdh+BbtC2+UZuAmZD79hIIbZlM0oPTNa5BuJNyWlcNTzpNw8I9vKvyynygPEX+7hwsnCNBIBiy6l18x1kXsjA= + template: + metadata: + creationTimestamp: null + name: servers-server-cafile + namespace: rucio diff --git a/infrastructure/secrets/rucio/ss_servers-server-gridca.yaml b/infrastructure/secrets/rucio/ss_servers-server-gridca.yaml new file mode 100644 index 00000000..6de4e39b --- /dev/null +++ b/infrastructure/secrets/rucio/ss_servers-server-gridca.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: servers-server-gridca + namespace: rucio +spec: + encryptedData: + CERN-GridCA.pem: AgAT+LNnYpdKlQDnwq8dg981sLbwcxTHSQGWEawMX2o0jOy65yBiDKtot0ZhxFbjpLybnPTvFtZdxvydYS7dEV2xJzo/EEKnv1HRY9AakEin3ob1ChVH7td9ZgsrNQeoiYhmLeTRonTV33w74YITopopEPmpieR6OY+8q7iudrYojcUHKm6MFoNOmws4HUHCAy+Hvq4kK7qq1Eg17l0X4nYx4gnjR+lgQCxbzex0GNgrTtjsnunblZFafGAkmvlab179AMYbHxsblac9Bpc6ORWrhBRshifcNrReG4qG5JIK1UJ3DMtNhEH4QfTUHoDb/Au4XM4g46MDp4lGeMI5di+9GsHlzD2GpWLA5ulMVM9en1f6X6iwy6e+5k4kwt8x7XLkNUXydGnqbQaM8L+WMibzlUZjhsKx2s/F+c2Eg2dg27fePrH/usLP0oTx0eeOhGKyjUsCdFdGnG3Kn2AgM5IFj/YT3D3HoAPfAfoxycUtBj53i/3eOqfBXSoR61SnsNePXK/kGDvhTMg/3WIh99Q6DajIuCKR5Bx0hJACWMTxTh40Tlc7ZSkwNtWJFzdSWXkYIy5T/IVJoZ1OIrwOctKztq7B4ZTEnT9WJwTjRvHHmSRktoe2KW7EoH9+JIquZOb86XvYt/DbR/wRpShEAJpxMndpyTSgKP6HJuYtzuLXt0owI1pYwo/29+Nq9qS06V/8Win2S85jOtR1m8dpX6MBqAm5QGQUhqHl98xyT6EwNYp+dqRn3WVFTLil/91GHmyUrqaf8uk8vGjafXbmRl8+iAdVPFnyRn2GBVfsZ0Ar98Flanc/LgarJg8rMzXom4hSOUeNRdnby514GGrnxC+rIQ0RnHWdlEps0vmCaGjrHJxSa4W+xMiC6irNAbLbFAI8UECEEKRMCuFTQmkiuqEdl1uFDaN8yV7IpA7P0uQ/Dn8NmWS0H9/hNqBlrldUwrCxc3lU0VI74yIQTY6vWySIjdCtX4ePLX+BkxAUG8PdHDVIMIDAUWf/8/ZI6ukn/9niSPmHTRh6ljnVHfSEMPN+lAP2fTKhS/nmUFRiR/TSPD8R9k7liwjoai7IJ0QPmGibEyWFQorKA+uI//h690lG7hL20LtNNe1/VMklsKdB6bJMBOmFnOBjo5E7vq0nCQOuchRgmvgbgEhgpwiKb++1uKzLjZG/MnZVbrR0emlDT+L/pF46GlfdYpabYpSM3n+bPboU71rkrcpq9/1groudY5wXHAgHTi/W9sloppdtGsFv+mBSdU0KI/7LcRwvBMEzqNIwmCqZ7umLDlaiYC8eq1B5HUiPTqqxwxjUAjgedlZjdoUxyjTxmhZkiyOUaXhdN4ww+/ppaZme2S8C2OG5PMbSBss6iJSOjDREeqkWFGgeF5iw/mjGRxP06v5NA4ZfFvtQwkHrCK1DJsmW5ynvfSe4VYvyyNa/TmRZOxGD1SlZY65qEx4okLyviycIIK+j8DV4E8BB8g1sH/TNKEZf0bo9QAnDUAcRi2aLnHfvBpjnywInpvCWYRcVH+cz6mk99tUUXn+rcv6UNipyacLbU2v0vs87NbYZTqht/z5EH6DlGv0Wb2owU4xqL0+Xu30hMOMqgHu5DJh7lIL17dCGx2Xl1LJcahAjjr1kmFWRBrUKHL4Y3lm6tGizhQyxfnUpd2pYDavvNYZfo3KduinR1cU5Db3115cE1AgFo/tezUOs+1G7YGQ8rlwHywtCp41l0r8x1LlEHWmk8H8zbJNSGghwaEbgRgFJWg+f5tz7lU1PizhnyV3CBu9T92W5w17Z4oVSQLWQX6dhsBh13YSeY/lgGb1P2CQhgJ6GqJ4JfpMYogkjB9wBj042CQnYnyvLMmRHI5q195EawQ/izKr1P4+TugsihTgANtJN5g+M8J0qEVbDYJ+yLxRmITj4zubzkEIdiq5tADVkc0o6eALXASBd+LES2lMhT+uqERUhfKthK6Ekf+ryWWPnwr8qJTmCQpWJKh6Oyrdcs42F39pg9jzx/iwsjgtsAB6Bjaw+adVy6sip/Kqd7vOHI/OLrriCC0ve9ehvOAU/xVmeQ76e9tpszTzOBIVHqNxl79UoECNaPZAHusbhKAt3dTSpALijF/fBW6Lone27XWu8DneQXGoHwuw1XwmpZvNETEY3GWMihh0WjmIQWM37JhjCmDOQw8Y1QxmSj/fHu40JPZ1ADZlcdl7UkJXsNkHMdiqnqZzlD7t3stBtEKtZAs1Yd00oBHwEEja6n9H1eftFpfDUey8QvBZEkQ9i2Q/aOfnXlN63S0n5MgBJZOIP6yuEcRZlWXZXtQLyRs6JL015UX7UTBAkHoqeIjdCCFzbr1mGN4/Aasa1OBdRXnJ9IAXS2zsb0NXNDJgl55TZf2peyoDYGtjzk7LP0ia6WSQWUbhyUsQE09eR3k2mMM0Pu/C1HV2bJ9D2vh9cHjIh9iByj4EHzvmkzz5dkthtqAGkRZDokoXvDlwIBqArZSuGC8PowUTu0fA9sJNAAom9nsA5Of5Ranh8dNLHwnK8UFLV9/w1vnB+J6pvC6+f4oAbQnvauW3/YUmGkkbHcC8ZIP7LpubhsL4CMQTvV8T5c2qM1tYG82v9IBnJ83ZMrXaWaDjSCJnvOiOrnPnlL7gsyLn89BeKfhwsGBdCp0/WMQobgn0+M8ulFRwYlUGdTUciCT96c4674c3VJzq8GXPOgJGUzBXJL5Pv2BahhzAY1SP0y7d+7abgOre2K26aejMGiwc0FjAlbUMhsOLuCFxpnT14SMNhVkcTE2+tc9T42XNRcVwE3gSJ62HN2nrqqvjyFj8K+EDKVDJyl9pV/61OnnBu8jYYxtOwpM+VPdK3n6xsU75OwXOJ0ACCjlsX2iluIHbFaz8YqVU5HQ1njmKuZPzLqpCAqBWCcadsOofr3Oa2LYJxdXTSs2zfn4jbAGDNe08dIzBiPYyhvZoItpIWhFSD4ZEZHS7olXFjgXDHuBK79sRhL28+h4aTlY9tRHLBl+Lo2CyV6inQLphoerYKw/mbw8kIEdbzwZtRmC4P63/eKV1C7Y1zix9PZZNCOIuCjH8c5/s6anGQepyUWatGdIlUYfcOEy6MmZzw1+XOg7Te0VwYyk/807jXlH2sds2nQF//7LJ4ZD4+ZcJnyVSHFYy6rS/YD5qjwzh/6SUUjVd+kV4vVcKLLpn17NRxlYAHz6zOFIWornMvR9ws17aQb6DlcJXRn9PSUUvaw+vQuafp33tMZvfktlRXEdDsj8thjcJ3RVfaKKD3XFLdXQaCutYscw13eW13k8x2EmL5HRm8O2djYkDd8Ld7zYd/fRqLZgOmSLVh3voLU2S+LBizozMDYlbJA5zckPpsByJPp9NcBZhWMtmmjDKj3WnKWidDPviLS+ij5sa0PKNl4JY1z/eLHl1kFpvqtB+YFf83O2n4D44AFb1KDUI7fj874cHa9wnIylDoHRHWu4ll98Owv33qZD+OkNpAfK3BXZm0mI+qjhw3ZyLILe9HomalegyDjDD5KJsnILppJdNbW3TtiRhZR4hfOOA2f2xhAp/pj8UZbQiwYe4C5nKLbSbItBSiGCgfCSjHkZ2FkHmeGFZX6bFcJVAezdnpRSz0zDWxh+Nx+6DPwn6ja2gTiiHv7Fn/VcZfvQfdGKtV8dGY9fx4eNGvPEBcxc6NEp3STRVeSiwrSNNen6Qn7izyubVN5M638QMJIoRUNO0ZSZr9XRnTq10JvES50D9iR6eHQJTxRtixUHbpTTtouDjnp2YZKzFx9I6muaiDCT0hDKijKE+0ufX9ya+Q3GNdSBTeW9b2VqRq3ZDrw0YeUZczrSQkyqAd+kG5K7Q2zVM8i1uDizXG2ETRPVAXXLhwvegyIsiB54ia7+kMNxyUjOZT+0Owkrj3sdj7ptGiS+cTX8Qd0iQX0JNaf5BnRBbMqZVISMRtF+oBfyg+iXTQ3G9Hslz/5VRVNeXg+QwpG10wjf0Q1ZJiCpU5EjwrJuKrY36DkqC9zoZlsF2NZlZ/nkUgDsTc5QX0tDHWdzt+TRl+g+g7VCI/8+O/1YuzWOI+vwi8w4/+QLEQ2gIiHNcUtchKIVFO7kFs0lnNdky4AcxfPSditmMJf8DqIdkEcRn8vKhxREdw5CB+2mfIcyGLCxt0F/f3tTQfbUxUL7To991HhqsIXpXHHc7v0qammw7xeLrxDLIkwKglzzV9wrAdQxnke0panI0E4df2EtCXd2zs6N2+VvpCd+GD9L74BtR6YqH33HfiHQ/qV2RdclwzmjtOJ7djaFSJRRwZLjx1W6Pl4AU4QsBNJxYkljLXeDnkRX86DZskuiI7VqaFb7xvPBNLhQfU5CLppc6nhMp8YlpicAokDxNWZm2fBVORsRi2N3H1sArVNgfzKt+pmkvzKupedfhgPxLKkROnWrfpTWcNcbWEPBysGLYmmamoHHQdwe1pdSK0q4gO6tDtMUQRfzFrzGiNs4f2AXxF5BkpiQdVxMILIqs+TrcIddRR3uCJltvVz36DPVGXL4L9qkUtj/pbBXgZTANMtiOTxuFonc7rXfoPe8/5seZM5VAGBdUqLcmYYJ6qRTlJHDIEHSfckCyXKcuzAUstimT8AyTud4GzFyjM9D4VsSxAu2bPzUY5ahemUfvBOrZqsktYL9fhEPuPyjfgLM2VMyVgkx3q6GBp9Muz3H+in5gIvx1gYyReBHadUjkyvu6nXrkSoHkUDAnoTCsszyWm9RGPPcRIBd1WpDWK4SBoxK2wFcyJyHfWiIn3j79m7DAlQMEw1pJJ1mkILEMMKBexyA+XRt0izkrDT0o3+A3upM3nhfN2Ja89sNJZB1fq4i9HYKMj+aUNau4FKdcS28kVkTn7QFJpkjuIop7lBC2LDunsE4Eg670Nua6Qb0QfTSrscGOaj9hujtzTiymhSBCjafiV6ndsrP+/3tFiZufRIkWTAw74pDjVAELB5NeZ731N7ij7tVqC3Sf6CebpgNoOuKkO/Ke/jwAWiYxrPu6KtV1O5dKN8gxk07zFMmrhvexuC+I6PUkCOdNKu0fckmHLlgpoH7UFst1veUpAmFv+ROJERofumrq1EbJYuwldPNRbRlTsIea7q0AGMZa+1d5NDex9SP+GUZ4DVTiNjwM7/D9zuzaRc8EDwYGTaE/LRuwuZoJaied0hlWzR92TFFZHeRPoafc/R8IqAhwdwaP6ZtMl0qZB6Npd2/8FzC2nCtLPYvQHslhC + template: + metadata: + creationTimestamp: null + name: servers-server-gridca + namespace: rucio diff --git a/infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml b/infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml new file mode 100644 index 00000000..264774d6 --- /dev/null +++ b/infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: servers-server-hostcert + namespace: rucio +spec: + encryptedData: + hostcert.pem: AgC9qKIwt3YRo/zhoYdrljkIxs8ONn/CxyYgjAKyQh+hy8rlWZppxQ9QD8iYdJVTOOfYiM5cfROhJcZbJq9ySHKs1vSQ+KERFCROd0ylPMlcvK96jcBgOO9abF8LI5qXvySMaDhgO1mWKnIAqaWG0FVW+BH1On5HVDdn37o1mcYeOSwl1g9HLUzv4ZlIU++jEC7XdiZYq33MdZ0ksbVEsILPPy245I09u+DEdRUiUrH5Z9AAlBMMW5IUffNMRPMoITzFvu+UbT1/66QVtFbgW7gheoWTMBAuL0AretDBAUzQaDfYvLdBayyg5n4pir0vOMP2AQR+RXIpMNfsfyyiTPs5RPecblha9s1OuB+WwCfv3GKFc6Dcoj1JzcAF5GBeSOQFqEEsiFPNyqysE/y1EdwdxmINbGj3HGHM84mU01VraYcykcCdTruC1mTJqg3gJ91eKtCOCG2yh6nWL0BbgMdhCedH6X9ckLGeosmd6qEat+joGrJgob0rrd6rJ+CNFb4XuvZF4Pi6ZQHpHEQlqHKG+kVT+ZCwWgy1D7KdrZLYjExvfezEtyCMv4CbS4h4QolO9DYS8XnPvTGu7OjGHKmvlxNsrkwq7T1ODf3tFmdsNI5MpFunIpPJYd2vs/qGKUfKIPcXG+/13lRwoA5mJKo9GS3O5QJKfAgtc51iQErQ6pdEFxGbqsLtAcTddu7a2tpeokqHrSGXa0tRvLvCzECBfAi9gfLBAhXV2FAQlSNb2P0sJzGZRS3nr0gnjAtgDfanOB+2tHpHeGeb5VzA6vUu6raaRMdtPEUFbbf/20jsuUNjEM/3JCTQTBjz8K8EXEmC7oPpr/yBUm9yEz3qxdXsaWFV1WC0QX/xubdjmR0AQX9y1wNvhg/3dkS7kD1mU6IFyltV/PqFVI2VQrOQf42vJ5ZcXovPCsBr/E/OiCUeS9Ndj4vsIZuOj2fdBoNWUES/Dd7SacFmvQrq41TT+ta3tiUE08MmHbXBuEGgoX2XsVVvhBd87t1QzDR+PChlg7Z2KallnqQA/onHCHLqtDiPf2Uyiee04AYZdFX/n7/zr6vVZwiGvge8DCturK5AGltjmNG3a8rW+ZqmBijfcZGTCfwjQJRc5fT6NYrdg48NjO+2yCLRpvQLGyef9azWjXYNwN0zYX6yvOgX2nd3upuZGxNTGHXR920K1gdI3T2SnyiD99UDhuxy+Zhg9BwX6WYBXTA6qDB1E9ZikwD0oDz/+ska+1IilCcdxNRkHqFltoX4BdGR4pkeoimWOFPfh74I23Nbr/VA4u/mi43ypmYbscvyN8tF48HbGGf46secf0J2hRTVWmkfpGqPneChkchzgKNppQOF08AHRAEUf3dajvZ1zJvluxKskXTlKgoaHGsV6ZKwBn58WcSanZtGuXRVK2gIphZot/dOs6VFQk7jWBm2mCX+gjPR1vMUBhJpBePLqgRlSHPregwlBKV8mjDM7ZrZY7aJWuhWtroTE8KVLko8AW5AMOpNxcw58mB0wUrKBi9NdDYv7rt7TOwFGYjB3SWUtN/crU/o2MiBS+paHmXf78zZ5mVcVJSLgd3FHCWP3nV07OuesOgCYpc8ZeGzOW9QtQIbN1peDYG9gaeqBhENU86aeGTsnaHYICV0hNNDrXoUyduluwAEQRlPL/eOXFCl1vlw1MIzzfLAkL7LbGCrC8Vc92+rs4wWw/b6txzE/Pi240I6fKXVgNIX9TXypyjDrZ16Ce3ICuDpw9AeBixB+yJnea4KZyPogVKez9f/aJINn7V50W+/vofcETm7+4CWU9BlaFMFTe0NjXRTtYAfcQVoj5N47IdOHxsXxkoTpbxn0LYFgAiz+9u9THczd527wNLADn8H/o5PDsx/jP3q2EjY4s8Sp35MOB54nsvzYymSuGK3n7DOFlwGeyCkUP9Ut/eIbKxqnOeWgBND6T5QWYkhTL7164+AmkIft5lleRDq4ABltpR7a3Zjs+PhtA+dFYgzSgfJvIplomEsrhW5n7iH0rgMu8bid5zoXXA24cuoT/JTzHvMZHzYHqYmsxdbT7KmNr7yl0wPIvKQy7sAE+dyhNDhxakFhmLT/TuBu4G0RKbHkkKxJH1DjYgXr+f3lkYwbAE2Ns6ZJNzRlFJie6xachHSyMehOAAj+09RSc4YMC8zfqOj+BhQfmIXZ/6ZDvT2uWo5NAL4GAVI2hCU1akZlaftt/apRBeiJ+KE1xBBsX5oCfMr/rUFhKX4vHNFC+iMqwKD13Rmkw2IkXBiBvq3/XrvZX/anbXbk6NWTSsx6tKpFOt6HKiRdmGRhvZ2TmugRhNj0XEMhZse4yo5ZygLgKxLn5MfO+Mcx+ihIXXqH14S3stG9emOCprViHkzDZUlFkFQl6jCm7K/0+7hQZmk6vQdiatDEu0TsEr16i6ECNJaMtr+6AG9EIir2G+j/bd6ROOtOG0Jn7l+UkHmZAoWZRHOED6pqhScNsWIN3v5QaZIRmNmk/XGVoPDo8tz+haeDIN4RUFJ967e3Cd04QSxSPanVyMYynsqpzsDzBeivqQREGwwhrZ6EbX4/iLrIfsZWuBos97H+84PSKlb505HmLlyDWO9p7Diw/vF8egk3KtblCpmfVYCuRmgPA3XbQ0Nasr41vHS2lnAsiWl55fz/WGcDIvVlmEd88UFdceDBQrt9XyxrTHRsjmNN540OmK8g2HFXfOHzd/DJqSV/6jTsLQlCSsOfxXU5Bvtv64iZvJ5cgoaFwa49xolJyyWYpnlGEJWeupC2wgOQzSyTxT0W42HN+v83SlKtUBEMI3ovqOWI5wZcALItd4UeucPusnMEdtEp7+NuuKekOiF7GP6TpX54Auwfv8gkSCTXoUHY19joMVhxfyUj4VELqj525UI6RFdzL2Kg07lyBXe1PSH+GdZg4RvMkuQJxUZ4F13/Z/OLyfvOzoZkVcQLNsi4eyuSXsZSLvnggRvkvH3G0yHE7DIBJcQRYTHskncvYfJMuoW0lsSDKjeHst48hD6iGrm0Z1FRHlt11prWOwN2gV1FB8UXx/2n+9BMfXvLg7EfnX0WL10G/oC/QrbF5D6iEAw8JuMhLAFxsj96+tJtd0woSbVpcMOvk9c+bkzxDUZoh+VDT6a7pGoUc9NFXnREqOdf0p8jM7btv4lA1gzv0YpNoz6jeW1IyhagFJ3JKg9PYcjeDn313G0EiNg2W5H85n3tdzRkQ3VcBG1ggImcdQnVF6QZSpNmBuDLABS8g9XHOACBflhSDheG12m87DsZKcVU+6bGRMORzLzl60VUvJme9BudQFtpahCulQAL+jA43u7c/gVsvcBV6OEdF0aB2rLLHKffIlGI/i1Nq63W+Vd2eZHJCSah1et2RIhTkb842qZkwtFCbisgOOXIDYeJ028mffIJC7hKfcle6hIQ6gn1Kb2zlnxCM1pjxJn1bYBgkdjaaVfZ5xksky7FWFS+RQ1G0U3L/8rW5YQsXsOHjcTg4WjQKlaD0uCk6z2a6r1AzYLhR7J1skzZmgPfJWAqomo62qPkQ4j+II9TlFvkDlQF4+R+AHLgh3HW2D/kLFxmr4Yguys5pDIHq+X1EIhcy4qXoIa+NQzBKixs3LWG0BJjPQFbO4T02bg8hvMGwzcT11/xAVRlgGmGpORJtF9Ut++hTyAeGNlaNlb9fbCr5irNlXsEBkK8DYiU4X7X6QU35vVV0ZRKrIsrErh6SF9JHKhSRbO5yxD+FyMgyZFeYyRtxrlv8Bsm9aeezm+V4xeDWN7uGqV1Msr1uP5U23eoatOs5LZX4Bxdy/enXjid445QV8wZuuXbvghKALH+BvZwqPRq61I79dkax7WcUUvNAuqqAW1lPUvqPYqvOkdaDnKfaw/ZPt8iYom66CFqPisZkfwa5BfPPXmuRP69h155FoueSPD9cZniilR3gEn5BlLenCFoj2+JkWWm7buiTGW7OHc08U8OA8kzavo8Fe9M91vO9X9zJgrgSXfki+DAb4PnBiyOyl4ET+1OPZBFsG0qcy95VJHkutbkTVxqfZiapTqphMMPbi/F0l+pVk+2U75rrso/1xS6FilndL3GL+JsIuIAIOnd50MB6FnXFG7+PHqwvgrjua3KGAOB6Z1W2DhVGrZT+EVMUag8WpVjbyvTjdYwgzO6jw+YfZTU4yNTF1RSm8tz0izTH0g4KInBRBr+l7nhHQimgwC1xMtfprd1nGEVDRg0Wi+hQ9G8QqKevLLgSmOjEZ0ONjSDB92XdCL0fKoxjd91stMYNVppsx13qeL9qDphLoyO18mME/z0tOtyqXz5z7/yczK5vWhFpJRyqQ7zoEqmwaJsD5w9QAZkOMr/IKrQ65wKkDapfJjjqGtS6giorWoRFZhBI2fqzGmKRImJkLf2X40hdS+eArVqFsldgkvAC/AimcMLgFxmAi4MO7K5iZbZMEMbZRnntqKoNIM8r0LU6IZAnDzO8tsTQ168Mn5v+a5Iid6LBGhvn/fwcT4vPXm+grJpgtF1liYRg/S7PCoNIVz2LK100mvN0hea4Gl5gn0UTztTrrkQ9YCgILMsEzHERyAjjv2StJHV0awjGg1sueoDCsqlRCAgnSoVofT8jIsQ+K+aLwp6/UIa1A0n3QEvEXstpwGSmGmBchziREfJ+P0DAjcRyPQVZ8bv9lvkLJ8b4hmoWSahi48UHvsA0pBsraQssmOlqtIcjoyXR7vazwifwSZJ/ZTUnmoZJtNC38KLAAscwuwP6lCXRsso2YTNuffy4MyuKocWzrybQHu6wikeaKVCZzfLamyX2L4lg== + template: + metadata: + creationTimestamp: null + name: servers-server-hostcert + namespace: rucio diff --git a/infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml b/infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml new file mode 100644 index 00000000..eace5e06 --- /dev/null +++ b/infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: servers-server-hostkey + namespace: rucio +spec: + encryptedData: + hostkey.pem: AgBgC1d5QWEK2Rib0eKFm17XBcgTrOsuaJpEMhYal8al1TpU8nGOMBPDENOhjE9QTuwF9+WSw85+FywlaCQl/fQZBdMoqYBkdWK0KOJqVGbOkCy8GPFWLzv30V4b8YuEizzvG2k0CrbMStZw0VLXRpT0KXwSEumKd0eMzKVc04KdlHz4aDi+00qEWus7N1z/1AlvbipoGvaEqdnMKB1W8jC7K13Ok5WUd/npKWl6H66W5u817Z3LOrYI7sK1VA7kwMbR3HaVazqY6VZQ4yqTwo9sYGDNZ38t2yQI4AHaqSrrPnRNQvpYGuMRXjrI37zaLgIZnitAEKmu6DyPutAHvQogRmpV56UuR7kj9yZlp8jL4sxWFlUfqxj4zw722SU1peWOzyLLRQh6E7C6cVwi0yd9BHaz5In3PkUyuN7kPWCFhjHcNRZ5uDtHI0chOW0fG+Osq0kZYNdCKBeaTBiVnvtHAmCEjzdKHd0D8XmIiFFGu4CJHWTI4jwCoAzTUSL2e9HCluiTjZDNOPbAG1lVAMCtmqVPWPLZalqORQwXlCQ+hbVAQi+GOp60D+5YyPnOVk+McU7C/9y1JeVSndq7S+CoT6gTivtfsFxWkZQqa2PFcmeUbiP2hP0CYCSb3HPmK1fm/pu8br5XFZxQc1Cr18/Q0wT7QMJZR5ETX2K3IOI5mFsWT3bSLG6CNE5ysH5u8x7wDexzLz0EU+LelGAKafTm4cEsh5rzta9CGDGR6dvMVLhBLGjoGbxrUXsBfh36slhUIXlvUMRp/vFTkm8jLNbMwKrXNIMYZj1l2CV89jpYRdDtbA6Xa+xDft1aJ7q5p+YjI54K5OeflgJUbUA5eOJ2fnehLnc7sBvKghV80Sifspt4c+OZ7GJbezlvktaf4QxIrA/L+LGA8JUy9lzbnbj+nTKSSxk2x5kWLwKRaPLzgCns3kMjOcUrFzzz1FRKkj16wCg4mukA9PkOREjLmyXIhmGt96vTWB87FFwyToVZ9IIw7FQdTIbIfXqTasGAu6jEPVd5M25DM2jwJN+00vHdL/E1jtB9fYTFrMZU9PE5XgMf5IP4+66h0CW5aQbIWqAVUj6l0jkUXyCK1CFk1POzVNh30CMd9wpgDoPGAcFfiCk8aHPzGFCmpH4doP5SNRwBJ2GrdOP5vVz9q7pfZcJ/rgxG8bsAmP1jhhyd+YWeXL/rtVJYN+iL8x/NZ1RjDFLj5J/RbVwPNCRZqvvEqHD4F84BSf2efn0Xn/FTEaMzEXzOjqBtgBw7Dk+PhEpjyVmRsUct9i0OajsvFBilyTpGaDxhS4pb1xSC22+sgSVR1teCK8f07AQj9jmLI80NL5yLrePLfa67R0mh4NCyTzLc6+v0QB0eHfR3NTmqbRa0TNZyIBmTztj1DzcRYS7qrDo29ZklqB0vmesOhrQQExQ1rbz9KWaxxDJf+qvGtIzYu3j17iPGvVgtaB/5aHqnTe/h0iP1wm5V1dph33CXeBYEfX3z7prA4in19eDVI9rh67RdQTcSbrLfKyCkeE8mM7M/4B5V8l+Rp0zqx7ojXFdXsVQ23GjpbkC0QfHc7lOvEwmUk8EDoPVqb3uPNfwUI8hPpl3ucz1AfChGocG/ybkpw6YUBm1xxZt6VZqQWtIaaaQ6fU3jB09uJk0PFAep9UH3q5RozmKq9MW7hMEWj63rijurBjlLWzC/uzrm7RdXzWTKlIEgfv/u8ZXB2bElkLIFdlTx7Ravp2jYSqE6kwZddVryvzwwNIiNBFKPDPSnyifrdXfvKgZCAfpoLAdA4P7LwRrTHl7UnJ77wBszhC03p2QvSuky9NkHU5MAex5ORBt9JBBohvAaH0/hIElo7tWCVkGcj29+YDCoSvWKUpmMeviJsCI1Suc020PU2zAd0r3BzSC8eSM4edW1K1gpCpk12qbXSVJwaoNYCgq+wiSWrGI7zsLC+DcYvw9POXnPnSQFW8AwPP4Gj4PF/g6E4mPIz504AgumdQHZG1J6vH9P7TyGTUYid+5lxbrL+VIyHoVa3v1YqGMqrgGENkq9Y0Wz4zyJ4nvN5bh//53nqR+51f/3B4IqRzXMFbzpO77sPrpc9/D3ZCSPnF4nd1Hi8k1nZCMQSA1ov73G810dnmf755+8bz13xqJuiHdCCdbV13nK1SWzBT+WjekZtesUHOyAC2SfCZcDcIbcQlITvb6LNkNDSGLA/JjmqcqwS7OUvNHATkb+bVub60N8sOG7jahR33bFGjMtbzqXoiYAV2GlMShe7Sfz93GHR1B8xa4Y/XWOojurzvzYtJwSVkspGK6JXNkpIpvpyMIX71//9dmQ6lmTvq2Lh7Pmdqpxk9eAA+4wuegSREcFjXK6pX2+E3YzcE6Ska3I182YveBVyb6uIsg017V/t2z0yqBNiEYw6jcPhRNR0nUdeCntw6EY7uZ4uh1+ytbhJAPyyOT3RFmNwzmw5ghP+AWYa111i+JXtwK6YMJGK3n6KvPXyQGLzgQwQ36BRixfNm1ii46itoWc+tYzFIcBTSFw5BkZVED0U3pxMyF+cl7W7kiJti1NPcQoVSYVNkxkK3PS1qO10INWSGl00RL0/4y6m9UjY0zaO5cpaWw1iSmNmw3xfwW3mz0v12pVGZZszXkFr/PIgVsIN5X2c8673eRVi3QI33JfH0o6xjs+O2UCF7r9m0BlDvVOgi1ykEiKxcwFs/m09BV3o3KY32R9HoA30U7OkWrv9R9v/UhNlZ3J7th3PjiTv0WhjFQZdhYJjmZWZdCLxCFff/6AafZDB8LZiRhLk/GuPc8vRywykdECJXJGB2EHdwZTLto/ZUR9ThbhVwcmd/57QoteW1o9oa3f9s934fHSm3xxR9DbVL72VpVI4cBMAfIHhB8G0qdqtr3+YdCv0weO+hEjenTfui2T1CrwitYxRUNuzTZBOrGJu+TKqg/jnnqof73ATv6vF5rKHlpLeCN+eBWgfDMx/MhZlB+eaZeib6YRooVJ6jndEx4cXyanYA4q2DYItVmZ81Y9eJ4tuUS/xdGLJ3kFyVUgSbFEv9AIP90PCX5J6bgTlzffdZ9g0/YrEVdUnJcHFTSNcAPS8Igd0uXs7e4cukwOABe2KaxnTA2bJrZlqz4jjfyetL83tW1PTCmx + template: + metadata: + creationTimestamp: null + name: servers-server-hostkey + namespace: rucio From ebd4f08bb60f417d15889c43a1e427d191fdbfbf Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Tue, 6 Aug 2024 14:31:01 +0200 Subject: [PATCH 65/69] re applay secrets --- infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml | 2 +- .../secrets/rucio/ss_servers-auth-server-hostcert.yaml | 2 +- .../secrets/rucio/ss_servers-auth-server-hostkey.yaml | 2 +- infrastructure/secrets/rucio/ss_servers-server-cafile.yaml | 2 +- infrastructure/secrets/rucio/ss_servers-server-gridca.yaml | 2 +- infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml | 2 +- infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml b/infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml index 959f13a6..75b58069 100644 --- a/infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml +++ b/infrastructure/secrets/rucio/ss_servers-auth-server-cafile.yaml @@ -7,7 +7,7 @@ metadata: namespace: rucio spec: encryptedData: - ca.pem: AgAcde770m75GX5Rdz1Zs+kqOaFhlVEyU3jzEBTZFfcUDqMSM7Z3ixnxmBT1Xux/nHSGGwF5gU1B4oB9NlJFZ81blcYtOoxn2g8BxRBoJqfye6mdo8zLAjiAfrvHlDZubv1iIrjxZcNVvgG81bCiXXmCXTfCtcytrH8P5bk7hlPwQCAfUe5aViqdYMKJYrFbez6Rg/MbvHu1i/V6z/r57MDm7vySUpJKDSuMnwupqbkPkMBVJHDkcy2RMJ6mrf/5kvQrtt5zMmTzL/ir0zYlxbsZgVLFdpP8yLmbTVLjq4LsTWwcFoVVLK84lSds+HibnChFnvKN5a07LJLjmsYk52j2cBKticU4iPZktlROQ8hVpx1Hk1DVTsGVPMbTSZWwCpO+Rib3hGrP3jIdRKmBP1znWy9wBb36JqQFBYlrG8NOdHxXCSW9x7bXx4ArEZkpiWfukPSJs7ocpvh+dNBE7b3Tbn6vmufKwQgiDT6HqCXdq1bGdVm6o8tyQeh8kVfztA1HMSsVQ52Rd1eVwcDW8Xm4gIQkK1IoxyPVBwSAVdgkUvRvlVQosVzZqDiiKY7us3fotqtiFPNZGFwdT4sqoHUIgaKlRJL6pATf+Gx1tOY0aN6RjGnRgxWSWhGWiF4w3QYIyGwsAZkqaZdhTCftgVFG1+4pLBzLjSvAEYmLPDlV9ZStcAZmATwUgT0QfRZiAsRvQrIFFI4kzGKCHhZLXTWSg2Yq9mXAcTcYc/V7aOjX84cqlGv8Wzp+9BVcjWUJuOMkzSqmhxBWn3uS9DY48bQeRtlYSia3TC0Zg3jUP7cWcDeytC4l2/3CtrYJmiA2p+QUnapGA/RYwgs5A9qvrNgD+Te/MzoOihOYljh3IhY7quWJRbTyNbIBDVLxtCcbYjOyrUfG0wFC9sGXiS5p07e2trpuBYKYmNYEgbqYCGi7UO8kXBIucf4DxTHUIyqRs0HpfdCvlSNzbCMcMurQMy2FBs+I1EqP0FUgc4Pfrh00mPYyOXRFjRonR3AgmcBuvMNa9o296g6iJvFZJyknXKrizqiykoGnw3CH8L0sBVoE7R5VO+Lph2S1z8BUdoN1SUeufOEth1HauR6ID5JM41M122S15Ws0uIcK2pURXDiXv/0ZniHb45eeRXYY+h4kJs4l5o8ns2m8qZiPGfeTpIirsXavFc43JnXalyvy2BBCgc7h4XIeMDWY+kLV0G/E9axyyxM+bixioTc7CW04hh2fTnFFjKQAgpgAM4NanqVQKnIiqECWgIM+qy3y1zlF+R9ReU+MNs6lfrxzTJDw3whZOCksYdPd1bfUVzRtViJFjmDv2lnvyt0buw8xIjtqaUqICyg2jEsIl+9Sz/ME55XN6WvWFtDdWnFrsmXK1lU5OSO/aqJm1Mba+jdIFZyLBDazH3nwRgRpuICE7c3VD4cWMjignzhSJ7p96wCqmS1ujynEAPj0aZo+ayC5zxyhmpeZITXB6QYCTJMv1T/5YunH217zMvvMpf8LrYWaHhhuGkiW+Gs3YXHAy7cQt/HXWxakGxzUFUO/GFT0iZA2N8UpXBx0DH+M6U1MDo9ptetaa2FgoqwhwReVlJquh8n5xOHnd9FP/wVFni+2iat/9KJ3DgUGV8nlUlHoa3iXh3XzoHvNWzObs9BkBAwOqH4I3Hp9LtvIWUzYbYTBjuCZlhUhubfbPAnzg7Zk5LNrZbIqd5ai1CCcXeIQNUS3EBWIJ5sQlVMQcecNPq8q3j3C05v+SZmdD0sa1aAMeoP04Vf+NsNTouMz3k5t0co/wplbOCC6YoBrr8exj1Ei7R1BgVSR9yrCHxJkqzkobB3pOsNVDbRQxcucxIpUyvn8CbOmXS6MJXcImmC/zZK7i00gbtT9ZHDOjTDdbv9YwhnYWXo/hVswmhP2rEfmi6dgORqzOPxzKwOAIvFmYeSNLcElWnzzWwaQRHVVk6vRxacEe7KauxVAY4XHAqIhpDa5A904d0fk5YEQKBhQc38/eI/qvUHKzpy3VP1iBmwVMZKK0oPcEO7e6Pf7NVCa797oBvl0rEOB8Hz4iyhBbiZQaY8LO46oqcPrxDarQtP7GbKwYAfrktdGN0Hq2VxOMsU/qUFNya+Q0Nb3zWBxRC6TChZdZ/bBJNzwEwdhncto2YNorlwILOTQNsp8BV3TScrBZHDEv988UCMOC7LpPCTmux/e0Hznli9/WU8X3gtEq8BV1uEdWTxVPRpnuSguvTpgpEjOSsup8sdGuHJVOreTmUHLpIDxTUvOxWZW4xpFVPeYr502juRFWmMpcVSoGU1fk/Evw+ITs1+OlPpMWhaitbNKgwEwJp5lgeG7sVvRAvZOJ7+nGT2QUucWQBr/nBEf3FOh6t+RQczbyqRb2aJITt4homUs1TOW3wKbzxYpw2nWW8POme38km0dH8oltXAefWpCJ8ykqmC0aTUF582GItRp1Qis6L8BkwAXnpGQvaipRJTHC9M4MsanBKJgeG7LjPm5ezHBTFyh6bHqI7VhfqkPiRuCndHs3UtNjDWOCTtzhkeHfba2gIUiRxwijznFXIE9aQjV1R+5WcdkQ8W+Ne2MYAoum7oG//T3IR90kLQeiA8cBnpfuDT5bMcAt29cElcZ3kEzRhWxyLY0Qb/uFkaay2dTUh/Sjh2HLwU8EaMgAXlSbkELj4novgbgLaVb2T1P+2mVsn1lMUpkgL0hqNkgzhvoC21dzySpzIN73Q2JqvwqJEM58S+bdQ7LudBx3PGeKmA9VGhvcjwkzDCTG+eX1KaPhCiyowFqetetr2Sa4c6GrEl7AQHx00X4b/HdQzmLZnaW/Z/BgFKz1n7B9ndHQ9bZ/keGKLfVW1XJD1qN6FoBsQJ64K4X+MfRS19Z1nhG6uAnXw8rotUplaIGpDAvCP5LecovyU/Dj5YAS4VbCDV5bezyzPlWl3SnQXL+lqP8yeKbm/p/Kp6OPEyaa9raPz+EGEHeWgkbKhxMWjJ8FbkNWY4VOYnAczSPI5zBXQTPJCor6k+hGscpKhswOoenKSsyCCJJNhPPmMO8yjxgT8S61sTxiHCh7aBqGlmTs6itWBXkwM4Ytr2y4aPIgZCSQ/evSXsx7zH68yLAfakVtYDQjJElo8acB9dxMPsDNCRR7eBHVfTse6i4nDTyCPhST2vq+1J2quEl0gwQY1TluSOv5lFSl22djIYEMfqH7obJN9NJNUx2kCGoSNwapXMjBbgxBsgSZcI7UdsB/f9xf3TtYK1RMDYzjQ/CslISw34w6VRhOSocjmZdCKpxwtvYosD5kgWrNPwg7EVl0bwirFScQGhWeJWRJ+Vs/ydl0cakOvXOBPSFOdUCxs3BA0ffBrnm6mqMnipl8uInANxzOdP7h+w1QpzFsCVXH4h7/lxhKGLbCvpkvckED6FijETxIy3WI8wWV92EnYYM5kLiEckiyJQhby8+ie59SjN4edqHSuKQpsfARtRQv4HR4rudUtnWzmcbrISBwwI+0S+o1CeNHINsTZK7xagmQ9lyf9jbF/H6JoOAQp6JsRVmvorju16G0SbBKK+AwDmsmATrCC+/JvfHnhJUd6akJ1gCQScI8ZfdrTHm3+eomjMjG3Dwp9tZU1naqnNQdPCASlUktDvspXy4sRha+WAUauwtuAkG9BDyFA8qn8MHsASYIonQJ7hIfjq5/8YgOBDF4OdS190r84JZDUfLgFfdJy7I66T/fvpEpuiH6aGnn7DDhZkuuJCL77M29/0f06LjbQ5D0jvrzbOIPyUcK5xzcCp3cyo/UsxoMtqCwnDK326VvI5FTV/kadDL7fdLaHsmwD+rKPiffYpt7Rm/r9hfYpBCBKZALlh56SpjfgBntkCcV/OshOfR4Ew4cgmENKqci5KGy9hBAdkA1CQdTaBPTlLd0oHDRZ6kuZlGWx7dD2dvT+FI6BzuQeGgMRa6/4nw2UheasGvHc6uzljEgdW4ZrTYFJ6+vTL+lMSCFUvOLliO9T1nXYzPTwfj1gZarxl7V79coQj/mFIXXrRoRkIpXQvogHPooROa26ssXGffZGjV7UnZaLh6PF1e9MDwt9qmCSMXg0ao/f+SIJIxZk7/neUIZdBavqJFP4wrWHNOPsEoTDyCxqZUMGLrhCgWClcIjSFrTbuvGgfEDG2Tw3+2A6l6qT+j/Lu2nnzgduhG9c5YLsJhJwRBoWZy1617KEjLPLFRMcSvRNGDBXUksiykb3x5xw07z79YecJALsiSSM2Q4rmM+Eowi96P8bQWLKe0jrruif67/MnsLtdDVB6+P0hICo5oczy7tFekZXKTh+yYJZS8v9uiyJWQ4YxCuW57Hh0hNOsLujBIal3DjTR6ONzhjgz9bpi7Rcl2tjriJhirCLgdunwu1wThAcITfmDuB40EZfg8gpZAbROBjDFNkGk6h80E76T0PgQK2wXBd2EaAqK5swWnG1T+iCKOUoSbk3I0JLzjBynB1/oOAxZQle9+bF/09mPB+OX9y6pw/qMdWmUlZGbARBCfOPSK0kAUvrSRslakb/R8sRjNiz7qbHuRKBDeQ7E5qEHLxE8BgVjLU7D15mp10ns0CW/ESEC6uF+cfDczDOou926PfHKF1xboz88itloQ70a4wvCG+Vbf3n8Y5/U9m5E2ZayBl6Y/iZIKCmy1BkYHmq5KsJYrAYCX3MnfsGp++xcAApYC1smhGp9aVohNhck/npk9moibZDXbd3OQUtAQFfZ5eTLof8ifXambInUbQeKHnnPrYLzUF7xtxjnwvur5Qe4waskYDJNB2DSPsdir1YR7Wft4QiMhYD4TnggjuK7vIsAqIL8Itg5XRaocXD69KWUxgR59crCUX4MMRBNgTLnsRE5KdmmNAT8uskczQ9GdilmwjqvquROLZLfACI5KDx5SkFYAmwfMAii2A9t4xbWPnrC2n4F3avUxxBoSjk/LOgT+NBpQvAMxcqK0Ie6NnVAt0QlQQOWyu38lW1Zpv0dM7MJyc/Bpnae0viI3BGbPfbQlXKMB+GNrI6uTxk7lywHdMXWNKAW8wtsRatmsU6RTZ0WnfhGG5TmzPm1T0SGQa3ggfkmtXlypYlZKn/k3bmqqd1d6M42owmaA5gRbZUvhTyJxJ6wtbLcDmk2tTRpwENY7SGo7PY9nWyux8L3vZHqOoYMLloZe7NT5G+tbs3IgDzbgT6RLr414TX7wmiCcKrPdmbPtmyuvwww86yN+UmnP/qNPXjFGnEfmputa5eP+ElVSK0i0STmc1keMSvlxenXajCuATYHgNy8UH4l6Fj583NYNFKvd4hUvbAKGq2uaWZJWzJfxYoNai/u7cBc23HX0ds/rQaRbeVlSDJk0zJDVUXML18SUJ6bW58ATYaTnRJXgh9juAT5HXpxYTVXCuJG+r6SaDsPtIGVtnN3+Lgw5Q6KylhbuWYhK6IIHbSxnL54M41lpK8xafEhWwzmawGbVe2OTrR2aAGf1FF5J9x+YP2c2pP3ttyGXNFmzc7vb8aI/dL+J3qc6fv5q7+qAvHp2PTk2h/0NClFciUvno17Opo9J/xH6gjUdEjhI6oCNxPFFEsk+tR2LPagwNpMaNwYSc9rM1Ph3knUmGBbCFocCicsznRz9LG1dBFSmge3f59N1KK5COoV9PvbB5vhGMclKeUMmHo3wmBjbmfP44cEyACnzsY+8KAauZcI3pRDkiHO/8VWTap98zVWGU9MjXgYHcp7UegAUlG/0zeVJODz/ULH0qvB6FbyAGCrbwRcTvcdeyFTABcGeIXRh8x/uIM7TgfTfu4cdcXk1NIq+JqtV0MfFJPFkPtZKPmR8gL0WkbGh0yVU3mLNtUWXlR0o08lwootFiBpfTh1LucAjfBlVFAMRAILkJ3g2H9MhSXu0Kth6L3MzUSYw2l5moo7WZTQUzpcUYhrjBl3yMn26TgncTzdukRbbH1azOiGDmHMEj8/zJZcfQDod8oSP2rZo3JrCHU0OqNZ75EoEgnZGxz1Gn6AfibkS5oGmNeVNyH5dz4Q5pOtrF+oz9wYs33Eu1ZKqUiq6q54nnoEq5SGD6U+vYhbpCjy4geQe5vyGg6VXxetbS76wJ3k2fsdqgGvMX37ENibNzYSnJOGNZU5oeFnpCEBUYH1ym0SR9VrM5CNPz3SsCH2DuC68pJ66MPlyzYssTsGgYdg17iOKFpScSUUCiDAE4/tJB6wXJfOwzz4V28QQekwLi0kCQUJ24R1SOiaiDYbd97n15daVtN8Ph+z7Wz4TUngdrggI2PPVrYxLhBAHv3Pzv3I/ql9kAaPP98FI746BHS5/o37M3+DFeOaW2IpGGXIevD0Cl2ljR8SUWroGF8ndX6Mq4G1jJ4/XRVHHFMsHQ/rk82pDmkS2IU6AEjTeIiEiO0n1KnsOjgoz2Ug4Pc1ZLr0tF1aHqeatsyatT51Voz0EEXcQBuBZTHflGsOT4vFyWKWWnBmKQArTB1CQvoLuoWxoiRDyrtZpY853hHFtsxFiFhCdUeXyQ2fmOViiRG6wTLII1/kYmmmJAIvnxmzWIi+TVZZY1BHj6fIW4+LN7yzvNpPv9dDQhO6wAqgcUCZK6Z8imc8Byygn2jNocghb1d8Vuc+iC8YahC1B6JetPtFxqxjQJjtYxUYkxrrfheuTKxm813qfXy/mCf7exFCg5t9BJtNc65P5i/NPF9VYdgF5Dq2BUdrXVjxI/7cz5XoEE7MtqE2xk2ctGufwdiOMuC+We3/q6ZddhrdGeV7bLIovkBGYAGp0O/MY6p5x8rA1Cg+TBI+p78bkIBM/P+dnDE4jjtVjVphs7Z+dfqkDgmtiE/CLQANFF8DBhV/eBFtNZ0a3kcPRGNzcwWmNiUfxhte9/bIqG5dDWxjxZKB1uYK7VJcZWK7p7EwH7+MtWjyCCVlvFPaHBKTtFox5Jn67i2jIHcdYEyaygc5UGJO3K8aWqtCYdobq0Xh44fMzk4bcZYanEOxv647GaiO35RrC4lQgavjby5wZU0chUi1s/Qbba3SxJbECicj/cb+uSMhMMDglW5DcEb4yaiIF1oM1BQ6nwdVlIhUT07gdl72Z33w4SteKKexCmqoHKspbRduPDUjVqQB6/+bE6JXTELLrvO8sJuF8u6BSQPV6JIaZmF1Z0/MeqJp8lHPx+vh3AsnDDbAGVfQLkLAxucNpvT5gQ0Xh72Ko24V3dhT55zVouchjauqn95JDpaiTQyPb2gjpi6BTP6fW+mygLje2oV+dQd8v/7XdoSD77DZmkoR+RizcY5yOSjHoDnlh3R9RC4CvpRRDsR9UpgsQ2tKM9kqECDKSCbIuCpaTy/l9iGBTv99WPVHGxYHj2GhN2+O8I1Mdt70BkrmuOk0JZHeVOkWg6q/z9MNsx7v1tOGU2eXyh4HFZFjNMDtJz6Z8ZzIbPGc+ltEAW+nNMXIwI7LQpR+J1IsiNMWIdA8iyiNYnbI5n5+Xq54BgO/UzWXmIrRaTy9oQlAh9MwJhzysgF4pa0vFmgSyBuMtaerbY7FVuAEr+EuupTQST6uT5APCy1lOhr6KunbbbC2Vb9oktyTUsTNhViteUEYckO6jHW4hyAWvz2N9wBloCaX0wXf2LyDKg2ZxP7VEU5H5tHpj6Nci1Bc5YQK4cCC7PqgcMIgVpJMA8kSRriFhP8pHV5Q8l/SYoC0NVueYTz97Bx7qAXXkD3vtabKYgkuJbvxumzi59p/2RT6aG6K1f7YH7nzO7rcRICmlC1ynBMnKOhGsUiayD/G4ECuBh3XC2237MDuievFt28oQMUR2rJoqDwvgdtpMmdarMXNaESyhfOeI8jkA0mRV7yAVS6hjMyUI05IvLGyKreE5mCOgY5MPvwTORWM5FwBi6xZ4WP/uWefj/k0jx9VqhW//DmHvDxvk8gyD7M1/vCZNwsP2ep6uys0w16XcwW1iaSkfbV9WNI5HrAdl83bkqbXo/1kyp8dk0rKYdFHA6jk0bk+/tLeqv0bNSe4ysWCGAIj3VHpV0Yr84uqMgv1CJK7iPUQvW2XKXQ3LJWESg644OPq4EAOaFZLqFWkM5i03P6PeHT6UMjKrJ/Kulc5kifqtXujZGnaS5TGCzRrts14Mrgx/JQmBTu9p0erKrgM/eWd+FQkJmBQu7fxPMaAk1horZjm1YYQt/gu3rVxI8T7HhxFrUTa/UPxK8Q6qbkUUU3mvp6yHilNAw05zhnNUm+l+4l5BDMVhqdY5+WeunSy5VCTMQK7GLJPecdl86gkA72Lcnyxk8PYcz1G07uYeMXg4RM8WNdo9dbkMLAgRbYQYZ9j3rZ1UZmxhW3YGW4b9xlH8JipNS0z/h0glizIRxMZIRDGjTf8vncQvxAMGtmo8OBpEsn8HRpRfoVxjmnRiGD+E7vmFJPLg/MDw+ksjSQpofQ+cO/8B+DVWu1ueaqTHxi/Haoa4RNYMBagQzGRNViSskAjVNsiAC1ifOk4iIqpcmolT76587aH1/gAolpTX8ewHiBFx9btFRxw320VeUoAiA5oA8xGnFUoabjS56MCMDGAE4crpmjNKaRogOjgYbGbaaUGPnou5FwNCa/jHRbcuZcyXC4dZUqKhZT19hnjmGJrnlZRrqJ472tzKrk6qBGLlSTqy5RKiH4/Oj7CUOv5lbhW0KAyNdcTLbbrfVZJ2Q66aLUW8yT+JMG/2biT7f2DHF7+nPkIRVjDv7M6HX5OJXxxptXNulu2PCPd4qTV5hiqtWay3Lu78rBWkZjW7Xp+Fs2naRU5KDn8VOv2C7EuIO2bTKFOIxnyiSl7TzxNjQIQm6WVqx80Y3Pm32RNVTlzNhMN27uLZHOMEzJHm3dPMwgszwVrZCNaT2yLl3X+zRrv96x0jCgnvPJsUsAQtuh2v7uiLP1UHICWvbcwNDV28o1bEFMh/ljRDE30Yq54FlJbrdC2+BhW3JxSyKAXwKs5Gcw9ofV80tp8hwW4ZJSF1xh9MMT38BoVkt+tGU3QOlu/wwLRDNlDOvt30FyMVNfz+9q8F8hdqDzHPrt8NyCFbuNWaMsKiezx6k2e6to2EqFScLqJVKuCx0DQFTwPXr4ZgPwWHvpvB3NAbC6AHVq/0ecfLo/nBh4m/JhIfM4NxPkZwR78VS5vWRTTCRRKYvKcncTXtJvvc9ez05BsEw/stF1y3V9zubRoNEQP0aK/mVQZu81LOGNlVZux18YFXLfBqzo49RibMZuugopm7voZM8Ugt2vr/XdZzUJXbO146UBdmk2i9gKOl0tCiqIvo+SMgFBOjF7mo+gQf9tio4JQieYBddxyBh7vuK5+7YnmgGzCEKivs9KNHU6t0eUYyhu6BHQ15cR8/t65wGKLCJ35epBkVNQOvCkRAfoLz9YCpu+7oXVd+50j5UelcMyPjta9lZTqZpO1rRSFXgiAWBmYEqYzB2JA7XUjLvhyBlBGPsFB0FwQn7+48dA0IT6+1UMSYNRjSok/AxjtXV1K17DquZmKENkdYI6LRy5JMVzU/wp/R1DJS+oOcqQ07BNRjQ1y5y5+dTTGk4WFKgxyJRPJMASlsj9uFo3calUYcyQNCkYybuopChVUxjRrcaBNKwwTeLNLzlGpSpOcDq7+IAZVYUSKyBjPNma7eWLZ6romfX2M6tUGxCujIXuyL17a38PdJST1me7z7/hwmzLSMtDTkl4TrUFzF6LvYm7iWNqX9iC01+L40qiqH9HjGg0gRJF5BCHGpHdOg4kZ82HG2a7EmfY8XV46eTn2IET+PcsmYAuu967T2Frf8Vjca06k/7IaZmMAQ82S1pCDW0qsCNEjlC8aexPhlN8LAg7KjpvhbEtM9lPRt7/KQWaB4qIMPa2UoZzs/PILrTpNH1+1H5gcYUqQ7Azx176tn+fnjIiax/mHDuB/UAcagRLDMyGnZzg1nd7MLN+xEi/pFXqJH+5TuLTjY0NrfExK4oVSbj/07YtRV31jtaJ7HuTkM7PAtFQzqt/Ih7uw+BLaefZ4CIyF+M28McXWlZ11t059gkJQTmD6E2Yj4hn0L2tePhEjlLocDDc7L73/iBoyqDf5+XQvcwBQ0SLkZW8CkR7pTkLplTj5F/Mt+UlODdX3DkSFScrtGCNi4aEu48zFcBNMZn+oZ3ZGzp8Td08OPwPb3W/Oneux18Z6yy8q/HGc59Y9C4joJJs96WO5cueLOCZHF9+pfBNRaWCQ7gjMbl6lziv/InAfld/Z5HcZAd+rZ941TAWwJo7oIDwmLNWLyI6+RYUKAScAcIw3Mop437RE6BP0k4+lexAYfL540OE2RFMfhZGPAnLIyBE9QkHWjFPNQlsfXu0zOiE+2spLKiWNO/u5DYjtc1IDq98xqman5gol+4WsS78AEwKSiG7z6bmihsva62RHBohdE29tjYOwwdK18SOtNnqYY91JExrj45jaPIPXZ8NmtbP8qut2UWjW/0v5j4GTxeCzCoxL5wG+N3mFB5YGEcIZy2sGsBnwkhQFdAuZYubsj/XljTSc1RZLnEE2S4Jo0wuGZvbGwr6XU5dGv2D/4oBEEqkH8i8tdxMCV8LpxyW4Aslij8xcUBs0vd/16++vUyyEtljqbpSzTpAxjut0bk9RdNEzn3kP5TrG6MsW0M6Q3B0eN95TeD86rfqTgetBYUjAwC08pHfupkSJg7f/KeR6ygMyuveAXeE8rmM80LHgT5K+GwYoLF2wSM2J2KQqruzj3EKaJ2c+ffq1D8pO+LIZDPp1fhw4l2yDekprqCD0Gpbx7I0wfBAuwUxNH9h4+HZrIv6uzJ/iXTKiuKUpVCyqTWae2IG8pw/vYNiriRDPGLz7m3NypLlbnP3kCRTwhVm15k52XLr9bEpW/d4FemNiqZXzDm1LP7F3sp1HfGMxJIbWdfUQMLwWPcmHqdiGVN7VSHK/xqo7+ddCud0/xeVZHYuCxq/v6OB+cH4LNNVamTfv/qjV7B9sOfB5ivf/GF8CvUASyqw5vRYUF5JjBKBr1P8pPqRHdt8SnRnKOfmzuBmtGozZg8VQxWTwT0kNnOcxD/XtdWypbBcuRGmimijJrvqYsfmMIY/DafQ3wsa+4CzinA9ivSRNDDrQcARZartUBvtWD940QMyyQdkZdCBFz8rTm9II4ErhWPGlMNJYLX/aTSXVJjdIiF3y2ArlDYN0jJjpOmvGqMFOFOhfcTTWfHxbh3V0HY6PkKa/40rSR7brlSyFsngYK2+gEd30y3TGIOeSL7w2us1ePn4OXZgHL24shmVyl7dP0eRl/cf98odZDMPATJCrQPwM0CTRQbJ3gsCc6cN+7wTMB+Mb0LgIJXXUb2daiW4fJFbx0WbrnNQ+i+8Ko6I/vQoNyqTupluXSbwUQDQjb4/mv4fDD9c4tOgfLwH5p5ml8P5xVLJX01kjpVlbgX2MT47RZQfxAIwq/2Cn2m2laQHdm7ap56MN5nQdPYSeP2GX52xhvIxG8caC2rO3NTrGqq/Dnu/c497h2CAlNAdNoWDOGjPjvKDNDDn66knF8SYh1Q9xz8Kz28Ujf1xqAiHniLK0PIlGincJJmW0c/JJrsQpjkqBIs3lypqtQ+MiYXXbezTqft0nuCClOwcjEAh8kqzLObU+PpXXN6qAO4mAlgTl/grrn4RFT485CFEAUju+HcJUbEZCuTiKWpLG+XREuxM9hgCzIw93tfF///8C8xgPEotMi2/ZJEtoMgAZN94vwuxY8iO0SAWYN6qU8zALVav2srMevapSoSh1bLtAiw/sa441tzhMKsv5wrlDpR6NYbm6IQsT4WJ4mJYDPhJOmVbnDO6ed9MNghTSpWZLDMwuryndT0ezHM1ezNC/ZBGCJrSbC+81LS2ByV3mmx31hXB4LuTPKhdb1BpcXvrpdaVc1qysAsPkgmkcq3iKRqrsdXROHXJGumqHgPlbQOxLtfVOKCav5Er0bALhrSK3tgVY1JEvDKOCCVk+385amqb6VFLG0YXt0XmhT8u9O2zeDbX2nbf/slm5so2JHQfscnsqtR/JGC49f0DjmZ6CJnW2PbJuoRcQE07OS/K31rWAh54DO58yLvo2xzo9vl3Lc31KWMCJ2l8GQ3FflmgEg4zBNLpbbSRvOS3MQKhFGEI+PCIeS/FTsAx+4TPYZchpyVU5Bg8eU3DDTQT0kVAgNRMMim62ifdyJeg0CYHO1+os9EQ2jEX2mJ5fWSmQuwDwcBWzCd1WMDy2aYzzO6J7U/p9jslOG+FK8JnOMhWj1JXWMsoO1Do+0hU8o+6ZymBit2o+hSQXRpYVrcE4L++up5Yj0Q0OH4KERsuOCrlg6kpnMaRUboQTt7L/jZ9mQDI1pnrKf7t3Cy5vbGsoId99tiACFD5tQYeamfcWB+TLMxEgUmolizwEtAi3a1AceEeCyGW3/WoLOI3PbF8WQJyKnZoM6mTzgXnD8/OIuNulyNKvHipsK47gdRfnrGx92dqHzTXwB7RnSZ36+D6aAAcSlWEjIiBzJj8pd6RSp81iU0Eb+gtIoh/6nw6CQft8P11MQmv/bY44hKCmRWgn/H94z2XfH15EHGlm3/WZiBxPYH2k691RIoairQIBLAthXiCrcPMQnWCxeUTrEDHQ09HVWehKwi9dtueofot3qzKq9b5P7YkcC93Z0NGLWG8RsabAk+PDiEqSlFQFPAPXLXiz4vYYlnW0Nl04LXEd/wvd7BP/0Erbyf7uNi0vdpmu86GbTVFx6OEsFqDmX6cp0AuePHNYkiYT9OyfPIUcS5+BgobGIdqyM4YSmfqSwFMaXPsjdF2QkLqaSMU52zGXmgZ87nAH+jIUiwo+N4ii2n08vPcyWmfBebUdxK18kkr621/6jqYmQh/5mzTkrxjWy38rU9qsPeGVlzCXHfX/esOI0UFcAhkrWvAd1gVz5Lznwo8VU8PCYnqI33hTWsSTb7sW0UKl1jviq7a4mJuSjILyr//1/hKRVDSA7+qtrVcPSRfGyG/Zo1NEp5kWRNz1RuYl1q3TP4oLb9QvaUKrNBMtA6JZyRQFqYIeEIKjj1HHUPvaBhwEpIXRX6a3e7/SwPZFeYQ/0Nk2C6w+Bp7hqC6HIfNANVqfJvjUed4v70L1IYyaCEqu+QbA+9lf+lKC+9nhC4O3gsbZAqjO8VKxb3ECCjBt2JkR+0fQDAH5b1/IKyQeFeNgcxYHjmsBvTJ8A1Z3ypjMvgj9+enD1YG98bDla2FvESMNUw/4sHcEP72Puj6vagwNMf7VMerQ1TRFGaTDx6sdAerKZzxsjQ1nVArK7y2PxyFXMUst0TUZtb52VvXrsdCQYjt6JlTPz8AZ7GwMf0ULLzxguHtKE2Y6DMpfVtbwuZuYgIsFivr2NRoKRAf8Loi6xdwARlnJeRUBpyRi8FwYJrdVqToZ/NevhMr1o8lsXDUuwmqTJQL6QBXQrfJw09arYkUiM8qwpb6YM+J5ytoip0b605d1YKTVqXpbpFTnVIEBx3lPNm6dM5G6joW3HF2SgAzOk7nDpqMjev7zuIchMu+8R8ehWlpCRhLMkgTUv0thexOAXhvXpHYL5A0QmCTfY7tFb1k649QL1SuB94ZzL+neD4mUGFjl+dRq4C6Jw+p1RS05oACa4GdKo2f3x+853ql6o/7xKITFp24uLImNRQJ1W+/Btkt1jzhDNcrxrj+BBCm8jTghFP/poPUBfERvY30rzCK5i9ubbgRSCP9JA7rxkAbQ6UybEhFh/36y+0tkUop83ZIBqb5fC2pi3WQRcD0ssiP/LMTXFHjPJZsn7TQDUPg2hFfSdr1nAO2/7s4emobAGLOkTJqpuNAtJUD9h7puYWL7MqMqcOb3dq2KCpayS3lNPTFSG3EovvXDAvHgC3GNen0CS8o9QRV8sywfYJRxJNb6VSqmdfP+ZffD8nd9fnhURLbG1HtPG1xfgD8hjzyeQUbPJO1oKKIewOkQNFU3MLBwd2u6ewQ8B7vOY21+Zfzs6Bnkto7N4E3q+Te8z7d6GNKjcDFj58/i9BTUEpodx8iEak2oeODY2131fGMCPeeehoIgEMZQtI/Oi/wPaARRCKU3MDAjpt0aldOv0orXsOOlHFvHnuColeEFZXcVLaCDSCK79dKfUrzMrBzjlcn+1GNDIfLRRlR+6V/i9PahhzzyE7LAZqiBrcU3lQU+Kyu5aC6AjSkt2ooQ51WhHmOfeNTfYOw1uRJVp9I4ZhOnnt/5mA7aDvd++jwHjc78MHG9O2l7da1xydaiW2zLuf2E5U1uFyPAMiGsHOml/Ix0Jp3xe1JZY9uab0bjE3u4oiF/eUUe7+XP82PrMxWMHxIxUclOG5sivIwWWPDgHyKZoi49/8ovOiMyj3M/NrB7IM3gbX874LgRD+NSqCrmBPD4KL8NMI5eXVHHlg+Aq3Og41DB1J0nZ4F1hI7zllDPizsy1c701DQpjCL1Sf9SOmvCFPc6p8XB6IWEoXwruArFWAQbxD/sAyACxov8Tmbcrtw2piBO9b5ndf4/KPQ7GYGrxT/kFQeRglUZRklOiuNmIxAO/X//2v26tNbX8GQfeDmt11iy7r5XrM8QXvtRjAoF2ZBGdOe/jE4HJ54LsjU70+/C50zVvZ8F8u/slmbzblJLJBWkhm4LKMZTbExG1f4gTMooztnRg9RqHuM1j7B6c4jaX03Rv2G2UW/zv9lDkrcx2ua5lRAo5oB4qNcf0qEREpGsNopX6zp5PW8XpjnOTVEgxmDK7ag74f6MzXfs= + ca.pem: AgCiW8Hy+JmBSDSgyeZIgqyl1naZQ5AHkf9nmf038wtGG6p5Hb1cLdnTDL+MeYvG3nYZDQKRhrfw8AFDUar32xxh3LKJglffJNBP4bKMRCufxWg47m/I9fZNFbl0rk0BPlkkKI5cLK3x9e8QxUfYCDx+ZBE7BKvTUK02siyS+/o1J3MlsJGFLR50iZA9hxfky2FobzcMMXITuXxzJ/6Ox/mPCJRVmzIXpl6jEUls0VH6jL19YmPueSrUwxdCI/Vsfd1RS2wEIOPbo6OobZBpmdgKfDFooMekicuRyj+s7+ajVgBFIzZ8b9Cq+g/fWeD3zII66HrF3WyozuZrZFFnr9Wsq2oNU4uNDAMLRvh++XRkM7ECoW9xcChhLX8JZPoELpcUGId8FmZ991dNSY/mN38C1pseqnQhPZ50X7KxkqqGwmA9N2GmFGybenWEs5BuEYoz6qi3es2pYdIukC9rt3a8lpep8H+Kyp9WPQOg3tadMkJf7QHz8joN4Dyk9yaR9wcLFZ1yc0a4s+pVgPS2dPnXwV3JwNzrUSHXYxRpx/1e7nxxeA5GKiPj4aePyMEVH5VaR/RkwDnKldorg8CYY5TZ03jKSMVd98mv8VX1LnUYjxkZ/BUN+yKohyplzt5ouI+zvG5IQ50XzDNixIMTcNGXWqyUYbap3anHD3GsnAJTlg3lhvCYhkqxnulovmOO8LbI8hCC6YRh0kbyQbYyOZw4WOxMSf+LsIu9lBKjJx6BJXGRHF6dOKBVnFteVa8xRU264LSLdUlKx2mVGh6/Xy4qS7fh0YAKSYApRdoZeT1yNz8BZuN/9oIc7THNg/XYR23HIU1lf1sywC9bsmxhtukVmid1KXXJBy0mVt5LxaJ0xvvyfL65meU1C3y0SXHMa15gkxAW+llY9qZDLYMwJmbtWmq6/K06yVVar4F0gzJ10Iul54F63KYI1pv9mnLDCj3XKIPXEZXtcd7EJjXIuhXLZrsrG3ROaKGN7GbKRaGpj4DvlShLmoI4IQEMuEh7JVFo+XrpmqhnDrHE9hrVIMcYr11R0Vyz3+4p6I+SILNcv37/be2oTSxpwAhuv7lz/X+RIpT8AtRyUMn8KAtldQs0oZOnWdg7FUdp2ngqTP96xeB9eXdpdL/RuHEN8gnJahlVgxm6w0bpLi2VTCZtEp+SVq6JoWxSy9QfiUqGYI9dr9PFVhDEGSXvuagrFhkSURl/qCoIS5fF/WQsePgMklROz9S0pETWcFzThjkNULnHJUWKaGJ5Xsxwqs+VJqTuzT8kT9dEmt+j0VICIbPEsNH7UhAN8eK36azhTWCUi+1J/OOicnUJlTOfVg0SWHn/0eXO3WUY7x5CPIHr5JdJ8ro2tmFYVGrwW/nvW+fx/9ndN5TH9lBvkwW4mNNXORSxyuIjyfcd6TfXcUyGLOe2P1CTzbRWvGuG6McPVCfX+KxsomnFzaxWKYVz2fHSqBtveNsR2znVwEJYUf8vNoef5glf4QcStvvfopdKcrsiyzxIWC5ZH8MINDa2OyVF9Dv21iHRp749vCLaJX2pyOoI4wYwBYbppP7UEg3IbJv4haf0MNe2JfPXYOh2mbgMT6Lj9ikUX6yxD5rXnWMXOyIvZdepK8nk5tHOP/4khvDcCBkARji9SQRIocF79NhUAG3/4UQqkGaMFldrUkkAeF6qXMyuxcUpCk8JceNHn2BIfBRXEZuNAlyhsgqww+4C4Q8aAUKhow58nDh1H4FGIAZRwpbwnAsKNd6h5VNPmQGtn4nBUgXGvhmTAyZgJvMVchlKvUclNZqKU+LVi9Yf9GJqALpc2q7+OuiVZKa2FNpFfAYZoPsOpueBOy7UfVUfuNdRdE0U0XHXn59rELiFFzHyisvy28PIm4cnkGy86Axf2DpfdOZidu3W+KsG4k6vaXKWLQZDwrutwHyxAj81MeQCeUTGzYNJolfuipFMT1DuCC9s+YmS7GeZlyeZh404TdI6cmLpAVQc+M5Of+Eym9f2b5kCe/DFdskNSq8uIQvj485OVz4uvtZF2koWz9mfGCI3XtmwKAL1Sr3dcWw1xFkZ1dmIcQJ7XidycpcSEDaWk6eLPAwaZV6OE8F1il7WoG/xZJo6MJ8yBb4jxqv2zWWKc+KcUSLD1aKsHSfSFSX4qoqndbYw7n1EcKW/9JLgXiBrKmmtoBzqKsf+Gew0YpwHckFeAo4R6bRff43noYWOnb4dNGv2dUXWHz+tGo7BkqYaNDMFUgLi0ATPUx5dqPFUF13WaKiOLL/wtnBWGUkPvtravyJ36fnwF2Xp8sFgttyRHnJ396Por6Ta00viqz3f7gYiMZo+4AFF+vDSKJjVOnatA7kFemsLgaEtsvAO1cVO1lxfoKAAWJBZowYmA2DZnfdYaSBj3beVkWjb/8HG2x3A2Pko+pMM6yKUtmnvhfYUVdx14iX1yXyaEYofKErpiKvPV65Ea6oPGQKzvKTX8KASFXkbMGTHmKmHcOYZI80MOwLqj2YlYg/ItPATeknqnRHKZU751QJmwURdqyt7P7gS5Al7c3cTP86gdOtG2MXTI2j/Kdbyq1SMDG+4/N5OPI9biISROF8DHwxA0xWHQL+P9YPqD6nrfzRx8iD4s93NxiPmsdBg32r9W2kB+9X65W/9RM04iMyIHmEBx5He2W1zpu+0MJa88X/5Uh14jGwmquLQ+KeZALpvrUY80jwSYzdxei6rnxsFgzhfP7EODUV+uM8B+65FyIj4SpeYv4A/XEfJGI7vyFiZIA1DVRrxyoM3JGs3XcAw+xGjjaIto3cJym0Sv/R79wLEZPVfzRuD2egiTQV6t9+7rakuHQLHBk13AYzPF/SCzOywiapeUOn0p4TJ6bjbCME81eEiK+LYcFgAGlIdjGuV9WwU52MP2VmDoF9+4K/tBM7mmrnhniSk61G9AvL+ZVFHXwDO1/8NFMIWOkpo0zbJYdJXQNYLI4aG+VZ3I+DH0GOm+6tjOUphqvpBB9Ej2oWFEUAtm+WlUtUtVm7fKzwyOiciUQ5479c6m+uan4LiG6by9T/XG8hWtzJ9YaV+ybMV/SPaiPjvO+PxBkiRMGTH0idhSRH5rVP32m8A1Ffii9ewAYAmnxR2L6ie4VjO7PlimgB7C+Afe6DSB+rqs5zOq+PdTDnet0h1/3w9xxxsPCXyOMUigEDAm/Y8FT0Hpp+IfDGJLt65+/Rv+/aLD69fYroeUpJ+JGDmngA9GwCKDLCjLFvtMVIWaoLWwwDaXgQspG76m7NnFSokEuJ/FjWB5++FVS/3XhA1PaoOmPuLOMrX1Uad0H1ySvMOXXikDGsSEVp7Dl6VmyZTIoJdKMWERHhopYBALFDNyTQLDYQS56ewsnYUqk3sOzaePkfV69b1K9+xL58ZrGO/D5E3XGLOQCQt4MQWB8e4VfL+pOW3dKdouoTtKjhbfYVm5i3DMZT/rxqPHi8zAT39UttLagvtasxdYiI/p1XThITI8siQyVw18QRNxlWhfY6x2de6mxVd2W9p8CqWGW1Iv6x0HViRC6mjOi6UITwtFaYFurE+XKR7qYBE2Mm9zpFe/C7/WalWTz8cjiaajR/1V5jwVjy7MRAuHUbADBN2ZgXY2WMIQHgHoIdmZOQIpJ+EPekwMgYRxLyelynEzfNoSOfsDtKJPPM00BEbSVtoWtIHlGzJbohaDPtcBkU/3QkuO43LKy0k4P9XWXUb56cSIuN033jiNTrM6pBEw3PUsyS3sm0JvXr6RHRVXnOlisL+in00SUqsHc8yGUwkgXqaeMsIJJZTF1ScD+f359HPqUtXgwvRriNoa3So2N6p/71JxU4KmHSYj8mR4HnuWzyddcMLKnLP+8VfTR57HnaJLcp+r/Kp7pIQtpuYNa9mkJ9thpNgfChtwjrewNvKiRRUOw3LKqZMcmPNTiiksS31bBwcrg8ONhWGRiY24r8cBwSd2tqSTeatvHQG7EzdiWNndqb/w2/H6bv36OlR3A1hbOycEjuamC3jfz+Vgj9F5n26IfaIsO1VDAtaEBJ2mnip8VqTOG9lP3jrO+H8+bj4G2xu5RUsogUcveHpqFYM9tv0tKfesIljUMyCuxQjn8Xav6Zqip314qV1qnzqV4xbTprZEPjxp+e048UuBVqfW7yFOnoJsF+iBvDHPD+EBUgK35uGR7cbhCmidM/xR28JczD7Z0Lw4Kl/5vlW/QEd+1fmAZ798Pgq05UhzAjy24yZuPvXr8rZjy7wuzGlysKGJEZf/iDT4ejO50gMgUn93JYODwaL+TUOOw7LJOK3lk87LYUV8/uuV1iO3+vmCDIfVn+NEzD6NejbgONidAIUH+rDqQBzNhwXTkGN0Kf9YVStBS2qBDyDp7eiQ3CDHqctZjDB+Crg1nqc9ODemQjhuVJXNst/0XWq09BuIb9XwdvwBT6lPv/6O0R6QCmQFP+a8s/bYGYWJfdzHY9xAXv2IbdB7YHcQLV5XrnengbJxkYEIvcfrdbAeIGppAglesneVXSV6qE+cp0fRi0mjXZwBXPQrpkYBE7EXWilfgDMDikqYPZYwp7jHuwx7WpyiEYGI/AXDevnPCsWht6G4Q6+1dnEILfwjk1JGevcTTIuDTvXRVQMZ6eKIzkduFnLU1RMqtbo5vlJPDEYhtUMvC3GVqpAwtrZutzvYQwKGieD/JUbdOdkOjeIx/TRGTpjN+DiADsHTnQ7BPokDmDgI+SqflQYGZLubdH8uPiaqWCBiuI7SM6dqx9fxrf7ilDMUNHkswyqHSeFlFFAQX29+wuWAu+TDY9JdlxZobaev85vXTBVsx6n6cPkPZgwyL8bk93q/w40tzkSXY91otbV680yUISnEQEsFFwxBIbqX+EznOfyL32ju8mtfIKMQl0zgliE7rtffbrGe7q522aZELHDEL1kW9laQ83A+f8+nQYi0cu19ImwleXNaDLxRyqsMQ6ZCq2r5HK0CenakOFM7TT4UuqWgwlcrAeQcb/By/eFUopx8DU6SEDDkIt2XSNo/y/o8x1dxb88IoG+2J3FX10vV9Ef5aNBws/6sga/1+yKgVOhp8oPHmsqmUCeDrt/CJ0vfKBgx5zada4PnF2OF7wh/A3CqU8g3wdNavuPibJAzvB82IqKUWxLb9NveJRLSeat4WXZKwv0JVorSenTejByO90RgxGl9aKBqRoCcgDqbYd5K6fdBCMQcV+7g4sHSOWvh25RSJbwTstZ+LlTD391+vlYRYMOdVp2n+A0EQsP+FH68qDXnI4mgjpPXp1uGjxImEsQX2nT06nr8dLBvTe/9nCRF84TVj5GseIEBiWvPNdBYxHL2jf3VBjNBros5zBL6+6cLI4/AeKa/+AXgS14XK9tGQznlU6fU/AmEuUslRf88hQw4hjb+ciBbqQPFCBsP3zG4kf2SH6tURrbM2qA3hX2jKxeOpB7SvbbwpZA29fP2d5Xk5jExelHO5Ir5kxTI6lmsOp9uNxWGU0W6QL8CrrQ8xaAFP71E38YxsPrpPDyM9WdWt7T11RHFUnDxql7bNsWwuGXYYs58a2x6ZHddjBJrxEciqSznlhK3GEc+qPsVoe4qsdmec6U+L+o1y6diDl8jEJE/7vKCcAvwHfEHEMJ6iIzoyDbeOrCVbJZgUBeU4Yl9oLc+7w5mEgjOue2N0K3nX5GVcH7rYXFlH2l4SCJLPOL3mo320Kw0WOFZtITkHO0n8EoIoXDZTPO99Yvp41pwkyHNUfisopfN1l6tML/kbeJxzdgaYyONeIuhhi56V0G55qw3jKRueUgZpAx9Wdb9AZaAGtRHtR0mVTFFGJhbXZ3BzFrhqE3lqRMSFcR/yOCEEl9i/2q4d4oGhn1ZEAK4kBCXC9l2h6BA0ksbqxHcrqMqeagfQJAqEa3deqzBodSS5fZf7fUQUKo/WqtPkLFcPGrhA6emFo9PNLI9bqi8kRbug3g426o3BiHleZNaWpP1OmQgiUc75DzO0J654uu8ugTac5YkRYQpu4FqTTJpv+JC5jzpT6Hf9IJ9WkM8yZzF6zF6t16QGYkEDkGIHyMbf7YQYLyYLXSIkj+AYdjwnuTdZAFktnfqz0i3g/yO7fc6OOrOA+VqxPYMG1tUqin3eVAsxH4K7bvWOnaB2PEcjYezenGJwOfiDhev4hkvhXRT9rlQaLWo1svCCd4hfEqn67mwhjsNr+rrY8/mzcMDUWKYEwNq5fc3t3IDJ94rJx/+aYe8houMs8ojORYToeWOhYdN56OWnHH7kNIZsoV3wcP5Tc0WN6MmaDgf4+SZnIAH3f++TufNDyEA5lSuOMaya5Op27hm/lZa5vF4BBy+URop68GH/t+De8wjbm7MB1U0CbtXJ7mXJBDR7gzcvJO32uLzg4I+Xpu1UZ2xctTDcFAgBpaMsQrKDYGIyQ3mFcgcN7k79T7x0Te/E60UJjAd8fBFtw0WOnnAvofALdOTqujzTqz1FugOICk1Dzlzc8d3KebMvj5EWFEifQ57yOcgBsbe0izerW/VXYIGD/+ARiJ7GJH7sOC9srRKV1RfCYvAQmHow/zjsc98hPRsmhkAy1XN1RZ1VYmUy+1fXx0634XfYg3fRTIfH6nPlcCwQWhFCOqim7zP/F6SNhnmx443BHMW0+rI38rIDT66X59Jy4IGWu2TXtJSUcNaCciOENuGy2cNe/eajshzEj1oZl1UG0odp5BpBdGDxQCJoIeujo+2A7AkhE4yFA1nUlmkrRBPKKCBEgDORAo3jpW08I5oEG8D4w0zbwxBuGuwdBIWpMmuj4ZFnzvfKRjxm5nFRIdRiDl+Yjn5jAfODhhqJKATRaFJt6TIrVlFx6b9cbdOQISOOLNws6YGPGoj7ngA4L9rK6/xt7u8LpHlGYm/HiysoK5fmpkcH1xWsLuPVN4nwh5s3qJziv5MTBovAy05l+jEaRQTmfaKtkk0hW8IBNM86hZ4WhyuzSQ/2HCEynCsPgziRPnCyhN63ZCuj/gzZ9oBZdUeg5/hG6tIMLr1c+18bjDL7BGnHhUm7lQNOUsldkX/fZIFozuuKGnGXC1DAVea63ch2uNPTEwZSQxUw+AZNjWaSePQ8F+40dA90Kr+OhmXDLFvuy5Ok+/YD0JIJVJjliiFb5uTGpm5I8SN7YJROhuLOPligCow7tdcKWDukAhlmvXNusawJ9Kh5cpKkc5GfjM+VwBqa0ObFzWWJTg+tdZwVfHtmVjRUj3kWnGBGZtfS+4XbP05TBqRwZHAWUar9vHVEFiCqGArxqiOqApg57m0R1gAH44l2XbOTrXSUclEi8iL0JziA3r3MZOPWm0P79UCSX1V10OvbzWyg0VEyWTX4+lU2/idS0an27DWqdSlTlncN0lDMu1k9Nut495X/h6lNUoZ2whYiwrwwnkKhCiXCK6VDjAlSQhYPoB01fbF7/WExHSLCexsRN1IkG9xWDFdbkPHvnP3iRGDLdCRlVgt8sWUk+Kx6wxZPMPyT8ZVoskB1FP1X3HabEphKOzR+M0ZgE90Lrjw3ZZvNjjpAg7hrduKeKwplpJgWnlGiMVGheTCXXXAVnMZ8zAySYNgBy+5PmgjirunAhq4DYt+9hW1gBMFgb/cHcujs3UyojQt8ZQhHwEu+XZAVxbeCG3+fimT+6eT95JRqnaxkImTEHrCCKS9Wv4LfetRrlorxM93Q674HAcIjT0rmC7lwPjAeNDKeuhsq9cSuGQjRJ+Wn1dqij5/QuECzyPAkPOAhdVVAL5mq4zrM9Dq+KSE1LraS6sBDQiDlgxa+JYyifV1ZU7SD7W21A+JRbZJ/mmG0RnMAwgfIh+nrJbzlMjgi+aGrq70oIaDy51ToqJh+0oCNgINwKcPrvJNEmNSFu5do5o0iLyFNKQNQoDLFPCXEFW/X76gZ7Re+xqiz83BJ0k2U0teFY2mxlM9qpJmjl9SR8+pRQ2vUD9imJgxpGY3QoCMdTO0K4wHaO4m0FPJknsByD6Tpod78dWjcVLO9yk5ZkynTDXNA2GY5Vf8o9DIciiXM1RcOTBF5pGiD21fijlQaTtnXxZV1ElZri5fzU32/74TPbFpdCJx+mCqRNcQrw3Y629tl+lJo3hxxSRy8WPQHOOTP0DfGUsHM88sZBf0LiGeUKiNVx5nNKsF8BOwIqTni3iyeZn+aaJsCmIfeCa6JFFhbYJB69d1KPX3YYQYi1AeGs1hCP/EpKE1mLphXI8PH7vMHlHEHPTgZHloRs98EW9SHQTA1+h+YUZ3BiNEHH/TVlJfPWUG0xR+oo20hNgCsgfIW8jxufmBpyvMXFhN/yYLG6aD5EU7d48LECa6j4mqejpLeu62RiGen8akH2mlxbG+IcxIM5BlACQcAJ0p6MRxbnhhYKiBdz2+NgKCGyhhYPtn6RHxhQnum0GZ9iSOsIpLLflydkX/xkD6BCwChTMMiAKTYVOlPpFhHLkHLIVeE0h6BCj1EWegeBkMchBkbI9NqOFa9oPDXWnHfqEFc3GWKer40oJGVhOc9CynEyw58uGdfybUuEtELSfFpE3kQnSKakw3HP/3j7Si30YfQBVuGcjW9yaR/hTTextlW8FA88qr9AOzOSas3We7pHtECOB6d8xde8YG6ZSGIMhoYfu9sLGz8ZMZB9bRcLrncVqUiB2DLfWirjy3zfFuWtl5WITP8O49rXBi/59+oT+nkjBfbHfPJLG26D13LzguTYPdBy7bA7wQAi9fy605lvysBuym2jZg19RJLIzJCpDBNUP/PARGIuOIIyQSftk0SpmRgwpEdHRZ08sZ/Qjq++YQyXGK1xiXSo1Ok98klQ2nCJi04tgmsGViagNb2Kl/YWJUr+zuuvshBumjatkMkYz8Y35GUz/afX4vcddEnWhZQBhSFAEvDqF3kkV6pC6RD0kske2ez/Mrzzl50BKwKQhtZJilQ18/3jzAFrPzCs2svzWD8tG0ljr2lR5+PDjGecSTka8sgaDl8AFVbokncXltD/9jY8z5u0tdAYGh7JFN9ZuCNTBPB7CraXa1oCDXKBVSaZeiW88LhfdeL4VPvYYKR4YEcLDomkiCF7t+g8bXadg5tKAzxTNxoeXyc4nLcZ8TbE8zoLXHAOqlYqk/RHM3BB8TGxUeL9jWjiFZDtKIH8U1QOoFzvoEa9dwQhJG3u6MrshwQVQEy//DiXW5/P97hNfj24w1BEV4bfXc8UtlqbHJveu+mRqMa75P5kVhDFdByjj+nXQSaRI04v9w9TM/V1b5yLbagMwjnlTGhvbabtiWbLf57r7wu38WdR8YljRr3HKMI6e744Z+RjDo+4soejiZzARvhe3c8gADLozD/WGywVH1cLd9O68onmaA4Y/AfFOLvNuo9jsoR0aClRZ51OOO09EWpMiaaWYWPf4w6QDU7DwG88b0mV2U8gDN0pxrBRNrNAr6a1ASkOemWoifUubBt3VsqTrs1lPVE9BTkUh20+g7rzJxG9x+9dwW4Xh4O9y+Pq1VNhhruX77qAwDRwijijtWQqufvcjNX2rUcwmTQqRP1y2/3z+3c8dM73qV55ygS8ysxx+apKCx4l9v+WhCHBpVCjMFLa7jaAqx1cAWXGR0KKChNVXGu1r74oLOfJKg/lLxn//BeQUOxew5NB7LNl0yVqamopMNiIIKAj5Fro0RQR5mum4FhKCuMVT5Hy6geUKt/UJPchPT3PFuioJp4lheHkbI0pYnYWqHokNKfvpzbl0+Hq4WH64awour9KZTUYV8aKRNY1GFAMNOEHMipl2HUAfFoNeh4+OeCB8rDhlGtHAnmrDdHK+Rj5h3e8eFdDYsmIN3aAAcfB6bojJmkKMkJqJG24JeDC/CHcLDfCHEpXoGFNLCzNa3LT8a7ycUdw9b+HJ7wV3ZccesXGKNOUsg930THC14UHTGYcCWPHsrDVM4lfsLYObs85Dz7IJoltxVYBHUYMalGoKenvsV3UXGk0sTevu2heARPDYFPxVcoXx77f5O1lKmYnUhjiYxjijb5pbvb2g41VQCZLhemFQI5nsF0iu4wumuwO63tAez3XWerd5AX4L3iwtuD4hGZdU0w8rGMJHdI+O5nPKz5SAkgfKiI/mly3IXBtZzxtUTJtFRp9dsPOBsrI430vj2dpGtzjRW3ctrKEg/4uUxqdWICY9UlGU65khOtt9GnPPDM0HRZzvAbcFdjocxHHq9Z1iTuWgFKTJKzYYjKW8M3iaT1VNqPOnXkDPtbt961I8jfof7spppQanmwUCeE6+AXEsicEylkE8zIADaoSfZL7BMKEcoPl8KfZNkNV429G48V+l7JW7rTbPblU53ND7ljxQ0SI8KdDmq+yMz7gmQAEA/XU2KmzTR/84G+zaKypaq9D8YFI89ZGJ0woDZzPCWX3IBC3dcW3PqLqW1fdvqXUBpm7v6sM3VgyosCtm+yJCkowX6wpUYwy8rCTuSxjqDHC5XfoZR0grYIolS/JDLD5WTNRaNT1Pkj6Xve0wFDHPb8WxpH5XH4XnCJjX/6sY8ACv/YgyiWv82oLjbPaOtvsA81i8KVvLNb0BGqvp1g5MFS89s6fI3WNFuYNlwb3Vl5R4bPWNQQFggzJZOQWpUyfPaD6um+i324h6dVpEPFmqIdw3+uRDjhtWEn/qlM13YNpWLIT4G8fN0jlRLZE50pTrt7WtiUH4LdB2dZqmoeH6+RPsl+mYxVeKV+NbcmSwqDkqHZZpO8ple1Sr3sFYeX58TBsVI82CJBbExeD0ZfM9xzIPNg+h9gluUBHpUV04jIeVOf02HiXExRJoPxMJiP61ZC393tOaA181OBEJEs4qv2vSsgSNDfx98aui/qQbfkjcy9huw3h7UnIJ/2DM1whayaHS+/+Tor51Eg7t0xqfr/pd14VNnwYnaUfmJENQkbAMauehGnQHuBuC1qidrqfkX+sfxrposyVeBvqNZ9FarhKamLV/xSJ4HE5fhpe/dlqQfSO5WQXEGiOwUpR+hXFlDryFlOHQf9YNqL5R1ikDuzs0S2BU0/bq1iyCFHNfxMEBsDCMpaQrioB9Rp38Extogynu+zxZv/A0UY8V5UgXP0JjfDn1ydjqBIwGfZEKxqznt86GosNg0ntmw9b/wlUU33HkKnyamppmNKkWD3rq6DhhLCiP7aK7KhmesPOArSICBuPm2BxD09RtQ6/qjL740yiTtz3qBpaLjdGSNT786Odfe7zFaX2OAD71vhzBHa/ZDkxPk0d8cT9ClMJtg6bQ1DMSLQz8rYAkmmvP0LiMhMn2XBWe96ViFg25z1IDa3wWKiPasO8Qs8UIGDV/j9M3jCdEz6pXCc/zMdHqtTzPvMq3phMzz/uBvn/5YLAeY7YaLtpKz/7XDMcTkg0MTlotSCvigonW2Yrn1qXpThiUbC2+r9MGtNsjXrumj7Y0lTCWBNOzywsjs8N4iegdZ6cu9DyUQ+fa1cmjHqV0UZWhofVEi6KY6clOWJ1OiZQv5upaglFh5RlHRJwx1nAcMEFa0UYUNwaHXZoLlZiE4NMaIJqEFlogBTbT/ixTwmUvyknkGJOk/ifAQmvR6B/K1ASn/m55rj3zuhahkd/2k0PeH+qgJHG2KrVBasi0J2wY9aGsmLZNjymE3ppUMftkw5jTHzeQrQq5FzcLH0jdpVqShTrZuo0kj2tAcWtc8vz02al9ThOFYo34Bn0n9R0oVlsp3NyYGjDnEEPzu984F6y52u2b6mPhLCgJprq7WD0NYaPQ5D1Azh5krLPsSQfV9ugZrUvPa6QDghoHep9qEXdjMuOwmFSP/2Yfa05oafsYq+mA2HxemV1UFjkVYES+1J4i6duAyC84LfNll8uf4mCGKB8OM1iR+n6K6uF82muxcUVPDrx9wRy0PGXnizIkEceK8MCRUzpQlIQG1Zq1sz6fwoXHWZo0NwdlUNB2E0p9NAiVWP4JOVIDEgOjPRVF5vRqx8ES5O5mIypORRAOBVXk1qjt1jeSoWq2EH7Q1hCjhLHvqT6qF1wQ6lXiTc3K8B7bifzEBElwNllVwVRojcB8kWBmPGXp6DJIdn61khK2qHeV3aUFcdABSXcAG0d1Qb2lbHUfNVyoAafldEqYrjmwWJJg2pvj7oef5YzW5KxA+rmrOk3XnGSDduyEdn9L26vOC9DdkBnkdvS83b1Xhfdx95K4iRK9M04R9uP5IdD16Xc+x4AluGa/UsuaXn7Wz1rBFIjFSmemEMZklgWcKAF4imMWkL1iUnh13a7OeYNMwl9kE1xwHcQHm/QoxQvdlcnpY3X+KobvqvL+M5zT4f/EtvbmM1y48ucsMw1ZkU5NN9hUO5vmdY67vdTUBq2LaSgXE/EsWkQ+rY2knr0fVSEPNstLXuSMNO5coAg2oN3a+7DH1mWk+eZNEDeriH9gwLeFGuiOqphwG7KoYYByb4gcCTgaTUd1Xi1jyrBvKkXjFZfVQg1ZQocr/Ft/RCEyF9TzL3ceVcy/2E52tMpzlnck/S/fjWaqRWAyYb8JgyN4tHykbA+7o6+c4+SZ0LP2AO3BKwPc1BAv+eZYYHd1HDvri1P9SDJvhMfhjNcL6ozsga2Th+kQNKpu2uKgfgoInOU76RvabaANNwBK1iOr+qruPkSafHvbZd6TSVNizUt0NW4se9YXnL2RD86ry1j1gNYCuofK46OfXZs9AUUqMTIFlPp7TRXVy6L2QTT1/CvgUK3s9/FkX3vBfgWsnFou8DMDSIsRPijP/OmnOwxF5Wn0m1zauGW8LwsVAYwmGbXMbOZNDCswqTY5tcsZuqUoIZuO92h+wnXkJ6wJB+z5TpQZyUMsYMcoXaTAY8V5U9yM6Mcgy7OC/OkAW1LCIyE3yWp0Q6tzn9MWEvU/gLZ6ylx3e7O3ml69GRhG6gdqXYDxlWBhMHGfhnbW93DAnq0C4hj7A5fXRiyKVHHL4TW5rIWm0px4MbAkT3YLzPhQdHRJ7q0Y+JXu35cN8Mxe2dVgWO46ZPhP8YHcTfFJ3TNVjvwwUTJKeuLkRuitwDrMHnE7veImMzWDIef42rHJPY2UVcAuuW1XlJmjEw6XfHPR0ycFPhmuNNdhQsX01dFm916ZRQCmjpvo7ge1EGPbWeue5/YPXU/LWjL7bH2rbmZoIHSj4yJBHbWJlCYT0vGaRpPh/7t1hctvSQ9AyaQg7YuoygK+kk6jixInxbXs3SufHU08mM6y84132Ot13lUNGvHHHJc8RWDOLOOrlHVLw74li8IJj5BKINNj2tScuffievx3anNQI9vNt4tVLXBs8QXWz+4HhBo1GpuGYPN69aKhQmKUOW4KztIb5z5rNXOh+kOuf8HSyisjAwuxMZdB+Dr41YT8lRcaomdR+FWxhYDTo0JbVVi7QowwHHUmpBZZjsIT5zUiZS/l18G1325QRmIH7HkAP0KpJMXdyg4gwWZS+45MXqsw6k+opABjMJkcEaWqgr7/kmMZSWF9v6XODIW1xcDfc5OXhP+6K4Vw7IfuguH3LSflYjjr5rsoDYixEKXECv8oxPl3BL8dTZ/LX9HnU+hDWzQTBeycVsc2+XsMlQIoE3WQXMWzIXaKWaNSSdPZ/rVex6rVd3DY4j7BXJLC6fWL+7XZ8SQz2aQ0xShYK6BodG8Gw9WCR20e5VA3q6d9O12Ml8c3dfRf6hcdGAs4NzmnKlKX3d2Ln0atEuEnYnbQ7BfZR0ISmZv2HPg3fruHefJTrW6C9P6SsRAuhk4SSb0K4gmtzh9EQuNkuEO/rNLP2Snk30iHeJdSJYJ4du39QbOzrCj9eBVKbJ+++7NAv90fwmcYa69I31EEmT5K+ydMWOZIYJoqjjX6lhFY54tv/AcRMH8KyrRrC5aghIMLIzAV2M8bx28LmAtoMwqZf0+wVzo2t9z2TfJLQs0dgTesI3TRrB658hw6k7FWJzzp+puyhIaaWitqAaWCWkaWEIFNfKVHQDYGBBaYuzBVDxVEERW1fWCdz/c+NJHAdpCM1NHvRv27FoPfG7axGXfNI7J//U2jk8Z2F4tj1b35FGzkabpQiTnx9wBVKKdR5aljrdGfTfjzIsgHKoeJ4WVeaQ676AAL0dND72/FmxvkOcxgn8nDhT45303Sx7PU4EPedH2fqaX4iJf70aRMOTWBs8G/fqktB5LTjke0brJhh2qbYqnog/QvSVa4VkDjqxFyjsGmgRfGTMmBnXl7ACfD9IkcPcvRAsyRVW8mcdC6Rvdgjhqequ+q99dLkqAxKxf+zxmnIj9lyfXDf4R56/S66XoeBz/nX+8mu5d/L06vWr15o6ps7n6MEfZm0xibILpfKT/Vo1RGXmMQ+qRC5VxFDzHgEM2Jk3Jqea1uFy7nkChE5K6AJhPPs6z2X+BiROzK1cphjRVCzKTAKyQt1rgyK8Oxg9Ph8QqL0u2XG3bgQDIiTiytFe/gAkGh2uwslLMkRG2iFMZpqWbYwSJ4LDvt8hZQ7P8L8rN1VclZbFq32iHqmpo72iausPsNJLOgo6xc1ymz7VcQTKo603kc5GLGsWw0dRhvWhWNJkLyLP3k/Q3SUfbURtUD58lc8GHsusKpvtoJ9P7O+kh2NTFSkaS87SSrJkSqQuIxaLXiAJO/EPKa3GTgAHvRjhfzhyL9/wgPpS8cOgTyi7ZeM5TFSlPYeEA+rPIth10wn7YebOIoRQyM5hJ218iit5IXf4ImptuSGZeON0QFFHAy8HVoYlUnxaf0eRFHldk= template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio/ss_servers-auth-server-hostcert.yaml b/infrastructure/secrets/rucio/ss_servers-auth-server-hostcert.yaml index b0c6051b..0f846ed4 100644 --- a/infrastructure/secrets/rucio/ss_servers-auth-server-hostcert.yaml +++ b/infrastructure/secrets/rucio/ss_servers-auth-server-hostcert.yaml @@ -7,7 +7,7 @@ metadata: namespace: rucio spec: encryptedData: - hostcert.pem: AgC/o6hAW3PPLnIaDzvruEsptPAG1/5qJ9Rrr5scZrnklfcqGRNJ+24tWJuJx7QxxXzojSnp9W4HkMSiRKaM2m12GEIY3H6o+OI9x/ZL9mjncWciCLMatRq6j3SV2Jobtu8cHoIfdXUkwG+2+1Iasja1s8JB9QIInU+AB29d8xpScVw/gC9ssNy1fugkcarWHrK/ja/h0H69nZ3P4L+oWQgNjDkt41ir9nWGbv63c6T8r7v20kcZFY3DIsT0/bFnEUCr97ugwuHc8cjxK3pymI6KyqWRSvxXYPnEok/Md/IsNKz1meLywfLcPeWU2Ms6Glir5O0/Qkq3C2VdbEBJfZHdaVcY0wGiCsbcf8LCR75tmM1ikfWP7/fJzhF9GQ2wx8ZG02tMYV83J84iq648/pgIT7WcK+DTQUvHoHwYAOGG64bU4bV+trPqq5YkEWvZESSR4c0gi2Mb3IY0SepQ+/ujfQQzBFuBt33KVGSlpjxMMCV3rCx/6sffX8EFENq8SsIt3nYt42QJtoM5JFUZzgrADGo4RU6sgCxfP7IwnhQIPD4+GznTZcdkBQ/fG1y0tRtGebjCp2OUxmEiVWghxuI8YBfOc/dKlj+3ClgvFk0deZljTtYNPRVgXiEe/s118Y9y4lkoUODJ1pbE0gmdBWDbMnSlU8ENPaJl/h6RNLDAZYGqH/GAtUWZbpjoRE54glOxnRfMlt1a2rXYxq99b/njfkvNVpeZ1/yAvojV9zixTca/qmZlu5wxGhwWNJZXLZ3yjGV5E4/LRRn9De656YzPAywaNCym3pa/ovbx66Bv5MnguLOHqKQm0tSvoRaEl9h1TOwW2ixQG/uatujwyv8UOixQNtJkqles5OR1LztMVmpGEeFf4G7l22ZfPOOdurSIi/TC2At3LB2fipV9GcyV27gqP4K4b/W0tbH47xXaTeWjpT0hB4cY89Mk1zhnSv8no+jWvA4LPwPT5s/PX+ZhhlNNsSuRF/NIA2gR8sCan5o6FzGyVIXqsmiiv33j0SY5o8HN5CZ2g9Fxiu9O3aHWqKyuJeLnub7N6/lIeQ4Og4PygefkbEVJhHnwOBNEk0l/D031FA/PKHSdxIiHxRDZXfVaF05n2ztxKRvxMEkOjnBMmQoZLc7n1ZanNZJr8VWnL0Xohx2xhtXAnIotWxv7l1GL59gPvMcInaKwJGU2PuOs502Smqz/aeMvEucQpWiPESbIwA7DTbhxjlifkLWUuv7jM/ParnH9tSctV+SCGWCWw6r7NfU+OOrwS2yxi9LPvJwqi3aR8cnuUNQ/3UxSN5+VA3ury0sxJ3yKiVFOWWbLf9fRhAfzXRVHywIapMXg3wK21OZCxCkNL+dpkIXxvXiEh8IC7g3Xz6U3uQaM+Rwzfj4p8KRzBuxBPj64R7NjY31Ho6hRAoXjUSPw3vgWj4FP6pHIG+psKJZlF8UuRqxmHQGKnluOr1BP35z49ml0dO2A0DP69yR+q9WmzCtmgwg2rJi1Y4Dxc1qqeBtcw0/tdk5o2WEjVXRbC4hijbbLDDx+QkY9Uc9V60yXqv36HQQGVhm7fXg1s0rObgkpCX6jbQ/ohF3bVxr3wIRYQ4mBZPexBLqcDJCnaAC0LHpevrWyhDteI104gdC+HH3VlGKQbh5uaYcdxo5M96Hz5kRbCs/4yrQChx4wI7SblKLeFNImMWG9SgBOYMrzOLMoNjMSIDfFp+XW49fuQ3Qeei5dcBqCvHwsxkqAL2t1NhvBHw3e+7jkwygtiMKeprKFdVl/ojPOcbdUfPgTH6UtYJy66WGOqJYRP7HedhzTkqz+AK1DmfVKZbsj30jr3OF51lJBYssSQrWJlmAB4wB8XyW3rOT+WdHTB0rdr0ifYv94HurX/cM4u1kiIj1ACqSqjlm833WWe9R+K+Wun+a8iQNRQ73omM2CHI40I5eDis44os9lUtR1qp0PJax5KgHv1DUuLbF3UKi+x8A8NBITD3TZTDP69fTZNbEgLk6f9wLT0+S0sj7VIEbYOjhT9zrmIzfeWTISsA0DsVIYN8tCPXlNBDqQmcdh/2aJzqatHypdkRClbz7O56nFsIq7Ug+XU2zNebGQPlNKGA6uJ3NiPD05YwEk5hwINXYX6x/t09Ji/fmPld/aagJgPzxvJhd/MC1qZfWPg7JxiamvtZ21bHpk2HRV8iSmVb8/ZF0uYj65Rc+Z2qdxU+8YQFtO5Uwi5t7S4E372+YEuVXL5octDGFZhLIRLp3I2LObCbQpnSxFQPOIZnh5iprB8V9fivueHSAABUm1oOdyoNLjt0f9r8Kb2RteyY3g9hcJg6GrkTgIa/VEAsLDnUR8syrmHMuozbw/MO1LkLxbeXX+tpd8/b+hmXg14BAMXHoxsAnVt32yZp6NIJzdPWE/3TFOvcl7PO0NLo3iHYA3UjdSsDHWqfsZPDOoM5IXoi9EsfgbcoOedRKImlFGheP/0ymp2DF3zzL/rk+jqQKHAlw2pm2/jeQPEy3n1NZggFJpHL3HhYI6XFW8t9/i211ddjdBHRLaUvvpP4Qv7LcnyO0B0xtq2T4mc1XJaL3pdjzREo8hdDl4BS3T5tzLdRlyFNGHwc2zAe1NV7VYU9eSnD5SmZvFHBrJtmRGOe0FNpm3Vp1DhcgUZgunkgPQ6YIkCQ+TJt0qhOVJnJiZciHCtX7eSn4JJs+pQgOFJcmOfm5fEeGwBqgBvfXroUTFIJ9saq+XOjbuKmvg5rud4Z5XOn9NyVDMhty/iHu/YlyFhR6cBRya4bh/8WiVjSPtRqXhj7LvyeZCmF9uNMa5bslQf/lVQrscX7Lqw6hNBdIp9dFDdFwSTTUF5HYDRpNLs9lrSnp5YtpOnPCWtBrztZB5eft1RcFRKffIFuB69irQBHN6iCyzx5VhUCuQIgtAVLJxqouQmQcDB3gFpP/PV/ErL1JCloOojkYINp4qdC2XkDhWQXLaySBB/y3mu9wBXvFJcEelfkdsdUZyXa2XzMQR+yYKOVQi1htXBpa2CsZo+dAITA+XAaO1xntV0gBItMJg6Ul0KToXLrn0p6UvKzUnuPMwjTNnHiQ+AcctOFX8lEt+4ce+ou70qCUQoQgLsyD6JZbFPIrwskpWggUllCyvKqD4TkO5QH8KPfiMCqQy6Zej1p7bizwWCabPtE3gozUplWel09i+QkU82sGF0A+bxFNj4+tHLMuWjzDWhRB3rfD2iDzs6FFBl9M07sqkhqqytmx8mue3PcXBnWJWCskoH28EjYQpUy55GPU0xtk0DwPLnxkim5yteqa+1WX+6KjggialOQJjO7/7XmvmRq6ikL8/h/LxPlSV86C/QqpIWFWWa7KhZB3JCAfSd6JLRssP6yegUHG+iqRRVP5IHtrFPDojYcDfxr3oT+fc3XHUztd+QN+hVYEkt1H9JqFbhN1tT7JDymxGTkX/xwqKI75eHFqPVuxScKyTvamoTWj1Ia3MsatA9j7ltWmtnvi+WFXQMycScWuanYBv2MFi9rjSMpKn0Q9sStGDxRZVslpoqNagohVZAUdpHkw37dvxmhUPQaJIB+viI3rzuaX9J1/ouXtRhpr7Hjl51L/gh95YU1SHTtVb9G5dVe2b1MAPfM4EmVTqXfbq09/1mJOGs7B8hiRaadSAZli2FEWMas5adrimdufN40Gw9HSFKj0THghaX4wrc6NLyQguztNFauLLILfzK0bTLgoqjHBQ2ZwyC3neFduwWnnmCKOHd+YPSIh65BfLb9JxONCj467D3H4CIyxc9U/3HjF8iffj+kVzoVSHgNvPCGoxRRhZrTin+6umlP9NeV7280f+LOSMm4/trhBgILJzu5hIZDl6eMXFOyYy+5uSZk5074x3CJZD/pqsKoNQjieq2Va384Sma/83AvNJRLtCwF/+4xxpsxrYJs3xMW6eHL5JchqMKPcZjFEFhE+/R3MFWxF7A6pnQj0y8cuSg3k6VXoZUTMLLcT/Sj+CDXrrx5mW27dftVD8mznksZNUzOGLqmr9mYHW5nfPS+6LNct/XwmccWur4QP6SbVtjI/PIJaIfKHcSi/G++QUU6S59rvqjq9h0u75sd4fgZCVzoWcCSlSoz4Ja1r2dZgQxKMvTeuawIC46XPYB0XW6zFxB+HNLoFDOO3/3GUVWCrD5xSRIE6vSm7qiMlM37VtfuAqONEvkKOjk/szs3WwPrvXHmtg+Mxs+psT0kXCAIs068NSWhzx6W0DIpF6az8c3DWdNFI8VNoGKD/T/9LhuGxH/d/yuq2dpG5yBNrZbwf5W95rAEhZuw81K7+kkzQ5TsdmNZ+SS9zrwe6roP4t78NXL/91tCnWGjXhBK80T5zBPfy+FiZCuXi5EqeWjvuykk2FR0E2aeOxbH3eck005Nfg9PSN5qEOaooOKKEXJ+q4KK2dnWVWVKwCy0G8dWJ5Tkb00VNvm/g3fZcE82U3IBNjFZhXYKkq4PkduN1xiSAU/eLdx5VwM3SqRzk1NB3kxLjMuZwh8OvJnentRrk4YFi/rRfznL/xGFgOc0InYnygumaONpxTyJeyjq1cHRUdtF4b9awwOjIgsESb4MMDWq+osx7dGJFr5Sl/myxV+Ej90tMu8lecpymff2h3x0eLCOslvSrlRCjLZ7BXZyfXqunzWuY2isPlCo078zuERYWPH42U+HMkOJwMwOHBd/7vlhekv1JKLoT+lRvbToGaSf21GDW9UQY6aj+PRx8cnbXrr8zBVmia/95BozX6C/oejHPpYsX+Rh+gZ2mCERgzlB2eJRIyo640HYH9VQcR0do6o7nwnJwK8GTj+2gw8+Br24vhQQ== + hostcert.pem: AgAxE7YhDSuJUmFmms9bxbMVU9lMnQvVAWHbp1AVsSY1742asXZQ2sf6kjQgrynMLow3cSnTq+CC57NNFL8ApP4odGHRBYOMNv6g5z2XmAOmlKXRWI7eoEwSr9CgatG6k5oY2hiKvxQn0V1mBoFMZCYfx1X0qpGoQshFYIeC9LyQFD646f8q/N/T4VuwqW98r1Lz37Sv+HjG2F8bGkCbpwg5ruoJad80mEb0FV22QKhIWP9W8Dvy/ZAw9MCmdTxP2q47PaumKU3M9/i7/RSHjHSIHI+kJAsb8mVzfTU5dOu4iCQ0tg6h9doqbPp24ad52ZvUdP0hi4lnpEvGoK8YxYbz0bz5zyDFyq/V3ka03q9GxwKWlvYWqryzvgfH7bMWE8XSRwEE3bFtw+xJ5j3a5Dscveat3QurwZqCFTx52i5KR3TvYOvFoNMLZDWzAFw5yxVtuNvLLSHJn37JRrJ29ip4ZRZQOWiNG3YdVzkKwODCgeA3DgxxH2PLaz0SLcMBiEQAXb7EWPpA7YQRqIOlau/fdWWCiD9N9rmUMSl5A88Y4hgZmmt7QfjHBTP9d0YvUJ61WMhvRrsL0jRc4mEzZyr9BggzEoWUhv4NqeZV+OAYz5LiCPFfo0NVsiAppeIYrasVVK2TLvREHN2B1wxqo39BJJRp4cCV95ZfJeNKwQtqYEyjYjHf6SVKjl/FSqEA/Axu7uhXQT3smnNNBKwwv4GQ8DDOa0Q9ha2LmWtX8Jsomgg6TyYOkCNmSuyDEpkn0Q8cx/xfpwixN0Gg/fjs+SFntkCwzraol0hV23IszwaA8MMgvxEpMaITBfNV4QiKT7wemltH5BoBO+yYkvu2UDi1VL04eDuzBEJhCYiY00XVblEPdgXyjWRUYTgKzrJCchaEsxjNsejTk52XhJYjxs7r63GYl275U4zlwbmZSW+Cyg/EAwCaucb8F34lpFWqDbDSCPmdPH50PkebgruO3I5DDHreDBYf6Q5+WJ9QvZ7VqsMzCWvmtFqzgd0w3x/rIt9k45AQvmfRaX9bOTDtVNDNNl643pNE6zMOgdLQ+WqOinFNLKBFtXT0F+TiY9ZVLyhAFw3zpf8bqZJqxoDtyrq9lzkgvxy7nw3PA0mvxoRtjindkDO27nsoIe7j85zgQJcQaKvLPECHqc2m69T6nlFOiZHiseiky91+1pb5iRWxXG++BK7r2gQrU2iq1r14ILuQFemv71h6xoOZGpfESH8MNkf3Q9i1FJXnYEEhcIyhucrXNcBKnOuco6kd2wiS3rg+8WVn+ASWkv/UXQRvViendKlMQ11YTYjNLie6FbQvu79+wgPgCECuzCHgNzHIIEjxmHEdiBudJ2iK1Mr7/Fbf0AXHk2CsvdNE0mqin1VdYT7uKNCDmf4CZFxumXE7LJggolRljW2PBqbL4X7+SiDr6nvpR+aQ/iKA8EIWd699Tr2MupAFeC/Th0pXpRbNUxH55PGlVzzRwqo6Fra33wuxyDslgV/NzpcWnJJ1vnrm3/rDhTdqJiUvOBWWoMHuZ9Aij6ce6Rdt79WCtaiMkFuMSgov+M+LsTu0nvcA6zV1Tk25WDfnCd2eU1hPZpdvKu6id8ZeYUY3i290XnGWEsKKqrLhThxUSs/0sBfnG/KAx3TcoupNHDsDzpZGeCzjtk8THQyVIM0MdUMje1CzsmQ00dSm9yQIDmpobhsdChVpWQF+cNIZW5AQNQnjwcjrY4BoQDqWADnxObOYR3LArKzzVdJcB242CLWZU7qiqXKnkPPrbdoA9qo6cPH069FBlbKb/ZIUs5x9oNgh689M0GVz5boGBNx6IHVaE/V2bRo8/Yicj04hEdsNQpfRefap4m8rFe/ScA5hpxAKEGowUvl98O87sb7k2pmuT0VEfniffrDBnvdcxdwCiHWWp/XJVDwD+LxnJkMDFj7QMKqFKZ6PjtFJ5PF/fcHgpTqsPjV1ojkPIS8gzu/dzdQuEpZ6uc/zQE/bg+EEzGwrl6xkyhNLFXdCPt3K/FvAEJB7E6bE+D1hi+GY7e+poGfitHPExL79Y80oRdNQL1B+x4+jssnV98vbeEJYRgfdN5fuPpPBDSnwaNDyhsI7szqJrd4dwEdgR/CI5uyF1/kZXfYVL33BPJ80fKr3HBaid5kAAroxJPKwrjb7Zn/jX86qBflQuv6CwPQnF1lKwXiI40Xmm7SQ2wtxCLHdaWeAooRuflUnpOiQrKEG4XvYxC3o3Sr+8mPVexxrDcPDl4PzGTZplQTKgVdBWxKru7ITUacpTR6+i1W36qV+oC7Oh4u30Ef4ETXiH8hjmUtxO3jyfW6mSWWZNqaoZkoCfniuokxexN9CjgQFDmYzBh5C7jHTQXKxHDA1AIK3wNdaV1mEFZWlxBbN1HkgMU6PddlxzQk3V9qcMIrFDUIOXz8HM+zp/AWOA3SBBdFBUVjtXi1511TAn7ombHIFhSUq/p4F5MSgrQIJbv9wRpGZvUN2MRYDZl9SUh9cyV4tVDmZeeK8aM0IS+h//riH71Lt2V4sFd2DhaxrteW2xpbwLfgfvHk+Xqs7DlVl5dLl+oUzC3vsp5VyCl+sZBNMxbh+h20m3Q6uqMBeQ82wnbVCso88oYZeoQcgcgO9eVms/Be+rwRYxjGlRaE8TDibi5jGmn9ZSWFijHvg73br0qdK2Z9eQCoYoW+qk2dXn38X/isorthqD5q8gU0xA3AobJkWY44m6fuIv7bCPx5tiqWVY3VwKyC/wsatIhYl+TgKbgvzyN34A5MKUgq2GdxCG88xaj5AWtD+zaI6aILRC8aYJTeoJbt58p/+zV6AebqE89qG2V0P5/xMsBD0YdSJLbOQAA/HYEKD7eRNJfctSgcGrdIFNYRjNdyXpDkJHnZeeCtaWBy9uBtLZQqBuGnDgtWwCJtpqF1RigCV0KXYWUWZyj5AANutAQOVKUaNXq7Q5EGHwd07mgXNq6JCFIm3KLDI752JzRSR93Zk1mYuaP3rqp3yNt3uwSZw60CwSe4pnNevfeiqRh+DCcQXvT1wUfFnx+G4lb6eExbd2ey8PQGL4j6d1HD6dtTJv4/AOf9M7tRH+NhQLK9D6B4cLnjauMoyToiuXJKIK1ntnR/q8xm5dhLVDj05Q5DMbpo46y+YhYpmc5Wkt5wGneLCoxdShqliQZqPjfj+PA9iGeAOZP93ytj+mWjIy0rHZChLqH2z7vNfmYuEIlJ+c325DtjgZ+1jpXRSGpa8WvPt+5suTsQs3MInplj6ViJusLOS/wc8uWfRqmPtluqGDt3/hg9FPsHa3hMxwXSMemlDL896spzFYTM7Q84USQyYACn3Vs4VF1oV++BGpqzNQHuY55JlH33O5JK3Qy1d7XKKrZ5aUUQlYHTwaTWhuAO4FDL9keVoeOgC1XZ7sgQrUldgeIUQ2QWSKzW7aPmCOoAyypBifVK7okyGrLeb2B8MK/hdibS5uvaltd6HwWBV+bh5DmvmGXdNGjQzbKxFfM6tty6ECNB46g7W8vvpt2yN4BdxZmNfTo2Puknd30X9XmwT3CrwS2im7w/EFo3tcC67nL+sx9wP8nsMjRvvQbWNa+yH0/E1FzoSX2s4SZogD/MO+cKNf4wo4S3SKmgpgWfjXx12qivLNwPBHruwCN3RBVi99n7539jTNajsD6kLP3RRdmRGqLlSXMu/Y3F36/9/FcYk87alFnIXHkmg26n2xWLW9N2VszXJDBCn+Vu8Got/S897oC8P30PP83VvYw/ICLTfFGQIfI0nUu6iG+BOaQgqU5tPfIe2TU3dBdwUzuDFZafZJE3/0PL/a3Rglg8hLeoTpkx5GVNyGsNeTvD88ebkIfB6bDXWl2Z0spEneW7SeTETvp/JJELhDWAz4+Tm9KGDF0OAb4PYpyNjkaGEr3ME7uwPRR61zNjrIsF62Kb7qyczvXiGeHpYFoFUqfiJkm3x0RTdg5Lb2vhKQGk8no1IPJ4UjdBfRcC67tmQUbY6JtKFNk28huZZgeeTJTtl7VlPry1J7B9221Zdv8vBSZIsAi4o9zUjIIanLd1oqK0/DG7xUcnoDYgNSrnSujajGkkykMoxm+ZtXjwnpVEX/XgIADR9ejQxXAazutYUDZQKWgoSPmHioKOOIgriDYtd573JODtIHe2HufZIoL1eqNeR/XfO2AQ9vwXf978THw2lcJKNBNjLnIfFOgunqBpez2vXrcXg6nEo9q31Msgeg75OIHsOZvaDwnVz1RPD3cbNj0KS/3CWV/oycQos6DCXIYgsPdjUuSSqKLXp7I9qE1FVxSl/9xNbnLMTov/0jsJjxpbp3V8przjPonB+VgTw/aYoOftKjIHm0PpYKIz2H4H/Y3Fqs9ZkaOASitugZNWvsod1Wrj7CEWKEb6kGqV+lHutn+lVQmV2/oJysv5Bt88FeMnUECmdNJxDtwPwRLpbfm98Pe9fF02dm4jbPJKQ4sTPXBIJC69fbK8OAn61RB/uAoyZBfSiVO1R7mAbJjkT+EGkvx35EDUI56n4zDL5CGletuE/aE4YUfEjSXI58Al7C3rsAyIFKijELB7JYAp1sdxQrKm6353bcwcj8NG+9BvnqcLKM+RCUCWU49rduUVut1/bOXK+zQIw3UBrERq+JHYV14BXEtmtHMOyrr1HTrTVE2DhK967NLIb2H4fWJxWvY3wBcgfvNRzb68pKE7EqSLh1uFFmKQ3Sh0dQ7dZ8NHxxDqgqKzAaNn3dEtjkQ8EKYfd3z+FaMV/o1Bl4KJYBNa7t26eBlTi0QoAtYOji/7Z/EVL1c9ZZlVWkanbzddVqMzcODwku+HIq2XKyA== template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio/ss_servers-auth-server-hostkey.yaml b/infrastructure/secrets/rucio/ss_servers-auth-server-hostkey.yaml index da10039f..c9b10d0c 100644 --- a/infrastructure/secrets/rucio/ss_servers-auth-server-hostkey.yaml +++ b/infrastructure/secrets/rucio/ss_servers-auth-server-hostkey.yaml @@ -7,7 +7,7 @@ metadata: namespace: rucio spec: encryptedData: - hostkey.pem: AgAmChKnTSk9lurvIq5niXMSdJDhSVZs8DXpeov/wYmUJcYVNpUBC3A1pADHk24x5s7f25xF8v+kDBooiDqKm034vBYe/Lm1fEigZVSdTIn6UAy7VOI6StkringgXvlfADxTtq47g8AtZhMUe1+gLof5S8d8VEYTCzcZaM+y86ecf8J60zy5flrRKbCzZL3fyyS3c1e7m0kkaPjNooDu4VjLNSbcwc2Eif543QPpmq0/rVZrKbyOXs+QWV5uFMn+B/JJw0gd3U6tGgZxw24gDJXMlisL0aYhx1ZFPsRJh/lSfD7foeq61+rzpbXwOpctuNVKznt8DW9mSMCO45FMq1vSaEIxtdHPy+49NyeqFNHp7zPaSWo63Z7BXkHGjLxQW7VDjjKlTM1e6moFmywMW0MZegzShF1aI5JVugDby+gjzuWTtgMJYBRpydVtecHejw+k1jyaZWcPXlXj4gZBUE3ptgYIOvMpxDXuPXxF2uphTRsNODO9opH9A35jPPdPkPqy8e0cJ7sH67wQZuGWoUf5YmtrvWVFvp4p6QhnkgT881Vap+rls/6q7ueiPVFAA38vN2anU6eHC0lbSVJQshXtSmoAztM2C5/USy6k8OFML+guXChhthlPUbtoU7bU0HLk0nsV4vpWSUIXwKBVJHGkjr8rpubTaT8IA669lU78LkX+fjHzPgXF5Fkhxn41TfaW/Ln2UCWURM4JMAdzzfz9g+jtQXfK9cLzlBY7qGCZO6kUtKBWWXACf2RA+9RtTqes0BOjIo7hptJrbPjjymMqd7Tl2UIfpmwvb/mTHxMEcx8Yhe7Jh2GEVma2tscYwRmCdUNTgksMQ+gKsaCsKA6t4NmVpuUCJLuhiij8w2/xyMT5tuBdqK8AJp7eql6QkGc/sbxUKCnLo6pggAy0SIl7lGrHuTCSJ0X5pGYXPY8VDPW4Zet1UY3CikTYGTbc9/xQ4dsB+Mqq5wcsf5irC64d7xjiDLdd3zOb5tC/FxH0z1uVkbrzKlK+EOPn/iWxqeaENAysWXVyxBNFye81mXWWqQti08qAAsowp6F+LZEf6QfFz4HTkuLu5rviHLJpR3eTz5VlxEz8CyjMg0XquiPKbmbfjXentzyvwwKunVgrEkSXIokbqZJsu92FdLPK8Nx8Qsu7JCj0LssZFauNGtBFLzwA0lRSa/0j3GNEdsUE63fJBwHWlDng0ORKLq4i2nq6GLeTALJ06AGsrk8GAjQoocXqSu8viiUPYwse/7g6HswBXVA45kd+V+8DDAghhaJ9e9bcZ8V4V2PzF/uWjEIRGXjSoh8hKoIvTuKkti7J2tYjh1KVAAHJkB5VasDna1SN053x0+A76v+uP+tufmIzsmH/l2CtukAP+5jRs2bAK3IV425NQ7dfJ4TRFxHmi3nmZtzYY6Kmwi4dpp/YuYrstBe/+3gT2GNX+pltEyow/vkFpSufgbiPP6ITS61k/Xxh8aVDBliN7MFo5D2ItWwj8JB79TR5FWB7wlsRgKJFmznswmUtyrHnKUDvx5cXOVLsK2/xAjimZ4PisM+n44bbrfcjRCK3nkFqHizdr2rcaJNRPodtAyLn0acXuuC3uSpCDufMYUZ16iu8NNjh+s5NdycZW4eIbHWtuloqBB7rPWtjVeXsvL4l5vQJNqomTFmx0c9wFDhK5Rab2zDmyBXKcjL3LwMtHn+G5TazXbi1D0G6aEQLZS06ea9ebZOoCnpZpMvBTcNijn8yoy4m09GR833KNW5mkiEzw41A/MwSJavvb/8DMMFCCUiW+Zk3L9Haw3MPUDpzgnzyFRRfUOYupX3RvvjAovWuqHBfNpjyMmpBvK5EBWQ4lFXpHnVgBJsNRGHw4zP4snBVk2K388g1rLhVd/K7Qj3W71HqBRnHhVJ27NzqzgblfWtaXv9yYpi3obtkk3hpgAEycH97AdjYeg8ccrdElJmMo8p3rJUouY07qstnztosFP6vJxKJ5QQVAbUDBjZQRUrqvoF5X4JQwUDdWexpOFlpuzXXFQY0nAzYpljdOBgy5tPAejQG3s2k1dOOraAmw0bOVOhWXP7cPl5JKZO/iSTRY6jbhzw5Q48lu4cJJi8woUqF8z95QW/1FukUEzxSqQcT7+wjpWahFA410JhZEWLPmOaukaXKUqBSCPIvGEFCrVz+WI4XZwSAaP5/kDMi40wjGDP/OLVKmB5CNFDcAnW47g6Uti+AwdZmzGforjwCnwQXcy4WCMMWLPCe0PYqWa1b685nKZt0tqNBf3JRpwGV5nAdQwz1af117XiGr1E4zv2Vy5LimE9euJIqVQ4V4qh7PDcTophv1etVUy2cjHg0GJiVkvELTLVoRTHI+XbFRyJXOzQBe3DXpAPwnwVbMxJ02j/VIrOdDhbPSv38wG1CQ17gXJbP1iV5WCSjS53cBu+/pOR0ZBBM/IVTRwCuf21MBpV43Q5OaN7HT/+xawSpptyxnk8A4RKBczRAJIjC19brqSRbg0DbXiAmz56ZDJzxv8zQ5wPFksJBHR0e263jOcKzg+gWuCDCdLEoZGIFehKBy5PbzOHKj/qgMP1NmePFbZ9DhNQuRgrmnJClIooMMQGM0pTQOVLjEfLMSgwUkjB/X0oqWtkpkDG485FqV6uWioQCWBr/dJR3GH6n8ILMOJ9Y3Hzzlg/GbtMyW51QdwcBtw1Jv+cCapcNm5IG5g0cPhCYdyay39ajRCJ1MIp5eoS7SsxZnsYGQSB0e2q+vh7i63pxznjtw1NxTzH/6aGpZlXa0RH6s7TnUbtdRxRi8PG57MVUgwydfPD9ck8dfBs6pPFMrITzA4iHuAR8emIJR4WeyeV9BU6WfS6iFqG+MUorRFCMTX9UDjGOtYxo8bEi5LnhMtZBwXp5H6aiKQVe4KNGwrcLNbIZ5r8iedOYaoPCwBgNl/ONnrzV4bRF0ux7KQdPDO+VmXx0oIv2k3QK0XAu8LuqxJdS/61h1HqDrSOAEht+WWn9oN3RCna5LA3ptEnrCO5u6Y+rf2LE/5Y3jvo85c/7V5cAlyqYjd9C/1Lw9XycgcIdA0cdY6Eo5naLZn/8TXi2hqfJhQ1NpnjgOXAGwV4NaqsZ9OKwfeE/Qq23hXp7xz4xStINPws9cFKNf1kFgidFUXrq + hostkey.pem: AgCnGzC8wF97zMvr6mp8WFgfA2LNo/aXSeXy+nUjZTbXcoNZrqep1ymO5k7TtEWOOUQ5rOcmXLsOMtbC3MXNt4cFnKkXfzW+Y/LyjaviO3MO7ZUzFNXLmGPFMXGkDyXBrEYIg05xB7AXbV3zDL04nUnZ/4uIfbRgEUvaSSiAiwg2TAE2lNfUsajyRVmEeNsJSdfEsorZK5LjHEcCL4C2zzGJOwYf0tE5sw4mBVpcFXwugmYPSq0QzI0dityoIieVZBEjCimVxZ7ugnJN7/gsdgX/6iRv3HLDSAAbVfNVxYaGXbgGAwZPEs6xyKoxeKb+ozF672XufmhVBxcm1wt5BmXQDJTZEaVBOJi3TzK1TbkDyuk/y173YhI8hBxqC3q8XCwdTRJ2j9mT8NQHCJ1kbf42WpPkglzmGFUG2rIDsbetAKDaHd1ZeK24o15XjX2qusw/F/a3xPSlz1nGn2WRHmQ/qWQjJSTCfUGc/8vY1/aNRWkys93jxj/343OZ+EEzhtQplsO4ZD/k35ZTsC95F5MtZ8bPdRNMBAnmV+jqxHuYRJOaE5PA8wvNA9BR4AFQ1gX/S74+ZFBlaD84/USIiDnCs4f+qCqER2hqI0fm2eDlMI3EwDkTCTLaiYa/5yR6VHKGuGBLhRXEtXRxUpL3xjNxJpdupgazIDuW6yz1MFpG/wQnVn72x0dYtR4x5BsIkj+02yPgVIl/peqKystlIE+tdKbsNWSBbmSdh1j/omFrKhvex/MShHjJR4fp1fzvUWMZPybj96VNzei53DCAtLfZ4UQkPGkFPg8ItJqbQ5XHiRLFfIHuti5MOtZOR0eZOLI+8eC/+66lmGNpGmpp5RcGr1V4U/zXY4V9HtMYy63mXnYL+tLuqG3q9iJlNvutHWR5PNPSvz1NyX3tShZEuDKsP7Fs45/LqwXBURgEn94O31A1Abmxhc01JJwaqVX7jBESkLpdAf9mf948DDmJHvrtVje48Pn2/zWMuhqvD4NXswX3R0BnsNjrWyL5Wskn6yNXSK3JzpiIYDnHIPPhhGfRa/Iz1RKeHiTA9rP7xrzmtcsrlcIlSIJdw5VaYbeNUpVXApLCORDPODKNhLel7zZjl3HZ058Wpf3pNIBIc9Vtg3A4YQxybCE/Zm6zgoDiHrPS7+NGRuWQ7bp5x3O3zpH5hGyJ7OBUqN0GxaIO3bw38e7CUFJr6HeVByzX7HFp/FcBen9AXdCEVrUR5sPNl0BR+WF8tRL0CDDccwQK1Lot2xXTQZixnKr/9hQvLwngVigGhd3b2r3mLAXPX3mQXPh/eK76D/46ZCqD2jhJWk2NW1WxH5PyaSCEaPu84YKC/MMtxeB8Ev+i4TS09k7vh7TH5FYb/24RuaDnZamNYNj4T/J0p2LTd6Q66GzEwfoj2iHlm1mR+DgqrPEh1Bm45utaFyP5AZnw60PFnjH/cnfUSPCzcp94Hpu+/cOsH27Ev3/hNmW5DBBgaY1jXQbRE0uCgLLZU1vh3FQhBHlLe0eKyvNPhflNHOuv3IDxNQL+f001MU8NUC1UYxfgad8ZEkVwu8QFzvxHwsuAwUhMTiUV451YCuJZ71NJsJPlmBD2Q/VocfWpiTgd4rDY17uzw0wJCd1zD7mg08q+npxl0JUG47u3wtCjbcDqxw3ZZti8B6/zdVwFEhfzu5dhksrJuP2rmuvU/VcV4vXBcWN+UtCzIKfk4G6BEcTvfVI909Xzttw6CT3i4CBWh8zvfeP7edjfTOgHMWC64fOBQnJirG9FtsxJJb+rrlpho0Tnkyb8MleAhTedsrZbhpwby+TVpEvaz3hPnC5rh0s9bw85JXlHufIB+Y4nYZBUieUa1RWeuUXe1taT4TpXdE1eTrVe4A5FMaJf63/oDK3WjCfPxmkR1bGgeNUy0+QIplZGrdFo0btz5E718+1Tuj1ZjRf7opx1EUwF0CTPxp6bnufpK7CVm0Wic3jc4cW+3TYOzgb1k9kJq2WloGh8WO4SPwJiSre1TwUljqG/5zlVOZCm8ynKCCkERhpiglbYFT0Xxu+jGocXrALPJmzsrwx0tyfCKtZYgBIDXsslM0LovfhhJbzz5W9pvDpQELmjAn8VrMe5r8ksrdqQ86vsfwcCdTxjcjS3wy+a+kzJVN5hHldk/sIbg4T0Ea6gThVKSSZ+hBrYF/TFRN8B+YQqyfV2S6zdm8GV1t++ZIZ68Vmpeewyj6qDnzm6FFsLTlFKArsmldZ7CraZtIIS/1yvx1KGtlWmK4+XqTpWDp+UPpSGMfsdn+3/iCYDIdudkxmudyrwXddgybcWxxbRS0yRq20AQGz01usiF8BM8VNl5lhb8xT2l+iGFk5te23KUHgIG7ODs6UtrqvHx0h9J7whyzHBLozGRcIKMQqR/Fo7/PVUjchakU0EBXyhjIwDf5jnsmjlsxOw6x4vsLVdK4/Y9HJMeTT7OUYIGHxkukig185P08GywqIpY6WdjGIHv2bRaDMBPaRGS4IkKtM/QYgb6fPw31pLIDjsJ1TJpEnAT8Tandm6Dfk5+T5vL6UwCJ5+q5r5zC8dOeXkFoucvaFUBtU3q0ssD1UVPjANG6gCtJWcuG8R6TK5SkQNGiR1cMDKzK/2KkmOcASv+HElrKvdm5xKEb1yGTx0lkR4t3Bc81QVD2aLz1mTeckJh6PS6xr8KiqpCi+uXmYToQwfiR3PYY/N7sJZft6dbwyDZ8Qi5IqEvHgBi++7u0jNX3eaTFx50J5snzw6CdZsIbUZ7iy6EoQ6/tOPAcosCU/XhEujeJnSYBKfZAgvjsnAl3Muhj1TIvdbkPNwb0seMIsp5xX40pTi3GPniXut8yvkvCnHTHIqCoRThv/WiemQvuuGPCg7YEpKiZlEaJLIbogED2MGn3qoaitroXAEtuFN0EUnZbr6JRn/mj9csH9tNsuJXsxGXuuejeua4LRb3wW5Qk+vpArUsI2Dn7C99K3M0eKb6MWp6SEDNwZyxd975yScgQsYg9Pn9ED9yB7BJGSdlysQ+8dyZu9neITXUc+29lrml9oFwSVUyJ4H3UInPr3lAr6oTb9Vw7yqFrgGvH86IZR/PirNlxoCVOyoFznaHJsoBiU4eXEKK+QS4mTD3+sfKoALeaWj2oz8ua1yZXQd template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio/ss_servers-server-cafile.yaml b/infrastructure/secrets/rucio/ss_servers-server-cafile.yaml index fb197168..dd473083 100644 --- a/infrastructure/secrets/rucio/ss_servers-server-cafile.yaml +++ b/infrastructure/secrets/rucio/ss_servers-server-cafile.yaml @@ -7,7 +7,7 @@ metadata: namespace: rucio spec: encryptedData: - ca.pem: AgBWB9AMRVXao/FnW+BhayuIW/iUdWf3Xiuy3AQYZaqJg3bPNKCjdZuQGDAY22Bt07gpc8dOCEvGx4PrzrV5W2pf/Y5R+V5T3akTKu8zkNSe/QUzzr1gJU9m0Tnd0foTs7DXvipJOIksR3i7A4SV2su8MixIPJiYgpRKAZZEPtSUU4WzfSHmBXmcACvYsntTF3NHYcZuNZWfeiXzOt6sKQMZcfFDioLQL+qE4J3UCRsWUUYghpPTWwhuYVlfQNNjiM6U2EC1WfoyGh6i29O6a/+6WAK/bby1aSHD2bkaggg/mB+7VxurHjjpn+SAqwogFC10PoClClXpENhFgzaZqfsQu84NXwbZAjz7fVphAkecrhPdx5egayo+jYwY9IBxq2obUp3fmqbNAM4kUME+GDmn4snBQ8ZJQlQPfj903u4r1AweYFd66XrbA7FoAcOqPv4DvVvsBJfHmgFZnWLuhXap1inUQD1aWfbGDQWWhuA5P2qysWTVB3/Sc1r600/EXh+lXUBWrBC3/JyqjKDZACZAruUGf7GXzFGZ514LXqKhPMBVqIF+DeaKLpX/Ef75oSmh3wbXw4NPjLjIv8LQbPgT6xxmqWcCZZJiTq3jUCRR93z4Q8YVQ4HU1KpSQJ6P6b0tpWXmHX4yYioXSoA8gJbcwdrgNV7OVZEp9nB7SdIVeWwgRhHMr21SjLk+yTUF4kD4YlIseZo8mqqVnp3Wtk5Ej1EktEks8wznrBSPkO0X53u2hzxIofmcTH7/43TDlbnEg2iyBM6vCEao/FD83hh6GCyn6Ju6f1B8d4MoVFi8gNXBguH6zzGWGd3YW7Qld5PZNV391BXjOs1f4Gr31SbD/y3ihCTqdKikywW/pi8F6+8UnX4fcZEq2AG/I+zAO6S29WRn9uA6L0WoBwVEQW/YGsIxNF+VW9rgcdlWRQ9O4zzbryog1XEwkb2dNw+q0L5QRc9L12ImsDzbIj0dCOF2IDAUmP4muD7zpYjVE1eXOvZr8LleAZbODCOt8jLP0WcJ60KjtLn+/JrC8qxN3kqCqaQ6ZEBcv423unPeEjb2r5ockchrMO4lT2CBjej0SiEKIWZEgLcGVrRxvKloh40Rf4pjyohLIKJA8BFGaQ943LMWNoQmwQw9dd0VKdaQK0iHimF5uTdKOxZerLWbKsMs6zusZ9Vf+AAvFJYnRC1Ws+avS+FkoAqoUPs80t7fsLQm3dqtWgYtri31+3HYlwsYPXIo0U26HKxMj2A6lIJD0RtdtQfRJ3W2DPtAG1QT3Cq95T7phQgSQhQRaffMn71/CPHEeZ9G2X2l9McANPq/K0fkb6AJaj3Fkyn7EoWfpUfORS6ROsqQ5ONQspE1CLHkHkgxBcUNAGIPKLxIsG1qz4pLFG3tapH+6Q60ByuGSiX4KA97mHrW7zeHz3Qg+GH7715XLQyZVBrYvwAb6dIPmAOIb2c+Ys7UdTPQErA5UUoHPZWhoaF0+nvq8b+MKb52uyN1JCEWmdUTUixGhq1+nTleTF9gaeVlUrd7oInxe+p9kuFtAZB9KBOhSMtapH1o5mCNHbOBwFRX2wtq30+q7NGUr6qzLp2kO5kulALC6k2yWMlvLt8D2JVi2DUI+JnpXjujtkoSEt/0zY9wv7TnawQYAhj3EfQIMCih/iqyTepVtF5UC6OwD+RT8Dhtyh8GRIw6rv5ypnoLy/e58hBF/163DzwhAb9H0mUJvm8q25BFTPpLfzwZq/Iu8pbeesqstS9rO32pn/WGbFqvxPOgNgHM84PQDYnvrQ2ZdywfShg7ZMBJukiVFoF/Ho3KHyq/ohynDaWSYqJhGC5rAjhCDT/LtdP1+QxRA5drnG2ZZU0D/2FOzyKKJ5t7V1wPs5/dS2n3i5D3Pc+lIa7dNacqUq3ruNfLGhhF1g3qBxZ7ysYX3MsE18tVvbSIK89GfVznmyWHS9H9sDTNwfKt+rhLPaaoUS9uRMut+X3quq5DMu7ywBFkgL0bVt/o00XVpwwl7WCzim2LUljyrZCsORogFHIEPYqD8N8Eh9Ly8sLtG4NEiNCQ+5psboOwcF5eOuK6yWzuA6rugPFTMDrzq7GsBTOXe8V+XlffIaLMPXEOb1lIwc2xRRGCNUDWpPm75uXfT0H3noJZjDBsk7DoeqTollBvc/mTuSVCTTYqhXFAefAErD3MQwxWuD1G0petKODC5UdbG6LxGvdN1dDw82E6YeJzNtVKLlGeycY0nvswp5+Fma19m+fyvBVJPO6ky2ycwFZam7rG84joOQw5kWo21ik1zdnSlTZ1ILGvfqlM6lsEd00hhrTxMLmFfidV3T3sFTzhYwlWpPFk4cgON+WmCdl+LUJG64deHbFY+Te7Xku0e8Bd/DZzBdx2nMB7g07plWYcccou1KI4UvinoC693UjU2r57fc+hD5nFyh05QMXlwkhfU+HqFdPNXRt8pgGr90Se89YzxpSRsGIsIyvds6lQRplQ0Y8MxMinL6hStRecNUAYXcPl7HWkKE1yOvxHu9KHhrP11yOHXYL6VMQu6j1bknAI6RVVFmpxzKOmZNKYV1a1cm+DPquY2VdUzvM8PT9dF2IE47doBPpgfZsHpMcA2gk4vrTfaVPs+zpH5mCGoRsaRcOwVoedQD9omt0cY9H9lySnEnxPSgs44SkzbvNY3sjB4PDC9ZQYHZnaIJmTX5AJlZs4+Tw8c1E36d3t4pOHQupMVxuNiJm1JOOjJ1LUtlc15WTGCpyNbdAGu44WpW5F/mKrVFQA4uRLUZCN+NLc0zFwDFiO2ZmCr2CdfUxkZJynjd7ttNfYKGsqbvXcvRazu2OIRy2tGCViTPlr1dxeWLCe1qm7s+Pv3zK7nPW/8goYWGB7DcFxr0A3M1PfwC2d0G2QwlE38M2dAgvqjp0OqFuM+gcY45VPPxPgWcSPUwqfhgOOWA+AsII0BaiFdTTmBXH+sb218kqiPnmuZfLExpdRaC7pzCSsB53SViVRCW08gYPSfnOOI/mECNl9fpkWYDyIeApb8tITFDceeNqsGMAwZmzNIw72H0VNklObgoadvQekS9Zr3BIj8l/d1WEp1in3nm945qRkZRfVH3llaGxEch1FvjGr56xKVkeHGC45fnOPY3/VuCzNmGFgj1KN50/o4VV7is4ZnCuHG9AzwE5VoCcJBMY7bqYJqdGUP/EG2U/7YDv/YPAINVPFJQgZ5zkwxDhWoQRYXrZ+LDvi93gYGDOUP94Z+PMCIbV2ufYFFgl+fLVhGMBsxP5wEDF9Bb1Srll0IGi9Tg3xTLrQHKh0Jat3Gi1b4hIiX1Nf95hFQSXuDZtZKc25O9JpxRd0OwAYGLH3volXrtURpYQgvPcy04tHP5XJkvKT/5MGSXdMJJFkjetNX6+9Xia3AC1bemA+cPZrB0LxzwYGw6+yXdYtZxZCpN1NpzqSjl+a/IXQDD75+LFVdQAAznTJv3E/C7RQ8BelMVo5T/smikWZ4nFsxMQ3LXoEy3Me+/OH2gTZ1w9PiwHQFXkU49HOK2Y1glPlMzwX08MIPojAKdtZBjUMPuT7qMLg0ZlQaYTvVrguSzJDja6OFOvNwd807NN/acI233rvnu+MjCcSxV9qKcGda69E/dU+gwVoGciwnaTEqsw2izPCad9XExB/9avejocL8J4LYlGJ+u1T/ISznDChKNKCswZ0D+pcyXp0PZTdN+fUlPvGrnj4+D8PDVe4CfKx0WSzFq3D6BZoNp1Xrz9GU3KrchStP2JRYlG3IxtzgsRRGxHaWZ2VvOwagV7hyyOeroLBShlqcnYUtMLAtx1zx5eXU9CpIaWA+vfxPaH1LI34C1XyOy74sAUI7wEutL83YryqjZy8xlnJtHqhIZiae9vEex4wOMuXU2DVtxQjkhsUWMDPuYv403k3Q7SdLrI745sPLj+A1rZibS/s+FkmOdA3PzYQ59/UvEYovNGWaohYuIKubsqUfo59LHxiJZTcptKUnudvuA9dD+7tecmtYUUN+sNtowAoLMpY9WbUN5crlBTJ2FJAqZ/f0/r0OfevqOKEksLuX21anvb2j0JXdCLN9VwFUwHcBOj8SnfNo6w855c8gjfNSpMDGdFS3S7U461LOepgbhVVNCg4EJCrYRMcHfuzvYxgqPXL1+tnTA3JIylgmC5PkU3urx08i5/xuNlItIRtyTnmRY73o8mkMeuLoM8PidqoEd66mZ4oyfqkR9r2jfi29gv8uw5El8iG4uFywqr5hXKVxn+BW0dGTJQ+K/R3O+UZw3SVlnGyAm3rXc1kfqHUk0eNiEXeoxQLKF8OXRk5a2wmejDWWFQc0naZNl1xNGIlR6kFnzj6GZtIZJHytUAkZApjqitRLGSOaI2pqLoyd4sY1RfRDv47rCi/5joMAu4r5eUWhiwTYUV9VqLPNJVsythrMP70Jo5PS34P9a4cy00PhlCZhDiU+Gyh02FvDNuBfJT2CVWEZr7Wjt+lVuWk8SQFqP0Tq4LNxtwLldYeBo/3/D/Abc7TX2++sbUb3ip1lf7YKaOOrj764UqlFPRKNP66BvdmSR4P2SZT244+E8BW48AKeRqy5S6XQbvoZWZLjTmP19ma1qAUEJqQHLctvtOW55/mTdXtvCzPHB1jJWm3F7yScFcAorZVpHIvvgFWV+xlSvOpM41INSt+0gmZCLSxXIuSHKNhvZiVd5kp+yJyXKDNR1rBYQaAXwhk/QlVDAp1Bhvy2mH+YfqPctuPXFoRwr/kE+o7cgQNUgolJbuDHKAzo/e+fO/66iOJ7+BoCCcd8ipSjwsAzMuBgcY0bIEg4wau0AssPTjjkUaOGD875NdR01MJU6/gpKpQiFvIEJuGKVIojFgMvOWf/OxwowVHj/H2ATeCzA9FpmiD0FP2rdFWZc01DQ7SEfuWnyBDnq19K6EOXjZEqgpEMfWio3nGt8bnvP8WmGGpdb6/yLbCytjAQJOvNRdn0Rq0gaZ8s1qHxs2ylIzjOKhjvvo4I4edCeUm1hszbG3HueSgnSS0+FSJl6hsrC/gJh6OjqMSl3m9olZvkMpf8Mk1LBu1QEDv1uZzEwi5JIMIfm2g/wOlI3tSpxcPuHxbK5n0Lz9z36OcQdsfk3yq1o4aJV8ul9mZWki+1jyk8OGeQX+H0lMaZgPu5uSWXQ+T8VcLdj8COkfxjZZKOxEOMoWBj3MtBGH9Uw8KBYnHhFp9RcpMggEkQJwQtAexJads6/xrfZ6jDY4xGS1nRQAP6GfB88/EI1SVaC+PtYlLWH9+mkxvxrwuVQQ+KOLMCTiOriFB2y240uo7Ds4228Hurkr11FCPtcgDXoD6qW0ISN1hV85rz76MgXSmBE/DQczSEgA8iKB4LwENYXDclz83SHDP0pfFu/4M3yu7FIwAVQy4eAqRqBlw2zHLJywXbINxyy/feGroyls0EHrh+Xot98j6cs0yg+edcfFbF7mJG+4XIqd5ym2fyQGgxEooOoHNLeslU+DW/SSFf2LWWYoJnH72HxnAm1F7BuK9ISBNuAXdGL1RTxnbFDgfArKPhpyKl6lYxgmQcq6H8AWD2wX8HK+bOkJktRTS9EQthAAD5oLXJTrX78616lPi7I+oPN1zpDSi41Au/7xHXnNluMfaognGIkIndOemJqMTmO7U5yIoKpbWGUHbu6hywMPGGejjuqN46ed5Hj1WhNskHyU3fxutYtagkINLnZ8AuXdOq0MEfszxLhje4D+65Wb6VFqSdYBkQGGX9Y3SWgFuSXBOS/sQ/AM6tkE977bRvgZ4lnRomQbEjScIF7xEVY8yP4/35xIeaylVGoy7xY29EsLKQ/qfn6zyXUMmUrlJnifnYBE+8/kCXjfgnABQ69Of3KuydNMBY+WDxFH44rD7a82aQODioyA3d/8eujZ7mbQTUFPXuA/QOOgRsWlrEmuQoVBacCzrjCU6oIh58lqlUKJ5dkmVPKQTZ0tGOGGO3YW69I2jXuEmzQGX+cSo18l3cNq67aH0jIJbu/9pF5Q1NZRZj/RFjMFr+4v7spcLdrxLsxo0vfu+AZk8RBk50z/MCBmRdbqS9g1hMsHhto+LVdtcyZwtT0k1J96FxGCh2uRaqYqCmJkYMbEwpjlzLaS6ABMDdtOUWs3VrD31u9sz4dkHw2+8IrOqjQdbBugsBJgwGTkkWVe29yimRXlDDa06VsWz42++GyWwN3xI0u4ANAJrLGIHD2PF3RB686Vv6mBRL5ujP63i/igoFNnyUo0FRAPtFaUmIquDxfdtdNAt8YhkiDaYUToMH2+Jg69J1HuCcykagaGrX+T8gkmCtlaxjVdCmr0y5YZ/XTbOHZuQno4/8A2SDqh50vWhzqJYrap/xuIa8sLi2Jpwm9/RWK7xXatgvDYVMcsBSP1PXZAR2SuQuyH8nbEPKHplD71Hwr4V7+BLIn9aeB42aUCzghjI0LbeKylUysPab+GllU2HhfnjypMdSCHNISlA1MJaq/MwNwS+Iz9Hq14oHcZoLwHMqbg3k7CPD+efyo3YFr057n0qtXecZlSi/zSWT8C8XCsObVL5YFz40K9FtxVMGbpm/kMQ/tt6jOWudIVMbYN/BleAtV79lcI/MrWVhqL9jh3MVeTQkCZSzhUOS3CL+g6m4IeY4NqQdDtd3Z6230D5wlOIvVOn5XrOHMwu+O/yHH+FZ+IXU7CyeEDpJBUVHLULiDevDLu9WlZy9sQyZ2dAwtxG6a168sCl0LlvVAr+IzmxZfFcxz/7IaNbEL033fCDY7g/pE+8fN5fBJ7oGwUou4MaAmZ+vzUUom5P1uEkooPhqRn3IOxAcV4Hg5638OjSHz9APCs2b4v5tCaXpcfUaKmvgRJlQDJVzqDo8Ovnm62MISHiEacrbn9Gw7Dl/S0l1tePEVLi7l5QlxVeDaCr9BPUBX6L2I3KdfXHgp+okHhCedLJtR8ysYLqOVQpNfLQG9Mw8kGCdgTuwJrGqFCFBsJFbbb4k/u3zBijORh9Dj/SldBjCvXRIEFBdPFSl6s7IvXVhgF5uvS2AZdFZ9O2+SPIyiMgb8WlUW5ae3I2LJ7cEFYpUj3JLFVlh5qLijULFQvjf1e7loBu+PwzoSLerghBPMYEahzKoYGY8PX5V+Pt/NX5i6PRRrThd+EvU1lNPsjq/VY8nGhPTWIHXeG4gUMlkSiaY9fSEQsZDfX7et6pZ5KrXFqBtCmvfeKpsN5izsbv0YTNo//f8Q6VLb4c/MAY+C/OASz/1CmSfQE/nJBKRvIM2IqKotKk5WZCRT/qHZLdRcdOnCABYie0dB1Pvr1NH5EBEWGo3PApcuUG+6Pc1Rcv2UNV+gplXY7i3yjLjSGBwLYiW/qoSdmVDSNUnYJEK7r7BlfaaNf14qU7j9l1NFR+aZrqE+87vcjxZRvi+RPpYm6XKimdPVrQldFKKyRa6n1LqB2RvrnkyOrkIgRKRrX8jqrhnHlhm9J+CC+rTpYhXCssYWbnwwvOVX5s8bWPgXdNZJZt8SEN84JreqPKDu1QqRBqfNwHrC95gzozw0thkdRaxJ8H1XBD89Hlnk2zKK0fnZ5kUebDped0GxeXfoqpL+ANPOsuUiQ7yy7rcaQ0gCzH/kkeN7M8G9gB9k+QhwQAtsNl5INLGYT2V54QJgkazjvfBUis9RCD96xPBFQC1HmgYn6n4hiwsuZK84I4wJhRbK8v7ZoiLlo6cw+wsBzXNyVGkOJSC8BOrutx5QZGYSlitCIdlog2EhryalbQaDuCVYrqUGO9KzGKt+XDOvYJYHMtovT1gWUHU4B6Xs0Gl0LJxLqKRm5WtR70DeIRJav1xAUm5+4aJne5k3RVKOuG5IdFf5AaTalH7wSxHFQo/kM6Sx3DiAIlKFLCmIcYENS1v5Lr7JyYckCDAlY8fnN6UY2hKbKSKmNROQBz3QDPh/xTEmrTLTcOAqm36JCIqe7fG6DOLEp8hOzWw532D1sBdcpeX0XZ/B5EdYovS5xFq+VQkmvNbNHg9Wf/+WPNYyYbHzEqPzUFok70sa53h6YYmm8DvJhsJT5KIHXkxXEZ+Zg1E/BuFzIy+2XJ31XIG9Psa4KB6l7tSvA1urXZrPbyysMzLGExaieslUrpi+mMc1GyiBawV2FkkutZrJ+AUaEix5l4xYe8yMKT4Bk74Vmbe6exHYpqE+EdQoHYl+Hcs39iNGBJ7bshgugyIVIjm3DwobrtFQ5tFO05mka6mC07T0o/mnYt4HeIbSVukGMimuk+RdjuItgidayrf0ZHHEaLE59BiQrSnWBx4mg/90xbN0fXlJ+NFYrK9VC5HejdHvq3NEMPFTpf1L3oc+ZkYvTxABNxw3KFldKZLLl4P5YEZlzz+bZSrlPX09uFnCvDj4WuadTJ8mrewlhHSRjrF2l2j2BqECMnfiMSdTfil8eUleZHy7FJ65K1i6x0UPbs1ljyl2papqSbGr2iAba5GiM6ykX3B8cUzFO9bSg/Rn3r0KzqcaYxvDCQfpFJnyz2sfvkorZHas1O5Lta9DQL1MvDK3pqLLQmpMByS97qzJIipzmCdX6SYrs3vV/FYZg1Np4jFGO77MTBpDYQ3xTFzaZlDAlNEqv4NTAkgOXnhMfj0EDRc+sqUNGgxRy7esPRfjlgniscj4/PFmejLjcgSiYhXJPO6FnononAKVkudbPJVeiarRANYlYlr53tT1VxaVQcVMaT0C80ljGZCKCTG8oDV74boxkBp+rHKVWjExIbvCZGhQSfOTifZHzYyM8TvG69tg1GjgaUbIHWPaENUN4NgOQLCUZPccvjVk1OGh0oDpaliGMrxfBSXt/07hZD5fnesK6TFw3/nDCLaczLKONOEEp7gHWysmAnz9iGqle6ctm7FLCLDWw7tb83WFydXMbn0mVauEWGNcL/mbrFgP5z5UuW7lnR9lRjhVfVCviF58p1iM5K90TUwBKoGiJpYL81V8CQJEWIB0x9gyjdEGGuJW8oVgQ9dufq0ZuQ0PScNrladr+N3IXGN/5nUGw/E+RXjAcBZ1JQ+yFDC9FJ5TnAQbdeYMMjWOfRWAwfpx3PTHB/bGrbFzU+W+Bu77Xg7DdCDLAfMcfk03crO0sXvquH+vgDPK5K5uUyIsXLmzap9gVRCeh+usUcZmYAD5yMxgw31cTU9kVIA6+O9cirJS9Qu0QoP7O26pykfNFKFWplAJxmXsTUWJoTFIVKiWwQlZzERn5Ox1KbQTzjUjde3mEAwcclnkneEimO9xrFZ7FYts095josco0hHQmc8nYdnM3c36mCA1KCjHQT46QqZw8bEQwW+rHyojnBDSRhz6TWhzY9uz6ltA1zcWF2nv4+7HjKSV4QoeGWN6z4y/FGoc0Fx1f47ES1EJdy+46Tz1uVUngS+CJPzDpb7oIsenYA57YdkO/iP7W3/5seAdEHYdxlpyM5eu5MMXW2L+ouO/BvF6lw3Lki3sI8b5+WbCDnBNkRakZN21Vds0CRNFX1jYp88J8IO2jCq+Syd+eDgOy1ktOSi+E5dmkfyi7e7yYLIvuiL41nlYXRApcYvFekC8ewfowRr+jB6+x7g2sjEkfQmrkhU+Psz1vPiWi9OI9wKXwIvyLoUt/LC6UolnpLuG5ty1Zq5z7ATOhObac2q28i95yL3LR354LIZB41wY1sBXqEBR+s7LQ6KbYcMNad9dmpxnnSzLqOLF955sZwXRHO40pwt3DJLHZZK8869Z9pKz+WHGxq9XjMqLttvvh4EIwOE3FC24vAw+sB9GnLo1C9YMRjn7Gj00I/tsrcO2BMLTSHal7LKdYXAxpGUhdFdUrs9ek1WM5Z64Hfz01s6xOtJ7wsccn0z0QHSh/SJLXCopztd9Ow0eu4/OiPVK8JER86vTwO0x+MoK6kinqssKo5Rs1+oTQMnhbWW0f+b5cs50fxe6pyRmRMCl52RrHH+EePF+jv4TNNQE/OLj9PVmCdeJ5jnpKO3P9G3dpGGdEOoEHFhvJ5HXEgi7fmiwMEpqjdwqlHohq4/2IEz04FpDiG/GrlAXvelv8RWc7HP9Du7oJJAEkqBAXygLOu88MQWIA+PzZa+phYiJG5CkYkaDM08IqQqZfI3t2FVK6xXBYmGKOdWCnyZEWXYpT8NjPTjITNBLJGD8IMThpN8Cbp/JXiQOD+A/e5xkRRfysDXAe8W8iDpkfebbljnJxO6zVUYqS4OdcD+tKet+icZe/5QBRnTZ4sfcp1YQMu9T8Oep07EdylJIZHvVNOp3E3WYutkY30YBUH8c2Q6rCq9Kd7Gyn+ikgo0lfq6gDwJhmTQ7QutbgbczeGYzPHbMlzwto0J7qVoZNj6jzArtKqAGVbH9gcvWklg/VZGrFDQK2R2jBJ49du56/198hGS8iSGjD+M/bdOmJQ16PDk/WAJrymtIKYCxHkuJvG0TRu++pc3S2K2wlo6zXLQ+OCGna2mJbqUz+mtiiyKorkbFLxDu4wbIcapTQPywIlJXdfdzPFQN1LXpREoZ7a5OjnWV2flf2uRp4ayNFdKyqWBlBdOfy/zr9PXk51Vh5ZGrxMSkl9O7jFl36MAaV935aQ/ZrXVdz125a9VQc41A037FMBjRAgKJPyZEZ3djEcWrMYTMsGl0s65bKQBIzn1kElPcYcXY+/e+QIehFvAn5j+ybuBVx5vlRFPb7zqNTgsSKjel8eCPaxtFEmEml0jm/2ct0m/3uEMYlWDiWku8b9Nd9kCNVvjNGelMJzxt5vpQR61aaPDgWD0UwsJdLZbBWGmxj9NImAQJAYMx+4TslYdMpORrg8YYeX0BaX1Vr4qyeKL2o2wCVA0xpIkTmDvFsdxVc99aq+iFk17/ez/AcQRAQjBl61vzHoDJaj2l+p7Fz0P6i4/nu50uYES+X8Yaf8tgx9yjhWTuymxXPd8jiK7G3PJ/gLB9AOKIuw2QdTuwl0BZkT2PNfF7Pglb6IH6SUluq2kg7R7OOkqh4s3cLRLPMrfC6qHK7G/4PUmTooU5vCptcBAc54A3BSrsKqjvMytX5LDzWV2Z6lhE9GVNDGCGJotbNXW7/ZFxljJjq/H0Z3npdzWh/zO3slWb9UcnFeJ5XXVAkC0+FNJJyH4grOvJId874v2aI3LPDMeV9N0cbvbepoCCofAXe3eCeus3FnJNu3bagebfY7kEKb8WkRIeCd9opL6n7U+/LCoWJtVzY90gIuWsWCg/TgqdOZxD3I0qDWiwiEgZ9IezLrT8Dxc4o91bP61YfvufW0JqVQkciOQGmOybwnNm/CpIx1cHpyC6W9mfM5C7FEeSkfcqmNFLXiVeyA3Dq3pWIKfoiqTdihTIx02/SV8zWYK6/cphSnzqPHSk8vHSS/cdIqsTDk6O+DGmV0YYnDKinIA6H2MMyYsphLZxIlyjleKz7inzJpVWasELQ4hx17eNlXC+1EnE3fJcbv/BAEDOQw3VDyJveF++DGaNr1yjn71ei4q2/ixUgEPKviVEgciUBfC7HlFPxJrfBzGZGtT+yu22/Z4lS1yvJOq3hsETWe1bmZSjAqXAbREikraoGL4VIDQZzDPjd0Mq+/o5yQk5LEn3EsVOwHBjPN2f0jGjlj/IQjt4+HvR8k1FNS5FmmUSQwGLIW7eUY9498k+hMCE9q3YW87QcytmyPDNv4ftpfii3PfmNMtULdssFL72pdWy9q3Ay5TLZy0wSFfBTKRxQCXlcBY9ybHqlVC++yP+hFb7IIF3hBhfcidecaN33EguyY83gKMm9mUY17nBJCnRZ01C8qBo6mLg0PYDfprPFzOsttxO1hss8k+Fop0s7NRc2XcFFIW4WsP6X/mDci6iLfwhxCIqh2EINuB0U0ayyyeg6pquujRKFqMb+04rJvhE3A0WS1p4aYmInm4ljk7r+CXq/zAFH+5w0jataROJIwamHpSzqLI9hLEK6yjkGpTyjbfuAgLvuS2NNRWHlB/BwLG23bW/s6zO3RvzljpXk3GE94BECJBE3kxBdd6A0ekTptaUdyKLZ6HpV6TS1fGhUTuU7EHhJBNc0Q1cydb5O5S0TMl/NpLlaegFJGKzmbjyZgP3GT2EeIdkals6gFq6BHDAzsFjj7u0bogf9BX66Ayj+P4TCOccbHmDTBjcisCDEhRkNu8RJNyt/RuJZqGhsMjiiWXwEXzmjGz/a0MQnlN5eeF8XCfg0nkaru1yvHGjaFllghq/oBzUmPND79NzwQeJwzIOStx7GB5UcAlijtF4OXCYWqfOW4wsj0RIdK1PQ3rKN1CDZCIJVf9vA0TGi2W6Vmqa8roxKCvd0g60mOBJ6LHbJapKJhhfEzBOoRd726I4I7ZfWbS/MagaX36VMjenMh+u3gfOYZ+zNY7x/5gQWZeNZIiqK1xQ8j1eZm4f9sE++6vRzcdwp/W/KfDVZK9SqoJc3EmR77/9bEUpLeBsjdKYGkHUijMw5sq3yxGp4YALq77U1s7/zTIMxhAGt4XnYbkKtSmkJjcUjMWAfNwmXVywJAnMX+J3wuDsCBR5yoi98Tq4P843bTEBIl9zSzYv8W+GRLXuKTyD+72gBHey3YrCcYngl/GSu74u+V2ZPuhSZfYl7fgMDQphgU0M5IRD4X+4oPHYIN+VimkzAO8M2hMQApyqtDPGvqhNcs26463vVWQ7pCPhWB4RNdKx9o5Q7KDqUBdVb32Qb67NPnKDMMPI0L06Vh138uhJrGupEMAb23+pOSnQpvofNEdhUo9qgYt1abzXq+ct/+9HhLMPgOg3c09zP4ihu5fHO8g3wZHVJkahvSrld2OwgNZQJareoQMZnyJmSq6sa721yXcpXl17Xh8zz8rmx2eSfSXXwEJ7nQaEgEHUDCZ0UBOANGJiN7jurqs22BSvRUkbxZJM+vvNrhoaPM72FPCVsQRBFOX7e71N2d+hyVQCgdxvZTRNpHIpIx07mw1zU5UG92WI9L2Ei/4R4UN+YTDRkS0tZbIq+rFjTqQjCx/ABNUtlk+5CL0OFzcLw3V3uD5kD4++fpJTAO7c8RpZ35CSSfsDE3n4mfUxIEIpwznTR0dlu7iBGmcnFv+PA6hH4d6Hc3CVlH0wlUMYb3Iw/V0vBj0f1cbqlM1jT2cO6E2R0conSs3GRJ2RKfgOtyyHN+hfq/X4pNgznE1ilgJxfEuYooQuwOkCfMgoPT5SugC47R6j4U1sb73yIqACpnmm01hTYKAaMNDpBnX0z5RopGPXSh4fbyMOQWYPJiF+6wnVkCg9PBZWxGpipf51wAMHMkfAlthCa/W55VHmDKnmJ3zPunwcsAHs3YAdtzJaVKqRZv0gmewlQ2h/0Brx2Iac0oBm0bbyYq5QWThXFWOo4VrERo/fmdTGL/weWzp4OJrnNQ8cXWGI6rPQt/s8fBp2bOCCamw+M8M+IOtYWskvPGH1q+UgdC0ORF4gYJ7j/QnxXqLp3xrgDd3Cd2TllowRu1CPgrcMk2ot5o1MfOhugJ+nsv0cUBmBTdDJFAwMjX3Ypbm87SH3PDlABxmBImTEOJUOeaEEJWDvPMWVAsayWaAALVY6vLRLtj6nJmC6cF4zIDz/YoYTpA8s/jFNjzeDQ0QpcqK4T/yHBrGR6ladTGoPW+zQinRXUroNV7vrAbeuuxpPmpbTpG0w2tzhBxcDEOWoVQordDhB0zpytYl4XN4AKMlxztVpJ/GTiuMlDyWiNpuKHTJ9cvpWic1CKjVKJetgicMMku17mMXJ0RL1w05bJpwb/roSnrdsKzrHT7ulevD1+tjnuxTceAkoonl1oXiFLC3PKkeivaT85XeWlQ7Qob3E1E0FHBEzlPwaQAwK+cfP2vx8rCNWF4nZS75go4/jMFjqVvY5xD82snlSRFRaZXu1OmiedNgvrzcCB2rvAtFILdNrJca3Zf8YT2nwWwpssdsYkZG9BnTHuvDIMYIRl5IQRN+GNxXBUgXZTdxNr2edA/VXvyppumdKh+A5iMrgd3YefIV2AXaiHr3Xdg4CqFzWZRc6N3SzhAQMsUQ4I6brtbmzHV2ga+WivNeVMqZrZJkfKXCMhdiIfAL4zNARwVUxLgvDnqYvkDSqX5qBNNc0o0rHZhhrfwVARH2dZJcjV4Ok0kqzOSVzzHpwef2I04wvU4BodMWKiaWNB5brxI5WJ8bW4z/N2Q5lAgXzeoRpLoYbLHt6gRegHpT6cl8Q8be07x4hT90vR46WFNYl3SwRDnfNnCJQwt4M+oP1uejuarMrbu1esagecM/pS2fj/8YEa9PNc1hpq7+Dm/gd96b4KrN3rr9QPTG+Yzj/zEi3EjeGK5GUiLGQ8nRpk9ErmYj+efpKRkMXgN6rbz/V57GA0r0TPCxxgNAEXJ9EuyHzgEW6p9iW8JMGXwKQt7ZHojWNWcC3lLXWWO/ogzuVEsWlkcCzS52HYcsfGVc6zJiUjT5F5JhAQHRzXcBlKp1sSH0Lk4eLpZOimK8lKcoPgJESavjPgFgJuRlpM2WzuFfja1NDFUCGwzDncRDDv0LVjPYjiOjp/DFSaCV8lXb35SByKqqCbcbcMx+oPpkXPaO1PweEPAFLG2wuXaD33XA4NUT/+u/O5KoWZE87HicrPOahbzWmLa6LYiKPKGFeL1Qh92e87QLg+1zHTQcNTXMpmGV28LA/cdh+BbtC2+UZuAmZD79hIIbZlM0oPTNa5BuJNyWlcNTzpNw8I9vKvyynygPEX+7hwsnCNBIBiy6l18x1kXsjA= + ca.pem: AgBOTP0IFMNRG7BZ6uDnIoGDuJQvleY5O6GzPO+eE9tJQxgyiA/fe46soyvI5DVh2dZsE1NiAazuvmuRVICajkHTfejbg/Sk4qDatPQFtrylpAMixzwLrW4y3u5A99UFXm6gNhf/sOr2sLx2qWLgG7+5x0Agef223FpDJt2j6scPqTi2b15gBlyMMsGeFzsznSH2jWMB+svftuuuZDzuhwk2ntg8HSgS+LRHUtwdfSHIddMxs5OcSe6Ru8MQDK32iZR8SteUpUUodR3K9ABpeNJaf6CF6vVFkBUlBSSYw82DW294IJ1I5uqZhVonor1OPoYri2oDvOYSuA1tBuLv6RRsH3o6Aq6lTaJ4cKZ1RtmlyWM2ATBdUZwt28KIueTnHrrI88GCnv1tmzZjM+DCbyAdTtW6N4b96HTbSREvnKAk0df4zu/ksg5wITbHY1tWNbQcf0eSSqYE1NGJpa/2vc+geOR7WIG2vwOtSiG8O/EXTCOhLR8+57j/10xENikC3vluwQ38Y9hq033aBLqoej1mh/bvx5VjULmHzE8vVKHSUEOvIYrQewI3ZLuM/i2Pu3yttUs9PSUPnGx/bvt84qkv3lTE6gDRkbu52VzL3Y7Ar2MZz5IHyjd7CFh+qLps5pvh52xJwFDbySFDFCBheaOYBO7aqAtEpSNBcGjiR1ZhfcFnUBI4sUqj3BJ1uNU2sfEeuzr5Kg6cUYdqLDqTTmMQkynLBSHRP4/0dASUxeammk4UyoA11XgAzS2KxK2qJKMTG0h8bzlbX/vgfZseBIV0LWzszUew7H99ApYFgE1udKn7jePGgazCIXnvjay3aMrmTFh9V6iBm6eyrXjDurgl+R5KDrdquJlx1G9DcIEp0OxaI9N5W/6LnBeq+Bu+6j+u9fAu/wey7LJ8UunNb1CpCkw/GsdtdyM2B3gEmLXx01bOx95/pQQpgZ0MO7fguOqDOmIeqYlM7PNSMAInzobsr37slgYOASf5DzYXllZOnwYGz0IFmSdpU/X05BYRp/uoCHc1juKxuLzDvC9fxhRe87gd9ljJGS61H2lJExC80xBi7Prxik85S/rGc9ZMqcPbwlEo34vUuZ9V61lGx2ytmZQEs4AZCuDiyOBymklmbbahHF6TagfKRMFz+DBqMlkT3HN0Z++24m6pJ5d5Y5fBqbKRGP+2qXujK9pafPRgtaTTfEpyLi9nfj+EAYvQMhxlnGNfZGvIV3s4ECMfqxw3DtXJ6XtAiQespZsioHNnlFxWiPA4GvhcQoVfhzU5LeZrZi5Fzh7SyW2p4wmXKmrIb5FcsQw8s1KZDG6GeATmIvHppbPxywR3AO3yGlsJdmEOmvs2EKgWZ8Jv+E9JgSbOxyWz13JpesEICc7FH9+c7S6tfLlHiy8jkA7JBBt9HBadxzwSxjsRFJbBlwDxhP02zGjiCVtxsOTx2mLRPhzpaUXMTUCappuBm5PF2ruS+TfSHSXCm59CMN+Cxws4ZIhcyoVddnmz6hi8+yDN9yXgawzmz2YWqGr+3jrqhSlwXdEBb6xJixl8HrVHX5Vwx1D1v1X3s5IeIo45FxpwOsfUSg7Z1TjfOmVC8H6pqkmGIKJK4uHdYdY/3V96ADHcXdQY/dh7XFdCcQjuAhizOQo6RRsHDbv7kR2/Q1IuOxs/J8ZgcnyjZDXgy+hMlEbMMibdb6f8Qfeg9Eyz8DK2/EV/uRbePo33OLT2TRxZriUAsqjcvStl8Z/ykBv4HUHeCSfVzG79HgEGpoWuJ+nQCE1BVqhAlv3ZYuoWncL2ECyEpYLNK7Q3PXnm2TzU5kLj/e3IoxX7JLkNwvNl1uc40pAej3mszxxDQn59dbpNjywUZQF0hn9xsTXh317q00XFoKiDbhK6/fe9GndlgZmu/AeUZPvyviKpknsAiKPO9t9lPGEj/6QbKT7V9GLhjPSH2uwT7m916IUeoLQHpnQnWj1ImqStqP96/tw+r85lg5XEKsGif3UOkeHwzNSHcn61W57aZvjiS6lzBA6esePFdDWU04FsyzGf3K4K9NL1auaZP8FK3lC6lL0aansbl+EiVh7ejRMlKCVl5TB5dA2+7oQYhNKnDD8K5U3a0RK9Z0gI/mXSCedgZMNTeHD7D/dR0+xtjKxqoRp6BjZ1V4f+e7+4WiYUX4aOLyi0Hkt75SEyBLR+uyS7tqKihGAjyos0DMipPnxBK9/lfQ1CEyYsblgyboXZwOy/CLUEC1xzgn97HDoZThDLwIMmQC6IkgVZEnQCiCC95VHZTHlNmZHOTlVbfiT37VGgSjJk5Bl//1uJ9S+UW+67EHnWsKMJwNfj/OzdPGMjV1JxnxYaehln7he4UBKc3i+IDs8MEbtIOHWuZhdZNevOji7ik4qL6OUM4uOVEwZIDe4uehGTrdCle2Y61EZi4u5g8/DrwG88DaZfByWTO8zWOmCUeM/wjSiebXAgcdFHSUorMFknqKn02ewQD2Q7cCkmHv++GLglbQRy2LKExH2I4pq6OzdGOjMNP896IuEXAefjWbxO+m2tnX5DrUmz8OUT2RxiyQeZGFStffVI4x4sRcB8qQAGU6Znze/n+67F2lqFFMRo1QyWmWcPsQlsjSkh6NiCNmBLOCV8TZtSyA8k4SRmjjj9rzeMs5+5XlBysymtFrSSl4AR9h8fo010q2naCVZXtH+DferHEnBgTVabeUSs0PXtbAjD56LdepcZU+E0QXsizOBikGVMqp+BZ6R1lXG96aKgAmWYxGj4es9A8v2dFRLFSjk/iluBBwKRv+OKsMNh3AhoJXgEwYawWmUt8UWJQRggLrSFBITFHJMzUZe39jVAZ4AforQrxyYoWSI40qLVvlQxXVXGsFPLjgPrlMHep/WHiGfolxVyx102MXNSkjQduDgcQPXmh+H45tQR7lC6hLKp/h6igD9uZ8glfrZ8BkBPh46fXdVtjpRf5xgwDN0jy2VSBnDy8NfsqfpAMyN2Ah7dU1DwTceNWB2/vxJqOauBfFWERa/o5yTrNoYSalJQldLylWXbJ0i83lh7bJpbjBuW++dFO2tzrUAv4n3T9HtsqEvFNWDcvKdv3UszcdYdghGuVBMMkZaG+YhuDhfqFRWiSIXZFC5NBwxSvWJVOMnmmFqYSrAOuu4ZktBev2vuiSYLUTGUVQCGJNIY5uJFLWHMAeTr+RmwNi8wz1ELazP4zl1r+cBKHsx66u/8HLXFp5/Sk8zc0iQUs+5yxZgSbvR+2l5wuF+/rMQ5hpkQh1n1dayK8d/wWFoRkixeS20goihZcsLulVQfDv8zRW22QqohnNmFzgYL00kh/qvl9D17SuCwZCDEuZ9JojFUErDoc+dgkb0Vtwbp7yLFZNO8LjadenYKsqMWl/FzPkuGOpuPGgmPq8+U0klYM4i6NDB5VpGnsigamHKZ468TPKVpAF3z8TmUf3QGm0DxwYCwFwNz0hUzD7hWtlaTnuzg8tfUepoT8aRp/r53BBLcN9KZCwAVp2GAGVygo0r5XaQFuhZfd2dTiE7/i0gPKuMWIXF+hVOyJ8AwE09tFj0feGe1EqTrgCewBydk6utzPfwY8fAYXZQVq9ne2qF3mI4fqzFUqTaZgbXdFWDMVXs59nqvvB9XN448jNNrd59jKJL6Y7lWnM5rZ4Zdyaqkbyznr1JC3gCGbvH/lLu6ppzIE1YB/q34WhEPqjY8bvU/svcXOVmSC69TvUb93mW9Ohq6VCCSgK0iykiPiYQtmFYgUdXk/v/ANy83mbK8CWlmGx+8jqp2FTKhbV29JkDm7Sl6wU1TSXqG4DGuw3OHpUo5dKsZD4bFwCzaYyZf6LANxLtGaAiPaCoDKc1Tba3/7MJi6jZv8cYBMtP0W6JimDZfHtAg7k09pgIgL8HzhonX4m3N4nUaNdoN5Muq/vMCrWBGuhmeKHW/6iNOT8W/xJaN6tJeYXOP0vhxNQBZ7pxXHoE1rDgzIygZKlNovHUVrWTfQAee6rS5zg9JpQg9HMKk5R63nfzz72kZ0/rXeH++6X9T/6dlxoyBNokxOAkFXZ4tdnV2eIJkDh1hr0yMI7iOGVHjOxppFDI5tmSJqyDXTqEpDS7AKN/JiyIVMNsgUL2QHPxqJMf7B07W0CEHzOoWaOEZ/Vhi0KOWj0iYYDNQw4pTPReN/ryXwIWRiEY6efz4Ww36Yg4j8akmIAMyore1rcz7a0FRNet1T/FqDbCUPY/c3xHD9yxqZU3y/+XXVDaMtiDxkB35Z/ecnjvNbNbBDVDSsVUFriwH4iCdGGx2wkUjEsjEY+4+pRbhRbK6NxIvlFGwcOSqclTJUhw1na8P8pcUUKseA0QvYfA4kjYXd9hcVD771Iz/6/2Pa6FCVB07DKGyhYKrAJ9Lp+EhJE8fNYAavGWHhN/+oY/wXADKdrDsTI8XeidiELJJm6DcTa2r9aO/eYgklkaqlvxVX0mRQb/HUIHv0RK5WE77tip5NmEGh9LyLow9jyS+l2AQ1wg8/25XnzFZw3aJrM28Q96t8unVqLOD7kKa2L7MGiTMElml4rQstCM7NFWFCr/UrURJvURci0swtoSu2RbGLtP0qt+fexB1MolSXmfqBtTA5tqYmfGz2LtVmZo5xmrFHz3aeSwmT6xYF9rJ4I4WXgZrbWeQcVh45kwOaX6kqo7aCvGOmbwfgEIm4/JK0U1Sf5EMpYptbGs2Jio/TDidgZbW9VvoilEumwJFfm7LjPuPCjv9I4MbO2ep50AEBQ3B76toI1N0v4MUE2oAoKCTJdCRl5HlCihPodxj59TnBUU4q+qD18UNLRQ/YNQl97mHA2Zdn8ygbo+frGqKFZ+LsGv6XgHqYzkyUinDdmU5jojgPIzro7IjWdNDXNAft2sYuX/Lct640OdAG17VPGVJigNDkYkDDas9CGU/VA8g+Rml3UgWlsUB9cssf8cBzkREv8XbOtX8GAX+Pbl/HfQfx2l69UhBx2QrRPVC7IFiPxG4f+DLUXS0ncum8YmCr1gq6vzsw0/NjhCixiBrxyHtoUOCIOtOAy0S2r/TZ+BiQVlT0HYCrUZ73YBOSWPueqFasFOZWCZbtSWPpdr54U2adaQlxhZuFUM6mC3Q5L8k5WgJbV67VtZs88rtt1tES3ZGAQlvfWkFFpI847NInlJfjG6PQIOkvWtpfUviwWyhzmuEHpfbbma6cI1Gklq8nWlACMs4xUk+cMS8xcY50MM0JxdBRQ0Agz8EAA6M549i0byDRPR3LRqg54xufsq9PaWirjqUOslGAmY4UEfiFK/TTT1z94/S9eIKn+dbmrg4x/uErjzp6PPbQMM0euD1f2ja5T/pqfvNUt8ybBHxmYnzjNYvUHSSHMeKxhwHWdAAmUQS3mb+jGnzkOGLgwX6uysccpBQrMUaYb30yIJhFg+xVd/vTZc6JsDRBcG+RPbnHdfmoOC0Dwhq+yNh4ukOPqg4gNlorTjhwskoj7ZF+v/hJhZOR73Va90iW9C/rjRe780ys93284QQk1/+1Jm1C5IoHI0BXAVNTJeAB7rkdGCmhD4562VUsNvTex3R7Ww6oJHXJ3rKypwvvHlrBCid8Gc/ulG4BS6itYdGUld3RbWe3AABX+37T+PuaEb6PnC5kNfqnTe9TbzJxeV3s5yteSdwHXtTVxpdZAlLKjNbjcz2pDDFMTpA7L4l12UU5KWdIAAQWe/RZu1dqShTSubJq6lOWb641aZdX7cjsbgYa1/nDP1AwIEl29DjpxnUQfdfYVPXdIkN13Y9x7rHVpfvgBM2OaErnnegUqFc2tWEBM8cvCLxARHymYsOBj8IhQ6g5NjLibIYUfhYpYCBH4hhgcXoBvW5vCVVaWAd35S913M+eObW9GqRrAGllx4Cg0aB89w+jL4sj6b+qmQxzUwl7QDt/HQOgDGZ5noMWE/1At0fo2XNMX1/ID1DvC7Rm/SE51LZIWTrhcbzKNTlSILMJn27gdBB1fuwMzhZzxrYxQaAOT435EzNaAlQZ/hDisXSREwkcIgOFD0tPtLVVAiJOCcsDVsK83sR2nZQOhmQmZhz3PM0YnmzdZEh9nH0p1iu8jwy9zqgDCp0JMI13W8LnD2yCbfipEw7EvHAduV1gy+A1SMpITl5TeIxn0x323qKlFGkrToUI7Nq2YxMtzkRgmtHDKDre+wtmDU0z9el6v4tuOv/2tBC3TM5WdYi0UOSm9aBw/BMfLS18CU+0nNppbRFgwbuGMoC47NHT+hoHJLg4coma9DYuT0CCphTTWCTSPJ/B8Vyinw4Q3AEv7JqQdPcEnsUwljlAHbdr6csstmIBDJBuKlEl2B/YkuSUGD5SElbxqVbcOmT5tCasWrgEannQaAIwqbWOAnijbYmfRWSwaOpXX34C0Ztxf7QyrCQ1z8ci/Y6QUBgclsLSCgew/pYDiiyseeC694koFGxzil9ZzEH1Wtiwxcu7iHku3Dhc/D+UdJx96GfDJxfxenxbIyC8zZQeTg1N07appHFtsPDvHEYvh64LivrI1pWl1qH6WmyfKXanEGlRLLTbS/AatTsz/KkvPpEE4yToUtPfSMAxVOes37JlX0jMAnJ1Wy9mqoJIe/cchhBczVv/gfYWDXNZhxCaM4JXxsJ4RuYLcVt5xcwGbZm+9IyG6mbtBKVxo6Zx05VTRx+kq5PTRhzMghPycPuL6PRRo5uMVzTgyI8HsV2djpHsfeTYxZKUIcVTCZRvOmjdZyRVpEY8hzg87C03ob1rfv8Pu/EvYIfElMiGeJ+gBs/o+z3/DtqgXuUQFnvu8lVbfpEFvhWQKKC+hMlFZZRk6goFpPwsk80K66w4QYsXHE1E9KDeBNh+CdJO8NdbVvtb/HJ4sRJaVUPVtyFSVlKyw4I2CQqKHAWkIR8aFkiNH3xxVjsqaDCP8aA1nkpCYnfccOR1q2iwpAHbcxQYoL/e/dAjlDAdVPq/xej22B29DmqhCvSCUMLaKO/7tU54ZNmwc36oiJtrvXZrtwgtKbbcDDjgt3uOBGuAuKW2Y16TsUlFyRvC+LwNL5b3Y2KgIKK9YaNY53hbdeAGZQYSisLcCnyBllfmHRPbSBaisIDZlOW12pCKqWkqk6VpxslHVjhi+aTXTAn1syfv+M7QwQAtsv5ADpkJIVW0gUt3ADdSBInOlZIYYUz6qYDliM3P8axaLF/sMKzajn4Nw9VP0+3zu0m0VPmSWFT9dZOeRP2olbo2X+A3CfFoewTLP8AIU+NgoQyH0OY+9BVkU2FNAaPTYQQr7bicy8Z52Ir16C3L3EyJilZd8I6L+j8A92o8gj7RVsaDW3phD9KEJlBS5oPzJkFDeKufsauv5SRowj6YR15qVa2KEnN6Smm71v4+fEfWgPZ9ao3qood7Os2vVoxIzi4QxqdFl2J2CENVmeXtPRGKTWeDNb8MFUUL/njEPyM03ZW/1TW089wFSQvpma7uFZNtEEX0PUbfZlevBTJmgr08AAoDeZctlg+NII2dgmnvgajqhK/5ena4z7J6fvlXyZUk9N7aHvAQpAVaUWqjey/dCjST5OnS/fiSexy+f8A/taeSQo2nvwaTIRn0fO1IrXwYtOu1SCoJDR0UGrZLi758nnl/LH/TzQd8HwjKifKwxK64xLArkIyBvHNZ7JXpZDeb35GVrF7WG8v8J2t4sLzmpOn5AUOFrbKEP6NtbZDTqycrd13YV4cPNMIqxfmAND5AasMELA4/uKF5V0du59uPiKWToYwkxzJbXOLBio4T/Y4QaVDcSrhGUuWR20/eUyCc9fKda8hyXJ776z9BRygFenWECaYqNVrmEtA+bnpjLsUL96YpPY+rYDddmug+DP7Ze2ZMGuk741f84S23pPV1LP6IKWhpDE4OC3ptMy9cNQR2B96pLhr9V4SE1M9EEiNJzfSw9Setc2mTrRh2ntbMF2RXHr8TVKnk6559pLc7WIBpd+lOihedjjTMel4FmxiuZ5ocYGt63rwKeK99qbaLSIkVAsYIg2T3sDBoiAyaGTwUVI/B9ZjHxh8cQ9aeY08DBQfP5czV2r33V1HiHnWwGuXDRjSNA3D2q5RU2xYqOYf+mc9yzPpetISJTxn0MW0o0GXdwOgJx9VsTmqcxzKcBDkRdmPVHYKsbS0KfdVXmEXVagt/w27+bHmBqSMTqUVxd5yg0bjAQWKQvZ2Xk99C3KXLcKO7VD/EcsRlcI0J3CVu0LODybPNStPls1e9ey/6pNsFCpB3/fi4hJT3UR/JjiDjTkRnhovmrPv4lqjeMgnX2FjXFNLH/ApuWLQaIXY7gsm42Btq6qG76xu12jA1S4ApSViXqjNlLEtYaJyMRlOaaoIb+gzEZt0hSaejM8gVOw4wHHXMulPkF9EWa37u529Fl4/SsteTHDf5gsCPuA/Y4cMjd3gfFEo+7tOHkbGzG7GmZ7lJnifN362IGtoSdvZwEI9JXttNkfJH3V+vA1BZhq9zHmi/K984s9Am22y/K1fmO/HL3pWTsPSAf5FI9gW3rVgrcMLVOzRNUCS+Ovr88FUrHeDfiNSPSViEw300K+C9O+0CF6eHPZjD27VItQYoDLv5yQWxSdbToBaN20iBneDwdeEFVyEcidlY+dbP/fg4Ly1NzFDzT6DsyxH/Q3S4hxD1ffR1ydq8RyhuZzhvMK6138oIVlYvqPagbgwtDelLXchsVmr64Spu9L97L9YTmn0u0kVdkbgO/crL/dLEmhyz18+wi6r7t+NTKBPZWsBWhDE7SP6gX8G/QtQsHGljfRRJDXabbMnPQVY25M1oeIU6Zybjsa4u7NCIhSSBfxROOyS5QO3gmVd0BJOhEK0SkBTjNS6Ou8/y58vI9x4Xrzpk4YHqnSmtQLgiHCsMAEWc0tHeR6HHYg+nPGqaOP5HI4MGWiX9zXATumq3h3sEhHw9HO2R2493pcJIW7ePpEaWvbHlrHc141Y+i2PkstVJbpweQHwH/881yc9wcmJ0ABCXmjPqVRh2KgyQ0K7eEGL+7EhojzkVt4kRXZ/DzqgdBbG3Z1FmfBOfaffrlCZ7diwGcHaUOA0NNWu6299QCm6fEKpxpZV7c4ROj0wJYh1qCccjL6z7QcO3hgFeWANFcgraizF5qZd92hbuRyu59oNOBf29+B+neEsFW8cDQV7YmH73YtwqpZh/MkV9xkCoWOrG6VCA6gwRkQXhsleRAGtaEPDRDlFubxNqwDlVfUeZVm7iZtQyMq9jSLizhmeqRg4UXkPqzL4UwVrlqMKEqqejVswhcxchv7hpJTcNN3Bz009MetXMmODit7nVPO86XHWFrfthkWS9NwqZGerzPXoSAHmBRH/2RhSLZkuK9BF6TQ63jZnDPkJw7ZnJT/5eNEZLmHMFxPJ7zfyDUL3dnVvU04OeaR3Ut3kJW8u0RQirMtdZwMM5AmF5uNAJ0YrT9+GbFQg+HPDLOTkdx+jUHydaYlY50nXSQpk/YGO9Bi6jSS5VqwcjT0DkdchbNvhLqCTDloh5pFniUgfqoVw3IsFdAJ0g54vG7mtl5GMPluB6e8KYPzcuU3SIwte/I/wrUw/bcDib6GCQt5+aGj/y8BBhQAmbzj/u2EcFS/0JGTmj5Pwn/w5FIx4duaDAW9rKrTxZe3Gz7SRLik6l0b+RdWjUzTsd+aL0sbmHDx3LK8W3BzJX8NXgngscbtXNkXB9Oyon+0MSnZ86yddwFzOAJIe51MpyCryyuKGmSR4pimVym7hVycLcJesK8AljX+RUkLZyyuhfT5NlUx9hwq4wvi6V7Q6M8avkVvyxLE1qOcHYsQQKBWQQ9yUOcAo35IIxucFz/3nfQkYjcMhRr0qKqBX7e42Qiw5nKz74ITXWdiT078jVnr5uGH1HI2mxKu5oFVDp4iotN4fg25zHvMTt/6sCoFPlY327IDEepqbv/XYwAEwV1SUjRphTkhLyqpSmJF/j3d5SyqwwuetAWQiZXSAC6O3pTXaK6f4e5OVyZwsVDkYDj78vDVmXj289PY63+fFHlXO3618h0eAXqjSelEA1wEScn+dUuxRliZ2/bHCA+o0yojpI99sxgLzuY+rgy1QIYkIBaypzqDPq/0e/ZwZKeCKaHQRegjpJY3lsynNeijlP3N3rkJBTG9y+0G8wWEn/bXbTf4j2Rqb3g05J3kckxsGWfxbadFnbZEklPlFdsCevIpey9L4wUmXyAPrKf3q9vRdKs1QeRv6IQZDAjbbtrRdqXheU6PpLCf+5Bw53+TeZEDxF2GrMueY2cBU7tR33hqOfLAKmFVOPTjlBCYsyJgAGGW6DPpBUpuGszTosUYPNMwLuVjT29fNDZwuWtHJxKPiuvY5ZixAng/Rpt322pknhAa+70IV/Y/NNeLSb3ge/trxfv38NdTqgzpQLJOxb4xVovzbp4awMRcSsTlPNxqrxVd/9E/jy6MO2IXEgHKLwhgRQvJHk0r6n0bNT4ZSS9VwuPQ8P0t4tvBJ4Cajeko2HT/Cs10eSmTW+hehbK/NXKkQjBP32KVtt+QubNmvs70wFl+PKDmCLzAUgqaxbBbC4dmMHd5kLXxyTlSB1pRtnRoh6pSegPOeVh/dh8Gu91K/1slvsZgIdNuAFLLMF2oyV7vmZVqEFCmj6JlonTsgysB7O4Untsf1ypWQXGjgvGp2R54Y/VJOGCppka0yxBYDoA85Is9fZXdhVUXk67RecB8O0paCkVW6vXNwCd9WIdYvuQOzy3VnVNRVul2L2V3Zi10O5Kx3Ih7X7pNeneVqSJS4ag+CnLa0iQgqRB1kGV5lkjYbG25C+BLdbe2gMxmjtQ/RtPJTur2nACbLTKACRo9EMA0ZA9M8LsjXPVXwJCHGYduYI/q6xtLeg7xpZX18JhyQgSLDsY3SHOy9L99fAfbrRqUfqtLEUuAZWa04xKTDk6SPVgMgpdZIMJ6qIywAaalZ3VDdmFee9YcjQs1UkS7zLWXlmthvoiKCYnWcgwH9V1sq719FPPtZzi7Sz0unUltwfbI2K9NbE4VShsA4pOosvtRUqLukw43qty6WhSSWCigzplP/h43fsozUrmf9DBJuVVbfJa05jGniz5cZWleAyVPTD0X1v/ptX1LjVOnTUgh4dr62g/M2ucmBChVehmTbgANbkSqGKm8bE779ZGmujNTQJWfnXdVxTbtbQL3GSPUXtOUVSx7oyFrOw17ZZsVXjn73SftYKAwhKrTw0vxOy7Mv0jkA/KrEVL58iNdwPwiMBh3Sbw686pgKwo/EShMngas+N+v7hYVF5663li3O28bdI0VgWeLIhe3ys5DuDXTmXbMjr7Up27vjmTtgrCXZAhzBwaN4WnybZccpEiX0NjlqDrDRmwX6I/sXjA+xPl4lk9eGsKE/j1vRl5BayIFEah6O81LCwWUWyDRZmvBpGebyO8MFz3swDzmx2M99qBOTwc/GeJ82VhhXSvIMU8teiBm+y+b2JkjbKBN0dDcUrsyjqQ+ER3kSZqYwQ6fvBy/TNGkU0Rujs6A90frh5bADErWwNiMVy082LX64CAJb8qUWFHPs8POSnclqCDvMjSt2P15Ab0ZE/gcV96QuMS7ltXQzwdkEeJEvMpS+XvD722KDj0+MKuGQQmixHsNRRqwbEPb13H9VNYPNWipNV6FR2vpnPGuin+XJ2ZkYJ0JZVbD/vb8ceDWiIq1Br3MkzrSkJo15CAZTaXEAjbJ7ctNEdZ14Yct+gK207GmPnry+HJeIAko3CA2E82ecsZYOKllANNngbkqBFPykeSYc+Sl9rnfAd+jfDYCGqYVGbTw6B1Chkovk8A6ORM/LFlfYVOvHf+ma+bSKM+gsKbvkQrtxlnH8T7OPbk3IHzC29mayiFgrVe54wbhZfGNVKIR715ZazxOMvLx8yrW85MBxthn5YjZ2yhYP0Bjio+JrsQGqfdPmTMUwU1D8Pk5ZExOkwS1YNUvPhxeUzZlcPi+NgYze3htK9KifBBX6qCfpY7wO6J7mzkBCgmnB4YkE2zx/8XOgaAsTCe4XjCWA4MRIQy14efGgYDRiBtkSv+dpUhWjmVdCwaeem9tzqyedB1SEXDxgjMwbdpZpnHLeHcGi97B0TH7tz64+NC0icBEGZ9d0mhrcdfshvSGktBiG6Ds86emRCzZwPO8wemi3pSPt5GHDOl270jEpBlEck2qQb8fnujLRWajVGD3hJf5Dwhp7iKEjgXZiY5NIqsdCtRIB2CWIcakIfOXaNJlOORW2zf6o/B2Gy5/kIXIOFfXisxRfShFEh00WmT/jecwHlq3RekQU4VOYm89n45RPXaii2I5kfM9DLwGMyom/I0Chb5aGNc7vatR2Duehmx9irebyDOXwDUxUKrK3JoYMGSq538jR5wgpkn8SvTnOD1WwSHhaOG+FHO1eOr5AOopGkcByMovhCaWsoD6002nos3Y14RA0uUn7idUxBxFWrrbLVecJBapMnAMh74WMNLmiFEAtTQc06IEsz623GNHiTSNnGEoXvfRYCy3Ge2ZzO8czO2k3YG3OTjizVjKRWWn1nMEp92BbVkCcyR6J7n7D/3rA3nfb3KKLPzm4In3K0pU0zw+/RZRsa0Aj6/zNxE/e6ZQTDyfc140DCkf7Ro/MboCIBKFQHR7XRJFbhQf0wVRbZZQkuhu4UCNArqa87w/1sU7MlMzEahPaNpC9rxmmK54vFQ8DouM+u5dHSWhoABEw67L+ukQi1S0C74XSaRUeOmOlejMUTmdBucHkfJvIYzQwIDLDo7R+ObXOBNNVncMvTCm+xxQLzAFIj/FQ6cu15E+3iz4pzD1/qnu2vNzhCkAwDBZoWcdSYHp7h8Jlva0Te7laHd61DGRKiVa7amp3ib8wSSuHD2Z+BKFCifrb2EgpgUMVHqDcZ9PRLSjQRg7uqAuToHLYwuLVi+HaUk0GygS/cOBTnC44Garuz33gGeDL0wlwBVeisLnLKOZUoIP2l7wcpreEp5otpJ/xcqQJ7zCzLsa1DJrlOd7LF3GiGrTRUEZ3bR2ULJuBG2sNJ8KHeLy7CyciAfwoYN10ztDRh867ik2Xh25eAuVt/J2Pbb7rFzFxzTo8ccwX7TZIPWhW328txU7PHIfoWUYEHyPwNAPzKs/6k0YTq0Zj97CkKUgwU2C1uf9ZaHW0Ef1y9PftOfnjd/IgWAJswxvlknSAvRiip7F/N4aUCH3ov33SEvkhyAjLz6QxmZPJerdmyzzDxLZqsSIGvibf13uSRJTYldwNabDuqlL2g7d5YQmBG+xvjb283DrGUMOSSL1ZOslffItdoXee97RmVVKUHx9DVFSfeaO9vYS27FwOgBouuivKjkigU7Zp/B61K0xekcmE62ceUCr3y6KYrk5ozBfeKAFv7aPTa26cy3+FLmN39mciNtMVpBST3EoRCIUbynTRM7DiXDHNZQGTVeEL06KrIDsuoKLlWWm2Y+QC7hG2PoSeQKS9kleuU1xKX4Yb6ss028GsVT49hTEFNE0oEOrIBF6iBmJ3bh7SH/b/1GBMRfmq9N8ezulMPLbnBGXEGrqxp2aJJLK37coOtIiwZQpzGjj2uCIqrchrMweqOjBwYumak/v3v3GdhRcJe8KyMksqQ249KAmbkD80jJnQuR8EI5lbXMQPEptGN6QUqt0ndLZiPmmT32/e23zmuLX/N6DfJ1+Hpb1dFp7tXSo+1HPRkk9/E3mCYyk0ua0wjqCC3GAKd2n4nCcUXQNvfzUZX+qy0Mu6nlnq/2XsjKOD1lRcJ4AlrBj4JCOyWILw+fvYSzxYR4PGHPCVtE+8TjEQq3Buyb3wRb+gmw8QgvZuJJS3lH3oO1EH+r4JgckqA/ExEYOVqwQcBDwbYYV0GJlPxJBnbja23jlaKTkgPRhWWmvJe7RTQlHVO3GGyqRUfvOapOUC7oa0NfQ83gHkbByR/fm3EgpdjuloYoVVZ7alyEAxfFzn8omVXjHhdh79mUgTzjxS3hv0lek1//xPdKjN3OC9QuQznVSNRcRxDEeL+wVZz3X+K62IchbYzXotT0ran6Fv0wflNYKD62sVZeqnhHPgwH6NHxkK4glvAq4xZL6XoeH7ViQpRXxbe+RoRYkoRwrY9D4rMm8aPQC12fRtx5IRffxN7n2RkX6lJ9nxZ7dghUZDRYvNTRo8jrWMp3GQb1z2VZV4CR1V1vBYnO3upynZM5BSIUWvbMywIOsuCHVM0M6RT/VQzxxNOWel9RI3UcNLT0f+qxESIo0m4sB8nT0gFfWL3ji5Dnxd/iwc4SS5qquZjfjbws6SWMkITzUZSKMos0DYNMiqHpeVR2oZT1GtZ3JbTvbV9wZd4s5WalWn8bVtfipb+EfS16BQ/gw6FTaY8WC995Qs1kBzQEAxykqZ1oVUJ97+Q/JIUY+9Labk7MsDvOhEB+HO+pVWxYfS6fqJDeQ86p8M832mD+jzpQPstPPFPyX59xUcltAFPrBzbVoFDu1YiXCG2gO5vZLnRF2oCYtliSbadJDpenSxLdPxyuGtqFC0Z+/HqoOZMfd9laUJnWOpy8sz1Op/kE8ym3epHbdFpdq3kre5PYpwJyxPtqUPsSkNqDgLs7RRC0CKXemA2KXjnLSqdffby3CSGGLY4sgIxOU8TG+nhD62vx7ibDoegPrGjAojKxpNzFMolOAw3/o47+xPrD8f0SCbidazergWN6crJy5FidmkQjpCtkKFXArRxNbsH6nE3timCGQ= template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio/ss_servers-server-gridca.yaml b/infrastructure/secrets/rucio/ss_servers-server-gridca.yaml index 6de4e39b..a6c16d9b 100644 --- a/infrastructure/secrets/rucio/ss_servers-server-gridca.yaml +++ b/infrastructure/secrets/rucio/ss_servers-server-gridca.yaml @@ -7,7 +7,7 @@ metadata: namespace: rucio spec: encryptedData: - CERN-GridCA.pem: AgAT+LNnYpdKlQDnwq8dg981sLbwcxTHSQGWEawMX2o0jOy65yBiDKtot0ZhxFbjpLybnPTvFtZdxvydYS7dEV2xJzo/EEKnv1HRY9AakEin3ob1ChVH7td9ZgsrNQeoiYhmLeTRonTV33w74YITopopEPmpieR6OY+8q7iudrYojcUHKm6MFoNOmws4HUHCAy+Hvq4kK7qq1Eg17l0X4nYx4gnjR+lgQCxbzex0GNgrTtjsnunblZFafGAkmvlab179AMYbHxsblac9Bpc6ORWrhBRshifcNrReG4qG5JIK1UJ3DMtNhEH4QfTUHoDb/Au4XM4g46MDp4lGeMI5di+9GsHlzD2GpWLA5ulMVM9en1f6X6iwy6e+5k4kwt8x7XLkNUXydGnqbQaM8L+WMibzlUZjhsKx2s/F+c2Eg2dg27fePrH/usLP0oTx0eeOhGKyjUsCdFdGnG3Kn2AgM5IFj/YT3D3HoAPfAfoxycUtBj53i/3eOqfBXSoR61SnsNePXK/kGDvhTMg/3WIh99Q6DajIuCKR5Bx0hJACWMTxTh40Tlc7ZSkwNtWJFzdSWXkYIy5T/IVJoZ1OIrwOctKztq7B4ZTEnT9WJwTjRvHHmSRktoe2KW7EoH9+JIquZOb86XvYt/DbR/wRpShEAJpxMndpyTSgKP6HJuYtzuLXt0owI1pYwo/29+Nq9qS06V/8Win2S85jOtR1m8dpX6MBqAm5QGQUhqHl98xyT6EwNYp+dqRn3WVFTLil/91GHmyUrqaf8uk8vGjafXbmRl8+iAdVPFnyRn2GBVfsZ0Ar98Flanc/LgarJg8rMzXom4hSOUeNRdnby514GGrnxC+rIQ0RnHWdlEps0vmCaGjrHJxSa4W+xMiC6irNAbLbFAI8UECEEKRMCuFTQmkiuqEdl1uFDaN8yV7IpA7P0uQ/Dn8NmWS0H9/hNqBlrldUwrCxc3lU0VI74yIQTY6vWySIjdCtX4ePLX+BkxAUG8PdHDVIMIDAUWf/8/ZI6ukn/9niSPmHTRh6ljnVHfSEMPN+lAP2fTKhS/nmUFRiR/TSPD8R9k7liwjoai7IJ0QPmGibEyWFQorKA+uI//h690lG7hL20LtNNe1/VMklsKdB6bJMBOmFnOBjo5E7vq0nCQOuchRgmvgbgEhgpwiKb++1uKzLjZG/MnZVbrR0emlDT+L/pF46GlfdYpabYpSM3n+bPboU71rkrcpq9/1groudY5wXHAgHTi/W9sloppdtGsFv+mBSdU0KI/7LcRwvBMEzqNIwmCqZ7umLDlaiYC8eq1B5HUiPTqqxwxjUAjgedlZjdoUxyjTxmhZkiyOUaXhdN4ww+/ppaZme2S8C2OG5PMbSBss6iJSOjDREeqkWFGgeF5iw/mjGRxP06v5NA4ZfFvtQwkHrCK1DJsmW5ynvfSe4VYvyyNa/TmRZOxGD1SlZY65qEx4okLyviycIIK+j8DV4E8BB8g1sH/TNKEZf0bo9QAnDUAcRi2aLnHfvBpjnywInpvCWYRcVH+cz6mk99tUUXn+rcv6UNipyacLbU2v0vs87NbYZTqht/z5EH6DlGv0Wb2owU4xqL0+Xu30hMOMqgHu5DJh7lIL17dCGx2Xl1LJcahAjjr1kmFWRBrUKHL4Y3lm6tGizhQyxfnUpd2pYDavvNYZfo3KduinR1cU5Db3115cE1AgFo/tezUOs+1G7YGQ8rlwHywtCp41l0r8x1LlEHWmk8H8zbJNSGghwaEbgRgFJWg+f5tz7lU1PizhnyV3CBu9T92W5w17Z4oVSQLWQX6dhsBh13YSeY/lgGb1P2CQhgJ6GqJ4JfpMYogkjB9wBj042CQnYnyvLMmRHI5q195EawQ/izKr1P4+TugsihTgANtJN5g+M8J0qEVbDYJ+yLxRmITj4zubzkEIdiq5tADVkc0o6eALXASBd+LES2lMhT+uqERUhfKthK6Ekf+ryWWPnwr8qJTmCQpWJKh6Oyrdcs42F39pg9jzx/iwsjgtsAB6Bjaw+adVy6sip/Kqd7vOHI/OLrriCC0ve9ehvOAU/xVmeQ76e9tpszTzOBIVHqNxl79UoECNaPZAHusbhKAt3dTSpALijF/fBW6Lone27XWu8DneQXGoHwuw1XwmpZvNETEY3GWMihh0WjmIQWM37JhjCmDOQw8Y1QxmSj/fHu40JPZ1ADZlcdl7UkJXsNkHMdiqnqZzlD7t3stBtEKtZAs1Yd00oBHwEEja6n9H1eftFpfDUey8QvBZEkQ9i2Q/aOfnXlN63S0n5MgBJZOIP6yuEcRZlWXZXtQLyRs6JL015UX7UTBAkHoqeIjdCCFzbr1mGN4/Aasa1OBdRXnJ9IAXS2zsb0NXNDJgl55TZf2peyoDYGtjzk7LP0ia6WSQWUbhyUsQE09eR3k2mMM0Pu/C1HV2bJ9D2vh9cHjIh9iByj4EHzvmkzz5dkthtqAGkRZDokoXvDlwIBqArZSuGC8PowUTu0fA9sJNAAom9nsA5Of5Ranh8dNLHwnK8UFLV9/w1vnB+J6pvC6+f4oAbQnvauW3/YUmGkkbHcC8ZIP7LpubhsL4CMQTvV8T5c2qM1tYG82v9IBnJ83ZMrXaWaDjSCJnvOiOrnPnlL7gsyLn89BeKfhwsGBdCp0/WMQobgn0+M8ulFRwYlUGdTUciCT96c4674c3VJzq8GXPOgJGUzBXJL5Pv2BahhzAY1SP0y7d+7abgOre2K26aejMGiwc0FjAlbUMhsOLuCFxpnT14SMNhVkcTE2+tc9T42XNRcVwE3gSJ62HN2nrqqvjyFj8K+EDKVDJyl9pV/61OnnBu8jYYxtOwpM+VPdK3n6xsU75OwXOJ0ACCjlsX2iluIHbFaz8YqVU5HQ1njmKuZPzLqpCAqBWCcadsOofr3Oa2LYJxdXTSs2zfn4jbAGDNe08dIzBiPYyhvZoItpIWhFSD4ZEZHS7olXFjgXDHuBK79sRhL28+h4aTlY9tRHLBl+Lo2CyV6inQLphoerYKw/mbw8kIEdbzwZtRmC4P63/eKV1C7Y1zix9PZZNCOIuCjH8c5/s6anGQepyUWatGdIlUYfcOEy6MmZzw1+XOg7Te0VwYyk/807jXlH2sds2nQF//7LJ4ZD4+ZcJnyVSHFYy6rS/YD5qjwzh/6SUUjVd+kV4vVcKLLpn17NRxlYAHz6zOFIWornMvR9ws17aQb6DlcJXRn9PSUUvaw+vQuafp33tMZvfktlRXEdDsj8thjcJ3RVfaKKD3XFLdXQaCutYscw13eW13k8x2EmL5HRm8O2djYkDd8Ld7zYd/fRqLZgOmSLVh3voLU2S+LBizozMDYlbJA5zckPpsByJPp9NcBZhWMtmmjDKj3WnKWidDPviLS+ij5sa0PKNl4JY1z/eLHl1kFpvqtB+YFf83O2n4D44AFb1KDUI7fj874cHa9wnIylDoHRHWu4ll98Owv33qZD+OkNpAfK3BXZm0mI+qjhw3ZyLILe9HomalegyDjDD5KJsnILppJdNbW3TtiRhZR4hfOOA2f2xhAp/pj8UZbQiwYe4C5nKLbSbItBSiGCgfCSjHkZ2FkHmeGFZX6bFcJVAezdnpRSz0zDWxh+Nx+6DPwn6ja2gTiiHv7Fn/VcZfvQfdGKtV8dGY9fx4eNGvPEBcxc6NEp3STRVeSiwrSNNen6Qn7izyubVN5M638QMJIoRUNO0ZSZr9XRnTq10JvES50D9iR6eHQJTxRtixUHbpTTtouDjnp2YZKzFx9I6muaiDCT0hDKijKE+0ufX9ya+Q3GNdSBTeW9b2VqRq3ZDrw0YeUZczrSQkyqAd+kG5K7Q2zVM8i1uDizXG2ETRPVAXXLhwvegyIsiB54ia7+kMNxyUjOZT+0Owkrj3sdj7ptGiS+cTX8Qd0iQX0JNaf5BnRBbMqZVISMRtF+oBfyg+iXTQ3G9Hslz/5VRVNeXg+QwpG10wjf0Q1ZJiCpU5EjwrJuKrY36DkqC9zoZlsF2NZlZ/nkUgDsTc5QX0tDHWdzt+TRl+g+g7VCI/8+O/1YuzWOI+vwi8w4/+QLEQ2gIiHNcUtchKIVFO7kFs0lnNdky4AcxfPSditmMJf8DqIdkEcRn8vKhxREdw5CB+2mfIcyGLCxt0F/f3tTQfbUxUL7To991HhqsIXpXHHc7v0qammw7xeLrxDLIkwKglzzV9wrAdQxnke0panI0E4df2EtCXd2zs6N2+VvpCd+GD9L74BtR6YqH33HfiHQ/qV2RdclwzmjtOJ7djaFSJRRwZLjx1W6Pl4AU4QsBNJxYkljLXeDnkRX86DZskuiI7VqaFb7xvPBNLhQfU5CLppc6nhMp8YlpicAokDxNWZm2fBVORsRi2N3H1sArVNgfzKt+pmkvzKupedfhgPxLKkROnWrfpTWcNcbWEPBysGLYmmamoHHQdwe1pdSK0q4gO6tDtMUQRfzFrzGiNs4f2AXxF5BkpiQdVxMILIqs+TrcIddRR3uCJltvVz36DPVGXL4L9qkUtj/pbBXgZTANMtiOTxuFonc7rXfoPe8/5seZM5VAGBdUqLcmYYJ6qRTlJHDIEHSfckCyXKcuzAUstimT8AyTud4GzFyjM9D4VsSxAu2bPzUY5ahemUfvBOrZqsktYL9fhEPuPyjfgLM2VMyVgkx3q6GBp9Muz3H+in5gIvx1gYyReBHadUjkyvu6nXrkSoHkUDAnoTCsszyWm9RGPPcRIBd1WpDWK4SBoxK2wFcyJyHfWiIn3j79m7DAlQMEw1pJJ1mkILEMMKBexyA+XRt0izkrDT0o3+A3upM3nhfN2Ja89sNJZB1fq4i9HYKMj+aUNau4FKdcS28kVkTn7QFJpkjuIop7lBC2LDunsE4Eg670Nua6Qb0QfTSrscGOaj9hujtzTiymhSBCjafiV6ndsrP+/3tFiZufRIkWTAw74pDjVAELB5NeZ731N7ij7tVqC3Sf6CebpgNoOuKkO/Ke/jwAWiYxrPu6KtV1O5dKN8gxk07zFMmrhvexuC+I6PUkCOdNKu0fckmHLlgpoH7UFst1veUpAmFv+ROJERofumrq1EbJYuwldPNRbRlTsIea7q0AGMZa+1d5NDex9SP+GUZ4DVTiNjwM7/D9zuzaRc8EDwYGTaE/LRuwuZoJaied0hlWzR92TFFZHeRPoafc/R8IqAhwdwaP6ZtMl0qZB6Npd2/8FzC2nCtLPYvQHslhC + CERN-GridCA.pem: AgBhHcBk1Oskq8cAiUUQZExYildifmIeZBfVPHAHCyuz3L9ACkZN+xe0j3nzzNK/i3ByOhJqiGQL8/Q/9z5xVNMmL30CuhH+3137iDLpvyx2RstUzbuH/lV4DW4V8X+sZYaGZFT67pPmh31cHEm2B5RNr7sJbtzHY00ssj8FzJj19HQN4L/NMgFHv9hA6c/BNX+5RojyY/B9u5OqWevOZR6RJTkWhg6rA/iCEiToThZEk9AUlqyIAkmurKayvTVUkf+IK8DxQIn8nRoOAZ8Q6S5jWGviYD796BHoE53z22L6Wf7kpElekNLdtDFnI63b2Z9G6XjnrldLDQM+bAQa9s1FXCXPLqF2Tb+Z71lT9ULowl0DMMzO9KJ2JuzR44n3bRye5h7YZMhr8rtJcfrPWj4XXd6Bx0L3Xxcw9Pq9fJhC27h42+57VV4oGGD4h1Wb3CqOAnqTAg8gvrJjhTWkfTMT3WZOIs5Y6+jTLgQ3dcLgDUYHO3jU+/Zgl2jrIDuJ7weSy9DKkWUuJCzi1Ct8p/z9k0oQ5f0BjEgyw8GFgIVHv+Lvpvy9LjnVoi+/lhpu9GZPew2jNJqFFg1yAgEx5hZ81Y109eiycEvlQMGT6PJrNpgaHfR+1wMt7QPRErtNnqGbKz/deklniRhfGNr3TmJjK0saxTkLpqv9s3o55i0/g64WyJdTksXPxCCl3v88RT2ZttiSToqRlOvzqjKDu068r7KKMZ566Xmgb3grskLFOwQYJt4TNoSKzRuX5/GTjsaXXew7svqQP6qCZN0te0PNNYZL23j5aCC16mNBYqMPd8wxetW8kQ876/faupsrcvX3e7ZpjRnmllRsDVk8a5/qyCxCaCLbhxFJPIFEe1ETgIBjIpeLHv0KoU/Zj8f0CpuQAIOjL2Y9RtxLXFjp8SecBkkAh12CwV9FSsvdKmjt5MeSeYom/W9AJakTC1pbLFLchKBOQv182SlVFmnGCpwPTEEXC76T9glZcMjZKNbPbluFopoHS0Qz7V9HZHyVs7d5M0VRmP1ASEzQDqmWvgq/8UUimef7Tj7PnU/Q5m5cYIub0NdMAI4jc/a0sRbZubQnFdyfsiZNSqi5PBcSppL0tjvxCNYwJ9zTQsnWte3Pw24uRbZAH68CxyYq0olmQ9Rz+/JdkiLPshlFKVVVC079/Vk32ipTXcHykdhHSRINNK3BU0paXhbAyGkDBl7HvgZx55/J8WUczOhHKtcnGJlks0D6Pn7AWvkNpRQiX4kb/XTAfXr+93z6ARQbu0Yx5wBdd6RKvgjQnbdgLHyD1qFnbQndEmb6w1n+yK/zzOrxiViFuitIccQslYxQe6R719xRUqFYXhhvaErfmSlf5oY/Zk3CqTBd9aQs1ZuQ6VyPcL535hgDJz3GwTeYKiUTt/hwIFksMIPiYPzUce6ovZx0I7C5CzM4U4Ei0M6qIdxR4ZiyaOx8Mm8XCLaa67tAqs0WqcRhky0UAD8IS7GjdaMm+VLaewq1LqiYPHkwAVZLq3fqgquBZQyGgyG+vTAduwByDi4PllM19Uz/8X+ws3lHGC1I4I7e1fYyE41c+3k9Yru4L4Ve6TjaLovVXPNUFfQLS8uCSg6UBCI6qjmU7oFYxkq2rQUpFMGct+Fkiox0k6E9/SmDa0drX1+uAt58E5sosB08e6201hBys6a7P1w+VbsRFyS5/ZA2MO3y/f/DKQ5LO7hQPmiPNPDetiyA0yBZJXxSLb5DIR/RuCD48ftJtVzZcfs7LCgQe0QbHv3+im7xXzjoSu14jdzIJVIuXZE6Ff9xKpbM1Aq3Ou0pS06UIES0V324kSNin9PW0kVyADyIrlzBQojuq4phBLo2fyGw9qMSi2u7A2cQAeOPvghppySTLCZe7al6xmkPewVm6ejXukGkqA18ACxLb4vB96Qp1v+KfvvYR7fvYALSPUPfHZoQPP3yVa3rqJgA02lPG6/CTGX4AFQr+mM7FSdwGpuT3c9ff0hL8GJMps6fgMfZmO3twUCHp8Fa6U52mb2GyHay36tt4tJqkD8woNJBdmZAVXq5eC5O4FvpR0Y9MjGH554NPccGEP7mj80CFlA6bI+gP9ly9eG+7x6PlhOg/vLs8qcMQIjSknfOVgmw1KpTtigiK6t1LYq/xUM3jFQVMpa28Lkz5HR+fc7pB+wC6zDioCz++7/3GogTOK6unJ4WShyJ+91qyOb+Cr91uLtgYdwFCndaeIUaRZ0VjeN8v4P9aPrTQLZ70hS4JNnNDzoKKn2OTMW6Ia2L04Uga6InaVImZ7DIQIXLOAEJkjqn8IVRvBFIXeEvx+t9DDiMKbQzbDKtidW3OfM/bZSI30h/PD5xo1jEWNiX6ORmYz7g+LBdc5jdnDGIqNcuf6d531t0YdcGiTF7IB6keEjAvFM+vXl1c546hssn8hxDw5S/sfzvNsW/7AfwAhwLWxeQge8rdQ6NgyT1V1UQdu0Gep+wydd7+xX9uw1w8kU69BYVGrTVeVxKmXw52UfB7zl5rWsdnf2HN1wjzJWqCTUcBWf7yiLz2gjEW73hd6V8FwefS78Y0/QUV/U19f9sX0adImV55ji702h399BTvFVsvhq5lAwnaFT02NOdR86/UwGOrK8CilLLFQuRpTi0sLj3JcJ/pKQYgVB3/7ZIFLqvccBCzqMI6Tua13QWNZERyjeqk5bQaeMb+7Lv0tuf0o+YEU6Zm3f6k1HRt/z78FRlSyo7nSBYYdR4mpyfUEB9CRVU8X/GvmzmcDzLmsfmrt6oLQIDxl81ouMVTWP6Jdcy5Wkiouoshdf3WPivHIdbuk+fr9k+iU6rw1SbWCmWRHfC8CBLNECIl6qInqaxgl8y5cTRkPQaozHZEaylQf5g8h7wna8JNXK6gCLpCsw8Ar3U7pDkmuGXSHfIu6oMiYtIujKmmz7qryjL+HTZ8DgVuKYLK32CV5LA+X1QUXQFL2n4h/D4/mWndM9jTHv8QuZ2If8hfU2IwGna+gYRWQEWrbQoOgcDjdJedfHtpy05t3Ja7aufVpozcllS1D0Xvop67ploOLW7izarHEs15ic3axThUyQmPcGeCiNjiPpEqnzzPQBDBeuPc7hiWXic/EVrtnyscWvPwnTHT8R8tBFdyZnDDnHQ3xrBCcM3I0gy5/r8uBSxhXNMxCYxcxc0QeA5yAsbPs5743R6Kj8A92ZwSlecwUqNAFKTMxcGIjyijaH8pGHyLXJHwHOfa+HT69aMdxX2Q3q7kMdkJoOu8I0yPuKzYkp9T4cKwZ+QUceazTffhC6fU1fsKrPZGI2Z/cv6Y01HwcKFveHjKTp+WmHv8+8TEfWrTckrswy4hdUQ5Tq/KV5oxGovq7GAXTG0aT8ErU/J2rJLNZv1Ti1Ub6Wl68f9otme4NhlaCjyjqrxHJ+87SH0h8s6sVE/M6xfjhA8Av69zQH0Zj/UXrN0XKcJHpxwPYl185/B02MYbNA3RcjZM5oAkEq8r2//K/0qy5gjwek+Re78pQNXYXsG1ObMGedpF4Ir6HuNLjtt8hfutDsp8Lu13xZYRg6AfItz8C6sWNzZkm3h0hI4XRxtS8/Fu1GL4AufN2wmrwGudxTiZ2I6zDpEHlD5uutNyfR1+qyKoA/N4Db6SBZSu6fPydha3SNrv5lbrX+XvAYZ0tj8+y0VWMM6V8SULs/gJgxAabuRuubAaBW97wEtwC7L/+auehXqcSt8edyRI+M3sOaOjCmTaU8WxGjwpX4/1gK/lzjy0/Bw2fVZsSMC2uVE+xK8qRVtigIX9WRpdfYgiEcR2bPkIjU9L0jLA48qmER6dFcUjPmP+l2wwjZ7iJCKfcXVS7VKz3KaAMV29PNkso0G9pk6sOUgtEqR1I+O4/NzH3OLlLACcZ89eUo1TirO3Aw58B+pwHz/huUBRJZVrgtH4jnjXwfJCxObmV2I05hT1opF5R3fXOXR698GtCj69r5ihKq0m9FINO23iUCebIQ4K/V+tBj3+HZslSPQ7Nt+I6CMPYpigBTm/CCAzWXIDACYNx2d+g4IaBE1d/z57zXlGZ4YjxVpZOFJ+4NwMhpA1AqLHbdvpyqcWOEnLV21D6mZ7HMDA2/ZNKgLZYI9j4d7O7ghF6dOdni164BgO/aT1DNcCBUYlJNTnZn/awT3XrEmQe+NQ9CuyBFyt3dmApZinsVRtYu/RjfBztUHnfiAoXsau0+v5ftksolg95dl9bdaalBFCMSPjNcC540vsIkZ4DnqKo25K0v1cES7HRmW0rlp5B5rusw8oca8q61SoO7e4cu7Wga83HRhKfDRBWGhRrRxfMr+Qpa6KDFaLOaUZEvHBEvZ2nQsIPSOjudVeDtQWyqq9cQR9Aj/kber3K8GALSKSE+kQTjT2i5+sQ13K9tcoxsBpK+ENBIn33MhiX0GU/a2knnuXNvhrVrFwUOPdtkyIRJdbCi8TzZ+tjCTUEsL3hFog7gslj7qKor64A4sAUUIYYG7lZli+NQSI6guHVgRiuPqnKQaqUcLM6WpsOAV9weEB2KPkW49xg+6zuDZzyPBNCdtX66BpwBOzpz7f+liNK/bJoqW7OJU7j3We77dfkk1sGGHzlmLflkD1Soixf3mC6LBrhWXgdcjWp4T86nyhFMwGz5Fw1NUQqYUuY+0u1llGUxFI+/AP9zDk9eLDLrv6VEc7K3MpegkjjmB81VNTABthy0bWL/es9Y4s5MWGyCa69kdNH5zfIKhIjiSZzgIVNuf5uD2r1JLFBwdiEL0ErZeJOLgL88Y6aYRUg25PiF1qWPg2e5slIbB/dE59wtL3xJLwy9l7neFu6KwriWxrunlg5phV5XVzL80MZ+2Y2AVnS3jsouAAXqE6Ff/KGm9SSyag0n5soTyy1Hjws7Sd5qmJjZo0S3T4Cas/LMBhOWc+xRmchliYzexCCoT9jUSYA8nJ1ZEzXAzUR3JzjJ2yLVdiZPPDm5hbRy4twLXw7Rk+hw5Ff8vaxtG/EZOYGgM6qO4giTNxfFzPM8Y+w5QzsAEzdjWKqA8J+BcJJCU9pRpqsBZ8iZbJkHI93Aua6DYTjOXZjHNUou992ITfrLIIB/CCRkMqYEYsHmvEIyIzriBM2Qc9gxx4kZAlJSDcF7+sYAyxvH4v070vlNpHm/nJoOnbiRlgRDahXUDR/RqDzlbJd/1KJmkYbdsi+/9fNt3mYOxyUNx5M0lFd89o6seeckesveBX6eiebqfoDLbWTDVkJhY template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml b/infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml index 264774d6..6bc5daf9 100644 --- a/infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml +++ b/infrastructure/secrets/rucio/ss_servers-server-hostcert.yaml @@ -7,7 +7,7 @@ metadata: namespace: rucio spec: encryptedData: - hostcert.pem: AgC9qKIwt3YRo/zhoYdrljkIxs8ONn/CxyYgjAKyQh+hy8rlWZppxQ9QD8iYdJVTOOfYiM5cfROhJcZbJq9ySHKs1vSQ+KERFCROd0ylPMlcvK96jcBgOO9abF8LI5qXvySMaDhgO1mWKnIAqaWG0FVW+BH1On5HVDdn37o1mcYeOSwl1g9HLUzv4ZlIU++jEC7XdiZYq33MdZ0ksbVEsILPPy245I09u+DEdRUiUrH5Z9AAlBMMW5IUffNMRPMoITzFvu+UbT1/66QVtFbgW7gheoWTMBAuL0AretDBAUzQaDfYvLdBayyg5n4pir0vOMP2AQR+RXIpMNfsfyyiTPs5RPecblha9s1OuB+WwCfv3GKFc6Dcoj1JzcAF5GBeSOQFqEEsiFPNyqysE/y1EdwdxmINbGj3HGHM84mU01VraYcykcCdTruC1mTJqg3gJ91eKtCOCG2yh6nWL0BbgMdhCedH6X9ckLGeosmd6qEat+joGrJgob0rrd6rJ+CNFb4XuvZF4Pi6ZQHpHEQlqHKG+kVT+ZCwWgy1D7KdrZLYjExvfezEtyCMv4CbS4h4QolO9DYS8XnPvTGu7OjGHKmvlxNsrkwq7T1ODf3tFmdsNI5MpFunIpPJYd2vs/qGKUfKIPcXG+/13lRwoA5mJKo9GS3O5QJKfAgtc51iQErQ6pdEFxGbqsLtAcTddu7a2tpeokqHrSGXa0tRvLvCzECBfAi9gfLBAhXV2FAQlSNb2P0sJzGZRS3nr0gnjAtgDfanOB+2tHpHeGeb5VzA6vUu6raaRMdtPEUFbbf/20jsuUNjEM/3JCTQTBjz8K8EXEmC7oPpr/yBUm9yEz3qxdXsaWFV1WC0QX/xubdjmR0AQX9y1wNvhg/3dkS7kD1mU6IFyltV/PqFVI2VQrOQf42vJ5ZcXovPCsBr/E/OiCUeS9Ndj4vsIZuOj2fdBoNWUES/Dd7SacFmvQrq41TT+ta3tiUE08MmHbXBuEGgoX2XsVVvhBd87t1QzDR+PChlg7Z2KallnqQA/onHCHLqtDiPf2Uyiee04AYZdFX/n7/zr6vVZwiGvge8DCturK5AGltjmNG3a8rW+ZqmBijfcZGTCfwjQJRc5fT6NYrdg48NjO+2yCLRpvQLGyef9azWjXYNwN0zYX6yvOgX2nd3upuZGxNTGHXR920K1gdI3T2SnyiD99UDhuxy+Zhg9BwX6WYBXTA6qDB1E9ZikwD0oDz/+ska+1IilCcdxNRkHqFltoX4BdGR4pkeoimWOFPfh74I23Nbr/VA4u/mi43ypmYbscvyN8tF48HbGGf46secf0J2hRTVWmkfpGqPneChkchzgKNppQOF08AHRAEUf3dajvZ1zJvluxKskXTlKgoaHGsV6ZKwBn58WcSanZtGuXRVK2gIphZot/dOs6VFQk7jWBm2mCX+gjPR1vMUBhJpBePLqgRlSHPregwlBKV8mjDM7ZrZY7aJWuhWtroTE8KVLko8AW5AMOpNxcw58mB0wUrKBi9NdDYv7rt7TOwFGYjB3SWUtN/crU/o2MiBS+paHmXf78zZ5mVcVJSLgd3FHCWP3nV07OuesOgCYpc8ZeGzOW9QtQIbN1peDYG9gaeqBhENU86aeGTsnaHYICV0hNNDrXoUyduluwAEQRlPL/eOXFCl1vlw1MIzzfLAkL7LbGCrC8Vc92+rs4wWw/b6txzE/Pi240I6fKXVgNIX9TXypyjDrZ16Ce3ICuDpw9AeBixB+yJnea4KZyPogVKez9f/aJINn7V50W+/vofcETm7+4CWU9BlaFMFTe0NjXRTtYAfcQVoj5N47IdOHxsXxkoTpbxn0LYFgAiz+9u9THczd527wNLADn8H/o5PDsx/jP3q2EjY4s8Sp35MOB54nsvzYymSuGK3n7DOFlwGeyCkUP9Ut/eIbKxqnOeWgBND6T5QWYkhTL7164+AmkIft5lleRDq4ABltpR7a3Zjs+PhtA+dFYgzSgfJvIplomEsrhW5n7iH0rgMu8bid5zoXXA24cuoT/JTzHvMZHzYHqYmsxdbT7KmNr7yl0wPIvKQy7sAE+dyhNDhxakFhmLT/TuBu4G0RKbHkkKxJH1DjYgXr+f3lkYwbAE2Ns6ZJNzRlFJie6xachHSyMehOAAj+09RSc4YMC8zfqOj+BhQfmIXZ/6ZDvT2uWo5NAL4GAVI2hCU1akZlaftt/apRBeiJ+KE1xBBsX5oCfMr/rUFhKX4vHNFC+iMqwKD13Rmkw2IkXBiBvq3/XrvZX/anbXbk6NWTSsx6tKpFOt6HKiRdmGRhvZ2TmugRhNj0XEMhZse4yo5ZygLgKxLn5MfO+Mcx+ihIXXqH14S3stG9emOCprViHkzDZUlFkFQl6jCm7K/0+7hQZmk6vQdiatDEu0TsEr16i6ECNJaMtr+6AG9EIir2G+j/bd6ROOtOG0Jn7l+UkHmZAoWZRHOED6pqhScNsWIN3v5QaZIRmNmk/XGVoPDo8tz+haeDIN4RUFJ967e3Cd04QSxSPanVyMYynsqpzsDzBeivqQREGwwhrZ6EbX4/iLrIfsZWuBos97H+84PSKlb505HmLlyDWO9p7Diw/vF8egk3KtblCpmfVYCuRmgPA3XbQ0Nasr41vHS2lnAsiWl55fz/WGcDIvVlmEd88UFdceDBQrt9XyxrTHRsjmNN540OmK8g2HFXfOHzd/DJqSV/6jTsLQlCSsOfxXU5Bvtv64iZvJ5cgoaFwa49xolJyyWYpnlGEJWeupC2wgOQzSyTxT0W42HN+v83SlKtUBEMI3ovqOWI5wZcALItd4UeucPusnMEdtEp7+NuuKekOiF7GP6TpX54Auwfv8gkSCTXoUHY19joMVhxfyUj4VELqj525UI6RFdzL2Kg07lyBXe1PSH+GdZg4RvMkuQJxUZ4F13/Z/OLyfvOzoZkVcQLNsi4eyuSXsZSLvnggRvkvH3G0yHE7DIBJcQRYTHskncvYfJMuoW0lsSDKjeHst48hD6iGrm0Z1FRHlt11prWOwN2gV1FB8UXx/2n+9BMfXvLg7EfnX0WL10G/oC/QrbF5D6iEAw8JuMhLAFxsj96+tJtd0woSbVpcMOvk9c+bkzxDUZoh+VDT6a7pGoUc9NFXnREqOdf0p8jM7btv4lA1gzv0YpNoz6jeW1IyhagFJ3JKg9PYcjeDn313G0EiNg2W5H85n3tdzRkQ3VcBG1ggImcdQnVF6QZSpNmBuDLABS8g9XHOACBflhSDheG12m87DsZKcVU+6bGRMORzLzl60VUvJme9BudQFtpahCulQAL+jA43u7c/gVsvcBV6OEdF0aB2rLLHKffIlGI/i1Nq63W+Vd2eZHJCSah1et2RIhTkb842qZkwtFCbisgOOXIDYeJ028mffIJC7hKfcle6hIQ6gn1Kb2zlnxCM1pjxJn1bYBgkdjaaVfZ5xksky7FWFS+RQ1G0U3L/8rW5YQsXsOHjcTg4WjQKlaD0uCk6z2a6r1AzYLhR7J1skzZmgPfJWAqomo62qPkQ4j+II9TlFvkDlQF4+R+AHLgh3HW2D/kLFxmr4Yguys5pDIHq+X1EIhcy4qXoIa+NQzBKixs3LWG0BJjPQFbO4T02bg8hvMGwzcT11/xAVRlgGmGpORJtF9Ut++hTyAeGNlaNlb9fbCr5irNlXsEBkK8DYiU4X7X6QU35vVV0ZRKrIsrErh6SF9JHKhSRbO5yxD+FyMgyZFeYyRtxrlv8Bsm9aeezm+V4xeDWN7uGqV1Msr1uP5U23eoatOs5LZX4Bxdy/enXjid445QV8wZuuXbvghKALH+BvZwqPRq61I79dkax7WcUUvNAuqqAW1lPUvqPYqvOkdaDnKfaw/ZPt8iYom66CFqPisZkfwa5BfPPXmuRP69h155FoueSPD9cZniilR3gEn5BlLenCFoj2+JkWWm7buiTGW7OHc08U8OA8kzavo8Fe9M91vO9X9zJgrgSXfki+DAb4PnBiyOyl4ET+1OPZBFsG0qcy95VJHkutbkTVxqfZiapTqphMMPbi/F0l+pVk+2U75rrso/1xS6FilndL3GL+JsIuIAIOnd50MB6FnXFG7+PHqwvgrjua3KGAOB6Z1W2DhVGrZT+EVMUag8WpVjbyvTjdYwgzO6jw+YfZTU4yNTF1RSm8tz0izTH0g4KInBRBr+l7nhHQimgwC1xMtfprd1nGEVDRg0Wi+hQ9G8QqKevLLgSmOjEZ0ONjSDB92XdCL0fKoxjd91stMYNVppsx13qeL9qDphLoyO18mME/z0tOtyqXz5z7/yczK5vWhFpJRyqQ7zoEqmwaJsD5w9QAZkOMr/IKrQ65wKkDapfJjjqGtS6giorWoRFZhBI2fqzGmKRImJkLf2X40hdS+eArVqFsldgkvAC/AimcMLgFxmAi4MO7K5iZbZMEMbZRnntqKoNIM8r0LU6IZAnDzO8tsTQ168Mn5v+a5Iid6LBGhvn/fwcT4vPXm+grJpgtF1liYRg/S7PCoNIVz2LK100mvN0hea4Gl5gn0UTztTrrkQ9YCgILMsEzHERyAjjv2StJHV0awjGg1sueoDCsqlRCAgnSoVofT8jIsQ+K+aLwp6/UIa1A0n3QEvEXstpwGSmGmBchziREfJ+P0DAjcRyPQVZ8bv9lvkLJ8b4hmoWSahi48UHvsA0pBsraQssmOlqtIcjoyXR7vazwifwSZJ/ZTUnmoZJtNC38KLAAscwuwP6lCXRsso2YTNuffy4MyuKocWzrybQHu6wikeaKVCZzfLamyX2L4lg== + hostcert.pem: AgCOAAUtf/lbPmG76mKb0BTOmN0ClKzFQL6MiXo/BpmIRhtpUk6n7lHd8y6IQio2E39kY+ARPS95hivCkT1je0TjwgIccG48Fi6axNqawgK8Th8tU4mPg9IH1TXLhNc8wEsGJe8m3De4HjZvXGZJF1qdwn6wbaAS/SwFYwSf9Up7Bk5IB9Okb4C8Silm2PNxiKIW6a/3Vi+MbEeAePCfMQmtkNHeznGA1CzRVk99wQIQw6Hqf5p2A4umYCQikhha06IN1qrrAzyj1k9PXfVompKm4+HFxE/Xg60/AG0ObHYsDfKZNvPrpx4+MijevIUplalJWGWuZVbqzvHq5JNgO+JEPSsoS1OIyaWY6u5wqpP9sUVyzp9FoQkTV+N+94OyDiM5RXF8HufDIPaBRSml5qd6mh6LVvAnyu/ddlhAMsViAV5E3ar2eDTLsr90Zh/AKrg5rGH736G29DgQzFclcMbYFcwUGgtBFgax7IPAoGBhJ8G/+BPP810szhPeQN5NUnShrd+AHPROt90iSI0HR9WQX3a8f5Rc5pvuC8wL6c9hRMMi5e9P+l8r7M7CBc4oKxa5ToTlM2CWbcZdGJI0QIyxFVsZF1Kgk60FyAYm9K7K/T+uvgkPlFchU3z8NiWqmbIcShStQ9/WGNa3YMSAxAcb5IDAQB5Um5c+2VldLrIp5ppcmsMksJ8OIieh1FwNbrtvJf3z+Sbnpsu2A/MxZ1FK2gAU5YIDMzwoWmXsqYFIw20ixw9jMeXHFpj/o55m9iXo3nWIOSAqJduxUgdcOZeDoOww0FmacG8mRgUxWnqVil9X2ixPNlGNEam9b2u34gwCu+Nylv3D0QrGHmVtn58huhQaTJ524UtozgIMdtb2iA+35XPsOeL5VYe7wdkKeeoIyENkyAB+ESywKLgCRBmYtlTHkTq8cciEHKImOT8MlrNOZnljfr/VzYGjYasxk71OMhPMKlUxqJJqzDhsjuOSQpkn9qHZl8VYc/oMWqbyRCi6irbrIb66ikS92jxu/XuUAC0ukM1WSviohNx9t5WI22Phqu0OYCHxMTO4QztO55hyfgembyPt0m/ZWLsT1v5HiEUsdzv9hIb2obiq6ziJ7aYlxaV7mbVGUp+xmQMut8nrJ9SQhleocbdIorlIzn7Tr/LPib96cnvGWqeB0sKHiw69QG8n2oaJgd+wsYT8+ApDaf/5MJ/YkOHFQOIPXDcvwjVaBaiksP0YNOYnnej+VtKsgdZzCf2ZLfrJniDHYlq3Tgi4Bs//JyqtcA1lhuRx+BHT0Gizzf00C6JDveeJCMxEWPoU4IAN7Xj/AfGkotQAij0L+25hB7DIhj2Kphy2Z+4udT+qoxKNhgBVcLNTk0ziGRlaS5+Bv/DLSn9OWWGqL2gF9S7MeKk7wWkSqcIKbSKIfOYlga042R3ZQw/M8GgdApWmjhhSzVJI8WwFCMKFlzZ6hndCt2+oxEF+Ex1btwyTTOzr5sW09dxS+zYMyjpNILpkzXmCydXy44zqqRZIX1fzeCgdU/YCwEC8PekDsxfk5ZvrNrilexvkH0KFxcXJuLK2eeRLZgGwofUektmHwqjK2i5vAYsGUsDTiBJ+oAGs43CTFyfw2bZnHCQ+7aktnzZVeS/5gA+iel5+//jHT4YMare5KIrg3xvYyPvARSZdGCV2QqvOtdkSieNmuVEDE6PoPQlCh475mJfa8M6hMWuAeyCdbog1VjI7woyx8BVyJgsqgyfQ5lUS9idBB0/+hNIZssLFYJA7qPEF+dDtGSgiuNdEJeSnCjD/z/TFfRjv28VfR78fISC2lCe+6tOsXz5wN4L9wAaanYWe09G1bdpIsju5UEt4Jhio/iWZCjbYQA5Bjhw8RkjZon5DIGrF78Xe6eAhwo6clXaRnFvQRQG/z+W0ZRIAWcQPiCabrB97YBVw8YqTXwew8JErrmqui0JSK+Glcy/1DWlZeo6tmg8dAGu9S20XJ1amp3ZT4+PSPNnk2Oq206/3zxw3FKkxU9/E0aILch/vyWMktw4ej4OYN4T+Dd9D0taVKpa/Kq1PPQom9Whq48/w+TRKFo3Maetj7e/VuJgJ5R5Gs9kxkzrc9WQw7UZdWhp13t0MSvk3P4jovlwi3MS3hiKapH7fZOGgVERgoo8Bm5jFcEpmVjl0MsbRY+uv8mbiMAAA8BgZxK7zbdJR1+qYCkWOQ9dlJ+uBSOn8xTRQieY/tQoUgrNHMFyBQ0zpNdZVOHrLgNV/GquQpxHSFOmxGfhy6582POdeuZ7tkcRBhmQdcL6/pvVsmPOlgVPeapnlgILdiEtg55KytCYlCCEbKgkjA1Ga76R5xb66AJ/oXALE1MKysvnu6sE8pQo3Uzslx/vwfc1XFcS+HLASz7KXnEFcrCbt/oMvYHBGQf49Liyo9DtoKcMVe99r0kn0fcFUiXpQokUosu4l0gUtFmz2g8HDbxaCqK90hrOJpSxlQBKP6zsha/73DiLh2tG2FfbctTTrR+ZvHBWtJb9F1zi/Ke7LQBSOVLDC4XCmVfhC1OnVfmKKnS7laWtr1hwQ3SwNH5HFSkMfOoX6b7BOHwRMbPGo5Ks+vYG9K/mJlyyhaLY9a4p3iKMaI0l2WF8XlRlJyEb82C5RH3tPD6YJBxzZl1XdRAnLsLhQYJwnyR443NR182BeC/yBDtwSQeQ7uEgTWZr4LydQLO7ZLtKgS6t7EYfBWT+UI/Y7rh8EUn4lDxJVbCFH/4dSgADS2XdgcVsSK08vjUeXZD7LhwRfJFm/s/+E21T8Nw7uYFysD/JcidSciq06SVNgqu/fJjgMELb0Yp0PeBIy05g8kYJd7J2fyOTQUoclaIIwfWWQRbliTo7iBXt8RaRG6v1POJGbEjT4S66xXtbojSSXeVrrRnKVilg22ZgRHDUtkwozyD7fzcSj9ZjfQzRYh7RFxpzNADQr044T42WWc4kAKu63qm21Z1H3EXOYVwyAy9IKJpzMuO0ftRUVZm/EHIZ/TcjrR36utofKO595TnSPYnsjQYVniD6f6yELpD2rzkH6zuCOGqX4GeLXa3wZQmI5euJv2RrspnrQtPI56KqS55FlCWKdwL1XdnuOPK0mrxRfBiP+eggqHWMWBON35zz49e9xySi9KQkyBjs8rEP7vUj4htrL8cTgkLPHCgMd7VmzuW22E4WyN3uOPSyWHpvhGLvT/L8WZ7aiRp3wyijQ6EIB/JR8uUHJGKEwBC+vTH4u1t0AcbwEQufsmWmIKNWkH9ITg0PsEjIeoxz52okXgZI7FRTLo7jf3SfE434iFp99IfeLilpPt3ntexpdy+u28WdoHWyL+i57OW0Dnu0O0hILsIE0uPqd1g9j7G6fZNivRjm8adLMxjTX2Nu0CI/JQjMKDvadtRvAKqexDts14bOZ6SIeV0e4c75NkSsAkvtCqkM1ryrepdwErIlmT77lVBDf77g+sr6pIMSsm1ATltSWDO7DZ0qsWzKeKZ0oABYcOSmB0YHqYf6n3xeDPZWwGVcImr+q7BBaI399h+AeuF9xzc/KN+sN6VLfeFJzpOYo7a7Vcbp7FeJ/jEQXtLEqMhi08KCUnk/8BghMfxJ15b315T46T/15L1hEetOBylRFNBH4F1hjZT22O2cVfCMFYfVSRNAFuxk28I97WLuB0mrS75MoZpdX5hwcue+IQyS1Eu33+mjgvVXijC//H2Wc+wF4SQtk41O6MBO8gFwyaVksUZcAAWDx2vC8vVClEbqKAQjvuxLj6Qi3LThZdNkDOW1OfUrqHfwy4qOFfJNRSR7rIYYXO1UpaZZQdNai5A6XcmgWoNjSxppwptwPCdqJ4vEIONFnbH34e9uhzWr8VWvrOtf7S1CrBWAv77ySq9Sc7kaTHlEg/NKFOo6qDBII+SKpJp3X7PV9z1fjTPDwSag1r2GZpEbyPnKqxXmrQXuICjz67pZqgAMr6XFtMvWnVL87a1+PIDRRtuMwL3xqLXuvSDgkBwYWmnVE3Uv721d9eM6uiVjEPOyhlV/2Lh4u0AyDsKyooP1GpVnJmTpx2Xp6jDnbsmFuXepq0KXBBCW1SB8ou1gpQJOYeu/0IrQ+hk5xODdAutIsxEto4ar2rVmT1dLuZaziy0/WbEzTw7uYC+gbCu0GNDDR5a6i3FAxv1W8L8dJFP68BfxcsP7gP8R4klLIvw/TY9VxEmu/yjUTO4SmEE8W8NUB4XVNgaevjYYMexVKzkpGP5C7dS9YSOkNVvfzIWnvQyiyJpZQig0xxp6uEuimN8NNBAxTyjH0d2cFNTTyj0R3vuJM7zWhv12Z8LdyKpf1KMmM3BWMVtRRmm3JVjjYmc7aQzyQ6FbgT3MMrleXGMK9iOlOUIANBWQPKBbrQPDPETEsO2D8PSI1VRWu61EB8I4OjA0IellftsO/9BmtClhPiFCqeZP5WDvachSf9Nv34JSTiDQwDEj31x9NsDrIWGpT9SScK0t+hdfBFfCJM9VElnZHUjRA5WQX7bazeRrnFoh9BKq0KYUEX4iwWNST3S6ZaOjmwhf5BCs+Tq5T3r5v6misOJOk9wkvf3D563pqOonHceIxlT53fjNQF/CPue5ZxWdp618Ogvgja4w/W+Q4Sx0egeWaDV5/MH72cluwel7K0geGf8LeTmPfZna8h8Hd+uvTcVWb93Ugd8EJOLS+TexF3gM1ni5e1UCMaQUWHudf/WCQI1F3K8OhS2x02fGfhjPCKRdSRrmPmENZTor9nsaPbj2QkgfEExXPIyZn6WvFBCLWc+/6HUdVfd6kkxBwaQzpM/pGdEgY6Q== template: metadata: creationTimestamp: null diff --git a/infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml b/infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml index eace5e06..2b8165a8 100644 --- a/infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml +++ b/infrastructure/secrets/rucio/ss_servers-server-hostkey.yaml @@ -7,7 +7,7 @@ metadata: namespace: rucio spec: encryptedData: - hostkey.pem: AgBgC1d5QWEK2Rib0eKFm17XBcgTrOsuaJpEMhYal8al1TpU8nGOMBPDENOhjE9QTuwF9+WSw85+FywlaCQl/fQZBdMoqYBkdWK0KOJqVGbOkCy8GPFWLzv30V4b8YuEizzvG2k0CrbMStZw0VLXRpT0KXwSEumKd0eMzKVc04KdlHz4aDi+00qEWus7N1z/1AlvbipoGvaEqdnMKB1W8jC7K13Ok5WUd/npKWl6H66W5u817Z3LOrYI7sK1VA7kwMbR3HaVazqY6VZQ4yqTwo9sYGDNZ38t2yQI4AHaqSrrPnRNQvpYGuMRXjrI37zaLgIZnitAEKmu6DyPutAHvQogRmpV56UuR7kj9yZlp8jL4sxWFlUfqxj4zw722SU1peWOzyLLRQh6E7C6cVwi0yd9BHaz5In3PkUyuN7kPWCFhjHcNRZ5uDtHI0chOW0fG+Osq0kZYNdCKBeaTBiVnvtHAmCEjzdKHd0D8XmIiFFGu4CJHWTI4jwCoAzTUSL2e9HCluiTjZDNOPbAG1lVAMCtmqVPWPLZalqORQwXlCQ+hbVAQi+GOp60D+5YyPnOVk+McU7C/9y1JeVSndq7S+CoT6gTivtfsFxWkZQqa2PFcmeUbiP2hP0CYCSb3HPmK1fm/pu8br5XFZxQc1Cr18/Q0wT7QMJZR5ETX2K3IOI5mFsWT3bSLG6CNE5ysH5u8x7wDexzLz0EU+LelGAKafTm4cEsh5rzta9CGDGR6dvMVLhBLGjoGbxrUXsBfh36slhUIXlvUMRp/vFTkm8jLNbMwKrXNIMYZj1l2CV89jpYRdDtbA6Xa+xDft1aJ7q5p+YjI54K5OeflgJUbUA5eOJ2fnehLnc7sBvKghV80Sifspt4c+OZ7GJbezlvktaf4QxIrA/L+LGA8JUy9lzbnbj+nTKSSxk2x5kWLwKRaPLzgCns3kMjOcUrFzzz1FRKkj16wCg4mukA9PkOREjLmyXIhmGt96vTWB87FFwyToVZ9IIw7FQdTIbIfXqTasGAu6jEPVd5M25DM2jwJN+00vHdL/E1jtB9fYTFrMZU9PE5XgMf5IP4+66h0CW5aQbIWqAVUj6l0jkUXyCK1CFk1POzVNh30CMd9wpgDoPGAcFfiCk8aHPzGFCmpH4doP5SNRwBJ2GrdOP5vVz9q7pfZcJ/rgxG8bsAmP1jhhyd+YWeXL/rtVJYN+iL8x/NZ1RjDFLj5J/RbVwPNCRZqvvEqHD4F84BSf2efn0Xn/FTEaMzEXzOjqBtgBw7Dk+PhEpjyVmRsUct9i0OajsvFBilyTpGaDxhS4pb1xSC22+sgSVR1teCK8f07AQj9jmLI80NL5yLrePLfa67R0mh4NCyTzLc6+v0QB0eHfR3NTmqbRa0TNZyIBmTztj1DzcRYS7qrDo29ZklqB0vmesOhrQQExQ1rbz9KWaxxDJf+qvGtIzYu3j17iPGvVgtaB/5aHqnTe/h0iP1wm5V1dph33CXeBYEfX3z7prA4in19eDVI9rh67RdQTcSbrLfKyCkeE8mM7M/4B5V8l+Rp0zqx7ojXFdXsVQ23GjpbkC0QfHc7lOvEwmUk8EDoPVqb3uPNfwUI8hPpl3ucz1AfChGocG/ybkpw6YUBm1xxZt6VZqQWtIaaaQ6fU3jB09uJk0PFAep9UH3q5RozmKq9MW7hMEWj63rijurBjlLWzC/uzrm7RdXzWTKlIEgfv/u8ZXB2bElkLIFdlTx7Ravp2jYSqE6kwZddVryvzwwNIiNBFKPDPSnyifrdXfvKgZCAfpoLAdA4P7LwRrTHl7UnJ77wBszhC03p2QvSuky9NkHU5MAex5ORBt9JBBohvAaH0/hIElo7tWCVkGcj29+YDCoSvWKUpmMeviJsCI1Suc020PU2zAd0r3BzSC8eSM4edW1K1gpCpk12qbXSVJwaoNYCgq+wiSWrGI7zsLC+DcYvw9POXnPnSQFW8AwPP4Gj4PF/g6E4mPIz504AgumdQHZG1J6vH9P7TyGTUYid+5lxbrL+VIyHoVa3v1YqGMqrgGENkq9Y0Wz4zyJ4nvN5bh//53nqR+51f/3B4IqRzXMFbzpO77sPrpc9/D3ZCSPnF4nd1Hi8k1nZCMQSA1ov73G810dnmf755+8bz13xqJuiHdCCdbV13nK1SWzBT+WjekZtesUHOyAC2SfCZcDcIbcQlITvb6LNkNDSGLA/JjmqcqwS7OUvNHATkb+bVub60N8sOG7jahR33bFGjMtbzqXoiYAV2GlMShe7Sfz93GHR1B8xa4Y/XWOojurzvzYtJwSVkspGK6JXNkpIpvpyMIX71//9dmQ6lmTvq2Lh7Pmdqpxk9eAA+4wuegSREcFjXK6pX2+E3YzcE6Ska3I182YveBVyb6uIsg017V/t2z0yqBNiEYw6jcPhRNR0nUdeCntw6EY7uZ4uh1+ytbhJAPyyOT3RFmNwzmw5ghP+AWYa111i+JXtwK6YMJGK3n6KvPXyQGLzgQwQ36BRixfNm1ii46itoWc+tYzFIcBTSFw5BkZVED0U3pxMyF+cl7W7kiJti1NPcQoVSYVNkxkK3PS1qO10INWSGl00RL0/4y6m9UjY0zaO5cpaWw1iSmNmw3xfwW3mz0v12pVGZZszXkFr/PIgVsIN5X2c8673eRVi3QI33JfH0o6xjs+O2UCF7r9m0BlDvVOgi1ykEiKxcwFs/m09BV3o3KY32R9HoA30U7OkWrv9R9v/UhNlZ3J7th3PjiTv0WhjFQZdhYJjmZWZdCLxCFff/6AafZDB8LZiRhLk/GuPc8vRywykdECJXJGB2EHdwZTLto/ZUR9ThbhVwcmd/57QoteW1o9oa3f9s934fHSm3xxR9DbVL72VpVI4cBMAfIHhB8G0qdqtr3+YdCv0weO+hEjenTfui2T1CrwitYxRUNuzTZBOrGJu+TKqg/jnnqof73ATv6vF5rKHlpLeCN+eBWgfDMx/MhZlB+eaZeib6YRooVJ6jndEx4cXyanYA4q2DYItVmZ81Y9eJ4tuUS/xdGLJ3kFyVUgSbFEv9AIP90PCX5J6bgTlzffdZ9g0/YrEVdUnJcHFTSNcAPS8Igd0uXs7e4cukwOABe2KaxnTA2bJrZlqz4jjfyetL83tW1PTCmx + hostkey.pem: AgB/9TeWL1oDpytRilrxsVTgEh6gWdjpu5t7p5MWQWRCZtmuyoQhRxOElkq083YMRpFLU4oQ+5axNVbBIcVVpTjSpvvcLIaX7d5qtxDCnYhZnUR4ozuYfYg0oMz42oERjHcOWDJRgG+SXQ7uJLRdul5+GsQdniYrj2dMFHRUUOJ0bKpySdpzO/eEhyJsh4OnektQbmvj2QwGpLjECXc1HswBkCLMLjGyPyA1x42vdvFDrHBgnaBujzun4xHk3FXzO+SwZmHOzeXjVEZvJbCQMnPxMuVSySea4PYwNiMbEcG+ZFL9OTVPsfWgonmBvTp5zeQU0Jiv0uwhAxVLoPuKy4k+ROeZd73cOUV1goMgQaeqPf/L3C2SgNLYwmtOw8zkK3SBZ5Xoq6adaGoU4mtrXel+SkuhPE0lxvYtcz97SjqS2syjcWuVmeJyAV2gkOwYxYeqKyy9TyaBolYMAfcvXE5h6HiuXrbjBRKPh3sCZdGuGK02JDfSF21c3bno8wcGbJOWdzIjwJ4uM1rbM2lOllzfwv3JvB7tw4WUZh3rcVbILt6txW8e3qC9844XpMmwFATcYd0bCgKYWiZvfna8w+chN7TqO70z6a0Hn2uHOHLaKA4sQ8I7Ee/jT9bO0rcBVw0NWDMxBL77c3QzXSy0o9yADcMxELtU7O+8sqfILi5G2N8L3QNG1tzVLWfmx7ZS+OGRel6RxWGHDeqReN8Pe4GWqvl6z/6tmtB3aXDBF4xXuyLNWLa0VYe9t0L3RexS6oLka8YL+j/xbOibvwKr5y263ibLuC2K7nMlCqvCS3m8RTlgSgV8Vgem31JymYUwC64kRAgOQF1ooKdRiBrzUVQheqxy+q5h5iTxlpZS+ott+Vn4xp2H3FGXIBZAoRxpfw6IuuDKmkxUAwY3zSo0cJdQ3LILDfd/bJErooTWlh+CXTS7i8L7JCCN3HKBur6Nypa7H/9UC3LLuAV2ZJcq68j+t34nxmZahxhdjuEzZ2YM+zhGuRgB7eSCq+SVdEXDjf1etlxcDJ6ZoA03xm7IfvtfleVUldMb5gwvM6P8ZLjeicXAVOUgN5Ju2ETdmmJIkISNBaTok1qZJFIrSFun3T9Yya5UD5l61weWHvgLHP1OBR2dTqNeTM+kAFjQCPPxKCB7khEkkE2gUUQsTgha4GdyuT9wutV+Fp+5eZKfb4OItGa8/JaNIlJR4nMwG++y5Vw2x9P05Jsw+lbru7263U7frSluXlHt197xG1KnRAghDuLLjq0BkvungwAQL990Yr9rbtjT+yEWjcUtd94jrSIcdQbJ2bQKt5kkOT4yOPyOzojCtHlr+KxF6Gjp0ul0yp/FJ1fKpykiDc9k4vrlFb+8bxP5wRUBGX2vZ6AbR9bq27vAHk/7KdhSx+PzJhr2mfG9h0IDjR1nrcPAbzvUxj20UU57agVQkeGiBngowbbRUN/vsTMHDRELu4XDe+d5NczrtVRpfPIKv7T3isM+WEjllJFuk5YxUKGKnDVW+Raw5/cwLgMbgeJ7sW7yoHVIC+spXpjLaKZxPMU8lc4xU8ZvFF68wpEpEn96ie4osqHnqzPZlxjnza/wa378TU6krCr/dPJkRdt5tu9CAfQCM//k/QbNXTKW74fR796A3JSJKRkja4wa3/YgAwhBwGBOFQdCP8yhiTtIl6TxW/R1CJYgH4gf6H5TWx862KVkslLMW3Gj7V1fzvyt07DM7dZt9z/+FtN+fBH1rNdH7xcO1rgWge/SqXymZbrOCGM1tpcpFBe7zMFGZTBrC4M3ng9hZJOxxdBXXk/L5cx3muGhvuapcsME35dpXNE8rC6SMbJxwnfQfFJ7vneq2c3o2HdJovuMojLTK7L5JWpmSeVq2xTahHjZDrEAotUgN63d1sLGNdiIK6TZB9Fd60WYvAdHtXWzAmqx3dVEJYGjSfXvAnALeK88j6ENfHQBrmagGjM/zLc3ccUMjswMZCj3b8QaP+DbJ4OnD7N6as+Wh7wa99DPOLdcA10amZzd5drANHyDOkIEDL9FJ0jjOJnpMM/bFyxqqawFcXIMGrUGm2bsR/ILK4qaDFXP2GgRMEoMzTfJMwnlAfJJ7UPV+2dfBsqAQDMhnnBZMGFRma9nUyI38qSr2jFarbu/EggzQj8t9ydkNDcudqGTkFUMRn7ay7megnpBoPScHSFFrQaxTUCJGaZ9DghqY6AUeUz/Ys4AGmR3aGziVBRJ1Jmq4kqMB7I3jpLQLJXeHF4F3PdslL80ridqHWnmi2T9oSO5rI+rmIyqdOq67kYPA/VjBa1IZ7Z4MsPkDf5pVPUl16wHK2CL2DL+t/p509N2GKEc0uqsuj9JOKAcO8scHs1IedpwyR9vPPfWr5KX0SW2cqrUHZyt2P30GJVQuIxrUn9m1b0CHwAQ5MTca53yQ9CNJ1kjehfDlc/6zgwpC0jT4i61BJnvc6HDPzZzTKRpDUM5yhws9Gfq/9JA1QQBQAZ3xlY+Eb7a6TCIFlEYMzVjLcxkL6AlWxMGc+/9awOkhaPrqr8etSB11Q9nsfmGEgyMpEy0K3NMr8epcsKQITmA4a3p9x7MJxrmLLKfQGsWG5DidsvUq0LdaDy2Rj7OQoKuGTjJraPop0ly0KC5RpwpLnM1Ev8eO5NqtziZcsJtvW/BUaJhrKng1wTx28oOmUYNVCs1UNDJVbQqFuBYXzr0YOs25xfncD6umBeZphH+ALtvHSh3NVk7qb5ymZJlf2spvEO64mOvgMsYslknsFSKC2waqvpcPRW3vhUHK88z8oAmZYBhT+yRsKEmAjGSF7HcNLXDKZ/PBkbnpMcNJzK64mL2y9aHdhiRJ0qFBVyj1B/Nd8hXXLWAmrKSojCXHK0oMkSNqsrOsoZU+9E4vYN1L4F7HE+7nG2tHaEKxVGfmGtJ/SNQaW8gpMddvvueHT7mLiqJVwoTwtf1LBSW1oyGP0HvOT/kAzuMGq7ulq+3GrULY3ZvTHMQFpsan/o9hhllzdyaW4eAh8QhgmWhQpu4ApmzpLvBcG+ZxDXoLnOcJVht0oI9EanOGxYy1Yk1rjmtOh+4aG9A4AZlqdQuGKUhOnbG0VIMUFkKfYg5XZPdjZEGMd84lFjcH7JVLl1cZFT40Jh0vJ6y+q6gQutY template: metadata: creationTimestamp: null From ee3b6b6295d9647d9e2499456f50ec5cc20c2fff Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Tue, 6 Aug 2024 15:11:23 +0200 Subject: [PATCH 66/69] add oidc secrets for auth --- infrastructure/scripts/rucio_secrets_2-servers.sh | 9 +++++++++ .../secrets/rucio/ss_servers-auth-idpsecrets.yaml | 15 +++++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 infrastructure/secrets/rucio/ss_servers-auth-idpsecrets.yaml diff --git a/infrastructure/scripts/rucio_secrets_2-servers.sh b/infrastructure/scripts/rucio_secrets_2-servers.sh index 46d7ddcd..e18884ae 100644 --- a/infrastructure/scripts/rucio_secrets_2-servers.sh +++ b/infrastructure/scripts/rucio_secrets_2-servers.sh @@ -5,6 +5,7 @@ echo " *** START rucio SERVERS Secret Script" # Once the certificates have been split, provide their path to be read when creating the secrets (NEEDS TO BE EXCLUDED FROM COMMITS!!): RAW_SECRETS_SERVERS="/root/clusters_CERTS/vre/servers" RAW_SECRETS_SERVERS_AUTH="/root/clusters_CERTS/vre/servers-auth" +RAW_SECRETS_IDP="/root/software/vre/infrastructure/secrets/tmp_local_secrets/idpsecrets.json" # kubeseal controller namespace CONTROLLER_NS="sealed-secrets" @@ -36,6 +37,8 @@ kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLE kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER}-server-cafile.yaml +echo " *** Create and apply SERVER GRID CA secrets" + # Create server secret for the GridCA file # The content of this file is the same as in /etc/grid-security/certificates/CERN-GridCA.pem but mv'd. kubectl create secret generic ${HELM_RELEASE_SERVER}-server-gridca --dry-run=client --from-file=${RAW_SECRETS_SERVERS}/CERN-GridCA.pem -o yaml | \ @@ -61,5 +64,11 @@ kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLE kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-server-cafile.yaml +echo " *** Create and apply OIDC secrets for SERVER AUTH" + +kubectl create secret generic ${HELM_RELEASE_SERVER_AUTH}-idpsecrets --dry-run=client --from-file=${RAW_SECRETS_IDP} -o yaml | \ +kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-idpsecrets.yaml + +kubectl apply -f ${SECRETS_DIR}/ss_${HELM_RELEASE_SERVER_AUTH}-idpsecrets.yaml echo " *** END rucio SERVERS Secret Script" \ No newline at end of file diff --git a/infrastructure/secrets/rucio/ss_servers-auth-idpsecrets.yaml b/infrastructure/secrets/rucio/ss_servers-auth-idpsecrets.yaml new file mode 100644 index 00000000..497341f9 --- /dev/null +++ b/infrastructure/secrets/rucio/ss_servers-auth-idpsecrets.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: servers-auth-idpsecrets + namespace: rucio +spec: + encryptedData: + idpsecrets.json: AgAHOx+eLicUw85AmEmWKN520RpjGGuQVTcDfzlzxP1lkfdtYlWlQoty4nDZzgk3cuMXXIMec+wsH2+V3Q1qG2dqtgTBqnCr/2NrSr7AB7db79sciGmci+MQ9GlIsw7zkMVE7wz28HCoR7JmJWUt02BEAh8vPOSfnIeKOl4yHIn2IwCEfkTjJwKxouBQWlV7jyDZP+tm5cOus2u/rBz2xgsr4+rlUXNpL8E3QlLzvQrVtGFXQ3XYWWntIIdZEjXIl2wg/zQncDwcelw2jkRpqdMUrOXafO55h53laCBSMoi7YB7eR47Mf23Tot82T11ZQSho4QBnp+Yqf25bdzBVMglxp88kA2SLkTQe/mX3zHL6T9CeZP/hnNUOW/k9REiGnWshNatLaBE59yyc1GNxSy4mjVgAh6lQu2S0F9UeajhnEmSMoBRWeb/JaJJqg36Cg3rNroW32cdnYeQH/P9K9uR3A7288J8OzaEHRpXviFj+10H3WFVwszRbJBFk9hOhp5+JEqFAh/8wFHhRcAa/mCgHEwvgFntTyD73DRT5bI9uawgItqhPpcnpGsBTqu8GYdj56mp2FRh/QEQtKENQbB3oLUEj2uDgH6/UbS8CfmgqPF73qLzrUNi8M+fyS9+7GLGg6gGO+5YWFE5wdSLSmXOiUEx8oYuzC72uPXfL+YWwdMXsfQmSl5Z/wKY0kLGfWuPW2lCdzK7O0gaFyAm9ozgqIbZANL7GUaI+ne69pp/Hi1gU2q7Zj2SnUn1ou03VxpSAOL3ofJ+DtmPgxqHiS1dDvqJZua/fFEDVTDR4+xjNPW6S8S45GxX7GAX4nzD/llYUQNV+U+2fNTfRo/BFb2Rx4Q7gNMe4wUlAWRrGfiUXu0csVILYG6cJnr3NnrMjvb/7cig0m98F/mqoQO35ihTKDQQXfi6vTlFJ1umWG6jqeHmk5F2q7kGyvoS37zPrySknGTfat1jW9H+s44tpG3GUEdPODaiT6cqixnNNkZIFE+GWU2Xf8xN/eFCLjj3RlyrcAsU4X4W5sNBiQUyTVgEGJxDyRiHERYP+IsHnbCrxJs36DJKsS+fKtmoU3f+cIkKLyRCjhndEfafGI0pqj+QQ5SvjwL1u3fWgmtvTWifJTrOsLg7y1OaMAMH9+KDfCASqydz/E7ZjXsbOEyE4mAvnmylDaltkK9gB/0VRqcVoWHYykOrnMWaDfr9Ggf6pRDuV5HqMruytuykfqs793GLpQV2j+c17eFJaarS3hSXC1a5wqQUT5K09XZJ8X6mSKEnuHRAcH8eo0c1+5THXA+zSaWo7cHOF58TxuEgZBg7AfPe+iiY3WFd9pL/VvvabnC1OzjDD2WLZ17A2jKve1PLpVCEnapBrIh87NzOcAB+F7pCFUjSrmkQrjieRlJ+Q2ZaJpoawGEBmoiAr7j8/fjFfEolb0dt+DDjliiXHxdUCjw1gbwt06IkzONntGsvx8SH+k/07iIAEXcpa34KP51eeqJzSGZFFRpduvZfsAdGAmHrfxosdR5DN4PdxXKARsWESi5lUMsaRN7VLLmgyz0N5o8IiKze6i/PBLVfOukbP1WZI4jLgO28rvJ/UmoxYjGvuc3P6MFHSC/LxlV9qkgiIZYnaZEfDNY6A6rwryQf/+bhoGlfXhRchg0h+1JJ3tHqAB5u9KyhcaL/TgbR9QGFXXo81+V4ykrLbjskY6Ipcmp9nLzuYNXEmBWDCykWPTMtnUERTr2m5Si46bVjs6yCVSqV/pxidwvSFUKwgUaGzMGUP7wegKXL9EF1+gcXDZeVFW6z1Jh2Hb1RuscrxwO5vyJszoEqSs8BnCXD9duxVPmvt3GDwWwQPrp5xjiloBf+2Ca+5cr63G2N13un0Yu9SAU76tbiKWBCLE34BoXnEX32TGP0ll8jhU6/V6MkWuWmYdKNSKgjjunWMh4qsIRp/lSLHdlPjRftYQ/4CCS2hjTaQxcLP72oiL8S4hn0f69yMjNM0GKwfaRmsgjM9vJ3Gl3+01GHH0SW8v5zzXNfJqd64wE2oq4fwCK6Ru5E8cC16mUcgQ8PU6sUnqKT7eVk+w74gp381/ES6jfFFFFGGnXeZqUIN4TGyHQORJ+EIWpfnrP55QmnfrLZWo0KwyLAYXAf9EB4EZS082W9d+8JYzQUV0zEHVyBEs5t4sBFSOl+/bawfrKMOGKw+pQAITRPCiUPUPETUN09PqRgFe6oJU426C+ksiUR+6BxH25O42gGjrJAYz9gUz6A3q07Yx0mQCAcDDXM545DQ0BGQBr2ap+KNzM0tDGmBs+R625NZZ8KSnSlmvCeJCyxD3vFHoE/HdF+ZCNoR6ccjrD5jysmmK/7FLIkOQRFUCOJehXGGtEX828QTapBTxwFWomM5g/4ceTF2WuWx1tOwNDiIaSO4I3YtkzcyH9fZNdJQRzfbZPffHCllcSq5HbNZXnLkieq7nybGNW3Vbhp+GfjFiyILxrd+Bh5+N/xXvFSuwuteDMJVR8o0aI9swWYhDENy/sxvlT9ruEAg00IVVWxpo4aUq4ZaTQ7uBp1fF2jXqy9R6fM1zwkEg919etMG+Zk2Tsefpa+hgS1Gv8qPNIOeOgawIDStyOqvHdO0120N0VtYcP8LCQNBHAp9jJuMHFiDwycgKfySbF6KwhBHXI0+IsvnW3fy+eOdMPpkLbd+KO/t2dRXvZPj2DDtrjEDxTUDy7Mgd1Vs+ss9ZPqUrYZwsJkbLe9iJzuxpzlafXiBVlbF3F5NOshf/hhFqKIknkbaj39MDv91kAYOjL5isjT1qat3agNMOqaSVVsGcERN7PR5VwPJWzhQUyZTkJvuv9xDd1bZxbkMzFMpxMXNTbH5qFn2BezGKvRz+aK4HeHz/OFCZzlADVUCECe68mMocEtgPL51iaLyYtfwXz/x+PAYnVol8jd8mP9lcvcZWl716ZJ7ee2zUpXvcAnzQ9Bf2wBwAltR92pxaeuqAP0LbzJEE0H/SBai5/VwrXLSaPFFnQTM5a/bTVBsETIdz5ruzZq7e4sCKmlClRwQCNfDij8YKeNN8Wk6ZhQtmbraNlr98xjmOTLQazotAoARpoqqHa1ZqVRaoETaBHeabbbNJZs2/zFzEH6DDgwUYDgSt52FMGcPIzI3hQb2Vo6QDxkK3h4HGHMeqCrqVBYIK7A6M2jvf2GbvmRif3kcIpH05Vk5aoH11m2nOntmQUt9vbD6THSPYmE/t2gZLENCH5wYed/woVCqsFZdT6AeFg== + template: + metadata: + creationTimestamp: null + name: servers-auth-idpsecrets + namespace: rucio From 011f21dd06041b8427990f679bb08a237f7a359e Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Tue, 6 Aug 2024 17:30:37 +0200 Subject: [PATCH 67/69] add rucio account --- .../scripts/rucio_secrets_3-root_account.sh | 20 +++++++++++++++++++ .../secrets/rucio/ss_rucio-root-account.yaml | 16 +++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 infrastructure/scripts/rucio_secrets_3-root_account.sh create mode 100644 infrastructure/secrets/rucio/ss_rucio-root-account.yaml diff --git a/infrastructure/scripts/rucio_secrets_3-root_account.sh b/infrastructure/scripts/rucio_secrets_3-root_account.sh new file mode 100644 index 00000000..f21090cd --- /dev/null +++ b/infrastructure/scripts/rucio_secrets_3-root_account.sh @@ -0,0 +1,20 @@ +#!/bin/bash + +# rucio namespace +RUCIO_NS="rucio" + +# kubeseal controller namespace +CONTROLLER_NS="sealed-secrets" +CONTROLLER_NAME="sealed-secrets-controller" + +# Output dir +SECRETS_DIR="/root/software/vre/infrastructure/secrets/rucio" + +echo " *** Create and apply RUCIO ROOT account secret" + +RAW_SECRETS="/root/software/vre/infrastructure/secrets/tmp_local_secrets/rucio-root-account.yaml" +OUTPUT_SECRET="root-account.yaml" +cat ${RAW_SECRETS} | kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${OUTPUT_SECRET} +kubectl apply -f ${SECRETS_DIR}/ss_${OUTPUT_SECRET} + +echo "Done" diff --git a/infrastructure/secrets/rucio/ss_rucio-root-account.yaml b/infrastructure/secrets/rucio/ss_rucio-root-account.yaml new file mode 100644 index 00000000..149d85d5 --- /dev/null +++ b/infrastructure/secrets/rucio/ss_rucio-root-account.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: rucio-root-account + namespace: rucio +spec: + encryptedData: + root-password: AgBQF0bDbsZ/0waZyPYVxJy4SKug1XpA2w5nGWc3JHg8ifiA15NmaourYs0g5Dq2rpKI+knFe6eXuXhLliFayFh39S/jCAT+gWC7xIhYUmLQtmqqyfH9V6fGwSKiA41aYNd343ltdIJRAMX5+vZjgR9TqMlWI7I+lhDlB+HH5FNZVwUWGuWtWctQfn9rTSIalJO+Ger7nL2h6R1sk75W0gacbQaMfMRN7QqC9sNiUXSWRxCecF2T8GwnTxR9ebDWfHfCelIavTzHKh7CpyzboTqdAUwCgkm4XljTwX6hTdbkQdrZXXquYKNGrwGX0KsXGE+Vx0RDpu/2n3y+9eH1dxFfL4w939xaHiyttBeQMeI+XLhcL+7KQnavNsEyjvOn5DyUnQmUukJ7txvSVUMYiwpFkEAtNmn5FDkdJ7RYUkWvQVoubp81JiGM+NgIhWD9U1WQ+ikJ2glk3JmZJ2OsuZFOCSTX2iNt5PT3bzdjQMDenC/7rW96A25RmdRv8myaZPSPPlN4QKB83z8iSGx1eDQaalU+xGO7cb/RIY6lXcrTrqAWEBb4vT1sW7jeqavbrpxvvShoBQulF8ywZ43df0p61dQOEkbszcbSMbnpmayzBqJxkrWFYOa7A21VtukEMeIQVcLyUwwCBsbsdsMAm6f5z6xv22l5ZYGXwdPb71w5pvLq2g8cPxivzuJT8YOadwYuaP1I2eB+fmBE0u/pZH9mhlwb1SHdf92Z8Q== + root-username: AgAZF/o2j98zsyf3ABI7mo6cQ9RFdtEQGBlWlPyUnVNQWyhrNXeMRv4egAd2Xa4iQKl2IqtbcFnnZ4GuISKDrlQcZDGcVds9duOll82B7tzWW78IzxxNIHyoirBGVwr3uOl/jUAVI49Ba4uGdxGxEGuuQ0INBNOOt9SxN+JlDHKRy1dwCyeskhTpwGMBXI3DX/loZJMCXs9xgMTEBEuYjkMd70mA6d9dmj2WKYyyVdgs4QkzU7yGb2WvatQovx/OBTg/BiNDpTHaw4AbDVqRoJ2ljFxR08qidu8TLC3BNGNvSKt6ZIAPrQQUSmOJ+wmCrqSB3cidClKM8GdR5hrlhpe8f3xODA5VDd9UYjC5ujJT68S4uYqR+rFKftbvwp750/WGdoAwfNv9VHth+gVDk3oAEBJQghdGDwGa++hnjiOdgRejz2cgpNonQaEy9cmI/RVKZNddalJ8YbMjab5CN8UQyePTF9tGRiJeCTmQcTJPM9YuzBVu6UFqWU2gCr5Mx89KUYaRm+ztacG4eNd6UvBh6tCK8UvrOc1O9VxSLMFDWozOZ3sCHM+tcMmXOfTUn3WU3a0JQtX6NqPdUDQHhYxTC4TA/rvLj+qUxMALiCX8MyqP/rUwj94ac4ROp/Xh/Pg0Q1/3ctvOHrDjz5zeUa/rAHE5idkQNkSjBBt6IQEz0vwXrkm+i+k1yyKqK01l4yloc58CGD0= + template: + metadata: + creationTimestamp: null + name: rucio-root-account + namespace: rucio From 51a53fb9f7bd7a3f481233533255a2c1fadacdab Mon Sep 17 00:00:00 2001 From: garciagenrique Date: Tue, 6 Aug 2024 17:30:37 +0200 Subject: [PATCH 68/69] add rucio account 2 --- .../scripts/rucio_secrets_3-root_account.sh | 20 +++++++++++++++++++ .../secrets/rucio/ss_rucio-root-account.yaml | 16 +++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 infrastructure/scripts/rucio_secrets_3-root_account.sh create mode 100644 infrastructure/secrets/rucio/ss_rucio-root-account.yaml diff --git a/infrastructure/scripts/rucio_secrets_3-root_account.sh b/infrastructure/scripts/rucio_secrets_3-root_account.sh new file mode 100644 index 00000000..17a0da63 --- /dev/null +++ b/infrastructure/scripts/rucio_secrets_3-root_account.sh @@ -0,0 +1,20 @@ +#!/bin/bash + +# rucio namespace +RUCIO_NS="rucio" + +# kubeseal controller namespace +CONTROLLER_NS="sealed-secrets" +CONTROLLER_NAME="sealed-secrets-controller" + +# Output dir +SECRETS_DIR="/root/software/vre/infrastructure/secrets/rucio" + +echo " *** Create and apply RUCIO ROOT account secret" + +RAW_SECRETS="/root/software/vre/infrastructure/secrets/tmp_local_secrets/rucio-root-account.yaml" +OUTPUT_SECRET="rucio-root-account.yaml" +cat ${RAW_SECRETS} | kubeseal --controller-name=${CONTROLLER_NAME} --controller-namespace=${CONTROLLER_NS} --format yaml --namespace=${RUCIO_NS} > ${SECRETS_DIR}/ss_${OUTPUT_SECRET} +kubectl apply -f ${SECRETS_DIR}/ss_${OUTPUT_SECRET} + +echo "Done" diff --git a/infrastructure/secrets/rucio/ss_rucio-root-account.yaml b/infrastructure/secrets/rucio/ss_rucio-root-account.yaml new file mode 100644 index 00000000..149d85d5 --- /dev/null +++ b/infrastructure/secrets/rucio/ss_rucio-root-account.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: bitnami.com/v1alpha1 +kind: SealedSecret +metadata: + creationTimestamp: null + name: rucio-root-account + namespace: rucio +spec: + encryptedData: + root-password: AgBQF0bDbsZ/0waZyPYVxJy4SKug1XpA2w5nGWc3JHg8ifiA15NmaourYs0g5Dq2rpKI+knFe6eXuXhLliFayFh39S/jCAT+gWC7xIhYUmLQtmqqyfH9V6fGwSKiA41aYNd343ltdIJRAMX5+vZjgR9TqMlWI7I+lhDlB+HH5FNZVwUWGuWtWctQfn9rTSIalJO+Ger7nL2h6R1sk75W0gacbQaMfMRN7QqC9sNiUXSWRxCecF2T8GwnTxR9ebDWfHfCelIavTzHKh7CpyzboTqdAUwCgkm4XljTwX6hTdbkQdrZXXquYKNGrwGX0KsXGE+Vx0RDpu/2n3y+9eH1dxFfL4w939xaHiyttBeQMeI+XLhcL+7KQnavNsEyjvOn5DyUnQmUukJ7txvSVUMYiwpFkEAtNmn5FDkdJ7RYUkWvQVoubp81JiGM+NgIhWD9U1WQ+ikJ2glk3JmZJ2OsuZFOCSTX2iNt5PT3bzdjQMDenC/7rW96A25RmdRv8myaZPSPPlN4QKB83z8iSGx1eDQaalU+xGO7cb/RIY6lXcrTrqAWEBb4vT1sW7jeqavbrpxvvShoBQulF8ywZ43df0p61dQOEkbszcbSMbnpmayzBqJxkrWFYOa7A21VtukEMeIQVcLyUwwCBsbsdsMAm6f5z6xv22l5ZYGXwdPb71w5pvLq2g8cPxivzuJT8YOadwYuaP1I2eB+fmBE0u/pZH9mhlwb1SHdf92Z8Q== + root-username: AgAZF/o2j98zsyf3ABI7mo6cQ9RFdtEQGBlWlPyUnVNQWyhrNXeMRv4egAd2Xa4iQKl2IqtbcFnnZ4GuISKDrlQcZDGcVds9duOll82B7tzWW78IzxxNIHyoirBGVwr3uOl/jUAVI49Ba4uGdxGxEGuuQ0INBNOOt9SxN+JlDHKRy1dwCyeskhTpwGMBXI3DX/loZJMCXs9xgMTEBEuYjkMd70mA6d9dmj2WKYyyVdgs4QkzU7yGb2WvatQovx/OBTg/BiNDpTHaw4AbDVqRoJ2ljFxR08qidu8TLC3BNGNvSKt6ZIAPrQQUSmOJ+wmCrqSB3cidClKM8GdR5hrlhpe8f3xODA5VDd9UYjC5ujJT68S4uYqR+rFKftbvwp750/WGdoAwfNv9VHth+gVDk3oAEBJQghdGDwGa++hnjiOdgRejz2cgpNonQaEy9cmI/RVKZNddalJ8YbMjab5CN8UQyePTF9tGRiJeCTmQcTJPM9YuzBVu6UFqWU2gCr5Mx89KUYaRm+ztacG4eNd6UvBh6tCK8UvrOc1O9VxSLMFDWozOZ3sCHM+tcMmXOfTUn3WU3a0JQtX6NqPdUDQHhYxTC4TA/rvLj+qUxMALiCX8MyqP/rUwj94ac4ROp/Xh/Pg0Q1/3ctvOHrDjz5zeUa/rAHE5idkQNkSjBBt6IQEz0vwXrkm+i+k1yyKqK01l4yloc58CGD0= + template: + metadata: + creationTimestamp: null + name: rucio-root-account + namespace: rucio From 92254a920c9ff8da0a7f01860020608b3d5b8d04 Mon Sep 17 00:00:00 2001 From: Enrique Garcia <40355845+garciagenrique@users.noreply.github.com> Date: Tue, 13 Aug 2024 15:50:09 +0200 Subject: [PATCH 69/69] move base layer to alma9 (#284) --- containers/base-ops/Dockerfile | 27 ++++++++++--------- .../base-ops/linuxsupport7s-stable.repo | 10 ------- 2 files changed, 15 insertions(+), 22 deletions(-) delete mode 100644 containers/base-ops/linuxsupport7s-stable.repo diff --git a/containers/base-ops/Dockerfile b/containers/base-ops/Dockerfile index 57af76b5..fd347d74 100644 --- a/containers/base-ops/Dockerfile +++ b/containers/base-ops/Dockerfile @@ -1,34 +1,37 @@ ARG BASEIMAGE=rucio/rucio-server -ARG BASETAG=release-1.30.0 +ARG BASETAG=release-34.6.0 ARG BUILD_DATE FROM ${BASEIMAGE}:${BASETAG} -LABEL maintainer="VRE Team @ CERN 22/23 - E. Garcia, E. Gazzarrini, D. Gosein" +LABEL maintainer="VRE Team @ CERN 23/24 - E. Garcia, G. Guerrieri" LABEL org.opencontainers.image.source https://github.com/vre-hub/vre LABEL org.label-schema.build-date=${BUILD_DATE} USER root +# Install epel-relaseas +RUN dnf install -y epel-release + # cleanup yum cache -RUN yum upgrade -y \ - && yum clean all \ - && rm -rf /var/cache/yum +RUN dnf upgrade -y \ + && dnf clean all \ + && rm -rf /var/cache/dnf # install useful tools -RUN yum -y install git htop wget voms-clients-cpp -RUN pip install --upgrade pip +RUN dnf -y install git htop wget voms-clients-cpp +RUN python3 -m pip install --upgrade pip # EGI trust anchors RUN curl -Lo /etc/yum.repos.d/egi-trustanchors.repo https://repository.egi.eu/sw/production/cas/1/current/repo-files/egi-trustanchors.repo \ - && yum update -y + && dnf update -y -RUN yum -y install gfal2* python3-gfal2 xrootd-client voms-clients-java -RUN yum -y install ca-certificates ca-policy-egi-core +RUN dnf -y install gfal2* python3-gfal2 xrootd-client voms-clients-java +RUN dnf -y install ca-certificates ca-policy-egi-core # Install CERN CA certs from CERN maintained mirrors # This will add a `CERN-bundle.pem` file (among others) into `/etc/pki/tls/certs/` -COPY ./linuxsupport7s-stable.repo /etc/yum.repos.d/ -RUN yum install -y CERN-CA-certs +RUN dnf -y --repofrompath='tmpcern,https://linuxsoft.cern.ch/cern/alma/$releasever/CERN/$basearch/' upgrade almalinux-release --nogpgcheck +RUN dnf install -y CERN-CA-certs # ESCAPE VOMS setup RUN mkdir -p /etc/vomses \ diff --git a/containers/base-ops/linuxsupport7s-stable.repo b/containers/base-ops/linuxsupport7s-stable.repo deleted file mode 100644 index 4b0920b1..00000000 --- a/containers/base-ops/linuxsupport7s-stable.repo +++ /dev/null @@ -1,10 +0,0 @@ -# Example modified for cc7 taken from https://gitlab.cern.ch/linuxsupport/rpmci/-/blob/master/kojicli/linuxsupport8s-stable.repo -[linuxsupport7s-stable] -name=linuxsupport [stable] -baseurl=https://linuxsoft.cern.ch/cern/centos/7/cern/$basearch -enabled=1 -gpgcheck=False -gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-koji file:///etc/pki/rpm-gpg/RPM-GPG-KEY-kojiv2 -priority=1 -protect=1 -