make charts PACKAGE=rancher-windows-upgrader

charts/rancher-wins-upgrader/101.0.0+up0.0.1/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/rancher-wins-upgrader/101.0.0+up0.0.1/Chart.yaml

@@ -0,0 +1,18 @@
+annotations:
+  catalog.cattle.io/certified: rancher
+  catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.22.0-0'
+  catalog.cattle.io/namespace: cattle-wins-system
+  catalog.cattle.io/os: windows
+  catalog.cattle.io/permits-os: linux,windows
+  catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
+  catalog.cattle.io/release-name: rancher-wins-upgrader
+apiVersion: v2
+appVersion: 0.1.1
+description: Manages upgrading the wins server version and configuration across all
+  of your Windows nodes
+maintainers:
+- email: arvind.iyengar@suse.com
+  name: aiyengar2
+name: rancher-wins-upgrader
+type: application
+version: 101.0.0+up0.0.1

charts/rancher-wins-upgrader/101.0.0+up0.0.1/README.md

@@ -0,0 +1,41 @@
+# Rancher Wins Upgrader
+
+A Rancher chart that handles keeping the wins server version and config across some (or all) of the Windows nodes on a Kubernetes cluster in sync. It does this by running a simple script to replace the contents of the `\etc\rancher\wins` directory with the newly specified config and wins image via one or more DaemonSets. Once executed, the script will simply sleep forever.
+
+## How does this work?
+
+A DaemonSet of initContainers copies the provided config (stored in a ConfigMap) into `\etc\rancher\wins\config` and runs `wins cli prc run --path {path-to-wins} --args {up}`, where `.\wins up[grade]` is a Go program that runs a simple Powershell script that forces an upgrade of the binary used by the `rancher-wins` service across all of your Windows hosts.
+
+TLDR: we use wins (cli) to pass wins (upgrade) to wins (server) in order to update wins (server) on the host on demand.
+
+## Cluster / Node Requirements
+
+This Helm chart is intended to be used on a Windows cluster that meets the following two requirements:
+- A Windows Service called `rancher-wins` is currently running on each Windows host (e.g. `.\wins srv app run --register; Start-Service -Name rancher-wins` or `.\wins up` has been run on the host) that is running a wins server version of v0.1.0+.
+- The wins config used by each Windows host's `rancher-wins` Service has `{{ .Values.prefixPath }}etc\rancher\wins\wins-upgrade.exe` within `whiteList.processPath` so that the new wins version can be delivered onto the host
+
+If the cluster you are installing this chart on is a custom cluster that was created via RKE1 with Windows Support enabled, your nodes should already meet the first requirement; this should have been added as part of [the bootstrapping process for adding the Windows node onto your RKE1 cluster](https://github.com/rancher/rancher/blob/master/package/windows/bootstrap.ps1).
+
+However, depending on the bootstrap.ps1 version that was used when you spun up your Windows cluster, it is possible that the second requirement is not met yet. 
+
+If the second requirement is not met, there are two options to reconcile:
+
+### Manual Update
+
+This is the recommended approach for updating your Windows hosts, but it requires the user to log onto every Windows host to upgrade the wins config. After logging onto each host, you will need to do manually update the wins config.
+
+By default, the wins config is located in `c:\etc\rancher\wins\config`, but you could use the following powershell command to identify the command line arguments passed into the `rancher-wins` service (`--config` corresponds to the config path on the host):
+```powershell
+(Get-CimInstance Win32_Service -Filter 'Name = "rancher-wins"').PathName
+```
+
+Once complete, restart the service:
+```powershell
+Restart-Service -Name "rancher-wins" | Stop-Service
+```
+
+### Masquerading (Use at your own risk. Here be dragons...)
+
+This option is *only* meant as a hack to allow users who are currently operating on Windows clusters that have not whitelisted `{{ .Values.prefixPath }}etc\rancher\wins\wins-upgrade.exe`. If you plan to use this option, please ensure that you immediately upgrade this chart with `masquerade.enabled=false` and perform another `helm upgrade` to avoid any unintentional consequences (e.g. failure to install the original process that you meant to whitelist on the host).
+
+If `masquerade.enabled=True`, this chart will have the wins client execute `wins-upgrade.exe` payload under the `masquerade.as` path provided, effectively tricking the `wins server` into running the binary although it has not been whitelisted. This relies on the fact that the wins server does not / cannot do any verification on the binary passed into wins since it does track a list of valid checksums on the binaries provided to it.

charts/rancher-wins-upgrader/101.0.0+up0.0.1/app-readme.md

@@ -0,0 +1,19 @@
+# Rancher Wins Upgrader
+
+A Rancher chart that handles keeping the wins server version and config across some (or all) of the Windows nodes on a Kubernetes cluster in sync. It does this by running a simple script to replace the contents of the `\etc\rancher\wins` directory with the newly specified config and wins image via one or more DaemonSets. Once executed, the script will simply sleep forever.
+
+## How does this work?
+
+A DaemonSet of initContainers copies the provided config (stored in a ConfigMap) into `\etc\rancher\wins\config` and runs `wins cli prc run --path {path-to-wins} --args {up}`, where `.\wins up[grade]` is a Go program that runs a simple Powershell script that forces an upgrade of the binary used by the `rancher-wins` service across all of your Windows hosts.
+
+TLDR: we use wins (cli) to pass wins (upgrade) to wins (server) in order to update wins (server) on the host on demand.
+
+## Cluster / Node Requirements
+
+This Helm chart is intended to be used on a Windows cluster that meets the following two requirements:
+- A Windows Service called `rancher-wins` is currently running on each Windows host (e.g. `.\wins srv app run --register; Start-Service -Name rancher-wins` or `.\wins up` has been run on the host) that is running a wins server version of v0.1.0+.
+- The wins config used by each Windows host's `rancher-wins` Service has `{{ .Values.prefixPath }}etc\rancher\wins\wins-upgrade.exe` within `whiteList.processPath` so that the new wins version can be delivered onto the host
+
+If the cluster you are installing this chart on is a custom cluster that was created via RKE1 with Windows Support enabled after wins v0.1.0+ was released (i.e. Rancher 2.5.7+), your nodes should already meet the first requirement; this should have been added as part of [the bootstrapping process for adding the Windows node onto your RKE1 cluster](https://github.com/rancher/rancher/blob/master/package/windows/bootstrap.ps1).
+
+If not, please see the README.md for more information on how you can use this chart.

charts/rancher-wins-upgrader/101.0.0+up0.0.1/scripts/noop.ps1

@@ -0,0 +1,4 @@
+$ErrorActionPreference = 'Stop'
+
+# Sleep forever, since a DaemonSet's restartPolicy must be Always
+while(1) { Start-Sleep -s 3600 }

charts/rancher-wins-upgrader/101.0.0+up0.0.1/scripts/upgrade.ps1

@@ -0,0 +1,72 @@
+$ErrorActionPreference = 'Stop'
+
+function Create-Directory
+{
+    param (
+        [parameter(Mandatory = $false, ValueFromPipeline = $true)] [string]$Path
+    )
+
+    if (Test-Path -Path $Path) {
+        if (-not (Test-Path -Path $Path -PathType Container)) {
+            # clean the same path file
+            Remove-Item -Recurse -Force -Path $Path -ErrorAction Ignore | Out-Null
+        }
+
+        return
+    }
+
+    New-Item -Force -ItemType Directory -Path $Path | Out-Null
+}
+
+function Transfer-File
+{
+    param (
+        [parameter(Mandatory = $true)] [string]$Src,
+        [parameter(Mandatory = $true)] [string]$Dst
+    )
+
+    if (Test-Path -PathType leaf -Path $Dst) {
+        $dstHasher = Get-FileHash -Path $Dst
+        $srcHasher = Get-FileHash -Path $Src
+        if ($dstHasher.Hash -eq $srcHasher.Hash) {
+            return
+        }
+    }
+
+    $null = Copy-Item -Force -Path $Src -Destination $Dst
+}
+
+$prefixPath = 'c:\'
+if ($env:CATTLE_PREFIX_PATH) {
+    $prefixPath = $env:CATTLE_PREFIX_PATH
+}
+$winsUpgradePath = $('{0}etc\rancher\wins\wins-upgrade.exe' -f $prefixPath)
+if ($env:WINS_UPGRADE_PATH) {
+    $winsUpgradePath = $env:WINS_UPGRADE_PATH
+}
+
+
+$winsUpgradeDir = Split-Path -Path $winsUpgradePath
+$winsUpgradeFilename = Split-Path -Path $winsUpgradePath -Leaf
+
+Create-Directory -Path $winsUpgradeDir
+Transfer-File -Src "c:\Windows\wins.exe" -Dst $winsUpgradePath
+
+Create-Directory -Path "c:\host\etc\rancher\wins"
+Transfer-File -Src $winsUpgradePath -Dst "c:\host\etc\rancher\wins\$winsUpgradeFilename"
+Transfer-File -Src "c:\scripts\config" -Dst "c:\host\etc\rancher\wins\config"
+
+$winsOut = wins.exe cli prc run --path=$winsUpgradePath --args="up --wins-args=`'--config=$winsUpgradeDir\config`'"
+
+Write-Host $winsOut
+
+if ($winsOut -match ".* rpc error: code = Unavailable desc = transport is closing") {
+    Write-Host "Successfully upgraded"
+    exit 0
+} elseif ($LastExitCode -ne 0) {
+    Write-Host "Returned exit $LastExitCode"
+    exit $LastExitCode
+} else {
+    Write-Host "Returned exit 0, but did not receive expected output from .\wins up"
+    exit 1
+}

charts/rancher-wins-upgrader/101.0.0+up0.0.1/templates/_helpers.tpl

@@ -0,0 +1,63 @@
+# Rancher
+
+{{- define "system_default_registry" -}}
+{{- if .Values.global.cattle.systemDefaultRegistry -}}
+{{- printf "%s/" .Values.global.cattle.systemDefaultRegistry -}}
+{{- end -}}
+{{- end -}}
+
+# General
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+The components in this chart create additional resources that expand the longest created name strings.
+The longest name that gets created adds and extra 37 characters, so truncation should be 63-35=26.
+*/}}
+{{- define "winsUpgrader.name" -}}
+wins-upgrader
+{{- end -}}
+
+{{- define "winsUpgrader.namespace" -}}
+{{- default .Release.Namespace .Values.namespaceOverride -}}
+{{- end -}}
+
+{{- define "winsUpgrader.labels" -}}
+k8s-app: {{ template "winsUpgrader.name" . }}
+release: {{ .Release.Name }}
+provider: kubernetes
+{{- end -}}
+
+{{- define "winsUpgrader.validatePathPrefix" -}}
+{{- if .Values.global.cattle.rkeWindowsPathPrefix -}}
+{{- $prefixPath := (.Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\") -}}
+{{- if (not (hasSuffix "\\" $prefixPath)) -}}
+{{- fail (printf ".Values.global.cattle.rkeWindowsPathPrefix must end in '/' or '\\', found %s" $prefixPath) -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{- define "winsUpgrader.winsHostPath" -}}
+{{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "\\\\" "\\" | replace "\\" "/" }}etc/rancher/wins
+{{- end -}}
+
+{{- define "winsUpgrader.winsMasqueradePath" -}}
+{{ tpl .Values.masquerade.as . | required "Must provide name for .Values.masquerade.as if enabled" | replace "\\\\" "\\" | replace "\\" "/" }}
+{{- end -}}
+
+{{- define "winsUpgrader.winsMasqueradeHostPath" -}}
+{{ include "winsUpgrader.winsMasqueradePath" . | dir }}
+{{- end -}}
+
+{{- define "winsUpgrader.nodeSelector" -}}
+{{- if semverCompare "<1.14-0" .Capabilities.KubeVersion.GitVersion -}}
+beta.kubernetes.io/os: windows
+{{- else -}}
+kubernetes.io/os: windows
+{{- end -}}
+{{- end -}}
+
+{{- define "winsUpgrader.tolerations" -}}
+- operator: Exists
+{{- end -}}

charts/rancher-wins-upgrader/101.0.0+up0.0.1/templates/configmap.yaml

@@ -0,0 +1,17 @@
+{{ include "winsUpgrader.validatePathPrefix" . }}
+{{- range .Values.winsConfigs }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ template "winsUpgrader.name" $ }}-{{ .name }}
+  namespace: {{ template "winsUpgrader.namespace" $ }}
+  labels: {{ include "winsUpgrader.labels" $ | nindent 4 }}
+data:
+  config: |- 
+{{ tpl .config $ | indent 4 }}
+  upgrade.ps1: |-
+{{ $.Files.Get "scripts/upgrade.ps1" | indent 4 }}
+  noop.ps1: |-
+{{ $.Files.Get "scripts/noop.ps1" | indent 4 }}
+---
+{{- end }}

charts/rancher-wins-upgrader/101.0.0+up0.0.1/templates/daemonset.yaml

@@ -0,0 +1,72 @@
+{{- range .Values.winsConfigs }}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: {{ template "winsUpgrader.name" $ }}-{{ required "Must provide name for .Values.winsConfigs[].name" .name }}
+  namespace: {{ template "winsUpgrader.namespace" $ }}
+  labels: {{ include "winsUpgrader.labels" $ | nindent 4 }}
+spec:
+  selector:
+    matchLabels: {{ include "winsUpgrader.labels" $ | nindent 6 }}
+  template:
+    metadata:
+      labels: {{ include "winsUpgrader.labels" $ | nindent 8 }}
+    spec:
+      nodeSelector: {{ include "winsUpgrader.nodeSelector" $ | nindent 8 }}
+{{- if .nodeSelector }}
+{{ toYaml .nodeSelector | indent 8 }}
+{{- end }}
+{{- if .tolerations }}
+      tolerations: {{ .tolerations | toYaml | nindent 8 }}
+{{- else }}
+      tolerations: {{ include "winsUpgrader.tolerations" $ | nindent 8 }}
+{{- end }}
+      serviceAccountName: {{ template "winsUpgrader.name" $ }}
+      containers:
+      - name: noop
+        image: {{ template "system_default_registry" $ }}{{ required "Must provide name for .Values.winsConfigs[].image.repository" .image.repository }}:{{ required "Must provide name for .Values.winsConfigs[].tag" .image.tag }}
+        command: ["pwsh", "-f", "c:/scripts/noop.ps1"]
+        volumeMounts:
+        - name: upgrade-scripts
+          mountPath: c:/scripts
+      initContainers:
+      - name: wins-upgrader
+        image: {{ template "system_default_registry" $ }}{{ .image.repository }}:{{ .image.tag }}
+        command: ["pwsh", "-f", "c:/scripts/upgrade.ps1"]
+        volumeMounts:
+        - name: wins-pipe
+          mountPath: \\.\pipe\rancher_wins
+        - name: wins
+          mountPath: c:/host/etc/rancher/wins
+        - name: upgrade-scripts
+          mountPath: c:/scripts
+        env:
+        - name: HELM_REVISION_NUMBER
+          value: {{ $.Release.Revision | quote }}
+        - name: CATTLE_PREFIX_PATH
+          value: {{ default "c:\\" $.Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}
+{{- if $.Values.masquerade.enabled }}
+        - name: WINS_UPGRADE_PATH
+          value: {{ include "winsUpgrader.winsMasqueradePath" $ }}
+{{- end }}
+      volumes:
+      - name: wins-pipe
+        hostPath:
+          path: \\.\pipe\rancher_wins
+      - name: wins
+        hostPath:
+{{- if $.Values.masquerade.enabled }}
+          path: {{ include "winsUpgrader.winsMasqueradeHostPath" $ }}
+          type: DirectoryOrCreate
+{{- else }}
+          path: {{ include "winsUpgrader.winsHostPath" $ }}
+          type: DirectoryOrCreate
+{{- end }}
+      - name: upgrade-scripts
+        configMap:
+          name: {{ template "winsUpgrader.name" $ }}-{{ .name }}
+---
+{{- end }}
+{{- if not .Values.winsConfigs }}
+{{- fail "Cannot install chart unless at least one config is provided in .Values.winsConfigs" }}
+{{- end }}

charts/rancher-wins-upgrader/101.0.0+up0.0.1/templates/rbac.yaml

@@ -0,0 +1,70 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ template "winsUpgrader.name" . }}
+  namespace: {{ template "winsUpgrader.namespace" . }}
+  labels: {{ include "winsUpgrader.labels" . | nindent 4 }}
+rules:
+- apiGroups: ['policy']
+  resources: ['podsecuritypolicies']
+  verbs:     ['use']
+  resourceNames: [{{ include "winsUpgrader.name" . | quote }}]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: {{ template "winsUpgrader.name" . }}
+  namespace: {{ template "winsUpgrader.namespace" . }}
+  labels: {{ include "winsUpgrader.labels" . | nindent 4 }}
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: {{ template "winsUpgrader.name" . }}
+subjects:
+- kind: ServiceAccount
+  name: {{ template "winsUpgrader.name" . }}
+  namespace: {{ template "winsUpgrader.namespace" $ }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ template "winsUpgrader.name" . }}
+  namespace: {{ template "winsUpgrader.namespace" . }}
+  labels: {{ include "winsUpgrader.labels" . | nindent 4 }}
+---
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+  name: {{ template "winsUpgrader.name" . }}
+  namespace: {{ template "winsUpgrader.namespace" . }}
+  labels: {{ include "winsUpgrader.labels" . | nindent 4 }}
+spec:
+  privileged: false
+  hostNetwork: false
+  hostIPC: false
+  hostPID: false
+  runAsUser:
+    rule: 'RunAsAny'
+  seLinux:
+    rule: 'RunAsAny'
+  supplementalGroups:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 0
+        max: 65535
+  fsGroup:
+    rule: 'MustRunAs'
+    ranges:
+      - min: 0
+        max: 65535
+  readOnlyRootFilesystem: false
+  volumes:
+    - 'secret'
+    - 'hostPath'
+  allowedHostPaths:
+  - pathPrefix: \\.\pipe\rancher_wins
+{{- if .Values.masquerade.enabled }}
+  - pathPrefix: {{ include "winsUpgrader.winsMasqueradeHostPath" . }}
+{{- else }}
+  - pathPrefix: {{ include "winsUpgrader.winsHostPath" . }}
+{{- end }}

charts/rancher-wins-upgrader/101.0.0+up0.0.1/values.yaml

@@ -0,0 +1,60 @@
+# Default values for rancher-windows-exporter.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+# Configuration
+
+global:
+  cattle:
+    systemDefaultRegistry: ""
+    rkeWindowsPathPrefix: "c:\\"
+
+## One or more configurations for the wins server to be applied across all of the nodes based on the nodeSelector and tolerations provided
+##
+winsConfigs:
+- name: default
+  image:
+    # TODO(aiyengar2): replace with an image that just contains wins
+    repository: rancher/wins
+    tag: v0.1.1
+    os: "windows"
+  config: |
+    debug: false
+    listen: rancher_wins
+    proxy: rancher_wins_proxy
+    whiteList:
+      processPaths:
+        - {{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}etc\rancher\wins\wins-upgrade.exe
+        - {{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}etc\windows-exporter\windows-exporter.exe
+        - {{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}etc\wmi-exporter\wmi-exporter.exe
+        - {{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}etc\kubernetes\bin\kube-proxy.exe
+        - {{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}etc\kubernetes\bin\kubelet.exe
+        - {{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}etc\nginx\nginx.exe
+        - {{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}opt\bin\flanneld.exe
+      proxyPorts:
+        - 9796
+    upgrade:
+      mode: watching
+      watchingPath: {{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}etc\rancher\wins\wins.exe
+  # By default, `kubernetes.io/os: windows` or `beta.kubernetes.io/os: windows` will be included
+  nodeSelector: {}
+  # If provided, these tolerations will be used. Otherwise, it defaults to `[ {operator: Exists} ]`
+  tolerations: []
+
+## Masquerade is *only* meant as a hack to allow users who are currently operating on Windows clusters that do
+## not support wins upgrades (e.g. those which have not whitelisted {{ .Values.prefixPath }}etc\rancher\wins\wins-upgrade.exe)
+## to be able to masquerade the payload for this installer under another whitelisted process's name.
+##
+## Please read the README.md before trying to enable this option and, if applied, ensure that you immediately upgrade
+## this chart with masquerade.enabled=false to avoid any unintentional consequences (e.g. failure to install the original
+## process that you meant to whitelist on the host)
+##
+## TLDR: Use at your own risk. Here be dragons...
+##
+masquerade:
+  enabled: false
+  # Why wmi_exporter?
+  # wmi_exporter is the only default whitelisted process that may or may not be run on the host, since
+  # it is only ever deployed if the Windows cluster is also using Prometheus-based Windows monitoring (e.g. Rancher Monitoring V1)
+  # All of the other default whitelisted processes are required for the Kubernetes cluster to operate
+  as: '{{ default "c:\\" .Values.global.cattle.rkeWindowsPathPrefix | replace "/" "\\" }}etc\wmi-exporter\wmi-exporter.exe'

index.yaml

@@ -10069,6 +10069,28 @@ entries:
     - assets/rancher-windows-gmsa-crd/rancher-windows-gmsa-crd-1.0.0.tgz
     version: 1.0.0
   rancher-wins-upgrader:
+  - annotations:
+      catalog.cattle.io/certified: rancher
+      catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.22.0-0'
+      catalog.cattle.io/namespace: cattle-wins-system
+      catalog.cattle.io/os: windows
+      catalog.cattle.io/permits-os: linux,windows
+      catalog.cattle.io/rancher-version: '>= 2.7.0-0 < 2.8.0-0'
+      catalog.cattle.io/release-name: rancher-wins-upgrader
+    apiVersion: v2
+    appVersion: 0.1.1
+    created: "2022-09-26T17:16:20.143967885+05:30"
+    description: Manages upgrading the wins server version and configuration across
+      all of your Windows nodes
+    digest: 38772a5a03fc707ab9a8b1de306e23ad8f8502ca7aee6b32255c835d8d85b79c
+    maintainers:
+    - email: arvind.iyengar@suse.com
+      name: aiyengar2
+    name: rancher-wins-upgrader
+    type: application
+    urls:
+    - assets/rancher-wins-upgrader/rancher-wins-upgrader-101.0.0+up0.0.1.tgz
+    version: 101.0.0+up0.0.1
   - annotations:
       catalog.cattle.io/certified: rancher
       catalog.cattle.io/kube-version: '>= 1.16.0-0 < 1.22.0-0'