From fe1384a5a255912441ddbfaf52ee6947631bd844 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Tue, 17 Sep 2024 00:44:27 +0000 Subject: [PATCH] Added chart versions: codefresh/cf-runtime: - 6.3.61 confluent/confluent-for-kubernetes: - 0.1033.33 speedscale/speedscale-operator: - 2.2.419 --- assets/codefresh/cf-runtime-6.3.61.tgz | Bin 0 -> 43676 bytes .../confluent-for-kubernetes-0.1033.33.tgz | Bin 0 -> 369990 bytes .../speedscale-operator-2.2.419.tgz | Bin 0 -> 16996 bytes .../codefresh/cf-runtime/6.3.61/.helmignore | 3 + charts/codefresh/cf-runtime/6.3.61/Chart.yaml | 28 + charts/codefresh/cf-runtime/6.3.61/README.md | 1228 ++ .../cf-runtime/6.3.61/README.md.gotmpl | 1007 ++ .../6.3.61/files/cleanup-runtime.sh | 37 + .../6.3.61/files/configure-dind-certs.sh | 132 + .../cf-runtime/6.3.61/files/init-runtime.sh | 80 + .../6.3.61/files/reconcile-runtime.sh | 38 + .../_components/app-proxy/_deployment.yaml | 70 + .../_components/app-proxy/_env-vars.yaml | 19 + .../_components/app-proxy/_helpers.tpl | 43 + .../_components/app-proxy/_ingress.yaml | 32 + .../_components/app-proxy/_rbac.yaml | 47 + .../_components/app-proxy/_service.yaml | 17 + .../event-exporter/_deployment.yaml | 62 + .../_components/event-exporter/_env-vars.yaml | 14 + .../_components/event-exporter/_helpers.tpl | 43 + .../_components/event-exporter/_rbac.yaml | 47 + .../_components/event-exporter/_service.yaml | 17 + .../event-exporter/_serviceMontor.yaml | 14 + .../_components/monitor/_deployment.yaml | 70 + .../_components/monitor/_env-vars.yaml | 26 + .../_components/monitor/_helpers.tpl | 42 + .../templates/_components/monitor/_rbac.yaml | 56 + .../_components/monitor/_service.yaml | 17 + .../_components/runner/_deployment.yaml | 103 + .../templates/_components/runner/_helpers.tpl | 42 + .../templates/_components/runner/_rbac.yaml | 53 + .../_init-container.yaml | 30 + .../_main-container.yaml | 28 + .../_sidecar-container.yaml | 22 + .../volume-provisioner/_cronjob.yaml | 58 + .../volume-provisioner/_daemonset.yaml | 98 + .../volume-provisioner/_deployment.yaml | 67 + .../volume-provisioner/_env-vars.yaml | 88 + .../volume-provisioner/_helpers.tpl | 93 + .../_components/volume-provisioner/_rbac.yaml | 71 + .../volume-provisioner/_secret.yaml | 22 + .../volume-provisioner/_storageclass.yaml | 47 + .../cf-runtime/6.3.61/templates/_helpers.tpl | 51 + .../templates/app-proxy/deployment.yaml | 9 + .../6.3.61/templates/app-proxy/ingress.yaml | 9 + .../6.3.61/templates/app-proxy/rbac.yaml | 9 + .../6.3.61/templates/app-proxy/service.yaml | 9 + .../templates/event-exporter/deployment.yaml | 9 + .../6.3.61/templates/event-exporter/rbac.yaml | 9 + .../templates/event-exporter/service.yaml | 11 + .../templates/extra/extra-resources.yaml | 6 + .../templates/extra/runtime-images-cm.yaml | 19 + .../hooks/post-install/cm-update-runtime.yaml | 18 + .../hooks/post-install/job-gencerts-dind.yaml | 68 + .../post-install/job-update-runtime.yaml | 77 + .../post-install/rbac-gencerts-dind.yaml | 37 + .../pre-delete/job-cleanup-resources.yaml | 73 + .../pre-delete/rbac-cleanup-resources.yaml | 46 + .../6.3.61/templates/monitor/deployment.yaml | 9 + .../6.3.61/templates/monitor/rbac.yaml | 9 + .../6.3.61/templates/monitor/service.yaml | 9 + .../templates/other/external-secrets.yaml | 2 + .../6.3.61/templates/other/podMonitor.yaml | 2 + .../templates/other/serviceMonitor.yaml | 2 + .../6.3.61/templates/runner/deployment.yaml | 9 + .../6.3.61/templates/runner/rbac.yaml | 9 + .../6.3.61/templates/runtime/_helpers.tpl | 123 + .../templates/runtime/cm-dind-daemon.yaml | 10 + .../6.3.61/templates/runtime/rbac.yaml | 48 + .../runtime/runtime-env-spec-tmpl.yaml | 211 + .../6.3.61/templates/runtime/secret.yaml | 11 + .../6.3.61/templates/runtime/svc-dind.yaml | 16 + .../templates/volume-provisioner/cronjob.yaml | 11 + .../volume-provisioner/daemonset.yaml | 11 + .../volume-provisioner/deployment.yaml | 10 + .../templates/volume-provisioner/rbac.yaml | 9 + .../templates/volume-provisioner/secret.yaml | 10 + .../volume-provisioner/storageclass.yaml | 10 + .../codefresh/cf-runtime/6.3.61/values.yaml | 947 ++ .../0.1033.33/Chart.yaml | 23 + .../0.1033.33/README.md | 72 + .../0.1033.33/app-readme.md | 3 + .../platform.confluent.io_clusterlinks.yaml | 883 ++ ...rm.confluent.io_confluentrolebindings.yaml | 296 + .../platform.confluent.io_connectors.yaml | 496 + .../crds/platform.confluent.io_connects.yaml | 6941 ++++++++++ .../platform.confluent.io_controlcenters.yaml | 6394 +++++++++ ...latform.confluent.io_kafkarestclasses.yaml | 557 + ...latform.confluent.io_kafkarestproxies.yaml | 5834 ++++++++ .../crds/platform.confluent.io_kafkas.yaml | 10948 ++++++++++++++++ .../platform.confluent.io_kafkatopics.yaml | 410 + ...latform.confluent.io_kraftcontrollers.yaml | 5752 ++++++++ ...tform.confluent.io_kraftmigrationjobs.yaml | 194 + .../crds/platform.confluent.io_ksqldbs.yaml | 6646 ++++++++++ ...platform.confluent.io_schemaexporters.yaml | 688 + ...latform.confluent.io_schemaregistries.yaml | 5801 ++++++++ .../crds/platform.confluent.io_schemas.yaml | 590 + .../platform.confluent.io_zookeepers.yaml | 4713 +++++++ .../0.1033.33/templates/NOTES.txt | 4 + .../0.1033.33/templates/_helpers.tpl | 42 + .../0.1033.33/templates/clusterrole.yaml | 172 + .../templates/clusterrolebinding.yaml | 56 + .../0.1033.33/templates/deployment.yaml | 238 + .../0.1033.33/templates/licensing.yaml | 19 + .../0.1033.33/templates/service.yaml | 28 + .../0.1033.33/templates/serviceaccount.yaml | 18 + .../validatingwebhookconfiguration.yaml | 184 + .../0.1033.33/values.yaml | 269 + .../speedscale-operator/2.2.419/.helmignore | 23 + .../speedscale-operator/2.2.419/Chart.yaml | 27 + .../speedscale-operator/2.2.419/LICENSE | 201 + .../speedscale-operator/2.2.419/README.md | 111 + .../speedscale-operator/2.2.419/app-readme.md | 111 + .../2.2.419/questions.yaml | 9 + .../2.2.419/templates/NOTES.txt | 12 + .../2.2.419/templates/admission.yaml | 209 + .../2.2.419/templates/configmap.yaml | 43 + .../templates/crds/trafficreplays.yaml | 523 + .../2.2.419/templates/deployments.yaml | 132 + .../2.2.419/templates/hooks.yaml | 73 + .../2.2.419/templates/rbac.yaml | 244 + .../2.2.419/templates/secrets.yaml | 18 + .../2.2.419/templates/services.yaml | 22 + .../2.2.419/templates/tls.yaml | 183 + .../speedscale-operator/2.2.419/values.yaml | 138 + index.yaml | 92 +- 126 files changed, 66390 insertions(+), 1 deletion(-) create mode 100644 assets/codefresh/cf-runtime-6.3.61.tgz create mode 100644 assets/confluent/confluent-for-kubernetes-0.1033.33.tgz create mode 100644 assets/speedscale/speedscale-operator-2.2.419.tgz create mode 100644 charts/codefresh/cf-runtime/6.3.61/.helmignore create mode 100644 charts/codefresh/cf-runtime/6.3.61/Chart.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/README.md create mode 100644 charts/codefresh/cf-runtime/6.3.61/README.md.gotmpl create mode 100644 charts/codefresh/cf-runtime/6.3.61/files/cleanup-runtime.sh create mode 100644 charts/codefresh/cf-runtime/6.3.61/files/configure-dind-certs.sh create mode 100644 charts/codefresh/cf-runtime/6.3.61/files/init-runtime.sh create mode 100644 charts/codefresh/cf-runtime/6.3.61/files/reconcile-runtime.sh create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_env-vars.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_ingress.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_service.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_env-vars.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_service.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_serviceMontor.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_env-vars.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_service.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_init-container.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_main-container.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_sidecar-container.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_cronjob.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_daemonset.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_env-vars.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_secret.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_storageclass.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/ingress.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/service.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/service.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/extra/extra-resources.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/extra/runtime-images-cm.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/cm-update-runtime.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/job-gencerts-dind.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/job-update-runtime.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/rbac-gencerts-dind.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/hooks/pre-delete/job-cleanup-resources.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/hooks/pre-delete/rbac-cleanup-resources.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/monitor/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/monitor/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/monitor/service.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/other/external-secrets.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/other/podMonitor.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/other/serviceMonitor.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/runner/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/runner/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/runtime/_helpers.tpl create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/runtime/cm-dind-daemon.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/runtime/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/runtime/runtime-env-spec-tmpl.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/runtime/secret.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/runtime/svc-dind.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/cronjob.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/daemonset.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/deployment.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/rbac.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/secret.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/storageclass.yaml create mode 100644 charts/codefresh/cf-runtime/6.3.61/values.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/Chart.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/README.md create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/app-readme.md create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_clusterlinks.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_confluentrolebindings.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_connectors.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_connects.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_controlcenters.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkarestclasses.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkarestproxies.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkas.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkatopics.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kraftcontrollers.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kraftmigrationjobs.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_ksqldbs.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemaexporters.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemaregistries.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemas.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_zookeepers.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/NOTES.txt create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/_helpers.tpl create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/clusterrole.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/clusterrolebinding.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/deployment.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/licensing.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/service.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/serviceaccount.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/templates/validatingwebhookconfiguration.yaml create mode 100644 charts/confluent/confluent-for-kubernetes/0.1033.33/values.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/.helmignore create mode 100644 charts/speedscale/speedscale-operator/2.2.419/Chart.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/LICENSE create mode 100644 charts/speedscale/speedscale-operator/2.2.419/README.md create mode 100644 charts/speedscale/speedscale-operator/2.2.419/app-readme.md create mode 100644 charts/speedscale/speedscale-operator/2.2.419/questions.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/NOTES.txt create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/admission.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/configmap.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/crds/trafficreplays.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/deployments.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/hooks.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/rbac.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/secrets.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/services.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/templates/tls.yaml create mode 100644 charts/speedscale/speedscale-operator/2.2.419/values.yaml diff --git a/assets/codefresh/cf-runtime-6.3.61.tgz b/assets/codefresh/cf-runtime-6.3.61.tgz new file mode 100644 index 0000000000000000000000000000000000000000..5dea8e26a70bd09ede268670fbc7ca0d0e26bf55 GIT binary patch literal 43676 zcmV*IKxe-niwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0POwia@)AlFbY4vbro33yfwC;kUIF3(YI!Ok0L9MCO+tuW z|D#&luOHU`15_Uv4{e%}&<5&2n|q%-WYihps6*6VCIhl%YhCEF}SOl zwc`V`RtKL@IH3?|u8kcy3Lu$)VCDhCaItNyKG+K_My`9}a z;|>Od_4>zu{aiC^uZ-%C+QI>Jp+%qo951+%<)il!#$CPSKp%Pz^lSu4qhx@nJf#Qr zN&p1V#{`8qnA0(EVWUzp=@hS4LGY~e%NKTVdhSUVl0-KXn))mEVJWYV9+(8d}Rw<(4k-2Xk z)k;sjP#-BN{Qu5!XOKL?2C$g_AMGC>*VFv}uzs}V|C>lJfMI}s7$9#<88T&%$a38| zz;`eRkOP%fWR7O8OP3Z1;na7n5Q3dg$aR5Sv>=>7AlMySy1Q&8UJ6hRP%f8J4N{N= z8!O421UwG#)WtWJOVPKcFoXdqy#W8^z>zg`L)IXK;0C(*Q)$df(!EZtc!KR)7>Io< zfMZ0$U|s?|qbGi|_O$h64M3nBz>xKw0E+-C2&@QBcjmf%R)93XZy!q%)>ZEe;E}?I zyRH?Ea4-cs0sLcz0_gl>mu@Yxz*|hh1}I0I%v5=FgyI!}0SNIe^Z@dJ@3H}cpTig` zKqGL?2@-=C&>9@gcW~Z=qicW&z*7{40*@D<2S+gzPBvee5g1em3`69N3D_YJf@Ze^ z-oZKHmCuofrk2ZcZ{Zve8~bz*=ev*5@knU7E|W=i0%$q^`6)ml+rq~P6vOI7D0ls0oumdJA zfO$h*H>(wkgEHiZM;XYYQ7|>1E#}45qD;L=oX;CKC0JUht;73?M!oUjQm~Q1WcINDhj0QUf zhjSk`Ko7ev^2Yp7sy63i2Pg;a5}-Lv<>Vdh1EK<>wGvo@>dt3$JD1Q>@dB%~zJ zjSgbGsEej3jD7(yg;NIhuvR}uQLgRJ8sNv;k5T)7%plQKs~;X^s#VSUk1=tP18plv z^qz_{Huh}fLL&JYAU?GD%8kV`y6)+L*$L1n1P%5$wpxy01*CB zeB+d2wOSM%D8EY~g?(q3!iaT<3i9ZYuEKaQE9S-9WK3U4+jOlYQvmAk#1QpfH(SXr z1vi$R?FcIujq-wi&@s1XB*aq?%qZK$oO5EA7owTTLkeX}M5x^&nT@UnTF=K0E2rnw zjNM6g2MM9u@eQQ7j?j1( zNJ%sw%Rtub(uy3zk%in@00$Gg1hMNhz#(7J9-;^36X;s=K4l*ck)M1RAl6?slgw-z z5~9H2ouJGH&qAfNN^r^P*mB{#vXoxN>b8d2%ygk0V#?X*@4on%E*oMO2GP`0ez8$k z3RrE-*13}3I{@HA`F0U>I!_LXS z8njU5pPlCUuy=XZ9$qxh+y5$m-#f{ERSH1LMiOO?5;^PgQ(9M2 zrr4uQ;~Jb;aEd*~qtwxT0e1MM8egjf*ejateALiSHrSs{CUXBA2LwZOyFz zWFGL%G|OH^wssomu*?V*A~zvF@EI;o1!>r_*_exF2U$Bkl7lQSQRzwi$0RM}*#`Tx zG_C(*`!gaTkssh_1nsZ^e!Readjg%A3;8Fpmr_}pkhmE=B@!d1ju}73$D@`UH_P>r z2cu7HkoL{mt7wSRqyW(hPYq9EFz7+SnuVB8>uYsRuxUE;uR$xo-Y@tjGppg}5C+~_ z6Fb?&BTsJ8N@{wW)y#aNN6=XiK+m3cv5V|^1H8e(4dNH=M2vX@l=mvND%j)yE33lg zXy*QcZ^&CjI70i81Ph(ShnlEGeCQ?4sSmQ+Mi~y9!+7;PTDyu8OfbEy*yi#A^g|q2 zW2np&wyS8Qr@Z+=IE04EiEk|X7J7~V!$d={bIo|_b>$k~5dN=W6Lej<9^24C<+H@X^-fve8e{i^^vS6X``49gglpHk@s-T3LVYnM$9}z>2ay2l z&O)wrgIp@;{fRx8hNTwxZ|qTsGh#rCghtI$0EK;1dCpPG z@Z&9?Q|YAS$?rBK|dhulLjasR;$%= zl=%X5DwjggrIZCe3~0Bo=a}HqbLULf4bdG0pC-_w=p>jFB1}8aO!`a(s?ab1X2%2! zCQ+#0&#lkE0JWo+QqrK=;UvJb@x-5n98VR^LG%qE51gad6`~+$-yg$T{ZNCTg7$(T zs;@mn%K1IP^lJ6}1M9|ij9T5gG4>B^$2dHKBZKB29v#2>scPNC% z=*|k^@D|Ps7hF)vb`kW#A)H#sU0!TqgVrpZ3}*paP=r}6EGfgl2!o7Z`1!E<)6j-N zIGhCq5Y!gWl>SBZ-ra zWJBEmPSI>SJnQuZ_aV14Zuz5p;>rxmo*-|0jvd$l7n0Mw(5w>=2jK+H0_;PhCQ36ul$e@IJjYCF-{|((-2-P<9;xP*`K;8rfNEnRuCwS&Mz{4T9fj~T7F+n$33vrvn z0J|=9(l#ChIna!a-rAo-=sA(*mTMs@Vs=y}^P2!UmD^Wj=;BYq=z=z3yQe(9D5amv zZ2n$GOwa|_Gdq-NU3vyv(gXtRx$|9l1ZP%b(r_(#5v#Aq?m)d3pOuoT%;ZSq6#>#D z1dTm;{l=~kP{2Ah>p|5Rx#mtg1wRB#KAh zuPH3vVVPwp4f!+ImHOt+=mLk`01_x}Qp~{2ROmrkD*{K|A@--+hc{QN&|8ewOxx4R#I)J#UO#pi?a^^ zjldkwfCu@LIXc+M$`_Y|G{4HR4PcuyuiK(k`7ZtAmoET$wmWkmDCg)r%yhLfFu~Wa zKWaLL{#3fcA@$Lpbn87jMd|V&fUHA8v#-+N0Tei*AFK_-XVW=qfMs$!mH1vkwT|~+ zBCHs;3)XQVO#{*}a1dSw4&_`v@}Y}7I7FFoS2xGFue$9PL|d*pJ2QJL5c_L_K2f(r z=BzwTH3k?y!4xb~fy{-nP%1!`iTO-aKum zw;7F5j98)itE5CF*SdjjT>gyx%oa^t!}HSGOCsIvx#sFfcN@>4W-sJbVOZS21LmJVprbvC91?tNw#rW|)DK4TAPE!(ObWLt@P+Yh2J7F?Z z@)YJ<;iMs~{LD-V-rhwq=(>O4$Hf&ZXzhMNe}?q&629V~I$zyfVOnJ%Q|~f&(TS@oAfqjvhuZQdUH4($1cf zuO!7p_8szxIY&(Vkf<5J^QY0@!OV;PCZQFiKo*vXk^)doCjiyzuOjPpt=Lqn>Z;YN z2d`AYiE$owP}#Y$2;7YiK6C(xJlSc_xS|)lLWh-?IJ7R$yO;g8+y=z3Ra8s$sgDV4 z+|{W7S~F_qp;?V8UksX^i*|2#c6oZ*?k#{aGNNHJTs$7bpiwhxHS;LBTfM&OoSiHI zBv#7J47m;ivv1b+lVIo;R}2cBVlZgDGOK3oI1Qx#wkQxXfkESl0!ejf&^%oMP-u-M zFxIUD0qjkGc-igeLl_YQ`=n7b>!zf{X=gBOon2lm8rqRDMxkN5%vQHnHR%~cRDXB% znh6bOmml&_hQ5pEiejo!qbHSGO+e^&y6v;h1%>kZYU%87;LS|Tiv4JQ4ch13v*w^Z zY+syqF0@sBbcH?p51r);I z&T^R_jtR7Hxqjd?v?-qpXUu+=W~G;7-jZ(ryWJYL-nLusqNgXr^M1nQjx{{sChy?W z1i2767pWpbPK_Q1Xc9mmslY z2?Cw9-?z^ifK6Z(fY7b5e8XkXBq%%rcovQsjouCh-3tAuACW7DKfJseoL+V=PKUIF zBvN04t~92YBKBYxOko%xoA85W0`2qmpx0^jhuz-gd3*4-ebpCdgp-85mkQN|W6PdP zn9JY{&)TQW)`y`ekdLg5U6<=UBjfU=O|&l0&f2X3&0;t1`Hj3~Mn*UQ-2hKvIDxYW zJd@I+DX(ee?PY(!9+|QK{iuTN;$UsC-OJvf0e-4Q3U0BwqlZ*nKHw``W}YQv23F_X z`i!QtDSKuDEZ4=KxNbpF1%?=WvXEkd9YBMG&?iFT>+qK@=ub-hE~kEZmsVqDhtT=| zh|BxvoO|BX(`c|xbm zI3>(Qr%fkd`()T3(5;E$A`onVpY+WKFbw9v3PU*cLlPmPk|EtluRZ8}7&ZrV3mo+0 z7V7utU-UB18;d>yDiXRB5gSGi_ZEzOMD2^y6}rDRcAro3(z7J!uZw@uNy*R|5ojHh+WcS|kJ$Xu07;?5^}=6NJDTg)pFdpFN4YhsYxQ z*!tmu&9HOPYz;c^+rz7iLFX(vsUH9%g)i`H5`r8UKnKh`UUj|-c2^f~+s(7V+YfY+ zFGDS6ZHX~lmtKnqRXExr0w0kw*nPg<@!-AAfX9u$Z2Qr z_UiR;aQUu%5$QFUW!0MiPa7GXQ`$xjM0yqO2`uuU5`ShIsHEqVlz!w|db;qf(4Jfa zACu4!e($8t8cZ<0UHqttR(^zc2uq&ivx?Czqpoe8zB)4*wG&zMWFY_HjBe6~p(`H6 zHYo>qgFHkg6uH`~YWh6$_VT>l0F`j+=Z@1DdNvF~e)YBPI7uLnFjVw#Y=>@A#Z`YL zUO|1EqZBz^LEZ^tmi#y;bhS(0>F^hAyxSA3=+F!>^U&u;rNRvVgPB(mua^k6Z=*7y z?KdhFA(%I6a&rt_at8x6nkxhhU6TA|TXdWopaMg?LWs*w;mkCsVq2y!9wN|!>0%Ww z*&FnOT9C04O}Se*kBT9WJ(_}2wTqzA<=Rhmvv%~#{OKpNR;@M;<$+h6C=APS0`3xm zcK4_KI#=(&&pr&$6nbH#)GoaMP2V@V0scHsn!P;0MV#gPhEE|IYQbES8q4E~PDjgKB9|y<9Uwm`R7%EaoSO9tBfH_D=zNyPwjG}l-v(KLC@QZWC zVkOX>TL^tX&oA6KQv$uNT(dgda*Y1fWtFoshlIo~z1b)BSGM5EMW1m7?j~>oqnb>? zGZUx$3HO$ls(bs2&~+*8P37rVLclk_LpzkKmm7;_fpC#VnG*?0C@_}VS*2*4B2Z!~ z#D<8HEL7O~9A}FTPv;JvT8Oh}`0U)i+`mf?|JFZ8 z2HCoE*|L7<^xn!R;$zNNdd4 z7Yx6eTtzZ?-aL5AME@Qva0!!trp{KP@e*@SFvxuW0f}Oi+*JNjrkY@raw-eH#>Hgh zIg(jveF!E!Uq`m4l4A0tIJH81BGix~3sBKtsRBL6$0#yEGK2|LC3&S5TEQ5GT}%(S z(M1#`H&b~cZ>$_nEt^{(vQJaXj~Wi(7=CVm;cyB=YZ!}*LmxXsR(iN&{^zbjY9Bjt zAKHm8QW<4-a|s_;$|pMI(JH|ez{NB<+gD5{bXO}eHv=qglp-p#Tq+beR%kU!s+qHL4wMD?IEzxOY4$XfVhPH7<&UKo zk-QP(pZIVGgBzAPhGF?7D7%QT|9+y3oc_TlApMK;CHj{yKRVEbA!Oi^9Zz(xpIED5j_c&qoFqA zR}Jx)mx1y1Yw61u@Pj>Su}E_R-|fTc9SlI@XW$3O3rCy&F#EF` z9;Z$zP~J6p$VsvOz}K&dka(8w6UxQ-ay*F;Da8v+E-v+5W84cFFN(ilECFGx!}oOB zaZMdwgx2^Acocar1P8P>@gb9Bq=3sBjbd7;QZH|dXyjU@MpF1SnTG{lFLBb)oHKF| zm-Wsx9XR5ky;_b-VOvI2KPD<->LG43FT06uatf{*QKJ*-! zAx9^T_>P>G|AX)VCZ-<;;VSE<@@`&>N$LDz!Mw|sjAmej-$*4)O6W9&ys5UG)}4JZ zSn!_(P(WFLDTBWxF^iB=af7R9c=$R?UPpt-|(Av?0*6!3d)r&`tq=%z$Q}RzLsuhy|R+0aqcW1EoWGjY9zZB#iJ@! zxROC(rMa~Vkjj3s`wnA*Nhsv4%o>w+OR;ekE!OOIhTZ1i?XcTxzv=v&Zy4Y&@W%{? zP+e8YKUe8%S=N2b!xMuq2Z@5+DJsq=LrXh83h4elsM&%fkQwXJn)Odb8 z^~x@mR^k5>==v}qX6UaLAbbh`uh(m7{ZGACKiu;FO{6bhDto2&XP?F6n}|rWc*Gxm zGX_)ItB84><#qgIX9!7zmWfxDWMP6+D3QH|PG(nu#LlR}%(KDKKKm0*`?C?{&t;>W z<-3)=lDJB;qVpY(B>u}7HH21xPi9Cd{W^l1n(jpDyP8+ zLDwO`3Lv-Clka8`0XsKy{z(0zPs=i|wLY|W%~EHS2!Ae5c|-($WqBwSnAak}V#o_@ z7mzzvXst?eMHO~WvNP@|ltqhhm5MZ>G}Iv#>)O74E#+UH$4Z9`HqjwuIX-E<)dIY- zDy}u~OU%;r%1U3ba&K>o(a-9X47sJn%A{m5lV56q7%E#Sy6rnLL2{t69>_`Ik__Ck z_@i71Kt`T=YF7ANrd9TTDLt=v{9AhdJFeF<=fCRycK_c*T6X^<#+)-7^>)UC;U^s2 zB5$l*IP=bBl2WmL<+Y*{|{f{h?Cspui-YM!D{{3&$a0;J-_Q&o2-+DjvvxoVKb zqc=d}UdWBi&Jyn|X@;gT7L!T6nur|iDTPx_B(M_J9C3@grm*IIY6}nXSjF%)h|-@32-)@&DT4{`UO0k+h8e(=lI7(o7lDXzh23?hFfV zQtxw@uh}P3-Fd+6Liy7$j5Hb9nu>|Xsij_6(eLqN5_(93foBDCQ0`$DmO)vuttzMK zztB4DNz5oB-k-MOD}#^17B{xw17#v_>iI`$#Rr%fANZKn@UkAWM&v-~MyZ~E3Q@*L z-P!fi{eebNnB*k~Gs=ASV;Y<6AU*W?uX=cNls^B}kGJ-J8%fLde=+9S^Iv*ve_E?NZeJ(3XQx|I%y2RW zIKFs4!+!)g#5Q&tV9@G{_Z{&g8)24{w8>k;Fzz75E}nYSG#qI0Zo2Vk*HaE?l?s9`X3qn1)FtZoRrL|L_}HSjW|9>n^$fa2)>Ccycc(yblvcaT=z z|JN`ATekln)YJDr^~3G^&&{Ml_dicz1Xf&Ye($@S=WY(Bde3?wOQ1);AIq`xDwnfX zUJN8j8hDLi_!78?gf9W}(DuA7y)@p{zLjxW+jeV}TdlPWxYSv{4r#taW3DyQ%KQHs zMqtbAzmDo@{}227_3C#2-$W|3|38!w*v70f3Ydebx2Jycx>U6QOB74liY+h;TfsKs zX>G&SUH|9U3vp143oKp#)%5$1gTvbP{oh8?D(hdk*w39j?@BOua|JT|<=KO!K)&FlKsq0@1^*3$! zDf>{IZ^#rd7C*5B*5 z5zIQdOCmRmF1t(mPlfX~~^wz&MiuJ_jh_CE(1|39^@{%nvb@S=I%E+l|+cd?9BzHOhK?~6!J7ndjP;bnKwxxDB%K-n;+*5@I1ogupy7!vd+ z{Q02z(@{CsJajSADI3#fw=*1EzH49Tz00cMXnBMdL(F>PjxO19_G+nhcGVxWd&ADj z$_{IpsADKJqS#&a&K|(?E!(bcUlAEOmuvAzso82>UR?|%wvrKzU3_D?rm#opFe1~D z?RT54_JTVb-Q}g?<>2erQt$GtJ$&7{IO$xRiXqou#uXpar?&Mix=L0v@-04%x7NMe z^l+*8{=csG-{t#%?I>;kQ#(4^>i;*A*0KMUyz0J&zf*aiu(kNjv-r(QQ};9VU7zHO zZG6*8)cbq=m1?KeO?~rpmJjFgHy5{i8vHI&Cf?uDS0kA}k%{k9Gret!Qt|zNUGI-e z_y7HRcK@#*Z~Z@RBrU%GdkVwf0yiq_-{n1bQ{U&{`SB61P*?Q&xTp8`xHxRHh|$by z7Hh`GPL5~EA}!h2r9uP3p1w`^IfNb^4069tYJpq6e}Ayg*`)gUInR6y%Yt={uM6Ee zuVr<8F9x&{*|zrC&mk3;|JL>XS-}72;c@!@r&{0o|J+DgEdM=};rAn2Wj&JTPjRWg zz{IPVwEsq^#Qb zRf}1p^2uee-mPkpnpuhrN^Ehc6kTerm_&V{(O|v_G4IT`XhEDid6tdbX3U6RRbOq* zh`%K>;t90eaH26HPK0S6tc}&X1>`{63bOlR#7^i;u#pQTk9}Ou zBJo+D!z3U)pKU5b$NTM7@wnY{yOMw&eb#U7-XF#8y`Z6c$~=C3yZ7g(Rrz*OVg1kg z=6?n3|I+cFYKPVB``?YEb?pCygsa-4t#16sfoyI6@@@Yzx~$bmoizMgo7{`-{!;3* z`vK!hco)i!|a|me+#ro@pu=pypj83*6=T@6kTffC$?H)`IiP=*!nNe z9OkLH-Zsfpc>iDD{BP<0e{`6B|5vNkw)TG;Nel0Pp2GZZxmJDcyPW54{P&O!J|Fxd zY(*13W?T0Xl{nPfvK;uu-<|%Tb8$MXghl zIAG96j=O}_7)u`XMNSh$kq2~}kZ-8;D2@|~NeuVg|ECu6 z?!Eul57YLa#|QQ8{=bo=IsX^f`uT2ietFVvfQ~1OuS@;**_+`>yL)!|;XK;Lv%4hI zuq!(x``u;s5%NUA6o^Z>-zoyd%HDZ0;zZ2hA4;f*A$Bf?(v6VV%I?35J+ZKIa@l%E zyVE}H^as5UI&VYF7@`Nqh=jp>`DXV#odFeGGOPIlDm=fxGgm;{YlDYR_uT)5sm@{% zVA=k^UrWXR*ss>A+x>qdNpq@LXvej#3Sco%jhnuQ+GZd1eD)n4k6V`)Z#t*v&29`Y z*BU`@ia;SRjQCy5p77ZmaEq>&HP5)kSI$buTm|fRbllyhR9d?K^J_c95AYqLs{#g< zp&elFcYIUS9AL@*e{i^;iT_jI#{bz&Qu(ffJjck6w_*?=27V*2LB++UheNOf|A_fk zhy!a3%^S)X4EpO(paDl0-z4T$J zjXir71kkhRnwJBauN(zpPoOh%lW$99Cin~dF~ia*OuTv-&D>w`4S9+}WFZ$i3u|YJ{|A9?617c_>?e znNd}G zB|4Ko&@th=z03EVe&_O{eKLIgAyGu=P>W4_p4E+Wv@<{FK~wRVAqPtslKuq~$bH3> zZhO_mQQ%1v&^~K=@P@T-oIu_?r$xU;q`q0Ap|QhUtf@`H^2%Oia^=@@l2;Z2?;Cvm!qpN^cY;~&&`Wvc(mYm?SJ^q`V znR*7Y&LhIudPny_VjWu@d4Y_B%mp&MA*RLbCf~t%$65Bhue`XVkek2uhs{>2-R}?I zwLc6yCk>6eznrER>saeWXW~!yXg_;u$6%>Fv?5Fu=YqVg8P7@J+`5P$ZhIy z^$Wq?3PsbMKE1p=J!=n}-R@bZ)f{v#FNUpN`=os_=rqszi3d{^7}|N#f5i?U?HsaP zQen!I^-wZzVd9K3#(3;PLsT+^ds6dvg1vJ3NsZRIm}s4;{F{Hy0?6n^C;fk4_1a2b zhi^J(?FL|-yp6oFugTZng1@)t z<;A9w?t~COcgyn01x)7a*OELrE33UE`J~D-i))HBTt4MAYB66g&goXheN7G)dlSy< zifW9j=~9+gNz@s8F&KMEUqOk8E&2QiMB3Un$c2mdpJJ0rqlZwtwW%FUKd$kWt)RSe z>05XwD?jXrEyqbabmgsMYMItL|F0MeV#)dcu)d!;|5uN;?>{$^)`|a+$Hdeq1?z-_ z$b#I4hsX~Pv3&nubtIB*8ty$BdQ`K|Y99nm0X9bQu)aEqT9f_zp%;T(eJ(5dC^7kP z0K^UnY}X>1Fc>RpxHNrBM8L=aX9(XEln8nkCE10k1`=UCNtOSg~@9x1k`%wk*^dE`oICOp5p1jx*@XGGCN-@W|q2R-HU3^ zFP7G~nAVd2IioIo0$3vd*Y>N~`=5jD{m(|yYVtoH_{0fdO|!^lMs|y>CUQ;{6l95C z$zS@`A2aw2IW%)WaUxL49xe)XAAki`Tn+FS8=J*vjRkFMO-(a4pt){47sAyVIclvB zbKq||`opI6_`h=OD6k7G)Bn_t)A1h<>xWzY&qmUU{9hS(z6%J}t7w4}%sF|8P0P$* zzEt+W#3CTX;06Nt*|I}-4#J5Q0;ZQ=NmR{fq92@jD~0a=uE4hfYYId5BJ#^BKI-Jd zrq}#a1F%m~cH|#HYjUUelc!!HEWtzUOnOW-4a$oAC2{(3b9%qy@CI`qsy55MV-O;Z z;r_%PhY`R(W+;FTDCa@5?kwb5H^@cd{J*gW0U}YYaxM;;TCCX-8RQ|)KdA`A&*4Ei zO;sE$c4Q83NO^Z@5yK{^yt@wZ-$%67mZjUXp8R8fU(mjpBF&OfolDN3nB-3{Or&8EY% zUcY?5xn^7T1bO3g>?}h=DVcB+jy+gjGMF(C{X$9Su0L(!mZStA-TRedrJ&HkET2Mu zcTYOsX41?5D;oGNNlWDa`td<3{!8uf=-_xO|8F9#WB;2m-ZfH&C*lX&B=uS;CsW8NoC*N$hOt7MrpPbpeuT9@icmVUw_z4eF zAxPB%l{hk06bVG>dlrfi8;zTJ^6pApmT761GEQAcJ)Pxa7K^NMBl|8wk3Wl5>FI9X zR(#N;-Ty7$H~av9o>x}%^ruft_W$Z}#{XY+f4{cf|2L5sueW@^ONU!}`C@Dz`Yr6w z<0bmTkmeH@X3IxUZFj~navuiDvRM4CJRe3>i97a4gA%!`08%%nG`PgKRe+|q)imJD z_g$d8qt5}W`esWgD5G_lecP~-$dH3 z|8H#lixv4Gi+}n0U(wQApO&uw`cZoQSC6*)|3=bw{eNTYpPS%6%;I0Z{)K_b=J)^V z*8kr|(suoSW9wh6$Vc7(nc2SqKl?ZcVQ_CHz>@V}tJYHcf4#PUxV8V>NMiGzjdxoN zcTpywt(3zFk`qe1;&kBFX9^3U-HS6UgnU2tV0q3$__=%{N!~nVfp);YbN5HzeJaBL z?|TSb&i|`v{cm;q{&zEJ%m4q*{9havx14{Qa#9ige_tiQGX7uNuc!I{(SCi)|2L7g z{Qvpz|A*!Mv7#W4{YQ_ei^4jWp6s?e%HJjF`TyrIu=u}5JPFo50W8!1?jP3D{QqF< z|8+Czks~-Vh7efZ7$&16^`fX=5g*bzdJla!fSv<`ViBGd@9saOyt_X&p`U45u>M89 z!D8$X!=A3o0hXTs57X~It4CY??`F~?uYU^uE{X&ZIbsnej?fz;56Yh%HqRtO5Z*$t zH$vlc%TGV~Pd+0xKxGd&v*~mm1uF%=&j@q!=pqsV(FBj|Nb(<-YMl6juV2LySoD@O z>wq)!`d;f8j6J*&B+B{{TkbwA@yH<^L0mZ%M_+Bs7?zvFldssloj@MfS-L=Krx)t*80_{(fzH|G$y+r2L=x zK~tUpNIs~XbywU93UhSgL;IWI=jxJ+xq22^DY2=cooGi*xwO;$;BQ8@2lwwc73KfG z;~QfPJsSogF&yMM59t5*;3%#C-LD^Q`Ts`Jlk$H#p_DCv-GS-10hR6F(4C_ax&HbE z->kO{B&PI3?+5bP99>Qgpf0DE?8nR>2bKdfWsOe|jVECPl=sWokKBo;;fv7pH*kal zXs}Prwa2UFMXk*VI%~1%0H^@U|0;LBS{m13r z#3b|^%f7{<(HWW|;mJbHi5w9iFVsMjERK(lI%D*1F$>Nbn$(%I((H-irAvZFwPS&Z zSzsv3ffvd;=VaJNC*W1k|B?=#PM|#tP$;bnwSm|rdOmjg$>REW@Zw=Gb9uybWK=gD zO6rkRryFEn#WP6_4~w*etXw%lmi^3xflM^now;sTtgo1Zi3a`Xqw2Y%>3*{2q^yFX zT+#BJm~sXvS8kA3xv|Kk9OYWUn5bn8CYZ`!f3XSu2Dy-!r!WNN5&g4bGhuiZKt?cw z(at23vO@P-RYeARcWNV?>KD!PcE8(fwWBX0V($Wnu4x#(_F22xF91PTx%Fn)>~@B4 zFZ%;6fZ`Hv6e`4+U=k)G9A}yvT)t~xDD7#Ns^HX&K^h^xg`Odzjv5TVvS2fU)=Fzh zfa`}XjdsDi7Ls;K2p`&5GHqACiG@#q9XkUyAe=iITvYg%iL7Mi`fQ7_-3TKU0#dZH1sRBSD2stN`+Rby86`P;I+o7y==5r~!aPHERsz zT+deJEH!|@7%gjA^{SK)ip+^o9Gogl>d!AvcmB;viT6nD;-A4LGVkL!|8Mrhj{731(_MdFP~ujIMW%?hEmb`-b5 z_dP|r{^iToa{BL|7VZB56uKv-{T1=n*LV=JRR4RBe*dw5xV8V-OnO%O-whjoh#CFJ zTHt6EE!FITq!#z3PSd+p?LM$-H=YFG+p^+FBL2ko8%bogD&+;18*&?!p2Al(+Gw7( zF9ySl=DFVHqPSv{>5&aD8Piv7sdsfT=$yA7qAmGhL2H{d1lfQUNMgA3)-hVWej0H1j48@b5tL!UU~BI3H`YLJRl?s(Dt7*3+TXPgfXnp1 z2ghmuU;D@P?fGvb>03PiJ*e_GmRyS{#WcsgvU;Q|XAXSj{1acfQRKwOZF@!*a-p+X zwez<{nk5SFy66K*)S+DXkN=B!uGm z^W>Zwfcre(Uby}rB>GE%^d#EihIMp-@eEJ4X|njpPfd#NGA&sDK6Zq|=X(kOOV@w(FungD zY|sCjNrl&cJR7zv|8JBQtpB9b_eYHXUaw{Re{bWzZzvUB|LG6_TORPYNZR$!Er%XT z{lEPDpML*UJ3g*%<^PQ&cKGGvUG(^$ES+=u=Y_Nf>_q+b&;EKa_d5FPK|VlGFCF0M z@Spp>KW&ld<;QkRj>!r-fko^8fzH$fg|K8wlv(1#!#LU#m3+4fFP!BJjX;8a~Ckz<1^0&NBhDHd4DzJ30{qI7TE4=D-i&2z}1)j~Wf&_}jpZX=TqXK4O#2FAU@6)ZY;kaZ$pxSxj;t0@bdb7CXLnvlW-|ZT>jWE`IKPC!(s01ev3)C8`E!OAs3X}z20T7 z0knkyA|QZ&%uoQGxKok;yv*LL?zWZ89LwUdd=xcgSTcMC-(xN(n<&q>4NZS5nq?$C zCgxdEFQQ(4^TkNTdC8i@Q6I)GCk-o|OPJx~5+-WA7+FNiYppa^voKXe`Q55lvqo=YM<3!wWbToMP|M?0*jG$C>!Qht=)*e-lajt}YI>rU|n-u?RgG z-_WzTjj4R#g~@=L@vh8+Q%H}M>w8&|D2R#pJE7?QMUQzlwp>W;IJ|HGP1@=SE1A)) zDW9l3)eT@6&VM27r`q6C56i~V!u7uy`~Q0NIBoyCwg2B#TKGU0M8Ub)UXO$5b#BsW zjme$<(c-JV(_Mq9@TkG}^xBkhw2l$lBQcg$KdcJh05LJCZ zuAiby$u8gSJ`?J%^x!qqu<|-r^X^uIXOTC&>e=F{+1EDRGcDf#P=t9@d4Ru9=jZF`_tL`=Ywa z(s~xu08||eri9F7Y2jax7n05fiwl&@G2nZPdtuCL1A2Erxt|LxZw$c?w{ZTF$v|up zfrM)?F5&M`L7_uH`37T`yJg#rGZC{kOXiJSY=uV$GCyjRwFbU^jXW`?XdJmDQ)1BQ zYUTMa`;zu8s(fo*o_8<%?P2G
n$_mz8AF=gbU+P&fHtIpZUlOn7`Bp2Q8)!Er|z*fa$0kZwK z&jZ;Qk6dI2&C_Rta2l5^(r^01%WnS(F;x-BqIcRE3|nWH7f;EuQaEIhe0TM_Jv?c5 z&n`ba34%)dS>(E%Zu_irK?}UTdSaHEgG(0aLHoRW)*Q5l?TgdS#nT|0!a=iF^@c~a z)=9LK@KdU9HYyU;mSG)o$}Q}igY8=w@Vjx1`sM_APM!)!QDvzL9GcyE zP$f>bp?j%tGT;^{aMZGNpKIDSB+9SgwJ5<*^*uJdNcDpP8U3X=5 zlpk$RRvUTP9a)9Ect5^3_~*45r!aeAFmtYs&BEQG1^iWyD^@Q)cJVT7@(Ioa|&9siQGBLrG1dUxFB?za)l-b5<5VCD0~$u zKegB0sp82sm#D0+$=GmB^L$K|AB#(xS-82AP651_gtE{Q<2$7fmhX21{CTdrGnILC zxTWjJPPYO6Wk{JqZX=U0^hu*q`5#1m+7ZD--Z+4Sm=jDwu#@}Qx59~d@T$c2tCV$5 ztCo?8%t;8RZ|64wa)i*Vw>*4m7=Zz#~!&>?P zI>)w~&XE$=5?%V%AG4y-h6+B5Uf;@_gaPu#Cjt@8yJ{VO&2~Fp@J~HhkB}Cx|2vyK z;dx~LuLt#7#{bLl*8X!NY0-O)#5%suV+#N*-)}I5FcXFfJ@{ayWi(|U2hs+fe=W18 zWi*=y@1lP-KyANTKs zqEiC~6+6J*@AzgdPOxPC*A9--{$Fc{``h=Q8%fN(n2&ci9`2&9;BqT!y~3H9;$j(# z`6hy~XM{J(m5kk{=-}3(l=Kl((*zN+)Jt_R(oIrPq#vTsf!?v-6|5vN~DgIyEKRDRNf7?h3Aqh#P zWZI}wqJQ&XI;8T{cx}^WlCu7L?dHjO+nhQN-NwT8Upv~bAEwU#wfa%*V7vY|kzTw| zqA>NCGwM?5AHPL5!AIu4c~twjBVXyD>DVL_7Aw(2xN>7TV^|TT4PMwl-UtU%X4h}I z|6dZ$UHJ3JwL*jZF|z`=TPnSU?o`A`9N_@)D%YhNR z8UHQe0bqdN1{l=M&mVVQgxIJXpX1zpnY*v%9?0ASHTO{F9;&%VGWUq)8sN8PU{6p8 z?Qj;rk2^0coeV(1H!H+!vYNG5Z0C=f{yNRfjfXCmv@`vNVXI@Y~?z|8!vs{DcCd)IcT^NwK ztjrPRdKiZ;Bm|rw@8sjoi$MHlPfO$w_RiUKnu_0-KJ>^0jp&@m@^AUgGyDKf5uq~> zM?ZGi+DL61rU%Bxh}BoEaWo2g*?s;&SwP9rmPjpA}NQY*;AHnCb(sy zwHGfyl9QE6*VorJ_6T-iiJk!fncz==va#jp)4HWTgy6R;0%`w^8;d|kQUTF9C^(hKlk z@-eAl0NT$R=;BW$zML8*09eH<0s|3N5qZFOE#v`q$lZ}q&FG=~dTE5sYuYP3MPUe? zf9x{oJveFrNx^Y)TxW#c%!DEG#susT2w8l`cW_R4<#XhrspYcVTQ~>A#y%tsv9}r> zW$)YxpymAMrvQa;_a$hKp%-ehh?=K9svGe4bmg*!B;mvgK>$ZEfSwHrusi@iBNDPe z$~+3C2%JoFB(4QWmmya^WgFnjSB6^K9GmQq1!dWH`3`A1H}oM{Uo48)D#;-I4|PuB z4vCR%Ssu870N>D_LkCP?0P{w=ZdNPeVYVR$Jjzhyty02IQMnx9@$MCo(f@c@>LfPe zQ#61ImBa@>z>YD4HM#JOTHHtWaGE*u*ug#*`$Qi*BRM`VQwx)$oD7ZqqwYDT)D{i% z+(G>)UDI<{0_h$opBD6?Cn6qskKBvOqFyLrF0=hee9ZQw5;@LdEV*PvoYdx=G|l9N zC%bDT`CPG zh=8f}I}W0-?*U|eWX8-6^aE&HA#?zNcQCMAK_R*+!~yleIVPcuvHuANw=T9E5Z%6j ziFHS}8R$`-Y1ttTpktOw&Cv+j6gG$1C>h|IJMEMHUl}`$kuX6I`mSX|hkHD^)&+~W zreFei%_DHqzOcCW*O9znfNP=AHC=35uJpXZ%=JaJL@QYf?Uao_gPARrd<3=v{~igmk9y8Oo-KSgilh&Oys@2>4CoQSP3H=NEZS>d;8U z$lnF@CqQ0^gW3x1%+x`?<9s!68%$N{FMc5FtOAaY#5vByVrh|FS7Sc6$V0leR zOu!woz;6nx`M6_Nl%I6j?(KC(V2)>CVmZL_<^YRZ4+3_O2~E|nT1E8_SJ57uDloKn zDOsuT5y$yweP!50qynw8j)uwx!sZx-li3YppDwEGf*smP_}QBJE_}(5b&x}M4Dj0+ z>V_%{L^B?wGKQg{{jkeu`I~Qr_GEqVmhZdsyaq(<684mPiXAC_YfA6(E}viZ2b8e1 z7=g;f`H?IfV?IN4L2|AE4t6Zh*#+jcHssDVJ>Bi?y}3g;X% z+wy>e2s>gi?m%}RO-G_xu(y{*h|yZ!o&C(*C|zqgH=kR3d(rWPLetB*l_JN6y}b{3 z2BtH@@uLHQLLCEPhu`ZIh3MjB7^&Ylan&yZ4=KAhqd4_CX1y?&{j~<%3G$p43_`*S zE`aGIOEP$pvmWH^(~L*%?J;ziG9q$|xwjWB@F{kfVC=#>%M1BolTJKED|zV|U9N8+ zN$mr38Af*X`*gy^&^4&UIT0F(T>|DIw5hc1wTt253hkmQhNe} z`40y2Bogcy&x0Q32O^Y(E1=L%oWU z9mai^SrW83r0_P`lzIWq(U^`Tn=9%q6rG7u&r271DCXWNx?>tFMCg7*Yq@Z2*>i9$ zCxtUq6^hX;DE(_m$%tQkVGFG+UD}l!;7hdh%0iYX3#W`P*_W^UKV|u7dU*}@C8A)t z0m{?4A%1grTS_@bQd*`~-#<7!I)3$2wVY^ISXw2TjgI=XV*EpGUaqdUn1r;HUe~2o ziKj6wU;XLT@zLSIe!Z3{!~4YkG>~IVU;r~^SWJ{`&xg~wp~W{+q=`zAy3J8bDQX!F z@Jb%=q%fBvwo;C+yab_TF0EqF^tyf8xd6R>6Lfo>_su~Yyla18Urf_fK=EctkgC{f z_XeFeoffUwYyZ!yc7Kpt*~+h*SBE?Dqzk-2-KZ*e8uhjGmG3N9?6eLNntLXgdGM21 zz+&yPb@zrHw1k3LJ>s%D`a?i0%V#)fC5M?(R!s%&8wh;vE8h9X-X3c`*(l{L#181$ zfO8Vo56VwG3|#DuVGwOXChdUGP5}K?MSS;=(Y_}atf~o4&fkQ_H_Zv8I#mKymL0oO zXkMH&2baAM;L`+pV9FRO(}mK0{*$uJ2```Te{3Y*s0BHvF9Il??I|U%ffwmRMI~aCt z1N@omCKVrSc;kamv)iHN92i17WI7ioK%)>KFL^6&mQ=ym;~s;V%Dta%SKN2m*t3xf z$S;v zm!0OhFh_{>gt~^=MEjj!k4aQzai>nVoqDxaH)>U*cFeY?azC^}$X=*7z;E26q1bxL zZ6?jrN=?_rpQ7!o++_1Bs=!4pyWVKBzVOqLx^dHQE!N$>XZd7;L;cr*H75EmdYC7S zT6r+}R~=0LB@ZUC19St~yz*?Qsmu$=W^)VZTjt+{KlSWqg@EGI$B69GwLTq@Jt2jb z0Qe|Hg8{oWwb#+?TL~gGu*USWo{k>ZP5=sMzqNNg` ze+uW6-1dXXDgTW%kN|+U#I&Z?pV+fL5!1%g3LPTD3g{7t{%d_A4P;Fljej;bXJ|E(g$(hWH}C)<5>XkCr`>fj1eZv zOX~qC4l6SLOF%F;ud?WoMrdRK387E8Q3{j7_`;>rjlv-om8l^!L6D&tz=%rRNm)Is z#8#uCL_tHwcIX=15W$eQ=V|S>zEmm_NJG&apb$<;BcVz#xUrSVfpBS*NqZoXd=}k= ze>PL!)rccYPy*3mQkiC%$TJT~1T{9x1WzG7*)an@(c_AukC%a37-sQoD{2URKj~eO z*OdlKr5SQIU;Q9poiH$v*Dx|l`CX+6ZMl+{`ukZsyFOkz3#Vqo$jD>c|loJIg*usoj{M1 zfbNSHGlrL*(V1;L8_keO)I!)mjpg}j%o3ClV7*~dW$7_UERzv*0b2AzxHo6cGL=cUtG zR!$Aj&p+%~e?~hMGrcy9KW31{^LEPMFYwt4#solng28TtLA!r>)oZnfr@hOo?$3Pa zlbL)ok`o;n#4vIV0!JfR!sC+ zgt%FN!nt@Ju2bK!y>I3<$rXV?161P-)7Ad^rOm_Q|$CHRdHjCD$b3^8EtpdNZFNvL=G234V_T(n^_T=eNOA9GezFDDmy&7mL_$;*yvG76rkfO z{%j=Ayr-?MY)dvR+VmZR5a+tW{s=A4u>$9sA9i_#0Sl^BRz8<=VXIR&o|F1Rn+?4% zu-uwqZ%}(wipt4@jB*ZCCO<3IjXp6k@&tJ&U`I&K$P+U3E}a~S<)TO1TyH5Q2(^~- zOH7DVENZ&wufY!T=vi$SsD_QpD<+j@JM2~@IzsaE&F+xdZZfQujs_4*h$d7(<6zfFcgBHsulMGOa+f2VwMNVOZBoJpgSvs!&^9C zT0rxa#~dBPsfFD9&sxCNESwBy0n&V879%;|ST%7$9t=MpR(~4WFbIdUU;zT!Vkz^0 zWr{!L&j%dV1zN&Jq$XTgDXA%>tHuyD3{}Y$JugdrA?cu6-eB#155j z0z6Fzl2*AZPlCTP8=C0Vu1t)z^2~^q8V?AiQX=yPPOLk`U6!y2)8c57JVr6ir^fdB zdVwmRS-C7zz%R9{H%(Jf6K~M?dyvopi1QtPr64^Q@RtzxLFyV9p!=T9WJP(`y!a5$ zN^+ z(==B$&7THKO``{)cotL( z+q}U%JBx9m6k_a3fOwfv{Ia_&0rVlzi>I{?KlUJq5*-laQGrsHSLW0?4)oMx>Iysy z!THq#;|0f>|98O>mcUm2J28<4Lb=#x^a?SbQ#9% z4Gp_!auJEc*$lgCeRxYv_?3(^!7lRc+sw3wluZ#7--Pl=ft?W8;sOXkO~!LbWW0ESFA8Sy%(_&4v1xR0amREMpG~Frt_)VjuwJY&?DmV7J<*FToO93yNcKBFi)+b zdqx(h52Iig!F?n%wJuJToB-jx01QoiTQv{Zos`iQRk3FAMF8%OQOc?0ZhF}c-wTJ;`l8J(BxeWEn zWx1r@i0MYk#_|Yq{E%RA#K#kgLg>4kf-Vbph4TM-z+Ufi726>=8654T#fxxyik<}=3W%qNmL7yEqAm`8) zz1DHx>Yf7O*ggr7JCB6;MfVLnuYie}6Uy)2pubiB4edx(U&uJ2n{TY=5w_haMPG!c&VSr*;^2A+ zM1rY?X-BtcCw<#UHH>nZ%l4#PF4b44P&l|28dUSdYP1JuR=3qT8uYAYr+w6`qwT%g zLAAP#o+IC$2Xw|L&J+pXCNcl(#wKXW-kjP&E+DFvhEzke$6;Q7Z_isN(A~>*yUJk4pz~N zGmog|FrZUQVtYD6MqWo8g^!(+^HaEVehd-{dw2vExqWdwj#|ABgYzCmv;V$p_1mAs^}_VC0Cr&@`cU^^9vCs%>~?*_K0L|>3GXEzRAQ&doF!x>FJx!LRhGT6<2AxQ zyf#Z)Oi4M1$#v&csV8Y0t&G^yjKbi*!b?-UPhrth9GfuZl|QbT6HHJL28OSkLuBy| zOrZ1Z5HYK59uMVRQrd`aQLQ@lf+ZXhI9a`1)-)>E4O8-&jB^>|fQ49q=S5!Nl5KSM zu}M}jmf{!ws!=A#vI!Q`WvJBAD{f`!L^85Xf%$I1=}xW=&vdQ~BiACF({_PzcCEhE z1}BrF#xK1(dIh#lM%iLL!Kv#8N1QDI1tuJGm?&_uqA*CYGY8sgF zshAeQDx={n@~%DK8)J8+vSxjMfOFI&I%_%?q+@A704H07O0FP6}d<2Pi+cF3w zzq10+DDB^9&trZF9!GW%3-*M8J@uMRxGYZsa`N}Z{3V@IzQ$ELNqaem4zk^;cyw#K zu0b5fh(iN-S%L;4w?TaBaQA_oNQNZi2LpsN{8_lf%Xnq<)8FY? z&7$q@*jF~X#z7d^C0da~bi(N@3}^+W?MIl*!hi)jpq$NN&%77k@h65lW|3u=`=GzG zn_3o&5sZG<4q~p+#N@Gm=_r}G9jC5n}^al;D@f zBTFe)IA9APr=(m4m)~+Z^%pwb0dTlDyj> z>fnn}|GTCc$YNnFM5GY5Vk&B|5k`hR^UzK)Sh%QhqZ+bBVsWnQuPuj(is+zksC^)C9F1eG=x3I z!sQP$I}eR~dkpzHaLky!xOSlDXfX$-2PKtDLPf3P6P4|UbAhkuC=3*@7~TufP%>yK zsIN6&+_6=h{#?XjljeIY{=0BZ@?7#GQtV%NI*V`FR5nEWjI@z;)AIs_mz=kdZ_{NW zp_Dn87xa;9%@+hT^I?vtb4V;Fv0p6C8Q5nNYIzCB}iP1O-Ww4ahL}e|W-y zbc!0yKp%0G2~f?<-*d_uN#Y8nX~!WQ_l01#?8RiKeb%*32S=ULMyow|Z*{FV6`L~B z{J30fnRLaJ9oBljw$g zC{v!-je9A>^D*p*OT_NmMpM4mBY&)90GuKOeWa(wRYpw>YX*3)}eBIH&4!c zeXGl&7Zi)lTJyY1&n2)3TmR@EZtc*)II+*Y^Tl1e!9$;xH0``+b=m8J!N_f3S}X!^IR-DZ!hKa}n=r z58oiei0qpj_z~P8i4fxC;oZU|o zzq{i(=H)NSSbA3X{Bpe+@Qku=jX43V)zcG;|D_Ff%r-Kk(6G(o^r z0AidfTO)~C%x-jqTDDk^y(n6j$#30Bw)3EgMO}&p@0p=dNQr9GX5&G=Cr#tbmgYf& z^dZZ7g(2}fL@>^5-DOGRL9;sV#KM-#y&ErfCNk|`MqtiZJ4G@SQ&0pI@3}c==i0O3 zrAZuyKJvXQj4rHRClQE+^QplaFv+57?wk9S(k>eE%{AObICfA;H4iNj^N)x8&;Y** z;ZzLo&dmHXL*|&1yIH(ZgkeA&e$QbSgn}Z(f+NEiMd1|EIvl1*{IH1NA*zh*Ud;O` zi{rCk2wOf zwH=XkQ|8T^YOITZzj|HgldJFQNp@kquBY~eL`vV)V|%RE^{QDl_h0F9xV)28zri@d zgqVtLuwbs(dq%b12>i*Ry=;*O8}bjLdqiS*t#*%wx-L=T?RlNN=97@b1+97m5ZaXT`-^>^tFE9s zsyN5KRGukhbuf8zt9lL>ELbXpOuBVC%XC3|c#f#n%0S5Y#TGyj4z1FtAVx>Qr$9!R zwv*Wb{JNwL(Up@NajqzV3n#sP@fo^QUk-o-g&ZK~ z1jCiX4lO9DzE!Lw2ObOn-6N0&?$Pk#v)~vk{SI8INroQ!8G@#2sTW{E&Z6)##Xfo% zqf6|EH*{V^Er>Fa4Ly?qIP*QnCQXn@?vV%o4r`L8=F>|YQMm=2J2P$Nyya2?J&!Qq zkwtuO>ctrV>A+DLQcx&SuiriF=Fo;-*Y!mz;r$l{tXhV`3a+?bc&eoxtRl!P+-0x= zc5-JKjC`q+g~jTx0Qf}2t~_E`p!Q54&~!tVXss7Vc8tfFW1L4u)Vm?LD6^b@?6f=Q zvL%rXwR`^Jrpr&&oT-9Z@MzRv)^r>d?I{Z)N6181loXO_x>^>=;+qHKv0_OE zzzX4nKWV<_B5oa_9br9qRzgi?b_y@yJ)DamG<$w3 z=E|N~tq9)_g5%f=#zYo)0R$eBVyBuox1CQ??6nYll!mEiCDaiWaQ!PDBEv zV;kmzOUG09h#{a;3$`&IZ(RFCDga#ewF3ikH3h1 zlm;W(tX5rk&Gf$6ENL?TES_+C!PrP%wx+RqtTH58K7omrszJcOrS?-ZUzoLA6RqfW zBeh2~-dNvJ0Iat2rCNLwGoA{36Fnx?{_E`;DR7(VLlVRjneY;Lk5;UbrjOC6M62IR zmCEn$>2#<9_?swC1)w(8ngqPZs!O8XQyS6M)@f#T6npmidd&_TS~6y_s!!31Y~#&B z_mm$R1v`cAJEay}(JS!?vS3W`msx#OQ64Fds|?62M0O-?0FyP8Mj-`cPLjdLgI|cG zB72H(5mV%kwaC)Qi@jpgnD4a5}+4zw7g?GU1oU++tk96MfYfp3*O+z`$YgKbE z?<^Pn1zwgxLLI&SNJ+x?lsn$nFU_hUf;j09v=!&m6fV1Hp}#q^IYm<6)u(vMK)$T) zoqDVZyPHYs(UB-M_g)^*njjaV79B?t?n)WqM#2hjyRod2w0}yQEQk68wpazyCbEm# zd^1@?KzJfiLxOv>q#;{wc2mfk|6USDZg)>7aO8vEMBd1Uw6VA$zD z)WuF1I3C?GGG5ONJIqp*j#2~89FaGQk&9#OWJ&$8f){W0lya9C!4j6X=qReTG^HD2 zb_98DjE{C+ET#Jbi{l~@=XWK%s>V1WXco~~b^j`~kGN?kF{H+W&TQ^6m<|>EP`A7IU8hg{)_D-#>%cWO`k1joM*+7Gc74 z{Kt?y#a7b!-ho*&_l=sl_u70#>0Lco8S?4lQkI?Am)IA7UORB21L%4VZ{*yNcb$`B zL&b1uij7Qjk@rWh>q_noeOKqNtDC+}2ushd!=pmSpSu`+(u;CxXWMb!Cx?0VOLBZVjA9i)Z!z4y+>0grOvZ)DTN&#KOgdb4J zU{{|L95o=AfH;U~$;ag3315(;G+}J(rxIf^-gHj?IxQ-h3tQr`l6fk&dS*XuuytfN zi?VqRu6ZK*@3G?qmPx499OND=?dE{kMCi>2!#4gB2tHKEYkciw+WoJ`F<_&8L=bs` zNeSW=HoC#YYKA(MDMd%XHqIe6l%%C)xG|OCgP4ofd z8GEudL^cs_yU);37;MKps`9gCo#m`ty6-g?k<3229w(6I_7E5b$$?4IV3X$$+xU zogU3sQH)pt{++va)AcY>lLfHuv`>CP9*eCi-buoYq?)ul{j98>lYe)~AQQ?>4-be~ zqUrsX$J+~Z)Qx3{)PW*_=X9JBISL%cWgR}Pi$Jm}axSTIc_nexPAh~|+L(oI4){mt zLpiMzVJJsKU|W^_rEb++D5?NeU;<=LJ8E*C9QLG$U2A|@1i(W37wKj)YCMni&fkKo zK)5-1nX=-9)2U5QHRxI0R^tT3J81&o z9i3PotrL3K;mi40hvGr!ynozjwT}ny`~5S~OHZ~uwffywvo|>Fc22GSd+WS6Xm(Cc ztY)7UHLYH6z^g24!lch5Az2sJ7@Szgjpi@wfPCNS^|`sBYF72!I%l13U$6hImbP*{ zm2jHq62i9pYTvBwZLA9}HwsrXTx_qp|GLOBT+7t0?LpOtU7>iiAdo*JMn*MU{?~Kf zh=o%~$Z@?#1@D?sGhf1dFOcyP5Fa`Kfc2t{nDz=xmE{Z zwP6%5%-V|t2HkaQf}muGqxx&JYSvz<5PI*|hCn7bsvl4Y2ML6J#Ye+w$@N#~csL4pIQk%Yji*Qgpq|vtqR{OZs&TlvKu0lVoSIyeKS<|1`UcvKgvx1v2x*GZ6&57h3r;UHKPR~yV zjgynk&(;wf9fP;lyH3{{oOP{1uWz082EFqpW#fANfSx7UHa~Z|AKsmGejd=>$=mj= z?rE#t=(jp;z5e=OUu|d6qro~F^!jvSXd@0uum4T0*R}fHUj~gnox^@FskEomk^Quf zSHfFbckpwo|DGP2=VwQaz6A&8t`5_|mTu5$H=6y{M{982?zc|TBV1May#3y4ob=!S zLZ^_|Tn2CNRkfOHH?ri7H8&Fpy-`PD>v``@tlZM?pbM| z2$Mn@Ncsj^pq=-ZP5YK>CAlgy`&Xr&8hXQVh0$Q6LVR|W?3jL>-%ydEj>+h!}_&A|YWop{>EDAwAo#Ht1oX2#__hhjP3!Zx5 z11@2Mg=6{juDi3B49>@6+qvCfK$Ih-DMc^`3LX6TDSezp;S|RcJWnQ#M=M;vE6P}s ztw$LQ9Aja$K^Nch-k?x5OF91JGQh99G2lSH{>~r)w9%~rZ@#XH>`AoC1t-*elvE8g z*B)aEV;6){*}1d{E+r9kpj|HHuQkgFFyG8D$2-{AG{@U3l7DV{W(doA)2R^BszQb~ zzH1GCUadhau~Y# zr|L1CFWqZjIX5wmrd|NA9Qphpijz-~bubd2H>9!0aEX*+@+1Sf@!|>9Yy5CbknP0Y zHC5xEV0i0svV{Tl!AlPkw$p76nV=`w_TvfH`KU}5#mFATIN~V_!)!hm!LNECQsTw%AK6k zt?E_IAfHi$_V zMQ!29pq@TGO46>Fa( zQ2Gl%Mi93`)($<}!Qe{|5!4?ViQxGAwzJw*J za9;urlBM6T4Dlsl{~8YQhLz#i0aS;Tp+q~=CB7u44Q>!0@NI594%%zu=iZg8O(~n0@jky0on1Ii~U^No^M}zz8ByAk1)uP z!JHV_Cb3boORUB5}m)H(mJ90DY3nvNhi3v7GUdGF`a&1Qy-@B}&o!AYL98ciE zaey$kJaRfj(N(BT?HSzS8uXarYrSyDL-oZ6#07!{bEQM6r^ab1b^+9*ZkQKa!z}pM zBK$`YV#7?mA!43;T>2Ck?!Z#WBg65r9pI=`(D%w$%LPuWd5|9aka-ct*S={k;Mr=x zl9y&R?~(H&E*rfDUIer8!{A&{Px(f8v4bbj@bZCfqU#kv+UyZ=4zR~R0L}yQn4lwz z?SHSwz^i(Gx_7}Vd)nlQ@JgT?zZPDE{MgsBix8e9u%q_F_n&X@lLT?8bgjnGsbx-G za~#Igng3*cRIAnM!Tvt{U#(Wt|JSN7YOh}XP}@IvwO4ytt?j@1p<3Io)n5L9s!xW& zlAk$=?dXT?^XJAsn zI-s^-i~=6FQ44qo8R()PqCNA==bh(qXzUqZlF}EV^o3fwFG}~-(wCz2rCNF*N)KqM zfi4=6Gx1{V#PbM$-g#~-f3neK$CVxtz@-X##u}H7QsM6E;Vt#liB2FCi}tKI z-GWCG&P~Le0ARJ$d_;z<#o=+ikG*bWZxBE4|bYmx*AC=2Bv-Y?D zD3>*Z<$WxdUzo4WDlO6e`~UdA|KI=Te^>w2-k=`bwTV!;2j-p(kLwWx4*^RlwALeB zR4#{se_Jj?zSU+ci4r!BrTpoaXNZ!s<-FQQJRx2=Jq0!@CH#fwiD`OU{}n7 zr)DFiuuZC@QobFBGtVKFq+W$BV2XpLazfV2Ww;E4T$e8(N!)w}vBX_S&B-%$rbDXA zEP6cKn5Lx?a>}%hkUVW6^tSdK{inzh1o`~9hPjXh@|#2?2I!kcC5Fb|HZt)y%`^G< z=)-@?#FY6#+2QNA2+W>j1#G#n8Ul}HL6?hjLwo7q!UQ5Q98|59oJ}%br z_TAma(cT{(wnbvhHcQi)8Hw^~$ykb_Hh+uJEQ#LCMxz9nUK~&A_8fYYm7$V^v7Y=H3JRP zIg)@qCP$%*@pFqjG)wie(%cU) z7i+1)>P)bxTY@_H^dsT|n0LT!^D`F~)gIwFo3P z%j_7(M(&3a%;g2RyloENp3VH*q7L|@Pk2)|4c$zFUbS|K4H=S>*se>f5v&l-Hd(sH zj6$+0j!&GUKw#({2NIfH#AS z1CdlvE-xYkb1kkIWuE&S&dq46T$btzg_bY#R@PA?%H?0eIhxK1!;db67w0h$P=<$@ z8KRpLFjBv<$yL8_JcKOYkhyL0nDx>GIKv!pM_%AIaTN39t4m6!pfaMt~Ta~gPL zxeVxlaY8zmmdkR3PeT_3WglPLLClm-N_ZE!>HgE!2)dIaQp!K4Q-L;zsFIXOG*YD^ zjAyD)37k0uO95LLG4huMBX`2!8XSCw=0f15A#=Mdmwk`K%%o8+yPgx%J@bZ6rre$U zEaeQWE){7dxjh9-|3`?zX1^h1aJ`CtWkhvN1uk2w!{QocOm%=JjE6tn;w-5CYyX#yFtT12(8WVX)yDBhSafe7U?_7Lqp{ z5+bn!_xWwPL(b1KDk6l?N}mY;^BI6Vl7c+|UEr_4D;A5hY?tCT4X<;cwA{k)SNN8s z;ODX6g0^|bMFkCu*!}{ToY|`=#c?urnKX!l=1L0d6G-YgI)w~qj8@cJDN2dL?n^g$ z%xUk~y9SGvN8mNZM83@)3Zifas)12bf%axaP026rV58|GiLPEpcXI0`0lX0l0|8$i z*nc`7@ER@Pi=08dj`ZoR@IeP&qAT@aN@<L$qh!eqk zCEz454$4o05cy#+hHQ515HjfixOD>MUtJ`35ewG%^oCU}!)f|WS%9;gK$ukpP-WY} z9Ydpi)aZA*zo4554%SI2`7C3oUAh6$b0n;=3l`C(n@erTrL}Uo9mZ7WLH$WMA5V}+ zlypDm;{z<|BBr2WXvD0H`uUgwPYE`553XUhe7uzwWdql6J z3!oEmzUmf8^R!XJ_rn``oaqgqFWG>JTFzd*0b^m>k$P~`Z_LB97uYj03FG{)eS1vu zzvRO_g4rs9$-d^nWM7J45-0L5G0;`u;GD*+g6OueLVnNeo5+-~@L8Ea{^_%vc9H0t zu1J|np&CM;g=o-+TT~mgzX)S~1W@_AX436kOfKLS&YxQZp^L#TY>cCDK4a<`rMoEf zal*j33Z8JVr+H_nApxb1cvVe9^jF5jvQLQWNPRY^X$$uvDFjnK`x-*3`CHzS^SX+e zTtn(#b#(EWP57RP&TK*;Ac5!59qqC(W^l_TrKp0JhLwU>hurR;*E;jWtg__E+3-)l zRJ4x7XM@M0tdnF8`86>I`lyGRSx`CN6UzNF+^82+=AXGKOa66*Z|gZD-r#j30LiTT zqei~aXCB1W6R@novPpoA^THHKngnBkE5hPqH0{Fwrzh=YT&U=+1{K#*4;$*qlIA~; zfbUF<;6j~ju->B$HkRaXVTi?7#I&dOZ((5H5Yq{#6}m)*9Z?mC{%hZmx@S-8^`9Ee zX6L-!AGD6%)M=&4Pp!u3pxZgI2JObF^+p$h=5v(i<*8}E@cSm)by~X4!jsoNj+ssFqrd|$$&6v6r??r z`kC4Bq|Sv^GxMGG(_RN9B$Y{p%(6)go^%pmvCjbe$|Rg(s@Z|VA0Kf=vB%qPC-84M zW(l>e>lpoY(z_zBD;;WDH-s>u@bXg_Tb2pyMeoh&mV%WVrUiOoVw39Hkr%ihvs{Ns z_(#cI8EtZgqfr=5b4CDe+pJBCu-&S&d4)12^%F(x*H1ks3Q0JM&1N{A%_%qvqe53D zQ5TA8fhXnaY79dV7(O#Z;OL;rY!7@oDMosQ%rE6QN#&SH?! z%&8m@WuZ7Q=A;6LOvSz;l{vu%hhPW@CC0!!f@~OL5=`!Deo3dnL~xZO>gUy*2QH3$ zcu@l4?ko&_!8X-FQr=1#Z%k)G`0ZUXr-h=#IVsOM`~`wU0k1!@-nH7Teycrr*E+Ed zSCX@6oLQj5tsVO}c~XHZwqg7_$I&g)Jy%Ef=!+eV3Bt}KL?wxV)$5#ho7UjC+c`fw zWJ{keWQUPx(D=}U0$x@8DZig|nh=GGqjN<#Dr2;j28)aUZHeX*RVr%m#E%KO65Dp? z$m(U#J3MU;w(inp4}+~c0h<0Uka|!74SH7hW2=d=$&W2 zgR^fQG{`x@Q5{v20vMnu86|(Jva%FzrOd0L-3>-^A&!&&Hu<6ARHWMO(?<+nwA6UpFF zFPhdB4~G2AVz~;;9-HfiJN1I0Dm#30D@{hh_+3>cUV*MF|Fxdhc^?~P1X?E%OzKEi zKI?_B7h=UMQQ90F#F6dS4Ci;W9%-`PV&-F&_@UbRSyWToB_C~bv#pexsEv$Y#qn~6 zXvYhvu2w>-W8>oj?F`Wl+=@sQlIb_4e>M6ae$x$*hPOcoB5q5{u2db}ON~wOlVI@> zkVy11;DVoO6`w^R6+8wWcpjuL)%98AUE47pT;bc56>`2hzK4T&fTyHb86E1C( zwiMD`WAGM+YUGm7%`zXEF7dCxP5(+3(Z4*K`>We$J$q`7uP`O3u`|o=m^%9DxYuAB z?SKAs*6sY4)dT~r3GH}ov4fm&`Y*A86btjRr~m~9=iIt7kkq2F*+h*+BXf>@nWG{> z=3AB7(}TpW%(Gaq0^u`$-0HtSe>>=RK3Hu&N1#-`i^6F=V?I{7EBoR66?|yqD_-#f ztd$kYxy*@(plPYXOFXf!Jr=?Q;wOhPiIt*8v5?b?zSqMgrhM>nS!IA<=~r)>reY@k z9i6}XDH{OS@7OB^5y^nPg!meyhRA@l?{>;~*J%HeP$i#W{z?tIlEv)scl{+(dy4}+ z^5Qyrhi`C%&OVY|s=UvA?l6e_@CGv4k(ih~CWIZ_=5$RtH}3JBgBR6M|!QtK$fB(<_lg#YtfB(<_i!DYNPjHkB zT3vYnMi*2eBv?u?(t|J9#2Zf}u|DYxq$^!UcHm3~LBT#0Q2iv5dlHky_=1|}rQ9d+U22(h>ABX)w9(Z!kQqc^c5>~e@JT?i#~=D6q1 z;nvBBLnRVLQs+6D*pcw#y9uK!z{0r1@eRfSORCGV?Uc~YPV*u%)>1%SX7);bJz2Ln@^bjG8A>ly0147hQ%idqcx6np{NUa5lrPTA!yy zWLGlI1iQ$$Z!^;#QZ_|Ud=tte1$IJUk5el^fy^R&O*vXPkBx9-un#zjLMl|0(K$(u zU9rOS^j^e9I3SkM1z5Ev7)`wZ61ON_&XhfiV9pojZ{=#MYl>ro_X44$82-j6j0{_@ zJzLw7ru9R*hEd4wXdxH{Jt8h|5%_${C86`Wt9Z>0^VBN3XJmo;FbZ}N+($A~>*7?& z2@uW;z|hpURr7#N4&i%@>Nskjun4Q1F@uuuA2!@Z>0$;lS9j-u8CUanq`>TU}Vj5@2$o zgiGEGjd|?(q;lzpmtw*|uNHx=EB>{J31*Usf^4}A^~zM#{$W2y*<8$dI=2 zgrX4oE~lW(>S|iKd^V3DEq%F+*vm0GFH{1fGvh9<8Cxc~c4g$jd8@__Q$297ynzsF zN;`cY-XIUOM?yPpF%Z~xCbAl3uIzq}Ht4g%2IL&tqSrd^TisJ29NQ-$a_5l{zv#Y! z=M^w9b3*yu8}zs8zo8weYFzrbMBxheaS0e%idykeYIZC+5I-Ra)?WqQYgK z?I+>bb13u+8Ao*UjrBajwmYTh%ZRnPkNZs=Tn~XrFx4>a=oamyZyTwGQ7&`Yo|Ma_ z`U({a2iHP_YMxk)_TbFwwmL_Hp4IHMk9u{qy;nP^R=3e}4fypA{uA3G=Kr*P@~7$g+- z@CYn&`{H;UwR#^0=RJyM|9#i$z3-e*G^*z7h3RJj?ZQCxq3*#vFk-UV?fQm&c$5ti z-b+5H#7>bpOUO!I$j*qXEPG?eYlMAxZI-r}l5!4{>&~fCPtrD88L_7sg~5M?m!^21 z!lI`*Het#ue_S&sn4lmGjC9!kg*z~T&a*?rthRYPly^yKBf3Sk>eLICa7f@}^>SI$ zs9-lt$!9X|WsCzBVnO6YBHQTfW0S06EX6PURijLfWfLr>%TTGKSKP|diDYD(0`uL1 z)16!$CklgqhL_4PaxKC+Z5J44*Xmnsa56b+{L-tVS77U8lr7d1oVsps#Mu&1V8Stn zX%Itco}tJ8ehHYSB=?iN{0V)GUpQP`(jy3_~HriqBY3JoK#F;7W^2B&7?;1TJ$EjSV1I^_1 zfjzDx(T(C2+&$H_pM|4V_OW9U{fG`Fuw(BU(bGK+p(sr488h3&A$;UxPUDC@Fqp9p!-)4+ z*pa54vCC&PRPS8i#nDa}mC#V}R2il-;XQ6K@~(93$eGj`iW$WHtpN0I<}4m%}$$2dsbIoH|DY%xt()+%JVct zh_M4aP8IVJB;IYyAdvjd3P7W@f1^E*`5|~5*+DGW69)FwYc}DsJPF9j-xu?jbV~Ue zSLr0}ba0XyxRz+N1ovJqs6E=`j` z0F@NcX3=*ckNPzZ!oV)kiX5U7PG@02D==+8!ekZ(EYJbvYz}+oz4(ql zG1M`OEW6wX{hjAYg;XGe4Asz1AkG+|%P$+sI-cT`rR~*RMiDNMi)VL1pjSY@ccdig)i4j-1Y=Do33^Wjm zI0>v>V)&W)b__2_e0+_4`HnytZiO(Dep7eSr2w4Q%6I_0@{ zjhSx;DZwv|N0w5qaKIKoPD!~8F2Ch+>b($nsB3HwzGtb;+0IaCTFg6$=`izrx_gaN z3thb?$-@nzj=mW8ziXNy61j;`A#BN1++Zh+414CGono+ZFO{hLvlx8lo2^XZUoTHu zXJpSjdVDZllDWRIVeTJzaG({d|Gw-{Mt#}A2w^puVHUrI? z3&4^n$XN-%h+k(ZnP$0WzZvl2R$5uotM`ywKh z>IvoQ3sH>tHyOg6u3#nt)1#czRwH@D153i{ZTx4JCt?lKNWn z#XVca@y}%}HffM#FC0nVB+n&3BEge3aDba&9P`9kt%Qv$|HhpOVnPth=s^*5V;G z9h+bon~b9lp~UA31@a!Y2^xMle`_^6?RTx?A&VWZb~t1r-H;Du$}_!jKV^78h8=N@ zn9jfY$BG8vTOa}*vGCwCkB6_SgZO6J^LP?Q-ft|V+SP0D3%;&t2wi!BTSrvl(-4~C z*mmvMPQ*R+_={L2MGmY((h|KWFNrSmlK5DftL&M_-jmkRg|2^=ArJ)m=t8HeqP~mt z865+OaS$^N-SKU2n)`)FK-W0B1R#`2(yBLh>`dq{V+?=uJfakc_`+Yyf6l{@@Q_u~ z*v=*|A90S1jB@oPNTrukS+ritwSM*TaRxCbaQr=X88@V=M34BU*dciTAsx8I5-vd$ z>ZPc^kmAXlnJem$P_AI|zwv~p)}0EokD5`%ef_cXntSJ%eqfM&VYFf*VtB8z6ojF8 z)-$nUKFesBh0hPT?a5BF`;o^j&t!sqUu!o`t=?IqX&ox(eDmbI*SESX&Oxz!tu@cP z^!x(bvGtGs;nofvj1&9Zk6+x%8$3vANz=}IR+qg)7<_D;oLfp8BT(g-G0Q|A;kdGF zDUlH#jzdGFOF87pqfAN;ET%P23x)2%S>RwF8HS4~$Wnqo8}B0i*B-t>h7s8}1^q;D z^CSX~lZS`9J8y*WuZU%q*0;B}x9&32^sv3XtwYvVFL3b}*;)pc)*&Y>4qW*kjG!df zrP=rjRJlaH0#()%M^(SO19eQ`%S9F4!Swj{94b6=))L z%$Rys_v2SB!3N`^Tb{QwS%77A=F@nJ$Qi~AWoZ~?78qrEL&>_K^l*{7)5I=sihT<+ z!Dd13TA>Iyc8q@d30a+Y=ndLZ!5B$1EyFk&+ho_)T4rz7(bk;`=0OugO$8~&$+9() z=*R4CNa%Nq_1N2_bq|HDJIR(FG_kNt(cnEZGzzIwZQ5)+$d{>UoY~SmXpo3xS+6i8 zej5o^o~^qqX*_6F=bc#Ca=CZo#m+<~6wCSpi(o_-oX3E3(D^L9(b?6no zg%}{YR5p~mn6sheiA3r94Z-&t0*>kTtAW4l)xe`B>@RsYu#;Z!@7Dx>&T9gK@dlR! zns#?5#T2BoM8&)!bkSq^HFRX6hlkwSY|bOQK~ zYV}}$AO5datJ(i+2L~^IsO=xT+N-^+*7jfhP^}%*s(U}6>XVFc#m}6?cJxE_tNY3h z?l1E5{8{DF3o4g3nP?h>kY!1@bpA)GkW$TNJc)CrTe=wPUN@2d%ZPR+FW& zV)wk=Z=G7Hs#|wzX&R>5Zvr#ZFAv|(VTyj0Qd$3~)jrBpM_YH02-Y9UUGb zor*y^`urmVCFZ`$0tNmmF2dP4MECbX_r*-`$Z1AyiLtcl$W!nH$!}p2I4Jm-UU3O0 z0l{rH9EdQTz>Sy?`x859Vkk$3pMC)41!3oou)-EOB_M_V-rK!?A0F{)7lo{}-G$Z8oF>7Ve$ zi@j;9{jP%y!+3+XYM<~$b*le}9yA<9imdcpAYD@^iw5fX7|-Boeuzfi7Zz1Sgrg+%Bg*sw-$tI`u`sA)c-B8!eNBUB zdt&c9gxo%!^R{ealWm?5;?3{ zzea#=!su$`hc_rcNh{i`z1Xkqz1TPR_g>WaZ?(Ps7xXtx(<#k7M~!Gqw3~_NW4ahy zHFWsDq5uDmu@l@+O817bBgb{09@BmPc-|Z>`c$GAot9 zVK+5{rq%5an(YmMC3BJw)cQxi+Zgm3?cN%|F|i$um!s!sW|J7%(RdCw^I^nhS93$E z@d^RwaO09)tGxS zb1k8$Cu^_V^3@G)nR(E<)``{V(Xafsx{;i{51Mw=>K<z|&{!b&`y zDTWM=X6ommt$Lk*;YO9I%pR|B4JU zzx*fCD>;LC(2)_~8^jbVwaYXT&0ZI+hk!#OK;YPFTir(AVjJarfWLkRQ#MV>P-4L4W76Q|_Jj3La zyH9$Af9)~9x`q#N`9A4&^hwVF`bpnKpLB;rq6VGRPda+g(HpdN$9CKUFx^3ff8_zL z5sIeB7+td(Ih^hx^+oW?2Usl1-+TQ=|Gam&wc}9b+_*vp>75|MMgLjQCog7o-zfn3f7kyyv)|oCwcA~VLradI9f79;|6X2+Z`3c z29yFGwpA-bC3BiRARtw?L_KdDfUOsU)JNsJSlm9n@AuF6{0y3%BkOQWnX!br)KV&9 z?^UZA={cn}G+9UhFgL3#jmsXKVn+qjkP*w#^tzy8Zm9_}xoGRy@#<n$PyV)LV{bUducX;gzd;M!fPBsHaNN^jDj)x_9gaHm4&(KE^nL< zOYCR`J*2I3xs#VQu%Wbt4PEGoFR=dk;bHsxwa=gCXTkpG1z!A=mp`lTfA*^{US;fm zFZXNT?|*)mpU2<-taba7d-nrUEcYd@^J;2Yx?-Y4ClwR9SXAx&+~)3*N!Ll)l53}e zOQ+1;5L8@tGsF%VW~Jxmc`(^2_W+!skC1_W`pN3N)6mL?AIw*=GqZo47d_ibqqXR1 zoS84E0H=j?lFU5{>ioiq8z==Am$8T>BZq?UCcsfw`f({wz~u1k*^IC^LrA{IVR-@- zC(L?!)%cgW=O!P{TSv5<#E}<_kK|;)#4G+=(qp;CT$Hs3O_Kl))3;0fNn@((l<&vF zEYjneiup4;o*Zu9nPOqgx#vD?mpE;V!oPKR1#EK zH$`wsf$Dq0uHPV=0(Uuu{F1PEu3i9zinUd3Z+yI!|Va}yvqRC=NlR0eJPkO$K>L;D*D!G)G2)r;G z%ci~tLt6hjId{Z4H_O^{#3mDJps6>WfPW!4Z|x#4kb!;)MqbR)fL~&M)sp19b!^|) zx)vzN5=r54#RyKww9I6gy8IQN=zbH!5%p3$KV5U#-V+ts#IIeQqb%LOM7eO3;z*_M zz(pl;<;|pnB}{+iJkl( zs&Ag?CI7S$chT9clXsZAA!I<|oI!mmAel(!eEXxtlkY#@_-8@>kFXO4j_2d2Qvz1V z|9gA;S^589zxLw0{QrCWY~ufws{Xc8>w zulx2kRmdfezBk3CZS)4grLbVo@H$9QI4OG0bdiq1vX`gQNc0rcWZxnH#>Yim=bl^I zP8#BC+eh2*MEycnk<&k;L*$3HJ0Nkiqc0$@ODKyvGjlBXquJ#5pYK24f4=|x%l-U+ Q0RRC1|8}~;=>R$e06&@!-~a#s literal 0 HcmV?d00001 diff --git a/assets/confluent/confluent-for-kubernetes-0.1033.33.tgz b/assets/confluent/confluent-for-kubernetes-0.1033.33.tgz new file mode 100644 index 0000000000000000000000000000000000000000..43273bb2bc8b08af7b970e249530ef88265373a6 GIT binary patch literal 369990 zcmYhiV{m587w#Qv;@t5a+sVYXZQC{{nAo;$+n(6AZD-=V^Zd_SbYjcVQvk^9Iv2CUP)f_Z2|kf`vXSz))ig0Yl!5i0X@+1dBKoeX+CA6wUz?E1Z{KHZJ)UMKF{ zo%U|-ybkG4Ha0d4myzd&5rAPzBOF4%Ha6mz{;ail47X(B@W||s4YOwK zpyD)iM+@q;e&S}4hY879?Cohnyr#{jd%Qevg-||@;8;x)#&G^&Drf*>3FKG@7fF5j zZv0gTD&Prh%+Q9Jk&pr>wPt*TmF$avfK!rEoNRRj7R(G%<%;62z1+aNyX*A;d%W8n zccc&4<8fZU5u%j-s5OALy?#e#V|I3$etq9RMdp0(h-jQ1}Cy|686)l0q5T zC<09G^aK9>Oab7)IRwACPYDLpBZ*T0euOodm5$gKd0L^iZv;kZb9P~g4rx*+P8kb}H-h9e% zgWr5xMtq+x(Z@Tw2tSy?8lwo6ASx0jbBqR~bc_a;(RgWk!$T70y(}+Fvp%qgj3o1s zEd*(P1CukzQv2m4=)jm19kPhyegfq|!i7Zoqk<^GOyDU4@;$ukYBADt&N4xPq{s`P z#_?sLwgD_L$i@YS*im~B!O;7!$U{a7LQJFZl7?XmfH6_ilScJrqKI&dhbzF?lF#jP zHkGnl1gJzj>%(s>L`HPf)NPZ#J1hq#oFOgMJ8C4X{IE@G)F_b?MatrzX-+@W7ST|K z^GmR0u)&Za6vsIVekV{W1;;X(0v&jSL1Knz7T{$=ZFrt`ei^`%gj8)4Ty7+T37W1k zj_mGhsFJ`W*XxiuM-;~|VfO`oFbg_RiqgWU#y^LiXAUb}q$zh`-M3U1lm>qfeoH$rWln;IP>vpL7#ng^+ z6q?bGHxlYF{oI#{SDAc5Db~uU6zP0K$IH*f`F6JOSKMBHCYDD_TGY5l+*l~y@>069 z9`l_-rmh+Vj1eBeK7yFSZ=4|ZIDzDpT-(O5%&k1*nzi=eGx3LNoN?#pXxzSFLw5cq zvz;R#KwuQJfL-|3Kgfdz)82zVK#?aM1~J0rV5mlNxI$s*Qg#Mu8ot+b&5iIqJc5@+ z#e~t!%spx2;0|66Sz?}Ye!>qtlET~)pnG`Pmmo)#VK7`CCu%KM)6sRHk(F#ZI8;I& zxtT~(#kUPk1Y3imI${ukI#8#fl!6s?V9+T>4%JX?PCC%_3uop50m?o1 znYp!1{qhuJ$~R(yLNST(Vzrf*Xp2A1f+ju)Pns-FLXewZgHf#iq##uh%{mU?;z-cO z1V;%FQWJ>Z#UsVo-;ILFVF_j;WJ1l3b^u|2?6pC#Id~s zCL|>!*TH05k=Apeq?rCS`GWtl!H*O278SG$v}}&iU;>zO;e!zK3`*fZ5K7GR-g=pv zlYeLAr|YoRy6b!QIgx!P5UY)LYEQrKKV>3m(8HmE#hk*AL=4JM!p{;40umLP`n~>| z-<`|!vjz0`!j^%j*w`Nkep~8qd6nuxv$q3-PONv#vw(-3LL%tSytM~A1FXB z4n3i~mq?+B-2n1V@&sYhj-(uMFeb_jv<*JuxEIW&c!{2a z&{v|-v$jS{z%57IJtrx);*%8wKMc)?2<@rpR9BVo1h(mM|HrrO?lAn!GfaqzHK-!i zbB8U~SJJR3XFTT0U-m(bS9Q_~$tDMxSEVA;DOopu8Dq|z9w&aZn3UjVO`O1o z-1sf~ONj22>7AL(k{I);##?B?BiF~oNEDEp9ru!jTr;uoXIbf&taDXsiJ2#iSZ+H{ zjxvx~%?G`JDMk^75VMmwY!)HnQ1Fc|AH=khIAXNgAWzVltd$fU_jirdt-WHD*PB${kIDwhSPaX^5h(E@TB4iPzTK4tso z{RN@J*XNhN%AAa%%>_e?lr1PSsY;bB6(V{O5fh74z*Q^Jcu8j~Ebpq$fSX4UnM}%|UiR14D>@!+teVhbCHaYDvX1 zlz2>nl2NseFJsS0lFpEm3NoR+-XHVFqZ-rK>K4FEA(uKk#Gnd!Dh9UYv!b>`F)y&6 z&@u)A?aJq7O%d8P+`sWDdmzwwy2Kvrd;MWk))znOsnxp`d!HtP5@sF@r3&qP6zTQ-~QX6$Xt^mlk`{c+ViCEA!Kce1GaX3%>R>`$O0k)5#USi>(*-eF@9)OnbyDTWDhd!fVEOu#~~je zcgJrOd)XpJkAxN!G!h8fc@avXT?p0@6z7ThuiBq91mtT~q!WV;6%@)Ws_8sJzgEN- zWGs(_sZNJ$mF~ZH>8&A)V4DGlKEzRrnfobgM4e+J0#oVQb7w82Mp-L04Mbu&+Lk;? z`A5z6kKQ8-zQoz7WhbEp5~9XMJ-CPZSyr4UwvhdQPnucM_FzsC5cx(b=)CDPOnS>> z{!r3ClJ)x-3N-aC7a?-{bY< z1P+3KR%oZ{dgaVcYT`V>X3iZz0!SvuTNvmlD>WG*d7Xv7qmn9Cpiuk3U){v00)e(^ zq>r@uJYLcF`yA<5q0M7N5sKp?2hGzeLd-ahMd&wN@)yk!ZMX*5`A@9$u5AU6zJ>}X zDUil;X(zm@+V40_as&itZbyQ}yB2#1N`FzN6NUe%7)g-OjXSeDY~47|McTJ6S?SMN zL5Xt|+WQ0OYjI7SbkwP#ftmK@iF4LqLkjNbe{*n9ezDFAo+UKRnuIzp<{Tg=BX>g< zjP)Lmvyt85?WjjeLD(H!|`eK9F}#n3wNQ+65WoZQ3mC z;@&UPuF&A=uon*7v9N0T9y7g8T$m{QLBvO^B_8>CGF_=|`aV;;)8(n3-|I_wqm?*(Ynuv;*n}gq*o-|FHRL=ZOOe&`RLQ+3WG-I`(xlG<~uC^=>!c`_=r3-qzp9>j}UkNi*5)x7a?bi%pPR{w1e6pIGZ=0OK(ISlb zpfbNB5xy`tXp>9MuYT%g_+pkQdJbP?g9;QgU3|DCFOpM7Dm_Pul2ML+h< z;HKa0v2^q89xv4;uJ@7F-PaL}tPPgGt107Qh^vsQIMdJkFuR=12R%a$-?f zeQ>UNeqGc;R;85r!6@^Q0lt;7`SrgQE7a}W5OM*wlucJF`s_81z-!Pu_37D$krX`+ z?SbB}4klq>NZeqzPC6Mjp-cjAKO}D(%`6WZx#SqJ;F&@S9pp&VAcq1O`rnRW`=;tG z0~Q9~VkGS;0yFW7?v7#V>|KCpBT=TEbjij#|5S!6G;_jgqF}dE6zwPjZ>36H>;v&* z-#m*FOw%Ql9Q-8+>6-;Rt>G3NhAjB)V`V9>fQ>xKg1ErFw9TFT8?A-Z&F$xGKsSvG7W!;B9O&R{rd}689S)~L1ipjdd$b3R-FtF zj29;@%MfzmHaFwH3dF1DHPT3{)_I1B#1B}EB5H=9H)wyORCrDj$*c3h=g>{ly<2N3 zPzi6NBuOb~ePhe0#5&v7&KF2s*?rQ;5|`sKd~D+%V2QothW%u=o%&V%tTB_7Em5C* zf*Zob=JN%-T$T&`jf`Vu%-@ZzLPe@6R6eCPDD&V7uG?4>^L1Ln<)L;~QJb9bNQN0h z5j{107eqY#$Y|=fwd7rWVQpuqRjn6mm@KNUWvbZrr)m;GD}?3kX(jqnt=Xlw__y%- zeJUiW;NGwS<83Nd#k*hc8Gn?lU*1W7o}=_iXWM?|a+B(E2IJze?7Cg=AAG3=Egxra z5};7bL3mAs|w?h2MU$ecU0i`*G zcY41VOyg5hr2mS_`#g-NxcumLMO}r#h#{Mk6j{;rcT8grYFPc&!S6{)IGVb@PCXyg zsJJ5b={Y7Xs`Oo=>%8Ww?dm9Q^dR_5Q8skkE{(b(`qs>$!gzpM+W$UVs?5ebde6mV z`1KykEvYp7PI}k@FI=BKW1dAK%#M5fOBwWclrwFc>a;^+1NfRYhzx3q^ZTI9`IF99 zOgj%qx-?%Tf|NU~Fd{{@Q1DPtW;>&_LS7aFRxG%h=5aoCtmS4Mjw>vNuf1&Gv7&9! zG_f!xtE@!02_kc%0-%ahD_m2;~_MWwOwn7u3f&8a(Yy;aXq8_l`FY3;! z-cR-yGBO}Kv(`Y7grfhO7ZF!j_bd!u%cRKo1j~vqhMOQ+EbMmh08T+Y*nWnoq28Hu zKQoK;3-DuG#p?Il%tL|GWe;-hsQw-;*wN*B3*-mxE{6ycwBKZJZB#>{*N<|$=Dgqf zwQK`kx|SoE&u$uzY`cc<#DYiF2Gx~Qb-fIxe+#8U3|n01U5u(jL9yVAI>YV1pBR*@ zKQ?gO<44*u>l)IAi3C+AZ&(kQNZ-ox-wGihda3fM$H zDs-lb%#^Cx$~NP4;yiCOkx{5ffXaYde~Jx_pGgB1CZJfPzfhiz7l}v=#A=kJF8sb+qk6Sn z?!n24-yT!^gdd*(=(Enx!SQ)Y?nNf4(;tNKHp3A)_(ZPMaz9 z%|ik~J`W#49qM+?W}i|7%1+1Axzgf`*Yk5@S^C#h=EP&MP_CVBImg1~Vs^)P>N!H7 zV>$ScGrTC;<7?n!RqHD|-z7G9~b}Iw;vCmeoHfbvvc;HS8*-t2i<#&_+FI2z z_i@Cv@gS-y%jUNqi&R~uFd?OmEHfYYwN__U9!r~tdPi#YI#{PYDi|7M(agP``|OkE zmU2s;TG}FMH^bAQn^|H z@*8Q_6JRkm&>z7d;9|D zGSw*&7om|LPG(Er4*S2Gz3V(EZ`r=S-$d8GSEetv*m=KuBNzKtkHY?Ded@)zHs_OZ z_fw$?P2~>&DNC{_z>hw6U@qrT?=EV4zl_QI(d58Tuly&#jm1WYvI%|FCM#ND*jpNp zWz@^st|in|s9Ks!tAhso3t$KwjnTRG0gG%_mkl%cE8E92-%ocA{=|5KvJ3wE1obq{Z3NNb_W@ z`kS5^D%i+#mtBY(W%nd9$H!;qCLT7pg#Z!&Q569Xm)j0SfHRhJ!OohC=Xi}+`;JYIq_dkxE{?W4Nv(^5y}GF#55f=}jINMMQ& z>6$#ZF#ptNd4Pvk1`?}&0qPm-3DHc@^6ZZ5_J!~XpA4KQ?x=s7Ph%a;DNP-!gGDX?zttLr%?rAzhqdq|siD;08&%fTD z?zWAnGdVHVy1u3|=FWS{Ild1Rb^0qPG?0_|xOrI99-h_LtSq1lH9B@S-nmE!g>lN{g=Jcob@w6|2shcotTG%f8Aa`Xu}MHt`|qWjM{$j8;Zqbqq*@T z(d{qp-b==-4m8)(ztp0;TMzyFw|Do#h2IT%vM%EwMBxl@$O%EEn_)sifxOQNU%x$X zwwi-#GIlc%Hlq04Icc9#Lio5u$s>)@uT!q1Y6FZj137{& z23hn?-F1SYH_i|91G0CdzQH<-@!)3Memip&M>0tX3;n(5d6+7HUXI&ZK8}@QCX<(` z7dwW+65>pcN*zzRoyx+*5Nn($a1MKjN&NA*$QkX44i~^({4`(A*?-R3TL>3XF@cW%)k7Er3R$Jik>%D#~Akmrhdv7 zk_z5^t=+{kFu=uv!l3-1OqsiaQ^qquKh;GiF{Ij;=N|dj%}7I$Z^V4mMwy{eHR`2R z@w5{-z)c9pCa9~Lr?CX!y;HQnAv^dhbsL5JN1>`M$phZlhaM{>qDMdlVB7@{N!lZr z1ReqQGyIOfu^}A}B>Hz3^N|33HI|sv$2u4zqBPmeE>MB=9KzBjx%9BviJK2O;vWhZ zNq4IMmuZDP4iSVlVUsqVJlRNC*;gEgHQgZU5S(KhOav|J2RH+6lL~CpcKt6Us)E)v zUq}!bio$ya7^}fg`&h(+Vzx zBKw_qG)&Ysgi!s~P2+q)SCbK4%Re?AY^G)-R)Wbeh{=gg5?aks_FOq&>M77Im3vP` z0|Xy2#5eCt*Jp#qFR6X$GQ&owQ<_#2MGK#iwkMuAg$zO{RHDrJgdbg)qtzzbN)W9t zn9?V}kwA_u)E2;V`9SLIy%Y%@``3vNDjTGY(|^IxA0<&JirBHDg)o!Gj08Y~j=Fdf z^*IWk2pG=(34oW3n}&}BYB_g2TQkoHqt+D&{Rvar5R{^dczvdg=D-i??~91EG?GDZ zx!QnQ$NUibrJfPZF|pN%<$Wu2f21 zzz7X_EOy)5IovJPp%iRDT3nlHcJv>Rsm-dihLV~HT223qSOebCSLZqU!PCh%?&A<8 z^>+%tZm=LN5tn850QlhFf0kP)#u;kVyPJlPfoa96I=MC1?pj$&j_tben#8Gu@CE+r zxn09_f-2T%45Ds3{WQL2CH7y7_&^HL$v#PDGJyo1q&f7c6LsxfDX+cG1Si}!I7Oab zCs{Q>DLO%e8x9E8%+`&l&orm#>DQr$rs}kvD zf>A8kx}kP#tIl`5kpeX z6cgP9bLysi6je74hZT(|29vI$HQjqzU@ znkT=l%)n-E+=tZ#^ZKd&r5M4zDy7W)w#G#hN3~i#At^&o`Z8woDPIHYSl!MLXP9;N zAG*CtI8z41%Z1B$x`pjJND;jh$jao9x8C-X8yYdHmWVS`aB#_10FFwo)$<(5{0>6_ z9I=Z=S8n#Sev>>WdCI5-m=tJ!LMCbRu2j$>qoRLUPB4aGw;LP{I=e$KWBt5Wc@}2Z#h(X198g z2p@#iab?QtY3L{{Dis9&IV%9rW+aIWG9FycjVbL=)1P$Q$+dmzFypk>QOJNee^yn6 z?kwX{?2ixpAvC_^6xr!44mM8rEh(xY(&xVKS6twSv-xeQAJ6-S!1voYkJndjuRF%R z=cx+;Nzq&@cEvDHH5}`qHGLM9ULbLm%sj38p<|k$$=?a5m=Dkqm(|tO#kps7AlW+Q1w00-552f_9JCSF#f9S+s5{Le3 z8~!*9k6Fn{e@z(S2;@F+#8nF-@xxpszi)n>XG{JS!1y`OI&h!EBSx77y$JC$B^QsH zIA#%CZ!7|@gN1 z1{RJ3E*4vwyZ&lFlnga36=b574q~?IZQCLbKn!ivB&S8MC?!JaqgfEp&KdvE7YKET zLsgF_{mhYrJ6+DoW&*EKQB@68BlhfI5BT!_H5JpOx*{H--hPr4L9fVD%&|cD<>2TA z<|{;Ui#XK}xxc%H#NXZNvE9-Ql+KJ)sl$`&gK+F`fjFz3%Svu-BE=KsP^g`xU=NcT z(&kA8CsY@J5gXq;R z)Gg~whrb)1awj{3yBSd<1iL4qFbdQHD27n{;M9W-(Tknpj0jaRwBjK)#2TM|qs)Rt zsA`^!$dGVs6)c5}30{pdUlfik>W)#zq^zBIxtW7BkVJyCzT^FX?WQY7#zu05WYh|{ zCG8T7{bP*ecwd1m*uuif7fWtB= z=4eB2C_L*AXp&J{SV1`L;m0mn%D7V0$$Ki=2!&7_s@fr-B4fcJj$&T)$P)^r7-`N6 zt#5HDCt|aqLz6SOTD9j8z{chcmyMO&ZX$Wqgk;(DJy$M$RXSh z7*3ly%%7`^pKP1*+)o1a)65_Zax$Iq{FhV(9kmbh{% zY&w^BN^z3TkhUJLM^(I*3w{!zixhO^{U|}#-n7&`<|puYn%`M2TRAJxInXmF!4d@O z+gc)|;7Hz?hf#z%-dPWmlrSW0H0jv=`gsOBnIDd`Dzh9f%{mn?*wj{?k}~Hi1Nzr= zS^z`gy~1=m3T7`#ISuQq|A4;5@m>XvW`gM0C&ruED1D@w7K9&m>{TkMyuWUQ>3Dv0 zpEss9RA~NFK*)tmqY<40@YBJS=t19>>ep6+z=A?{Mfo1JuIzN$ZGnYJYfW5txx76r zs02+p$uMYx3f{}qs&w@s)L9fX|w`x)^k6L8)@#bUMyCrU<2uf{%1zDY&0r~ zuk`7YfHIS?f_cC+p=lUm6EPF;Hf+pb#DkWV;rcyYyjs7V*;+Ez^MwC|3#VXB_$u(}BcDA%9K>OH0lYU}7lNZEgifyn!$58>^05IhrL#B4hO6Z8TDXm{LrlW)x z!zW#(sS}Dbv1ws~0}-rZt@Ya);-&lxL1hA3uwcu)C<`6{2^9?dG2XppLQmo63}>R& zDNT|Z-^GzI+Y6c`XG6PmaNdTLbU z@%O(z|L378xFgU5I{BRDKp4UCBBtalo%xaIU;8g(p$#=+v!++bnz@H3Kd@-J65^~} z1`qQ{B@bO7g+OA2+aWDe`7+Yh!?#AGilqmvA=H=IdcjBMsl=N=7-jF#_b}GV`zf3RnTN6q?cY29U*Gh#N!~5frk$j1E>=6hAv>~`6ji7 zn*?x|$Lf@f)4m76qE+LC!o%v0ZbF?PUQfRfA zk!BDATkG&1p?rhCD+^3k%&43R{#H&m(e1|>-KC+kRSDJW>6yti&^K4Y<>hZL`S0}| zbzX5zNirw@bbSWk=yM(M*2OQdKlKHU{VE6LX7*xe)_2=^$2eAWt{8Il z8=)4)bJnmZ0LC_Me9s5aq|gOJ0Oe7JtfDP(Z)kihS(|V;RieA@!B^k&IM(lQi_@Dg z;}#u}rTy4<6f&VyC9@_0BW;Lt01m`>+YI+ZEMjDS24%dcwXpz#ei z)9Vf~@TM2_zD88yO<;CwO}CYOSKhsBXbdfV^&j2EivPRHoL_z2y)O{NP7mEQe#T;o z4^JJhy`F{sa|2YCOql8Z3HVAEk)5(vU5dVu&BSFcYoTL{use}M2)%>sW?qt(xk4)* z#wd5Njfa&!a;2Z~blXe_e2_Vmy0}?1RDMnFqN7=8C+Dsf8-ZC~J#0p9JC2-BPDQO@ zbsr!%Mkt3fbJDf%jylQ)f79H!Vkkw*@sKph*!?IFjG|Iw`T5w`8ri z3$Cj+C|&sy0^Bh+^(2iI+d^8MqVb4}ubC+CvWhunEe7T+JW`@h{y9(4yJ4A<>RwkZ=t*wDtJLy;9~tIz|K3Xf)c>b(LaD$# z7jN43tJLy|6*0r8Ak|5=_!c2n3pp`tsJUan;&_%(lK$M^+N*UFoZ#RhZBwnaw;(u!encnplyiMk zK)b4zKH3ZKAg`VdJP+8dN-+r172IZ*0^dgzp|C{}6OMg&Th3K1Ip_L2du5hPJ)#XS z^`$xgE1|U-FeS`UlW`{lER-q-nO<{bgfK5O%$KRHT1-zFW6)xF5$fXW5Em{nF-n@?|n&z zNu2&=Icz@(UW;CMXJDky%gI8KSfjW-O$C{^zX9zlda=};reEjl$^tU~mxQpY?ci3G{2*P(RVGD<10 zi`18id_Ci&V#L3hu<{!=5()<=EyF)t9X-9=$o;6H$;Bx`M=1QhOz>-s`K{f?%(){g zJJJqCz~0e0KU~rB8qHh&5ye|~YK`%1*-;lZp{7l=W022xAjO4xB9gIgM6nscB1cff{G&bz()B@`*-4BJIL%e;M)T8;vKIiaz&E zO_MAI$EJpyA`<85tZLY)n}7b*try+gp5IB9)6m93bT#dGvvHf1jqWFS2*8x;!49B3F9B zx!nbSCpk*^wKlrw9!>KmuwcQn{VVnmNwWN85zFO_NPmoU{}gBYWAbk1etl>``b~5qiHc4G+voZ$c0hxPC=$YF`^JzQM0Z5&CI;* z-K(uJKiXX2lch2{0XJYRe4KRD0%_5FeweyLF|H6ce{Ihc!~k%n|60HZnXEtB%PKqB z_|TPp?;3>dw~}_myR6pvA3A1rQD@qx%Ksp>e*=Lq=Avc~PpL5H$bm5|?KwmM{|QcU zj7-b+ix;b*KydGt8if^_RLb0OIVu-Be1UFU~RKX^vd{W6^agve3~tywob9o0l=jq11^{ykOB- z!l;0oT)gj>`-0mxuNy_pmNg<--!!~h-1Og4|D2%hVd}MP^=S@*+s?T}q7;kj!N26Y zqZBRHC7UifFTunkUyVVG=`d1E6(9p<0)`>}QDc=H^ik5`@5ynqVS>sY#Dpl~kocbj z>lKd6Jb}&v@sAmC!)l)Qfe|I;$J2fR?Q0nR1`_Jp{G!y8}RZ_aZt*W ziharvErtQm4J7rOIU$X=lH~i#5^Lyp+D;#cgCwiHTt`;=r{hJ`xWNICZf15>1vpf# zsG7@gx|1(3R{I_{O$GOEVqPDN3L%@v3Sp1Tlga*cMmp5u(*M}-6>b!=L}J}_!UYEu zv_nV%_$c-H4Qp&N7CIYp;4Z6Hi-OX$4lBbfs>tB~*s$6oTjh+4t4-g^fB>_I8&S*A z&B=)2g{k9FpimTebPqjil^l|x+)c?J^GnXQ{`MBU&>4;BRK(Udb==;}sg8b*V()j| zm!hJl#c8@KvuYH-+2XAsq>ouV1h1Cnr|?fy*Ykwz-bIqT>)ZEcq`-CE$*-N_I|Tid zj{Fv1g9cXkQLkTT3Pvevt#r_?2S1)uO;323zQ{ylsHmRmoD;yPe+a7d*V{g!FAc4< zak<5pTvg0Qf0xtuA|ey;RYwaoff2@LlCTL2VT1;*E*l~+uOdKdx+S;t@h?MvYOHoT z(rpgbBR3`*Pp~w#d|Ya1rm1KO&M1YPwy3D`)ShK_?KR2)mqnkuC)=vFF46_3La&m8iy z@J3~;o*!fD0MxSu{ev4#kdpi7hbS{P0A{7B*0uExZK5TbC~CS!^TLM>=#9w2tL~LAl7Nep-{M>FbCr))`B$&%N7$J?<67 z3;ThTRrSz!mI;fuB>vNa6v(AD6Lc2&S@&PdfuiIS4O~1Vn`Rxwf4c587}J`69CU-# zs_#C*b?N!9(A=6-P~Sd6k@%&qbYh0;k_indsW&_3;HTe{6+_+;)Vu7Qfca>QMSpvI zz8y_Zpne@JU1X>7ejU)y4-WgKSw15R5>(jUYl5ET=dAQ|yVwJMR2p${OwlyKG3;_Q zoFJih#W&v-D6RT`R%n+48?4=83^*8)JgD%IE>GN%l4tSw#G^8qJ#}lPZ!jQaqmHs; zE}uaqrCF)005v`sRmUl_7jVzVrTc@BktG4!NxAVb&=2{h?FIQP&lg8l=Wrw)(i-7f z&{G4(CvD++CJ7dj~>Q-cxO^&S01~H<}QttZ8L#JcvH0o5p&gj%eP} zrN1!#lg|n?@KF_a{KS7pXOuo(=A>dPE}m_k!)}pbCq2BIO!!@vC%zFBPYry%EYtJZ z>VoS#!f}{qxDk+6wR&6CuZMEb&=wI1<%cC05?GR2>^9N0l$Om=_9zhy?bL3_4o^ow zK=scVHI5QJA5J4YguYLiZ4tW~gE(e0tz;T!G*s&M`?kPVY;BA}3#{#iF_|%VrpR#F^mG|!nh1xJPi&_>DD&QED3c^7t+=b zzbk3;>wx(Ler^=;NBLdMnq1BxImJLd?W{HaqVDHvc#ZdMrEt$A2Y-&^UE$x1!GCl< zD@H#)yb}^CeTZ(tvxqqhvdw<^ZyI=^M-a;y;8rWNkzSJfd~XoN{cUu~=kQ$UoJ4)4 zNR z2w6i~Dj$U64nJv!!~%#Lq1fV)Bab}fKvGYQ`5}H#JhRk%unq|%et$xD?8z~;xGI_I zczGnr+8Ghb+sVeoB>5-F5FYGSNBXjg;388H14*{d;wjivA~F_M&D zrADRaLf2nn^u%aD>#H-e{~Q5G)m5!5zBd=+$VtXx2sEJfq)+L~^I&f;w=$DA>D&z@ zxA3xYrO$+ro(V~u;*2^Gw83BiS;~Mt5^|W*hZ{o&+2I4E+lK-XD)a&v=D=J~(W&jW zOBN-4ev@-r`3#!@2QGGAUm0ex^zv#$W`%78rU~QTL5@juMkQ-cZc(PR#Kp@NZ$uXm z&HvTCBn47+IYMTz!J5HN(9a8&mABV;PlTv>U64FJAC}F4ERT5jGZKP+_rwzf?$`+cQm+c2SDq4HtQ1 zJB##(C0Jws($$(heV~Yv;EAUlkaj_bo;g7N2>tTRSHUo{Au@)(H-R}MOMAV5|5;)m za%~yKEB9=`I^Kl1VotZEy>hfJJe&MlIk%B=EhP0UUR``2{(XgczhkW0#`t>m^@2l- zoyFm!5X+rdx%Y3+p~^0LVLd=u*nTUjs76^k8GeTK8k^U>F)faPFQAKAY4D*ts1xD2 z(em@l^9fQU=>V#z2o1xr5EvHM&s3K*%-J!MSm~;~8YSRdes6AUMB7%odPK((iMr5yr-hNvoekIe`@kOik`g7a>!EWaYfx?nI_2 zlA&bwI?LXT8Vw!Q?OL>!w4ZM!^8@UWO#7`tdPx7cYWrnUhdzrD98MAZoIhV=C^&w- zAfW|kN@~0v(QPE=al@RhSlmOJ`4FURYeO#@&_Ww~2^Vh( zJUwEW#rwgDv!(6v@xi(I=-EW!ypbkdV@KnsFb!1GECYcV$-&=LxfE_g}g(Id8Ezl#yT~{ug@NP;^|hh zdZsp!?W~i} z;zTqsS$z2ahv2EMd@7TE>MlhC0f?xnmZn_#ylv9c?#-$umVPc# z297KRd33O@*C1jxdZ<+5d$wP|4qe0)p`Ze5>QE~7YIy!Grv94IeH5O;lyBPsZ4 zaM;kUSAI3kpc#Q8w5iwN$9PykNzq+$HUUuY`QsS|#$|>#YQbS zJA-^<-?;{jbqU+2lb?O7tmD;^B~$OLyFbdheXTtyQ&Fcf*x@$gsW7|AjD>Q2?Dog0 zhW%Aw&DIrRw;)f4RmxQi75Xtp6YzMGt^xompOYj}is0ma=aLuPB@|8vKevOw+Vstr zyqxPA7_0sr1a;MAG_FsT5uT}nbz39fKCxl?4~Cq^l%6gFM`s&>u5P0bxWG%~E%+~u zgHZPVBS)i8Z8x0mmN|^}rlxc|K#bwTn%4Z9p7y%6_4$?{kgcux*V>v9#r>jst#;*d zGYzl4@LYj2?KqPt)zcO-h&tr4FA6=qP z%Hf9DuCatmyybN);cYIfy0QwqODu^^WeUDsa1-EITV6}@Q?3Esv&Ft{i{VgzmORvN zTWIdm^k_~c`B_*L#NWDBG%Ga8o=`*79SY7jJAI)op}($kwzfAvx83xwyViUj3ogEV zo);^(zTR|;La)C*c0GMl zunC7#S)*I2oP(;n`W@NBuZUx9*+VsRh8JyF2>>3lM-lrMt}t6SwY5DgKz~oo6!ArW zi5IWzGMJlYg&yYFm0kCDo^tK!V}WecRX z1bb`vAb<%Q`N(CQ{-rxrMJDmaC``@=E>Tb_e#z=Z>my_Z?l0w%+Br%CH`w{3;DcY6 z$ByT2<{_ms0YDrkF~XqTitY?+K1)I`}}P1Q#-GkpV`{aLcQw7 zLxyOlZ`~UBU6179KQAV#MsT68x1n|O+MwTl@|^v$YY-gQofWps*YuMCWXZvq9+4&U zC|YhN8BcyD#Hb;CG}z3fHoeO%={XmhFB$$!&ttLxkgm=_CATeT*;uExi(Oi+)7~$b zE17{!&p+ zE&$)b=<|*!(``{N_k21xwZ%&`h@pz=Np6VgG+%3e<5L|aPFqbsc(9*5loXxjLhd3C zBP}Sp{aK3Xqu^jnENj6WQM76o_I*}8qDU3nGE^bGzW2u&Di&Cj9!H?r$y))8|D7Da z$wb!j4~&ncbRh!SPfL~NeqTOc{jE-IC<;!I2TkqR@8UL!biv!!=k0sv)|{5Yn~=xmqFaV45*$m`4d}2HH6BFMd2fP*ZXA$>xP%xSxqZ z3J9O)FB1!MIAyrb#|fYQ@Db(nQy4Oezb4m~{zykg#Zq@O`L3dMZTS%AnAPG!oKSMG5mepK-oRax^dzO{q5W)kIzW}It_d7zpasshj;*Am@7X@5UVm?P->bYXuj@c#Gi;)L+!Z}%5QX`}Vya(C_rJpM<2 zW885~W_rLmG2T6JJ}5f}hF)jZ8d^ezr(0#>#G|aZk5(oM<+}8u91XwUffn8Vfw+BL zWXl&*@MdkBQu(c%JyP+W!p4=r^pvi(1KqV__|)7l89M08j&Hd`E`!qUvSw0H=j&_!{D!XgfMJ77y`NNgSw+p!g| ziNIW};Oua@>-*>5QQV+n9_uxS1YF8LjvzN9Ue&^81NU>`7vu}?e&VVq_86=Q)Y>T^ z47BDc1i1=Z0|dz1G0;Hh4MU!UiGU;4nz6%4e8|`9++ICQzw$r|sC}t2l-kgPof;6b zN-Wje)y@k~TucRRrL$|ythzD++M)ECr)FFTD38_b&XNDv*%F_(m@9A+7U!zhwK32X z@j`!l9riE$g($yYSg#@y%Eo-!s6MkqlwGdix6C%|YP8NKJ|!>~;>m?RW?oInvN(6> zAS?hIB#sEwI#NBxKAm|j_=CJ^zajAa=x89~hiFix>*>sI^OM;*9W^S!7&e=!&-@gs zUn)jY*)i=?O)HmOf{GxpG9tE;cHdzkVp_dw?GBS@N@mEx+|Dvx(evt}?dA+D&Z`?~Wu_BjvK_~*D zx$3WE6W~vZs&QmQS0p0tmjLkBOIvb{$EFW^1mh#gPjyKois~t1F>BM$UMJyY?c!vx zS#Vv3()XGYZ;&&PFY6+2St#UBrCu8hE#;+WfG9os1oQ?Ey{w-|t0i^*Z`m4$MVDc| z#koFfWDWwRNV?JUAkB8M50I?mQ-)OQRPdEurRRJn+1B{C7h~#@oOq0c=b#%CACyn$ zeBGHUlxZ!hmfkPf%zfPCA`k%ystLbDDi!xP9Aud-RV%L53a-LjbNsqEH~d)inZxMgaq4d4bqCqHMl5zu=BHcZINl?n}1_9ADjoO}Zq;|a4Az4(BQoO0WDd3ufL zyH}t8{I#GIQR4qjID8e&rB-=8tl|~BD*aA=`_(t0Pycs>J$SOku9~f?b$lAirMaS) z(hB>p=O)K#a~YEj1ZCR7?6ofXpux81!s+wckwkQ1IavVL6rODPEQW80djJ+@chNHS zq2HLK*9mA#ax&ncer-NMnZ1czxv;QODVl&a-*oJc{sQ|BYeW;*vG!n4@BL8Mo$e*r zxFdJiECaQR69MOYe@*~dQ{14`J5rxP`0gvEBx>W1S+O>du z{7_ACgT1rgN==ovyGZGawqBBcf{2ed1*)e?w7wI%R)%KbXbj3m)HRhSEthVzWiUIm zo_9(v1RXxdx>dD5H3gZAdSgu{*=CHy$F%H`t4_O^7{thZk$b$}^hcMvSqQGc&OL8_ z5&Y$;-9x6uQeQPgoXgSM#00o+qgWR6S=Bd6HH&vidxfP`tX*Ce!~Lnd^ih*9->A6F zuliveC#ynIE}eLz{CJ>*=12^qX#QEbQ3@kEN2at8s1?+dJd78wR!GkwJybWN2@#uPwj<+Ks5nIFW(Ib zyGny1scj0ot(O+1-=JvokPdm8SaB#6wc=@{66r=H@G(h&i5F6s9f$pIF0^EVBc1m> zQ_W6TMusVX2@}_$X&!M&6!5%p|7{ca+6R5FB%H3-3DikGX>!fuOuXJ* zStTGe#yfqvncsOp4l&#MX(m3@9d$!g((~j8B7V6%zw>viVkZPVbN`1W%kNyo{5XR= z^N*o>mQPxeX*e*)K?c8Gx9C%13vR6a9~JG)P<;+ezw;RV5y=S9=0jok-H=XZCyBsnA7Rpq?+ za|p~W^cC36x(o(vA$qef;V8OD_*`N?#LBb$Ey@}@!vIgNE zl=IP_&k@o(h6iK~Bp{G0KSLLBQhyiXgdWE-vR{yY&Y~1RHWj6Fl2}SQ1%8l!ku-H) z2jcrpjgZ&f5O`5SQQYJy%IqLWI17uRp2S$);UU03p2Ca+W#?n(k@A7kg*k#)i}3hg zt)Tx(6+4Ua200fI^dCf4*vX*+;5gEUg@GWtn0b&C_3S~mw~I^rKNb}C=w>zZ5|{R5 z%qSapfT6d58o5X+`v;fay(+5iT*avxe4NnKJ>6bcSl3Tugq}arBOPzD(`*I3<>_<~DdR>w*@I%y z__pU8J53vc2?D=C3^^I;%vM!s8%2Gkk8?cwrE2~L;P7yqpRTDHVW_d2C z#jd@=!%Fa5Ro1x0K818k+P2Oa?+)-=jZ4S&Y2-=TrY{r%bjl@dAOAy`7Js7(0smlk z<(2=qN8bwH4C6CJ?Zvi#5=YGKLO?^U*Mgdl=L*gWLDS*OUZl#vQ(5)ew=Ukl%IM8` zzvU_a^uLib-_`#o{8zR*cZgm4X6mODe-n4Fd$(n}SDRd||C*BwTT5^ivN>xjweQ|= zb(`4CPvOvm)!ZUITWd=AYkS$ku~&~QZ;YNO%V$SGC$|7?R2H+C?rIkDk`$C4jgHYC z+Qx<<+B1MFJr`QM7mAaS>8_V|9x)*yp_eoE_Awt*rI1-=jfr9JxT ztJ(F=Ah>HHt`w8b3?_zpg6Oo}4nKluFM(LylBJenH6Rd;p9#@@k_fpiY_Mp5jk&j= zR_*onXA>oh1Jmqv7QWFQDn@3@w$b15f)#F{BOMa^D|DphP#)ibLu0bEc(`aJm72)RXm3)O#vbkF`N z;wXO$wABA6W#~dgPx9Feg{hE7)COG-g>m%06{j(JQxI}oqwpu1lW*uha)aS{Rr8k{@OA-j`Bxb+D^r=iYFveL+D=}>)Dl@2TT)}Vu>IKOCD*al9i30~}% z<3#(NGOB-9KU-L^HEVEfQ5W}Sc-^ksQR2G8&EiYnv8%@|=TGgX11TP&7rT*nnTqte zdA7tpQ^>TY6x(;Ah@~0N4^voPK@dFqKi16;ewck`g(^wIh2noq9Oc-)vZcjBCIU(r zV{z#bi4T$}635I|^P3JG0^tx)ZT~VUTKv{zwxk?!GoFdzQvZqM$RPyjN|Z)e!JcqP z>;WLUUH0?HxwpSt&3|zNt0+yRqC0V|5~iv5b{+;mh1ot z=PLjrD%0LTRIy+A+`Tb6^ymAG?SOij{tn;VRgc^b1L?uyE(}Wa6U)gqks&!gpwteQ zDz5q}K%!8pBj+|9#;4Q@bxC<(C)(`1Sra>r>he$Ysd-%+P5gg^A zfL^NzD#LX<$p*}XIiPfVC|k7nnBkp@y^{h7uR2v5d^3QVAy_($Q6eW@6@;Hd%?_w? z226F~^Fpfuw1-YsRetMHLKJK?%|?e5D!J_8TM!M~aFC^NP%YnBv^`$hWL+Uwb`$acxO{;-T z%J=$qPV1M%?_2e@$&AH8T}|Z)bl<6y*gH+wK6B)rfi=ESXR(JW@X1E71an>I)2OY} zunpjW;g(h0CgWWPf>p4KsJYXwStu_88@m%Ia#)DDs=~qG&E>o7z| z%z9z(n;)0V!teY3?t>t=VW4+qKnnPKK2_99!xjF@m$&?UVb{pZ#{A6u{}~^G;ctqM zXXyIoAV0@}_dn}1bguEU3PIkH-n^w*#XDwk@W_2($xDE5A&%k?VwOkznWBr+x02uwuFMvAY!QHM z&y$TA%NmRr(KbUdAuf783E@T@3FeW`K>Z>R!0S9D<9rscU+dSgY+hqPnk+|+X-Ez) zO@0(KvDon1j@9ehA}U^;>hsr?`L5;)%?_39o))HH@~q|oY#_@DjFF0 z@WR$w@WFVW5Wnk$2T&+K{?&krD z(D7E+rYE;L31{g|3QIy48?@|<|C}=*eKvILpdbz2dTHSlU?~3n>m2U9tw&7u+~41N zd1v}5>wUN+JfcNwB6<0KC>#~xq9{$6q#*OGkx7+ie|BV5JMCMtdu(9ceC z?NA|gf6#mYmKgrdH}HK@xr8J6hw*tWpy-Y#=4fuWd}(-cE^ObQ0A&0PhDaq2^48!C zhlqN~%3pP)Qo=6v>h6zW<{xz#>^TX@3PVl25gkmfo|0^ETZ1O8)PsVPG79}@Fa^@~ zvySgb&lHozc-<{dO-tlx;F%zOg%bQc$L_cU@sLdXZQrMysE#iU}!WDpWbFcO;e zVOu+SyEXlwK1f?(aB#td)7xGR0>?{QRCS9bbko_4!D8={BB+IdXu4$KwcpkksMER) zUOaXf$O)b0haJ4OP!$81Xm76S4N>dKKom=r7i}c7@-mkqe?ad-*+mm}gR(oaw;`gA z52;3jmihLjt-Y_YVuVD0PyzGj`z9webZq~1$aatkgv0x0@)H6PA?OhCAzT!7x_@Oh zt%pzvRroI;#DP|PIM-}*Qzz{F=o0WyVTUpj=t(J>nDad(#D1pI@xf1MR$-L`?xh6I zhFQP*aleY5I|O-#9y(LJs3JqIaJ!;aj&Z)bW7f@n7qMvQIy{tFc!XMHq5b+lm^kN5 zlV^DZB^>vrVWp!D5k*&8fojN$e*h`e;~s};@NdN3*D3N(aMm#;y)CAZheVh1ukA;-Oc z$Sp~g$Hhrb6t<>L=bG8>!)W|iv^u*wksri4m_{Q>4l>JeOwIc zpN6IJTc* zbLK=&KkYP*$Y15sY=NnDrvs1ZIQRp@m?dBE}Ps|Arq&bbiE-uty{OM46Bx@a_Ly^kW0-hW-iE5Oo_aB zOzF{+6=Ct43utkGx*v0oj+)Y_YDLIu?6lj-l{Z{mb zId*7eiw$IZrO(g%I98F?>$N69YNVpPCXQ7tj6T*QAgVt#7b5Kpcdmy7M0M=)QZ_h` z3)P~S@J{gg*PXaB39Qmw&|#w6I`gQp+MLXh1|;CVtIcA|iPs3W*-VF2y8d7eLiH}P zldH(n2~d*?Helj%K-jU!;AoJ0&O9Q@?t$TRDQU0icM=n&76@}(Vo45IUOJbfu2hYF z%!=QB**|~uk6}Qq@EzSadF4y*#Yf6O^Fc*AJ#Gz2oR{kR$KDE6|3W)jNWQ}B1yUeG z?~1S_xX!&eu3l7@G53K;=fZ4Wa{GKTxH&o;UsjT1T9#^VZWe_z<|1=$fXD7n)QEyy zUvhyn!JiJ*`xq_fQYhge9(ko4zpd~4fZ>}g4ko5ppU3P~W&-kU?ciJg4U9r_)bAo= zM~Wtg6c)@>k zQ5RkZ)`pP){)n{CRXJ^Rx2b&a!(UV!-MAf`+r#y@qs8;($fh9vYQVwW$6$f&O*(R^ z(r8kx4hOj<+SqyI-kNE9a+%9ZubL{iGLDQ8(#RuCR}15Kp`C8a}pw06u}%A;6oxgNGc zr4WVz!_tPbMk*^~_004OT?F0;0&UG(^C3YEH7+vv+}b~?*y;;NZbRov)_mfZF>_J- zSl(J&#diKIITWlTK!IOZD=#AX#nJ^UvO!uMkJP8xOmStv4~7Gqkyu!Z9}SSyszcl< zluW=4mV*vQ*xpPSM20u;qSMi#+C ziL9)}J%3|wlAtEaEe<$wgB|a3Jf{6fZswY4zj}>iFN;TjRtiaEMyWo~ZYwjAr^hb) z=#whe&Pp39mMX(dRh@zkgAV(_C%m8npOe390u?|VMLBmiXi8?2u)t}~8jV_5$1QO0 zhq=5mipJR;2WG=d0-`~G5gP(4 zGO#(S(mZ#RdTso}{y6#;M-p4@wR5*)17CIbQgw<2%CIoW1e%!&X`ZQVaKE4bB3YL^ z85ua|oM|e*g*DB+?r6Nv&ivweaE(<*Ll+D(WYgD6#HjP~d_G{9 zLfkAZ(vmpx5a=VJZ{&N|jK6igS_~$6j}990vVulIEonau5emOd^AF`^FJA83$~=P5 zc+OGrq`kT^>i`zT?Wcxw?%S3k_h0ey5fHQyrL7YipfhjL(MS7=WhF?MJ%e{OO7r@mzxgt~^)36Lgczj(DG^N6&ykk*t=ku&0tl&y3}vC;RX&W+Y>gyb zGGC$0P0Eq-!A0D3paDyO-pHVOQRhC)L(-Gdkj17qn?|b0ei0z+L?LKh>}ocSeTYMk z!wP7-%z)@d`4Oetv;J{^PK(NeTTyZ^u+&J(#E%#D^X{~nQLn@OHau#ybo=uNvHMFF zRuKkuNIB>BkBol&Wc>rN<12<;3O>#)H=V<&t~w)Owz)7$>KbpHO~ z>F`=J{?jY9{MLPy`bPi5{12Y_KLAJ1-w7SwW09J#UmJA>H9qCWFCs}+foC-#VK;hZ z+mv0KcDC~!o1s~zoK6Dkc{Mm40=bdP<`!ove-JflQ;6fw;(j!(9`0CcSqIjh?pVXv z-mrgQ-mq^{#9I{#tXc`Es@s>#j(EOjRR+2pl(6H0H6bL))bIJwgQO254uNe=$p0-a z*6`ku!kZ=8%H4MBl++$nb1IU?g3nHln_)u_2dAwAgkU`K>4SkzxCm@<9xiNU=hWD3 z(=;)vD?%xFQ`9S1RASUx8P>=xJ;V8L3;>Bk5JM+tt%z?$>0JU z?lEGl!+-O#!Qm3vV?6L8TAVN0Z#}^$D{FIjO<80yQAaaW6yC}1U#j8z5vwf%YBkF) z?e8yV7!q6@ZG0H!ruH#HUVT=YpUxjEPF=6vs=-!p_pvt9{8v5hFR{cMxPTf~?2cuY zctc1kt6Gd54wWZaqj`=$wKb!R-1O?g2I#EzS`zNGEAVT0OXBTe7+_&qxbz@AzV1DGp0y;nwqIeK>@=ZkyCZ>tKbMrXpNEx@n|2 zR(qCCCFu<|i-;_NdE`$w)sjzk`YD=j`Thcv0?D?J)Q4SZ8g`Xyrz}+;<9)PY?bTvN z1FuDikV)~XuRDONG;V;4zYpT1y!GjqO#6CW%Z z-QFLY6qEP;5~@JF3yT{YC$mfp5jl;&92A*^wOvH)^~}d4UmoK;&ilPMapeU7s=?&i ztX%cVuYsk|Ea4cVKNrvTlV5i?&6)`bWg3Q`es^fzjLm#HYv0v&oY!+uUsB22xy(^^ zwqUOrJb$vE_d!$_fj*2Z-zcgMhftnpznMW!##91dZSeS}da+Lq(MybY82X?n6U z7KVig`P=D)>{)7i1$sS7nExYtgE`q8Dxpz7txhm!b9Z(zk;Mro(ne;uRik#qHoEiN zuKLSTd22-XB!j|ah>Lqrp*mogS-X;LK1-d!sJj{2{oQv=+&S+KuP7<` zlFA(XYAApJH_KI#pOV$P*J=PSFZs&i(xu^3;_DJ8tf~F=PwUghmtw|AL?pafhFu)n z+es-uNzLn{1bG`GRKL1UgOYfFr67mThU3}Q>Rr|fC;wLS zpYTxL$_ZH#&#y~>m7NLA1Do|Pz%)xu+@zqkPEZy;@bGQLG!?zU~#Nh)|;W!emPR{Ls@=rY00a zmR~S`3_qEkVIH!eSsSu=uuP3TM{dBD4ZJo_FIJl)`?2j#{ z$cz06Yu?4kxjp4qvc|BkL2kbt^w)vk6(HoO+J{KBOV}q|4S6eY<- zB9DlN_!pFT&!=8E(pb*o4IHv>wwaTxS<-&L-EhM@^taWe5|8l!$62K}W?r)Dvj#4p z8eN6LzCX=Wu|7zgyNORJ*MUCsN`u_-BGeHuRjKW9xCM7O@2X_B3TS3xZf?h?EK7!l z?r9hBkY0N%gvYyYZZPMGqa3Pb+JNb+%yzIc?^MxlF{FiPvNVW)6yhvm5WmpMs(1!6 zY=wuUI0mkZA!f8`wrQ5>(j^FvC2gl%${xBCNeT}k&E{ujeTEge@xfS>h+CH^&=fU>jR_#A*z}b zHQAUSfHw^jUm!nE++oZq%|eWJqKmJeg&vXs*#?FHffS+;FzS#!DZv(JYI{upQmyT= zjPE<0qHb%XW$XWBy0cro&2NBRQoK1p2^jZpBHo(q7@LJKrV^$?*ejUBAfaA&91LRS zc&;K}v)f#&?hZ^>)r0D^CpLV^)(Te{z?aVa{hoX!FTZ@W;uG90)5=1JmEF){?s8iS>0K@-;g&kI-nqR0u3H_H4D*c43gn6T=mqa)dhQ#b zQdtIL^7@G5koXtu21TIXK!9WOi!U2VDK z@w01p&{UFU$1%{Hau=wt6t3Tk(zAgl+{xY9xq2Ey4^E9WW`hzGpROJiiGY-8sn->l=OkAbQQ1JPnW{@fbtZA|o2w z-svOqjx~kVgQ98@$M~~jV1J)Bte@lU`-$v0m20HR+zv7kyqZ|>731}ZjWl%Im0`aPh2W= za)hKlB}p4(Mof7LaP4b)cprROs^i06SXNkHNiPL-A?(8}v$KViMnN24gUVa2emwNl2wco;4 z!_sN$m^Do3v}6ZEYGgH=w|I=7iT6pL$|eVQ=eYB;z*ftbuw&T+j8z43;2M3l@m`Rk* zW2mSAZ=U)MJGX2-a;6P|EnHweuIc822nx#ARqV1>c}k(hUGXwD#rk03f&2X!8)GV1 z%pu(sul)PsYXQB>V9?p1N=l2|?3od)1LJ z#mMC&EhysVaPImzhHr~4ce7Vi9>*WjQe+81;vDu^e#5^3(M*$3Q&x^&l1Qb|JKiDM zZcn#&?|YkvWYNCNn25&YL&YZh?A%1>)vSAH+SfpT0pDMc&EHY7YO|g+Y7A}LQj=`y z7o@n^@8{J>BGEsDW%Wp{7V1qCb}-5V>f>uo_}(0`DsX<~u)96FV{JX>To`4IVBo4e z>TDNeu3b+}t3v;30GD4(r((;%bV)Ly0V&H$PC!S!_)Hh(JIFzRP1?ZNB3!k>Z<(A{ z4T{^9&g4#y8`gyNof!}$L_=h>!AsEyvQeE&TS(G{=m3sDnbUWp!_dMpL^Ll^d3o`# z{EMZD=K+z=Zr<(p1s)xP(SFaxA>dSO(#Rsr$iYp_cD&sv;us$-)XPjl9{Ytib6;4J zoG)EuotU92iyG-e$i7LL|r*Anxt{ z8-GjbFif#;g~6+5T7TsB*OeQvewvI+TxTZ?(x|PUD20u4$02hi*A!6fE~w-lAsfb* zLRY*n&qG%zERQYIE@__y8|AYNca4>s7NhnJYJX4r>mVUG)u2AFqv<_MnhyT&ybyF0 z-Or5B);J0dJn@1l2OAi)$@Kb(MN$7nnUTe+bS{$Jxdp;_SF>#6s`S=#^eKO_D4NFP zEoMXE9w?z>!@h+h?((4?Ai6}K*$!*BQD9FrGL)4v`V#3z_8sw>_1Hcph38a55Pg6?5*GTRV5lHA{X4;QwJ3pLj7TUoU%aexpz72sINwxCWr$y zzf1s31RHB3J|%-44r%g^3a#$lv^v^&1w<08E9*Y5AS8$m1NygjRuDX6jnADjjn5Ma zGr`u%>TTWP5R$xx0r-wLZ0#%5nDUK{woZ2|OObdXP;o13PLC?~O-C2y)674jkCZXdzl_28w^Ob65e9=S`?c0QlA&9eag6H^-!%8?jcess`WoB z0k0K@Xy%T)FQ$TJyJ+i>j;Df|6zu6yL8&U4im1SN81hzpeBv__$%?Nfe=lfc?B88A z864U1SC&#uVkw=Aj4oA*2n+11T5FneP(T6am^H<#7@T=Mk_1LC=H1i^XeLHwZf7Wk zPQ8!OI#E4ur#>GNIvz)V&XFz22WnKN;QnRyIy6s5x!f1!hu_foCMhMv^7mZdU39Y{U0#JBko$a14r&2wx zHd1CrbRyIP>@G{AzBYy^EI1t2rp8VOOSRtvbzVrNKgB>UUYSO{Z#8o45Vy98St*z8- z8hSP_{vH8DD$yvjlT0UB;(ReuM$~{6X@9`h!-$$GFm|POJ;7vjGzaU>6k*&Y+HFC> zHSm2Q>XXHk63mx(q2X$Rv7_#Og2j+Bv&_L@gbE5X?xMFrECz9Foz1!B5E({!Tf+E~ zHayufyK#gBRSO||Ot6XJ?U9}nDNuv|jKI!azbq!0d$(q-?iF#U;kq79zpF*#1K{W+ zUb$@9Bdf;{(&@ndM{J@*xtPWD5Ke*L3Q86n)rD3419qKLZBH6T~6paU=6j)MB9cs*Wg z%|pM|_7S`cnVqyK#m`t~UL^e^AfyDPBCAJMja61*`pYX;Soeqk^hRcsLJ= z>Ly+)_?*9oioZgq0a?EnU8$aJPGB?OK<&Q z&X6WDFum;!=K(@Gg&s zylw}aoh$yXxb>9b@tHdI0RBIw-Z4m*o&nb#+qP}nw(T|c%o^Lay~eg}+qP|c&b;5Q zQ+xkN2T!Lf)p^p@om}^wM7=kSSN=8asVHYG5MkSApBMKU?M~OjTHUm#041P9v&3?1 zF(gEHJwrab5C}I53xQHfbScFLUnXN)!M7}l$J#walrca}oLdr%7u!6VUbE~JO3I?_ zve9#I6=d&PXCDG~w3*$447~hIuNlm?zi|~w`Uo4g!DgBPA||GPNPrlD#oG zUI3@vl=%Ca<${5&(=qu+PaL+hX&0J-E6`jXw0tMJbi1bg8(d!AK}pZ2vlh9K+Z(K- zUaAH*xx7=_Y70z^l^pK0+_C-xUh->(-}%*UOl&HZ*@Snv^}KS=}L(5%`96 z012H&rG|uzUV55b?*6en|J@c$KeM34(8*WHVMH^!)KZe|qG*T-mzS>sr^$MkiIfSi z_yBot4mj)b(=iQ}2%j{kI}!5l4n1bsFJCy*LuF}S;q{Y6HC^YcI$ab&dzDa#omYMk zN^*6CU>Ru150Z+4wRXkU*l3v(l0c$o&bS{{{iGNSkfw`zgB`xqq9a|Y764uc(I-zT zITT?Mqq|D)C1Ue12Z)e_FujyW5>TgJ+chi{%xoNn5>gsOm zSA5&jiN?n;?}$Grg~<9xt^arG7^#|1G|8MlVp4fmYma%k?Zr z$-r|oHGTn$!es=G1|En&!E!Z_>2+BR!&fyQQcv52Yj43o{(I*)P?X_a755ly>P9Yv*KQQt4X&sqJ6ANQy3A8FeB5F z8Z}~a5opxeDtlX#tk{~dF<1s1DnKJe$W#@@YCV%=p#RR)Q?Zp|hhGrFC(E;Od_pL< zZx_WAP(}kfcRLd)vZDlT5O6IBfvMLj|1OAWBAfThR8@PZV4|=JxYy5|h9*&BDT~6R z0^Y^6XOs;0K@nVW>S4+aN{JJl_{hav+~|Wx1MedMpeyZDMmG&h#417)pv;mW!jt_i z!bLozjg-^@yLh0^z%`V;EXrN!yvSoaXug+=IIjb@O1EkZZ;-hQaBtHH2x0orFm=m4 z=Z?_!8A+<-iMbPlz0}3LhBkxX$=)(45Yg($&Fw~%FJxdZIYt#?YpdzQfClbC{@WVt z&YkFOQ%ZFUb?`w#!Egt9YZ~7a#3V6((%9AQ++|b7TcPn!dY)|l2KKzae*+*&4kbg61X-#G- zZgbr8eo>+g2UU6DaU^ITt6p4LgqqnHrsNks4B|X+Mj?_=3nXCH$O>B{S2`K|ymtL4 z)2s=an|Q+Xyvw0X#pqxEQ~(HC>^!5(Zu@HS*;fuZ(?AMz)h~>+I2O;%OGp2KQP=&-Tk~b=x(mvRv=DhxB;WK*k10*$R_rb=vVd6 z;&k=PJF52s`x9xPXEi$uVKJf4P3^NQke_B_H;bZJ27jI^S%>2l($=4U8jFAa9K{RT zxj)K%sTgclefsSQb-H?I)y@xu2DYa3xHD{olXem5NwHvkQfJW-Uq8oYGe(Gtn$!CkaO@*bwn%O4pudr96sGX0BDd z2@2z}Q)Y-*@WW*jbe|tp5mg4WWTD^YlF}T>pSp&cJu#@=*QhI6H=fu(FyPT8W=xh_ zJb7YmY}5@9Uk+_r@6I_^lia70B&P@iYm=DkN<9BUh4ES?Q{7xGAqMI@+t~c7D4l?^C_P*QYcnqp)6H8*ElO|D-llPqBFu*ai zsN$7|h!uG6)6L9fblu5M_5wbE?did`d1L21z?{JS+!>fU6u?7ui$~<2vR-K4U;WU9 z`!M#(&{EBdB__@2Y$93FTdp+mH6Ow4`EEUgzibl1z$F(0?WwBA^Uaa+qRs=KTUTXo zGFUFYo=(psa^}EONZx;JR9HC@EU&QMbVJ&xTN|ZhkgJ@L(1~WE8Hstfe4=-`lxfmH zYG|-2i(AfPOe%AsVCu-47<9a+#)7E8>ud-soUQq^CRXg4y+?Si80E9~x;GxyjED)} zHYnfZ_Mcm^`$V@vC6CQPnfl#h`(_fouA{FfTInp?;R@C}_0WaJU!D_zW&Xzb%3>ex znEr;iXU8~SNzr7y3z?o5&MGe5M}uZ)90+&%q`NSHkhEXlK_!A*cqh)WG^VwU%Ja_x z+>cBlW>vBIyXibq0JfGa_6Q`m164Sz+mAYyW8W_v!y(Bkh{2#u47=Ll-3rJ`!(s~f zF{V>?Ps%OZRv37nvp8Q))@W!3o<@%%sJExj+OOV#^I+ZRD0Sxhcu~VXD3SPy8P2K3 zur15gVC(#RAfNaUhe;y5U7G~=PJ#CGD+w~6^GtjO3L@8}JM9Xg1Q^qAq z9DPnABDK-YZtW=zUF!qQ2vAjvD%D-Wd&7P}LbO|Ez>Pr|Lkee->vVnkwcx*mlE>io z#*IJXOzyJ+rO$2T75j|ELw0G0iT|K03ujwHsG@$OhO^M4K8&Ujl6+P7W}j51&^*!< zVRjiAu?PP}<#k^E0J|)@Ag3GXw?AEO*_(Yz9~KXkoiZ|W3vM=QiN>&W17jvj6)DuA zG}SHGV#GqMwhYIB`3s;8%Ei$zQ%&J8H2RVO1+f9ILzJ0~n0>540SfoFDng~z)tTuG zVw)J`4R!%3cc~xn{P+#R%oS8ZSVma?wMr6LsGJh#n^dWRgqR?=!-lR7A{s;*%NRAh zJ^)un3T(7`WHuEfOw>?CdSNQA>NDx{%ExTrl>4-1{kXpwaYr`%=i&29l;2@?K{oDE z;u3<>&L2Q%i5HOT0EhJ-QTArT(Wskzrq<2zQMPiQUvT+!)-@9i`0v9zFnu*(;^56j zxr`^sN3Dw-_m=P(PtJzlAkJnTZ!Pbyg4LhW%C!qIR!`E1b+s#JAXEEU^nK)6-vH*| z=(S#^T$Q>GJUv`hY0bajYpn&l0j{bW`$T=sz#h*pf-O}wSjgHMV;%44XtEyO&B+?= zxGa7R?$C&mvD7oRZ8sfpXm(YjmW3=U#z#G@;(#UBzPS>OS#gd;?k=gd>&!+bx9w+~ zJQ(n-=d|Yi4At?b)f|OsRk!KH%B))Y57SMTr`fczVqJ^*gFV|$=;~{V$@5KO_BaEe zc%b69m*&Z=TQOT+FzIIa*J)y9A6$9n!JLg_xt!bW?~d%-+{s51g9Ci&G1&8dAmXG? ze2-J>tg+3+*x=7VuDaFMUBEjvAH9*9$MrX4RcLN6_d2hNEcpy|Gt}R03NSTPpU7%J z4VKCJqJ746v%bz(La=5`p$;$07qao4G!BHaCJkf>FA-QwggR_dNW>Ai#}^O#^;9|R z2~&A{W71*C;ZKne*|E-*B7|c{JpE+`UN4OAHEv{Vv`Q2^AClqkJcOq>4NjmXb7W!U zCTi}(8s**Fknl==vZCpjN%dm`&%g*>LfCmXA?y%mpviaXdL`i%Hx1Jn4Tu;Q&>+`N zZQp|l8Vs9|7&bw-`tVo{VfOjaK7~m-%siM%ibG-=&5kKsu#HIjM}t!MgIpHJ=m@#lOJw==-nW(&7Se@y%X733H|pB6U@$R|WcC)I^ z%Wd~BKf$lrlam&BPVzt2*RT-$J;sS7GUi|s@>@~Y{AlSI&Cgt4ip4}ZceSF#%4Yc; z{`XTY+8$#l^%)JmGVzjBJikk#KdVo2fTn-Q-uK)VQ2G~bGd4TYhItBhUB{|gC#CM z{{o9jk*t2rPuat~H&USd=LWG7z}Z@#GM|qfEQmX4MuHrz`QE2A4Vw2XWp*-Mn`+qY zogqlV@4^&dVD{Ofqx^=iz649ya2|vH;U*Id25ehk<9V}{$>u^M6ThGwPK8#fVgGDz zO0+QyuQN452KE8tcH5xe`x780?*7aZBimXoNffC`NTz3Th!~_FEirb$4{nv|aT_dH z+ET^ICX&a>_BnmsSr&G^;a=OG54B@wUNIRPa@DwLl&WNr=rTSF7t1*7W(j6-wV0+A zwy2>VY@ebDo(^rQQI?-jhJb3bV|3&e z)L_z>_MkM(XxKHNC=hbBJ78q`vgN9d{^j<4&OHG%&~vd1Ip#G(x(@ipFQwlfoB<0L zDeL>8={!r=8L3fZ(X)H+qwlaUHS*;6F?Atr=u-t9;Y{jqf#45yEI@icJ(PM)q=tEE zNO#i%5bdmt)-WW~`7SE0m;j!L$fvN}ar8#*kUmy#keuo0NHL{%C3_#30d&7qV9|n) zs0t&IQ^dtv5)4%4yn}Jh)vU7eLAU`Pp*LlXqP9gID7_+ivIk#SQg9_!OZFL@6SYr22*=>+KX>tJzIvU@XrsYvEK|_xM|dFz3IiF`Jc*lpraUb) zkpaOEA6*?i-%c-YA5ZtY2rnbCz3wzd!WJJ{YI?F2m0yGtBfTR}_~W=dOXvzRBfcW4 zqP(9kWQ~-F8Be|4%;>iDVBGk7*#FUJL;E65H5r=X;!>>^-71{cuG4jHA-T9&vSBt& z>kH52sk_0%(z*{_(Lhsrv*%#!&6tXD?g*On6}(;(cOuYK zU=>oE#Nd{T>XxU#HTvljfAPWfxd$(aBkT@GPkcF>R>Aikyi zF2}~buc~0jFZnWJ-afM51>a8nVc44CL{(KWy%9$a^H1gd`< zv?XX`n7uVdRgn!zc3w}u#x?A$JZf@J351JW=@`nAtIOl}hziB0jXuektkC7b+Nlw?HcQ!*aS0Gcqm&ppH-#{WJ;K zn}&RpcNi;phf}4y`PQ$>KsMh4p@v@SkV)3fh2Np5)3pCk-9&`H7QE1aW$oK=gWK|{ zb#W1}634(~w&a_i=1!He%QkgAhgNQ4+YV(6pTPPd#tIlz#hjB?L{R+?J#!p%dV*ah%IFMH)N$2L zuv1y!W8qrI#r7Ll7gnc|3H;yRptV^&UsE^wPWz(^L!Vz2X*ck=Vv5iqel$WECY^n& zfU>WE>K(2ae>I6?I;P(lvjbOtcAxMQf?ye8!;iP081#1HE{v1qh{LbDs{mJZcJsWO4KSA%-M?sp#-ggbvrVgIP-v zyk@5HyuxfC4$vdJ-9ZBkZK3I({P>n6w4uHE&okpCEhw*2!+JdHw4$c!UAurDoYSFR zL>pIJY#mV6Q6jU0yU--IY)@C?Jdx;uDB7>681V+rJIOTvFyoUN+iZ*!0pQ{ap`LNs z7Qf|s?@E_8T1VWSU&Y@XNV5C!RB)e!0#iagSCBvu>%ld+kjXpdi8Pzc9=FF{pqyZB zyImoTfGIJ<=>Ij^je3^?IFTcI0jnA~|*A{~`7Q7H?Iga9dFH zi6MVGle_J!`OJ}gCgqXgE&KO1O40eat=1S5;GvSUI9&vmb;!HG#{KZ`Oq=iH-;-01nU7$BVk#dSu%`$vQ_*oz_Ela;e(<)%#6roKRDdPpM zu%aET$0QLTC!SKhUX5cwdDwjYY7>#=Za!%IaWOD>EG!H~*1G9$F&@UmXe2tlLf-fP zVfCa+{$ExP@BTklkCX+d4cyUrf3#NJ=fpwe`{8)tgQ~{+i!wJHSl(}Q*PZag(!Bf_ zz=ndGG1L7Byf!xoimEyMZ2WZ#r+185U;sp?qD_wogTdN?_faOaZnJBNGeGbB{~~*O zszg+2i$w91&;Eg`X~=O~#|(VH$D7a09T^R_70eE0orhl`D&`a}PFUuCHPPNz9wW3& zq*he#BFKnIKHD1)5&pH^?h`z{_G>j9ra_2IEuxf5D<){<{-glS)J?Y@CM+;@48@QN zj-rT(t${gY3Qq#6cD_OzR=ehg&9(wYD|6)0ra>uEQF$q`(T3@t8$F=U@JB3S3P=Nt z?iIiurF-ae5ctI=u(qxzMB-K*t}qO z@}qKV@MRfD@?2dN9BlH&%;M*Rej21!c+3vp?{NpG0Ya2gLvR{idnSLkYD2_F{9JVXv^0sc+BpC;#S^8rrkh} z?4BCZhKfx034a83?OPnhL=c%PbyS!s#fPmW^HsWQw%c#Txj)}E+jps$~dUn?)4Q?z{>MJM`G&iZsXOT z7ELY-Kdw-bOf=>+&0)1!1_!wYfjDg`D$%G>D)C!&??X9W;qHGj2Fl-xsZ}l|R;7}G zVA1-K%weU|sAKs8_ifhIJkgbk!7n~_Q&_vp=DpT~beM>!>rg}U5jz@rQTOvoMLN_* zBjlICy!S>Y+No>5eg2&lQ3U#!gHGVrlf1`$G1;g;{8&pSr;`1KiAdzPalglfPP$RZ z_Y!y7>XvzH4jylzRPA=IyRVu^wu4Tkl}@=SFn@zftHnNZ-=9B{*X#UrPom#JT55SW ze<3>FQ$$&HLD!}|u9`!XO>IsJM#NPooxlSQfH@zlP!OL$UmkFEjs&K)&WjfZsOp}L zOo*1CsW&oNi}^na4j zW;aleuNw9%mT)2SD;Ge+_noyY=*qho@53u-%7dL)|DbwMwsh@+iE^Wb(37Ytwtdn4`L%WNflz)F2!^i6-fUO!Z)Tu|AtNh@D%m zEFP!Ln+gAmN7<14H+Rsyr%nJIG%{E1=)|Nx?E%6e==aaq;ljSf_Nd71rcIn~>TIwc z=P6PXDk;g)%l<#;M4OFp#bZy6eeMLSVTJG&W!{7~vLSo=&e*}azP#$#2@bEcg(%}6rXIenf$icvbp5G+OoL<6T$x}eZgCteT09kn+x=w!d89CMS;E2 z^x`08$$HOLYie1Zp}+a!&(i}BI_ueZEn}~NpLM!tkaZ-pWi>fZu@jZ3Qu(aPd?we! z4Od#D>djNfZpM}eJE=W|o3qWrNlK6>Hmip|st0@<$Oc^dARpDkh!T)(jvDC30-1WB zODPKVDxUt5IlpUBw{`uP50fmZXn4RWH9#SR)yIHH%AS&@FRuDcVtvK^=KFe%zP?Q! z^li6Z4J^bGpxYOZuXitM#Ot!SWMV+1C7}OVOvQ3!*_v#=R{Alvx460-`qyU0c~Ku@ zVP5;2XA<^{_K^VAwY`i>+@e92pN!Fz8vW(ZoL+~RX9QG=4|Ok@b#~D!s@Ai43S=-I z1M%XXYtTZa)pYV|WD0$!M%&om89LXyfpWUkf4tf<{AiX;84ZoRe+G)dP)nX-bg{da zIrsw&Ls9?TeOzRwMO*eci$}%#wYOrkIC&QMcw&?Hv8JFK6`z zq_LOB$CTOl$lp zg5{0Pv6!XsZ03kyLvv9|PFy74EO+<#IE`<|J#b^<6q6nvwD6Q>#r~;tZJ~)2fl-zI z)AdU@M5|{21Wma_G%i+ewKVl^emIzF@A$J>eoXOk?9)~UM>x6!i^G`fGLjD0WYP9H z^-h5(PTP7PE`6zO;&z2)w1v6wqw-ZO@4Uo^6xk%Tgm0k*J%oF5f%{;kyfAV7DqTuZ zF4BnaBKo;Gr0@B*@OnQ zK5QU!_3YunWZMOvXxFg0b;JIqES(gh;j-s)04-`ly#kNDd&`uH-=0Iv5{vKAzrUVG4-QNaH6C;YqvrNZY_dYO& zh9mcpL#B+872qNB6tI4foaCU9Zqu?zU=ckp7zhe$B(8dvAZBAQb~G8Pk~z@wtE?-= zMnc}xN!dh9x&k(Mt;QnLqUnQ$2EHwu|1|fi_)}_Tuh~mmP=Ez99%lDNY>&SnF+Z{% zfEd0*M2RBtMRyvR%!ktbi{KLPTX9mMGj7u=iXJcq3YNib?o_xcla}C+GERbX=dvX2 z^eE)gtiQg9rymMC4=~5^W;;yT6Gc3M=5vR(wJO<8ZJYga>v#3%O#Kd0%_oUt? ze}s|Z2b;GK@b%3ZS^JIFr5z~d(bV-s zBS@m8MD@A}C}*UW$aDP3zdyfSdF3_v`^-XVAiCsI=#P7Q{#6>O#A!S-pz|opj*V<8 zZ74`9{QbT(y7lbDA%g>PevMU!&kS|Ypyn$@JP#}nbaj5pSA|` zo&j>Q1a-IKV{otU(EVqb6_H-tUSv_KNw);WcIhfmy-#~agxR6VToA1g&rWq;b%$SIj3Wu zFWeO*FM=a0iLEIcci z;pnL*bI=f*dV+pKM{a?w>o#44Xyv?%X#L-WR)hsD@UNia{u8xr(pa;W%Ffx5LU!j_ z%>&l;aEUlsX|s*Qk@2dVL*a%89i9a3&_BM@0GgIKupy8{4;B(wRYD26m-cfv!|c)gp5>V5$JUHa%`n;zW`% z&IF9azc95cJrA-Us0YH+tZ&ddsv{v+w4!%j%}1p&$SY|Sf!nFBOiRJBeAui!QRPjQ zrE9Cocd0!*;`baZJ3&Gj{h{ti?#7+EaO-gmPc zM}VA=*$Yd^#q0pnolme67+2+Nafq_3OQ8l!{_Z{1_^pim9;`>MrFq{~11bsOty|kK zSx2Atn%|I6CERUYGwuTk7a#k5*QJK=jrh=}-E{=u=Cd4hX-UsWjH9b<)xWa#dsvs2 z7Sf|&1&ThMu%vsrm7-tYvGoy`cs^$2_ExJEbjE*ExpG;upn7ODWMW45M@fVFe|&o; z6JBF`fju)Eu`^Zfx>9roiY_*DfjnkN!1aM=Vy98Q_Uobeg~U8Wwj;Q0BT+0x2ETH* zaBh1u;3_R3tf)*J(&sGZuh^B${%o2Z$_m{;1oBTC(mnl*O-*StOr@kFVs^kb>P%g! z?khzS`mf_p321%M5x|wRFO{~F@kH9d9#N^6cms!lJJz z21vUO6S(#jWK_b2ZoS7GFt6{N2MDM6t*680&cI>Qm0lAD^n-!ps~D~41hNs0 zH9A|`Q4mU84eTHTKO%w|{9+)5k`riT;=6Fl#<#^v@p)-LMTkP|*_!9ac+Hva?XesA zJTZcc0e7^ws+jDnPa#{U;_+VvJfSKsra{p|zK;8SnRJdpLWObAo)wW>u4`PzGsQ5O z7*{IN$N)Ds!LRHKWaSvd`b;Csb5EbQt_+7wi?YJwipF*jk}!DUTvbw77ix7$zx!RC zmO?*oO#;T4%iS69hfS{lLyQ=dqRG;%0M08S|C1XiXgSWwYBqYJ%l_J#!DAz0l0mXh zDARDp%;0hHOLi)yP!dzpLn&f7X7}Jc_RS-4QY)~D&ZOB=ISeHA5%mg@LQFAass3!V z7Y-=Vw*9N;)U{Ux6QSDLHL*A50}U~tlrrO|Ae@~Nl&`*4K0&yth!tEyfUaP`ZJ5z1 zSJhaftxq<`i`Uj0)p3N`aRp;q2~7K{IoEmE2gAGSXU@zLOtT;$*u8DLodTYbX?9SQ zbZhKvU!9f(?P+pNcA}$tcfDs#1_aA@Whrniec^0t`+nal6Qh__)YYwgGHSa6_wDK7 z_yCje(7&P9uK|}P7XYxPHCQvU1oU(aQ3=&a6x(Z0CxXJ2wf=6iEv^%+LbLGd$q5eT z%vGsajgE1RW((onxUFsYVN=~cj=wrr2-X*1NtP3U z*9jYR1VJgJV7^D90z9b%*oxkRjiQU5mAU(U=(r6pC5W(;C}-O@E%)JhG29vHwMFJt z)S9|617-R95KBpwxs&ZeLdBDuj>Ys;KW~wFoZLBKzjD~ImAQ{W(?ufb{j^8jM5#Ar z&s)V$B`76^UIdk=Q!r@yjk1kKBxA$0b-!lZW^8PtNW_f#Nk^m`QqE|=4979$Rctls zzg12tH-iB@6pz$=a2>Kv?AV92HtIHI8;P6+n+8Z;AJIUf^pWrOnUq&?+Y+ zpP?k$9TSPsISq71HRLltLQ%C=BQrQdWmJ4_TF<+Rj7yOLxx5sMS%}ZD>|ZnvLuS4yJ8qUHU=vNZR^xd2 z1?Fu>to!=HU!tVOZtDNi?bj8@n)TEsVl2?$t(+dbYdSGsx9>ct?N$NY0)3}p1%H_K znqS&TH?xe|f#7ix!>JNNmfqw6TJY9Wd3sKu&}4 zU`_%H6M|@wM;TG5>P)x4iiEMZ^qS-}L4?U6Cd>7|@A`k+h!htQ>G-qDv7qNO8~W|T z^=F~!knC2_Gs)PO%(ay7nt_iLHY}NSMuN&TaU8LYAt~{O8NJ*HP^CtUB1Kg3G5D~n zJBYj%Cc=gYC9-6ADodrK*;pjJiXPA!5(&x(rtm>lo|q!R#^P|=bmCi^;q?n(-&xNBwJ9n!ElCMcHwQZ3dL57LS_G*EJjAq zt5wsOq<;viOlIO_di3308bc<9@$bShiJYaM39EPVJi0hy>n^OYvK4sBZn1$t^X5Ly zI5i^X3)<2~S*}u_vF`7Wv`wU;p|?6*)-<;LikqBF%wGb`v@9{~G@KPMGBX1Qwr2ma zwLiE1W0=1s-CkrRCjcF&=_3DB>{!>}OIfYCdH`HaqXGqM%cw_L8XSylSF{y6(`S^g?ybo5)6rK>u^vJceQK){#iKIDM+XY-!B^ z$N4jnL|H$lWs_MGd`yYWnFB+=x~17_NMzmGDb`B|vSIm*STL_zcpl}FA0ZLXq}(>G z;Kl20+7g&mJGK=xSaj!0YJ#UcB=@&SP|{UtiXMgTQ5O{<7nT%XiUJeFR0o`s;<+~& z#!r!>W}D~M+vu1d3n$w;=_2WxHOSQ56kiWa=Hr%;q?zOOdo!eqxfoRugLvk=eHlZ2 zwo_AhtQRTOa(cGW`TLuQrCKZ2nc5*ftfQzWx_DbEL%RTnjcRPQ%jtmo2UEP@8M18k($&|z2;0Vgsua0=QOIQ;KEgOQa~!OBcK8av=E zks)z4)kb5~SaJe4z5q&Z*~SBIoe*tv6@mfbvx_bIEw`H}#$%8ZIkXKsn+*ezSVWw^ zA-zZ6$^M$E zjp9Z(f>jaR)(gSuSXft{&~#VV)I1mpg=3`%9;68#zG1{G#$mF%n_g60TrLV!9(3vL zu|JtSvBkZqb*+2P!wf?jvf_~Os4>8WjXZbnND(dwuX3`_zw%3|(Gb2VlFDf%5J%&K zrjq0%*@fE|zgmU}>T9Nx5MLJgw_Jk&mon$&fWy~DBN=Hg;AuuD)VKygeD8Z2*%a%6m!icw*UN0fC55%EUZ*l5Zu!1OU~E9Mhm zNXiX^0?+}4jk6Ga*5umAUR4kl{iitNmuqr}Z) zYy!P`{u{2-SYs2>pmp#JPCAs*dxrR4hO~pzOp17c!HUI(SAerqGOjA9xFyI4qfVUs z3q&?<)nD|@h^xs?eOG=S-=qER{@Wpr10{((w z-N2<{G3;-+fqq)!eh|K{C(%RsAgOyuj_s(d-q4bqepz@pr_ycavud4o9{IV$+;y<3 zU4NSlZhVB1(gwb~^!*Y!J4V9VAF>rYmr8q=l!0QGjc61mP%t1RPCQ@E(Q{#n?a_X2AA%`R@;3Ijgmwa)0oNNrQAu8fM;ggLKUeu!+eK zHVxDMjsKNp{ziXoYA0b*(sSxeijm~uXcyjr3e_ousmk3{M1|V#!!*M0B|&ubDYj%g zpG1#PX@%s^TncC|3b&FGpNWq7_={qg+T^=oQ>mJV*0r(W2~YB63@N}Y0!a-W3|aF^ zJY1Rb&VLzL>TD~PQY)MBYWr5Lv66YX3z$ZZ`%O>9JM9$y`SW;op%Ggjvy$k)?oL$ORWze`oTh=}Bb0oL~ zenq-JKe+%_9A!7*m)@;)b^Kj^FP^&i+Qm80JRI;_n&<1paQz?=^jwmm2a>SREqyXAE2>$cF=_hqg{OR754YWGD^o3P_NOr~jDa))m!vTsd zgw=m+ZrL|$XJ`)<%6GM2bSXoI$3$`N^(!SG``fyPci>To!j}2igaF)3dTSU)5IEk;iKwlHAa?`` z088S?w$PzMAcxmt93FA^p|y|K6aLcuGdH^n{1GN4nAN71rm?ZFocS>?8zJL7!Y0`s*i;WN$?lzOhrS!LA)mj~ z$cMgG&%Xy~bK&on>G;r3yWiL^_BZ}E`%TH(jQ;%o`djN0#!?(6m^fhFkqU=V^z z2uEkb+Waq#Y5AyPGg`=QJioCRBI7ap8}zW5&TMRj$-4OP;nE*}3${T*WjucKReJcp zXJ19u2rwq)tgdEDzlG_Hdk#3V|ijTJ!oY(mX9#39wAt~ zO>F=5Wq>G_PRC>+7E9Y(|)0)$c} zkk4v!_z2OF!PzfaCM2kgIkbB`1GZz3?&NHixo&L8HKRIZpG#|+LohO}9Fd|VGg4y_ zce-OnF2{Y2Uw5Y>`LLJ6x`GW%c^4e+DYV@sLtrwH!oUl`CUcKFod}o=G0 z(r(YLBvi{Jg*^sCVm1L_mEb~ccp(wvp6(&uu}?0s{xx9$DP|I3BioI`E?P$HfltWh zUCvgsZ6E}Tj}#Y#f|JnLl%OlAgBQ>4!4_+euuEbHR?u$p3*|fu8Se6<+{6tFYKE`x zcIxPN?S=ut`cR6R9J=5tP6Yw!@F=Pw$4-KPRn1`L@j0#d8s^ zs{y!99Y{;8RLiY32$_gL@yuYRkOEhvv6;IZpSDnMk}rJX?tg4XP%2&p4Z;7%4r)%T zqs(R8_O`!y_|19L-TD&girW2(0qv9IwUVjqVuyR`JTD|f!kF3TCFc0|Ek>N}0+l@U zvPUrjSi4G+*=1#@|CuoeB!geAJT?!-!0n0mVQ~w6bln1U-2L0z2u>rnnLmm=Oa!e? zXNo30t*v4Z|tq()&Yl(4xW$@m6rMw1w#-Y96;yBvpdoMvoP|=j0Y)#LHic zJK4S8y;j)K|6ItA_s+H8ggfs5E74a+orz3Yg$SA+I*WPL+fd^HG+T4>#Ye|c)4JbNeZuodYVhef~~W)MwKPXDK`9}n99F!spb(5vf-lJI8<-wsZW zD=UBKvLsPNFHdwRSRyf~WK&~b_TTz7_8tg-hKM^S6YlSvT!i7-xA9w6Q3f!+G%1wF zh*-7f=j2x~{xVtZJ8OiMqNaH_p{AD5YL&*NFdI(Xw%q^(E;k__CS_=0FE_o2Qn5^k z=KPg+ERk~aY*sVRHhWRnTfhVZI7$XBzmp-gV6auJHQP6OA6OJC3>-V3OumX%?hpu% zchb(KBOOVY51pexv_cOL)G1ksR2`A0==aW;zR%af>*EYLIe$0C&xgLR_kAkl=Ye{O zFW=YL_ua+9!tWAjkN3;e)zgvw+nGGSsfkCd@0Zg(amS~X0eQ)P-h=uRBr}T|C`KS} z)cFzh*fMA=Uo*i~?;qv)QrCuS%u1m<(Eddo_(xiCG*oHpv8@r_nxOD$cmr3{Ga~)Y z;Zg>asK`vzB3y*IX)s(%%3xRxK_ksIo@j?{{1Q`vi<@y7b_o6o#&FM-SR%(h!cJA@ zFeOz>lWP`^TgI)jTAP#Ez3Um39wAK_T65A_rgB~7Ac#Y_Q?LAUotTP4*CKsCZIB-1 zOh|2v!9Z=i&d<{fM!F?k$m);g#nU>2>@-x+)hQXwW;yJ}1uz>i7s=bBIwXv*)ltaJ z0A@a3a-~Y3IVll&8oz2L)O0hL1R2WgEgO)_Xo+Z$7&u#&`2Kaorzt&6MiXx-uP=$Ma9zBj}~96w`0&U zLJt8i_jwI=tb7 zyH@8tb!H{ggfc}NcpXbwr%m(AAilVz)%kY0y@2)RpDu;T2?cW|i)t{{04f!U*}(v` zII}u8b45FkGeh5>j%d5!u%%;$E-;u*G{{&jx7*vmref`ZSqUZ+$M)U)S$mL4aQ<}I z+2$g+>55QZ<&^nW)u zWOI*_iHf97Bg2Z;yxlMk5Z$Pt3ymvQM z(H=%YjIiuJpauk@7E2{a-B8R9gdmFKjj1teOmo+@9eD$kf~XD=+@x+W^2P~Ek%CO> zX(sYN`;2YdwtdF7ZJn`g+qP}Kx%bQa@_xKzrMkOPyORFX>Dqg( zwefD*0vOO>zSt)pyF1zm=tskIb|~XgF^?eMZRQKw==g}W1<`RQ{GAFyZZKs?ur1c1 ziWaJbcW6`4$29WY+Ok!B6hSNY`?nLWO*)Z8wkG$SZ zuPV0g@>g3fxVd=O+_m+Fvx1!6mqHUInyQ6nJg_-kjUCR^jn)`pf>D)HRXbj5oj8$p z6%k2ni>pAE{t{@avFp!v7JPc#WykIVXqS5xHLiJ$LWf%-eL-&EZ`QMVn12B@XC4QV z+)(zR7Q_>A*jXxv76@2kRvHPfcr!1~80CdxA4zZ*)(rlK95lhzi#`Fv63=Si%tVxGg}fiLC1P)dcsKN(Lu@V9FsN~k5OZg zao=OD*y319x4eRmQ*0+yTC#FRSRP&$z52%ZYM_aL-HG*?p|b}XsmbM0pafUF2=3*t zoy#Z!8S&qgj|(`aR4L5z=1z`1@dvODpvdObu9>%xAyBqQ$w&q0*|kr!-IYlT%-(rWJ>&@y^oQRJW!}N<7}WH3msbhCpmn6_V;G!P1XV}yEB|_Y8fxvq z+Sw3ZokXT5V|L@h)(=f`zD_Z4vw>fVRKu=X`@pa*vnzooMIqx-CUNslNY@@vNxCd4 z^R6OPj(W%41A%b>nvXo*S5S%zyTlG!KG)u!VAGyVDW}V1Ejy!!h<>G8ekkfoV&uo0 z@%yDG=aYl&=RNt$LMd1cJn2D5dO)A3q-wnNtly8(C{mdv(gHCE7*cl+TR@Qk%W9r> z2B};B9baW7FVSYM+m%_kdB*2<$kta@izYi3hHh?h)58)tTX1EYtqGEgm`+{c7K0v9 zjcKR?1K1xC3}LG=N*nFcRhOYWop`@Q=sv0#gVOy*z+#-(^R=A}qkG{B~2a zJ_Z-COX9!^Q6?$r1WKE1Sw^@Je9AEqa5n?eFZBuYNI*>I-;cmV8xlI=Sv0v^b#)U2ymvQatvu(x{6E2ewh0g(CE+w+{ z@^*p~<$?>efpxlJR`h4JjQ(fOFn{?=zu$BjH!?$2iEf?Q3BRpfEn@G-?z)qzee3f} zv}RLGmz6UeURW9>jiYhr9aRPcK{&XeLgQ;p0xD<@cipHrN?J2FP`54%%9B@m9!>s3 zkT(5P_eKr+gYC9@kIH9Ri`z!~7>rGYC2ax95*-p4E_X8 zItaI4>ZY{c&uCb2yhhSFz~Am|rxlgJXA`>~_i++L6Em2H9ynA8s0dc?Cq8w(6%C3T z?z(Q^3n{Q=H+>)QWjCJ@;ERi2pcq_)~*3$QR{XWw2YExN2!pr55FNQGKY#Ljf>=ISsC1EmHh1wXuAg zUnKWL%xn@?D+?XUUL8x{?hJqH{Bex+34tdVNMOo1NfuL*Bi-x4KG@9i$}_GXGzX_I z26x2mk><710^bl3nkxt!@_5cBo8$yg{1*{fHpO=taVMV-`I>8pJR~3Pc(t1KWk)XA zP&wt!N}`z3eq0{>eJ+??OYmUjII*%UA2m$xH@Sk$Ui1AT+x)LkEm{@dFNrISlh8NZ~vxg$;QK!Y%`(Ovmf*7ef!s^P*@6 z{<5l7aAKt@KXV$=ur0jy%NmbBJNmtSE|WhvQGQxR4nL2N+_%gXyCa#nUlT zyZjT&80snHAwD~v_iklcpk+wJBypOu$afnAH430$L?t3*q*pJBt;SAoxof~Ed~J#1 z{gjC%9;3-u(V-pHUw|ovy5--5fV&v~Lnw~^p2r^8q*+^$TDqLN{Iq>6@S3SK8`i_u z^Sv?UxAl4TYc09-k+K4x1y{9o#8SYSeIMMiv-|}_`N_9;J94L?9fp%?VAUNes=)H~ zr}`Y$-dGj?ye2Qb;&V-Hzc|MsiaYw_RAz=Sa8A$bqD7E2!3wyuS%KqI#ij|MdoFeP)x0u^c#cP_A#H*IlV?rVa%)+-^R_30I>)TeW- z>*iBFAQ15jD%hK3LQKX_0@;i%yUjc{>&XJCNW-h&IQD8$M=#@s#jYpz%ON{H%|r+j z69|bk43meHLOjizco_y+?9`_NDiv*b#a5aHIcXl+S2Hs`ZwfUVqXkah;aGWUjwMmi zW5)0^-zP#_l}c-Ncg$$|1- z6nk2_{Hg6_d3|oO{MU@i=IGXCU00IH162hNy|#`2@EFEBmOr*8jjc`VeP?5Q1Pq~t z*4RO#S6$pjonh0eceHM|&dABkJ%Np-t-Dn4?0pbPtc{F)TAsV49%@ATXFJ%9)3F_f zFNU-5)EY4*LZXgo=mh%2+-_LVs#qEv7 z-MPQc5+Of~RZ25jiX>4E7u23}{nim;HqO6MC8O=8w)+TMUF-qBauk(;fx^i70@hEZ zv^ndS8Sc4zVo`_G`0P-|{N`f%^!w)3-_WW^QmPu2vpEC{Fk+78~|`=H3h6dN|f)UaN=S{ci@h*l6f)xUsRpLDf-O%=*D&wLS< zddz4|%0C3}w3-`5!1^3!Qj+lnTsXSsZ?1Mb%_iW~b@y29V~K?^j}<~JRi9kn(xpg$ zT9(#Il!Qs9>Rjy%j60w;VEkNV2qA`Dg+72D!8-&_F2h0Le#`%5K%!u%J+R3Gt4Ygr z)y+`cVl*OkfE08;3iHN_2OYPi&qg7*r`hG4LVUL*G3Eht+!CB&D8s`5#?+Qay12z= zsPz&`ZT@Hx;wD1S1#4iAN{PpE{wLYogfkUO+SG&`X!QNes=Y7p(ls?fK4$wdbliE`O%pGd+P*e6a z>VmR{fID@dv5RNHpFbLeT%2c7Tlw!BIJ%V!ilBvY^b!f^hal}FJTe-S<%VPTi{~Wm zxWF%3vLy{{;`k)*+s7|u{^9q+z*>{hHQ}}pe_TY8q?}@`>cf$LXs29SAKehN|MXq& zqU^7&-@$-IkY#2~C69^{U8k^n^qGHZ8Y`j-FuNMDu{&#$Hl;;^3&|9dGYYdQ|9Z6% z1R`}4vrq*m)vzN)Cf!TRhIQRQ3!KQP%1xjM>?l!DFDNQcnFDd9Od&51et&)qk$v-J z5q51ch!9gJYJG`S*;^A=MV9o}CAxV7zGc~`>0n4OSnbpWi+XjY?Yw8NCqeG^&-8(B zYAJsZ26M@x65CeT1d!^kUq96ZRD}z3=;#n5$KX|E%L8}c28tB?GF(74(XcVvVv8{9 zQYL2JBNDGlP^?*J+4;rPK(%ly;WA@<|L``zKuCSl>wp(n3g&ZtG5ZMkbidnrJq#pw zko(%06+$Kd)~^_U5T>XsYxLkS@LDCDZmfs&_hRVw>#yOCHCWLXu6 zF<|RF_9bS~`v~P%g<5|qp2Si8q7cIU*L#O&f9;)Qg<8kO4!h*v{c`H;|A$NBh!D0v z2oE_!b%8Y%R}Bygkd_y+!6kb}MO?r@0Esgmi7*mSwU`lZ4YRql9uLzgssQ{l9h3n` z2m_fbz@wNWu-DfL0w50yNvm^5Vc(gA>K1jFCkXjY5?7b8^eCJ=%OPh?s1Z^Z{S*N0 zK4EKgQYqLL_NmsP2GT-NN0~i)m1#YcD>1A4$eXdfc?Ts;dAsy;g%bB8>^L6z6Wi6J z7qcn$47T_1q77Q`H5hMPDY^CRZYtZumlLlHeA8c;?b?Iph4UT$GOWOOs~wqq6y4D-yx17(l(S2^&HSnXj=O zwtKF^^iiS;r`_Q{)D3nH*c$``ZE*Fe7c);9aDGIWi^Nr)TS$(!gUPR+^eC#$4{1tq%EeVPewIn zM#?UQ***xD;<8U+DvQ3Oq{`&C8}$8bim3Cmb9pO=tx+e;375<2G&vV_8TdCeH)-*K z@xI@ z$9&{sZd7)v0H0)r@&lZ%qciC0tEA%M4F9^?V z0<(ZH&iJ7o0@niJe5LGV4csvi31k&UA9~R_xCrsfx;HlGDbOyv8Sz*A4|($$3%4c{ zEQ_W9o^lJI&K9iOhO6Ta?X88-6WUQc&Qo@n>30{HyS*@VW8@X)x_!|ToNTQGn@-ZX zXkHj(LL+-(02R>y28AX3L06BBfVeP?s83?Ya1E$aw6&|NcZOC~Z+$dQBV@?X>Mro; z)&MpznLTrc9z%qc3NKbH(<0W_VMIqaxoGQK*BAj=$T`qb0mvH9(Fi#_Q zb9r8jzt8i+u9B(fi3WUq{TrjL7ONqPe=~knAql02$3`yj`|(@|98CQR92_nJ_^efv zsG{ghuIt&ZH9Z2jrIf+}?cG2f>=iE1luhWQaB&Pv+UhgV%G@4C;aX92LVK}mgp4$& zv|$TLlW5vJw)|fDRx=jK!7HubtA>K-(2vZFg>5nU+!z@YJ(h8OciExK52yh zcl2>=8hfogcH3@y2YvJ2VxPlD^Pb* zlmd5!S;GF?LyXbm=AG+#iId0=y?ivcFfSTI+l$ZDRq0`qg3@SkkX_b(29c4dG*86i z+N!TYGeP8KYR8^GIp}Q|Z}A!t^aM%V#7<|dDyN?&9tLgI?abw64x&&vE!v=y^H)1y zsV3rFAx7FJ5g+m1yuy-y(eG|Ar44jy{D9qG-Qvcbx4 zRV7*M&ShX%;IE0uuZT&kvUYME9PWxh6K!waYEpTG1^i?0Trk9>_|Au-w3tz@zkXF)u?aw49usqF^mi=%VvJL?p%{M z5ihP~4-3E2wO6cLNZ5KWMYrM%NR1-r=^UJW8tU_buX1o==fKe3bV;MzB5O9wo|=}L zL$w8_%}`alHXWNrI&Ag%WSa;~8a?U@aN=FC^6e*xuG#|3epcKi3p`Q~=28Qfqvvee zCM()C_IXZ9^#p>I3Kp<)pu={%H)k(mMK#uD)pJ#I-Yvz}&$LkrK9;E>no-ujgE3N` z6Kq=~=U!$sV-nN*Ooo8|0CDv1>_L^My?G*`Uwq}&U&y#Aq}txQO1lsQB@dJaEi`&@ z(h`t7kkiOiq&>2LFpRAFBCQMk>Q63pE%D^m1q5S8m+T>oL&(JYSV>7>F2Ty%QLcbJW zmXXya8La`v;eepG!g-c`AwA~|Na|8cwi2Rz|-kiGl)*MRbb3+qt`5yx_<|EfrJo+dPR)GsUA< zvs{n8?Zj@1U7c{zF>Crkv9bIyq>~X++;Ecv|Cc2@HdeWEnvz3mXh0y_oG}n8oVjm} z>w>8@#5|!G(AdGZGM8BrucARfXp}h`W5?Xw*H(=68&nKYv8k5td)Y!*)fs!-| zcBSw3xb=EJHRQP{I3e^IUA()3o?GY5ds1<-|&Y+2Kx8BuwX7ITSkMF4RGY;DFvugR+2w1fN!EAdEZ5cDQRPetY-`3 zr&C8^CdxdFR8>(N_J^fQVPB;w@E!g4Um?QWX7vWDNW)lPo_9dLvW;czgkY85@fI^^ z>=LooSnx`r442%O<=q{8Rd6fv-$i za+P7JC#&p*yl(GlcFPve?kRc6v%f*oSNU9zpN}Au@C`K*ceC5Hr{a7lwVSocl)};h zaZ?n7K8?C25y=oy!og_OVOk{dL9IPXvd8rNJ_S-CN>Ey~I@S?1#-zLIWa3PP{hwmv zw^5wdLZW!$7lxb5g)Co|tk25QExWf@-twcfukaXO53cuGzv~~C`JeaA&&5=g6)%T} zJD`rhN_${<+K@Q~a@eMY=nfI!0!v$P#Lt|$4Lx(QWO$} zv6v_rAmeFi%J;-n_%^!~eC?CnUocLYvlty8!n)QO@7JC>FVvXbz6*GM#B3 zxxz8@p9cFu>V931XHf5$)sJ3MJz*N!XTo*!n{|`%Z|NcqT@4I0sYaYAIze z)Tf1K{Qx0J_ljwG?!YuY1CY9Ia(70vg2Gn(^*S}Nj;&X}sCzKg0vS5;(RnJ930f=$ zhQ6qrG-t^hxNYCC`pkz4v-aAVUpl%|CuK|}6TPhq2t&~^^chb%AJW7T3M-dK@RafZ zazov$Xr#^#f{cyeL40{|{L7tPbWUj~lbQwdukw+yQO(zbBOd|Gt)I@r4Q72E!%`1{ zGpM(o0Zc;~vHtSVP14p)8L31TY`w6RL2@e%&AN!{M&<8ISU`naDyIyov*oP*MQ%0c ze!uFlp))%wB{MigFJE6-{nJ|-Gv%4fD#@wa(Bz-XmrU8|X-7#+#m)O) zQ$4tV6wg~SwN#I>8o03~>I{h|`1r(1cy}H*^D7{+`BeC#nlG@mm6-nL4tCaXdQH0> z(CQ7ak|EjnT+$<#N-enuit;WvF10~`@jx=jh}Bo9vD<9cX^58UNRzdCGR1Y*jT;&H z5h`%uq}l7ZXIO=RandQO&*KP=udmA+>NOrrM~$0gTU@*hj_@+Ln{65N8~&`^PUVlY z{l~2f>P?v&-5#%>gN`M)1=(0TU_T}9emk)Al3NtFihzDF`AoOzKAWHkjPwu-v$wTgZS$YfV+8P~hZ>Da{j$ zq<<`?7O7VK;}ledoGYV+sv50qMMv;e>sq6Mhct>HemcCY_|Db`_TNkRah*4V49zY0 z?L}Yj5Epitdm6q65TE3=y6{|_^_a=j=}o%>!_(I5TwE^eT+PMp`iyWW90tZWm!Dto zrRb$MJK5bI8@icfY~)@i_}ebLHGXyln_iwk>ORyY+E%0GAuI*dF+@aI^rHn^ zjZ>J(#{KG&#+ahg;}+>8&>N?DPZQ*gq;Cc~PptV0Is!aD*RRIGb0J1f5CE%Ey!IG< z^1iiiR+%J?i_{;sLFB4Hb6lJ2*3nM!b&!A6*9kZOT{W2gOqNV!yQxB~;g!s&gZ9cC zh~~X&d$p*!gWd0hp5lbD+X+nw6C7PQOQPxY)`+!CMwS?z(9_eUI)n(`cZsJ&*ewZ< z?Wf|$14YXt3a#?$aX&_X<1BUH7EN51N^oJhQJxW7oV1&6c*aE*iqjdHku;J#25w$Z+rU_^tNt* zfpkekYVhbeY||y0voQ+DtZzLf*AABgj<5A90|Z&+5NXdgfWV}=S3$td{P*=pEwgPe z1JxD|_@g6U$do6%gGpUi$U83Ur{LGdXa5x^HRM-ctls_e(r^I$s2hl%73>|9d9M9$ zc}+ugEY^SZd-e@gHw?!*hDJoTHvL12b1WUj1WyGVC92Z0__zSFLYhhJ&apEIR_JLY z4DWa;O4P_HM~z+xbV}{t^6L4fhH*O5uU7}abEx-e`-p%@{H8r?KGnpA<9tkp2U<>**2rw zhs*c*>GcdBLcKCK5iGrFejgvDRI%D0?uXOD57LUItB)s4wG|(+0yrjCq6u4CbPD{o zB?snm2l5f#SMBe`#gUm^>)=g&(WJ#Z4(9!1`Y5!x0$)XsvF`_z-Z7Y(#GYCVo_HWF8WF5_rZMms&2f~n9ZWt!BAXYaT}9><;syxi>X+a=Mf6B7g}(ePv2DAcxNuqU`VdfeP>RY$oGomB%& zR>Cs9b)~K)C`EM9Ldc|{5L^D@wvoqz#v>tDzcmrQNyW&vY23yW?wU@RSO%v+}_+84~ZfjJ( zjds>O18ZHDB_xPy=E^>Ki?{v3N?yA>|9ZaA!`7}OHY`l&fsa#wxLa{GARWN~-OL4} zG-xNSFbnx805tEPp3%Syqtl-5mUUZa(}Htaf`N`I#1;k)oe-T(D57;!L{nM$;w&*U z3`rz9qAO!^0^x{cJPy}#1%xrH)L4dfCpB2~=jrCKwW{dpn9o&R9Z^NMOo3nK(F3uE zvVY0S+jnrv$>kH>V7(NdjIlS@O-!_%WAR;kyv&@Xe9ldAR%M4(TRB9>uK{SF(qF*t ze(KYlE8TOvyhf2TP63gCK4qxMmpPTj(DisYct7v)`L%D65^8t1xNMLJa&!SM<`ZIoM+*_4XA*S zmRw3md1Nm%N}Ho&){^OhNFtb{{Z_1dx`aKAPHv4d{6E5P3tl4DNZ{R*Dhdl65(0HZ zFKo2P-`Sn>T)BOl-0`2w0d}L?Qwj` zYfg66_)X)g!WW`q&5#%nB(%e+bwgSa5;lT$N4Yg zS<`b}0-oD-a2}L2B3iiRMNZEd>PH?C9^6zPJckQeiIhlo5El&&$Pe2gP%JJpTLE*^xJl9o0yRCg_rJV3Qb0M&9+ji9jT+5%Tae3d#&vKFM{M=H93%01Ib#T7}vrJkaIdz$1T(V zvc!asHkFGG0Jxw%0;IIcj9L_+S!Q#FK%F;Kp#6O8ymju|s?(R?X=__DSNe7Ql>6W; ztPeaGYR=;SexcSNr_2X8P>5M{I_(hC#kvIE&ppITFR%)WZCQkA76OsR{K|p$O=wd6 zX>GV6?DA{S*evX5K7L;JSLXWkUS9kZQA=5Z+;%%uXgBW zbiWhvKi`!!r|oWQ^3=ZQ#{@TU%SxbrEenv|AWAD(WiwpbtxWDT)EiLlzM1@T1jTs|SV&_hk>+Y20w2y1IzEqvxYV=c2pIe*N(jV+YOo8v?RERHC{p zg>xA@j0Auu*LhW%MfKtCl`z@F=IwBAF!lks+e+7uXu z9{VisD}pH|v&q0WcDYOX5?Llzw!hYnD(~fwYb!vuVk(h}oLNcL`*f34(405ezACKe z+x3!d)-o&imx|R)W`X{mtz;&@Sgcp>Gjb`LkS46*Xy#Gn-gCieqytzik~yH;if(&b44cE1#UgNyp&D#L`!BrvkOWwC3_H_T;B^W!$L!6JDs3iw* zN5Gs^2iL`7Nt(9R_rIqef zsq^~1|HXYzoEf)bEl8&>_}uez_cSDUx{2rrMd&3x+-s#OaLvd#RHYHEO{u~8$2~Z9 zlDvgRO_4+fz0SR^rRw>Gg>NJAu+{WKh&*AWu|2%?xO{m*`<@fo@y! zdxZBLZnW*7^LvV~w%s_E%3kBt*~sqNIAP@p$i-{pv8@uaS$Os6S1P{}UjU{s`93Ya z@+^dL;S|Ca^ec@QDJU$Wh>%v;yae=6KMCoSjo3G47c9DHnM`o-R3uKN_})MmWdaFL zS08i4erD|1Wc-ma@7i>AFCqdHNIz+!_NM<3uD51WTLc+Uf+x84n~WgsriJvk(hqVF z3NWfXr3(lfgMV7jbXk(-$B%g#q57NPpJ{QeFUz zk&numoubSdd}`G=1qHrs7cih#J$+XgCGg!b0(QR~>alYrLtiiO$Lz^ASFHfE*O6$c zS}}H$Ml#=E`-dvIz?KiBCq|>E?mZ-7He8W;11)^<<3QyXzy;VVknWjQdT(||0510N z)jBF?oyj8te;u;#<)Ne+cAlS=EqGJ?IV6v=^94^H_HK(W2=KAdqn&rA+V_7`RG1$! zx*ngP>ivq{X!7}#Xw2v)>xp$U7Uc>J31~_Rt$TzjN@>Pp>pFY)#bB;WIp|*z0$2(v z=^{7OOK=bMwSeNNyN96hR|m)kfN5cg&h>mM=k;FrN4e?s(< zz0$et3O*~UvY2+b=M4q=J(y;j-D3fQs!7*s#}6d4b?JMY+Pe8w{2J~6()rRH|0-Ug zDZZ;6{Zl+eIL8r4$1WI;)|22% z80_KW=fd*q-p1``|KYWbKQ~BsYqR!3FTz(^iMNStG~0Caf%+9If_bpN&g{tV1n|uO zwq!<&f4S8V(G;t$N+`djD`FBUEt8UbC{)5XIb}cIhUT}v*`JyFTeE00VY!c2Rmg1O zT+VN-G60&zxi>KGk*POAB3la$WeDV#tRtV_+yAm^lb@3wx*EEieLWpdMDfu3(_}VY z4$<7U&YKhWGVK%BGnZ+(q%RzMHe5!*aO_FlFSU_Tzz1$ejYlLhNz({`H1IKC=ve$c z0VW<4Wvch#g55Bzv8#?Ljs87p88I3ab# z;z3;CfSuw19chCabirCb8D+-xVVo15p6S!vMo{d2WMw~<4iAZEBKk?9AcqC%?(IAE zte(&oD1`P^I&s-6w-as~Vnl#?KF1wH7di9%McQ97l z4-8w%)YlE0xK9^g%Cu#1dk$q8bIK9tfKt@&P+zNpdL3}B@E&jGdI941m~0u1?m?{o zd9CR8al))g`5a^o*;25VLAk|j$`D>lEBjD^^$p!HH@A-5DeRwxKf@DarVX=OIiD-p zd6*M}9^{sykgJ7jGDT3+`oes$B7=US?{y-MVHWW^6?ct=U^({~Ig34!xvV%LrI+9V zA;J@3@)gbo$H5b@lj7t8rhS&$X+lc#sWfByOqj2;|2d$~F*28$X?&FRoirh_)!0r9 zFW#Fh+OZQFu@EEYQFuufT5WlM{w_g;;ro>tKIhWsl27cJ@#6FosS4Zk_VKU~c)ria zb$%E;juQs)y8r&=8RgetGPs%t-lOP~6Xn+e9$PVLV4GC9qvk%`tf)c_AW z9ygZLgDzF<67Vj2iI_VAzzJ1BQ7T`{Y3x0R#T`5S#5<2X&=xM2UTgf1?Easy0pL#c zMAs!b`tFX>V7OZP?~}|JYq-@|yl|g}F`Rv^rwHS_zks&9O|==fTpv;19DWOOYUT`! zhL0rZZuh^%3m*4%XkvZ~rmdqk2!v2q54!&aU;HOT2M@Z+ThfX{>WN|MNkPx$z4k9y z#_48;{x3x3){fd%{|j@<-{t>bsQ>S#cse|rIyumG*}v;1VEICM&|NNvO6IkB?r~5v z!Lu$Em4ETr-7cl@Z!f#j-ydiz4vC2& zSPbF_4yGPa{RrUk#ArbPjI#$^dLSchW+!Qzo~2ux!_b&J;N}Zr<~NnrU+Us;MUPPZ zw%q4JRpY4w+OVU%`JQM0m@ALr!A9fBV+D`(^E@;(JkSS@sSbRsAnA}2DI`)ba;t47 zgT&O|Oa7O&K!`&hX#oaAtM8!9tM%)UCD76nuX20^)6L!f3>g8OZb!TExEnuk`T{UD z-p2~%SQ;-Ocp|WvCY3j$Lr__9IK(vwBh;H3{Dnl=VU1YFkw^F*y#!T zzm4yTbw6dM&nHZe#CRAzisXY8qsGSNLsxZ)tFO#Bdx}AYsoRiZNP1MOE(OAun_r5O zD$t<7ZP+Htjg1_+RD>|NN#-7h7nBD285XUG24NdT$CAk1hewR@CZsxqt*M7bu!2;m zBZ8E=UK-am5B&U;qW3l!In5wDiY)@fh?mMeXjrkVq-CF6g5~xy0(_R^wgLCVgiS`C z<{dmp$!m94LDcAOigxVD=;#-2_%*}`PY2^w^jvscXTp}%c)CDRT|B32+GyGnkeA0w zp9Q1w^?Hf-d6>;VVmQ64Fg}L|d{a-Fpo;ln3qH2sdh&AIz7q_5#qGZB0j>iBpVSHv zWWs0sSk!2}YHlV%IaV6n<7X9rrzAzaoCY*%s()TV=yIzS)y!RK$FEOJqgtFqENZ&e zNc_%aQ_oMMmX}^?$Mc0?ZnP0KCI8P%!|zPW#(EpkZ^-Y;E|cGot%i{ZChyN03BkT& zc6>`;^Sn2L6Vh5yE`q^N@}un{Kp^U3rE`p~JuEK9UVnO!U!Vsib@KArz~#24)X5`3V0Q zt2_KMP9DM!C3nDvl=_hC|3|8>N>({_AYJ#Vy6kaU0V_E!u>2>~gFg&~CN{VlUV1=4 zl^cpJEhfO4b4DM)6?DQLL~8bQo#@6^cn~MdqK^q?jYIAwhu30;zQ;I9&0?%AXo%e3S1brRrkN-`w)=VW$SAzzUK# zr$MeQ_#Gi9*lwlN*^$dWjz#&0AtzK5_+AQfHeG=!sA1!F zEm1(eI}xsV2_ z3eI@N6owu3{w29s#ZnY7r38%J8M;dkWUS4!mXd(#}r= zTA_LhBdFPJh?J82p5X4(fzJS=DJE!;J@OHi?DVt|rgT2Oc;!li(bFIx)JF;T%4sm7 zm-vR01pM0+K}?!o^QUkYmN}Pr3g;&C8XI36ZU{^1cxJ|y*ex%J4ql(%=H}R^rH{rq zCf1VtKA$tC2TSi-4(tpWOL@MYB~L;EbHi!ObtRalhO)GIy8k#6N%bD?QCXo%FuBo;b$KjUvK*p$_!8*LlN1s0~05e$@PYzb+qS;G?m99n6%XP z7(QLkP)(%mwCL3Y)OeFB;FtjTH_}`Fst1Mn7|!gJlawkKI))zFo&%zdIbstx<)S&T9y#@kNoE6NFXajS~f~~){#wjBO@~Zz2VH3C{*=v2q zuhH_pUX5&lWJ5P*8;?FF>_^w+ne%udbNp=?d8A<_h4x3YFwr$J+h>;XYnKbe?8G{l zmNzj`hW68#hlO;FtUZz!MkIY3f8)Z#=OAzaw7P$=ta`4F(T5hg*X~x6r`_{d18#>Z z`z-}qmDgDtf(hO~Cx}I4iF=*g6`)=TcL7KDd0t7o(_}yo)Q?HibIbbhj>L-6i*D$d z$?0k)_i@LZHzLi(Fx=-+Hp6d)E<*9LWw#ovmrEO3(HYKL&Gay&V&yUwt!PKp!z{{w zI~-gBZcv&@2{^ggt}A%QiRk+QC&)zLG#S)9L>^p$NUfI-S}ErXWj}NSRaM2vyL47d zH&>hUJcrVUqNm#~{N*wdG94DW57xmxYX@%pG+0NXOSM$|G;XKLMI}mJU+t<(|Dr`Q zChHrtQHYQRZczZ2F-1jLfcx-=Q_fr~7W&vBl;F>y2&e#6#8)Oaao>2PRAr#W6)|&_QQ_rTORKoAc#BMPWeb&GYDT0flQ9 zfqtFVqLAXP8dKad)Lbvk{M>@yl;$SFpFy~BL{_e;cqu0!j$wlA2$pzweqOhpSCcV* zo%1E1>t5R2d@hZh%IWz$v5rCxU)sC5u^+P(8^!D4D^R|MD5&89W@^HT=7`GMt%~akbrRg>m*$hNWnd{WY zhwe0?;>y)O<#Wq=W5N2DhEDW%?s!4s>!v4%_X8@Lq9T&G_3Qr8v#1-#hqL`)$QmR% zbd@=k%a8me>G6#?Q#_^cOlmcN{W0j;7c z_jp@C-kE+hAv*rAXH`8SV`CHSJfI~arKO>Y@HzZqNxKo?!_bJdL}Y`ez%7^^_KovS z_~;n+i7G4EVGxZ)0u4kCj*2~DTO4R+>{4`qCgS2oT-!f?4-=47rr^SIEpWMb8x%JA zN+b%naCw^J7%4OnPIKj!^)Je!u~l8`tmpEzpj8wZB*Zx&SR6~mE?A3qrgqWtFgPtL zD$Zav)jwTidH1U5p8OF@jsDcQ(4hbwN#(j|f7>hGC2%oE?d==1ZoSly7TL8Vse=_(vvNR1rY!rE7U6r;MeZq(EC%Z( zo8!S``xdMoHs;JKT8Nt>Q2^aF@sQR@d9tK>&;X>O<|m7aeiNtNY9 z7FA*+CFVTuh>F8_m~MF~r|0*zv|if9o#<^3G@2gvQWW$FHjdjd#Xil@+CGAhsF#_HwNWYAb!H2FVaBfb9zzCc00r8zULK=AET@}K`nzWMLJ z{OONRpYE$e>=}va;y~RB^^M4KsQ>EA@Cg=8_o%r0u+jJEsolT+rsa1JQPO=J9}Nmoc<6 zA&YOHe`9Fl{dB6{{6fQJzaY=PJw%+`75s7)fS@J6F9_`p+`0p|?!c`(aO)1-y2dQ7 zij`Xj8``_^hX6-?@X(%SI)S5~5Ij_g5P?&!UahGx;D-l6XYD|(U1QkFMy(5&o7kZZ zk+pFp)@T+Y@TsOQdts5|%6OE5id>Rwp^hsmBbLVSX&!@UUCfk>n0c~+3mpa-&QwVv zb*lC)nl3n3+&Y6(yAC4Lp%+{AY&F7*lI#hQxLWK81ai92hzqL)t zcJDKmUd;HkLtV8)eLfb{XK3hDv=10m%Px@WE|6-o${p6UR(4p^9o7`e4r}^5z?!ZS zNVSp2YB`>&&CAnw$-4iTt2=aL*BG`!T3ZUHSjoPIfb`=#Z31t`r~K4HEZ*@Xj%Xfl z4)XbqjYA)#q161Oau>P5KfIamZenQa*Fi*jPlPDfX_X_cE#{bhTx zHT~E2{2t-4|Ki)Z)~H0O?GlGKSV7fXcY_1Cwk)#AebjC_?^)~_qjAEd)Ve57>YK*fy*dERtg2;i8K|kR`*i5P zl6fVzAqS~Yd5b>@5cs*^x?%k>j0rti?Mi?^)JFi}k@Jbd3%q*768I$#jAsHvj zuUTASs(GqN=h%HKjq%!@smLu%(~9*6@H^% zc)-QY%1OfI?42mi8I2dmahx+LyB0BQg}Ul&OnK*Py@p`xf}p{Qb^U*lmu%c2)~QE5 z)7qsV>6vuiawhnvh{w%|Krt2!_*Q`DsVvlC2*#3Hwz8HgK?0taNx`#(*-z#2wG^%&u847ai4 zlmbefTqH@qaPK(@t6r|NQ{2Joo5u@xnC>;id3Q`M(37X5+N*D{mQilf4!-)IFW!B7 z^i6Dj&V=NJ$QR%}@a@qzRuUXR!}#;_Zwh+-ZHFvpQxJ~7cs~AOxKu@8Ro9t3pb9-} z>ffUZZKJxs`AMoba*s2Wl}XZfDGX)HrWP}6j)$*$2u2(=DA{_=I|ePZlKJ1UTM+(1 z;6I(d6UAB1Buk6V>s$McFW}R@D+6|@<0161XAixI^D|n>@mxOgw&_LLi-KO#gr{w4}?fuBpYuvi3Q@T$hk&fsn6Ycu!UKd2K zRNIHf>bqJx{J!O>;zff*mFAUVxyevjzIVg{hyL>AMkj@@UFG1dN(#4T)0|O@7Jn)*nsqQ<@m1-L+>D;W=TSTm=W&QBMwwF#v3vtqs8nrJuye>IucJ;olV=Kc}+>rGb2@00zTO2yG~?h+HM#KyIMLKJ5of) z$HNl&>t@h98Jw@!sJcoe?3N|wop$+YJ3FKOF~_u zpEbnE8O>boVFF=%?E zF=?U#Og*`HdwHhA$aFyKXauot@L~mOHJTEdu)H8e&abb*I+_v&&C;l7&9&&!9hJq5 zrNt)HN41)oinRJeMa^pXV{-BKtOf;@WI`p68XxrOUj_1tMTRQI`iCe?Rp+sh#MA*y zGdkf(C!pOA2!x&nTE=lyKHTh(v4=tyV>T&!+#;5G3h&n(TH1Prul3eSNFuHg1@b+m z7xm$81|>L5C}Or8t>k(qH4H zsd3iR1aFo+ZJ0TH^|hdz9p6XYN$peyogA={yaB7o5ZB^4Pfwx3AUf#t`6J+AvFXKM zUh;L;`O{gKu=(~#u%--~^Gc#MK9*XPwE}L9K^h&S!y|hUhUB4HpI3mjZ-z3-wFFvI z1|$dXMO6wl7l9%Syz3QV-XE*CHY>u^S{dRGS?gWB=h#o=30@jU5q?vSkF<=r+8F~~ z9?fS{9te!#>4MZvs?8;08(<2iug3M#{< z0QXe(!?&yQm?rw?yBlfZgMG;PHoTA$ZNJB7px%r-~agf zBEXNAXs1e06cmD7vx4Z@yf1F%zskIW~xELTz!O&72*uqSNbl+*ZZPZGs3 zMb3Xgc6#9rfQw~YE0>6Cu5M!~i;7Eh^nN?ki~LPn9ct!a%G9sMhdf{j08e-N;!M%^ z+#m95TfWzNX3iOn*P51E1vn=;qwyy^Aw|CUjz%|PI(XcEL~K~(Sg}5~^#LzQ!qXc(2PnSzaC}{slU3y&_fzMXHNeFI0n}?ei5W==Bt3VsyQOUXmmI;-P)B=KGsB1KFq7zt>uP%+&=x^MzBQc+s zsRiIB0uZysEJ$>PSSm63PyJ6sw!zv`DRsafP)(b^&Zv}HU;9979OMSM5v}(CrM72y z+fsRNTIsxs_A6Yu<=eU|slGmG%r$as}G6tDYJGzdSEmabBkQ+)kmjp69Cip2yHf&pNE(lG+*B z*R#UWj72wi-8|I-QGlVka3DAR~( zKdFG;FMVT%VJz}i(7IBuzRJbCYqw}qK7_|fV=`w_((4Y1brVBXeF+?)desgr=hr;d zA+YtBAt=urvJiFR{dII}jrQ>x64xDJcl_wu=uDy{i(J7t@)=8wDa_DgdpG@eHQ)UV zV&7c8xj64-GxYTlq@Q9#oR2? z$ZRBhyKN?Q7}~9ag@#~)LWF_($U4L)zaeHlaltG?qyKYO%=)8WHG|87+tHdQe(#C? zU?+B#3pE|A3^^I9m-`{q2D#;-jql(7|3_z4mFy!#80=u40U)o0MmGuX%fsk3<`1ye z_8IZ>vKKHhEIHYEnXp=1WM|G^>N$fJ?Zj^+0a;Px@93Oer1XZJ&@Py8RYH+qghVu& zZLqo-OEO<=1GE6aIsjjIC@e#RL=EgjuquMA9G3}8NPeVk%(A%$KS0y{htKxf1y9!p zYq-mgs9qjEBZbZ<;v0OWN7?_!7r%}U{<^>a)6>y^{qu|ce~jTDpCA17;8*j<7Y7IX z`#-&Y`?t%pm;dAkzy6e#^Ber@*ZrT^%YOz|a^Ta}p2*49h)1^n)%pgs+(NO>Vtmms2>_U-p-WZS>0X=ob>c-jq%5FP;X z(MP5Zow%IKX52L0XbS~)O4hYbzwPL>s}5?$FKD0Z8FN$-%l&U!FnW6KKXpR1&;9ym zcYG}#seNFF+R(aoe#p7`Go{ie4>iw!`$;pbuI?0PX)%&K?#F5jbHWVO=mkmv!@)=c zIrA!>MVs_3@+nq=kM==In2j9o0~|L)vIhDO`9NJmMfXbly+mBm3cJSn+Sx!fMbGiO zUZ*(%2p>Fc+xOg-_SI@2ui@KllbV6nO&EHw$8vugatoTy$IJ^cFIS*jo+&%_2qlmJ zf|wd$tS+>vKA4$#XrxwYhofVN4 zIy`O#6R?V_JE2s9PHj0=4bLKreUC4<8Y_OUA3{=Zdyp8tRYeII;NxqdpqjenckxAuEvGk~w2McJ61`&74mhTCOGsI%Xb63&Og z9YP^(=`I}`L7UdBpAuTUNVA0U)OwNP+NwWee$8Z|{snF%h_3T%k>dy6Cny&8n;UvTt=xfKRFk*sE?@ zC`23gPDNkdL@pt3Z)eKjMjQhDcGLC824{xk!1}H3{oDjktYe|~`6Sc^;5y{CCLj03 zt;aGT4|yObw8@z^#pkMQPh2|3e_ud)5TMI6<>|H0?$DF^8XLtHPhPzatTbqnf<%Un zkPt14u7v=tVf2WDNYX0@^(O-k?7+i%0|)g+IB~1*tXqE%C+^$4%Ny4P1l9Nl>2_ou z#!pw9N`D@&ZWpm7_k|j&%fT&NzPYe@DDMsaw8}MT2$#AiM~C}yb$C3^4#7Mmi0yh^ z9=7Q8up+WQ)OB>I>%%bWzCZVeEl*RB6U27hAci?BU1?;p8B;k@ZOhR# z7jsN(yp0t3VV*A?Z0>EHUTg+FO719Vppak)B~d90o0i&Sk*$`ewRVSqR`GkeVT;o~ zhxyt7&C77bxM2&p9srerDy54Vdpz>%-a|A~GlSd++5pQtG;+s_8BYl%w<0OKZ_uG~ z)eY-ZBesv-Xk~P-vRwEL;DJZ@T*My3{xH!_)u+1qULz@<<1Z6lR2VhIax#|Bxs+fG zfJkdx!e;imxRw%f57U&0sGx~ftW8*P$5=|9K7INWh~w#>|NLhnazI-|e7^i5y!G|7 zXTApikK?y*AdPxfNHP({Ot-5(uT?D%5%#Cg6xnzRHxD}(zE)4Ca3MBV!}t)^AIZToPf1IBniJ^WGerb zi!wuX0fP6XIvMnp9-FEtql1T3B^*o?3MEn-dy|BZ8W)ofDxn3xW%#4M&A?Gr2r{Rc zvzfj0P8UR{+oma@6Dg9iz=}gZ)lw`%MpcJc!shDcyEh*1g;oMF2P@FLW|RIJHs)k~ z!@3=sMlh~!J4#@v-JYl`-m6E4I^BD_?bOBwNb3)-vF#V1`|f?~$!~?@!<>n!IgRG{ zhEc3#B9{6-&{45xc06KRt@A%rebf&oAm2it)QpNLq53T?#dUHC>W|?bBHlsMXP(1l z$kB4Cb2`ZW0aYCn{ZEwz306gJ&2#<9ONRS*WToIL#Cox zFNs;9v%Xy&}_Kr(N_NO$FfW$6SD{_0hbzYzl4n`aJe0}qQ zEGOG!9GXMGcBuGi=TkG1Sck_%Dv&SDsv0cYjq$82Nf)R!MKn#L@y z-R`$JMc=U*y=9U}KIaL|6S&4-;K0bFEC@?)c`i~A%WrAU!3gLGkN;!;hvV~qy*qyU z@&MQyGb6y5-_2e+)op9-i0Qvt7+{uWJYWVci;^bEg0PQDjN!NIG6}yT*dDx{Z>)pB z=)WM`b_t|ppt#j1X=$lcU!j{4DF|L2b&Kidg)Wk_EN7CzfeTX`o6P~LvP{I#-){Ae@?}D0!K3dI5#4}+c~g9(t?t^qq~!R=3-W@? z8>`{QMdXsuqM*@Cd-(J=b5l-O!iqf!5)7HsXvR}!1e6qlfos*8XTq=yRENt#y zX)64T-bsd|o~TiS1-?(w5@>6l%FBQl!b1(sSgTRYfXaR$3pPi9v%ZRJx`mZlh?3mV z6tv*5#{#@+c=nvUOl6rf6WwaLDRs@W&KTMs7nT#vfN*Vu*Zu9i{7C0n!sK)Egncaj z_~ej0`8bv8KWQLX~3&`rXsfus-Zl2`h@JGOC_9?38S|N7t(xaLD)Pi7G7Wc?YOUo+;qqa)MM(^ zRt|O7F?Lftb6E9?(Khka)t{^uR&2{$AUv@FHgfu6(-Ujzg1w}~=SY7XwIH{jN%9`*r)*LcS#tM~rA~>9`-+GO(jiK&2ADZ*x@2a;a_sPo&KT@IZay-Dd*>KVVzrX6-vXo3OcF66dY^1^ zR3FYy2M_AQ`KcL``lp!IhSQ5yH)R{c*|zZgsv!-Bi!IjRza&v_PMjX!lOP?u95+1e zWwT_7A*e5^kXRaWKyyYeW>oQPGB1;YXI>k=CND*gQk`#x(9}I07$AAU5SAT3CrZd3 zQe%6CZ)r-eRdv9?$sGUm)>`eGeN^$L=2Jp%DNl^2on*zq*hstn?CXUf5~gfp3~=i* z-;yet?5k%-pyoap16PL^!P%@53xk;F`I=&5s0bG(U6^yh`_hN=(~U?Vig68-K-3ql z5(qrFz$Ar!GuQnIAzP=<__six1_LrY5{~`M9Q+mr;)GZ5j@5==Kw`SkT=ZCTQK(;$ z$?G1Rj633x&=ZOe4j-@i%0@MT4#UsHvv&t{Z;0=Kmt)vIugfzcmd&Q&0Z`TJuP*AU z^b?lN$g7KGF3>w~pcR5)NL0S>Ns{m>D|qjqLV1LVaKC9DVd_=1Vl&{HNdE9EC6P!H z7U_WfI6daGRW8#^>#W8%e}U_?zBnJ@(jA?@Jbv-^<#--{HWPQFLX1kuM%=eQy}7@z z3{F+pmy!&NAII1f6%A6cg6MvbN@&t~U^_wn^^yxw9Fm-(W8REvb!?d=xI{(H*rBUr zJo-S1Ra|A4p56dO z2^p?C7Psm)!tRdlM1I55>(L!AW+N1F|G4(=tI6n;a9G z@gG<&xkwK|!Es1R9{)9<=6g->OA9e?O)p;+#Vj_x)l{8s1X4JZZD7Eh#zNvdYB_3~ zh{p2(J?JB2T4B=51#Sn)RFc>6zlIZmR=Mzy74W+P7>QmVj+^))=?jZ$W4Y67lg!9 zee6F1hVsb38yG?1EzQC;q2`N*TxEaO3Qkcb{WFq@tW0RZ(6bH)v;jfL@wwi3Y-`7z zyT*}&Jm;gFp_h}AfRwbOs~aFa-Ipu5qR5_(F%$<4n2^BAIb;NQLo^ zH!^1B#~B!he~X^@TlK}?7B(_Shdy+3L8T2L{E#pj&BzT~jF6Hu%B{Nr;Kb1Ju72=G z0ZQ=`%dSjZ1|6%zb<{AIL>s^6ZYCsiWA1v}F(FWtWTqq1Ld|M4V{$re298L$R9%25 zjk;&vHd=aaYlVFvk)q0Usdfxl5YPhfdFU`TaZai>&;d(_hScwxRk9O(7<45tUR$gv z_0j-}T=ktvNjS{loaQ$yw)}St4s_c2F<>+{=mT8(TVgNljmLXBB1G=SQwRye5NKZ- z9ML8~=JUn8F=dF%9uNbkbx145!ZBrl_)3CeF!Hsxf&?8N?1lE|6II zWA#*T^~UU}_c2I~5Q>-xQ5X%S!_^c;52qyBhJq-Voa_yE$RgO(e8!*528DLTLGQpt zP84$lSyfARI+XmTG`E2iyPDD~lD#?S>M9k<$$k|o-XI1~(}Lww8nFXM)zUk5md)6l zxEL+Uyx%`6SXToz zZ(L0SwYFwOv7^C>!C8^62FlM1PDBc)Ik0m`2nmK=8&@e3d9LIKXqZZpvukzj$}zQD zZ@j2_c^p0=*2vf6e&MZ4OL!(4G75MADyj0V=ydM}oFb)&I4I1jRr9ukH&GB1ZN#CP z53Or{6oh73;)S&YFGDI~c2-UjE@v0pG6}V{f#Ay}cu$vUD8THLN)D2lI`Ndq35mln zA-}2J-AV$Sxf50}^T>Y;SL4u8DwM3Oe*KVUwcjI}_!20Rr7%q93_=myM6f`D^LblLAw#6(`lVpN#>aDK;7L^Gy8{xCdpEWW*ztn=zV8k+ZouZvbuq7>qvkq`3ZHx zb=4wp+aoaaDD@zAH)f&7{u~!Y&L?Hz-%2!&IWmy50o!i?Nvvk(tOfw`9g~^^kM!C^ z4!6*%49jO6z8xq)jjf~uLJt18CrK=#Qr(2BC9g0%s09jJIPZoCbTsox20^XG;x4_T zd3=1<>nU9K60W{+ZK398qJF0nQ5N1)#e`ro(aJtO(`cJ!RA&S4GksPX&y`x(SzCA3 z)}6JLH1{iJV1QeJ2~1aGN?wMdhvT2nRjgevDz=Fte$x-vxpjmHVnXlrN`KtQ2Bf$v z$a@>Mj6t0Ncf6K4*sEOVE?A-@TT-`Whw9Ts{G5OwM$=T_kt`2MLMJSdhgt=Z##J8E zz963@XuFjE_-53wiPak5_g+yU-`d)((0NcRX-s14X zO&0`Yzv-Y=9&iuCvifZd%eKwZtD2(^twOyn;{-OlGe_^t(d03kqn*?BOdFhQ7Uv*_3xA;d2gw zVq)MpOa_E0!m^K_j-#wR)YXjVY%cP}p{+_itktdGz(C?U_hhng1hXy4Wp)BWLW)$S zz6UFNCa9(D*{;~e05L@SIv!SLWyRB3dP{C;F2kshtR{-Z{FY1MHBVNBri=H1G)q8! z8Ojgq-whf}V|gxW>BvP{WM!clIuU*OUz-ICc{;4M-6##2`Pq};3ad0o`~Udj*U`aW z_xFE#I{L4FezE_LG5q86gTEg9YX11*;9!6Mr`K=)c6s*lpZwt0pVD%EgMabB|F%AA*#6 z7z|WUg<#fv!8hhMZR)E#_!MlOiJayO5^EjcqBoY&RwLU(7h~R=HZU|`5{r2`-*~tr zsMVdpJBT;0W7!*cj(*J~DWTB~-qP$8hv-ae5yGE5(IAL9qp8)w0}w{UY){&EvFSnT zaI~Lm^y0p*=s?M_Z$VJmddTE}WhaB;vG8Bm8zqc+4T2#j`>^wT&?!FHbJz^bpr8r? z_h%idY)TRlIVdq#HbVk@X?Q@WDHl>v^IsSWx1fAZBqD5h1W9t>E)H}OOnaA*7T_bF zmvd4|)l-qy>!><Rc!pMB35xv(==DZjwC-CUk!2{$U;3w}S0nZRjNZ%GSSM_X*eCo3bOo~C-wQQ) z2`j*TjM)T22*{d?TSeV}=&j;|)b?@i;mq`)<_s?JR-ZB!qwiW$bv-XrPsb+*1_2AZ zK2=wy#O8eheOu1dT0ktbT+E3~X(nf)0DTY5Xv7OI=)TBlbfanjn=16Qzgy9P_AGFT zpzftt%yLm)&%n_P--;3{(KoOkHqctP)Gj7&TN7P zvsLyh*1E+C4mhWpkqN+ulv zR`1h4&CQvq$;LP0W8fSSO+nHIYlR{qU=Pc~^=&pMQ;Gcq&woi3ae8i6p|_sfitsMk zJWFV?aY)dQj&;Pb(ku2u(|AM^MeS!loM`7zWEz9ugO}#aNNo;CCAzlq3kYI3VKMN0 z-LnuoySPhPZYb#Nhm%9X$82o=vQ?S0tPt1e>|&g~{Fnm~k8vojsll!L>Kipk_4M1( zH%`{4Z?DwR8IYjss_~WU8DVqoUY&{fB4g25XWYIDaL`hPrA59NlQRM6KOWWxQmrZiu))bP;Rlhx&_7Q_@wugbC*?M{9o!0T5`rqWk%DO^AZmeL#>s-r zxh&`n8-M29SABO~_VTLG#N zo&LW<)iTmunebGN&<+&TD%m^3Q^>3q+^tlEDjDsfm)Aj0rTLr$$$OSQ!-6gz{vQ-VbwD z(3lo;!>V(W( zXrJ|mXEMbo0PTG)Wp`FGr4j=u8ypQNFbzDnt=;h5_@hx19;XYOv=p45;z<}vi)hC(1mc`I%m`HsQ@je`)ODkc*NH}99x98xpxeRL~M$tidt256l0@R zHwaj3Pea=tjxhrCH{cS(zgV4}5Y&=Ed*=Fk4SyK1!Gb6zOl{IClwA1q6I=qfofaHv zwF_QDo-l1*HK762k#l@@ioF}w_A6ik3oR=aGoHtzjON7x^-+hlo>{NwAy}VPU`HVt z65Uc;VwfUh!qm3&L5LDlnyb3)QHQ!>n^GIKo0H2Zg+75%4}%6l_#y7mhPp2Ysfw@+ z#u2TL^(S@CdVlhfV&k%o=0hO-&2n zV-0Xe%?NNKr#DU$6_X?TX^^8A7GRKA=K=a0bXZd+;n4<3C0)206^C&f@rI|d+EH+9 zg04lDQN)7j4 zGikMMmQbx+o0e&WxLjT=+`P{<;T`lO5_E{+V&)WWDUQy=5)YiD3p_j3m9Dan=)kJ# zD4fvf=8ooZC`6k;6cbu-OhDjqbSioyl4fCl9O`DVa?sD#Q68 z(Eu1)7Gh2d9)aqSPaQ+!+@^Q32p5zeKzh;hJ#ZVf3!rOEm@`Lu73$MrhUv&t1N(i6 z7#~0}+A5-L$ycmSdys!_HorRnA%%wKh8y#X=BFxVD&Kq zbSA%L5>Q#jQ%o(@HA`7e3oyj$(86%^H9Hfk9K^E1UCp!jXf1DFZ1awOI-s9C#dSCP zbHGAE@V5iMZi3ZyUR0~$Y0vYFGmd&jk2)Ac#3_3I=TQob{vY@v(0 z`>!s$`){-C?!O`Bw{ZU@6<4~iJ^jv=wCa4(nX`4~fsl8i(1-{Sh-s&Okpcs~ql|cw$&?@%ddmOb{z|<7uGd0o=(X*i^MI< zkwjj8%xJ2v=&vYG6oD8*sjM21U$hPba7zQ35FycRe;nuG676n1{AsKRHtQMcJ zR>Lq?WwM65GFjbanLK9al6u*YS1?&qAb5lRNLa;0vnS(1Rk?pfVxE-+bJ&<>B*Tut zf%~i$Ec9qjQ+mxtwhN=md+KQL2{=gCPi%yR-KJ|VyG=Kw8|Rvun%hpx3Vqvdm20S$ z8FZUm5;5mR!3;FoZlgoOi&`KC%^bj1fdFUr(I!Q%1o=T-fy?$Cmnf#EgwHcflmeT4 zq&*dlUf%XP0@x&BAHjNp9s6DIp244BM2GM&BsD@dAM0R{bixwy?~>&UB0|FHn_~Tn zAc?T#F}l$hd)PL$WMB+?`B4es5Xfxhn{~6IDn8~gdY|fPv{UPf*@)s?N$@5buzCFM z#V~d-5GF|0WOjrc_sjs!s(k`{#sW31BA(o^#i2$|>s;^p<$+y6hlMK7oT@S`26erx zLYY{C)8o0ND^(uOYe-V2p3@&MZ0cXlGBukTuW6(_*s>Z|;mh!It zg&~tcpRIH)U2Qf%vUvj@N%wo7U2)ylVJ*&BQPh~zOtF>!r6da2b^jZZM9VQbCX%Pu z39CKRRtBe!=BmOZ&)izkPJ)S|>a-c%K* z>60p?YmMPpfeR1?PvF^;Wzlpsaq~XzJez=HYNhT;LeUDdZIeN>y|(;w7tTACG!AKE@}e3rQ!x=70j-kmrXt{08SweRy1 zJ{OYVRf&JXQeal4!d2uiq<# zbBxjz97dZUos?;Xj4@oj9fSuVz$T(hHA$J^VVju{HA3T|Z=2Ty={S|~sT!yDs~3 zBxmGgM$?ofPONI5vRB>iih@QnJRK-e94=w%RGtZ0kU5QJJhgE-Qxk=}x6&#;%qD_p zZ8h(*CVV$xaV;IQw;mg~cd3plU!!I^Frj$4ghLSC^|#QS5SpCMtznU;&Kb}22TFc$ zB%Xj+Uy#RjChkZq$Q=Vrk`hk=!!M1P>x>i}<0-axv!?H?FBBXzK**@TBynuBu0E zPs&uSY?Zm^)d?wRe$5J17fH+cgyp{Q?c2#SxAhFNwQ+k=zmjwF6*%UATsIXVG8FumKWgh5Ex%+11_*<&3Zj@1$>(KK(3FW%`qRxn)Cz^k0SWtv8);J!kEB5_ZH29u%zk*Ku+Yodli*i;3_%{zuRbeWwPh0Kh zr2wD!)VL8<`F;ahOC>M(Z7sqx#K)jg+Up@43wqy+WECiwU zinnrW*qdX#eVT$NKUQ)G&d&I6*^>DmN9CU(J!;R3Ll9G;&VZ|E+uk|nrtuvMQ{)U( zqKaFV-*R?$q&?e4cf6R5v=8sS;jEUMyM&D`~ zIIX>@q}!1BQpKdvViu*0ZNzGYqkst8!J9|-?!$-E7sF)!>N_I>!@uj(6B7BJOSA*> zf0ynJ7jiaOD%SOFX4FBO@H%3Zru_w%H=DXAE>&FLw|_f%N%XJvi(*}g+}lK;f;mu$ zyms=X>xfkbyO_(HPe5bcyo;G+CQkmMg(%6LjtC!k*SqA|bMi8kWzH&?bF(QWUTy5= z2RQ}g^Lx{7-y^B$DSedc^o-^O+*&tHp|)bfb)6s5O_1p6)OcalF&SLiN-BT@9CSm- z@RiN&Lyls0dn9A}>=3$XoWAR0qLMs$_Qc=91)uYT=E1O%$5VCgjmZanDrqqQsXFIMleIzx~it3blHefg)AGl9_b4B6+dAYIHcIMWk+6|vrKGEV#MkiW(8iTAB5zP zz?c?r`>&45n^Oq;bmoHyDCx6qeaQB)qCYNqbE5|2SXST8ZIMio@ zNBd^8oI>sinv&C$7gdIRbhArDsu5SJW^M4e=7o;@jSZ>CrncTDt1K6g*4d6=Bi0g= z-gx6zPn(+B1kFNYYV~{A(fihGu!bnT4LGqy3Rl@@F}Pcu&I9y*pp7giZl^W+_?qA9pq?8uVpLrlL;>!I z^zHfl&F1=q+jU@%^d8s!iNt)4Ns?wZw4PnEfMY3y{REFGjCog+x;6vH+*Q-w-9Lzh zn+hA3efzVHtdLf>y^W@%*U9CiiDITt+auerqw|-?FW$Z!&->Oklq<3{&IC{WQAvh! zMO(30I8zTIVlPb}YENK0oAiHGLc5IRbB^A0_a%F8byYSccH4d3FPzh&FY0;_XIHHC z%(JD25QwR-&eyY?jcl5vDNn#HsuD;XHs4#hQQR60FxHSPnhM-Xq_z5V3=i!~5NUII zYTX#U#xzH{w&i6xzvT(LhTOzFy_Qu}J?%{7vnQE6#&uiLTlH5JsRlRIyZ4unAso;a zTUAJ_&UlE4kkP1rXzJqU7k@Kh^cQawLDZ}_H3IP6qkURa> zk$N)~9)bWVp;i}X5}kYu5@QqBnyno=#yr%v6@qk=s2;@QixRn*Cp^75w5hzNLdRES zL_IJYBxf{P{b1WTX$?5kiY-_6iT%3LiM#3)H0|vFx8%H#w*>PFSUT_H!Xom@bOJ6&_ZkPmJ8|1ts&&|^4 zdQSd+d`4)gCbZD`T{k3HRb#%u_zWwJSbw|bcug(a9PLAZcy~tMdolU~JNQHmy*%Xw zr-jJ3VLz)?ZWVK-EW}*zyi@ZAfRlnGsHI9PZ+*C}!fKqR>TXCQ*6{f_gdC~ZHaG8h zTm42WuOSmr^6m3)9P9D7Rf18Ic3Nv2Bax;o3Q6c4zFPkt#wPi{(}w;XhyFiHn&6a$ zOnZ3uYE!>)YN{`+9+zE3gtq~MDkY{B!oe0fO{H48VJeF~jU3n``$d#_4e49+R7}d$ zm7j1-m$;g5tf!){ds{NQ!-m+nnp9V7m)ITh89XCzxGd2917C(BEJ z(KybZL%wC57cfjJkT!Jrj8`r})bwjL^ zWj>88`s~wT(Hqsq@PGGhYrd!M@#yslQq#{`Bfz6*m3@pY|SL|?qS_}81`?_R!v z715|VwUhPrXVXybjc|=1nn*WiY)>0z_LRJPburMwzD@H(I_;aS2iMU%DHUq!2sMe2 zj5HwQ@>XYvJbJ6Jnkt;WM`sV-#xjJ-i}}#F0zp2vxf6Oo?P}z$xjG-!$;hNMoc2?s z-;G!;Mta!m9)Vd~q{2-x?bgb5j6xG)(Xp`C9I5*a9UZYJ@gRVt+cp#9R;`kqeO%`_XYj^}4ICTD&Cq?tnq?ugzZM2WYK*Wl7z?xk9&!!a<(# zK=*6)ftl;m7g}UDzSC0EDhVW3vP`h|D!s&~FV^1sA}{VlJ~X6P{j&y!Pe0SAQ}2xY zf9(DHcigtMD2|_>^H*TGUDr~pk?f?&ImfrRU5f3bYW&dGQj+hzX-|bAF*Arb1WSOD zC#UCs|14}g2y*xUI1h~+qN^*`ki=tSV`IO!*YQ65BYXu%xK=2*?I<7ONq)E!yz?vn z6Un}$4pShtGaqS%m)zTu)?rYO%9Gl=RF9LqW!h$DzA=5v+0T%}-Ji6XFO=0xmDEfU zxw9;F3wP=~OWg$!RME*L&bX@760`gC9_KMSzwENsc!$v`oBS_*U36<_CfQ3mBiv&(gwQ(Zu2}#kjXU~*E{n@|&`@bWobQ+V0 zF4td#x4wM-yno35d;azf!V$4P_^0GpGE3DkvemifyWNWpus(aMBdeFag(UDwhZb43k_>d8Wfy_TK6pK`!+K zCG?h{8UHqCMOIcK$_bYukuLV31}ibgBfHIRd(0QZAh2{hCxrDE4&f zX@IYceQA4FTck_Yl=KNF%q#u8v*#rPVSMvenTO#rtT<+*B4n=ff{U+tq(3NH zH5&>qF{;c zsQmc$3XpG7f_z{R^4*jn-*zGL4XXO@08y z$se{n`Gy6`Hz-lQA-WDPQ$Dm%`H)iOgNv09E>}JjE(1%JZ=-1W2AHrJ>3QJNwVVdA+V&r`A z9aD-tNLFAx(wYYBE3#D^P#4Kg8Bi6-;^PilZnQIWRXG?iS{K>?Z7oZ7E7im=BxeEr zHz;mGvC+q>TQ(oB^s-e@@dHQ^ciMUc(c5K!M8KMJrnU|&qx9^Xp{NZBFVeD%{1CP9fUOK;a(jKR>of7bc$LNdEzSlQ zo$R-j+E94P3SlDa)pJiULRk~RjLmLG3hqFWX!z+-4iQyHpc6!Jw2b{F18X?d zS91M|Yh?8sE(FubET{AI^z^CD zs*L7^$w(VqM+qUgYY&*GP+qRR*#I|ia z6X(lwzw7(arLH>Ft7=tuSDkbA271clRAQ6MI<5Dh5?l+b%z`Y>+*q9S+QRu3SrQ5^ zc_|6+QawR|pu!&jE>+%{oyd^JoP{&`BkK+1Q0e7ObyMlpl@5$-Ih}pY)2a0p8Gep7 ztG`)$ZdYcn`Gm2bs^;)zul1$g!vkM-z5L%FhIX&EX*p=TsLsx?NA3hiM5Ute%307ulqHT?^04yBe$S?&<*oi|MX#HwZ!BXJgQl6vQO4X!8bFfB!_Q?XT5mFDdpxzf$&D5F zn=k8m2KsQb;9LfrHlRLkK=QxB>k!)&NqX;;l8SfLI)G+eN6cW2tvQm*mrGw`yNhJX zqM6!Ct*so<=M}dGg%7w4CMg`eU#ay6#x{oyks}AI}Y}??#j@$-p(f~j*Uj{S?y+%lZ_k@|I9*rC?f%*kON{B z_jUx3Rocmz{W{QNM@vH zl2Qg0ZxZubccCAUsC81*0pKn|1?JpELNVKu%cdukB}w96((_$H{M&ok;knSw)Ufyq zyyM|R61%QX0xxvLDaP)%u}W7)^}HV7%(ZM6`Kn*lNLt7Q&>@%P)(CCX;HHRAOyQqV zfT!+0zeTT!dL%LhgZyuvw~d=`cJ8l-xjBUyitpEdJA|KCXkT|-2fqlvCqC}p4-Sfo z@_N1Bubz%B`W6oSKLHpMI!`NoaegFq-`8tncXxUIyoQbF&;g~!f9@mKk1=<}xp%EK zc6YM<0Nr6{F6n~P&4BikK>=MPy!K7d1kiA;ScEwkG_Hto1y;d_8Ub6UKovw^w;jm3 z8$Yx!htA2t(~swXX$NaW@tL-{2m12ZT!*5QjdC1(wW6XEotmF4Z<^76_pVUyd{kIe zr@rYEFjtgS&pw{1-+P@R^^m#aNz{w?Gq+F_!U35ShBcVwZR*w#d`8FTh|67@@tHuF z%qdC#1R^4_C+IP*hd9;8XQq|DEU|5#-_ za(jg6`N}O*pgETwqM&vWdxSUlOHv3Gu$`|o6x8)o51igz!En?}tn;6B0P(k`HBpwJk=MD_pH(tNRf!mG2*m_6D)= zOybMd0H!y8aT!b5p7Vc=uu_+bpQl4uA#fkI0}jZON>bYt-?n(rlb3V-dd2z(Nc;Q?T!-+jRevV^lEyT5qp@)R`TZDg!_LUN!dy>K$_UFk zqcxW`Mf6A~SSFspc?_CE*|oDY2Iv9N>o}jVDMKtEl2qA}YPzAIeH&cLeN3ZwW+~G> zQcGe0&AwcE3sz`#JHP|kW>U{L+`FB zuwb27zhQ0t!uEo)6*my3F!th}92Y8%zE$YuFFMOAHJ0KxWt zo|iSw$XO9;xJPGii~VIPYuvG`d9Q6F!L(-hSHwzG#R{&G%+6C~TNYVt_Ib{!GEx$z z(uvfsf02;|y8fzM_qaDCeyH-TEX1Fls&GI9{~2I1JhzhYd4&$#KvCW9?wFx=kIdK< za=Wnc4TN7T&}Q+<&iGyw_FqEsoQvT zHo&v$LPYAVwPoJMT0;M_0 z?6^?Z`9_*b*2#mERggxevx&}BTVS;tI+_SQHHv%ZbGjFRSv;)LijSFw-!$1aeZ(LlVI7&NP_`(z#}}Z*Q;I2&%!!p zd2x}D4L<3;}fD!1&8AE&N!jN=oxq(hQ<`JA@$ za*4u`5!SyPe?js!mXg|>4`w>&cFW(fo&CeDXk>b3eUuA2iRdS^U_QF6o_z`u zZ%d17N%?_@S$w6An1cFP#-)E^VGvQXn)W!B=OBBO77-V?&?7m{7Hf6|0>XFkR2p$q za&Tzr#|fiXb;^bJ2_FD@3LBBu69_Ja(AUw){v(vPNmEc(aM^(X8U4DBWCuS*F|U3Q zLK)LoH6k&LhD@Mlf zI>})($*N!hA*K9SFouKWUekbyft2yNt3P9K&pb3XsGxsNm?hzh6|;m(^Z!_`4{knq zMAMO!Zdg)9+mIGS7Df0B9{o_3{T-HJ$8SCP>s?TA8aSNzOmFU%g|~nsL66FDJQo*T zi$Ws5;`9!{`@{*BOy+)4JEq?O#qYGE5Lrmk&x4&uk#q81m07a$WeWyo_xGmtF&^S8 zob}dWgZbNWa^TJq;o7!@J6&U56gQL-iFa3bO*Ji4c_oDZ@FWehr%04La1(=TuS|}v zrXk!)e67Aw6RL5Nudy+Hd3O%y(gc3HOv+M;&WR`SFNEwcI%3W`yk}H`#S{0cvf{dM zyL;liKSr@ErgaAZA8RguXDd*SS%aMft)WGet4AGHSVZAN5HeU5;9@L3HxmqW1${7%RAP9(| z4g{X&Y@=f21#{>7OH7>TPcZ^je0u79x8PFs1Ata}`WuH9L5`0fD-hNa#P=F=Nu;?m(?483WldtW zx9ATxuIMIbfJ=0T%w4;G7@#k;CI+{^x>P-{NVArxksF`x-jd^9*(UhV|2kH;o|4Om zO`|*}6(_+*CIv+=uV%%?no++Bk|q94BlBOe3_tH{#qJoepFT=7*Cp!M`j|shX=(q6mw1` z8xPd~T!*MOkNg!~CbDaibJ}idWT2FbdHc2^#7`&HMO-m&7Bm!dL?Zz#qa(UF z{|=$o`-U?Y)wYdBg)bAx9UVy|lbM8N%On=G(sgmnCYcs&4-WJuCn4*owgNxlz}*SR zs^vkj@6!M2#xHN5R~B_Ge5AXIFx{l}FX36EW?{3YyxR0k%uv*;T}B&661u#BQz9-~ z{MCMzLxvx!R-06Hw0TQlQ!teoT`$E1-GE%=RizT+k8K6ClA(~f7zl(p2C0#L72djH z2%G626AK+|JsIn9Xp@}uxT);2q%p>T)kCrQ+7pBpidB2c!?>WETkPZP=>@6b{m9~Y zi$3P$^j)@G)l-uPy0;_nwHr^$+hw2^n6Gqe{-1wkvS)X_=cviHCJnzo@(|ix*?;SH zHTBk{bSG8J{rx@@MMF<(f(a;)^)7f$of6aEMW-O}s2)M(h|^i3Ed5pKsPdi~%8-uj z17rlG$5dX80hLGxZ;;k~sBH9Lg&^4hh2SPVfiRj^M3ZN6jbOrHnw9tGQjheokeLH& zwHx=W>m!~FC1@6$V@S%}5h*Ok`Ea`+cOcf?+o(JSP<}zDR*e7PpXi;M9ZQ?ZlnaNY z_LnO;BPyWwQAA%zXIPwh`tBmh%iL6LHcL@OMP0o%PpByB9)%?XHEaDkg;lX4HRznx zC(&b?d-O*{GU*|GLE;Yl%&t(u7b!U$t2HwLeLx-L7zwgk;Hbykd)P8&edl8r&U)V) zA{i82eETCu7>uVrM($WAqCcdt%thWs9{V|-xg?E~f5(LsAl1Oe(lF=(agCe*lN4JET|60A$D5SAUwvs44UsmNd9_XT&r{2=vZx12+|VoM!|;fk3Zs@EU=QAtBCNLQAOlv6=%`cKRKbF>kQbX zmg>%#c~YgO2rlmU7CT&$9e>`X- zR`p@%`qqG0dq(~lrb%N;KAY*MD>n&oOeOC(fK(U2(fl5)w;qVeQ?d2mDf)YZETG z&FUx72PLjkZ&hf|E0e~j*sH|$VkDB1x5Ozx}UZ%b2s zN!?sVad|v?)0--5%(qMG-rsxS_IASoTN^oS1+C)YQA$NaT&7z;-X8htHZ4}Q7?})X zkxyfe#+NmrwBnPZXEI=yBK1N|@lZc%M0JM*bc~25@;UGawxP5IN^{;>WbT~2!uDDF zw(?P9y3q#h3XR&ll0!^qTqj272-t9GRB%-q5Z2mIyv6kVAn*RsJdHZSms!P6M4WI1 zog*G%@23Lnq_yxg;Dv4fTWG82-e2MM9_!72ob3*^3^anB#4tROljD>~i|N zk8r2yM>@^1WmbKT?28y48Yg4s5J~lA*$)_z&-LtfB(fwmaF@V~I{Uj~&q2y!&x1-i zDq+Rl2Fe)}ukNZ~#j{5L8&VD2jO@g*pAkL(lk}co|tY1k2ok%p2^EM(3Dnn3?ie*cB5cc zS~Fw8AiO(3Abem}w}@H7HgS7Kt7_{1K`-1#Sr_rZ6DB)5CXL)ol&qSA0b!ImRHTh< zdCLBqw)FI*FDqRbX12>kf#fNmG&(vPbN<-6wDja&Nxb}^ulOS8rZoV;vQnwhp>RIH zrC%L36yghh5b)df`dtVn1IXw^SLWcGPO>*BTc(7|N)lnk4-HTR<>Dsu!a9V>ivE~_ zA>~}?Rk2sYKLB(N7(3Ypg;O$yW4|hRqI$KKkOl@QUQY~F4x4*n;;30%aIED|gW5G# z!Y3GWptbQ5)dyiX75YuohCf4s*Zv=UZUc7Y-;BYoa0(ey)!Z^fb zJT9%Dn{vwc6Y6*n5*iB=H%{!~=7tMuE<=~qloUa(Bz}bxXiKbc1M|1H8Qb))2CEra zmh-^bh2;(|8e1k4ZdCt#O$4^>^!x6FG;`Ug zRS%B69Ct6T{z&`^|R_3yDt-aO6(ZSRTR^Ny1*0Ll%U*aaR$ zF>8}nx>0JWB^2z(&c`C#E}E?v2E3dT1*k8wRiWa{+KFOsP=7xc59m1}b#ZHc<35g= zYwM{F0B%OD(;N7JICs>=S#|4Yt=goA1FfwY;08M5{=W}evG6!kZAK2vA*44`;dy6+rbeqCFvb)Ez zv?M!3lXLKn-PAlmi17{|a)=nN(miDhdTXwpafM^TEwI|#pjm7l3`Ds!IZw#);QXy# z(JEl?bt-UW3Za=f1-zx8{#|{czpac^U@TjfQZ}CjGXutMufNw%H(JnGOkM%Q%u)kF zo3i-l%1erPbmQ0CZ-`#Gj_%4gjDLP0=qT@P6Pnlg3w47Qx=c}7I7FucDAquD*X4A? zqtjhumR@y>{WKHRI>W3=oFjlC?vp%?pHJX+hE8X~g8gGcQ4f27XIgIHF)L1|90J<8L`2PGgl5**P)L&#~-aHwTni0UEZH}{HnPFvBWH#Ivo0>7lval^a5o7mX z1)o2u8OnTXEwUFd3GxMS4E6a+*w9v0ER`VXh$Oq6!e{3DHMBH!R>&YF8|qri(p@&B zwqld~d?j(S9SXeOd{QdqzC(eM^25G)3GS zrnr9O+eYjZfGEv-;N$xDsde5-itqszC6QCiKm}$rsmf_yS=GEN>lSCXET^>sNv>w$ z;X!?Y^rob7G#$xOjuDx!g*`vHG)*Rb#k7FzuC`Bn5>(WC&eVbmStJy|7TzT)Rv0+0 zUsA;S28BMlqOm+@_3p51{dKB4;(vZ(;}xzbF(1Onv!Qd(>WhV+p8$mr zhm*?VlqRIa3m4&)fERvM%3&h_dl=z8Wt(*RipweDO5iO^>WXCEGLk7#J{H6Ax40c0 zb)8h2vRNW|O<>Y2o+4)!G<^htr(w2s(%591pp5^kn?HC`FDs)H;_^&!{x;ya29nK= zzgdeG$?9Jw56vd5AJp{~ZM|ik{Y^NM;v-S-HR8cZuMFY89!R7s^53TeeCwc^S^X1? zmn=K8!M=(KvqbmpeY^P*3dE3L;IX34H=@ouLW1uwKsZuI=Ecs6`7^0(M_o|2YYvVx z%b?!Rgo{m20l9OHv$Nt8!VM;IR7gFUboc3qK93=z#w7; zyCEQ9GS3rY-av@(tT#*_RCES|=z|*=9fb1Y4hcwuL~viDn>E7~VgQb~B>dPVTy0#6 zfS5tytH{qv*>h6p*QU>nQ=^La^%=2@X%s$vBO-YE&GWXH;x+8W2mJJ#=A9Gc$jTm4 z8Bk_dH$2W)8k^$z6D@J5A7j%#aM?|MFV7EuIJ9sa`&a$@2_7s>zS_1EM?M@(zBuFK zf8uM4pOV&}TeuH>KaB+f*O5*3pz7QuLrH%GnT$m=u*?+Y*P56S>?9&a_Q$1oinG|P zYi3wfPcE$f)S$Qf-%7=9`&pb`xb&<=W)S}^Q`GxA%M7PqKP7hmRmf;yiMKW}%l(n| zUt1Nc|DQS8rF~G{w%4a<6&Q1rBNn9m3Q zTrTVBQguDC8IQsOc&ukXaW-^Z#^X<&V0}WHN5IvbMn2YrLUXGK^)Ke-(=)s9#AK%* zd9wukp?EfrKde~9Nk4K8Fe`p?|JPp%hc?E~gzEfE=+DFkE&Qatf6~N+ajBtmjk~gr z&2%xTp+a@>>|V)C8I?*`+Jv5Mu}be3wcV%= zk0xhv39b#5*u%w3n-QooK5dL~*A$fO!@_7OJB|07gD_s7%-V?am|H#?jMM3!tmhs0 zgg$*g9HJ9;uyCx;YFgP4@5WJ{T(l#Oq2O#LsvIjh;UnmYY(Al@O}|`-;$2ef-SX5r@F-G%Z7<+1QSqT>}~w{e%XOX_sF2Iwwt(r9Z|Y zDk^wc+HxT1^(c>jeY?6&R-En0-0#Ff&k}i)f}f>LCZNa1@J^hBxxk{f7@+_qD$3RC z`O}FJON}Mf5+|?H8F_*E0%y7b-_Y+A7C9|hG-a34daJ`+J0aN$EqaCCBb=}91L zb-iY}o!=l<*{NmOC)=EF0iM?HpTC15N|49EewlbA#U#Bqd8h8oy9y*uo`^QtTM!N9 zd_sI3Q0DdeKYfAo#GB}OHSU_KlXV(yQ2)XH3_Q$kd<5H?XA=+tkNxhxiZ#kGehTJ1 zf%&_l7AmY2lKL3#WiAegumHTgoj>Rw0vbYg1qg}!6Kf4>@bg=6Ya2k(pvajB%1Vlb zq-QD-<%ah$BQUjwod;xuB#iH+o)l)4v-5G^i<}+a&dvz?yg&WFA0KZxuURFaob*p~ z$Yvy6GaJ*pgYWhfruwoakZF|*2%+d;{5lPFb#>Q&v0|)zpR+TCC9K@5LgZn6=IFe+ zMDFG7jBd66E&R2q&M`jcD<2Bv!G(W3WllMqBfE9tG1CJG6lyj$FU9V5eNEJA6YiOZ zS7eUyiz2IH;qB}G;bO@}Ed9>#yk6Ir3{&#=X>yr2LZ|ooRYP_!tfguj!6tp0WG&NO ztFqxwidPXYUsTOCho8+bmUKk>PC15QO3i%>jY&7+;%wZdk+;^j7@h)M?O*e^rF@ip zC!rdS_)>!|ECC+2*h2)XpiDhNBL*O*yqj~QsZ0m`ucq}()!<(kVsP!007}tUIRW#S;8P1$NL8q(2TFo1 zQ%$I(GR9ed{Lia@-F&Z?l9jkTX%W!-)3JgpLcgZiqV~(&*!)M zr=7FAK0oQ`qnfu11BqXWEB^m34_{tp`run+=T&7j1(b;V14Z>8gU13WK6KM7`xvDw zO&L?^Nn5^qcC|Xa8CO6kmE`}r|5aN`Q@RZ}o7=heAwsE@Qw5Qs&PdRjPA!8%OV%&* zk`^>con3u&lj-LBCsE-E$h1*@ND(F?XYuw{k0o(gMe?Q1?6t z)znFLo2f?-sk%oQsZgtf3DXo9q5k~YR+7?Xi80I``C_&pS9tq+4K~E%NXD4Wsn^rWWO%CgoKWsH6w{es{Lrz zw9c`DxsZcOAJqHx8%k39Q-X2jxmevrJ)6?hW%YCBsg<>14rEp`eXCm_BX*Nb#K<6I zkpIF?RpxL26?syB!VSjwXEl-7lo@`t9e2$0?Sh4f9F0Yw;&(%x6g}z&pJvYE)x^|e zUjQhKGyqtTr{gJlu=e3MQPfgsb%ik&(s&(dIgFO2wT^U;CwgoslgIZW_~<2Q{&~L3 zcT+A$m}A!iXQvy{8fIL_LHQ1~K!5Oe{A+tpL?^9cO3_FZxsXq($p2Z2qyA9>pkDsf zv|>tky7YN69KkR0EfAlO>@D8arjbzn{q;4daz&f8qj3K|X3BD=`!WQFPEEOA+z83h zQtG@}eig!(aJ0JFE?)ueX7|lY5s_S=XfdygSP7;^b&wwkPERCf;=WU`?K(f?_Y}U| z=JVIuH(ehDLccLY9G|cKd%*fsos|tw?tiDzsWMz3$H95Bu+8w48{RObrW7}+)QLUV zYuUnl4aNLC0fKhGww$NUhj;qK13Wyncm`(K%b8?N(riP{OkE*GIDhaw_C`a8d%=52 zseWK!%$4nps2gEw&e47&(<2=-Hv2di#-_<+yWOohOB*u8T9px2MGZ9gErIcS=J^@Q zrtj`j&MqWB91_&Mpx!bitlFZtQ$A;invSXSjRM~pzCDoe?`+GFoF$VL1&zhEtmz!m zrU19qDy6jPivBJGKJb?BFHoK}!&Z`Ke?5P@rPr^xFc3*7E%$o>!C#yq0(4K8xxVLC z?;KH<@b(r>8W3Xt2ES&4)nhBh7+bwQ3n7540gv$>+2ykXJztOUf%YWf9r(=*x}-n&1SO43hZZiF_FEna149U0gzQMH_FsTIbO4oGH$~)(+AP%~+Yg&B^Azk4yv=v!DFvm2 zrM8bxp4&@nkzsbX7km#00O(KsoqV&B+V({m2RW?jkfjJo;JW0i!n|#WQrtp1{mL=$ zbJw-c-O+HEu^lGpR?rNtp5|D0EfUe-!Vg>EmE^)TIGwB4d&Fdv-0V7Y-698 zRK?9XDg;#B;;q+g0{fXNdy#q;8=S$@)I(}1#W0s{GU0o0@y46e`IWKhk*jLveatLk zSE>wyDG9{9s_oOQ7V1yKB)v;Zc>x6F90sv-a81pd$m_eD^Ix+#_-)lV?@CYB*X^S} zV0H@p=D!7`zyqvY7`Hny#>24xF{yu!uYI1bh9{?q!dz!XMLv*^FuHI{2{}2ZBwA+O z_qRFJO;`1R>V-UVpd{UM|7mF0*-1VNYS_q?kB=EV%Z?Ib=8s*Szk|ziAZ zFJf5GOs1n%u1+PnZJ)*UlGdn$Heuro-7aXsK=@A?hWvgTx|D zZwqsaBzuX-b5hT;Ko%v?@St?250gqABzZ8SF;6`YV9h316@K4OG>!RxeV&#@ey!Y0 zD%c_G^D9m}b36q@XC<*5l)`_jVe7Q_Tg5zJ;Ylu{Z-XRd?`kI5`=!qEl6)(wpBmL<}yWPMKV%P1;@hpQ)5XN{997HcRS|v$S)~OE~0j3fE>8Pay^-janVi zCHJ}7j`}`b%+@rK-yz1|nXT*>a{cwWUIW=VeYyq)G(Zl)HZzj)d+R$K)@nTNwR7NI z61EhoiKJJt8uKB@Qg~2}-Gd%zHPpA4fohWywe#*0{VPqGg?_ZChv2Tg$rmNt9xG3U zJ6C-MkI_vebAN3EZ^#f{ws>uhdIQwA`TD4niGRXCZcPM`{Ub78I+h`_^w*6;^ZR#x z(o|7%^$2{tH|rT+jmSnu-gmLI5K{HWVWw}d@&FCR>f@@mfw%Q(AJ3h{Cwwgfw#Hu4 z3*N@wDg5~Ax&`rN4^v->{{?M--k!S+lUqDb+b4X&&nf(Kai>7fJU1%@K~&l|(e~Uf%k{pxgr4%cVpr--N0?Vq2K9Nmh^jdC)@-vs~QQ3@6I^x(V z-z~oVvu`my6%wB+ab9IO{G+nD!K}aE2;VqqFzY)=*fpYlfoO!MRVy-}J?SLBtG>d> zN@^NePp5JXxv(^VriS{wteID`r#Su=T^Wg}C49VILROC^)`PNv@`#75#1C}-o2m+R z^%+OYOkJ2nr%6assp6*;H#$OBfE?PrB*097BXlX6&zfMJpi06!o2F zK@#0SS}BNbdv$v1bb4ya7QAJ2@sdDgp{(-^QG0r+0gGyRgzul$`eSFTZfg=t7X534 zO>E+M-pAUkQ^$}(Me;avPxm?kei%f_cw95cI5Sz2K!=y*YTrUFX8)J6^EV|ChbZJd1XD$5)>~Ss{6EXF{po|MoaZIEYoC)am_x8J z4WdI*ttIO>kxVY%GdfL=!)lpiqN#OI3h&F(>-%{hTF-a8%lIp}Au==J38Vz7z^Pqo zW#^D-PUA@?zmV;gDn)xkAFB~n^PnK!0fpEM=uX|aME46Ibc?Vd;SBTC^qnNl&sl!4 zahVi)%Y(^BqLR3|0T9-rN%{O0{$1OAu#uYu)2Be@J9s%L11BLK8vQrYiTGBMfGR4; zUZ}x(R5d**g02kwwS&d662j+#clHuZJG6cTa-CgL1t2a8`6b#9Rg^M;`9YRrc{`iD zX@XxcK`(;XN<9xC1e(H&$mkb#vM%dwsmxPnxyvl2+*dmH;#Tss+geelY6ipn!-(z@ zCMYtg=%>Zd#@_}ALg6O*W%r%m3|S?(uf*?*d3Y>hc&zo$t~}<3_^kDD*qSzWgxH#d zzBKJWyU5`tmr0Ose!dJQX(a;qW*tQ6 zK8MR{1gyRG0PpAu%n2>fC(JcGiF*nji6tZ~kG}a`dFLJL)rU~s=;xWW?#C>|3h=jD zvL?U~&`atD0F^+8qZPRRagC@5y5*8p8BkCh*ieA|U2@1K1J(I@K(Ce4pUAJ&wvcD< zx=KmSo6=2=K_|iK&-VSHBEw~0_MXPb-n;A#8NR#z2mH}n*bo|uDEAzCQQV*+g?1T- zV!Pnn1*pE)54;lt2yo%Rn=X*ujx)xKSAVkYRU-|mGU6r2#^$8SV zIPQj*i#ETR=3QGy80%O_&OR8+RT8+|WNFZPK=*`LHFjfhfig}LHu0|??eVmN46mx#{Bry*Dy(4bX zm2FK@5zg)nOPZx8Y4XzK0He>ufx3>7zmo;7ZK0sHYxo4PQ6rKm*l#O!rr{`Qk}0ZD z#;2uIH3U`c{;~*6UVzyt@jDk#uLSL2MVA=$&iso!t@apKh!??XX9CoS?&e&VI-iW9 z)n2O`;38B+GQgcg={bGBG`yiv3scu9>cbla7CDSwT=lT2i;Dxy_A| zg)MAOJraq#rW(7FTSiBD*Wkjt%IX`{tB?I;sIds>9*$`T4`lMHed|BlqLm6Y<+_%P zi!+AUN#MnaJWzT3mYnwDJ_Agqyy+0?7cHQ04t?bXw5VaR(Pwt^r zHnr?wKcdO4XHS7o{NTk`Rnbv$`Hd+vIOk($F=x@|q)O3aToM@RokdQe;f_bWf~4|iO_5B-=}jw>W~+_(sya8#8U!Q|giAD38B(^$B|@T5LN%NYBAU8~{x-^?WF zx4|h*jGJogM4_kJg}CjJFI*mGZwm=fvQJXLk)^lPNeUOz>rXmt%FB&|IqsG1f?m^A zz9R|amn9*uEVcHd%*g$7UJ+bY717kwqeqRytIkpc?VZIFqnm-ANpGZEW^%@rVm73& z`!!A*=aHqXS{2ay)!?kgwA4^pe|Cnc#ySyDfA}@;K{S4hUWuA}273OW=CP5Hr`_SZ zzwEwTspwbuB9!6}RYuO9#^?=)s9W6okKBd6ONsxV&|gAa)r-VmV06J0dnU-ZjA5sOqVEX5r;p_vQcEFbc<)vU<3IGceySecPcYdlHn&a z%8V3fyMPV1o;UedqYE7QjO4y001;WfkR;IOZ#^wjz|;*TmNZruJxf#7utZt7TKuZA z43hOWQHqUg7S)>Wr@nnRi-YQ64#8F?EEsLiI@msYy(>eH3lVDfMXmGzjO=ITNLGW7 z^nqr{U8t01w2hs~5qE{8;TDy_d*?uKIm2{`f>6fN7QHJ(wdLd?r2F_&NoMRh(v4ac zN>NgB2t9q0sQ$a73hk?e)lvYGrP#A>5`@y$<24{w9zlwYypTD#SXT($8uN@ix=Puf zT+WnT6dOOoU$zFNVZr-PFf7y^-c=9b2Fm4AQcb)@+o7NLBTQ!%`FzwEALY0fRvbRw zAbA*HrkM0~#O7DJw4`kGHr=UVNN1wvm+yE(zK{6P^hch?B|fV7ldDT%OS}DXN6aD5 zKXq9Po*Hw+w%Je29I3uJw9?S?9A@&5 zL5d;(O*i4=Z()=)6J6p#$37;D4%E+)oLihKF`7F2*xZRlULOCAKmg|Y0?8lUk<(g{ zZ_j@`-=T+rU$ox~4@;ulOvs2!;g`^^+#9h|-Vby=pvN50YqHiKx79#`hms4bAsnCyE|` zG1!&r%Tv#I4Q+h5JkEdu5a4uvc@3r#qvoN6lm}P0c#YI{EI&*68z}ABSCEhX7!wu3 zszNJpcH$H3e)K~AmB-NEmGh#fe4FFIOXdOfS_^rDPG0IR_>ax#Zsy0&P3ZLWHLL4S z#@^L`2dY&@c#t1fp9p9)U7DFqzto$K$V2Hgwrb|uO&i#Gh^G7lmg0*j)mR?Essq&1 z=Q&WO%9T^cUo!`H(S71)J#o@Jw;^gXKbrcX%bku5t0xDS5dj)|=O8k0?B@EZJd0%( z*ynh+B*3h8-(C<`XpB=@{TMnEOUfOYW3_DDor~An()D-3z0q2p#wyz4li2SI0J_^8 zQ5Q#3cZGm$kaiwlT{1jId|y{jw~Jg)ykzHE+49#f&9YQ=QjNXQx8E;b1c zeVZJlcb=T24eShppKWPUbj;nz4Sjqx1oXoSSZbG1 z-&5}G#bVQndt#j=?kn+2&F#(WrJTm}>=|>m5@WY96db#$h3hTtnQ66N!+)px;j|!L z=lw7qJQnwejCM%6P|vxGn*}|CkHBeE?or!a4RLzD^0Nk-_H% z@e=j$A=z^j&iSxx-|W5hS69r^#P8f>c7?<3RHaW;G;1(2+~BesgDv$#?)6PdyGyCT zIDhzrUX9BTGCSkg$H1;jXFOzD2q*N3L=s_G6oWscLU9E$Fy`oyhXqpW@+S?5XVECR zVh_iFA?kDjIaw=z4J-;)u57PWQ?KdT=odFC6WWx6QkS1>1lB;fWgm2G6@S5`JOsI-aT zo}~ueny?f-dM?Pq1|Flq@YbHuXSpUz?{pFUV3MF$Ld9|?Cz(VVU+}wD#dZS3bnEeE#wNfx z$?wXmH++}qEv@beWo?DIKPjRPt1gQo=U(3UDc{6` zs;a4VdlQpmjtUbQ)S?VRuS@4O9Z-&o-L?(?9a5EUq9wMt++^fiW3oQpXWgjM1kxGN z9;BLgaaVv7k8hNhFq$x_Cli|ymR+PY72LLr!a6VL(^u-k9H~?1i$Fi#3kA-mEELcm zNn;YQckHS&Q|+;DcKErdg?ik+4u=}veUCP^b@1ywN=tVc!^(+@-!FCL)vHu&Xa&{2nbD-o z0ZVcQy231E4=Cw)5&v|i=j}+!=?=NE9|x`JP;|qB)JNj)o{urdHER0kZ8ck(54H{K z?P%`?+0YhtqM2Q(mMlW|itLbdEy(QK=Y`YHM}h06Q%X)LImm0h>%8~L;tMFdT|tj@ zCOPk@H`JgPmn~YWF%6!;U+f#juQC#S7}~hlts5(}xEB!-mC?*32~-3KDP4gB8@ksI ztL=&uI6_9?rYN47S5TUR<7=*t199es$lW$}j7aY*!|FZNPR|(M7Ql>gT&_fD-&0~N z4pP+wdlFQ6Y}Yom;Y|k+1GdO7zu&gd$KiSrMcvuAA?KBNRt=ync&q9vGe;_oLJ4e? zYKW87CQ1BoGIIDzE+_w{WQ&RACaY$P*(Oz*x}YYBzrtX+bRtb0a++yZMVT@qL+7=p zd0u3vz7!Q48t~cpSH*7^$%TR(k{bS-1L+DDDHlRyc->Q?MPNUO?GgiCn;}55c)L3S z4joy>w-?Wbj%w)tRbQ-`l*ToPj9#@4n~-zM8qeI`Usyg@k*O}&n@=weL%9k_{y=yH z($s``P)45;W0ZoiZlur?=QaEL3W&lxsnXEgC8#L5x5wsBSS#Lr1_wg>lid{2Dhiu& zELmq$fzl70IQxp9fp%s$e!UP``LU^ahlgoA;QR)wo3IjVHCz>4-RFRz?U|1y?A9<( zG5Jqh71H_K&Q`uvGo${&T!m!FnIsJwgEf_L0-K$hd|lPZ&*ca^4uk@(uB%D?7r-;| z>JqoKvzMTXwscb!20;f(M$ObV??b;=Q%VA=0v+s+M><76OciSMMkP-=T}2c`l}V4l z-m+$eb%`b`d70v60{825W!{!Flj&eilFfQ-Bjjb+2q42Nz*eNLjLSWY7#-5ad?*FbBd z%Wpd9li$~nV4t=6+~U#3kqc7tj@7y)PbTej#w1KvP*=k$j_n|?qk@HY4FuJs$5(F8 zv^I)$JXvM_OvY*JGQ1_ruW8)L2UEw}e|4HC^-LtVJw8Qz87Ko}@a-u%S3HI6-W}Lpl62o-!}CvZMV8KrgD4=H#VBRY}h#r(pxkO=~hi951U($OWBDpJqic34m_HU zP|G*J*+b8Sxm`sJ*F+O9=*uRI6{{DYFy<>PJUDq}oPCT(~+csum z+qP{xnb@}3v2EM7?Yz0K=lH%K)m4ktKe~?IYt>%oIZSZmdLy1FrIvQ z!ttPIQ-f%hhr_-;m<1@S@l}eHtLgGf7NODjjGTamgVad&e>=TSWb74%)qi@<9{Xq!ZFTxaxr5dV;?m$<*SD4GGne2;74YEB_iAqMT73u z<4CBv&1Sw16*uIt%Bc{g?3Iq};}hO*9$&}9$2u`G+JU4h@BD=!g-$z*YtU*Own(0!^P8Q_spSmu3MP@W|m~vF!r`W_LInCwcVQ&`hPua zgZo~dMytAZ+}pRT8!2ctrYTy^GtsAqd%Jl%M^DkyFVVhn8#nH8zy3>jc@z)M4%xry zeT%8VJy5N#J#43SlfEd459AXB^XQ51868Jei}1!zxwOwOlGEK6;*Q|ws;1S*mY_f{ z1Q@ALD}-+qIJR){q||@KHK5!h=)0`}(EdeKQki3qL+X{B=PXb(Xom>)vMCujNGfRC z6b+*4Q#Z@@texdFZgRnQvH3Cz6RJrM*!>oU#De=r>}EOl=ySA0)|rjGTkPA^jg4k3 zn9x%7vdkK!a{Pck>OuMsWVZt$N}Pl6byk;dIyPya{bOf=2^z25c^E6N!A3e8sNQ?& zEh#=3$Fulpz{Qucm~*#sq~I!{_q%)3@23xV-Ou;q>29y5kMSSz;-0?y?QYyxc=`$0F90UgrzhM@=_l7;(|BO7fpXqw{v&}k~rodh&!9l>fK%JvBea1 zg#!+C-K_jGm}D67EIz?zccU-mSAk9$MT#NC>q};LbO!e_HF_9IUNZ^d?S#Krb~`RQ z^@VE1E(bZBl8@SYF3%{HNNZY?;5sI68gke!Hr_c4(P$Zv@{cc9uZfVAnH_G81dFIr5_R8-ZqwPyU7JgColCyR;AVQBCk3(L^(?OW&*=#Q^1W@{R^Z^g7rB0BS&%nOmSq%+Tqcb62wtBID{~B z`3DzL)f!`d57pDbZOmh7f}7Inc^=%(kM?A>{XV3_XoCMYFd=f8xQ0@)BDVe|VK(O^ z)_Avuw#Pmfuv9_`D#xg;(CZIRqQ$aE>~5amkE*_L0C0%QPjUMbpW?Q;1K973Z|@^_ zK<;oE?}R#|uW1*oUR`Ahdh@S)9qon*TlB)V*~ zZTPaL^UvfRWl4FrDk9z*vedkNUw3~ZDPjBVK{)e!#tx!q3)Pyr_+e?M7~W^}84E6X zl51)*s=xQFWo_ajv)mSNu^2A`lc}&3zu(U9WEjC|UE9twg}qfJt@^2=8y7QTaoN;p znxY9L(#dPlU-MT*s#sL=L~cKR$J?6pObwx9X_ZeHj&(7mL~tpGJ?CVl z`-nQhuV9qIn}72X|6V{P-=IN)tyQYdBYqleuos>iO08h1YSo#hYUvM!QGzF=Bpwu! z1445NnG;AL-t&z|*h|YfOev~Te~rPlH6!M4|A(Hf!&=*MPD^X<0gUUhE2vu(<#nFX z-F298algNc&hO?KM3S$UnxbzU;=Xii#5PtbL|`qG5ij*RZXyxtkJIRHPFHgjP zt~JtI!pb@V-?uaqh89f$!7DihVDoIEvFj{@@8_}06#W%JyIaulz{5bn%Fv|v%sbQc z9Q1ECpp92qdp;dU8Toi`KqB705_Z6vXug!LjhsQHTU35!-kVY*yg;BB;CA}WBH)du z|1y$h^D6RkLmYM$r_gXQK)$?u$D<);o;l&b8dXN|MBJsPjQ$XK}ATwWI=H|0y)vuc;vCoc1vK z90w`|h_7dsIGgpW7qnj-C=>u06usmZ;;}1Tp6I?=!BU<|bK!z*0qUzSgev)b88HXAe4gQ^G=?$9k z#FuTkhtu^zG3e)1;M0*9pY)%ys8(>Ek(|qfBzj=XzS;&;0OJ$?r4@ z!^^Q27sxgyUsjLpS=>S+-vy2Gu7#(eqI!DwqUExaG32>a%7Nj8JZ4wOdS_vEbwb$9 z9`hDXLH57ol-~dpsBU>qFTus7bU1Lrc(idkH^FP|Y5kcP^aCv}y#5c5C;dRD$SQdm zUT!H6kmRL6_r#$tr||mr&0}Jef2jy8E51JVE-r8FG2l%BQ_ghv(1+HY;}yKDzur7Z zOn{sNdYXgUoo!ceN3(L%(oN%+xH$9&!kSK;*(QHoq9Z&S@s4_cZJkr0H;hC|Bzew% z;7$?D6a}KFmn$XI&f>L^TW-10ZdSL~-750-Tt_F~6k-B< zDo^cJ2Jla>j0r2z2xSzCiR+xshL(sucX04twQog@Smru65UJKF-D3~{lxVDQ<&d`i z1bLK;N|EDLF7&mKRxqPF z>p3Yw1VsGC@_8IIF|vPtZRcgW0e}&S(?r{Mz0r*fcV9Nxh(kX9>HnaPN>(_dyrLv3 z8?gtOWykO0^X2>n^)VI*RvvbYNL%~W%N4Fj&tc`!kF`8sY=tO2Y!}#nn~T{G$Cbhz zf*rN{%dn*v!=`o%Z@TM0LGWDiKh4b6kX<0-h8{8q(|>MNm;X9Ce}a$LLa-OsFl=Tv z|FicrGH&E9{ajZ6=qsBUH+FhY-hQl4XBajNA=tS;Rz$O(g#PAb|M}-Geg0=~19pLB z$LNQX!tRIrKSLcZ8Z-NUw}L>lnNe94KpiXZ&`5exLRD*S^QTPch`#%UD5>n8vQ_{6 zB&zvOdl{wor`U2!XOXH5m)7{l6zScsB%d;@X)H!R88ya*qdl*X6oTctpyZ&KT5YoJ zH1cLs2Igp=)e5uhlhDD{zk%WJEtvAo$6|P}UJ-1~T6UMV9Eh;F*9LhHoAZ2u{ z?O?eK^{=6Q%6?2=K`^q)r)f7L_%dpsya`&;8qT{HK_-vwY-+cTBy+zNAK{_h;}C;3 zf>ef_vzKwF+#QxJG!;^c+sIIKkF?{jL?i8zu*^`$W^9p8c51`ID$i#iEe@2YdC3Bo zujAE(34FFEGOBf2`%sL-)m!MBmJCn|7Y>rm4-TV**f(~j-79=@LB{p`dg5kD)f!6o z_@F6nz6RCORJ$Vo0(sxlwv}{D|7H3=K3a*u0iTequC}w8O;?&cS^e4R0(S~35#LL^ zAUYG;Uin=6c5P}olPXSt8x8LORDNFwf|4_)C1Qwo!nt2gYgacZrTM)@1=nenw_bS_ zEoP{N(H&P-itHo=9DyQ1ZbuoNjVaV^&DTu*5Lw0h$>||M%xT{m@&^yIE}BSBYRlf7Q2pT0`vFlU3sWXN025uj@6+o~G8%H>q}aTs7(+DeR5!^iR*vac+mx(ec`aJmPL=k{1uV(75$AF z_`ygUa%JVxSd+u5<+>F_Y=24kW(OK`dqc>26jND=ZuPNkRG$6fBC zUfiiZXFOI{$-zy8DSxx>g@OjdY29a+5OHL8c9^TF1p+7!xNbc}P_EJ5t*}mYM_Mhh z?w7i34*ai~+|oS;^0q8-WPB5n+a^~tfrlF#qEJvFyw84IZ(&?v;^4r7An!f^p4+XU zeD5w|Z}x0WsNb(I#2(OmUwBMpo_udm-mGWz!}bEm?W)jick#zx;tywTn|x%B0xZ`} z{s?Hj*dY$>(Hon>3s=91U7Fit@oX-z&lCfdi*X~@s+pWMsV3z%rBdID6mK!}Q{9!$ z;<|3ezs%P0CTyNlFCuHJuv7EF)ipFW>J83IN*{1avUZ!O>QzKng?g;-vzs7RT)>xI z1}0qwCw@<*qP2>qb23|fAFQIKK3inwCLu!dwHC8yIt?;g1mvPRvtX;Js z;}LQSI$jXxM<oQFYB$_gNI#7p3h&CaC2@MhYFsav`dXRBVNu6GB1 zj~}f4 zp47P}f^jnT`}uk0#B-GU(_|qbY4($bCv{5(nnR-Gc7`iR!xS`rIlInOTU_V*AIi?) zL8_S1;x$%y@R&8E^O(WcLRU`*_VJqX5+1hoKDf`kxvD=l@OHpKR<8&C+OG2~+YbD_ zbidT7eSOm7!AG&dyzI!Wg}&sMPeRec00m7W6Yy*4MUcDvKCq9vIoBJ6vgHbXP5Ba^ zrQ-|UgCNWrLJRa9I8S(xX8KLQtVOSRn@iBF84xhTcW{~8CTJ!O2%I^344lF9L)DRl zgcCd5Tt*Rkub>Wc(ba^!^!gTdhVyc@#yHbDZOntGHbBb zqQKK28Y1EqQ=dD+SXumHa30VR3Y?8=xy?pY7nY5YtExEu-fo>(p6A96lLqtG)2SU z9!pNNfe-w-{)1!KsP^1uwQnVn0L|F)Vsz;`T4y}&xN}y+Xu8p26ZKr62? zeRBSb@ND-klR8K5O0jSBu-zx?ouBV|u1q$wN|mkqi6R+Ji86-NJ7k8HeQtSTWV?K~ z*0@Zy5&2(!hd`4=l7HLDl7GT`IR*k(HG`Qw#DV48S9` zNz_njRq-OP2Fy1GU~v%-h7_-$Df5XU6MU$YcK*j!%_e3YEw5>~ko-UCzhJC_CaR&W*?Q;P7#9U%s8E#qkaU@Z-wcS4w*Wx)({u z?cHtPUZY~Z9N=*TS>(iPQQ7Mm{Z>@#SMnt}!9HWI_D?Z344Gi-MSHl*U%DO20vay% z#+31QI1W6V-dch0M@{_H+bwW5PmkYDA))`DlP*A8Zq`jxU_75U>8MJ;zbAJs*Fpe? zQ#mKYiWx~^(or-*b|F1ME(NS*6S_oW0RfTk*a<#QV?s|Jp*;q-V)UpVcJkpbdZrW zkl|DqNHYzQdfCFD5_UIJG9a$MeqCN5b7cgY=>41O?HOREF!kGM*w)L${k3-?bp;FE zwJN$Z86wEu4kG22I|<~vn+36QLD^z5?9bZ1x{rXlPX5otFQ{`KC><`)l+SpxVEVAd zJa>Y48Rd$H;;0wYz$Y5I|Enj3A#+u*XPhrU`wdjvD?sZ5RI4LElLti8D?p<|u6SE+ z8F^&S-xe5{h8tSv^f<9Y##x{z0^)`jMA-$ou-+LyxQn8aT{e+69N=xz1lw?ltG!gz5w z*-l(SxJSj@#~$b9`4#r#lKy`#GiyT*@aKj<3Ov)+P+Cet&BsWNKP#PZyHCAZ z!E`JRs9{)*@j;8MiP_p3xJUc*0?A{d`{V`6;Y$L+VD~_Q8-8&0>s|^T{JNe+-3`4q zIAz!$h0FQ80|Afb+FI{0Zr_`nQ*-gvw@q4z@lbHlrjH*l8@>gx%iG0O#ku zZxG?09No;UtgmX*;4Hg?Ozk77+Az}W$O9arsGWoaXa&leI+7twhNh??`FDr*S#yw0 zC!XXi+j<*c)4`OU-&)EQ+Ke5I+Foo?thuZtNFwqP+0w{m$NfYbm2!y0oj>)n)}5Ii*yM;!i3K zyz#$F?qExCb(!m0g0a7JX~Z(e@rk&SOKVejs9H|}yZMu7oJR*J+7l$mVlr|p?U!j~ zg!(7hWKcgl-Znipnl6d#UWp#>l z(_eOny6z2>*J$9iyNc{n^EMp(088IO{GiA-g14*AmfQ(mYP1D}j_}c1!ZZrp3S`{` zTK--@?<#6hW0(wb+YY2GL6fUR!v?Z_%)ItoO|_WJfW*uOhh z5`NeBE9)tW`+*Xa<-{l3#}Z1MN1=1b@j~vi4iN#WY@$RhYz%4UFd`RLhSUlf(afVn zu?&AGLNFp9FbLR&h*$yt=`5^&oZi&_^JEz!a&BToEAuu9Ju`88sguwPzcvJ(z$wB;z(hfDq8wE zeWAwM)A7k+?Q8uAy5yi-L#;SCbbJ=BhrENWD6O^}o^j-?PnYlTwqp`L((5SmYjs|} zE>DDeAMaj0kv!&Jb5N%-p$7$-yfRY-VK*Ta6(&orx;o6~6`_z7CA`_Xo6p95b|0)V zc36N>@TBn88dr}+$dLR@z1g7!!v}3fQun_k-6Wo(itDta*Jca(drx*;Kh(`InFHIt zZu{Z4Stx)x{Tgcd*QQA|Kc-h-v>XdZ<_eYMB;8JL=U|q)izoPwR6;5x5qP;EWD!L= z$e6=Ar8?eR*Q6JHnTv2ZVDt1$oa`MleHOsld*l67{M|T=)4jMm5-RS?d}KodKi9vp zgn1fr=C@l}-w8D@#P8FGSVm2Q^siGf2)EwpFqll37!yv-{0vie0`$ZG?X=PTYY!)# z?HVB=22tg0Ox&au&!XbbN39}3DLrPx5hK~6mDLSOITS%Z#cJpZTB7a4oaFd&wu!2N zrX^v|K%PnJx>E%c0rZ+5c#4PmjK#yRFL}TO)9dQ(aa&L zzm4Y)dg+cWnvzbg64l%hb47AnlZI|WhrVWuf)|>zjzd(-K z>KVtu2p%GQ0=aSI!*#wIFj#vxKL@wDuCcA!EI**rY6e`&bSq((_|L}hnwyEt4JMQv z^zlmizI^}7TGb}~`{{B}PANcgE7d}SW22ILv;Xl}B5H(Wunqu`f}E&Cr2cb=7NnTC zmV)EwQ8l~XoVJ}BR;`W=hh1SwaaTGyW%#?Z_A{+oZd+iZUR==E)Y<#wY-^6?FzT@D z>9Q$H1yn{sJ!#1cv0F;*tbaXPJ#k*1shW1;&*e6zz+6_cS+2-gS55oC+Pp(^KApZ= ziv({NIY5*Nybo{5T*fxOo@a|#j9)|zwCzn(Qymf1j{;k_8g)QX5|=1b zV&s2Kp}2;`%%>X8HV{xL7dJ$53{rxJhMO8%|7$wcVJLv!95_6@4fPQemn1aKAdZpgf0(8`DPaE5Ug(mWwwLE*Hvdqr6ASk5z>(o{W<1& zHzOsXrt4)-atApIb@%J*D{&7cr{2paZ2e( z-&9Jsu&kubZeo4I;PI>?i=c07R~OGaj&bWi=ud}|oFp3=?D3%>Xh-W`tk9n{r0EhW zr*&;pzDP2X;(){2H7~T$@9*RLV_k}ju*^NMLf!N!^1JcT;{;DCG-Qm0VV+jDSI;jc zhaCR+Q`AVC@D;Bv-Ot@|`q0TBe(jvm$Bc?R$D7`;=UgKySvuWXqVQhL7LO-QgrO7a zx9CjjQN}aKl$gI3Q*_X0JdxD|O#kXnDk!v$mEBUz z6Mpdp#OhSBuhn7hwR*~S(V0A~?#7Pz^5{Jjb=M}}t zUqh945GrRrLt2y=iY0by{XL-hp<^g-QwW7PW9KMyk!5CXC5n7JxY!BEOUw%@a*WT& zoBa>@(ae9IlY`soH6;Dln@Oa30A}#yV3D|zd7!7r<6Wfsz%)^^7zwpIwoM1I85etZ z)~DE%3z2M`h+lS`a9_;_XiXacs9gCZh!ms;13Qz|6gQ@j|IhktdPgt{f~Icnc}fa5 zK@xh3wE=9KLb85LwpMqCmqS3d*Z1Eq@%S8aRr(tGoQHy4YFbA{x{_`{yYP;eOwjbD z|Nl@=n%n=#!S0Zd)Dk;MZlR7-jvjXIS&%VF12+}~Pqih~rCQ2yJV)WntjEEg7rs)p z7|b|wuBhtzybh+6KnCp51SSRSJjPbw>wN8RzOFBS_G8@r#?k<&e{njYn&oG?g?G^Oq`jFm@1j+ z{_p5~%-VFLiBP`0xNi&r2h-u(cdJfG_gzEdrloKt9y%Otrb^%-2V5qq#=kxOQ-`!i z>90DH?3=Q3X*ESjS!%6Ue(ec(VZ`Oj#&EPlfX5XJy|qs_RtEAErR21!!)xEN*y100 z3vCr50i45VA2|KbEsst@>tqFh5*?lMM$ABKhT^j+dvE?yysnl^acbaJ9oyehI+fVv z+cbPE4gUFt@7T`f%a{!|q~PxBnjU$F>cWAfO3iUm*i6ZYd^Ds!fzR-V_Sw6hk^ za_wJiFzLyv59LksD9dcE)Iqs<>Dsr}yx6vr?IqEHt~LjG>o~<#th0@(ygV`&p5RH@96X~52R1=15WmpMMA`goY0T9-(tTnSU}u{BRrjy_6{TY z)8u``P4ca1dyO=^gAjJ3^kOsgBVlLE)-+xX#kVitlCbhuRr_(wm!bEzszABW8(V+N zG@g^+du5uXc$=9DmDlKao7?YyI+bsK^tFup26tGv+ZMF6i)`a)LAD*Rqo=MhU;)?MRyUI%sh6HQ%0TlQ7LCEf9v2p;a zHT!jbTV(Za3_@AgR>H-txHTa7cVk^RfJA004HdvD9mH=yd27pK*3pE>Mq;R0vd;4u zY{e~#rw;tJEBT9bstK^3&m5iBD9idmJZTk+9Ez&4X)o@r0YfrGzj66~IO|I;fL5A! z$3I_1OvU>>K>GU9j!v)B@ggyFuz&6IKFt5o6ig8ewNE+ircqoo@`iAR!08RjKK?uU z92$Qj=__SZCpoAC5&Sh-=9-cyep7+viO%61+aTdttrhYEo)Mhb$D2ARzC73cnG#Qn zd%39>;AnS=qs0xeJk<-B{~1m<^~BcVR{j6=nrl02r#}a0i_4PEe||Fazm}&K6Mmxq zi}}Cs<>vnqS^3?kwYp3NX?^at==W;9Dh%HQQ!HXFYQrJ!cFJ|jdbMw^6}z`TbBny*Xqy;6D<O^dxZPi*|5#Uwgzh zxs@GBBr#xdQ4{8wQz1F3NPH57d1TWE03T7|U!UJCZDnOw+bmNx(>zDIg$ z>54L2)u<*eK9~g>Dpj>$XZAP`n!H1~^T&*cQ$MXk2lz=@Hraoo#aM>>aI?T#`smP~ zxZ=$$Rq1wLT0)yNSv^I~a_B2yX)B47W(=)YaRCWemRsxA$*pg{t>+#jtoMi|)x8P#o0q*l7Z0$A1Uhxf)x(oM0P zWj>qhF$S+X^bjM}n{2|SEIYrGwuX3ldqb{+k~G#V=g(!DS07q^Lbub=v+W%3@7Q)7 zTqqYH#P$cxanPm4oHH<*gwNls{JbtLt3ve91N1Uc&)yREAn6vOy09yC{jM_2WR-OME z4I95iKL)Xq-zRj7r+q!IWky&-YAa8l_ET2ITWSyQw?2+n4^_!^ho0=|NL2IH{MJ8y zBrY^FSkV1_Rb48N=S3{Cp`^JCuUm^dQD2vUo@yIVo*rmW*3WDELzDcHZclQ zL*w|yKf-wrBToi-N5M^JKkW5+=%lJ+>?OHAixXF*8K6G{#aDw53Z)eRf0D}p4&xT` zDwRn?3=OYPx%$Qnhu*fX39%SxjUEHicV&%)q@pJwwvDYN}}E8 z9?P28j%99Wn2*(;hsmOii8gqaZ7hq_Qrb@3t6BrZ4w_WL!^vU;ZX7om!sM;7Z$mOG z98ObUfVs%agJ?j{v3nG_Kx4VXqlwxKSDO;quh)t(}MtulD>r(lkWS7^T{L$zeN; z-UzNv)A&dOy81JrE`P&eLY-uiem^F9@yrGi`yJaFW~-J?u2dKPd=8yxbEx-jU&9CU zIpF!$WbnYNZh+5y8jiAVP2|#O@O=~dX|ws6QwW8}p=lU=65`bm>obNp{?&96_L;F> z3x`iTpQ)!3>5Sh@pxj5CJW7|>+p(A^KRIuF980%8t}OIJ{a~IkRFicb>)uN=iL4{f z+CHMQu4#fzrl*}F&7I&a&78>WIjh1$zhb$pt$??3g?Zz9)R*msex4rtzG%kYuUAL~ zwpVLUs!d`wh4emUk!-+COG@Y(-cmHW?hM(~NDp}CP36{w#4p2vuG$aDloy*alUKJ; zh)eUo;IkqMbWMJP7jCJZ`x1ze)(Lux)8sM|6o+0PQvPlpE}a_t%Hn8NCjC|kvTl`C zD2B#!UUX--U8DxCFQsYGP%8>`;tsW~8K8khIH`i7T#PcN(!x~u&Mo^a`&J{qwY(|s zs%OoYZH`^^Sf8JRR!L2}AY(boVPds>mb7U54AjajPpS;H)+Q79d|k_FX1lJ6j=zu_ zKMJ1N(K8NH0C==!^|lD>m=|j*y#Nt=IXg7VU1E4B$Zxu7Q0@xY`dDP)+i;%Cq#@k;l8jL zitngs*28ba^H0)_;a+)byMD+N$*qBHn&dI54K}J?fk?c>{RR_m*5!N0MpvqnWxK&H zKTJEur?w*MY)8|*4HNf$-7EQ_%ZiQhS+Lqg7xzu;;rDU;INr~>z}LmW$H)DAxoo$! zsh;{Ci}ihDq@MTuI4>!{UwzdD<>u5Gc2=>DG@HZ)*WjCIF__-%yKoTD5H~*m(49N@ zOJJv8#AP5^-I&v*Z(dxbV;`IAI&-xSch(vby-CUJGH*~j-w&O*4+84UYTA{QO zh?vk1e}vmEwSqxL^2W~q(A|@D%lP$z=BG^tn=WB~fCFXLEwkmLa+l}8T)Af@-1-nS z74kfviMkSvo_uMA!-A>SI186bIL^DiP1XIGicTxL@M~jLqI%OMP0-M#%`lXOu@J~j zwe0Uumrpa$;g70|G^*Y3TWZ+mfEx?T%ry=AMYM>;2tjKsH6z{`(E>@tcBGOsUV#yV z{?>kVan;)b=8!VOgy12zvQmS2rZ}m^Ynq2g=9ANZOU(C`C+iFjbZ;`uuK2QZQdz03 zSzh7a0_Y{N93kx3rrp}JoW%}-7l5x(eM%a@uZ!w%yWImP7>?xsx{U=xsvDx&JH3m%S^D;Qt+(v? z=JI|<>lk++9j%gMX0HC~SOVb0eYg1ds*`qCenZ1{2a4*wI5VeV=H`$#TsxWi=*(2h zFvih!XRJEe_0Za3Q^5Zb&B`Fdu%R59J+FH_0=xJOBl*aVEBh!$Fy?cxSq4vdGht9* z{;jM(goUL5xIv-MYvcB=b;U}BhlVpp%a9v9hQ-Iq1F5DWCFsfLn#g*QK_74NY4AI{6cLPPeZdf4tc7xF4FZgXH(TPIWMHU2=o~!ho#kiCy#(vS=zeHn%j8jXQIy zw{DT}-IZP-c?>UT^#-N#Ot{ct+|mM23Q+MlaSmk)>I}@Q;i607Qyotl_Fn=VDz!!( z$FSR-3R9Qx?4)Ug-q?ost5%`#hGi4OLdVUwqseA}<(fT78WgkOr!oF9+3U?GYP;Lh zq!|(b)0C|ItViN=f;$fAh)7N~BOI&Fr^&Q1-&$i$mc=P zVxWWcSwJaGGQTI3#+lqse49J^Ga8Hd(t!=FZ9`b!@xy_{fC3UDEXt14hd=hnLV|$= z0dWB7$(dM)AOsL%gye)(n&LmKI{M`M$N8P8I6|7jj}+Er!pvnFFOhv0ga#FMyWGM6 zX>G8Yi4HP`5XVW&v9iu{bh|9Ro#W%@wK1$_KUxiR55{JC>fBt@N$m3FVd$r}_UM-d zP*Nia^q#YV&9VKNpA`xEnIEb47Dnz;5o;C|F+)c%6$OW3s7Z-iBCLm@F;a8AF~ zm}eijzfL_R0v~5QtNVLq^Bbac%mK0AOB41N%s-3H9^Q1?4wx3`@AVM;0{AM5bvyO)B+#GfN`cefl7WKDV?p9xa;z zaNgAI6#p!XY^s;&?-laL_drC>7nYG^C9w#`g}VF8lT)%!r1v$ zZ-2i_h9QB+&((L;o~7Xc9s#>8E#25k3Xxr+G+u`OD%@}udXceBfSHWsupKWBH_TwW z5mr5Lep`&TfcGQ8I(V{Q&I*!%;1 zqlL6md|(PNWnaw?0Q9_{>Zg?G?ym(&PB(jj7!iF%u!Nvl&bJc`u0{fy$;Eu;su!QX zAi)w`MxYmUpIFqP$-wey9oe>Nj;Iw zs*RzjNO!-ek(RIAV$i>5&HsK=GC6!b0#41~ojYB?4`ueyRjda=Dib!Z?ZAq^X<&*u zOY}@8y=RSj9~>RTP(@{6CA6s}q#j9IvRPA{#~W7UMi}s@6OY4p9NIjW&4a9I9%tTX zw$Q(;P2aI{AX1&7P&g-6!o2iY$kLfoeZS=F2FXI(+ZZ25TP`#O7JQ7*T~9G(3_26+ zwlo@BZPJ;=Y>@3GCpcFR%e&s~WTR?#|}t9*behfbJgFoLj`;Z!33ND9W5SpWy?!9{LvtbIL>183e>^E&+BUv zWuYwr1tu|t_0HQ@6=7cW_R!kgQp&Cf>iEE`%IkSJcQ~z42RO> z%T}{#ZVxF#!mz==jsm*MI@VMWO(6bUhbnE2B^OxS6&>l*tqT?$xbIK4GNgb(AJSg& z%)2kT=F_?e0-X)2z=z21RvY#2fnNq@z5O@u#zJOv{et<8b2I?o|8jajELkDzUW7c*@bvTZ}G7PqowB zZF1Z}I~k_Nmk|OndcM4^wXA$vqs~WcTb)uSK)oSAZFD!_clRk5A0(T$R}~3egjhDx zf+T7R>!ypP|GwCA*Ly|be#~1$g7l}4D8mW5$B=(rB-KRBl(qF6Ic#3cj<2_h`_<0J z z^{4`wCsvqCR)ffTw!-wsE>fv?Wki)J+lvoY8IEH*z1@Qc_S#d{g;B;R5U$*#+IH6Y zvi06k86?xHSJ9aYI{HWymozN`h>E<(Xb`O3*8~B+wWJ?}ls)(vf=wIT=DsBYfl14p znH>3!gL)S}{pC1tZ&y^eA1U%*^jK$ndi}T`yMVmV+j-2OmL&1T?m(hE9={zcHgP1e zEJ5SZf$B|n?(D3AE7tIkX?3EN2HD9V8F|prho_1JT|FWNhgjjkZ4Ri1&q5=UQn-_` zLPNQ^LEU*l@q3U%%2$zAiysIUO!)Q5WhpKZRtd1jjHy^-U&}KP8+{b@vHC`rv3C=U zX9e@+Q5vHx*Ya-*Q5Q5znJo^7g-;HTcMFzhTI~^E62r`1j@XLmb>Qu96dBBEN%jv| zEn1hl-2-*Tm1zy)2S`tZDY5H}ii#_23K(j}vqc7L36)PAa86pYF%;@@vndH9^=E6C z2xkh&YBQ&8066Fmvy=g0=E_zlA5HwdS|rO*WSN8G;Qco&+A#zSlAw>RrJYrmlT{_aX}*g=rx0K7EMr{1CJ}IzX5=41&xh{mDz15 zu$e!a5R3vXjDPS2PITiuckP%sSuhEq`E!IMutEgh6|SS$fO&LPr?A)GZZ3d1?NsQ@ z`?WZl9`$tp$k}8jCBP=qKIKpkH<7oT)bTDl$6C{KI$5oM!^K$FJaaVhHFGxcz1IE7 zjmBCxfiRbCb+uY2f{<;9ta7+z;a+DUkG1X`(GLR(ui{meeN?fW%6`KMT!75OLneeS z=yGdG%Rf0y6nU3J053>LuzR-(_#7EbV70UW=3Z&FlSh!o@mB?)R@eRg!5(S$$7oNR zqmJj%Dk9?KEN80IjO~q-sx$aY>~c}2p|L!5hbgI^r*HdK%Q(TDJ_rTfgGlXHUni@k zS_c?jUPdROd&xwN$MK$Q92hL6ihO!0)zgN1=x}6(d$6d%RfT7DhlJEm?+mi$AKV~*F)AG%F}?Yvh_icvu>WRB6Y)NLTsR}Jl~cl zZ?o`bH(taz@oGKTYM5d{(Q_FiftZroc1u4z&`3qB6>f6ozqFJp@!u@4L7Ecm+zhq$ zDXRK#8XxB0KeXyX7>xQ;9!2~%iD$D5s4tzknnStMK$y1Ru)ix1+ANdJrji$|SM%PS z5W9(b!e(iZ-AKpdC~>)&sKRK5_OLnOZpH_SW9!=&xtXIIb1iDMm(X4xAq`G(NX{*v*3jZ`rO{rg)C%udt;I)n2aCbe3^?9H5*z z4^Un zI)rby(rwhh3vD!uP9Nlb^%4UfGVBb?LR34`R8`vFizOz`tn?JArWmp__rGe*U$?BL zet7t%Bd#4rf#7nr3=I1nuoq}US@i}KZ?v{c`Q zHMWo7q)2T33X{RaGOi=*9swc5D->EhGOMjJ3({U*xk$5l)Dn^{*(;?bu}Yh+W=@zB z_SgQi8j2Y7nlg4Rdn*S=t*X)JzIz8gg4=Y2B)0T7(8_uSPHYa$-;CSH6mX+N4L!Ti` zq?>w~>d!ZId-%l~nA1UP&`4N0`9&^iiT#l3z$-?%TdwxZ1pT2oGH$zf`ZH4j-wQFq zZtJkB`HXX)POBhP;F&mw6DI6b41nE*fEa=zGG=k)afD^wt4b-cCXRwa6PEiPJIke068#CD7X5H zgy^ngz-Jo*>1JatP)dpZSN`6Y$;d|VHB;iDb{7$46j&YSh6Ll;CYPp%JUf|^vM9T3 zAFF(U;8l% z@RXav4_<;yFsM};CjZE>!&Wx!d=q#Dn#;Y0?|7DW=aheg%kvvJ>Dg4~0vB>ygH_aX zRsRNucXDfOfvAy!!>xup77o%ZTz<{a8^6l6v2|s$RYaHU3)~5`k!J_G#T`;Hfmc*3 zh|tNuq=?p`D_`@=J#O=h{fyL(1Z(@|qPZ8k*zTEw37K@!qMWA>n%&+1W9l8FbZ5F~(YCqUwz1o` zZQHhO+qP}nwvFAkt<&#!?!DvwsMM-@Qb|Vg)JSTrIoISQ%NnjM^}-Hlu0*4Pvcqml zj!{F6oMpC;N<-%eM&Sk!yBL z&BNom2s15SJq$IuOC!bHtnKl&4iJntdvw6-s&^GRw&1f^aVF{ZBMxb$2FtKDK{YT% zgU6tv2GjQb@eq0qlD^cfq4G?nun+C0Wm&7-JmDKc(u%OPxc&HkE!HXeeyY4n)mbjB z5VeL#=PP8~P>Z9}74 zCoR*BD?iMjhoeEstuif?BKX3mM&5SM_mymc=uo(`L@|`JFw##<;B4H!A)~{u!iJ+7i4I{+}s17~FvO_C2QC#q1 zB~ZiMc;wl!cWeR@0ac%tl>YCEo@XeG#|9VRPb^{}7pQTOdT5uP;pFqaCSV1E;`fw5 zVZhPY{(DqG4Pk7)3k)RrjQTKf z@yKBasD20IL8vInb`!%+e||>lR*gC_BLx&=kWSHYYl3Tam0>VvB75$`{QGgRP&|E! z)lQ~A#KrV^Gp#bj=OF=hSVE;5V|!38=PD0UDFLm>obLZX{2(P$%jd}$FQ!o)wad5n59JZxwQD|ZyKSizMJfW1mRfS zXz`b4V?x+vk=Cj8RHtFxKD8ir9KO0M7h9T~pe3slMSJitdNqKdz?gt$8A(dTTH$3+?4@bgaU6@jjIq zCa2499+AB-SfB8HT`L(G2#aw&E~@Wem~@J@oeXlT6y5@5vKHGbq>VrC3>5FeIkFeD z^FWmQatYX+>de_P=uFM-nynuQHB4=pNmtk?JIxZ%lYHUEl-80Xo^G!6R*V28@q2a4 zFaV+D08`6@4lYRxv#axNB^>N_ z3OaC!u*fY9NP92)9z01V{M2iHhiAoEJn=B-s=(LY+R=m^m^8qdK-wOsNx7XDSj zNpgd!GZxrrsFQU|v;aV531ue31Tnz&%Hjg?0RvOr!D!^ZJB&@uTQ}T6bT~}eS)-*6 zcY$aJYYh{`_aleq+Y6r6G}pOAu{nZ}#&pG|VmA)>P%gVf+S}_TLTzI_`f%kZWjD#f z4{(j4eA*3=hBUe1dh9ERcBb6)2{`XsgdFP$miG&ed%xx(8C*^lh2M3NQph5|0k)o5 zxsU`(EZ@^uX-+=9^HFwIDD*viUpKnj3ztYG#vBd6asSw*01mcGIxg?B;|}ZT0k94X zs9{j4hE_p3A$@MgFJo0}tHspYXdbWct?vT%sa2d1mslQtpuCMTvOqkDp#py6z<{;e za-r&FwXl@PTLe!n;q<3fetA!X-nO8uJ|jc)h)GtPr$touF8%XZEzE*9kY zZp^srpVrZB2-ijbh z=Oa^qQCVc+ZYG}ufTcByHR6xkfifKC?WY{(L+>|^!LWEW#88kHmTle0-Xvs|K?ynh zIKwHcC&hMEJIssES)6WG#t10-wPv?M@TZ5*nvWj;(?E;JNF>EuA0fRdXu;T9X_kqG zkguS70pbv$gz>W9dx0}6z%22xO!xX}6QgzAuGR+IcI_SdG&IXeK@v+=fs&iGq;b(A zMz7=WaCIc3TN`pc=XyV5TttP!3RS0&-jFZQVD;t+H$wor;KIqo8a1zeb*NANgi)lO zafAC9gZoTB$x};VnO*~l;4SJwd|jlbV2%}pGRil~ug?kfRHQ{= zqFuO6kBL}g5snUH51omB7ECnG)xlRHcT1m>{#uf~E>097GaJA2qTu z_*_l`Y`FGDHXS5L*ceT6VIr#RGv)Kj!>s3&_q1;H_-`xhj&wx-;qkr-kNxzFRIG*A zB`B+f4m{>=hy2n<|dn|adUi>quB2kTrrb%%|H$A+-)6@z7{Zf@Mf)D z&J|=SCSP)N{BH>7mf#sz#+p|zPI_5)?b62vGG)i?ELIynx5qS6(EL6(Tx!P6CbD#} zx(jkZ?*sR<;wq0kUe}1|_h0tC%Py1+ppXMe`ZqX$EVcuyt*vwo+HmPW&jJ|FaLNlP zeje<2#d!V-EA^0&sDKWC>lB-glL^j(1}2%=bGgi7G zcF$@@KxpA$q7m!*gQaL#ld1ueVwzd~&30P8ulxg#{0|M;VUk$RHc8cUW<7)3_9HfK zR4C@tF_S*}su-gxwt`gZ>r{L>W_7LmiH3{aEGl@Rj)nX`UE7Yx$jdy5GYulPn0=tw z0N~dvy>#a7sBJHpbW^nJG?DTTj(oG=_15t`_MM7%$JHIqG&>c2Lfs1M$&|r2uub7EtaT1L=ia07Z3j$D05j7 zrt|m5CBu@#mm?u^Vx6mm2*!`N2FmrkUI^Z6-AGwz6v%f!#KYgY2u`sZoj^NO|zLziRf0)AhtG# z&ygez`t8W{nh*zkna!pM2f|t2;}sl+Z;ix+QLyyaXUzX4*Xt9b(C1?Qv{=rHun!8owm6faz?{By$rDm+3p&$uCoLkRh&JJJbZ2MG4DM=Pq~x8VO)$G^zHZ?6>eaKa z#&$I2rM16Nz*FuP5p)8`Bi9-rfw*yrt?R*OY8T7ak2l@HnVka9@V#Zr@zc_k8+9hd z6{8*l2F@j(&Iy3;ZL+FqRe)fN6v{v&JeslH(vzN>hh*CqUsvy_$Z6)LVC-&GKFVRO z4KEnRQSA7ekbFi%)v?feQ#!M?Lp8RtvMv9f>{X}BuLpPQtcW8aojXOHTiGn>vqt%7s@+y+4W*>pC4KLv+v*m!hKZHe zkeawHXgB5wdT0I*tTkP({GI>268owU`UNN^TvA+wk5Ex`K)w z+di}O!-!c+j2r@9u;hjCP&=BmKq^ZLnhtsNrG767hWWH&JnADY1dCcHmunbLisQ{v z4552NG9n0<5#LFaP}TMOt}Q3h!cMz0fy*e$uRemB#<-X*iw?2c62;CN6oQ;wBYX$t7)8yBh86@0 zhT13t>Lxfwv}yXq5fUW=N=@Fe#jDMv9^a76y#6@x{4(g7&8bnn3|w|9o{EmG1h)&* zDf0$1k{F|5PjI4u7%hSDvFY2cyV_Y#2XB=()X*?LHGyQr58SC{;D&QSx=7TGP*a?55bv14=Y6%ZFmVQ z(BpU{ojqirK@~1)=$D+W%4=SJgN_luK}TejZL&bgRq>-e05t92G>QinA90Ck)3QcV zx-ohgET^44q?F_RlY!TWHSQBg8pM$r;U5)v-ftU#{U^7>fb4%jqp;_rh^I((89~ha z?`Q8C2VcL^r0(7DK9Qc!wQrgS=uDSUMj5?tq{m#3RT!)Q3A7>a;GS42P~UO+afNfeF}==}IExid^N>iIHc-!i&UQ2=JQhdP7)BO9`>S5f6!AUi zRSMDmv2RsZe!-3VK=JsBJ!|Xi(190Mn0EOqRFNL62TDrDRPGlyX$nzJreB}h7rKGO zHq-K{t2{?*Dm+1-ab53r(|tWrvu5L3vzhK#vC&WiF7G0(QOgmdga=apwS4BGQ&&%w z$aDl5B&-Y*E_$rV*&3l)2{?kAAgt)GS>Gg+8*`T52_@8#kt4z?a#J@YuW#k<-haZS z?<$v>X6o87QDGVo-f=135@Wxe@+kA8Y+TVV==}B#Mi~^?I;?}T;K6`1CN$=@)$_o5 zGrNQLr7cNm?;z!)XL608Sqz0saZiU-lfh8cI{=Uef9hbm!!d7bQUFZgCt3D1oIZq) zcM)C>U2kHW8p8}<%>l*VA+7}f?@2gZs|a%TTC^rJh?o&ZqyUsh=*e zd^aqF5=DI#0<8)PQ=-SkdpR{+^hqB9yMp|Vx!A5|k%58<&rgtLNB_3h1tCgjNh?_+ zCw5qNrMPsfP2?AeZolmzO)AtN@2#;ISa7~U#$Xp=0Y29cR`kI?lqF3TXTZTWpficp zxheNJ>~dinsMhVSo`4+Uw?#Z1fXTPc-S2&2vKTJysolTBUcEPT5gK$LMu-d4zg$f? zvjOtfK=XYYPJJZ#gEzW#Q zezy3lnYA3|sY{G@FURf0fgafhK^E)4mBfqF?gS`i=O8dbWFpwIwk}nOcvD-Hl{|r4 zZcfizo)&^AUF!E^6o`m+nyw|_cO@cgn#Zp)TM^RY;-*}p@9QB8dX~wZXQ(MvW6CX* zd7bt4ad|UEY7f+B4SeU$d_(DL@h*tG)0WDiHnhrz2&3R>ucWwUYqV4#rzUviqKmfl z+W_}f*I9VaMdWMM3HVWN>{A;VT+=~+)JRq1v8Gz%x<#niP*Nbvgvft((#>6q4sns$ItC1r`W0a)f==M5n55vXZDRjN z4M?w10lGF-WDo(`Fav;D6`4Mq^VJ?m8D8n>S+uDeEQYkC5{$_O$9us{#H@S>-QsPH zJY~H1Q&R6oPR0;~gdRJwl`Ah4(+4s7R$pT!FSfcqWoJX7fGstu#H#3wc81EXOk~Gs z{Dwg#4;5yjmqlVcq;_933Gwl%5Hf`L@fuE|W}5kpS|Q`sSLH0jH0qad8@PtCH^=-@ zs^%)k#DWG@OJDJCf-ERYG9O>M{(9Rg#3@;?Pu$8YGpvl0AQm{4Vmf6Qgol_>#L&bd z(&CwNR-KFBu$d=b5tsi>^GkE;p914uoG-pzTP6lkK^VpgZAQY_%~EF?J}PvD%8rBb z+yL?ovnK*uT8W<82jqK@eLf8HSb5m=%e3&8NVw=}Y5y>%S#(woq zpRa%%X1@3NABL`;c5dAn;pFo0<4Ps*L?e2WTqf%kaFA;dh||{MQngxzQol9#e&pj- z&b}ujpn`3j;~WlAXsCXFxgT;>_|db%%g-xhWC6Kjc>o6=J^x%ImoZW~=lhrx*Y zO%+rhk)u&pRX?xHKZjVT1iP{r_u6QLyA2(;$HQZ;@<1Q+&U4d&C;i<;SY~}U`yf2tmq%V}LDQr;uAW2OrnRDgCgPx#OyLFt!B|RE&5ud> zTNQe94hF8VCO{MmpyB;XTfmA}GYXw3b9O*96zOMZMTD4P|EmM|Rp?h>tXv4XC^-Kg z_({4d3%G+~(cDFig4Cf7@ZID`Q^L*2R|&_QbtN zG@9!hvmXEXac|8^SmEDLxs?(3H!g$-xn)66^ZJ!||F$CW#^+<6pwKp=nGkxkNd`A| zA)*drU5X<2;)Q69Jd86x8rCb%T@D^}FgJUzsviq9@7R7PC>7`p9x z_too?%@7_7a9c~_#VR-{EQi?BCprp9@Yj;2Hq&~;Nzy}!zgy>|?^=e>93Z&@9c9M$ zD~s$|QgG5L%|}@?{lHHuLQ6B-oEefz#b!HVw!mdS0pSJKBSNBqf`An*+g^vYc1SWJ~<}^q}muPVCXP$G>)-x z)^;M(PeG$eI}-6pluXHw9W$SuaHQ7Do?oG(XdW|x@uJ|fd!laba-cV@$CEwd!FPMiuS5B`1CpsDxM51 zS`y1rO5Q|v=aUzOd0R_7%#&Y#i1aC#^s0DkhCBXHgep zgEOK`sI6t!>T39h&ASa%Lu#34X7kqcg-t)d&q+%PHSD(gxr+7sL3yV#JH`Pwp6DF^y-zMCV5aWGWmI-h(umWo_}e6!pB!En+q$`p&?tuFm8m+XLe*l*QS$_tM80&-{^>_<#M(uF!ewzesUa9?*2j@M`YVx~`bFd))+uzg z-%{+imA^Bk-%D!TeOZIoyyZ}VOx2)z_=EFx6q!3R>dV9NemDH8`}00LuSznRnF!!kGE#tk zz|srEIsseb0`l|xSon|GDmN4Ia6l|P)@zLw4TM$enlTQTwGoqBluB-vpN@C>H;nvg z7Y&X5jb8EL^Zb52JMc4|j7EiLTZ21SJHK>Xx9FG%J~a z{plW_z$dkNVlw%wcG}3+DWmH&K*l0k>k&REFStuh#W{Kh)F>|I*+cWplmeR2yoDSx7A@=4qM z&Y2QY9}Cy*xFq4aXv|dCaz~*^prb@_e+ww$qEgQF0?T=Q2;F_*GX4U|rD?!__<--m0~8rbCk3epy3~WYmDu`xpPQkLs;79m9X!W+b5Bl`gm&c`Z33) zUGB2d9u0Y-6I4&@6iCWmhk4HdJzavjU-8nrH*)RdSZ`3xqZ;iAaCv7(22odbUAXR? zj`((JCL1)44A{0WkKhJ?`l!x@Nko=FCZ<6eekcOk0RQlBuk0jQiGVK7q46_l$EzBL zF=--VMV&-mk^q?XNm&f&$PO3ESn%5tGuzJJ3kgor-8}%6u0Zj`$n0*>3?@*hk;ZH1xE>L2W^ zZv2B(3TWlM3Tx=XqxCP0!%kF(TY+M@T9N^+bsG)*Jlpi2|4;xIT>_d_jj@rPOWaT; zfqov8_&H(xaj;l>ldGC*Ht#}czV7`*hF!bO7qPz_QS9qNSQN=y~&~b7=2v(`>@NM7n^z zd{_HU3}#<}AfG?_-loc(gT?ov!Jc8au{Ldh@lxIdHymKwF{VhR#ToTdcMw;wBjRgh zM~4Ox1HW-wNfbvFWG<5gkVOaGv!O)O24nBbxcnNJ%+qF8S6w%a(O~a(>c<|=fXC&` z%%hi*kuq(r+oG3Y!Gk35Lt-}>RoS#10Jet}R%*kh>J2^-CVjMWxBZ4sBxD&^2hZGx5Rz5b;lOSAVO%p_)G04Rez>_jdo4PO zD-wgadPnWwSMVX$rH!fN1a!V!06P-JQFe{wG|*0S>=mK638|C4YRz8*j!c1UwoIrl zYBi~-k;4ay@ZO(UPiwG-96Ng-dt>Ue_V%fp=x$&%!-9#|oY~k%oKV++` zw*5?+CL%_cEOQRbjjG|2G$9}su1vt@Pn~{jWjjiR=NY%uEzC)kTG`LA__#~MUvlt6&W8turJF6v9JP-~e;< zs%XwIXiwKF&{g`q!GtI60XKE%ezqW0ODBwOCi~5e!vt_4hbm{Dm=!shc6MpDF!M8W zRz%jYG9UvGQ7#%`+5=Fu+Zcgcps^MWEZ8m=oH4UzzLn5$`al+@EPgzkR&9A5p$I&T z&zATW?PHT5*_PWTk1hHy^eQeUWDrN;U2|jFxiGxv4Zdns+|>B{7UnBXtAZRpU1e+9 z!u>9m2o~}U%z!7ucs@TLewK-7a-1=Oh%{l;t|gKhbb90TM$6|2b0^}U<~1*PxSgwZ zYdrh4`#QV)B7Hl@?qc)ycVZMAxFqzWhD8T!zJFpw#k%j*AX%R?Oo--~a5EGJi^n12 zBn6SoAECRUWisj~l`y!8$OaY-tWX{9)hOt4sPBdsOFGvq6Cy_?tnVNoY2HigPq7A3 zaC@8A`8OOrB5;U{*UTv+v`O+#h2aJR#|9LnKtj^5xGbo-KKNp@fN=#E+6$&9FCUxz zF9rP-pSl#{jU7QYB5*?&Dtq&TNb5aarQs%o(ZfFUC6KfH%#6KM&bW4US*gFS>roJ* z5PP>5c+p>TXZm_AM?X&t;bOoY?JO&&`WsS6Hz>LM*8oo_ZKT!7yGXYPc)L4Ju}LV= z4_orWv#JcttGTD>CQ_1%CF+^r$0m5x0>Lfq!kAy_r3D%pir3YUu;?&WxtuUr4};?R z&K>KD^O}O~t{4t}$kmf+m+UD#=?eIJKY+0qRAC8`!;96}8dbmrBxMKqzyp_(94$uT zW;-oz-I?7t!X|!UN`h%7i>7*yD;LdaMbxcPMP1}V`cv-T4s+m=l804%>&V=O9pz)p zieQld(8>5rgLW!kwigL-lFf(DDbuG}kqr0>XPAEjfgdR7K%nJ0KKLR1ZQwi{+;cfX z+p2iLlm)4)2ArmN?8{U1ja$c53fzTk+-V)B>AiL_#zO|SCzof!*=GQcJg;lPT$WjTz{o( z_(YxUTNYxEHt;?jT;~slUwv4ip&j|kRqAnYZZNH3JX?-OXTCR;+%H61Dg_Z8u4X5Do2EpKE`b-9 zB6RBiITZ7kWqSQ}2J+YwAkHDm!xv7EPnCmYGX*`hfw9$dG7mC|h&^+fV5~tUE@1CI zf>fo#x$Fl=;yq68MDKvI3}Gee!#HIvC`!sO1eK1MP zNaZ?cAm4wgoqU~fQ@)_+MqOv3V0LelD9eZdN(2qFimp;??~ki&tc9#?pWX%5O0uC--6z|HeBRG{FD zN_<0>v6U8ZXrI3J0b&ZA19J>6NC2Wi7G+4TtR>U=Dip@r+Gm{G1Q8~Km@G5!zUTjK zEo37p+y-QuWkxDwIs`C`6U08bP?E$zv#~&Y7dfIiBovSqK<$mJHaks> ziOcS=A=I3_$wVk6oOnPROXFRfDj`|o@ze@Ekc`5;T!nCiGcbleBdu4k?SOD;j_qnG z4UbR;P8(1uWqqyfrzL@6#5_{gQ=rFymVS-q%U-+k;AihTMS6Q zY~V3zvVGLqB9>(wSkR*3dVG`U($c%X`Dk^*5$Uh=--O25~!Yd7vQCpK|Y^V|wl_uaFTdIo+hd4)I z6yNQ7mBxmj?%7iF7$6~*s0r*VW%vIAVyyjTj1uR!QbRric{VZlO-Dbgm^=LCK%Ns? zcLNeX0RX?QJ>3$v)-$bD*dr|`($QF%6n70J3L;C}sY1}WVK8HsyO2a?LG^C5n&5_R z)WJa#c;Ev3?l6TcfQ7zWo8B<^>W*aazE$3Pv9c$RzQ`Oqj5;~Js5FM62AqQitn-#d z!tHF%zq%yEikHlP{F&jkFLzI1>_04)yFCf=Dntn0eXc5LCOEV=j)i<#gn3fHtQk3& z@k29gP7h4uc|uD!!9g_O26x!`T!1ml9%hJ--p|lsC$x#gUEWR0hVAj$v&{>e(PX~o zx%RZG%r|kGsrXz7S;tEE1F-B~Q1FRIlS)sTPfz~%DB#E-*LSL!mCu=jm^1@mtYpog zbQvW|X!r-m)GI$5VAMTnm|#uG@%*=}S)9GzXLxAj>u)n`MEH|7yB&vZpY{PeJ^P5i zk)8vlwVs0(R$7+-xcVj-scB?CIH~Dx&&OwaRt~V0s?i^3h3;h|-n^B%vrnL{bb2_j z{*oH}#i@zrc5Pd}I}-s#sElp;dxy{a;Yb9S8!WlqR|}Gh6m-XU|LTJa-E?3 zO%B7p?<<)QInF}C>9YC}w!_cAiX~$jmd(~Zs2QbJhh7X_dakDX5#e?F_n3g42v&vb zqEQm6@fD04;gp2J6H-SUf_G1k>DzD)L!_=qe^N(&l9Sw}P&h}D!AQ2nnS15h=3JHe z{8*B_$n%X5((G{#^VWb>8307~yF4EHUZT@~^z7UkRB9AERuMAt)4km==&rs(SrJ-W%b~%X2kfzwL3jNYm1cfzx-w`mXTX+OU2VEGq2K$e=Mb>b zcL*aj^WR2B^Y@0Ij2&`SNE16*=ws3AtT=#~-2kU_tP=uv%nEnei@}2M)I^s7Ry$7? z5Yo#C9Xdo`%tV2TEg&yH5Z%kh)5FNj4GBf8SP`Zjlc3$jbJ^U{;~6-IsAUtVoWvVA znM5T@4gIE@ksW!U(T#&cqt!)oyF83$vxEv%`{s(UHx>YfY-{b8mK9H9>!d!Q#Q z#8PtJ1?ph`sXejTa~ht#h;} zy892e#&=&Rk<~;jipdK_D=tK`^Jib`ZWuYRr-4CSWK9y-b{i5*&Q#zBm#dFdB1&4? z(}-Q7X9tne?+>kDyPB1Og^Paixz#%9X5~W;i@Ft-7`h5hV+Oi zs}fQoECFD)%+@`VC2(|&p24X%RjeJK{~wSnIEnSAnjMPG`3HEppa_*bs$}D5x-6~B z#se-_(4*8h$x8-l`X*1Zq#A{wMAGYcOet<*l?!TBD0~5K2aaLyS+t8o^Z%Jy)%J3Sj;mYca|_- zqu1!sbg9jz>U7gDq^cT+qJ^EFw^NeRuPgUlxf%Wcr&hL*3N7WEO1l zd>e_DnJv(g4AD}M3C1j8wybp9>8UDBdQ>fUR`}SQXDmrx85JgC=z4t8IB>Fww^5F$ z5;D~SxZ_uUDsko557_yts3u(w*dNwnHoT9P;Qg7&rF_zV$_LkIMH$CU-~z}3Xpa)tIZAG*x9dg&O{jDf}_qFB_7 zRGWI~>Wg5LQf|MEKw}f{->L>SCB2{Ffw5&u>EC#dv4*bSBb4zkL@u^MOiUFQkxHH? z-0uRqcr(1Ur>v_;_>^M1CfPWr~^ImdcMR(%zegxamMH_18ZQ*Xi$4FAV7Nk0!OE)_HLHC&uh%Ax{5ub=>6*&!=5y4S>ug$TanHEZfd8w9ZmLE?Vd%?W6eQr z$6Lk>!L8WFt+1^pl}`zDp(i=92e_zp3Wt3zzq}_*m`4J3=!LZPjMqvc(KS<}c>$Wu z)@9*?+Ypn$>_F9X`!S-1vB>67Q5zD{hG~+_DWbGVtUm3B)dD29zx$;+8R|x=y4Bd` zLGvuH?X1Xg&6Sik*5z4A(LUs~rmWe9hee}`Y?1fUlKfZq9&3O1C=|7aQtQhJg4`o< z&$aBqNslbvizqz4N77zC*@M|l|Hfn2=ezc?rbnGEGI0~4yI0p<-fWJ54FWO~!ni0| zLMIfEM-@Pxzmkn8B`eh9dVGl&9w1LF)>h*~U(V=nM9H0RR!?1R9&A!T5{nu-&{)5Y zI;g3?p)Ro>d=d!bzaGF1J#}snT@! z?jYSK@&48yHdg9o{O#Tr~Rm3*<@9B5pm z?&VV6aef|LG~O8!+=ARWxKC~tAFRkn>f1Tu@;T0)%u2`g)@4(SO2_4``3$pi>7$l{ z->uBnV?QfqzlMqJ@5Ybi(Dwq{eeCDAhJJM$`#JXgwKP{lKL7jmchqd2%a9x!VHtPn z0HUCAPQKBQT>434Ud^vP7oUsdk3;zYW3gry{up5)MJd_@yYHX6I{*zUn9rcI7ee^`b0ga^yg0q zCbwX8PBF{Usrusowev+}mqVmH1WCJ{t;dSMf6GZTLE_Fki_yZx!+xB&?Qe&)-B=N; z(Zc5G(|>#Od_W-!zJ)hmwI}7GTRb|ooWv*Em(4d8ct0aMl+7=$QXZoj3V zx>}495@;&o-ktcDi3Y+VNCiP+a|wl=Oco}}b}XhrsI6KkO=@vT6qt&_{)%d?oGbyr z$OVrq{X3NJzyUXZ`Z&48Y?m-~$)-qStWGpXD z>O6p|TWw%DP5^>3aE+OX!`$_0iuc|Ve#M|_>1Z;0@;4w1tN~M*swWt$(_VtQ7#TRN zNkVFWT#k&+-kLqRtK{s%2F`0mQ;_Dl z{Du@X84B7#OM9^#;wj$GlwHSb0(Cuean=^h1!Q5_S+t~qQ0o3T?DcN%JhbOvMS6Sn z({Zzyf|~s%FpCoFzcxc8lM={V8;s&t=SVWJ57ZDfkeN&ghs!>}$jJ52!)>C){|xG; z5VE`~*`Vkgf!@SCQ6)IZua|79J!~FSyG`6%oG7Zvb%NLbK>;O@H1`j_KRfafAc{ja`)-|R{ z@JFQ6%Wpuq!=~8CWT9e(G+{&#G#u@7L+iF(knbbarCWFHbT(Y@H+u-WT)xh$%uSo#G*|pdu+T zJ?{M9#8-M`+nZ{se?7c=wT$r%l3~w-q;CoG_nXMg2#WIdeoKeFI4)ETa@$}!oh?0% zx+_E1?8)E2q+d3TE`i7h=y*~{+4lOOOpfMl)&WExrto_QBaUCE9Ln&(*Z6OC1ZHra z6ba@Q=W zpV#T%e0jbNzFziTUQUk(tv5aG?HoT;yx(V|RZ=&1wYf1qMkl_omxr&fv%S}r>4)i< zkp@xtzQRiKE`j3#B|q(T%D%eFO5@tpoFeD9o&2@8A9RCC}%{wV~(5%s0==yS}$c@Cm(D%uqbC`KoW=P zp*jef?oY?_B~vO7*iDJZSNo+ip`@F_BuG)@Y*&L`Hj71r#K74w#Sd&CK27VW(;ItB zAO&bZT}ZaFe5`HY;s?maqST{P3nTnxs&?%FLa$6+n5L6DVhtvLctWQBT;UR)2A1Yy z6Ot9lNc)v(#!EiI6k1g}He(t%E>O-0(&nd!n^P{(hPDZ{ozzUhuMHSsL>9$$I$_K? zK#@s)>xvc$Sl9A3D=3h=d-?mba6c{i7>NwO=kz!|td0`HZg@D&%-44GvHR~Op_~&p zQ4&8Eks?jU8}C$#XWN{qcN~6W<2mdraAi(ysk5oGN6fKtBl zCZ(O7;!NHPMoN&|_4J;V2L2d!nV8DnlfqIhm~=gfFxZqRvXx;DHe;%rp*N>MwZ6do zIq}ES&`xuoVEKpAJjL5DMsKuu%Ga+s48HD0dniSt)J^koBE$zCvSjz}a~geZl7J`X zXl$rlTOzp`f)t=K%|d?)0?i<>fF=&UP6IYl+V+r>FpUft+nn+nl)j8o&hP^DaeNPFb zagmG`pfje6IoHS|VF#5{ZJSc%+~xZ7f~czrAikv=V$1o5m%^yst0ac^Z)wcji#-0N zrV$H4`YUMOOxSOddFk<;`>M}J9@{%>vTpnPcWe((a=;+{gKo3Jj;>W{Yf99znE4bT zpyv7e+>-U6gaDIzvD9P0=gw!ZyXBGR;SClr4_F>s|7L3eOW@pG=#`LlDn9qc!j>UT zxo5jG7OZAo^vZ(^j1H!nf*8#!k1xJySAqmMLm_J#JfQ)(VKcNsPB&6Z|J8w2hsH51 z%Xu8G#O9=GwA%%ZM{jLi=&k5keHuUwukix0qBmuNk}g=Bk9oJnO8N`6kbaBt^9e32 z*SDZS(S{PLcc-2%K+>2oX1);UG60a zgh4pbZSzHks;%g^XFma@+D`cNQ=W4&8o{P1`wp&qZ z`+TUmQ=ZadLB6>-Lyp(#dyn|E;(L!V9R=EqQkLGL61eS}^{};}+yL3t#?6#GUN0Xv zg^rftGT|Ac9V82;pBhmoTlhjnb&$!S4T zrZit*CHs~xL!InG+|E`;{8BrF2_*}w`554H)fv6JG^OutvWq>I@iw(kF3h-tvFcXNK8}ukbMlgC z!F^jX@h+A0b)hGzI8Cl|7VT0V_~za9X}x!#i;&(%LsI`vXl(8G5A1d(#C=DnN7mu= zj;mRDJBdWNC00-K+&nzzy2w^~K z;6Ng?yhGjLBeh*xGeeW$G^<>IH-QCeNp`YOqfpSi-7azP->Ys(tgp!waDh*KLgL9% z&JKF0za-|cccZbYC}Dva{BX(CgDCEC?Y{9r3sFT^ zP=Bbqva>?=JR6d5wg98a( z;cGxrFdA#pEl(0YXZjyi*PxSa(Y|&wL$=Rd@WpO^PFpOUj|?u+%-nfu1D!$F-Zr%f zIwQ_mQScZq5mz$Bsu%-+5e5+5w2WL9>}FOlsfG7lQr2eQmLW-b#?vx|0xwVie$MQ> zvQiBI_)y-pm0%b;19g+b*CLxHCCe1KN~oHOLJyYaA_KlK5@3I~8RbA%Py?z>DT`jr z0DN-~yNKM%PdgRTT?>l0y8zd8Jiq&G00rz0gXJ05%-R`C=;E41B8zv*T&?KdF_vX| z%L=3Thac!vnP{i#f}Bx_u3HRiyBOD8*k5T1+v_0$La~2I+nRSKU|3GQV9(CK-`rdw zfOo;Q=d9px?e7}3Y8`vm=uA8iF;!UP$av#bG+{sz4}zj-@f{^g3OsjUk@+YvZFdBG zy=W-vcQQd)Lg#zAUYdQkT`%U{?)$~OI4u)H%w}}1aUks8St|DhwDRN2k5w|nk1s#M z92^G$@p76zmN_yBcK$B8ng0Hf5lbVpDAgVgeZA+ds|4-K-hT0vNg~S580KFN6$lE7 zHGK6hSYOv!DDOM4z60w^2G)0AeFxTeb;kqi>$QRP9a!Ii^&ME>ov^+gFSulF0Xps~ z-yuFW$q_VUOXbz2s8t@_P*WWxl()GJg`?eT=n4F>Dq}EM#_Ngdtg9Y)AlRSq<2H{w z3?#6H%WV-}&yL#WzuT++bGz~SY?0BFM<2|@PZR5@-KY)SIUQG+jHhX-u#CY4=EZ>w z0iLsVh__2W_pc8=-2Ei-A~QBfYuD4eRC~MC{%`wja1zp6n1cBc5VoozGp9W1%(YKI6oAwbG~7qvF&)fyAH+EnE!SCfPL#TcBUQ;PdOT#YV=uV^4vIsXZWFii@AX9 z6=}Fq`U$u?nu-!#D4MsX45{+fGa+G(sX0k$M(^0z4OkWOktf@!)-d7lfUch-x_&Ub z*F;z&hO{B9CEOhzsBQ!ClCV#C!XplOt3zTuAc*XN zOJ>Tl^3;aoXrPQO!-q9jsyP~$RQ4%iEH=~l%uZy-3vze){8lIPb1D34i^Yv>gu`K} zqfUmRnaj^h|nnD5Xf*ZFaEx^Z>0oIvoe3O?rvyJP1vqF6nC zCxK#X`UYSZB9SgJD|N9(n#I4PJR|A)(tNlw(=9NQ86w4diA&K|GNI$>DjxB%a+&ooDQtrz2ymSzpeWPQuuws;g92! zxDYum!`6Hai=t@ylUmgq;K;N-)LlU{Rr#|o#Y;Wo7LHiWBtW>t3jkD8(lsZ-i3(O3foj|YqjI)6<8o$qy#RnnO z8=f$^kczcbybMQ{A6!KMUr`Qx5rtvLSY1gUyQv#F;MD1*Kkq~LOG>f2QUH4{*#bZF z1b{>0RI|dLOXAee^so%MQ`fbh&mMmk1o4S7q6X&$d}awz2UKjfAIkF=H{ z&1u(?w@Pzb^Ugw|SAUsy7(c|E$1K(?E6_6?*{6b=79zEtokIq=HEqZMH)MbtGQbTP;D!uv^)_UH z8#2HJy&zdJ=Mg)NB2i{4Fa=zTOK7vV6%^QxNhrSNs%;~#wU-?U^SD)1-dFCnY@Ca@ z@~-uso0*KwOjZxtu@6XWK`8sCpb@+34wLUF@6x<0kudb`4O!+|obkFbr^gj-22vrT8H-C0pbX*AB9uv(4lz{_9!GhmQOl!E68BOkxKXNwUW*%97OUwt%TpRDRs^OjVJf_(ha{`0Ff;kd2tU!m0a#_Sy& zf*S`H(C;ZlH6Va^;xAAeeSs@S)*2?>qU!Siu)KZ*-5LN?>tA;;LpX69DL5Rkj;qP2~bwC?1swEr>qJccNHqy?qtt1|%}*vyV5;j{OZ) zGkZ$|vjZM2^<#8|`bvZ4ts{x4C1j3rjQq%^dc5{sCJGiGd$)r-(-ZRb!m0<`qNemU zX2mTCgfVk92hQwXMJhDIF=quiiUoYb<~&lz6Y~GDLUeM{8M{OEw>i94r=hX%Ho8(kCK5R&SMD3|6O z*JKkX{#%;saOv+LxRQe1!70SEwdENM6iwDSn=6rvMBFW|^McX%waBC@fM#sRY_93F zN@_6^4}_XZPhyH}s3`AdKm;XxM`%m$u!V5{RqKx`{um(=0kwgRp&N>Am4tAS zjmV`?`hT9Va3+|%6bhc~1)@0deZsTKx<)f(E5IWFCiwre_xH_l3>Zg(8d+(l{42HzaV8tOAf|NXabKm>7&;Uq~LlVF|Y3wCZ zsg*e-9vY2Cqw(o(O}8dZ=`uzvRU~n2%J2}E4e3*B%;EuPSB)(xdb6}b?u{E&4T2kz z{001xk_ZwHhB*)b3rdL76%8EQTaa`{Py!Ydr%xOOs~U|T`?&gf%Hk4LNS1+Ea1L+j zX|%rT6pP4w)jlHFML|umQr9=wirEpTx$s?@M&IQYxWJ%S|KGv@`TtOYX)5$x#A!T> zNaZ(`KGmqkp~+;`e1T&`WC#$^dR;FOM_tC{wpkphAKjAWqZ5ZqV^mq>k1pd!CxtP& zvS5o1AAH;%!EcW?QDq#N&GEHLz?lV3RHQ1Lu|L@c+d!Vp<@0jl<@HA8ykoJgnM5c~uSEdy8d*Ar-r10L-Ze)hX$4pPO2?bB zbV9>WhVg|?6gRH5i52UlasumS`P$bF2%`FNEj4Q_#j8E`(s;xJ*(LIG`c1C+mlyNT`iDSNMrxco!RaYp%+ikbP#3-*p>+VnI&QC3_t@?1hv z6?-eBQx#Uz!oJx(QPFTpvqaUxqn1a8(-}Zrl<7h5e6xs6aHM02b&u?3<^6g@=Z;Rm z)=p=15)ozh=r*gT=vR_5l_=e)xK;_QtB7zF=jbhsUnnzQXZ0_|GXI1ZNkn9_ee`Vb zD~kyVqMTObio=f9B{)f4sKr|Q4Y(7!ETp(}J%`LFno<*R|1EQ4%MPO3t=5}sDA1K6%*mq4CD z+-E_Wr~kihr9gfUVV^SzI)H&5!!RGCdoZFe@U67jod;QtBhj(rXM-n?5sNFYcQ$oL znb>gk$c~>_P-%5CJZ&IDg#yrf9510u>&X@^R?g$)Jzf^VMe9Q|dPmTl&gOsv)4(R1 zs-k2C)h_3q5+7)-6)72DH&){#L2wrGzX;-EGmhVqtOVfRz3Lw|*Qws*0gUa0^%* zrqmsYQdB96MSt~TaB{v!=sXU~IB#o?n*1xr5twmia9Nr9jUObhb66&2Us)#m`>`%93yWMuBeUu7>u3y5Pih2F z&%fQaBJs3ak=U9RApdJs5=#zmWbAK`OR78ue9DSM0q}MSF|e?x(vvvNa+Mq+Cik$} zR>)f;p>ZtLdvW(dn~(tKyvU{yA}*#|AI+Z~KSKj__E;=~Sgtjga#Pa*$32yYVlK`c zVje8Zo9d7(RXt=&XU<|Gc6{F4?$#Z%kepAaG^W||ibXWo8q)6FO3lVrK43Z~8iR)j2?aV=+sgOGR5^aEtx1wVO)j z22mbLOnhwzw`>subO}b3=e8CKQ%e-7zS$e@=5n~cDK=_zi-LWLN@H);$Si&ZDxm}> z*mmeO*U>;mhtLZ{dvh9#LDVjo=u(V|Qx;1u>RMjY2yY7GkxSwRKquQ@5N5rd%RxF_ zOXy3Ty*pdkChM2TbCzcX<{U>1?5JWt5RXWxUYs&Bi;;O$>ugTO!Yff=Cly}ySumPl z4ohTL%RzSMi&_twn_h1Zg?&?2sSRJZ1U7V-Mrm{&!f4fzS^2=pdl03IP;R}<6x%cf z=f(g>re191L6h6D5}Bag*sxo&d@O5$2u0G#KsNG&bT@o7$%9*x>HD#C32FZF3{7x^ z<3Ow&Q1H49cvEfq%b09P)@tpYbjn9q>5j5X2Kbo9JQKZ;sARW6pGTaX2w9~oUol3? zX4K#Eno;eZgvjff%H5wO-_NRkqC6d|vb4L?WHq zy)UB~!ZBT%(=0{^qIbjc$ZgwOD#u!MthIBLktmWE9TBG<<_0|$s%(&P9lpO>Xx@T#q{1Vip!$^3htQ~Zrm4Opj zti|f@KJtQr60T)vhJL?bDfzuo)&4gK8w72jO{cBD8+vBzJ1d(|%bOcHV|09+k|d%5 zZn)>L?|AxKt?`D01NBQApMIlhD$aEZRyb%F$y(vim@;v4ELm)|hHkS_m$4`VAX%0+ zX#X|OZuOqwNg=va=BF*+NJ+xdtdYkpIsdzn+tT{EiOY<#pTZp)MV8>z00iDukrL2UlRyZ@~Me*txKVsg>as+ z{~|Fs|AiMM-OK}PwYJI#b^LMBovFU&ObL88nCb5dr>V9H6|3wVj?f9FX%V(@oe4xL zhZRegS2&wr#uqw}#3p2DtFt!U#cL2VurOm5Z$p%+mL|rxWXUs@lHo76e0&0{fM@0t zp;e84x#d@wbFnKAvrpN$#5^vfpHkb3uGgop#*FBNq5%a;Q0Axdu5v7&+=xm>qLK^v zZd^(Lr2@&-+uVxOOwY}oEEq~xe$rPuP12@&T|;O@wS;P zTso79HJ}A$cmDKOuSY1+{Jti$%l58GN8Va@3s6y6eN@#TN)01)7>g_oVU$7^@L`~5 za!A>!c4{~c@-!uJb{eojEF+x_NF1a~7|d{+OC-+U-#Mn-Q z>fk*!jm?4lDjhc7Yzop>cH}C;*_5S=vPV8=OSiuA1P2}+hS$wr%Lir5-JsL3a@=w3 z)po-WXJjBM@3gpfC=sG}Hz|%ebjoY6)z3B@aaL4DLg~@SVxspEKo)}Ce&_U95YF+; zjR@*pHFAvR`2xp-l;BXpaMjPSS%f6Rw8L!}PXNpV#~)3Jw!u1RhM2eKaIcI(zG_UK zdZ15LaxRN5wf4V^#~W_e_a@z8P54Xk22E=N)HyEFTREg)={df$G{qU7ea+l5N)?P4!1u1?eo(Xz;^ z-hP>~{#A&0n#MR%Hm7xNfofG0Abs&nomMysBx1Ya^T`tK6|_p_ra-lBjSgCU)7TdaEy>1Xez+lPVdQf0ze#pl)m5$}LEi(%>p3 zQ~Jrm<>srJ*%SFMJ%m?p|Cf5LJ^w_N{k={e`e?6i)M%6HQR(vP2gQM$@eHLT5Q}tH z{;EG{5k2lQw>uhV*CwNFN`EIQcNk&yZ9Tj~M&7CC3@)U-sGZC)x1CZO_c-{lCPpg8 zn6A^d3hWf%7!eA~WkS%=)%E+oUyd%{zq@?*Uq?-6#1tJ}e|XpSbM<>2;?>d<0IC&w z#Z2KXiu-(tL(L$I`w}gi0l7t|T-%&ujwXb}i045-IG^TGv@9C+n!j{{8#4b?mGTJ= z$}l~mbJstfUkqeuy-;slaEU2?Fr=36=A<@*%NGt(vv{{Az-d@$+#75ydTCsmkCQEX2+E>F)j#keDbp8*k3N1TZAjI`#RvJ91|IXZ_8!f`08 z9~nc@KOzjjc8vuNYK6^a8^iF>@avz{}{lKWW=r z9(-)>Cm+dRwNsC=7<|}hjiU{3jht;)VT;JcGm@Dxe2eE=5t-8{Y|G$u1OBlo{Z%Mf z5%{s6=NaPxj!1g^x2yBV61@u#jD$4aO|{NgBXw49We31)zia(Uo{5Z$L!Pk|&xrXX zpQMDdJPpbX3dU8oQgKnZ!rA;e8cGdwxDpLn^hawS`qhL4L%pS!FG2ot=I6hd;o7&(6*& z|9$%Hvu~fB{oy~J{NcMlK7I1-*^_V2{^RWFvv2?ShyOrlTOMm;$$5s;|2W&Yt@_|T zlQI|#euopPPwWUMRP04D1X~^6{s}z%?w+;zf%H?}Wl&3h-BalL7 z&eF^hDR)Zk4_+L}?!3^m*|D510^Y#dW&SUKP=xvOy)5FzmJ$EXo&g(bO-T z#hvm+68yUQa78pXS7aQvYPI2T=~EThUMf|L;0LEVGy@Ld0z%!l@(eGMN{#0Qct=(j zYWKOO4*km5Eg^{@C#WTrn*NXeQ9Vsk%2JvwOAOOWhvkQNPbMV8@+BV3$)YgPvxLOw zSC@Z(HmW?XZThcGi@mI%X1zYYx-2)^=EIk<eG{-)oYhcD0yc~3uSMNOQc?wbD6NGu(bZ})qXiace9og_^!x(=Bt{t3i}mWhJJhte*GFh^t2iRa$~ zR91-mAI5t(8MVVI8bB2t(+c1UI1Jw5h_;!{SQ(xNjnfGZWQNu;r;8+Na|j}FzGy>b zi#l3Rk>gr-nIm8xRyU;W1EDi_0Meix#KDrMEP{gd`E$l4+D zgktk|ai}C0IKhE9=d65=s;+Q|5 zAf5+vgqwi6#i>|&6q7hhaRkS$w=YJ%+tKYco@N(?@o1CPUaP9^yj?()8vIg$2(`~U zFCh^6-z?XWWs5rlnN#K03VrImGO4_-gQM!2yN6@>L5(V=lL-(2m0fMEx&s2}J_e+X zB^|%lMgg5|?|+w@iCNlRPP*gLIOa)-+dXJHM<%^yR)<&frm+mJ6TRc&S>ruodv>=0 zjHC5uhkRJ2b@`3DjN685?`o~9io0I6`VtTs8N(sqZb$uXRj6ZV;R_nBEWK?luqp_^ zgCT3^fz|V4`J;s)n}u!novPm;Mfn9|-sPy@I#8#4mSycVO1#2&3y*D_^fA8nzjS zsZnsaL{h4keG3s^k>HuS_j8f)G9E!i(>T-_`;x`Jhk#~+d?OY8Y8QgJ(m+inyg$#g zc^P}lp*Aqr#e~RANeSkh7Q7e`boDrhFkLvV z8YM&-z& zno5OOwHg}i5ss8%Q^|cmD|Sod*-vIWm@c*Cm(96X$#V%}IMfOF<^Gmyi1de)?sAW< zHC3CbJf)@E|{( zPwq%cr%MPfBqj{jP;t|88D1T6bY8iVmOzxln9+#MXsp0tH*`T*p1pMv>$Q1((^QY3 zB-e;|$LYxA$8xK>d~qe#!oqC{xhCf_8gok1RTiMuHNoM=q^eXR=_GSg%4d$mI%Fbc z>GDS$+_LHPE&j9#p=uRLVlD6|l!~7mDK(Kbd@dB*4!H`(%F?B#z~{_a5=OksgPmvq z0)i(JjBKVFRB0~2A9u-ez1wF?Z6isGq$qQI=c-8HB80eXoTajIsXAySgQJMXw<`Oh zeDg5&51vmp(Z|fsjV)f^dwDAOV*AaQ*q96DKxtHmK`c-d_oP2TTR&n>+LfpY=7uH( zN^Eyjj@6>msFm3)SgH=IMX(s<8h{j4@0jZg43--I zy26}i(!hBD^Y3A6NKzUHG{MnZoFp`!UFVU@VY?Govths6U`#7-?!YqA0P>WW4wjm5 zja8e53meO<%@qJ>5@8yTPtZ7|Gr}|R*CLA`u6-2ZWQ@LcHCI;m28VuKwRUG)r?YgA}*SgxGby2mt&FbQt3PW!&7LsiHB6$643;$KOhqMu9 z*>wtuN?QkzPQol+8;^(Zw&q39#gZSPnipYZF*s1%JAD7@h`SOdl*K2%K`RBE*2jMG z9++isM6~8cFw5F`5?pqEk30jid`^&%?d4c7%VEXNua__SI`P3#Bp&?i&&xZ=^I(?4 z6i|(^@UpReXwBe5O>ZpxID_bNSYNRpHY85N$O zBqEp-!y5yR?mXA!)Mfg7o)@)cm4Y z-&I9*J3@IcBxeAA%bK#{>TTC3rApJdCU>~%KEI8Bi*WdTF4xanmDo4zy%(gFvTYs0 z1KRG#HQR%^p(5uY(BQ*{zZ%WPK-a^$novyP}IXJlzwT-j&;|EY7fW z191MCF`zdLeGMUVvKKRykpyj)Ol^+^GykX=! zfsn5WAKxc+HYd%RaPfnoi6cCGjf2mAVc|Q3gzxO!=>-Gd1q6IU`1h^|;}7{>10K6` zsP~>=-aCeP?`DpD&e+?(C9PZne*Rab#&EWFa{v5nn*C*_t@8ddv;OuMVTiOlkofUT ztK*2m0I6lT<#Jl{YB&+?#KrMK?aK-3kQ|_#RToEX!^!Dsrw&hR`{}s)=&a-9-b#B@@!JHkM zcIC|E=gf2HFuCnJF7?hIUoNuFkw^XbbBE4IhslfXeCW)BTj9U09q4QhN1OT)Ekc*% zY>Tk2`r1-!v~)O0=>n(AcIO(qkYD$>W2W8H-Kb=U5j!RvLOa!{?H&NPb&3HOFGq^N zyN=V@L5k9A>cA2gm=o<~UUbYGkNR(vKI;EU1AWy0KI(sK>7)MlQU4oDAN9YF z`rk+W@1y>Als@YJ=RmPO>VH$|qyG0%|65BR^?$XkKI;GH8TH@UMFg#HY4COxNj-c; z&^G)H6yyF5oqrYzpF5XnuW^9PFAy*QBj1cj6b?2e>M4>A?s)cq51 zf+sW*=dz3yZ`owZt`IP>zZ*R4VRUsrD`qIrV4-QT~q%hTenySxQ2j5?ss?7o@v}Tai9$FnE*g}4$K2Aa(C!tpQI0^O< z_i++jsMN@`^m${Z&ty~7!i&KN=|;&diN*kc(OQ8j>aE^5KB!6x$*b23DiQ=xp36BJBu zEj`tuOQvIu7`v7Jn`lZSxwnUC5%Qa2WfZMspDKb?%%~ik=)I-Y#v1?feL037hUl6^ z}Tl>K-+I^#OqmWReh;no!GlsRCQ*-%tuavRG}`Lj6F1LlJt3%M@MAaXcfuNO%wWOiHE^ z_^*pu7yOg52wjla3CE_qQ>v1N^1?Q&I;+$n=&a|$qZwH^-P(HH$t`Gn2^Bl@3QkjN zD&cfz46@1=oAScvIdATBu_qIxKAbB1PN82{1n2ZB=X!&`a42%wB z*w6&|MHv8HQHJgi;oaofZHSRlzp@VI#A-{>dz8-osN~wPDOd_DzVV5rMinMSg8dD^p@n+j;} z=5lbn_*tWt_vGf1r;(##o2OAtefx0zrc9`*WSdl4JBIJB&OSu$OdAwDPn&Z?St$K0 zW4DAPZA!M=IxZ^lNxu4j^ha%U{@*MYN^3=xMH80IjrN3MdwY$inL-*y;NYWLrETKj zA&}rE_RSeLRizr6mPFfrT2t4=pSwx==?kJhbggQ;2|o9jKdx7iEX`U~q&1Rvu9LVE z-CIGcTTj~g-Ql`~}600Vz!4CoCJ_TTIF0u4S~ zSn#f9ZcQk#Ck)sF;p&M&^ur(eU=P=U{q6$tduRmlhWPFT-n%BWcc0YRoHT1fc@Ksr zj?mpT4nF&Z?Cub*yR&nr7esd#@Z1fdxw|5aKOA?BbXq%y;qD27yJPt6ZsyqMjO~(W za*Y%AP7_RSm|XHpwmrIRj+-Wu{LC$dJ5L(<;0Ystiv~kaEVGqoc90NqAITtHpw0Fq zknRZ}osvI(X-H{@jD@?&RwzCyFYdQ=U2o4)xSI@xp4kZ<1%_i*LO)@!+iZk8$wcT# zuFax$Zj^m+dzlBnco1A?gboLRMXZTvYsmM;+_RRnfQ*Of2JI?%hW^sXyqIV`PxW7n0=7dn2N(xgGo z+SyTj*BLRCP0`ECs}XEw5yf$aeq?zZEYSt#nb0kk2|=&$9Y(K}+Q*Bnu%aa&HL-@_ zI?jjiFL~L*(IV&asuF4f-LTLrC&BcVpBNjpej@a}nqIlmX!pLF#6fZ?R zx4Z;FQfdt?YrI=sXlK%P=ImgrIl*B>I3JPpjy4%sDkQ1BZR0Cok$ghZm^2FxT_1#Y zr9p$WwR}QX>ePx$Y6n!f&5~Y;y90R(>XoD6VhfEcz_9)-P!hBt6H}@&8p7! z8GfT)c)-a8{2`yeW7##q;qp8TQ^I-MB)ZK|Tb(tMx4s4jgErE>)YhUCl+7tulMTDu z1kRdd*kTP9KdrF?bP!!*g09s4`#K6ky^b1@R$)h04fW)$pd46PyjBUv1Km{paq-D=aAKA0?drWM-)`;`N%imTrxphdd@Z-yHz7{W zyIgCbm+Se|Zff`Cbdf|pmsauvV*u(wZGEg`wGw3bq98Qe%hZTk05qPSeTN32aWRZJ z+t)e)G{3dreme}sXL9ul!Y-S$(2^xi6j1{>hB$d5W>2=Ubz18{9@BB2*BKL$znp%^DIm0B+qDG_RuSl&vERW@wdo}!$k%7>)uJG>xkvsdNg zb(stHw1*_Ydypy@5$;l{n+afiy6*6$OhbXF;{gUgA~+4^KVt4Z`Q?{QL+9|TW$fT| zpjQo4IuMUS_4R|1<0XwUFO0{^w`-GRDnCC!qKxd$Q*AVXPuC`i^l@63BJSQ~uAXE$ zC#l>>-cL8!kh-eb$&Mr%Jm?Kcba37MXyw}`b`vi-q}O`D;jgzB)xK;Sx?9-)2iS>3 z=hoVYsvmA=AA&pdhm*MFki2)H`ls94gbs!xzFSc3%Ps9dp5)l}2DJ6q@iy$On;o*p z)Ao4UYU%N`y7YKjPlEM$+8$5a<7s<5ZI7ol%NK^HwM9Nxz=XD6?YMw}%k_<=n;m)n z8}j>`_eW*s`>g>#wtdAVyI6f;Qw`rO45ohwOnW{*ujqqY*J3?FUiyc-RKYB5N}y*1 z#+?|8UBg@YhqiQz^yC-TQjyG3=YtW{D~zSze!TPWm4_L+a@#YsM!3q|gsSw2vA6vj z5#P|1-eDAUB80aX7^^-~&BUtH-U(~A~g>uUS* zIQ3Z{5Vq%kx}ops)~zEOg^#sr6INwvZ9mh`T8ch^Zz2en{@%8;R<|XC)fEz{*}S~S z&|F1>*~~%-ZB#32bTq8>7r6(1k!z5}7sGDd=IV8u8KsMmO3JDq6VPb%!Cn$LV_Irg zt^LQK?^rK--w+uIuF#>#BFUEMn58Jrqv$cBQ$$167LM+5dHt(1=wrIzdX6ax5$38V z`<*4~i`}r>YnnhExN>VPqp%!t^x^uAllfdmA>wnEM8F1;w<;!g^a;H6I2zOC`!0)L{5e1XWPggO~vGrEx1jTjt{ zj<{}O-)^s}S(w?MMDIKDt+bKF__#)wI~>uFX0}wDLU~~9mJ(yt6z1u@Q>4F)ZoV+~ z37zA9-|TW*;c*+iT|&5+(%KFR9iLcmpM&~t*YTz)nLA!l83jMQ zC_*WVB6aF%$+c}s0ax~N6ZEb*Sd{_)g*i;q_-DL3L?fVC+crJ^Ue+>5$&B(WU80x& z{}=CmIQ>4*$*wgR%XWaVRN>1i^LYQx(V@s zD-_kl--FUIPIQ0!M5;EjM@l7m6kV~11}(atYd$hvi>6v4|0T9;@uOHBFeu)b$KxD~ z2ICVnen;*|syzoUr|(#Hl@d(0lh+sN-e zC8KV)6RuBLT*v~!Z9KsNQ7QW1EZZ=DE$v-`R1xnMwTr0@DbHveWN4bQMe)mo1X$>` z>fdcPb?MNlE?RVF6BeGJNuDV=w$dWF|I5>-JUxtW^9hMaI|ntm(3DC3hLnLr&1t~m zfFv3GA(tsXl_WX+O71gD8qeg?6`fLj8nAeP2MKGwccU3ute?(NzJSvduS%k>w5o=@ zZ}?TnBCkEVo=bDJN!KKnog;SG^jEWbs>{1d4pVrmOg{G&$%U)@w(0t%IeN!g-%*tG%yO>EMrRZjpC@X51Kl#IMr|$Mo{6eaqFW3Up z22IjV`Fb6G$&t1Ci$eIgjqc_dY);TvE6ouLa5QfHxPz%88j!dtTz)klrF^TNqgFj_ zju26pp&G_=72#~k(nXgqc(>l~2bgeE0`?FL!X(=*0sT)SBaDr;p|mGl*m5Qe0hft5FqPmXs`O`#^8bQC3)smFG5sv8-!Xi73yA zP+_fNQoX0Rcd6z~KeZW4xr>b3P zt)a?F(=x@g>QmI&s2euNHBWE@ETuI|uycZ7)Uw;z2Ie|AQGUUgyM%r5kNZ*9TpRx@ zj7P4?k9ApFju^z2!o<>)d&m^8pegHwP4Ny+Q3NUTN|%fFNnYd~3B@xO$`+%ccx6s@ zi-_VL6U8|yin-9PFy}WiF5K=`v(bnNcZwM(PWN~z&U{Ld_;S|z`gzFLTl(8PA2bRE zzl7sx??S?F(R-}a&qHn(SkzKeIK)}{5=FVQ;DrUE|D`JD)`oAs0a~PgJ}UeN1qe12*1mo2cOD4~ghr5Mf!?*(Y}n7nbEPLBq1_au(Of z^&pF9#s{ZKFcTv<2E3QW9XqNTazv2I;+qLV7VmrzP9!=^(s<>Gki|b+gcE(tj0y)$ zr)?0aDVN0O$VCo0CS+ObptZkz6SC|m>x3*jJ@Y!_#1sx5h4$--0aVuUg42Q_pCnxC9B`h_ zH>TCkDwn$YC*L%K$i5`=FN*FT4}4auQy#)Z&}jFnq@yvf4`B?pOSX67j2;WI4e#MsYL_Oluiy zP7uwczsQ7?7;MZdSMSiYV*{~NuwiqZh$C>*C={YvsQZ-M3Dr?uu|W?qoaG#yUs;@N zW!bGhkGs&s4X-<5QQNxZsJqoo#wMtkBa9X}fru4Q8@eTK2TpOAkd6xprYRqyOOqLm zg=e(qRIwCH;GYC*)MZ+o)fHL%P^qhB!dS+$6em|HnbJ?YTI#iCYHK}_536##_{3a9 zT0Mq2)2kPUp^RuTt~E21=vAxwAWNek%gVkY{f{2_3?o(g9Z#9jhSPk>V}{3M84YY< zrpA-;3F3J$mz95|t5lccg^rmWm>z5TR&Md3tVN?q3*wUy? zl$wH5KP=jWYDy~!ZkEu4RV2(K&j@^fu5mnbo3hrklUb1ofOex5e2h}~+J$0{wjAWo zVy-qFRFu7AbYxA#E*u*Zt7F^l*vU+iiJeSrTQhMovCWBXb7I@JZGU~=&w0M{p0&=O zv)9_atE+0)>L1;`t1gv%4G;P=#^hVGKWwYrLXzP%?t)*)Xn6GPV^2=jBexLv33Y(bL9dUf$fgZj1LGkHmm6tyMge zrdX3GM%0gys{aMYPyyBdPtpK4`V*Dg6^p!JV5SF_zBo>1!$_I``fzn}a(Tg| zEZHhpO<9+s$dFl-#}tPu!h24D-$*z$C3~M7uPK@}5Ef0V!K8_ihrIq267snD+KLf2 zfg-$LbZt%22>=qV%~}iolJrqC=w-Qhj#Z2oj2jMxZlYLiKiquZUbW*s#}LvwpB+!1 zZtb|<&3FVuW;XFhpig#Eil<|YC;*xHBbkzRGy-<_Sq#Ew`yEL#{b5=$F4+D$N#Rhs zwi_p!us`c(?IkpawDA)Pie~c*|7LPT(VM~TaOZwGOur@mSu5GWG3tRS0;$vV>;3~M zD@|gRz02=^lk!2Y&Sn!TI3dHpWhXDTBO;a$)M%&>Ce3q+r*`a~GRF(Om9F>5pABgX zEZ_|9jPAHuH;EyFxZ>VVScFT0pOrdp!^iZ1or#lF(?J~i=7oWF=x#+ zbX0K#dOZ8-F|;sQ@hBtY*Q29qX?*9ogLGJGtY_hvzsgaxrtvoiq8AyoOKQh)i%Rk! zF;L|lE{B!Y^LdJ)s`TEQUu99X_HM}`5i+&LvSPAh*0@V5t;0Ki4X(>YqK288x+t6W z1eY`HDZramiyx(z8Y^YUy0*KE%$^|mwwvnf`jUv-BU~=q!#3e_)$uj1|58>a$=F9m z6^@w4`e;7KI0CjsM5UZO<59YRGb)*GV0XNKK8wqLw5;(D4gP-E94XPdj*bAINVH)4 zmrpeRyXm8ygOk|F8~5+QG%YR7E5~|i+s=|~UF(>GqmS}}rnN{5hM_n7RoB*R{g*fW zf%%4)oK<@;U_p0?Jsu~5Gf4L&ELQT6~A6CsaQP6}j5hb{T zcOQhLes(<_w%s-fJ#!Ru3$i@P&ZxzJqZu_(hMQaagdCD zp5r?wF-)UiyjIXzi?F`fwxKG%f>`;ZZ&kM$>rV9JD&(OFR1)|2e@{9{&urYv?E4YJ z{5q6yoc*f?#cpdN+{@W*LyL}XELnOCrz`4fdnB5ymrEeH)tJ|k6_ByJ{#YdKnhRt2 zz9gP}bQir|G{vO_$}@*g+r6sQ4$#@gDovemN{TTiii1+*F6Z-ABz#$Z!rXK$E7Dxj ztD6*(!fx!VGTufAWVtH;Q0~VR9bPkru5jv5cCU$)?%tUi-RkIURkdpfZrMJu5J?>c zIf2xixABl|lNG}zO+)LON9BS}LfG%_7mr@M-j3UZGBOFn$KT-*uF-FhN@kr&RX=ZV z?xfv@2QkeP?AzSv-=PThM)w1_SJib<%r|#`cG` zXxHuZBVrIP(0FD0Mrq?}=2iWJF~p6s&;SV2aZYd?6-G6dW$nPg(1Em8T0V#Y18DF& z);0J7K_m0G4n+mYfA|#CNd<+jZ1$}8t2eK4gUcf2>jQ3oKr-nIjKK4@IK=C~RX*A( zw_0~6V$vWUeh&4-m8b^_q-PO@K{#}nn1!uwtqyEn{|^l%OXrWMQ>WqabTkC0#KJEo zK{)L5nQsjYSZ<*>my$sS^6+NUggV;}_;E?0Rc(sM<-C%mChIneX4tt7#pddPC&qE= zd`~P2rFhnt?;kvJm_8dOV_;G^1QsZSrl@lz4i&eR}-i0s(58 z=w`SqD+Z=O+q8`cFs{@-b)%9K@CH8niH#~GrRS@P-7LB!Os)Ar zW!1uLH&D)}N9qDMf08Z|^I6G1H;v3}7BH;C-^OzUv4i~ds#oXzJRjpXf4>g9UadzN zj)B8mAYHp!R`(p~r{*I=@=5trP*5^Tr4kYUS2!dEDlZwh2GJT*FQ!cx}p9||9`YrFsnJpzn2WpK$RpCO5*sK7F(2>6x6vg&R-_DCB zcfkUaS=~;2^N4B-9#xKLI*R-oq&kX3<&FigJQbje1n;vDKyNQgrgS|Of;N^wP%kgKVn0xiOweHVHie)O1+Z3RFH13%Lk*nPqI=OdVc3Gf4aUThsBU#) z(}S?J{J;cdHXH<noF{g>lrQv;MrWYEQ@KhK5W!*AmrIb^rX8GT+T5ZT=9KKll=rko zStx>FAyp7ovud1VJ*dVkaK#FPgb%t}3ih3gO+^UFb#>`0^|IpQ{&3|eqIIf^aHouz zHA#kY2qI7!iY;a`9R|Sc?`|D|AauvL0QHnI(+>)N|>dc|TLV4{m*+ z+d^pgd@JNmweg}BT$5dGU|Fdk*D-YQXJ1=uf7<}q{psPheebwt*~^GG5m;_j_0ew$ z8E>d76qJH4dp%~<9f+xm~E|a;h`&|SjGDDERgw(ohR^E#OPc>gAa!aunOAMKe zX}#6>BnBQ8&DN2LCoI#_;YuWr^Ax`kk>&E-!e^@mKham5_2=^$57k$I;O&`s zPzZHSziTm?=<{Bvg57$XDt+dhy|-H6n>k=)IdhsH9cRUT79eM4+>tABmIdd(iyQgr z{cvc;6147?K7V|kMzpwIdZmgjP>sIWm~OH@u!-PMR~$wDi$&{OSSNqjPOZPreSb_L z#gIm8J4hGK);T3TWMk)Jb3PZ{^1@jIJkUyHxK1^IuIA$Eq?F65NkID95~TC0nRYwo z4Pm&KtnC}b+hu0KGbU(aL?H-SQu~E2PM21Sp3|z&+~VX{p^Ch9L}{&&O1&kU64uUGigqCpS6xTq#ERj(J%%y)Z?F2A zgW;tIS##S0UOK|Y+wmSY}iJQUQ1ve(f(*$Z>M95%~f!fSiKr-T3S;i@Ez>eIl)a z;IfYwq8rF`KiFY3`(RBoq?6gZ{-mk4Uz(9G`L7g=%G)L*2ri{fPb4~ZL^|65R>umc z2$ovz6nW=D_yu^J4*=}0dXN}8blr*!QD=SL?)C5aisvrK8t>j?Ayt4M%K)yp8UF69=4`qO5VpQFZpn$yg3S~~Y7N;sDCcnTz3n!+I%$!!y1cHw$->w| z=gD^<_8kE{+vGgAg}9X=$*nXo^JB{NKn{H}3L+7nEz(#=Djj+u+=>osapC^;7MOl& z9=GrfKV#5HRJ3}6GDXaqgs`Z#kpJ)aJ}!Qf1}VskG$BUEv*GmPcv3Av_dklzaxlsV zz5gmgrR#O!@&2m_b-Jv`eYuvcwtN1AD6;n$BA%={aucW@isy5Pxmh8ava&d?9*+_T z9tF`_txZ;CZafrxtR!c;jG1%lq#pP}iuRKHs$D5o<0E~{^w6q>(Xc$EtOWq-M{ab9 z5f4LkP|0zS;qm$2U*8W6zpI#{`M0e{Y*BzeT$h#yWL$qlXTxP;)}^!en@}FkM&3FsO2rgWq_H7G zr3GD6AeKa#^mX7r^p-%IeUOk7hoUJSq;1)g*Q(IPaLB-;2pRbs{|`|p(|5~6>AwvB z5rr1B#p)BYfplx%dRR1D=g2=Yc!FWaqWrZ_x5(*&e;x8gQAhROctf)2G*jx=0vRDG zXxoGlt`T?1@m}Y0d3ByxhJ!Wf=+#ymSGIV6n|sqgf-`J-^R!Id4!3$nKbO>upM;B} zLTg(4;RW!dOSs~eYyts4gyC0fDj{s%LU}FJHKB4>X7^=e^3--QEH71aOJYg)6gVg4L z8NBUZ06k+g;nKW+5v26*-6+sRB<7INDpvv%7UZM>WQyDl0? zF9YXU=kojo3EMk{U{LOGNscd#`x!5q&M-9mXGu>F*^7LBUHG+*8zH+lEMj{HR;hDmubo6k_F_`hnKClji*=GTExu$`1FZml z5c&v|8FBo%8+e_=z+O$1=j1cw3;D^1-?sI(B=AC;s$I>JQ64|tzRV8^6~?NQgpL1| zc9&wm(H{#T9yTv?h;Vf&y>c4UH%dd{^qhtqWLlZ`ZhhI{_Sl#$G?0*WQ5>=;`jh-; z^8JD-aX}WiT1?rx7w@v{-^xBwNhAU|(P7^#*EYsq)Tz5jHTC)W8dX#9Q1!){ximrl zYe~S`-uRz^(0vQxe{hvl{{@V2&2ODX&iE}2cLN^4a2VPl@GCv$K(7Lkcl20i+?=}eD_qC3h7Bgqwi(1#5 z@gL!AEQ;vj9?FwDj*7YL)4gj_<~a zsBxt?e(0*UoZt36W$50qjyPTUlG~%BVnqSy&^(RDrcGrmwI9ax%T$paSPUL)oP85l zO~jR(XV|{4+b`d!b-Q!czDNpzQwjp;+|*f49X)1LPp(&S$n*WV#O32I9O>jq5>AWt zsY3^V-X&qf(>ia0OFG;x^Pk6zf(4C#Jvz9H54WozNBeD8aQEqye(M z2XXr}U}JO?b+pACd_M>8kHI0b@I?-O^Ew8Ms|i0dZ$u)*rlU{f@i)Wma!|NH&*AwW zG>!5G2PT?y*nE?Uv5EMN@HXA!;ekJF^h2Z$f?v}}cCli|PD2_XUZ{*d)K)e#e;~db zWy1I8h=|!m2{lkXxqQ%f8{JJcsgE~%uJtyS16+OnFV|HWXrU*MOq{QJRZ8EJP6+EL z-#md`5Y0TlusBAj8joNr3O?)(IaTsU|Gqd{i%&gHLf>l#TI6x*JL-Lep9?BFBAI zBFg!ov>r~7Crhy@{la=BHBwfb*~AognPlJm?F@8SN5Fsz$HZM;CnUi4a&Czg94|Q0 zDmdEH-9^GGe0<>xtY2+H-h{cyLCSV$S5+)?q0`ysv0%AS;qlC14JO_Rt<<@7cSkk1 z^aXDz#MJ}x~I z@pr8l{@X0z+F5e9^jt~xZ#(mU?g3ST2K2sGTzclM3nr){gX7b8J<}Vx8KX7^ws&Fu z>L`^t4dIZy#6XWeaJH;T^XxwLD&NEjyFV2pe9VnfKfM$qOy2(@M!1L$StSm1%{d90 zz}1$Ny133voZ01H9TAB93s$s!5wksyy`^=Y6)>qbkZ=zEqu{ZdQoQ>@dZa%*=MArE z+tGysszh@4yWq58Z?)*zO3IdJ4zp*|BgXrOu1bqyk$*D7JHhU9^v;#%_)WwBHoZTw zQ3IC}Zu$wWGnE`B+ckvn_O{}A&hJt20+ZUf={7mcEhq)^J$txMn%qpo;{eos_*VC4 ztsPv1F1pHxEf{XTO1r*qxjVS0>tHZLP9gmlr@r1ifc*kpn{8npQe3V@O+L1xEta_n zdkq)cZ;wsP`st}`I935tH*~tL5-?5l_Xucls@z^a*F`K0Lq8CO?*Xz{A+~2{JZ)vh zGTLiO09$Quw@mt^3*W^O?wN*DFxcXbJ?@qt){8$YbmUMFW!8i2I+I*!ja?755;fLK zkp^j*73hkz)vp?~+}ym(kM|AS z;O1)40|vj!w^#_y{vXr-p*$O=&PJ{igj!!@N}lx7^U^-Po|c}Oxu+xsj{zmNw|(pz z2s4Wb_FH&{N`2dBtb@0#f^C-9gvi(@B(+OXIOA27)NK z{jdI210JF#5>m_2w5*rWWHeZ@M4Khg$(W81Z8S!$jGDf@B&s{UhupYktJEx6YC-kM z<tQI1{V$|cVIQ)cw^(7BtG$!t^#{%j2M@G)SSp=i5axcwigPab+ z>y?m9%883oc6mS4X|{RQH1X|qND-e{rU0z@XDWO@tM63$4f&B%2B=Z~4I;>JR$`!7 z&e_=z7$Os7F$!5$KzxeFR+v1SxX?2ThcXk@^osg8Gy^`}TVEai1bhM&f4=JpdA==v zu604Tq&!yu4%gl1Zl5*=(#PM-!25MXTGPsAu8O77 z!jxZo6~+&~{AAJ-(hfV$Gck{Za*NWBJS3yYi=6Jn&B&{6VZB-Bt7ub4>|<`5W`!i= zz~6q>=8rtDcFZE!1_EDrD-Qu9C@m`syIGp)<}05uc=Jh711Xp{vE=@ntUtB0#4BUo zGCRxPbJ#=*Vt(bmvy8t>uhJX+Ho<^{Y~UDMrAYx=*o_x>=#*r z2N;w1QBypLlzOhS5aoV0=AD%eiUc12eLuOHA0$ZFGU=-h5MND~W-6Dj*%B<*G%T0vY~L_8qkwMZqlP-)nR#m<93emY@Ilzy9}3 zpWNjFDR|se#oUt>zLwzF;&Fld>p^-UAJqOYV^*D;(LoetFzuoJaQdE2#5P(Nbrvv* zR4f19$RVW?;TZ}_p0^12xPnn)2m8^&*`}x2R`C*5GWfdgY(+X>$D9#yU!S3W6s*v_ z#>Yz0Pfk0yL@WfR&=qc1Xjo!X+Jv9TgFiev!G!^949uEYN!z>$x+Fo;8rQKANrzJa zCLow`FGC_$nT@v16+nWcGw~HH$xbjs=kVEBw`1^aZpri>Iy1zdp|Lwcq`Z+VxNFXi zD2gQ~@LWUPkIT0&qn@4tV+^?h8dEGAiGlBnea}rEzQ-@fceV-X((6mml;B2#xZl2S zCzW1Op`QV6dhuj3mV+U*rC*0&O4IV~6v3$yNJeBHML4-6BfI+xBsvI>4;-jF1=bRR z0&X;503>Nh#-ATSsqF^(GGV1>sur+y)?A<_WuE3Q z10lwbvI0HLMx0ae8qatah z{m3qLGaX+F_tc_(W}W=PTmI(TcI5x!YUSo;=4)*)Y;%3L^2NVXm##Ywx1lI4QlFRF zXCv}99Eh4hq@R$54f*%IP{gzL6)MN&CBQhv<-w=!@{bs6;jE)F-NKtX)rxxn;u6ew zT>p0By~mwOhAtG0xq)zUa`3lBZb?#x`>qk zyQFevMJY~v;r-s%%JU0gE1tkRe0`aHKMu#BVqE6A!;ziZ)<2GAxJs^kKk)&%;4iD= zHafHt#d#vr z@5%AX*bPfLw3?Umt!cfjzBkW- zfN-oFeD@(kv}iMQ*+>j_@C-HeAr+3CLv{DHBW`v7u^}&-u+52+c>p zCR)PaoqkK4uGpP}e78XGYz)sV3T?;)n|}UR*g||@Y(Nkd4i92}%e8d9d%i%vkyNHU zwhxZSegkReBF>pJUDdqiSGrQT`GLHeh^ygF z0Wa;CStR(V!kddFuUo!2eX17LI0)155X|9TBVjm)GJs~q$(%;o!s%+33xfA9R(k+0qEHg>^i0FJjxHvaXg**P-U72TNy|3p-?2hFBsFOXX2`w zge|$VCAoauZVDLd%RqQlvv7H1q<$m`hOAf>H*muEZR^l~q=R5OXRQq7IMowa8L6x` z1&&G+o)IEiD7!O-T)xN_FSY-U$23XV46lDU-0Va zVCQ5S-t%rd=qdV3e6%DEw|ewiau1>jMUf7Ym6?|jDC=?9+f@p{yvgrQJBSDl(DlFpj+5B5t*f$#$_?Eu2d+6nA(G@Jrzu) zI<_}hnqD(l5%bAd1HdpwF();)9I)zP4{OZ z+m=U>a|y9Se(L44@ACx80+cBZuL1DHO3KSjPyh)UQ#_ZP9` ze(y}7w86}L;%09DLq6F>Ug0z&dtvDqpywKiN#?+i$;|s-L?a(DKs(Qxv5)mZt$NQ- zzMcQ={2%HzXw&x}>K2EECK;|8ofuKpn@8oM(qLi#CckWM7nI^44Q&&eL9xECk|9j9 z2;MCJCDKFEo(4*4!U9M?t7sYC1f&TqOyi?%1(#HZHgV!kJg&~&MBF#T92=htxw{U|Cfh86de4l8tiaiE`^Z>yxdBXQnDWAESmNGBG<6LJC`P8R; zLyQ1eEWo>%(XN;Iy%~5#W$8;>44|P`eB3o}%QbXZAL|j@OhJ&r?x#_+*pB%?A564| z@Xi;(Z(=-e#!k5v)V8^~3(keCiZu8ON?SM}*0!-UQds{(rLukGPkyT+d-K8D3HpgE zD3Oi7?t9n~rN8Y646W3z**}L7hw!eM!spYvGVJ!TS%>CS3e!!$lQF8u5f-V5&s*!R zsu<)@2Za4&NEP{At^Elj#0OR|KI;nxBRWZffx``SPGdy0(j$d)5|MzbZvhCui24A% zB+mQ`eV9f6i)DbY57Yl(A2k2s8LP7Y0v=`Opq~FiCF1uf-rB;BX{EnzO5N?T3ro|mCL1>ptr!p#-WZoP&Lak+us}`zDfT4qW zCvo}Uo445&PKR@%^8a(RdjE2?h7wmsibHB~{Z}LBO_^SG#9@>!2Y z1$lz&%NPN0)KI+#d~#ASgn-}`Je0DDisO%meJgh514ElDX}yBc%AqaS0zFdE+7r_% z<`2wZXkKgZ;w-U}ovFx7LNm8S28(d*-@P{Bmz7TaGwYXp_mZuygj-+@$!}EL5$7*e ziB`iuNK4wT#usOpg2pa%%FxTS6SsNx_ht5-PZ2uRPA_ax89M-H6T@mY6R$%`mKzr% z`zYJEZ!-v78J%Nev>-+M0=CCBcg9&Cam9=iL;pgvYRRUkt#VyR)FOP+qJd75n^wr# zi*6=5N`x!ev0@!luR>6GU9s;jte=*e;Z@2oE%&$?{!9WC-haa&@iptm`xh4^bww7c za-qzeI&>2?sCl?G((pIqC?_>!gS*y5^|lzsJxm4t`tL^>yZ&Zu)^Pw#vujz=vwKc- z;ry&uFQ#QX@I6$CB63I*PnG{G1S(Aw*RS@RXEzCi(K0vq3RJ_i&V+%eFGa$?wfnD8;KT-6o|sFGt@v&JZYpgLHC` zQS`>(#4u^(!3mkNhp0(er5e^n;ImJC;9&vI@B#7izk?_URMy&H{~-xrpIXOmeWkIQoc?@^fbGgc{&u0y}W zVA=l`+BDz1;``{TT2Yt^S(=k;+16lG#YUryZUz}Tqv6vLe-4#d%v>?}Xk><5aBO zUPtL;D@!M55?oXdKkoW2<%kCC_c^tdn!?65M?r2Uv0b)XR?IW2VVh+b`(kwY4HXrx za5+%fE|g2mL|?n0JHllrJ$%Eg(E4 zqZY5*@u0eJy*-jRBByI@(~%JUP)xR|<#4XF@;gw$;s?La{{>MgLyQ~q0JBd5ai@Oq zc_aclv~!L1|3{)u;4bA?u<~DjKi}Ef`F5nG#gb<93or?I``XqXkR+@ngQ&3LN!nrs zE$tW^=SP4Y7B6~=2-29n^UdDYq}-toqd4mRe{j}eh#%#g77?9t{(@|oD-^}v41?L| zfRmoKZg?X1E6vt7G*B`#pHH|@h1f4G=r}mUH~4}bYL3`09~f%`Bx80q%m{;s&lp}m zSnIYUq+*a$@dVC{2Sx6km_*;+t<~5=3noV~WD(O)pkIoOD5HQ@XKU5u4?|*NDWh_U z!M~`=4c;jCBfXu6pr%w8ix7Kb>u*C+jRO#>l^!=ta-xA2sds|*N(n*3!#{(Vb3x2X zeLm6yEsW-`iY7mA{*4NAKfC9)LO4`+|F>~rnL4hJ$t^nu7zrf_|arH~`5`$K7> zy#6!8%8Eh;&JUL$UiGJUfr&q-%Z{SLu7G>Ejw z3G0t}=}g=BJ#h3gc#DV`M`1WBaTxiUY)W2dGh-kUz>I(xmGXspcG=8y+EQ>BZ-8-s z+(fdMCbU)vV?o_f6Di}u+xU3~SsS#ok(;l%e+oYKJ(ae~VmmjOTs+*YyLTRgh9gzK z&_8g^RzWz!&dA}U>Hf(;7|Iuph3mHIkf(AzZf|Os6$yKU$Gv za3u;sEB98$8K8sPuK%^(6d`P5XGwx5XFdf)c#R!#O|XQ9)&}b-b91I&8gXGhe4j^g zTW+R?x)Pk~3h{q)S+OR3kfvX8Gn3wI5H4f-rK;~-#ZP<*G77Tq@Q`}A`R%w!H4u@( znYD$k6OleY@3;bC;OT>htT!@) z+lb6?$!@xNf4QU9Ce4cX& zZMYqw_}gP6-lp?j5e6%8rmb63KMOpW`BT1LtoY6sElr8(CsLP!Vr3|go-V%&HUFG2C`*;^@^rxry zTiuju*Z*_kn=9-P@{BAGqsJ?gi%=0BZy@q4Tb9dt}=!Y^0oLhU}vGf1rQ54yWNpp=q2QL3q)E7vYB?yRPN93yq;nAZa#m2%xj+U z=o2>_=6lSk0m%|*ZQSZ8P^eimp-ZgDS@6$v_a$f34Ujk>Ext?4WFI8%Fs<*yjvCt=uy)e=MrntzMQvqgnM6>3jB3rM&Q`j$rCkxw8=l z88zv#zbGA>9z_lg;z+4RqKAfN%(nDCQA*5NRtzpEq%#xT3AFl+{we;Yl#2pfx4aY1 z&gXS6tfJ@B=i>nx>gg+66cs~ynQQ-HV(D|(9U?<*vieWxpst*tc~yJL(bklo!@gQ$ zomh#fVH=q`$k@(Yi_f+q+BtrAl<}H7h`6-BVy>MLKsE%3_+6GqYMQ(zsBh0dK@Xrk z4;{}VryBNRVPBuhM0HdM!)c_d?xiA7O~=Ws{X}C~4`GC3F`Mw%UAeEq0r_OEhu1 zUe>BaLaw)D9K>tQo;9#Nfsy#Q{X56#QaC|1rn__GQ6%mbcNhmlD|b~6IlQaz+p~j) zB6W(~=PlMtO>iZb3`Jc8&eW%~GC;Peyz*62w#E!nPX& z6(5Yao4`Ea2_x=DO>q`dc7_d*zmflXBtkm#JIy*`2CbS`kt=IQE!V|&S^Fo!C_V)V zLGL`2PQ^gm?^eZcM5U-?C<+kJ-6%UwE!G-z+^;wrkKO^Y$}PVCPahTA6R_} z{^FhayOMLuW)*z9@*Al{)`?njVL`o;OJJo{evW&?9C9jOQ@L|)0tM|h6qgQ(O)(B^ z$_P5P=udtoq$K;&pfy^y2(+l=0hsdW^79;Z93Q03+ibEicKkQonk{TwmnKT7w3Esy zO36cFsUzt9rl25gd9r;tGdz?7I(um|_NM1RaSHw&w#-=wSSRTZTC4WM ztOHO^J?7+4$s2`}HO8D(tn2{bDylBvw|8YW-v%PiT;`#ae9XxYf z=+)s7+H=DD_CE-p#Yq3p9qSQdq};s&&~?oyGRIm8iseCU7H$V{SieZ z;9+d{BcHSIH*|Zs*~mCaf>VgR!MUBd(}YCS_MnGUjYFaHgt{jKT(QR$1t| zyu9>Q{WvaIUx8B0_Q3^IFnN{n6bwvFX1OLH!7Uy9aiLMm2@u>`zOHFOZfQj^Is*0H z_nLcp74dm(TT49w^b@2$O56G(s#+o>RLDWz`^V-y#n5EQXm);h*!g`oM6$fr7oQGYvpYjl}jynC|losale|BFA}6H|21U zhXoJS`w|v}l1-j#{5rR!v#kx-O)W-&;?WxVsb$5uI9|hXJ@BF&c*zn8(s7U2JYOqX zwLJig@x%bqjhx`kPMLQ7n2}Nac0~pUzCfrF6lT$w4kbos^sGgK(#T4>jC9xBN9a>I z;!5VGJU_Ue{UX0mW_->sPd_Mhch47fUX?{%C$hJbyR-2jcPd5_vX3LXe)-{E6IB>7 z?uf{m;?vT4R_4>pF)!`8z{(E*Y67+(c#nki-c`{QvG|apV@=LIohQHPCG=hTetYy# zPDP6`7Iblo!>Q^5sD3-fp-2VEW$Jx8f9#wq z^h!LLJ$%+YUYH=il+i&55?!~_q2)TzJ*;Ej!PLG4 zdu|lguwM6#C@asqRVmkX{;3#jQM)YF$oI^xOqooLc5(Q0gsNryKn zL>ycSo-McA=6BI55GWOqBtn zsLsXdEV}bo?^WSf4v_T_c`WA&#NIYrTZ*pZ(0eC-F4OUtBsPfU$4Df8A7`mW!EpwY zqzP>iCw`1Z&((xT=eKahxl9OiZ8BiFa`Irtkat8p>>4$XD#B z3>%8c)GZ>7LwM;v#uvr@*XU^|_DL$TUnt4WI02>Oa@${CJ>?4R2Zv^ib|ZkC3Mb*! z9`XvKx4Z42KUO?^CbnC`hE;dD0-V{A-K`LF8>}ZIsfpqK&J6t;%0JDbh4#(?q*G4OO zqD9ZxUR-c=ZLi9#mx_f9fpK2R5;Q{rDnm?3pKE(=iRoS1u&7*;-;&hK+Yif7`j?yi z@y}n!Ncopq>^0HF0DkHX8JQJIjx^&o6ayE9cd{y07O#b}5)O`9W`=G=0qUZ4j*=Lz z*u`2}ixa=0M>Q=B>|X6z#}Mgekf65$6NQ(TsK;eR>K2If*L7m+_uR@=_U^1qDVQW( zR2v7SBu*`J4g<<8a@5_%15?{i=1B~`(9z8ayUhBlD|OqT?0M6cp(D2mRwZ{ZVM5cVP+p~i2IyxJ5bZ63JWpm$BG2~URBr$R$Bv436)7MxPs>Im9Q^qPEcSS_ZCWlN|GPbGmaQ0Aq z#>B^+tfb?97pr`GcG>0+s`{YT?6Budd6NQuJFH~?VH5h-x37QFIsRzjTdrEZlyheB zN3v*W!&;ph*ie=oV$rkwQrSYEnzg#3-ICiTym-Ted-xhqr0FW5is2mBA=^H3pA4GMEv3>xy=*_*f;je99;bIoMI z*K*@F}>C2Op!nM8#O)Eo$iL{=hA`ld({EFo-9)FMb=R$wu@F) z_O==suefDmw|?yM3aJ>(H_ z+sW}Jc`1I&`0cP@#TLS?()#kr{I)c1OWk8g-gn$UsjbYzS$0fP6N?T?6 zrS+a(zw1M{s=wTN^4p&k&^-UUh1^uwnqGoShac%=VZ#HgNsyVZ1N!=QJY$i5lK{eL z$T+yw;;rhYgUesX!DHfUjXRU+^}Q^zkc~m*69?~{JU*zp14FBoYI4(eLm@uZV8OS9KmH1O__~ekV-rVHa?q z?%-xxkc&MHhq?F<;bG~)qDHZ>nM@}9#0j}5K#_WFxz__W5N6^DJ}|P-NhzcPYR>c3 z1+hO6y^K<7Y_dK9xEqM_Xc(#1TBw9 zTZbS0V+l}Ow4R}B&gI?Ju%uO7vDL_8*zNDGBI<4mR6U6edg>0~U0vva2J}DPNwP;g zylTI$5|wMMji0_TqPpID!cGjV6JRHp^EoLUem$D3<=kjOx$QZvI}6HWz(|h^=N_5e ziV3y-;={@HxqGKKF~DcSe&_SoPFOu>Ww%2yKA9DH+h`2ui)cu>&IaDuN6`Y4ui}E> z1V0VCfE82#eZmQ}5$!;w$^G1@tn*iI&jX;r_8cNPn@Q&d#?h**=>vpgY9br8?35^D zK8z14qxoN#qS+263r8zYuyneydLOOf|Bs|=j_&05+FN()Zf$LCo1faYZQHhO+qUg? zYumQ*_WOJP$lT;kW+o>&nUmc6NLd5-FzTxpgKm0#|Mh^!rC2-elpgwOZ-#TE>7vQ zL2_^Hnf=9Oj+ke?Gr-c`$ALoaZsR8OsvT~1^`ImCDyN}gic8ttRbJYfI(g+Ca^90m zoxTuh$oF*b1-$oFpXnM>2sHBEBlF?Lt~pLM*Namq(c{O^+}$R*m%`BnB(~Poo>R;j zl&x<}|LQ-<7%VR7D!NJ}MhPu8y|8%1tFeKcw~KtnH?z$C75{8p_}KqY_|Ah{1o0E# z!=F!Fa#->g{rUdA^&O6Ra1mRnUzFW}dCODVIavg140u@PZi|?6fILiyyX|Sj2aKIjMhfai?87r#Jf;QzINGvoiR3*kS*3 z2-5+^*{)A}lLvw!Ye!x{0kHBs!ka3TUZNBAjiBiDc2>~FK?LRKrTIz`8F|C(!mB;; zP^>#PsJ!uoj+kqNiPWwsJ=z3%&6~X!HvqhPQ8R51wtld9{(DjK*ZHjcX`MAoJ$5@p zzW@+VN$&6A3o4@gB2b29F+Zsegg~!7sCa3DQoWYas5RTjWQ;|8Um0oTQESpas&ChU z3qAKMc!?XqwE>)CTKuvA7SL27?QoO95+`1{C-9og*kdY-zq*6?GW<#COL=6gD|KEk%7GMv$-EA;rF!glt=+k$6=d=!m`?=*WhpQ7 zZK!X$JNQEK_fEB|<^o$l9Y3~U<{v@$Zw!QMt3b%N1QKwOUH0+u1p7AK)G65EjcP_d5+3c^Vv;tq&b*Jb8EZ8Y)=yYUk zAM?e+!j0rKC?>r^Nd@jAxDbeJHV(rZfk}F?;=F+nUuRMGQJGUMuqZ^dN-~n&TpX2a zYQp~8h>G04FB@oYP@?OaZWZ&K!2&QO7}LZ-mz3tIu%P>de7y3%w~ut=5mh7)@)Ou= z_sXdkSr1a;sg;1JN#?b|wAoHWewyUcybB&>V0c9b5xa?F$%?gobeo0It)|0n+u+{) zHmzpy!YJtQGpt)du^-M$Z35$jcg)B-x*LtOVU1K5##Pqfa*!IjZW%vdB%NP2sEeXx z0fnCY>*pG*>(Ofs=|On!>OOQ;^pX}Ig!aI3(@oWvy2#P6gDz9C%Ng3r6I!h8xMN$k zOKM{sEvqZ`!?1dh5Oddsi@j%q71b?lN_svl)w^kjOZBF=cf* zo;RfShjWH=GShDas1Qw4fZ}tdqbH{lBP&Tym>6M1d_}!^C|Mhm`!udssc?~VhhTW4 zus~{FhC`69^DYmfannMz8dU$Cl%Ec@GMJ}=TJB34j9gtCfNpK?q@aHfT^$7GCc_Ln z>|JAj*;)p;+m-40r{(I z<|fp&W5hvYT9#58gUM`sRFM7t@^-Q3jI2OFZy7}mj=+vo+?4fvM`mZ`q!QD0wjyh} zj9CF^Vb5MPYf^jWUCkfs9qM8V7)U8l6k2hAN4&f~mq|~2+P?=rP)CIyuVSJ3gDFWn)$4|n z{cfvBDpnhox6v7hO6wPZ_^HT%E6lCJP|`a zLD*lN#8{ID&I%F1Z52y#b-|3QZjMioI7~RPByEIVDY0OQFNdZ;S`{uHY^@& zn57Ji&{`d~)hYq1U0NAqoDrrtiU=!r5P5i<$VYi3eW?KEgWg8 zhxpAnhE35^A{MVlQ_j~bCEQ12U{@WSIovFN;(M~<@Q|%zdJsJiv=R-YmGLPvpV2=E zDN*}Q@*>X*iZkfUC(o70liZJa*!z(oUYDEszqG6ZKCtG!Vee?m%H{xBr!E8~i-i$D zlTUsi1lNVlxQM+7^Hpy`P@oUlG^GA!8C_Fl)7u?&J=CxYM#Nb=*c`w+_7h+~pi5Tm z%UqxyUWKI(n`}TOn;EiSYAn_{Y%{})J8(s!*|PnZ9*zgu{?0>f?QkK2g2VBB&J6h&m{7wlmgKSBsulM={T1k2_x;Dl7( zN9Th3>Bc_2d$WDXo+X1uvQ?avB>P?Dq+tsUGs-NQmkl&D7n+8=>YxNkue3EcfjV^;(d2jmbbOzVF6{$trNeOQqq z{WQhNTx|&D93PZ%ZgOU*vGfw6Z(4rbGipR?CvMVUSq*hL{jJg29M@hTPjin*IeL0* zjv4E=CvTGbT|>o-1}1Jn%?2$I=;m(VoFpoON17H#ngyTqn26O_VdzwLzcj!&*cxQI z$?T^_pVOfr*Pk^BGH4)Yps5mpLp&{sP_neQW;lRa#QJ&s9zjW;;Q2k=ef%+S_U2=m z5LUe`6Zq%ICq}m^lxe~u#Y(QzV<`Oz`@>7nh4(M?Mi%1z=r0~g2Lb_v4OztJi_vEv zsh>Aq#(gLJSoNzXLv2X=Qk4ToLmd;|2e~B~_^Syki1z=0fdb2YfE|Z9&E18#+KeXR z9!>x5E9px2w_-5{4!^Ci!xM#4OH02kbuYu>&1 z9pyc>ZJ!%RR9*iVuseQeL?)7F5~qAfg4A#NQDj0i+|UC1o`_zQI{4)Xd;SpJNt@s2 zEF(Api@K4gxsx(~+~s!oMR-JZ)e3XN6|>yX4^NUJU|8v0X`+61+X+>J#ub6>N+0{S z<=M%a=#^HjW(YTV5Kjy%<2V94+s>lxAuGX_Ph_A=xuHn_ppM7JMSW&&8Q{1CSQTW?pSW|3C<0SH*j9P^Ar-RQr2U# zQ^Tme(hkV=mc84M{iz~3@F$}=!m!|KP!7(`$Q}r|oz30CnL;0Cmfwv4jIUzmu-7XU zOfg?;{R9tKy)#^ppcd~xpK`P#mOe|YhV|dapt&Jq^D`kmuROKBI0B4vh1iZXif^i5 z2vJVfNr6}FTb1*=AayEebX#&=6r8paz=}F5%3lL|)H{y)oDI)=`FE;klB}F}Mx^jS z=_fQFHwzzuulchh=)#4QS)Sacc+tXl7lVBE#C4ado+`-FDE_|HSZkIZN}|eMZMk)s z$txNWBvn~9haYt12U|j>Ko<;#>c_kub-q-Nqfw3>&E6pY9sFZ|Pndtak4-5jddD7P zOM$-q3G=A}jFf>$?s)Q9XylNM;25peoBuz^=tZx#(}j%vJkFegw!6v9^qzX2MeOyj?p z#CVHfQh-_cD&&OobbW3lEK!@}>*QO@CMe4|VzFv1#-IMcxqtH~(8B}&ygzKDbmFzy z8qQK$RuT0X)i$@k^+qztia(Mp-nF=8|Mn8gSR8y;?vp$n0DFV>lbIZ3wAYfW8iz6v`eg76mnLX)%ULZ{Q>MU7+W6( zDW)GVsoCz{+e4)UbvDg&@Je>}xJDBkD*j=mRIdut3IR45d)9fdP zympSM?ZRhj8}HJKi`a=ac>)>W1;v&Ttfnp9Z;yTcn{<%vCljwH(-)${&cdon4w^~K zKr5c+aLsC6M{;%|n0ZrqMy0hlxt6Wee_^TBcATLiIB!4Qcp4E(kyBq!>Gf`RHi^^a zZ)vcJQ=~KI@r(j`^h<{|fu0M6!?QiVN!4vOcO>RXyjqa81Vu*;_4%qKXX~+I_PO%Q z8jE9Nfbebn!M{3`zi=zLdgqjV?| z%0(^fuR3S4X!y|;QZCVuaaYaf6+^4%KC|c@hiX2_D9n;S3uc>ZKqCV~rwM`TH^{UX1}_~2m%s6t1cn=#pv;-FpX*^{ zJuLT~kR>NdiVU(o(Gq-mCk|c%Jo#p1JoR7W^J!?y)d*4gNq^B&WsgZ_E5!RE1xW_=WH%iv4O?2Tm?VMX}W4$;`waI}BJs6P|M!1OlR>q?E-Y;(_FjU$6 zAw!8NThZ;+YP7oc_n04w9wN7Qr;t0up}c16;BASs+V`kNGr$V)g5!F5wb|j7D=6Ud zh%08%TqKDbszgZ0Wx9jxuMsZXJH;z#lHz{pCtFxw#KtO^#nkXN@!3)&X}RQ5Rgeq1 zt}(5+h)KS5+%QOyH_LDypNsaTr*k!jFuPnxR}W=SRSB_G&JUOrVyskD7;=mZZ@#XB zX=f3n<;r_PTtUP*2((l47<-|d0ErmR2=0jTOEIgCM7`G@XA?GeW(ymw#qn~zxbS}2 zJ*&r?(eXJ})qQb6;-XKxZWG|d|JFbeZf}h&tAQhV<(C3_yz6URhYzJdEtHYZ(w>zMSa3ImdHjj8iuHjH z=a;X-h!(W?Ft#)9BG1XzE3^y&+jHCGHR?8gHLWDB6RDd{bJEd9Qa(Bsk#L1*?K;h< zZag6z_TG-?@Y)X4cYO2un>~p*GE$eAN^|P>E z>cm_4e*cCC(p^AT5*3#3imvb8maBOOq7*`Ob-9{cJGNk%z*3Zkj3Y!l3a=e7w*JLd zC(-h?8Ug$;y}k>jF9%K*LMb;tSlb`XWt1oSNt%Rycg?iysy>71rm2r8 zkhGENmL-C73N+cJ)tVjrANu*Nm!13)TB*x;<2?GNFYc=|uk-PRR)5<1!TRJ@pBa(_ z6QtIM9I0&fpL4-H-A}kx5SI$Jm0@{E0^Kf%OR+^RLs=^xP|J%Z^lchQGei&GxlxtH zyMCLeKMcA%hlJ>CNS+|1PU#}i18h1aJqzRlmHFm z)*qGww-}ps@!-q@Tu?$En7OO0Bd6;o<;<+ygvPF2hmT}4QX|^R8_rgB^JzTdD-1Ro ziMyD67SqgcWV_zKKolV%Y$6IM3a1P?V#8u@TfL5XJ$+t3Pj#XSXh0K z!bqN>Pb2KCTwlj}9<#V}c7`(eZmPA+xP=d%>op<1d)|D@N2E1Z8tJi%x&pftkN4Kqw z*zVy(cEjsGfZ5-qVY;{Nq$^NQ7_7`-W_b*07Bx;@j&<1E_&UfVLo_X!;Z(uTQCtis z(bW@3t%y&KK$;ist!#A7v!CHr-eFQ88tHU>0Cc&(%4z7%#-%l^3@N~M|pSCd3LP3Z{xzX<~ie6ao`5~77Lp-dWLr6Yj!c*29kzv z;5{+o`SnUucj;=vsD9Ia3CuTo{(elh(&}Za=6juER&<4rSLmX$+--)hsm>!6`g+vK z2AOz0MEkz$L=wTJJ-Wsl^7Og*S@+R_8X_`K?ZXbkq4&eLu5}HBPJr8eI4#B8Vt0N) z)O@G@wG1^AWrD8``TZ8GNqX*xDfaMq49JHskJ|OI;2bt^Xlmhs2kNX*E{TAASpArV zr6E~rfHOL)}eYoLJ19TqYhXA zIZ`CDqMrIRwH7W;ENILj`obMFr*EFvdWNE6F{0o?{jW~I z(C*;P5ud+PEAG#>cSvtxbJrNF9*z^h!s@kA$hLelOqs*R5}&U363#jyVB|9aBf1+| zOR}xNJYd(8-`3MB!yh384zGKDA$Sz5ckWx)#1>#V9u41BVrkm=q zi|W1j!Q8ufZ@?sHb-fIQP;TV?6mJ)ct)DW;zXj*8#5Er88Wity{5#1|r+;7}VXZBu zvVY>jO6r`fRAfr*Qqz1;jEBz3fpI&dJL#?_c7Qv(v5j`tJeZidVe+C9S#MW5!=$Y1 z7cgqpq*-3AyadJd5I41gz1^m9RTx|W;2>Jebc-{#`U>+S*$UWGxLC77csG&{!@#t~ zMTBl}0)b*(0UlKtASn~`Mn{&+?%@9V?oYvx-lcg}45Pj*cYX21)Y zV*SWhJ0rgpxo02O@%}wwvZrTSVa~2OO^Oxx&x%jbFWlM5Q6>1im5hGnWe!7%>${TJ zc=i5b?kB{&9cZlV!`85%&T5y>XG7z6U}11XJ4Rt&5Z^K!I`&U01q-;Vp)4}oU%tT^ zhdg?t2L&K<zc7zX@uR z7GjH69;{gbui|t&e_67P8BV1~_xp?_8p0BLLk#;&$1Sbo2DDMYBuE208A$Dik;r^3 zvWuvyV36QnAqYd>Yjp*a$p_Yi7~=!8z|oKf_4yaa$(M<#t!}kDAmRcrpn{una%Irb z#$^+(Ry3F2mQTSx+E3L09yypnY^Zcm=f{%l`qc?wTW6FnGLYg#jWSvS!ON^J#}gf; z4BYgdN!6yw)FT%Oc~eKey;;A2KC2&)&y~)Q5jx1yhCkd%TX6{p)-FLggE-`qh6DKu zrg9$C_Higvn!itGoGH&cWyWszk#S-uIJX)`J}LRHROy|!$NObUKVEjBVy_kaJx2%+ zM#ur)Cjti^%4l0%=&uCgy1cIZcOjHw-N)S*>d7B;9e1KdV>x_wcO%p?-6no_+~SGX zVbvWeuU2V#$q>E1}T*cCzm0U}t%w$kdft)fpI(y9&4p<|oHqcQ}K?xkQzBxaL@3 zSCkAbjQBMEYKZ1i#14^SH*THio)p{Hj+k1Rf;2YKtVWfG>8O%>JoNC}&7)x%RJJ=s z+=|y|fS_y#AlsQ#i6C@oL5M!6I*{9)_cFj~N$MSna0fpM^YAZf=2l)g3^<;w^Q=rN zq%xQrM?B?bd+{Pa66_|GPK;jXqi*R@zSFm5buU*ihIPCC+xtpJp(Au^y6G5UYl^6`@mzL zV-Gc44+tr&Nt)fGd*Wk8y=O(KR*gsG39{Q$Dn}D~CBngd(%()D6=Q}L%hMU%n13vl z#naS!(_v1yWrJ&MvignNs<{FFLb4@y&_a<5k1ENn<6AnNw_TSsNk2 z{f(}oAOWTD-Ka?x-#6NHvUX!BMR5u8wJL7CykHm3b-}3@EM|wBK4Ho zfH_2LUCc+=g3K~YpeY{7REwA$sirmDi4OB7ttnqf%jry9j&`>%vByR7SO~igbt@64 z0d*^{je2E`&Wt7Vb5eA@_2=4Px9o{vN267AT{^yIDqw-;0gR?)BwPg!C58$|ONvvg ztRNR0$+fcQH!a(WO>kCXTQXOt%emv|Ko2x#cO4XW_%_gW-1b2piu(|G;Hzw9u=RZs zl|JW6WXcs>?Zp$G=b~=S`Y~??DQcmy_*BYYg^(ui1A@u7@@hUfD%T11HFq1YYdV@b zm$}f8-CLEgp^HGEpIlyEy(r-?(;{QB{uAy%ai`JeOA%$OGWqHmN32KD)mb!eZOqIP z0S2M~ulr{*R@~+_Kc=nS)C+>LJ~qU(;UAYt?YD=^rTQf~h3Z??uM9`GL!mh24hQQSD)9W?zNin-@B|G|8mcqk-mzh zNif?GkGEdkwaxFrfaknSF*pN;ktcNXY^_C3qM16VL$7$X~chVi1jmPEy zgFkBj?gP`ntLjZc3QqL(NS)Zl9Qw1;OIl)Z&DQ9%rATIGdb?Q7dgT@;@2nDR_@8THhin zQuSPWB|{dcZoUqiKGimGx`5DIQ=R)#_^6%cpW*!${2)GqYoP=?fPb`xdxs@I7jpS5 zeN>jMQX|)n|Mqyx`TlsmUB#1;@$u&QYT^C9KlPE`!Rz6C-(TI{#QXMic6NWecd_aD zwEcXW`M9{|jiBfm>iP11WAyku9+jS+{(4!*Az6?8)jDgS7HyZIrbXN8#uMu&w|J6^iNm$6yteb|?1*9fKczQuwhbAe>ZRxL zV5kaNiL>W3-D^9suR2icZ&+pE7ru>JAz(b5M7Ij9v_;thoKO$-41TG@6P+2TO5XbK zbqGF*b!Dw;rKp-ZZ*8J5)-TCXFmkniXzK(z*^jOfU*B<-w);7Jwh3cb135WTFB%ZN zW$gq?q%()&N#wXwU~`8V6e4qi3Myja_lo_i3n<<|gCM9&?*MR#I)p;77;5PQldYWC zIvFrppnV%vLZLVOx8f##i)k1tr_{uepuNDUrET85&L8^~8kq;*b@1k7a$(}ytHzp8rSv6$uJW~WBzJV`)c&`Tqaho5 zb>d7vFLIpP*%|lOxdTx#iL0cC863(%E7QJFa1l$(?2}&i3%A;6xne@C<0|w^)r@s` z;}gZ)Ujs$6yFK=?wo=C&PjJ7Nd)l6BxAC{%JRXMpCry zt2?~yDITLn+Pu4jAMaz*f=XZaUlJm}Zsm7Lu70QyR@RG7E7t0EKRAN}>lMf8ek(h5 z&{->)wU)c<2xLE6cN2PRCGRs`7Sl(p0t`M+J7B zbw9fDZSGzm_Y$l_JY?!tl!Yixnr{>XY|krF+%X&abQt0 z8J(>6iP!8#cY5Z^hkK+L(v)nXL7Ziw-DMZXZ!pRyUQCaU?p)-G$^!ZYP~sQ<-#~nL zReQzZQwR@s$ex9VO`4}r6XFLF#XCeCw*DCTWlV5Aq8?2-G|VMk9_~9!t>Le6=%;7c zVFkIO?mv#>&1$*yUPJ36OE2ERx4>q?!7ig($JRpRX?-(Yw4(G(a{3{glldS)( zuiSY=;t(F{8GRRT)0T)Z?M-0I1*Sc#mqePfOIP3?^b&SSjP38?fq8JhKBk^Tl1n9( z+c+hMYRBhg5xR%n)9VMTtbnj6h?0f;mW@Cx=DWO8c(@t8NI&n62 z9Rbv3WJSWikK~UMUD|1?P;aa~FHkWU80#WBp1cs(S7FWu+Z1<{#^m*xNpfVwKA4}L z@2SGRe{tF7vb)rYF>jxbGHbT~gr?4S$zyxL1od`oK0#A)dO>8EBf1lwZljbpML>KG zaCYbgvEZmJrmrlMU$x*bQES;2O$fTpiL+tgAcgs2lWAl4CT3-|>1ERRP08SlW!k3Q zS}|CH3IKLuOZRJhvl7Hsv?-T!k!lsyf<5F=De(Xag?Oyg2uS7bO=)*u1B}<~q^vh-yS2#nAy5WFhJ= z*ZNcX4CA}>1*BI}hitw@A2Y6PpZNnaeb>@pb7$Z*Xi85B0(;cnnGu=ro=KUucLbU5v_BU&Ex-rol6K;n5K*?BWtb_rQ*#mS}gmk*ys3Hb8 z5$WE%{spT2oh&&WF7@ruesKqzd3;2OxYg~i-_&m--${?%^PRi`Yyl z!U4p&Cqi)h0i%2Jl7hi$I9%pbJnwulnIJ%bxwibxiHnCOKWu=X!gHrw+@U>adpPcl zqO1=<0-zsrm5!YhLHFl*Kaq?LXm$L>a?Z`$r$PVpnU@o&5A$}N`ZK`q`xfRS#Cg(( z<7mf`4x*)b4Z9N4EI+FsDHO-H+TMIZV3&Cp{&nb4>6lDx48H|zYQYdm;`~A{S{6BpicRI>^pPq2EZf3?XSfy4a|1P6LyUgkV>u;*s@D4LTa4B=k^sxYAm@p$nG#=Mk}b!xLJsA?&39`JzLR8N)! z2i0QSI=RLyCrw4DXc1N?jPylGF9Ma(;UxqLXuI1<*`wDP_MX-!eJQ5=DRQyFQy66z z9A%48^`9va`w5qFI_!a%EWgPq{G*!+l4Va9keH|4G^=U+NhSnD+ZV-`BR>-o&bCrR zE;VhftD|E7?e-3FH#C%c&e!yENRWRT6erk^JSD8lIz8NskYF6;6%$e3RIIx@*KlYi zJ;3o>%kOK;8GUoV5q@bvtHPzK_ikp=FA}g8%C%}sAqGX0(0psM&bJCwUEMuA(LqNz z@Rh05;o)3kTETcUAL^NWTa|ZS5_K%*LAE{Kz9l5TiuP?W0;*1!DYvbdAe|Dfo22>R zHOHxJK@$rrLEV6oe4&;7uZHiyl~aUEXFVlN7-?Fy;{#D0#~G_xIaUJTNxUa5T<9H9 zSYT@Kdofa3<16KZO@Om=6V-yVFJ8{wx2^JB_>#%l1lMU#7uubvrqo*hbc3!K2S#_~w>+LMe2KDrXe?P1h!*T+@Q2x- zkJXvsvJ0ZCT2E&+T$v%;JBQjQKyaF5d8WW0FD%-^Z z?Rb7~wA#6DXxx&hHm7c2^^aGRj(#~JsEgs+9|0q=kz7zc;Dy!{&dFRy=J>Dr+JadLZ~>|qeQf%V}ognRu!Y{Bfg^Ef4Qf6 zt}RN2{^WkVFICe-amFyrOr>xo->CuzYV7fFIgk}QwxqXH4Cu~yoN1y>mpnD8qLNk1 z*oqzk_SXt)01~qLJ`0r(G@<=ryZLJ0W%*I2_Z$B#=Q!iM$Y5s%9-A>kNsg=bp`hX` z@;o{kgOHo|L}%4z57e7@#T-3Mna;;iz(1=;o0hwlI=%JY)!=J}&)z%2f(&~nmbT!x zDW$!#GUEmckQ|J(KbP7TwY*-4bM%_;u^uyxi%7*R%f*>sG6`T3l)CHV6zkUQ=N9;n zo6)N{A-16o<;Xb^b_DZvyG%1a`y}+mggC5hQ&SBm%6_TdwCa8>;Jp$r2If*J>p%@b zh>lYXlk3F8Y@bp`_mnZop(Ivyn|OB5nhU-Z zD&+kl_Asl5EKX!B=1;lA!37=^^iKr|aKco>m@l@(bF*&`H^*u*6HJvRG12O-ITEjF z)VrQME0O4LQrJ5cBClZYA8p59MX+f(>|OlFblJ?Cg)b}PNoASTL3Q-2Ez^7yK1N*=G^JC2J+qa^iDBrQKNI`K4@J}ogt%yb1?ELiYI*FH3*-I_JM(K=9dx^ zr2{-_F9{RxUViIhw7Ma2#_CdS7N#YMCa;3+)o?vqMl3WTg$&CY34S5owzDBgk>RGw z2|&$MDWZOaCZE^vF@2j+*;0N@1pr zKYk&5+$S)jjk{a1sBj5Y#8Zh^t$%q17Ea}yaor=CZfLzqHJge) zY&+@NLaq%Y_vejQrZGw6R|0WiRX`SfK7wHKa$ryHOJWw6h>k8A> zE4i1pJ32StXH#AOgZnrUCJRuz`pF>)7x(H@bRqm&k73#`)4_5l&ylbrw349OYgYEIFc+_g%8LC8^1WabWQR=CR1gg&X zd1@xsgK)HH5DcMLpGFbwHK)oAM6s{ztV4XEj>mQVE7;lZ9%;sfat!8C=rMW{W@#LM z1wtq9p%O2)y7SsS`06f=p2nr)U_CA!HT4Gz^G##Ml48!d4?L*M41lFRRa>ib$tY}(ml7*gfV7c3};$K6s*%c3S3=@F?b|zSnZjeD&>TcFC*&tgK9LrqA%uU|Q zIAv_XIY^W`LW);riT70$5@+TdND?lhoq+9;efvw;9;k>W%T?mPXQ4a%7#mQ}u2}(z zK6HOp0nu&q6!(l8LaK4dVdWl`hY`FQk^(f}?Sq$4MDX^t5!BUCjH0GaH1pQZg03># zxym;-s^90{H{0lRd&R&42*NlIpfV&mp0LHTIxO$B73LLJWNwP=;V*TeeCJsaTwBYf zL0b!)?5{_9`CCciO^)Xe`~ntys-CT`44HbeAc zVUI<>v-&V{c1wiHsYOWGQD@ZgI2IFj2oMEyKjh}b@JY*59DE=vtMHlMxxSmXeW z937k#T|eK@LYqV~RcZ7=F{|k%6~2xGP&tiIanD!B0bP!u5GS#M+m3`l2w>$+7{v)_ zM6JTVsTYRRG&8R{rs}e;uDRD22*XU~pHJk6i=ihh_{(U`=*+6Jyjm8dI^xmQZ<9W8 zW`z%3tV`$R|Gh$8R$Q4czJy^c~iyRBHEo37~tI_TN-$Tzy2|JMwz95GvrmDaq z%NK`By{>6sg|ni6wEB#$9?$)%7?p^#Y*^Ih5q(ukNZ45+Ar2=GD02$SmhlV(hG<)_ zzv>*vrU&QQ3vcdEC5l>9roec{Hv=|UX8U(=yT>>rva$jWPXk5qe@HsC*sW6=l%9gL zU6)znd8N&`24)@yLyOxq3)~=!>d`T3jqJ#Ltr9Kh-%DdjY-JLx%#hJ0t@ti$zqvS9 zcW7FXI@%h(T9!%Q&78zQ6uJ#2HX{$YZSSoNm`1=XGMp=nFOZjX8L`uq!g8GhO*X;G zv@#g-PpOeq1?l4iZWojk{GUo+%^9)xOk79%$V9P>o-+7 zhxH89+Cs0=`Nh}>Aifgig?oZVtHdh2+*}xRp7sU6EqbtQCdqJNlBIJguIHj~*Gf2` z0qW45%*RfC8k(P8}i^s#+& zrVN@iWIr?;2W1QGC|=p%p#fq z8evS8sZ4V>ACiF5BrMl6XObY9@C=7btHr?&n_~_R>j#Y1a@0&?7b7XVK(r3e{KU@B zd_kNp3#$dr{Cb6(N(6P65xjgbJC+XljCtW1&d*!8@|}R1!cM5$% zY{9!_vOa77XhN9)puvUe8_m(}L(Xn_E?gsuZ-IW%r%3 zm?)Cj?``1p{}CbOhHIVxJrUvgtoi1#F#N87z@=ggFfy*4d@%hH23S;#8f&^~VK)EM zS^kLOmOchXRb%g=es963yn4+>HF`VD0&{O(S+aidzfILUuTNdP`lsDV?V&h7KJ75Y!jgTA)wY58SbI|Nc$&n2-l_aJG@P1ufkS zScN4g{@)TIc(g`11iaMf*!%H${7vIbv}du#L7WMBYkI~+7wLlolR+d}i+ak^KeX>a zb5K`*A_YN`xQh!M-XLKP&MOtY6U6~3wtB487vY)d9y}WA9gYFzEa-vLS8~fPBiOuL zKen<3&A~DbP6wD53bcjQXC6&?*4OKa%}QJ9tWTRA^DhL=5gn&{<}AQYoa1gp-_z2E zB%1KEtmp$=^cuC(9(_Q5G&;f~89Q7{##-lVC8@}UnK7dv?N;lm$nmYOSzvac+NHx3 zQR7%-bA;F}K1t&YS=KB_`Xp|@=F@5+k~`@AN`f?%BUQsnYzwJrj?Y$h)}+>ZTD$Yg zyq4GiQF;sRzsAQEO-#ewG2V-iJa#q-pI^nD$f->F5d%w zA0X!F-&R1=soU#g$K>;a?l!roDe2vdZ6ALQchCj_nJIoey!2mq6wn7*AU=??jTpr% zR(NbgHQ7RXVPwZ19JT##-#RRT1p#wz3D- zU5`*B!MDcoDB!E*M-Gns$eRX&@AYPu1D~I}ut{#-U`<59{fKgxqsLnRDM|cH(*Pq9%b!Ww1e=`J#{dAInAA->y}#8> z`_21vbNy!yV^A>yjBx+ISu_9NM$`Yb@uzS+rgCI9xapaF==MgdSNe}};Y7^>5S2}B z^}jrZ`NM+MXd$cN-1<_mr2Fho;>Th*wXy+_bn)Q9r9J#8`anY@-G9ni+IT;;FB@w3 z=o52R*0RN4!}5e>Ogu2zF+wo8vDQpv2!5p1Wf{U)p70DWY8kfq0}Qi!FeZ1@{|{&L zkI4NQ-T%_1RV~%St8Fb6OmdK}e}Iu*E!D-tn{0te7wrEYSzn)r^l^jAqy1^CPa!5Z z4y|uJ>S5iK#l^spBQVR=4!DCk9hGvl85u&X1A+L&TpB5U{IL5`I$BF){Ctsuyi7`< z*IXqs6OsBj3^jYPM1}DZv58CMto^u?*aY!dS~2+|GFy;U$37t&AAxuY#*^|q9zxUv zC*w63(%%&F9O_-J0qe5gZj>$Nxvi;VDTaAYw|5_%#^5BH*(D5e|Al^V)xJ&4g1Fi6 zc)5O6J*hyWK{F|+eL<~xREHs5*Gy6?2bF9ASI zJ;tBG?%E`ITL-aD^Bk4TRcr`Na5kP4e> z?H(JVJGns|QIUr~9Bh$zn{a%6*d#FPPwVq|v|HbYn?vi%CVb#4CH~=!1zVCunxhhO z^_(=6Nz|WCJs9uQ&pZFBg0}P+QjB(xXL{ld3(R)W0eW&5|5@p-@7|D!-f$*boOm$f%l%{;0Fr26yBo z3(U*Vc1Sp9eXzV-3?@k@7@LpQ?V2-``XtwXmF%6=@%p15=f?g&KB_oor zW+s~rBZG!-(xN980mxBVOP&56HCYNcpK#Is`+xy`EOY|8CB4XyZ(g!C&#cGltj)6X zMzZH=a1MJ)>bygT_Wt9koUt%39_#$o-RnTy+m$y_lYSvv3ob~@66(1@>kJF%; zLo9QB8v)ovQpGM_cd@hLchg`Yj}tZK@p3UR=JRuv47RA~JP?-18%H|7{u+vK+%&($ zRqxnjcJ>AK`YkzVR%V89rgoV}Zuk~oT25wIrbK;$E{V(h4N5%}>iNK%?=e3!^L4X% z{(ZmL!0Q8(112DPBXImzsV_b(mfQnke;_B>r%m*a+HWg7({f5?HPND)>d%}YNtN$2 zCb}nrn#ZyWFZ~ObACAGye%>DX4m&9)m)0sX&A9h?3)m}LmPw6i;pr@x>-!Egx$$1@ zM*XAWRgcpnq84kxt~FQ$jA1sRc$KvOto59M#|5W8#&I1__NGRT^Z6z18=BWr zQuosWc{#qE$rI4*7+9-Ow-RFMir=*!gy?=0)GaHkh^B zxYz(t2v6L$Lpk;p7`l6xwj?gKy^Nb8`5;{Lt@G>KT?!FXUW05*^(~3H%kZKo1pYT; z0%wYFhDM6GiL7X$9G-IUo&9yp`|aiVG%`P*lN0lOIrHuLmV@*%ay|X!`sDI+NH-@d zEBotXbKQnlv*(ME_x*h)f86G_rYGlXQu~{|KB1w3_p7VZ3_Jlu z>f2$r{HwdNEWSq-E^^`aS-|l03Ze}aSwg%Ro~T-1N4gKBc*M2i9x2Y&EB}wG_*CGe zc$y3(8A*ZkW1`w z&6;t;nA+MnM%QX;iF-gDrs{-PI!L9)T+EQY#Q)p>Xe!X0C58Cg2XDC!33+>z^KVy9Cd{Uw*%NxSXm^BC3 zd<%02CQLo(RSK#8>Rfb)lk(YWu$BRr#YCggirib6p*WBESAR6uAO$O4n}Rr97FN8q zQZmJl&w1V^&wJoc!b5I094`+iwGaau^w%SB{EfR$w3jY@_h|)&Lj=G4RFV?^%>;~@ zR6?;aQv?H}zMbLQ`=)@brpPDaXysal;~jN#VL`6%uTREvO8KpriT7JqE^Doq#YjZ~ zdT#RzKbfkqXe>%jJvc+|X8US|*4*YxA5vy$2IMu#^mG2CT&N@{rn+3P1Hza!_) zt&5%y?{f`${U&b7nqMF_M#BlHxLjYlRwqjgOyQEN{#$lxm~6mD0XdVXrkv8v_sEi~ zlN;0u#_kUF>>;lD01wMwK-NH(tS60=x7vTGH8`xXb(o|zq~bM*)8rXbb^1@C`ZJq$ zN0WxS!MY3tMf;5ziCRSYI|VA(!IX%h1r{YJb0RBm8A^n(a;%C$kLD6v-s<#WqMs{_ z4-PzTwZ$*}17vbb5+W|LX%>IGqN7_rL2bnO7$dCKqQuzq5vG3C|3M4s5QFhzFjSP7 zuVeN&w-3XxRbehaN|s19XV(45MQ2kq&t676+=#DfhTone*8WEI*Nk1vKs(9x0?#|B z@D%U39(&W`Dc`&WG5UHN?WHXBRWmIhpp1)L=gt~E=C=Ua-x6b!3F&R4jJq2IH&C~E z#~k2`WGWR!aYc@>BQIhhtw)JeVU)eJYQ^Oz7htxBg)(|_j- zZc+Op(5jg_wxue0i}hy((U)T&{0juARNsY#K!-AMYshx|tNkh4)(cdA`m~=wYlFDds7QxxlZo%cqX*D{Q z)>se}nEoIec8mE=N@5vzhU7R=VX=q!27M3$olj&Bi?ZlklR^h8aLn4=i-c8low(`q z0T-_cygb0<=>bVIS&agjb}Fw$L=);d0#7(~>B&zIt{SdaQ^ffAnzkzC&O1tUceM-0 zE}weIy;dE0O*7zuuSGki$|*o?xK2W>v=?jutu78uD)Vg85!6EC(e^`OVHWa|NSXRJ z6~wBC3X1ql^4?VFt4iV!1$x^14zH;WU8MtgcIZnH6psJoVk~|l(&r<{F8{Q;n2Ck5 zqj9yaYPmhiCUurH~0yBxKK9C>qU zm~3M)^Ad0)xw!@nM5$+Ur%!L6I#1casP9V{C2ch*)kUE-=dvyOF*ruMi^tV}gw9$T zV~~0l;0%OD_bmU2zG%CMUf0N+iltrbi91C)#9O*h_F?E7(ZPu1)8dM)Oh0l(3X- z%nBq8ONQ+B@p78Iz&jx-YGI6LnTC?d`TWY2!BE_Cb@n{Nl|9y`uQ(-1@Yum(Q}wQy zqOFOWyqo%kffX<9M!+u^Lhot=e%h!`it!sm zBh+n*mE;JTMJ&G^=os#jsl{uliE+9Hr}v+da}jhRVaBBY7Uk$GIdfRuv_5{kx^(32 z(Qq{#1(@}yt|%rJN9ZPI6&1C5zCYx3dUx6(Z4EEWAI#qs7tm*ME^1GzBe`aUC|&>} zi+9%GEgiS8M)^cEYSIzjutw#?$)zzky43eo>QN!A;?Z7~Q9OE7(lmy_XsV{4E|xF< zo@C-7k(fJooD$P9qKg_$-fDmzDIp>IXw8_8_ux>Ry4)pnt-b%oV!da?`g#1P04?u} zr}_IW=iNdpSPe2cN>O%SpQyBIs`a$rkI^VISkI@l< z%W{5_&1|X8}q!Obj z5HUPq2^Llx)oPf?Xfo0kf`o?JyDO~36!>%{E_5e9@C*0RmP(T)5FqTXrV^}w2CFO! zw>!}=RYls|F-L(nsThlfz6hwBAwl2I4eO9!Z3d`9iZV)f0?6A7;XQm~O^!QlOb;fr zr2~lFnMcnTNdUN`U%zc9RHMTfOJ}Q2IPxKXVlniJ*GS_~NmX-@k0+nmrZDFW#!&#R z-IlTH(oo0Az%PZ?+AcKw*Wj1f+EM{CaKGmnxSQ+O!)`w-$P1#jSFa@e^4DL5%2@~d z7`g-A1m+l#*eZ5i859T-C_;*H^lgQP62LtqdPW@byem0ic^pmTQ-G|D>g0oBdE9c_ zW;x2I<=wZQeyU;uxe>gJnFG=7x+>)zMDz7_aF`2gZy1BX06sU!-_f(NkhTD^Yezlnm0wOB zw{MP==2J<}u6r06_Y1n^aGRWXdg;-}9>w+1y=X^+0kFUUjjquxQhd*~&%ZbNN$wQY zaf%wxGjuFFH!b~mGKJKI;hE~<157ZHAy{ycvB#;5xmNvs)|qD(CLcU#m9AZouZTII zGH54yKYsnvT8?ik}5%Q?8Q0vGoOH70hed{im{3y1hI9@-&jp_WGulh&pxXzu#5F8+iC-zF;-s z6KzXN?>TISiq6Cub-cnGB_Df{b#fv@DDWPYMut3u;TO5orsEBF8zK9c`O$d&VXSIr zoSJFMPm~5UP4h1kvc|(OXZEijY~=U%lpokpgE87rVf~6?Ik1D4bUlPIdI&v7Q2&WE z`ZkylhBq7h6-rw>8eTjdTAXwQ>FuF={ptUg-K7dOcy>Z= z^Ofx=aCce!YH!l4rB4P<;zVn1;W_|m6hOh4!bD6-uVENlO_0%Y+lX2Cg3){RZ8)T0 zoI2ZHgKk`>0aqG%!?ytqe>^7fTMXkZzZT4@Nmqq_Dx1Fgx@$7vCW?6`yr;eOYkcy% z?R9+caJ|xvww8bsPrYN@LJ)@Q5X-Ko`W;*`*r#t-ZvOsXGB{oTqIXPGf%+r4O9eY1 zLBpxcLn5T+b9H&IIM+U!Tju>lhMq8xQQPahMS(OC2ei{shyJ`T=HTr;tMZ%OSJ{y9 zhT+c0n$tAM%xBKCPJ0WkZsSX~Qhw(;9R1+3w@B6COph+`N`h{FY2Pa6>6Q$k8%79R zQgnhE@h*W@&GJnslf&zj#@Oq?T0Dtxa*deG%ewUHXwKWp{axrH?mD_iTHMCumv}Ov z*-dgjuEBi_2eUNpUxZ64ZB9(Rcg9(1`EtS+3nSA&HZ^C%O)maH4f!tqd1={2TB+Nx zCrU?^N^1d};}S?pmuz_SbSxI`0NrOOGf)$jPhI2jXT>u+_n`$vizUTdCVUOwJ2YTH z5zZSC)KEMl7gDDSQ{RJdC9~A8e+Zj=ijj*kAS+6v=r0-MK)A@IYiM7Z$fdp|VJ0Iv z?bV;2PcMyx;c>}GtX%XvC{p2E`FoZ)bJ?!dCgM(S{8m^$Cap&;ODWtn4TH z(AI5oai|G6*Jc_P25bKl#ssz<0b)1y$6*4%VeMqv{C5)NDNuhGOMXElVNB|54Bd*J zHnX_JCa=#<_V*>TwmGJCN!OKRYF|~!MXO`I;ir;et%L1lbIRD-tifX@)`#B^MsT%- zRA$A+ZNwQgy?UGbW^xh*houYrM_YG`5}~#27gIB9L$}uZR^--OsXm&zeb;dFhv#vo?!(cPpsqL#c*ZIpXMpG$%z67BcWKL0Nnc+epQme^gZG=;{RS2H5nQi#5WR2gfj@JX7Jxv)$^Qhbok(eO zHY_pRqO0fu`9D4qpELvI>wY%}Vf9Dsi_h-*<2^4~(ZEfBp0hU2)TsnD4HQd{oOjMh zB{EYb$MiD`YQ8uQKRza*$W|2{wI<}V+;DpsDYyvN{C2PZ0=GZU@&1e;O|dP0S5W>= zZAvb_f*ibFnM1+?8>ZD-@&$U_g_Z1S3A#_E<<|EISq9L?!kVOuu~u*{uK#50EgpNa zr`Yl|i7digykLksbPy>&R#`(RFgu{|pl7x_z&*|6Xzc5}ORA{kq03%u%5jHE{<)t1 zQ(0j&{2d6#fBR;KHc1B84dZ9Yr@9ibnh{ETz&kw`oQl~MlpI81VFSzGoTz%WsN|_i z9MzBlV_xo|X!4Kbh-BKNZNux`aw10Dc*cx?ugVqIwoJEG3p*X}#@qtGP-#I;lg18D zVhZ>7eX!g3)3IPG4KIu>q+bd7!FjO~LbHfWhSfxb7UD0XV@rhW&8|#k%+USV zlmnKO8@P`Bh(B5J-}=QD2Swmng>UQlx~21Tq=oVH;t9tGsO=;?(;8#trmJ@orzGuo zpa@#BC5>!i1SD^>htFjJ5qJI2%_}&Yh?|&+XAu-?Pq^&HDD+?4ndc6twS=vSiIcmi zd#h{ru%eM<>)De{|4oNy6&SPlkcP~W&P0EvPtxWrNzkI-<;rWFN=(JWr7U^_3(NPq z1(Ovkk3EYjW+>4u1h>9-gE?=RJ~~SSKkyb;u+fq}Mw8_mt^P3(x}e|EvE9Gk$C^XX z3RNE+J5cLEqvl!vbzac+@8TePTi_2lt|y6V5Far9b z@2|hHN|WL1mRkA|YBgSsR)ki2h`MSmiBQ9^OR{CadhQa)8mZD~$h1+^m>%Ipn02Yk zc@t=*YciB8*!g;&KP~CCU8=~ex!y=8CzuFnLVBF>!rMhc&K{;8fFEBoJMbnD)UNV^ zn{ukDlw;xv20nz87Zx@;aT$5+6P~u%Cz?(nysiSpdD!&Ng@kVKE@F>d~YBQ zYMSdD8*N0@Ukpfkrq>3g)R{D#hE|*?44P=bfsnijnsNxBV}m=|rt!HCW6|%)8GXmEI9ZF2#LT^HB@rE!G}Pkqp>LL%;djkjaT_rEPK5{dR?- z*Z-5~4ois;ZXQ|2hB9;1T#;5$9`6h>U(mYOvC6ITZM|=vt=!N3XA)}#0b&CN;9f8V z^*Fv0YmN=Li~b!e`x-w(Q_eIZ2HODw`tsqcnJ7KBUSZ#H=IzX-{wRE;8VK+RQnsD7 ziEiNh(zWBsWXHaf4YQ>M3ry4X0l7u1`$yO1LWt3cQv+=PUgA5xKlz^&b)<#20rJ*f zdqe$EHVa9eYqH*}XAtCU1qXR<08?d`)(Ncota2v8N3vSl8C!)&=P;XzEUDSAtg?m) z?RR^n!jB+LRzfh<1YY(c0e1E-UK68up+xD7t#pC8s(h#>Y6sf+l7($?lvP*-veGL8 zrCMR@$K3E8kT>^O*R8m9vg%nqZ>Jl5MI4C?)vf$_b^M4zjV943W}z0t zS7GR_6Ntqap-1gT{Lx;w#48t|=(JQ!pr7jD@SF7os;w#&5lo4h)d~BGdUE;7NmuEr z`~K|vdX~C-j;$SGZL|GY{wUqAtY57HvZfc6DcBH~vzi9hUgjXpH;aE>^*@UGUYtVR zd5(Y5D4YkTc|c9|5WNzJ$eq_(Sk)nEFUZJPIZfNgFcXd(I37p2*fjq*^YF9^-qHcxZ90pDc zcGI3$d&4S;sPkx@1zt4sztNc212}kg?{Q&TP+Lw;;F(d6@m6!JJnnf}5A;?k4XY5L z*Pr7l+YinTCA?~lr!J#5=(==>?rWB8o$%9q1FQ0h$YvU!fK~bHrZ=!5kC!=8PIzw` zghO|e9|#t?o_1q5?mjszc<0s+j1PTC7FwOxgapc<-sw!9p-{WyF&{c=S}vjOd-CWIYObi-&N z_(v&aUhK^pl1$OKDa-PG_aMbYHa$JTi0HngKQ1H-3G!@>7a5YkIq}CC*X~NOf#o$G zbTr$SIF`l^|LF{!$poVj3qza!KS9}`AAKIJbI#VWpYtFa>-Hl2ayaTpvd0@ANX2l0 zFumJJsoW24>AX7-gJcKq3`_OZ(~Pf4s14o`(QI!!Z|@H0EVPp{4OAj|FDW>k`;nMQ z)ba(L7uda(nhg_E)m}TUG?4c(J!SpW&{w3fV_PMOt32Qo2_S5(QYUcJvzU!StwFm5 zoI(Bip6uezCaT4)sNo_u!&a%YKAY}0;@&`|N&N)jb=yn({sPM8n2>eh#Ew<_{`0RYIgnv8 z+jvtj??Ri!O5U4HtuqEV3a2~)i<$|mLx8_{19wE)F4)YItdqZ68UJdGU_iRe+;BCM zptNSuZPQxwEq3vT62US71iJg|`;#nEHkd9ij1G~AxpbFA4;WnZ%ublw$qmhD&)0pr zEWB$R%UKs0C8ajYWy&1wO71o{wpH~58ym!3S5u$?rtmACSb=Jo2+gngcT@r$-U^S}fraiBDeRnwmSIU%{KDi3gRN_00d{x;X$;cFD#`ACgq zjMWRD-CQ`6jrJs4j$6;uP()O{r*rw1frx(g%N-3vw719C;A@l;XcqkxY%)mW5JrGT zzn_KKdV(4agSCGe9trwS`MKpj@Tc!-T^i}T z&dg%J9-}hfHyFM081O` zLvE@%_Hr8k%0Ji2leeEj_HvT-gYfV8z^=7ic)qK; zM?=-O`VwPijUyG&(bHkU62D!_*KedZ81D~<%B}GT$xy7ZRQ`cdmbR`^6X@PV@WqX# zRDTEWo873dzn&@7izX2Qar!?XBHwp@)gd(rMYN7sM2J z8kCTO*bLf^vm3AvIh%9kNqAkZ_lxY?ZO-7nKRr@4|DugsUL&T@OQ<>0)#QWT?d1=r zqhZONgnGDKXTC2%)le$&3tOplc^RSb(`l2M%wT}ArU^VNjnTmDc5Df8Z#C~$$$ZT; znLcY0a|TpI3Z`Zjr$V%)y&?bAx_|U4G5i(h=N4k$;60XqHT}NKPB5|SziQn@hvTx! zR%kAK+aO6VA2CyCtZ`qMqB0=k>vNI*I8Z(Mk5Z*m&XK|0&xCZc&rLj2rF7oMN#*iF z(z{M}tYop%tPI85=+U~BNZZ6IG{QO($3IrylG`YoB=mEGwJXy^K3B1 z{qU{}mw3)7 zr{i4T-2a@n{Udk4u_DW+al-QsC+)o9l;uSC-*SH&cEuIX0j%VS&Q$Z%?lcW)SfOtj zZL9);opZDJ6U{atog!JVNCTWzYSSp)UT`(BR-*tMHs%6KCgR#U4kC}ifgvf|E}y!L zXi!Nda^RcU0W8Qr>(b4~y;1Oor)Wd-gI!f_xF}aj_;3PCvxa)wFFen*zV!b|m2NjK zflRHuU58z7P_3tYhVVDzl>+XAm!s}kFJqvyy`2*!`8X5b4)6PsciN{Or=35>?{9lP zUmuR^KbNmJmREqRmg_a8q+nwr*Xt%eOcv7Jsm&@<1?YmihI zCW$+a=1>T@fU;F7*^h0)>~)_{$ND~|B}6^&7punu`M*9(5sLE1rRS#nIjy^!qlr(#tAhV|XFwNU8CD8G8>lE(GhObu&um`;T9QPdobUaY(sfIz0N;8w;M^>~YdvZf#cw=@B@!?T`k9oa^cRk7yu5Dq|&4y1E#SWm5Dme`dgdVi$Out z&w;3|W@sK%T6~dr6xx$hIxZjQQhvIkt4#)O4Kg7wbWrc@Gz?57xY$cWD7UmWUA?~? z&A0L?vu=hF!0;i|xTk@1k_XwgKA*EP08-M;@fvv?Wi$vAEEzI%@KKa9Wnm==GrrSK2dHxSOUitLC)Did?ZR2n1~s5-P1zPhW8AR?+@TBOHSn!m zfXGc5W*pp4RIEbRSR~XqH*Rg0@bSz<2{pS(2)^rP+FKc&<9#3RK0XkD55}w&ldXsN zd>+FDOVm!)lKAxNhSUgb7cO2S5`udBGK7-8*6LMR&6;CI;-HWeHevtm6YwPqM&=4 zsHdwE{b|=C*OuEGyg&p45b5yqQ&_7nFQSMQZnBkx7O=_!>`K^bL5o)vt9ia7>D(BHDr4>HhU*$-yu*-|zMwaM@BNivPU8QaF#`FMNB7qTcTr;&AhpI!XT{ z{%fS`)dYmL01f56%V9#PRZq=JGLguNdMSR|1<8a9e!0wrV34brsh7F&i!R zzc}X617LZH$lX3~wppU`yrIT6Z<{4-0cNpJ>S@cu&?<)_*|q1QWV6hwvM1bj@R;Gs zs!Vnp6yF41-&=SsHni~l$Jf5lG{;qAwk(Ob_5;$9pKv$k)&R7*S6=vKg2$5l13&_hO02bLZ zAKKaQ{gM`$P>!AsTia1NTZ^K{ktS#m)~*>MGZNY`cP%4ei+NcifW?AeAC79W8LEFF ze$ zbc9}!H1J%}V{3FHi-Awv1Ef*zDEH%AFYk{}N$2kad2&K8sDiABD$Z9!M}nd#DCbB% z2e_nG49LWZ{u0>*Sg)kdf}yi3zS1F@-o%ju$kqW;CiG5I9n)cGC2}@@i15<5|IcM0aj>r)Oo|NV|H~J)Xwnn>!B%;e;LlC zi>1<3=z?4Q+yC>>1+xHZy`M0r#s3Qy|1f|wsx7eLMreX`HD55W7I1^Kxy;Q=-iLBm zG5|?{bQd&Yj#=Y;P}Ya4Yi5v|jX5dd>>O4c{3gHxZ2Br6)(DEj&{{LM;h>5vya>DE zKB4sG*#>VT8+1cqMmQevIk~E;Gl#erN!et$hEHOQ$Ks1_Amly}8_ALBky_trhquIH zKxItdbR}UBJe>irFm+HiFSKdwazvU5UkjmXPcUFwr*U!KdlV$j8NmVN;oOhR40eYJ z0xy`4VBdbya99RvZs9l~-G+3VqnF<$fUUz-8P_z;>u_;9V&ouD86hz+=astwF&p#h z`jLVADV!@9K{0}~lBKYYqi9sj0bN0vKS^3hv}Liu?luZ*6()|?=nf)_y;S2IP2kC!OM*V#G)tV|#?T|o>~{Bnn^`VnN*Yq?L*0jRSoStko^d_0 z{)oy=6VOtu;lk>mGRw!tKXru>u|tD}ty`XFvRpy=EN8;3KNMSL@qIic3cFYhMfHR8 zPAVRkGDVOcL-!+!`m%c&W|wx??nR@7lT8{tQ`)5-K}YjMGLk=EmwRWB1Ue5tuG#JQ z{<5;rK#H6jUE|(O1W5=YT#53Zy)6^ZFq{}Cf;L=B&?KStLn7B?ZBJ#1zhmeP95L-$Xwgt z5}C91$OC&X%)Ad!z9;G_EgD?H3Y_N-tk`G=^0Dlx>Krzfh4R={t4oF))IK8Xg;6Uu#N7w<9fxbO@wrXS_?wLxO&jY6l;J9ablg zh!#7WHTg&%{h|{psc2xcE#wDrek9u;m-Kpm9*%eFf9B*Oz7Hy8`d z98NSjv`mP1waNa7q(!*IMSx?RwoLahay=>bp7tac6$uS9jc~E=>9T0vGa!bK_$U3Q7WR=Rn zhBpSa7qU4+480zKbhajk$Ye^4}H7c!3-CBa@^&=&$mu zw*jvb7>Sy34gudR>+z+Kwys}7i&iRxtZR_>p4AQT4~OUC^@5_>|0^qinu!)gTB}q zHg?qpHTu=l(>Ya2_E>kK+3qMQtK(DHqBm3MJ-Cz&nzPJeu0w7l%U{N?C;Op$tDWd$ z?xFqY<7EKWH241N6cXpYhZ)ax^zrzQC+F51D*LvRIrkd$ziZ3y4ny}-?ps*Xwa+L2 zasRmNK+Jfy7eknH-G=VLIsSKZ&h3Y0Oc+zHp8f3ROp&R;Pl%bbGuW(L<_(U5FEOOc zcKp{9(cK@@S!bjPuYr=O?rxl?>2Cb2ME=w9=*Mg+`5k1`WPrvq_qngx=5^J3$B*ro zx%8PuLQ$s6dhP*@Xhn?m&Y+Y~>jGwJrlt#QrnbcuvI%xa*9sq$|90$U!=e;d{8b+E z+>Ic(T^P~BJDq2VK$cK>fTUPsGR~<6BWW79T`xQm2-rxg%6Zsh_js0W%=pVDsd!`q z6IBng?(NK-wsQ3cBEZCSP8ZiwTt~Bg+!4M1mvB`QJ`14|r_9jf?>07&BCBGr4hUns z-wGCO1VylwrI^uGjj(S-t62vnp<(?;tdrwvj_{~@vqWzCs%gwe?-P1b9_yM2!{a!e zO&pZq6>9K8pec(%w;n>KGDFC?hVwJ7vT~(`v{rbxqvmi`Qb<~pOPWj6ox{z= zfZrj?&{YT99>oD5eP}Y?m0b|qmcPqj@ zsma4Yw`~Ce$6i2|@USGt0J7gV@(nikWr7f*QFO*YK1o!=iXh3_!qjo@k&5 zem<^eT2(b|vvyOx*w~;5?iTQJD%Johllns&{fzb%ATBb=t!2cAfev8Iy4&;h;LvTy z3L{X2q&tplAIS1JxQj84<=oYEAPG^q1Z#b5or(aRSy5M{GFWT!6h|9rw%_Hb>f6Dp z3I$c_^7wG!=qCEI;;yFb9AT$IDb8hTJt=(FVr=HH8{j zD;CPsp#23}SStd_KgR45(^*OYqr97%LLKY{4|Zw*p6DP`-TjF=gewMV<<@>|feF@% z!vYOxq3|@*&5XjoI|(@CN(xLOZ3TVu5GDV(29qu<`$Jei5PWkuNan?*+1AL4EI!_j zh$$0&^<+BGpl#RpG98Gj0yiv7^ubD9F8~j_Sj48-bH!t4C50Y@EBfU);HtnEYen&a z9<(C{BvsDx!CW8WiHIsa0I47dtFA?-AspRQKYnXT*Tx)AWCC#Wep?tvWvbtQVhDjx zHPVtEj6(eV6kk&H6sGa~c7o=ig(t2hD z{H^HRot=QSmZbY5@5~H}fO&Oj;EdJo zLx*G^U)YDpc3Lkz+h~?6AA|eY(q7L_%5Y*j2R=4F%AOe8$)3R9km}>iXzJtmLN@Z0 z)zHb{mL0VPaLQGK(uH&YdsDe-l`nQ{&Tt1EHnZ`u4 zegVvH=hdzGf*bb(e3E=c%Zb{`!(O9}6ei|>WxITg)|H4yo;G1bYZlX} zS4WiD3Q#+iNkI+q)~IBdE{YpA`znVU3jlLpPM@>5xCiaEmA^DwX*UvAB@Z)O zY<^UR+lEd5R#3rEE9M^)7B5U;H2-J?RhgEvjm9WB+PDNN<03mf`#-(~CS2>uNm$oJ z(NgX#ywGKY@Sc$!$+kDXQKhsIs+iw5$TTqahTq5O06cS7{y~18U@r6G|Sx`YO93S}kl_YJ;lKFiu z@8^-f)$(P?$$foozxPufU^c>;_98!r?fOtpvG03eh19usZ*$njZ7;R*Qt8^om;fxv zXVjx<%#$}ajsEptX$R<%mg8)lgDRj7F=0t2>D7{sD*oz0EQZQ)_imdYLU}Y8n)4ch z#t6K^znLbPiWvPe1v2{9KzuDo?pSjd9-%+CTFTEKkdF>o4nS8fk0(bf9}vDSP;-ug z%XCnH=R>{ol7ON!7q0pCyjwO~2CN@dL!^=Omu9}Uzf!aec>DybP{Qsj z$9I1LN&)T?;+b297iqbw9{NuRznOS;g{tLvc9CJ}C3MnQDgYf*rKVW`5SZ#*)!@Q3 zp7nF=Xor$x{08hvc|$jpc%_s9%yk#i6~%rh02J9NJio~aW517_*jyXZ8=Q(*^I`h`Zp95Uf#(4iCOQ1d?bT0MOdG-?i z$H_2AJq3xJHHVfrwrB`iAAscQN9zK?Ptk|1e-d_uV`0w`gs01D0^v5+IAD~<(%x$= zK%J*;OE#Sz9tBI6UjgkH%b>gzZ280 zl;-9j#Z|df6BVucEwYM=vNmoyBn8{g4+^Q9gk|u6?mBY0E2efCnJdVlK zK5P?R;HBm)KH1jD5C2IHane8?=O1JVwKzYIvbkj&JDH8Lx}_;QNsY3&WeGcd9AtPU zus8)9XRyIHpB$vCzR`Aa4RJvoAx@{n@thupD&!H+jgqP!#>iSmz|z zb%|Jimf*8@;EE>9rozPw>Np&pJ6PT-<4+^ED$bD>AvbGcxM^hAEAn=EZ&yJnGkUzn zx#x8Eur6d$?G2|_gY<twX7TLgf zcg?&j=DZxgagxNknR}gG^cC(`Eyg)wF<&XZFc8xKfYx z>8PrdgKD9NEcgX34S@#@Kgzo-^9Arx1S3&BJVIk1X)~i7L6}=4#lWsqbHVOP+Xmd9 z4S`&3$;_~p7dcg_Pue6}9n6}(;|ZP&K3Ob!K%uhZvS>g!^4OU4b6GL{UY_oLxnI^J zq?-;I~)_eaS_((k;kXoUuXeI#Xa* zcxRjjiw@X5etmgk?RDs9W9@JWiToRr5$`cFYAYBxsr}ODRQvXS81IYj$IdHp`6h#c zwj7OFzC$HkD*2sL*+^aM-$-qj(`O6ffuS8HApd#a#grQgZk*r6Q8eI@GXMY2b|guD1o1AxsD+2V@k~{@h71i;O#3D4+aiui{rv{_nMa4z zoRE>V<_R505)U5pJFRX(<>+RG{8!L#>@zC79J%bqss=O)zu9iBj~|>t)*5n=@_d&7 z?HhF_aHTtefpRQq^%@)Jc|K-Q7rg z+4N~g*%$!gOH<9Vz`A`pc$kVb#Q@2@95rkT}?=WfXSBfyLRgta0N0_i$i9I>(fKX*Y0`$Qqo zl@~z~59{pTprD9Al@g3MH_K+Fp@V0cIG;zjRY{CD{%J=y2LljQiKtpz5UHb)aQTJ# z2R?8Da-F+9z&LW8_~ESoi~P^;d?&Btey&pQ;lSaG8W8G4oy&y+)t8igL!1t>#GDbiTtH7L}+E>8Bq^3&=5P$`$ zk5)3#k4`gDbEt&9;POog$Qi0bwQQ`pCfFeQ4mWiX7lCt(r?&z-m)B zvNpeY4vx*bBO;v;f+{cc!}aR=w9E(YS9Defm9rEX?2d>A+s=q){*W5D=#}my4lG z4*jsOJp_Dj9EK2V(d4E(yL*vXb*x+h!&uZ6`JKzKuya*#k$k2ABKVA^LDkhtb9Wvl z(EfiauD7GG*3_~Y0keB4SeO-KIQTsifRckf&_QPA8-9mL*l6tS2>{u~IoZcK1bvGL zDK`<=;Rv@qjq9E6Im!MAskMWBqcqzOp0)T?Oxe6AXKw(mCz~cYe|-+4l=vJBiIW0CKyQ6wS*@@Gd7hrzsPlW~d`L z*dEen=H1SK-iTwk3k?uYP%Rl@JN@*s86w7?Hs*?hNZFw@k5232+IBm@C@VPsg|Sgi zI@ZAd!dh37L#$Me(GRvwIsB|H0yycKe(3D~&QB$N0PeUoxb_S;%^odh9~n7&{|De2 z!2Tb+{dXJZa4{Fha54P_3?ZjLhcxING6Iq*m(qaL$ABhu$EvOVKLCjx83sb&oAnz<+MwV~dcW zPl;odt~*JME*f-27!~XWByNOkxX=?G`*wqDp$Gm`W9YAGT(tkZ87nKzfZn=DGk!YG z{3qna{XJ_Lr_bR+?;j=Awv>2q2hD(R`+_GGO!I3mC-JjrtBP!U#)6IcK~qAn!Kx{& zdh9pB+StD5 z2$Hp31zSalL^DcO5%jQx!ZA%fch$0Jv3;ni_8AZlC0JnP-c^<=D^Y%bl{5oG_{qS- zxe(uvdK92nfxgaU@=BOYx~W2DqpXHWp|vHm901#(xb%F;ZVb#hmi}&nj_!6tinvE# ztZx_EopXr<+1wolM`6!aBn;I6uiQuBgODffsEA8v8c&pBDEisLI(suOsiBB#nG(#8 z>W0a7m;QmKPg`P)vd`_Ha!?{ICPOe&jSf&4CfR(!(%x? zOJWtiTpmY zU(aS-ub0Mm%YM9H9tGcTNv{tF*WX=y*@Cf*>-y+44t|(hEqmU~xoHZ&qK@BV_McvC zV%7`y9+%W1s$4;021f!#S2uY@xi6;BPE-=xcf0-|iWtx&{bhN5)J&uaxq(s0oQW7t z8>eAXATXurGOM!xeR2i-ExnhWeqjf}@RSFhKrh)=86y__(a>!Q2Q3LZsP2wuE|3E4 zp_m{k{Xpj_(z23|g>iTz^t&f5c_&cx;H{SYC&C9;C4;|b&`e}jtNYwyX;z&&Jdwal zgn%)XI(d80h2qNNQO-A<RfH@g%R3k~GQQ0c8jaR4^a$Skp}rVApQmS7bn9`N6D2<`g{LyN#S zA(tB*Mg+&UW|2*sA)lm}@Ge!l&gfHKo>mdJv0wO>*^?_yg{oAOp^p?YvF z`bEfwI^6z#MLQ!L0~OvE+U*@p=OEU#UM?R0fl$E}$Jfo%)fKrLnZCvsTCFK{$IKE5 z2AreFjRonHFaABgDwKbssWZ5LOS(Q0-Pk4{1h<{{tFmmX)&CsKl}p31Ylx%t{TYae z4au+Fg*FJXcDR1t#nWksnQfjMDG`SuYV^^rc(#Af2|?|LP8bTIVr7hO8G$UkHryL+ zelkxei6-0HXsi#bC-!jofrTFgDXBXd0{O&j=+%fpUn1d6I*Cu zy|pC)fdOaDdYY%Sz5i;Aq(Ri3Y{l z8+EA0h~72EB&F$x<$2O6+^JyqXn$v+*e;bsKr0e3dTVQE8H% zjl_g}QH0HSBGc1!%a!r%!cKU$Sel5{kW(4@hD#S-g_ZwZ-eX|g(a<=EnZLJ7t5-{j ze#WF#%!O-~1}kh!6SS$ncZypyyv2I9c>nQ};uo~rlI~n zRQ+R+CC}G}3r}m>wr!i!wr$(CZQHhOcTd~awC&z)pZ@*N6X%ULBX&hrX62WPirAU= zy4SVXW*m>gQ^=^Bfbp44BLbiZcotzYbNJ1zbg=?iHgCD9w7?*m)Oe(@cwD__gq`yj zdWpM=J>(UaIpvfOBApq8LkSEJ{#8DQRwlmR`G#A!LjF;$)%Dzu(Vj`{Pn)%yAdF}y zgkuqD!H)t9-j6*cKfU0lQs+hl^SsYa1SVQxBMcfpNW@26Pu{0;c|lK24@Ov~U|>0% zht+0QCv2HmI!fX@=PQ$pCws(5VMK+G8Ky!UOLek} zqYFdSMm{u?j;bzuHXB-24AC6Ww4s82)9{#S_alJ ztQsQZCk+j3Xa?aBnH`jpc1OOB=D|ttrm9&@#8si@PZWlHxTt`}n z8;Zx!DK7O7+ZVHp8jwy-GBJ1y33*I%>yk%C?0$rr+yfPa4RjBQ>M8u*P&FWr&C>l* zKQ11lT5Y7f)e9ov+wN^t5~?VH`!~?6KrWT#5sj+0@LbXEwTM4lOzyCQNsCkxja$Z* z%Wo&D#vxTLFY`!c@E8&~iaH_)q_s)Ar&&bwYv$yhA$*N~>HbZ+9$Mb5oL7MPHxd|` z;&GN+xuar2%$L1KFD_w^{5;n70{lk2CBnUuRZ-}b)El9?sk&y8PdG>ov}8~TlVJWX zfj5D)+WQ`Eb{*dCtQ4oMaqVvD5j86l1t8o#uIFLwQc#!L#YSCiw+;opTr z6DPE?olLL}W9-fDOF7L=wpMrrm3iUtKvvCP3Pm4ugpuqvm+8PL%_;t^gI=-=Bo|_2 zUK5u8P6^af=rJ;6cce7M(FgSl8?azNqcN~|uAbH_}wiTWvle`OQp!@W~UxcitnRI6lSSM`0g^@Z-`@L*woi%aw6tfq)yQUuE8S3I6K5r!Z_0fZ zz(~!p4C)}!?Q#QhK_)QWJ|p8D{*&G9!?^6dTKZ}lb_Q}8y9oEE%k5~sM=p2k6dmrh zv7lC8OU{NmY=0njc#YdBT&xv$=4J)N>jFCTsk!yOo(>Y$)71P#CVJId-F*MjA{^IK z_NI=#BFAzrQX5}}G`#e+p%`rj1j~vyVCX+3v@q=6cb^Ckex8E^>Z`!M4*%xuPYPpl z<>9q%(=r$=7e&8|te#p0qI0B9pGjgqbYgD1Xyf1}`eIyWF79k@N&Qb%Q(qgxdFS(& zWWsEzW4$vOd?yvX6>N6n2vrn|1qoeo6WOiZJnf882c)g}WXg~rl1O3uALB83q{b?4 zy!4nV1yB7QQ9&SX!ae8hQP^QC^b;iTsp|lz*9|+G1y281eA0U%J9R0=(J$%}?Y>$l zT4ear{Fyb1S-;_|)Jpv`c!~H*=DeS;=7dpz+NOqe;nP{9#xr8VdJhydQ1cYI6fzQEmkkd)F}rpTU=u-mBvQVL&XA7skZeFOiMdiTzx938L`jndhq&RH{@${ zX!xhK4}uDGa42CP`Y=3bP6&VKiIJGj%8ApDyxua5k@uHSFC(1BgE`D(Go8ObYknbB zVYh0azA%Q^QHAUGTLGG;wMZb_Q(3wsp)fg%O6gCEHer{M!TnYzem)(KCDQPd-9)Fd zYK#N0ku}2nHa)PNL9k!FYg1_oEJ#9QI4Q7k$j0!$x3_$aiElABA*JKI1`?ZsIES&e zZB3JN&$tO`^!TF2jl+>8Vyaowsx_#YLkoeqOm2@c*UiL_c9XS$G0)Aya~}kS=U%=) z%~L$#?1QEneXS8v03 z1t&b`$h_jyg7hnlwT2Ntq+VSh8mEFI`Qc&)YL77(?~mK|>q%hQ^bTW}846!@ZcI|W zNt+FL_A3&o{UAKC!g|aFNDe@=FmXGh?FB*RRl;KUod1> zmp^N9jdDc^kX62VI&{dE)j(oMiJZh?Q2#55rZeWnhXn{pnI+R#g(kNSYdQwYrvU&k zEmR=~&j(rd!eSxhu~fw6sBpB)e!n?!8o+`nqBg2UV*^<^;|9*Nf9%1R6R-QUNvo-` z1$>Ci+TS~x7N5|^8(pX~=#;IOwpF~lk=|*%7SOp~6BSoz#~4Cq84G2_s0=rc4>j8K z%XjlwJ{HWu9TnMOoWFTXFUCWWMIGK7vLoVAe%J6aN-D@Z!A$%mPM#H!JjI0-)W=+! zUa{0GZxioRIe*i_w~uc$AwE*WT*$yglEBcWP~b9`UQ>Ad!EK|Si42-uQkk<$*G&~D z28Dz5p?ks+so=q64yiEPkmg@k5M0KFVqV4Lr$-HxQD%*eYzA}sET!Z8QxPNv3Tn)> zZrKQBmc1WImpg{kL&9Uc-!9Fb3zy2Zy0~aC7M#Q0B06pKJWi%*B#j}1EaKg*e8tpN z%PV0yWjHTk&MnD|W1*gB(*TW-0keAys`TI;FD#i}#E0>!d}6{^ym*=JV9xsEeksGE zKDox~iej{ie{RGHs(lX8Ywwd{eEAbP?JF#Z_qz?&{?0$mP<@}-&Tw8=Qe!2qYWMaA zI1Isqbcvb2m?zG49%}7mnVnOMK;qXGku7xR->*7e@&qHKD{O#ujv!jfK?qbs2Wd~wE8)uJHyzv z8BwrDbR6Z;E_}GwqHu~ig=kDS=vJ_eerRqbak{!2)V%8h?PHQoEoW7D?@5tQ!*y(+ zQss~+r(jRmfB}z#V=!u`kf`h@vzMA<+wCmqi5#~U-wCJmN|+~yG|PI?1f6<&uHVm9 z3U*vFga?|m(j-U-2oF;M9QVbo=CD;QtrTg9wUh`oI68wdxdOOsMai&sUIx?-^{VVU- zO?)JAJ|ABHEA}BeAt-9{nJ-svcBhZq@0kx=W}z$?NBirx_Ugpar_q?DQY(v9eD{#S zaeG%3^Eb+GO%}j_s1VZ&b)%)L{4{vTRa0^{wC=12nFaY`#lJ7oOS;{R`u*)pYRqP) zKBAX4?ces?>b5Y{QHKC36K)TlwOSi{cSzS_o1m@zeB;%+@-)D2sjAX>)T3zzDZcoQ zHxavf!y&BK5r@yee|`wgTZ8ont7Crl5MolKBhiv!Er_@J^D9azmu-gEWg&`j&>Wr}{P$y{Dg;ciHX* z?1w}?o?v(rH#M1?mU6&2TtSJ&d^0BREh1o^udCdmNnOoqbol-1_kF7e_gl!;kv-$S zICyMScR%Vt-N_tvvRlu;M8WuGK9X*zmsj?u^?m`QUT((6C9eAPd_Vt==Y3zCrRjaY zMwRL1@O+*h_R03X04~hPzeQwS8-8VoTLARPv7c4)w#0yw#t-3H;9%UO&2h%USdkFg zKA-6Kf5as>xo>-H;V&o0)QDty`p4zl!08}y%E2_6lHS(EB8A~aM`e#VF^j>Wc+wA4IDZ%lNh@U#2f(}V{M>(dDuvE#4ZP&r%77~%{1#Oi+ z#WLGyI>=t5ldHZ3MwNVI9Ve+Jx-L?JSIAJmz)!=O@k}QvZZ6aYie|7?uLeyX4>k^# zmgJ?AP~LbCG-R8~kLjl5*scN|su!a7XRSBlUtFgqcmJS9N%~A z&43P3I@I*+cYxp>)^f3Awr;ZE9h*~IiB+lKinA2;Ax8^Jt+jczL(Z$IJb?&=umMw= zm(0Al5}!+_Y{YGFgyiL&IMX1B0bXB3;0~ZQgs`FoNS9Ej)L^84v0?>~SSvnAFy)Ju zvJnJj^ca3z ztkx7^IzyG;{|}D6f2alUT>=ywVdFZJct`|2ZCma3B__`gj|b~r#x&#vk+Vn&EqC69 zI)e5lWeb%tAmNgc7+?(5cQb3V2oS8b>nT&X%pfA-^NQ2E7M6XlX>Iteq~e)w>DIaSgAHWhL~8*#L&{y7%!nWcbF!j|r{I zI*ToX&A@~X^O0RMRT9Kf21)cY&Rt-^_!0Nf_SO3<)fc0aqD6FRkmi3v6hak~Qp>Z4 z3!7dhj=_SliRlNUL3F>#F@Ag)6hIg}@K*gSR6rmLTA$w%GQdxbhq=zCb3*ACLLM_B zZn=3&__aAAIzHENgk^i;6dwW!Orh2zoV*HP@7kpcXJB&-zT3cd*M=4b!9c52;EJt6=l>lEvn#H0JJ2- zeH}Da@CwYIIXvQ|_!t7|Ci%QaX*;cn7N7W(y}zeEVs7#ApGB#P1`EY|087Kf5*Lnm z*3g|nbtdQEhl#huupoMThg8<{tl6O#LXI`YiGVs2tVpXA{$Ij2xRk~k$+TT7(3&@I zxLj8h1fvUg%+Ymb_-x^iTj%ksO+(d-2i0gee$%tk5|_|P<=$=Y*1BqUSX0GTbYRkktLZUziLYg4KCD6P;%yfm6fj9mi;3RW$99t#=rnNVDmo3J`uYa+>Vl}8nsr+MmNV#);$@fHdb1Mznl5H;CxWEh(Axr=R3%wWP3Ao91&`Y-ZBFlY^> zl!V2?boT?=GqI`T2-B<#xMH_;d2Ke7G}yl;LIQFBOoTkftSL;^J4BWmeeZm#h&>X* zWFn3cuMd2N;;rSpf_qJC+2Lo(z>}yIsDzj=62EU;O0qa>l-w z_rHA}Ps;SVUi`ZJePX}W#F{>#f!!re&NO%hUrJCQ>)$RsIr=v~mi~0$A=hhGf2b@| z0E5=1Y+X9BIMtKCl_w;^hY0R%51}Lv01Hu$n_GEznILHPF=BP=z()RgPmr1+vT>|K@UJ zD9B;MN9kjRRf~|U+H&#`HpZmpDQDqIG4Ts*n;&fwCf>&fHXZM#(U#Vp(0j^paLSD{ zA$L5+0eT7zy7LuUjU{#w?F5j|B^tq6^VcyA8zRwZs3rvGF}D~9Pe;bl_56Et>4R8I zz6c9S46wl{rWI>TG^aD;oNPEGz*uA!lRcr`V>t})fq~=}Lr92)sq}vIuAIqXLXA7= zX(tIKyMpG#L>>mAQ`NURXgf)+?@&GLl&>VeFT;v^HTKTDv;t* z9O-nEgwz`4c>=icXTIJ)Bz7;;X?>~J8?J^9`qi^~H=40D*P&mJwiOhp?OdMxjWa^qqmG~1@zkxqNT`Zwf+jwhT|R`bnts!bQ^}NQ zb0m<_*sugt7Y8Z39dAxD>$p&^6Ww0T46=j^iRxxU{)p&@k9xwoXOP|bnNhGr^i$rV z<`}?S)iLU9Wq|JS)_zflcwqny6kaY1Z|f?EAdjb}evqnht{VJlv&kX-Do1zTZCEUpi!0NgHphXbM7h zM(CHzvx#>q!kd^e73jrPq49wEbDto_`(m?JgzFYl&>l6TaXP*ZOA!oqpE=z{PWL?2-c%qu6;+-l@uu%5xxNyPSGOzTQx#O=AJ5A-thGst89!G&?ipz0|d)^!i54Ohm@x z69W$tA-v)!G9;K}gq{G=@F+DcVD!3HOzmz>u=nOUI^CKmwTu1bPWP6W-Tmd(z$i7T zpQ)cGAho+U=R8ixmID7LIVXdb61nul&w43}`M($x;71D5U8kM%JU(wPTH zqlB=97ecg{G=a$P1F*;yCh3L?*p=!2u~1xBluB4~auTddxq>-Bv5-V#jF`+MhF1MX zfm0yk9#jj#BR;KsE*E*8J))qKQZ6*2d?m){RJW)1CliN-W*S`ReXL(M8-m3KtT;*< zNe~MDDG=LpQ@GHKm3xDuNw7`qJoEw~ry*7*K@2^ed752`>E$CRL9sko37C^gz#wi^ zD`DUCPAJxk8P>k&eUCUV9`H1;Lo!h)9C#3X zT10UK>S@mgDhAQmpa`R@+hXIn>aPbY@*N9KZ#<+kZ~UsDk*IOTj|6HxTzP~|V!aB; zQlCTd>-J(^Eqtg(r4R`{Bi8n;gWh76$4YVx(OSTeR#2{v&}s#yQDr1I#3HF_`|`*s zp=Zx=yrp>hB+3S?SFIw;iR_A0R|i&sAuopps2PpRtbfsjlbmO#N{R5g1JWG9T@0K? z|EW9lt1q}0T5gfBObBi`cLh6-Y!rjQ*Y8lF$x5^A($!le~l$Es_5^$SqZK&}m1QrRQo{QM9b=xxQbGvXr6y2-#feU`J z?1G)DI~Qg4%~{qHHVgH{w0s!4T=~@%^fG}|y=5K`gNAQmU1n!O1?kvxx}`+Q2==co`#iuz3EYj0h|mu|i4M z!xax%P0$ztc2i1~OqS2LbZZyxFHSc^UP4(Ltg;cAyS5NuvcvKh0~19vdAWjIl;glh zu`&P3++t7V%-&k3(Rtt#?^_kpeklv3p35_7A=tmx#p%;h?4h(!zE0HHt~n>A3iX{s zmAa-cVR?reO;C5Ggrs37C)ef;G+=sPt2MjfkVR$w-rByg!gKK*>d14>5po*Aa$~*5 zw#tGG{q1NdOV20;TgS_we@ zFp&LzP=;y)^>%r*YEBt%$IEBdQJ+gsRZil6wb*J?mng#D9A8hv~*vPL-=gjM?AIZMjUf z@Da^1&8?{i4Xshw-yv+v{mESCHy;uon_u;zEm3Qxum5a&Cbxb@&#^th!G=$?=7d|L z6%>!GhOde0H^ugbLI&OUC$&Ykn&Ml)Vyal<&;7#Ju;Ev3@fiUXMq!mIwQ!qXY(?R; zxqL^%r=8|f%#00M5i^DhPh@){S`!g%iY9Mb4malx4{iM`Zhmlm5On6C-@`rP_cd7I zQMtRsgZuOQot-)Q^8zwQD?I-1QU=q<%sLCfmD&Hy=CJ?!#8QNqww!=@gdl-I3iLjP zybD1a)xtt3wxCjr)6ape@df(WN;1W7|sEH?G#3WoXRg)4vYY;>3 z_gQFfS&@|3Z|yU*C1H9-*0tG(qFxdFes)AU^s=@qYg9Mma#g~H%&AFB%*-rvgsjKv zV8qHJS|Ttj*@Ui>$gPFOwT=2`UZ=;_$q1$UcoEG?e8zlp7^6Bgj-%t1TFG~OkeF?gf64zANciZ*&dXK^3eaZdUzfZ|kti$Yw_Z}F+m+0pnHl;pb<=j$6Z_*`yO$5sn zHTWd>v~%N#Q&A?O0JNX^GDy{9XPW=8zG%*?QzL&X7&k(1iGr z%IyoK$tRo(rGNeJNO7l+8@E>R!=0Gd?uWMl})i2!NdowVCoh9 zH36*0isAM~BbyFx5o>;!M8H~n>VptU8>Qsf4tbm?eJ)wQ=s4I3xS%wU0qCE=_LQF z$v7cX?KYVNyY!)#T&98cl`?^sKv}J^$?WqPV`-9DpT%E19@+iIN5Adk^$}yoJE{#z zDW{6OKGZh4b2!6@e5&r_`z0f3*K2dvLUqE*XE|fB?PN5m^UwJ17xhEscprI)Q8v!k zOO*1JaTqnKnSuMjP`_2dWBqHdG_~on;UoR4@g)AynZHED2oGKv0ZThC$?DA-u2l5N z?&}Ax96b`5dUEUA5o_t&pt6nJZze)Zephd68c2z0;;N##b0iyMjt2^W0Dz97{M}JOK6VLHzUdNTU{# z(Yy*bQ&eI0^V11|Ge#MAmV%$4$;H3GWZJMYDP^#q0N`U*Ikk<&S+CuT%C?BA-A|P4 z$TMw?Bq4`cl;`b2gSiDzn@EfziF$@R(8F6uD3QLaQ8)u3Gybz75H9nv9?Y(CT=wLh zRp0(KuCtec<1i*WcB7sM+B=Jt@va7FcIeyMAiVWkWqht%V}i4oh?VSP%XcRCFi*p6 z%q|23JU_@Jh%?hVy4V_#OHp#OZwfEV4}DeOw|2R-`5~G`es~Y0v6$zRysPzYhw1P@B%9n49UHfn?OC z&H@r{?+qtsk86eQ?=o>4o(hmtF$&C6z&1{i=d`A$gDo+0YJp=40|I3diS-R@#iYfh z&eki21t0J(g9GFL2XOSF%H|A@|5g_tYf+ zzBs5ws#-ODWh_yHOpX0c>Hs3TzW*!I}It)}ZEnQnHL_qT_?AX}tChRll z$P?Bo@3vfJuPB0>XcdNos5r{0B^E5yJ(Ss}J`?pk|4Qt-+uc06-M%8NH-j8*U zFY|@Xc?P8%-ihYOvS%8j!*Kw%7P?QO)n#I%+x zpn8EQUZ4UIp-NE}ufD9R>2-mnMCv7-;dcUW0F05hYno_)HGK;3I@wMH+c%kzbiczx zgg0TP!fqRDT%;$lt4>E*1iyV*o}p1_>8g% zcq!fslo)t~E#azCsJ_0B$!*5XYdDlo*DM2Vf00urdf&OR6epM+@o3eqnD8vUubCgz zG`b{MXH5Y{R8Ug!JhDR6r}~n>!0zeY7Y=aR*=&|BRIdu?#3ubn8a`BPD>vq_H1pT) zJZLp02q6`ZDjAGIUg=R$LztbTEqN7->3O1lTn91CbEVyh5b$d`Bsa}(kZ*GTqh8G) z{F7*vG+U$tS!o#*KNvj*Dlo6^9BZ*2pn@Qk!V0Q}-T+>#y58meogCvW9VCpCaQ{Ot zh*hg#7fw1~020IC2>aX&C!t4K%ivux82R5(5gjrM9KY2e-AZRk)~T9T)$X`k^0gde z9~FbqNwDIk${%vI#WptC!FaZ*E`MIa@G3`sh8BKAg+kFQYE#(~zeOza;m0tp2#$R- z^Y~+T2%pj_FXdx~wOqb^G+PDiODh&=Q`gGX#$Y-R_IK+c!D5CYZ>;#f(Uy){9Zhgo zP+>kSeN%B)9X)watW<@4G1mVnN%X9%L*mK<*G(%^!NjTt z6i<`it$8)hJ7YOL@M4rS#+E^AZlWPMi&Cr4kfcgJg+#v1FGn5;(J+dJV;llT&8FN~ z*c!cByTy=5dmJ}Jg9%qm$q_mZOmH?_w|T<7?5}$if{H*y$k~x7_0S&#b6&_oF; z?}XcAFP>o)3_(Q7_R80h(axRyF(Yz|4JAjFxf4YXK3bA#P^M)QoJP_p81f{?!4s#{ zc#>N*8banD3Nw&g@<9b&*welwy0u8-m|29lMR21Jb&S|wuJn6`!{#c6dN^4t zPmQR=qusw?w0pU-ygx73)o#@>pqt;{-;4Z3AHvDmN0q~O$r9g5V_o!iQ|RE!r~gL| zBTW1Mk;9b#Iic&hgBuHeIk>nue1JtDNAR^F_Q7ZP6?H#`qcdd|UkXv(DdZ$&I8xHh za%XrUAA?iM=|7EcC4GNiESAkChlS&ugN9!dbY_fYCef2U3v{OQm%SjbGDLVe5J;rw ztyxd>XrFySC~PMb_I zrZI2k0=xj+J2Krf#9ti^L;ZUYtGCS|5hXjy^^>rBcMBdu;NGZ_f%@gY?bYa*fnsZu zyWQD8kEYMu=)FMD(d@B8=eilLlg|J}3fMA%($ zJ6ZgdSkM;%6LttyfnL)Z-o7fJ`oVeV$oMFnD$ zRKQuhe{!D}VG8O#8MmEeHot`vcCbjhT@MSK)l3VzY%snmUN(U1?G%pH7wak`UcAba zMkEjx>fNlzEWa{Ao8teFVv;v_jGX5W^6VNp9ucLBN+ND<|1rgO0gyq{;0caM4oHC0 zP*PKfLq_gSPDO>he)|R~4R!GNnWOX!N8%EWK7I`)s(Kg&!v_PhaXW;6>2{-e`n1fjq1|?F*P&vIJog5eBH6{F)P6Q!{zxt;ul6YMWKjxj*j(}jkJa1kYd(qf@sw< z#0?2p640jJQe*n)Ev-))tr<s=8bs7vcVVI&yhp{cyjGpWy6d*J2y}-M|B=KTaGB6a`&E7pGyH5m^4+rpAs*62gMm&GMp0!am4J;b z{Ww5$mYV4Lgy*rw`zAM@1rtTwWpv&!lQ=1sz&)kG_l&vugXU4jpQ%Mi;m*U)Ghsg= zxFVu|aD~o;NfCpcx#i_xyV;4T(hvZfHl+DY@nk}bhcj(DHOs17!A=|1&TIM=xJ^U2DD*r~Zf`AXn8G15is<>56`k<8FNv1%l%VzM6{TE=dc$Q)$?!GnqLeECCs9xh z-aRU3-yGSn=O1A#_cm&C(C>OgrxX(~frl%|*8}`+i2bx8loAHvp^cecSaOq#1* zz&SjP@QSxLWlAmjO1~|0Pt9%+80MA_fgCWaIjA4|Is8nfLorluHeIX%L8Mowj@K4X z{c+mgO#_Llm0qV|%dH_Kd8u>wK#dmg0IsOR%;=&215&}7&BOXuEnz)yy;R!T)$PXt=o^Q=)bNH)+i z=R&UH9(x(mzQ3|iHCczh0m+<9L7i! z{~x6-!!Zw$>4(xLH!imVq49r|Hek-n%cy-&2~=9DPbAc!s#mr zwLZ(sX%9IEWph8`IYLOsp(7BvkWnK1N-|yszB56^3r0GYC4RHaMAS$|tMM!JW0rVx zm8<}TFJ)z2FzO0aOVVo29*$KB6Pu%{|I+v&VU%1jARIq04}V&w^iMuN{ny7Mdidm` ztY;HU;g6V*m-K}Ytcs`@x>-l80t+j8jSAxCb?=fwF8G>p1oZ7F5R?6Bz}lAnlg2Nv z^;fLI3#rf!-i*8N_l#?=5zmaPFKqTzcT>&{PC`?TTkHMLD9nuO_WDd(|N0E~<}0uL ze`CHq_-5QU)+aevAD(gloBo+1`z3UqHebPRVA*wB2u^9D zadZcpmdK2GlJWoc>$Vx64iOOD7@^6a4|I!JS{mrySby?LXz`(+uZ3{w+UxLTDg__a(Av=fs8*EFXGiPEWNcBnnz(?-G5= zGS#K=NClOPMe2vC*W?@ymU=?vtVh0Rqy18H*RMn@ZkJTnB%#je!!`AIsY<__JelRRZ_ABd5~h;e^a6d3WO$NWvvTO@WJWrqJ0=59f*1xl0M zjlou?!Nqhczr#LbuMBUS|Grr!H$BBEx}l%YJ<;Eq3RI?8M9D{;=k4_D z0vmnCRfp=|9$OXCQA%n#s^p(yur;B*w(ve)goiVCpMA9uFH50Kjhd@({nK?WCo%wN@+Q4bd?xRV-YY`~fA%<1yJHhpAQ9hZG^a75q$o zk#0Z^ENZd7_AZE@){4=6Vw{qF+Uy)0@?J5wn$EnFBW@ey zd9gcteaQ=h=+ z;#{a(|B#fPBK{*OL6MbZqugg%D>~fd78j%^8-+bOK|cg_Ka$9voMOqqF8+q&WLpOMk;+`~r( z6mIQU1Y78lROwq?&`w_*#urF#=>`zXBOEWqq?ZF3WSp_!&#aVG60%v86=1xsj41s{ z%6XDas~~-5Pl8R)0!1n!bP2}U?G(tFuI>U~C7OHG$% zR7qrS0G649pPx`5w(p-#)iQpZ*AxGH(zk>o9Nf2)h*2jb`)P~62pXJkcUzUwzTVSC2FL(s2e!C1s2#U0=*NLs{O6>Zh zsa@%V?ihS)0l%I;R5FqocnOB%EG4VX*8QKP%f`i@9{}l%s_p$%3cizw0zGJda5gj-!eCy+kaU1Hbzr$3AyvKched4sFJg zcG+E`WDxJ@Mz;&%cR&*p|I4|g#BXW))3`jr+hb8luLhM$0leJ)w$-#{-;&qY9*@y; ziT1Laa;zT0Sv^Qv^tDS`uB>`5hw(Ul$aoA2&-2Qn;Um_g#hcexf*(r5Ujx(vA@vqO z0w8Bn>hl3Lm(LtCos1_IwD@|Dh8#RN&@|%@LReWA<|sovRx7A3p8Wb% zR>ez{B(&7PgVj?=?AisvziS;q=ik~_6xf0c&P*kV0*s)w)=fy}Y!f@!2>EyER}WeV z4I|nno*rEj1v*j~Pv-!R@0G#L|8g%QBT~DhLJ~3o#Sj1a;97Tf_IM3FCV%i&=wb%r z8kNV+e?d#`6>ck_TRUZB?q24M z4K)+X*~bezpLz!BS^g&gSwg06NW9AZs6fC|QfU?x&9i!W$yJ-O&Vu<(u{%;mrxYcj zD+>Iv?R9Cn|E~B0Y)xdtY|P-d4|!ihJ^9T|R?k_8q!0=7vsO+sJj-D9;;wYZnPfI^ z?}A?f7>>PZHx<;z++e!?ZA)X1OcwMM0*(Zx^lM~4nN|cKPCC|oCSe}#OUV-f9JiTf z^RtSN4T?3Q1Al%GTyS-=ZcY?Tcz88}__1G)0lTBG^t~ItMtNEz+8Nii+^o>}fMeDe z!l>HRc-^^ob60KG(85h5x?!t!yH~CFunc0Z8m?-H`*yo>Lv#-vY^7G)Kg0Lgw}%W? z#W+|RwH8b+v?2#>VB6X?uim!qrB)N%yrX5$c z;4{uzxR}zOlzvY)#3QqW15c4vLlP~DxM5v;W*dZ$fp~w}Z}%ph`7)Gp$+m05r5dOg z723Bo{8$DP`|Wzt9gn^@zjqD`%@ci24GrHNOwbf>*kC%fKfRFQHOJaI4K2tu)_ex~%_A=ZZyeISRwElB0XdcRXT^*|{%!@!%&c!iEy zuL5w`iY0TFRwQh&pJya&yfj@Ewa8ms6gNff|LcI+D{kiEvz`@L)4zi@Oc%gY(el6e zBT+#j3HMR0mW%S~+8aiArv~qS5G!UjdZ0n2u0#X#$Cl4Ci)|z_>I!XU#xp-H@Nenh z(-%Fc$6dW(KY||uzMnK76|iImL1&Tb5c`zjbn!wzdc7S9+;4dxH2P$MOayx+y*z)9 z=9v(M+md&O5>Uc0cTckURWE(y zXjg>X_1Z6qZfBuQavaRtpO4Qq4sy10$8aI(A4qI%t06b&|F#ul(TJy#ed`PDRjh0{ z{;BZEZ0zOOP6qVp^k{-s9D<$I?P!=v10pU$1^|5k@INA{ir}eUm#{2#fd5CZpdljv zY5q9meqZ-_kinIY8R#^t(1I0pxx7~wx8HtmPq3gb(MkfQJUXYoCXbSf`|__~$Lo_- zeZT{Gbs}|DyPByk9p6x&Q>^c*Y^t&kv5u_jzuBRaZqUj@`jvW(sieGZMWIB;oO!|h zy1;^_1uj1cA%nC;kN5qMa{or+tKq!~_QGUZsp_Dn&pU>pF!Y)w@~jyV^&*)={8^7L z9l-sG#wr2HsZ0>MNIIl@-R0E&LPnWb%-A(Ztqg5YVU4KhmOS!TA4^T#Srqy zygAthyk%b68L%vTrM8s$=k#~86}-M1`}FV#EVn_;8n@Qqg=UK)EMg}v{OMY4vHLfL z5g2Z}0V5Oe1@XK~#?owCkYB(G=3Le{bcN3Ns5|Z0QP8dC9%bOfY|{fpJ zp4i{EXKmt28Aecl`emzIR7z!Vtcif#%M2zUclnHPlPc)D0i)>4;P(S`?9hnZ4 zy$18art+|fH;aKnB8c714ga0H@C*!ue^<&*yR+(&M+Kgq4-du%|IQX8)Lez$?%A-Ua_4+k?TK=4A0I<(?(t&trPvL5br|SWtGm z5=A)2{~^x^m681ZgiyZG3*l`-NSJQ*a5%*VjumpSJB08f*tkJ>kmT_c#;a0=1C`*A z<5oiq!SPhl^$q7BNJUDVR6C)g9jIu);EU(L}fAeVZ0p*gB5VKkUK?%F{06`^Z*-{ zwcY3yLyysW@iL?$4ZQC{?%je`cdUD)sqMFLhGuro=6KAwgQK-9cpgR7+v(HK~IJ|}z`q^S`m8)aP}@Rxb(-V028#S>HY*k^ag!lzFUVVLCyt(X%Pl6NSl^62Cd zd8{He!Alu3dZ%o3^gXm9Y#FDk-e7$;dDLvOsP%I?WB~S5~4& zBl7aQscxtj?H+EGdoMpsLX%0pV7=sik0CJqElZfBoY2HtUZYNe$?xO^O{t>9;Hv9f z5*`)Lv!t?SLFDTj5=UcUX&w(Ar<=FEO4!;|4@woyd+`rB+B5YXq1Kh~jz{c}Tr%oI zs4D&EPf3unql2+tOnEZ;W7E~sBI`rt6JPEmoHs;LV2I8Z@)^xUM>`^<(c5twL_K+<>KB5n zQN+g9CI>WOWV)d8&L+z&OoO;rhp*8~;-ir7n?W?mr^5wEUNB_~?LQ}y$hK**xxu$I zqBpWRxWLI${j;~#;@mt|BHqYUCG?I4A)N)Gc3XaOWT@T#9Aqgc0+wvF3vlZ+-cYGWy@h_bJRgMukr$U81tM!SQXufd zRJq3YtGRYZglru@{Z9cujSYx3DN|H44}We3Qi}K3JJ&oOq(Y{tzC};RGV$rk#!|5`(fvV4qDe;|X*Ke%Lc)1^ND`{N;TBYjW3w<+Ta+e@ z9hQZR#~%+tRau<9rml8};kNH&AK^p>Y*5j1b&IBz@4208%E8DMELG<`k!YS&QIe$| ztjcjFSaPJA-?J6Rywljk)Wg>MlFgfzTYoM*gfvxJkIAHHoW}JBN&NnxI6f6PF0cq0 zlnIFnkqrPv;mH2l!Q6redez9>Q(ESf#l(Ap3;XN?57-Pf9UJ=-PEfLzm9^lF7 zZBuo{djlB+gid3nh&FYtmSYseG@(nDvZV0l)Jgd;g7x4{{Zu_>tQDTk~!%$*d zxB4(hZqlZfjgW#!Kl^)dq3oIQhKiu@mUc$CtV%*njT&8*f7Sv{o`u~j67x6LANa;UE$l2Zx9o?|4IF7Ji%vi{UMM;&0U#e_OVZC>gr#;etkMMED_L)LW2SwwfqR zj%kp)8-Sgda=fcP{2oFmewJTXCN6`H)lqiTFic_|zvh0yh4u|sEKzSiCIpJ4%vh8f zP6}poM9$~+z!6~}vyTI(uc0ip-E=V8Fq#5pPYP!3o+ z`l2ptb}3)zLljG3ytY`H>8$}PayfP;1PNdTmo&L$et!QRfdid(eniYB5BdO1e?#nr zgQKGZ9T6fa$5X(BVL%E#wiVqg=4^id?l#ZIE{lu@)p~V zm1E!m9(n~2_1r7iN(>zX+ke3oZ1o*iVDp+Qu!)aNkUDAw!w%AxV(%E(AO=spiH&0M z)EgTblgEJ7b%(CCzNxHg-R z=leJQWO*d!GC9~gah?!)IRdS!DLb8|WGu-o5@Ux6y*$yG+P*4M5dnEzL}E7VbM7o&uq8|6+Uquq5A%XXeyA8=k0o%ku@5OrA{utKcs4yJeiGcVM3Bed zG0AZ;nr2D2e-v6)11*m(rh!(?GgFS_Rm?^$j9L{@mO%C21!p{h*Bq|%70(i-*v;cA zc|1uZ{Qw>`_mfmlqpr4nlDLm6ML znfJ7*h7f9}NCZHc$rn$OoRHg`!w#9&%SVZWGk3^RW`62_hKqUVC>4@cmS2B};>vfA zh9QEJsD@!OZ;&FvO#};taDl`{vpQfGrRXJ)ZeV0OjSDNtQso$syjx^e|B%oyTno{x z1788YI|Z9luoW;|!M1fvfFjQbErsi9&VPe_N_#AJN7K-&@tme<63nu+|0r!esoF3# zXE6bw@0idx@I>#8SGp~qM#pNafVXFN-LUlkLA$wVvr_*A1!lF^jQ z+qP5nSx7tw_29IvPTT6Vt)zZlRR#v&3QSO$3kEum%T(3*D53lCmXLT{c#p&i&^E2r(K(Ts_I+ zP^XSP)FOz;SIIYGim=O6AdhnXs`o}1(POb%Jm@7SzOgmx0S;B|JW#v0U`q;rzLIO% z5o59m0zo96AR0Lr5ckMr0NSUTZPJ!TvU`P5~1LIlsJZo z!crQ0#f$*14Yk@^oIYN4L4fv~TkWz1AEsb9H>P0QYU!cs=)+u~UZru6-8yx&Q%941 zR!5g!*9)z1u4tTXl+|VRfl*G+m|-t80~2xFg+k!W8MQP|s#Zq_M@I+B?&zpL6F{ZO zES*pOLRjQ+UykVt#+rx}=(9p_#?E7RzTD&}qp?@9 zXGY&hw(ox4d>J%}?uJDYGy%4zz1jc$9#jD!$ZnEgck3|@k#jOulf2lyzK=Axj*n#4v2xbDnlbg!B1VTv*D zEE^b_Fp0&yOb?ze33~M*cnA6BO)h)uo?~9KMM`LNi&B~cafr^emLdG;$T&fyjAl*; z4~{S*X3wO17l$6C4oCaB@m@SO9i3=C_6;y9_ntC2VB5){d@THD_Kjx7dJTdhH~X;r ze9$dEIC9u7%z8m70rIm+RW>Jyh&(SbpEpAUd~In!s3{jpQS+Y}GPj_7P9%ER@Cb_J zfGiGp5{!E{P!`}LPs@~)QqNRm^**YJ-q|`okQ<9<@KH?<(NDgYj9fd&Rmv}jZMVX+ zEJ30&voI2Yn1iE-W1OWctupukXFRE&U|Xlc0k+JHALLUxZ%>wK+k;gLyLqj@<-x9A z=fGLJd;NkEb!Sd$oeAApHpctTVQ!p0%UsyeIx;D_c&$7Q4vFXn(N|Obe^&2hZLBjk zN8cy>26P3oJKhU5c?nYxKE_-DA#}(}#Y$uMXPsSqD~)}e_fTefQVRx`DAi|-#TdJm zR8ud?tY_l06YBvBr#{mnQ{w7AfxfL^dM_ZCSs_v)Gn&h#P@wOjIgPmLb-Gstjc#=h zU{i&ec26rhF_8s664ayg)UpueVhMp}_*RrqiLrs*ZUbBUHd+Wt;&nz-9=VDig;;UP zg)zUun0?EoQh9C?xV*~?XQkKVhi37VCK}tXzI$bYLy>3^_AXOmfx#{|*sI^?K*XoG z6yMa~_x<6IdXf6+pQeBGsy_YcgT6Wg3UqyFeC0<*xSG2ku0(vDv*^@R-2M;{prsqj zRIxrKR|35Mc#KC53uLn&t>p@~$*I>Ps#pfBLr0~@s+q`g=pG0Q1^66;CK$7`Oo$Q! z$XqW4*6lna>?4Ag`Ar_M|Q@lIIhZxbv%>zK*7_|UG0ZkHdXA)Q15s}`qn8anUKEI;bA=bn}3VO}E-q&W_RNhHZJ@#NL zbB#7}mMLB^FBePDP-Y*?3=dR&M{&y+Ov%dQ7;n_T-j(6LaE8F+*KpMy z3UhO6ULjBrFz_1@hg+C;GuhXMssgVtzE6Sz6JG#t7FkOugQR>(yX#xm+m70^ ziiMxLT7NLDDNJknB5(qM&b7AfU=$7w#J5e8*Xu!6%Uw6R8p+&n##za^x0%>-#x-FK z2hwk9te=q(oPq`;`i`x}=G5${&HPt?{ba{Mfpy)kJP7Xb(v-EdVv`n83NX=_pl&!F zg-8-s0O*Xirs35ImATM9+n=7vHmd-1@?6I59A`=;CQ!D1G@!t=?z!8>4L^$8j7QAmYEzty%FKx9pr#&$l)qr|r6uHN^mLqoA`tF79v$z_#7pTMez zxduV{A>N}6^cJbUdzFrZ4Qik3_gDIj;XR5VFg?Cfi} zkpehAV|xo8&tn+FLF4I}j9NEOs8O!X%Pc~_T&~uB-RBzf4tf#^I>c}`bB?wYPv_x~ z2X4|e-kn;ctL!5tv8uibXEeIKqeUF*qD>%+2~`}+(N2&{^O>paneP?Cvt8Lne_h8O zur}Dq6URnM=8B2Ra5_kg0}L&dNU7oxs2=&;Gc=~Iyp!{ALH+@_7X$Bs$7nkPx(C2K z7@1wDgTpS<A?^jPO*8OEgm?=5v>}#hQz|_H2kO`aL)wc)g+iHc7;t zBK3q^+5+*?51~3n)UvA^mL-n=p9QE{cjgl4UVMRx<mYf=lt)z_R%sB#e74zgO$=A*TI z`)1pB%+mq$k~j`FW*qx{=!qx>7vehKm~si@LJo$0qer&Xtm9?bTE10ipPG9D4Y z5YtxuA_W3^N7ttrQzmrpib<-Z``cz~+|oMo|K9yvjiXet#y7`CmVW zSaDJ-0&z;NjW<|h@XZ8PF;kR>WEu3Ey_9ZRF2j4jbjUxQn#Khf-nV+C3iHV- z>V%5&cWb6OAAiQ7Wqj)EBM00eB`cck0bXr@d)|{pQlf z>3)sJXkM@t7p1h}6s5vzTPh=+F8RV07q>3X;Neol?qmngKq{(AS+DF8ff4@^47YBd z?~xJ27?L4Z#%}ouYds7LRVI6cE0f(rmdR5NE~&QzMFo>R8G>&x9tpdc8S-R9sH*U< zNThkGm`BD8AsKcB4m@YIWT9s%&FF$n-4v!(^winl8*q@WpSTPQ;{V;GIKhux=^42)r~KWZi%5}EBRSvNbX@?#Fe_qhS11Fg?y zqZj8+j5je3o9AyYhLMATZh~Y_Vn@h%2LuqR?g`Kt=cwrv@#L1RC&qi))Ot5B51a}H zEL3&obeCZ{sOxPP%)}O49?x%WrScH2Aw`)sn~M{7z=zm-IJLuoL3UMtVYB2_WT#VDha{ z@XLel1}^R~_QDwTIGEbN#~3r8KxDLmxpi4|`^F`?%!nuq2zNRM%npr%S_?yE&E7Vu z*(*`hw(6i0FoT1>5TAhl6Pzh*%m$VLrHU;Ecy&}QWyJ!raYw-g@2a-LMS^V)^c?Pk zZre~bCbqDWcl9qUnhg4EC$V%lXaHyP4MZe8tUSBpzVAa?ytN{$kt^8aU_8{Qx1tHdxJH_};*es#!DmiP)o6XqJJ+(KTed!$ z3{r~{|9aD1TxLgAO4k~}aSRuD6db{`qfORyH+J(OWS&E~V;ZIItAwHz=Dtk^&GEL? zpS$+nsVrY69`@06+>iz&I4WuIp>Ni%d9WR69oP%pb-A+j4t%%m121No%b}aJS>WBv zbKytPh{D7^Z}{gzF}$kqPgn`es#Sg!1(Ufz|JAJvHJr&3%H3P9H%0QY$b~eO&6-F) zC~C-raM>_Qj3{=Pug{Cis(ju^Hiw2MFCkVYwl5-hKGv}kg(R2r2&aPa-Otc}#WS&K zkwW?2PfFD12|?$Wr7Jj%HbFcov&u8ZQuXalc#r~YCd$m9luaIX7=Y*%+6a9&yg^7W zsEp6`I!#>tkagCajlfu6AaG~v?I)JRg5gfUXcL70cF>qbgcEJ_Bc$iZP%WSa)K!qOojwMp>*&xhJx{Mv>*Si=u0#RXPSO_+Z`dclhytG zA9lQnLdsv+w%^qQMFMQ{v|9epDsEy=F5o*LjABl{tO}cQ30in=Q>*Et!?P$UjWHf+ zoTfJS4C$RO`Ra4aMcK#;=iL+T&>*&wQV0)lSUU*n1EDd1`wf+8r?7iHF9nVp^xC{L zkwb0o=22bw_9dScjJ#UXEMtk6tGZ9wtED@oXtc!Jff7yO5~gqErI3oGG+Oe^<>kz5 z7V^$ctNbvBNTPMGb(am|`vr?@<(PZ>afy33`l#wP8lnRLMd1=IL3p=+g!Y2a z6OCE=!BWlzq4r8|=gzQ~V!nNvK_owRGJ#-c{BOCX@;|PsA3|o;JueRNm{ys0XP^>QtXQ$)?C#7&woUK2T24(2_8IWtXTO4ff<{Mq_B@VFxT;Aai&-H~ zz0$}N2)~+;lE;4z);0~`3xiN^S95HLLThUHo&9-J5#4t4V0A?mzTePRnI8??X}QNf zrBa)A%FqsvG0=Ew2I=h7m|BR`SXYH`mRS#(3uaiUqLQf)746Vt>2u-qhS}2)uN&Wwe;{QpPc2y~9yJhV9_PV`lg5x0e^gc>d};%L2oH z*TEB#`JPL(1M;6rU&4i&4GxP>tztkSe!aCv(uIdP-o`nmn;)oWsYtqY2E zC35EwfePk8CGy_ImlhGL40bV>x1WHx?ZP0gpO;nPj7f1agT=SGCv`E&q68BX<`tr2{ zg3saeBXTSX7&)RDNtjK(W(d$4<)4!$hw=AgGRfon;GeKp?|QElhPkM&IG*Wy@05IN zZY9G8AU0^A*f*ZqZUhsAdso#olr9HRs*p|N))U=quS{y|6%1&pa86zN@5CREFUXgKKJuZ!1L?_a+TkM_+~IfdF2G$WT8S5<|546{o_W<0KR&&J@f;L2qF#)0%>+gs<5Rh0`U z>+Du=5NnAoZ+vjk)0L*SNwd(HTKyh&^}exXYHYz5QD9k1+`nh1r_WB|(tmdP%yOQI z^YJzJXf^1Nf@5_IJtgFwjj)C+y$yF_=P6uOpT*>EbvzHy`++vHocWVB-p32RGD$rT zX2htbHV6a!6&dOI{Wpi36CT%rGcsq~%qJ3Qibax^F14Q9vVdzTg!}}rDU5hmK;4^w zW9_PW=jk6r!fl5QVc-31GAm@2w0F>w^rpC+v{}r|ZF}bCb@u-C`Nf;pr)k&ThEheA z#kt^Fe^!#ARMB;8vDE(HRl74O&^*{Gk&8qucB|?>0CK-Vum35X_E*;%AW5p_;e|-G zv=FSodGX|c>-Zk6+_~Y`OeO*;?`<_v4>>cRNz)Dt<$Gt zdg#6ak*=nv(T&jsmN_bnEiW(liYIIVwTXGQkX2Sa6HL@+PqKB4>$apf`mZWe4IZku z?{1(%ICxv!t3p~&rU#h_nNGWR{^s4qyW=0Vq!K45 z0Q!I~cjm1#{bnY55CXV_T3?(=4Dzv_7>5vR?(NdC=AmszAxJlg>Os7|D3R+l;o0rP zmGYVklV6n){lFfOg3)C6i|yd3HQ-WH_h97!D}z4u|6z$2Duo8!NJmGX7AOPtKL@yC zxQrw})cpdT)h?HeTwcGrzWfx7gl)VBEb5>VN3^8*d8w8cTtWugVNBr0*Iuj}7C|=# zxn7j#c56&Oum0owiqKL6RGIp&2V$(MHD69}2(l2chfl8t`h#OrePhkK+%BSf8xW{cVp$h3@Qi%JrNZzJd>N8KVW^nq zFt3Ox2+#jcqeYMq!ozHy$@2l16BLYJ<-*62{4pF_KHAB1WI;Y4;gV|&&xvuEV(m)8R=?DuJY$mU(pdUPGV zS5l#-j?h4aVx$2Tm+uuqI=T;4r0cku=7SD_FQL-1DaNaJK)#Ph-2n2W?ws%MNl|cE zB|#YRa+tL@d0Gl3vK@mqw|!ivI9Kq-E0;JnkeXrmiZjbXWq-pAh|C&cWw0;M0cgaS z4(Fkg{e?Su#skBz^#>N#mluX*x3SaG;3^43R)AK_~_!i_?~ZAbYjp5(_n!S{aU|3b1a;b9s`?d(TJ;idPsqIDG1 zqxz)wE;ZmJADFh;neR>C3h^W4a1SSK_6xL{VM)y-(K{Kgo(O#*yIW?acy;S5h1qiMHuN6^Ge6Drfw z02U@AB2qN5)yA2+V=N=jpFc;1`tv{h;SU5VoyIKU>E?^@*6&`t=pXVw&)pro&k7-s&AeFLgo^e#^*QepQGvuPPB0OlpzH6#Kxz zD$EJUZgW3A1LoWgGrO9zZmTnLsl4R{e>w)y8NTVqr`ZpyrAqCUFNpoI=$D zRlWTIZLfi&iTSnxja^5dG@21wDlvsxJ~oQw^s~lOqip|N$6q$ zCD&G(d=@E9_|H|k<|QLnuirrI3~=b0{Zp(zC>om!h1VEWapk9kyp}>inqu9%*$n9_ z!GM$4be4#yKOv6;mnqGb#RNViOGaa6YKv<2D$iMbO2{jHBIi7U^0)d~%;Hir@sNKY zaJZW#Bcg~I)-IZp$nVs?Dls#eapDrjMf_nJKj986O%to;Oi!nja|n)Ju!+BUpS zFW}epz#7{7)F{NUfN9)3XVMaL6)o{rZ{R;6D2>n|bqN_>-`t)r=c3BgsphLxNt0wf zWgj(d)&~Uc1PJK2rKi}SQm25}dBGIs*E_=XWCEhyj<8dxBULI)2sGLL$&fX!Sg|(! z2Y6DUspxaG1E5v~Qwpb+(c4vk#DFyy0=Et<^Dk2s9y#MoY~ePSFUj8Cc7yUg-5B*C?7d+z?E6+hXzCbJDPu z8C$PM8ow#Sw`P^=^?(trBF`LCs}_S5f_&ac!kciZCv(fz?hFnXZOdw^+!Fen80V2P z+ZYE*j1C(MbWpGeYE^z-CW|GHAV-+)*t~0Z(`~~LwS%`cl4({4rVY7A^m>?-gadq2 zTHLbOv1O;^N-x~%CWc&N_BsTgLb|SHan{p$c6$2EWL4YD=^Q-JU`0gj+`XZ>L{*CB zjr2Bv`Y)I$+Gb32G&mHXYP+hNcThFAshQ2X4gL>R2kk7yrvdI#olDq3=?D%mwfcrZ z&Qzv=<`5>#wny-$YPQGnu4=Z+IS_&EnbUnoH^)E8p*jWfAZ}O9cCT(&%{Ig>tJ%Wc zw3=<0V1#Yo!|LaGE^5-1VPk;70NFD42-yy2)Lc(^OzBLDq*S4)q}w|4?>d;YRqqYE z;F{ffHzjZ=cy;a4=Z=JX7d84&75V_V1lu0E#33s4hf)IWo>m3h<0eqEW@R;;X1CtCuLvdx%IU_zq;H(7vO!pT^kUp z1MvEJ`uc!N6!EQ(k|qTg)dB+39an7-Q?s8$wK2^v^&MR~T?}(;s+R`GkcR5!A5d=G zZFIv9vV&zVs4eW9sKdkC<+1sMv?vqVeeJHZ82`7V!xQ?2O>V1;}7z+l?l z|HOg!p`1w$V=~9~7;2tf)jJc%h}G3KgC{VmcSiNjKb3mN<4^4Mwu565Y3OKg!4dCpEmWMdD?DOA>xwxUmbi*9Pk73Wqqe4- zOb(P`bUVgQPNTe>m<~@XiwNcC)C%{HWWl^w9C2NnNen5WOfoGV9NY(1J zqAHjR3N^TyL2IrL1BeOc(3uejVTK7wZJcZ1Io!4$JQ z-x&2Cc6R5kA;z^~9Z=;jN|l$xBY}v!MD5|WrGVU_-pygZCS|?ouOGG9a;g+7vX|ul z9{<~ zGQGvW{&D;Rd;Pb-PEJn#{OcViTay5Irlz8p;x@koH_9EZb_DcLAej%Q3C_^>;-v;vHMvAJO z-+sxyZ&G7d#LlBgl$p8_w=B>hrJ)Jf=mqMnRhof7nECpH%`P8CO+d?-Ysvc|h>0D` zFBY4{EUq3HN~1IYPRThbSj2N~k}y#GeZYW#$|kwz|>X$Bi0ly8|%`C3GiWEs0 zm5RK0PEwwgYDhiTVS>*dSr7)DEMLrl|8}yDQ9)wS!(8x8H6~J}`N*`(2%E*(=bMV_!i#{S*p z3MC4XmWkqdQUUF~{lMJS{Ss@%g;LKJK(X8p)?@}V+OZppWeRE~fM-9;X+ho2L?TUT zKyDULdvi2@q#ARian2>L!q-`8O?gFu!AdLL$5^KWmpT4kp*9|tck~l$NvkB zZdukZ-+n7COyhM%Q&Z47FT{##bZ2p+e>pJ)O=JjdXMHilOX~bF`cm&&8l;nTst%2T>HI8H*RP7ebI8h;8)61VFa{nb+3O_i9Il1+J-R22ZBTeb$b$^*m5bXya! zl>n7H{I1!o_kX$gR)#3;JW=C}spu?X`SQ$+@TtK&6&Y8e7*>NS0N}P?y!s=NB&Ir$ zn3Gp5U%D5b2*3h8hz96CLhXvV5WU8zq0rZT)+qw~5=Ia_^e$$*QS(Pc=tmLO4_381 zTq=K1xQ7V;=!P2*$ut!5u4B;ccs6lbswK-5kI>#=oP>Q+PA=ytEXD!0RIy@3!DA*# zFfI3$PCR)cTQfIs zauPhHt0zov0GxT}8%I{G_{cDG*BolGBz3(Z@ z`QftsBNR?|a{G|;h9%bz#e*%VVs~^H3ueBtAO~pBI4+o!_7XA3*t@Rtt4s0~c6YEP z<%Liv!CZ)x@?O`aW&!Wo$99oEGZVVFE7un>oz0<6oJ|E@7Az)4WAf>g#NS|lKh2W( z55NO^nsXbQRPnu*T*Ia7+@Jz_&m;$51J94n6#e3|3O_1 z$eNCmZ*N4Hm=wN(`Qx6J!# z5SuaZ+hDXb%eWe_ z!gp8hl>qv+z3D;t&Tza;pqI4OP!gI5^BVhG=JKwvo05CjwyvMmsIUZeRtM z?uaX*L2)`e50wJr(Gp)gZn}$mO>*&2sVyELp~dht7DHpW!sEAgJ4pAOp5g#WDGr*7 z;!p`F29d+?AhNI&6M?;Kp&j#| zjyX6U&B2|mG6&0AnrN%=1Y!rAtC*RxP4JRmFkXbm2%!6DY*hcpQ-%amqQO>DqqT=URr+>ob)1XiDeEd`}5glm@>|EXkE zx=_cZ+=CGf`n^A}A#>FrLXp^rg)?h)Ahh%(40JF^O*yBQ4EemP2A@}xr;VsglSJHw zX*PWZMsK}di%H5dVi@Pb z>9ABwZf9&sS6q|?4 zeFG$eulJ3ww}Yh@AON-wupBV8fW0|GszYu`qj1$s5rvK>Hve2d)7YR^t2Dkn%)-JP zP^wkzN5}g{o5G&8JnZeiOO@9?vRxgDkgbn5pLEPeWb8fD)QVoQ;_X(0P(S(J=mhk@ zg-AR{KtYN!BQKy5aLx+Q-5B1$=+X$y6ra-hoM&9ENknrx;|W(=9qhpe6F=sayBN9( zYlb%?z!~T_qNJ3XX9Av}5J`fb?D*?u-(8}29?y1xkMm}enwPxbvMAy8zm)O9cvb5u zy%O0xDK&YxN~oHP0+R)ZtVLF=++fJn#a{@oxy{XhKiYXC5Bdi=VtL*BCdmNUeq?W*GhwJS(c`tjS0t|(7*9|7~Oe_%;qN})H?=}1jAVQMnOiMjVwbK4~lo1#qG70yG| z`mWn4TXAsWJ)=_cMK;YvJk|8^>{oUYQ<}xo8hzY8i+;vk_j}$6ybSe@}>a*+x5^Xrc+DphYm@?oOMjVVYTmx;Yka5mt{ zU>+C>A<#Nu97Cz%a^A-$LcF;JF8ioOKy-?zbQ0DF5A<&nGAk9~3cPWmr4YRl0~B`< z=CtA>0bhNQVS+o2zEuT3J2)nttv=&@EMTg|DYr?Mkm^AkyT1UbTq+_TDP>x;rAgu!jkk!21Th6!`Z%zjn@Kc0apbg#YFoEyLYRt9Px?Hz z^p##JEt%@o&(?%1D|)JBA<6~9$QaH|V4~e}5bS9j_iIg$5U58kf~!nz?p=UfN)==^ z#;CrcU@{k(?iZiDuGaOx0<>DX%VT*`ZSj&XmUf3}!Ay2pA2Yf)`d-{5&ojc(T&+Fy z^iV~yB6VN^Y(k|uE{YqO-XJS^-aFc{#%99RGYRKzD)N(4a!#_+k&UhiWWtSaI?|Jp zqU!5_mXF+de-5^PoFh76VMoo#vLc-{h5R5>!zLyos6)&oL-XP{aXd8pa%1TUmyjsA z4g#O%1ojKeyzb?hBnh3dB-jh=!O8$OH`-gJ$-U@MKoe!-2_&5Z9Js%ta~HLNor6k& zo1~6-X<08P-5rh)o?v>nLTH1_pw&RFFHzW7^v$v<_bki?bxa7&^91Bfk%t1__`pZnSjtH@V z137PgX$G{;VwuRMa7}L=5w}H;>Tk@!25%quD=4D#jhc8L4?VWkP)oXEReov1>`hES zfVEy}DZj`IrcBD{%*y>kQ5{W`Fgn-gC{JjFWi)`9)f-I}TkwdatXP2NHyT)wY;bu@ zvQI_F;RUsJDJM3pnAmjqrM5#cv7svmPUlN-*LX@yj&UFvnVd!&nH<+fCTC=FTHDCv z>@oPronL@EGseLn*whtdnpwFvx9bfk-b`pp zL9+!TFQzY^KM%q1p&@cZ0^~w5a_VUzdtb#}=(DGU;zby`wHX8M-|l1xwKF=@j2bP* zA?JUYGDTXg)wcOsXr8i(^U3gn-JOLiCc=ixYXs~=u$^WfF)Cd}s@`ZPs)!URGnMNM z#n;nkc00&1J6)WTxHSH+q|9Tg*a@yQDCthB`GvxTzN-QPw4vlf2_=KTjO!o=#U8kl z0Wb>Z)td)?Xw3Y3gTtq-a-Gt>hR_Vn?8D1|Y46^L#1;qNpS!Sk#{Eg71&&fi{y##QUFZbU8;u~_@tXzHz`xi$JxBFmX!{53+oZS4DK6X|NB zx?ofn1h-LL;I&a*u&s^if>B*Cstd4v`s#wwCNeTPBa;)5U7@VMqi4>jLL@>=uF5+W((&1x1#_Ei*I%BNP1I6krsYFagE}=bi$0J0V zZhj(>I~r*XT0!7tg&erj*jUe5d{tjx@5O`?H7tY1F@wnSDI%jFb8hm?)>qftsexF} zdxOGn>dP8zAoHzywfm$Qj1$CaI81n`U>p#S?R~$KLS}%lb8e*ZpGsD&A^A}yPFj*9 zjUNSU^M07TXR|%%0+Q2L$#|t97L&XlsX1t&yG8Yh)J{8|lcL@3d`$ zdnB9sxt%p`WFIMaSIryQ8!i2@>uJdDMHNRv)p3B7HI3Xu?#3?KIC7A^FuE!ZN}z|) z&ymO0(REJ13?8i5+F|USRbgaTbr{(XJ$F-!k)2dyWUzXS?4}|kyQ#^@j?e(k<{NM` z8UhS0-(lwbs~vB@9rt}7(&DWZS&fuJ%A5bz90i=Z|AA^zQVSGDQ|&)9DkiU+fy3vJ z-sz{3uV|wA9dyaGwIalPgU_6p3R3!-N8y@Fa&*hqN0VUJY1@2)b#$2>RRu?C1jjL4 zkWcpro*iv*7u<>6+*$uS=#%}lx}=6FU$gaY#_|EU`KC6S<${$-yHzoE5-SI34$Y`U zP&>kt{xYhz%@|SimStG_D-xOHv8gqUn+)UV&9$Y95+QEO+?DJpL^=rdcovD&`X!@3 zqsCo>)uu)p{tm;!Eo8z3K78Yg$R7xmlpE$k6DS`brxqh=}3TJ2Oj_n}a?(ZO8S=dkkjaywyG7qE) zn2g~5Z>+xENFj4k%y=BL3>?Jm)S*CB1I59j?C)*(py!DclV*Pr&8)LN(`SQa_3jCm z8l1tklZdq;8U{4Um(#QiV8)_hVFXo`ry?03%6csHnQdiaL}X<{qaTA$+x> zsaj(rdauG0s&qYhRwj|`>~aU|kOSAg&W2Ke{r1N1Yg&@-O^@~3JOhW0xzNN^0FRDY zYu!AbtLL;ysX#ImO*^o2mM@fM*C(Q9-1*3V9K2TzCpK zk!bHj$lS+YEj{I}8B&B~TP+g}stem_dlbf}6B?J~QJ-6vR^@uyrL7frn6@7#Xu^yV zc)w7Sj4EMyXFHN$Rs4>zG;g#E1$C^HTtfyHrT9`@XM)XJ{{+A>vT&M++SF*Ty}krX zDJJ72Yhq?Zpuhm2=PZ=_G7E#iaH^0ClqxT7vL|S=?Wl2n8v5`=-)epZen80g<^1#~ zcdLZu|5Lk5{DOXf_J|Bu7n<}MFv1s%m-RXi@9sDAP;d0w)*IxsoLgMOy+)OA>As?fQG32m>xTIO2!ah+tPj6rHtF|58q*HkoHe~`)+h? zrPxZjd5HMlHLkrIqw)PZuvT5w0d@HH-(RL3S^Bb;E1%XP-&_9V4hws_t`ECi%gym)MU{AR7wzi$YU?Zf_M;-d~Lww6wZjRE)$wHdPL zUH1EjC^^I6C8(Zgrp@xKaWibpYxIu9>M)F+sGd>xE zL!G?3Z})eP=f;<7(+kZ5fJ-S{!r5;e;gafMHY-GtHE3A^)(v=HtPQWS-U4VBFF!a? z(YU>{PY&P9r<4899Z(TuG@g5N!V7Tqtbnxbx^ZuLR+ashnMbIIG{{?h|cPxw4_N4r6uNQ5)YnwY?**@l@}vGIO$ z4Qx7i5}T%9_{P_>4FdmZ{Mj@y#m0rY5aHujA+HF@7!FB-43P*>?#%lbR!XR67nu`eQ!vbV(KE|$}sq_mm<%fUH80FSL z#7XM@R3akJBa|1h4s^HkS+GLO^>L9Q&RObFQ9YM&9`UrqNng&nPYa?{x0Be4kM3|4wK8EEBV) zX{a}krs?~%*tm?=_gVh#sG10}shVK^Z(-3X9+v;V!1FT3)7+XR-^eq4O%cuNIfToL zXHzvhKljZT#Q^HXu^iA8>lt>c4^?vkw0`->DL1Y9gnLQ z9_5yc$xp-QRf&37zu|_}ad!D5a<^_}TOvdy7+JzW{L>CsE~q<%4KHE@w7m|dDk!!C zrA}8f>*69YaAd>LNCl;1FXzfKRQgsUQ8g#NUDfrJG)gQbkzl1WKyJ1`@E--vsrq&p zAE2|X>L(t*HN+HA?_O}Hn9oyrDC|Tkp(4$kZW4c`jOhV#R3>_9u*~Yi|7p-@FzO`p zn3@stv=GJVl3N5fb(*VB4V$!9fg+i6Uj~ATuc#tsZIFY3`3tz;7fUjonHKoS-`sOA~yF7@mv?Nt*28D}Q{t7NCC#9dvU)%OVNyw%Qn z+zCaza8JEXA~*qGog8>3y{Gcj+23US8hT0^-VE7UY@q_M81IxH#UpE+mot1my-LHX z-QLpn^>}&p!Ad|Ty%gXIOq&@n@HTS;fjg{|X|(C#`@DSr*xm+wNA!Ui`}<5-U_LEm z(G(+kjKTx=3X(_Hbe`7hx9yRUHo1-o*nBjs3I+-<)&pKiH1kzVrsi2#HR@ZnB!d=~ zK?<0X4~rY_*ERXae`(HH_w6Y;l1T9`)%qd!{#4f%W;4JB7`jPAnVkHI97H_DkKm-!qV#kIV43?u1$r*D`Cp?ynvif=u`kN4 zvg)oZar7W^=HhgSJW1(tMnm$$^3}?mzCP(TdY0vrpsi;A-kN#00{TuL2JQWe|6rGL z(63~*7`l8_Um*#N7q}Z1dtgikL#XxD2ef~It#VZha8CEwO@P8LJcivsB#e-z(t1#; zW=1!3G;%9!+*&g(P8==N*_sg#=6t|?!Y0XYe^+dfoZ4SW2K=JPN{gUbag{Qk>M;uW zN17F{1sFtEynUVy+rmyDtK@fgsuBFIyhxoaY%c5Pu5T(5y?mw?MOT5sSDV!AbOp#y$h!Pr=nwd@KDgT1ijD&sJ@fCS0 zAp(5doGpL7l$!ay?eO0Pqg;h-NseWUmS%*nYGD(7vb>Lb{D@#uIt(bNNG_EoSv*L2 zW5#m0tJMYHN4eF^8SA4O@;*xYl%aV)O7mo|DLX}OS&Wf(RI@McC725KhR+LCbm$y0g_;VphV7@vih<}p+Uk!B>TmTywMCzf}{FzbI_H9 zRBF!nc0!(zX0G5sGDp5k!=CD{R0{kO;~0wjzg|wc|9LqtK8;@zi!;GWvWD3-{CYRp~u z#E~ii=dyv`uI5sxcNl2~NYpG^J!gZefpE*9tJd$o0}-*cu<>oZ(?!ag1fpQwL#caK zhqWb8KC}=0ar1p0e$2?qr5K7nCcba)f4wgI$;f|te|t3VPI|sB^y0qGethn;Q~B|| zgnjJm$;-vY`8~f*s`+IFUf6vS(m%O`Zo?#xf-6BHt1;A5?E^0vw(qz@Pq5c1 zKvS0*44!~b0HFPmfyz0>0gut>H(Fn&gTLJ%Dn3-Ow3V1#4i}(ig7#94A-$_3c~xZz znP0LvJa29T;@Bo3u{Vm>0V%Tp1_Yt1_h_XVO0_=)Me6f#zHlb9P*to+;69!3?qf~J z9gW~19liF>a}0*sb-k!+j{9VC+QMr!lrgodS#>zFTO*3(jL$VP=s++t zUvIfGMabNg$b5B-2o{WQ==MYz8UURps280gSwLYBo@`N_tB6mdnyQRO?i`Kaw_Ci} zYLahh4P4~fnx3mzas}hZK8Oy*TJw(Ub9;6@ga-x-AfLmrlw0o>zt+BD;z)-D zZQ}4%7#$-dvS*s_?D-J#RWy>@p6m7Wwg7Heo9Xs|RiJhMZTiM*bRlrqc!&f{lu0y} z*;V|I#~@JzvQRfV1vH3YcybxRb&hcji$ilNGC9bqoDlWqee=z1NUf+f3)5}>#Cfgl zdYqGnd32!&2uFlXYA>j>{-sKNXhO}B!NMN&QxM}Pxw)Yr{79qv zhD#ZHmvep3m(7_LiD5IROf3j_tw?_%5+TpKzRk%J154t>N@7hbH48rIU7vgjz(Qondaw{b9;Bp)y76vclRT5p zf~g|-awWY>rG5yZRW_!g`+$^^8xeb33JNJDvQ$Ncll@=i*#Nt9%yLfv@wCL+!6PKhbFuJO&L(Jpz_ ztj4}C8E2&iJ9kxI?=-h(U{W84#|N$_BsFNT!G4!{VSDGYyv__iS_LfkFFQ6);aSZR@FX-R z=U`nAY2N$j=)rHq$Q#gsYI=_rNEE%OkQ{cx6NJsW&sQ>@sfYGij-HP3;JLjdkH&_Z zH~dh12(-X113t*MCefDx2;WV~umzrAd%`C$a&P+cU;p_UJ`O)x+33FVf!K&?2v}rQ z*inq+P}{z7xqwpFd77SbC^TnVE2FoG?jB~4Z^dI8od4ZvK)M!f-0!F37XR5#!TCBQ z^e_T3-09#h+oR;S>j--x4k?K~Ig zVpZ+pghDazB{cCgQj0?qB%`&$S(#X`gv~b6f}@`UxKoZQ$?Ad#V1S`|wdp?o(~R}; zcutk4%ng(4dwC1*FKJ4K)0>T@sPUb_DGdO<)4sr3aHHr_GO-?H%4?AZx-z!&L?tpkItr5WY7|^vs9sHu zpiq*9rM{gZGo@MKl-G1}?26yvc7R0z)4HZ#LIzzK?&<0}YH@y*c?FAgFgfYA5g4rk zVzZ*ND2AxWL-t}-9nxo*&Zds;-Mw_(@B&jf=dmeTsz%g>95rW>X(qAMN4pEh|9lrc zY-y}U?O8xF5E|{bMkF@e&FvxCw9{Ri-YP-iqjD_y zQ!eQ&TQn>gy4%yqNB4^0n6#*6Hhy6mHm3UHGj=jnXyeh@)0#jIOPg+d)q-4cn%Vm2 zix2=uJNNV;2L(VOz;xjQ0*ev2@njH~papskif?|z*VraP91L0>03I=Mi1ZK^x8PcC z5=z-;q1py=1qQ#6h;N)PmY?U*A-uQar@Wb{u9rl!1D5+1{5PpMo8Ugm52Jw}RHe=C>heIuQ&X!H@jQu_-vtYwLSM zWOZ`cp3Ir`vrBtSsku7Ezzru3X^PeFs%?9QZMj{EJjn`~_%cZwcS5@Mph_}j$rtV_ z1En!`ojl>`yO6m_5U<i#$%0k>cBtaY5xY7uqx8)iH`4&j^_Qo z)^CuN?(}-<`I|-E9|Smm|NVtPX*g67okjnS#SD}XZA`~x(O znEz66LF8IRy0GGBHh$xQ&^tdoY8sq-8QDRboX9CW8RCzfQ-9AbD&VF ziev=AHUOEG9Un32vrUCe(sbu1H?euN!AVRuZvEu7-Bcb$j90l=B1~B z+KLf1S_oDh*vr~0dKPf&XCz=k^cM7CoP2EVs%}}Lze>gcIgy`%pw-nnC_sd?=I|co_!w0xgQoB}#PD_ZCm=6ReL#&U@WCY~Y;8kb{1KELPOC8Y4g{w!&#Qq= zdD7oZMnO%kyj{}GE!-DzPlqU&@j(c`jP-FsgF#utg4Y@xQFCqkx*ri(ROWqjBUU_e zp5I{PggoJu82G{ZRauQylc~De9$~}5;<*At-(Yx(f>r}IhJh;N@)mquCTBgkm%PZpj7bNh-}s*F*mBLu*1*eBiuq;;*tK+0TP@8Ya-^0Clt zC##7>N^Jlvtd-29h7@zVz7o5>%7{4NqEvGrcz~?kH}d#(>s%MzAO?Fbq%PI|$vv+f zwUwOoKnmx|O*2YTq1m|a5XB+sHcGmm?+`YQ<6kvW#En0312=sJ&G?uSUTk3iQ!@h5 zl6Lu_xwhi!aCrTS%sx7I0`KpUfrGnsz{GU%btN4pdjl#`SaGZ;PNXS4|L>S>ke)*& zp>92<_aYPGaG*iAaGLeq{;A9UsTpU$jvmH0@+nZi)`>?Z*AVq5uaTSI z^1cL&tadb>fh1D*R6lz9{&FeJ1P4_P zF3{MC@1p5&ndM`-K4iM5u*0qM?%`Ya_@vk$&2GMU%A{>Ec<$P%%EP(iY8}>wvo_wQ zkTIySXKMvU#2aiE?!#Cd4(Bu?FGnWH%p*U&QVn!&ZovaUwJ*lM_gY z6#~--lmZ=tzd_k184QBAS}N@=47?A9M3@C>x^_ydGho}bXCoZWKrqbY7SUvxX;NB# z4H31Mj+hiTK-y&I5Ed=ebE)f_&YVMdZc=3-JKmqPU0*n&Qo8KUSN_IK2v3;e4}n9dmdd5vp#C?zXCaL5zNMmu-y|@UN>%QqQLRHKo z3XVGei?aQlP|;GO(*(%!+z^7j5mYN9_(nRY?F5LL-G74i416L6En)o~HJV8Ym{PAx zYcQMFx=_GHdhniA%^KUDrrT-)L!6fAfz5&Kcu8A0?Um-08*@^5#^|G<*CS}ecWF31 z3>HJR50ZISeOF(*zLptznHgtzV;So%6+(L-RPrj;hHkyLtx^v)QiJ17yoL$Y?3;GR z(qRl6C`FP&iYRH6JcQjD(qzeWBt{h!LUE6hf5FKOA5H#hQhj&93CMn(CTFnttFT*g zey{rdd>V`8hjis=kT2KbZ@GS!u)`P5UvR}k?50;cC>tED{=V`w6`-Jh(Q^fC?pbT_ zHLTLz!z!l1dkWl{_a|kO!~DQy}oY2QHd!wZiK7hK3BK0m2r`%p>(Q$fVDoTc7Bc&D7wsj5Lft( zbB!q?2kk9e+e9D)?x$AM^826KdlqkZ^m&Xg@z!k3J@pf_fGUu6#=#$JadfSb8G2g_-s!sJlrPZGnRW-5EODZ?Ksadx$6 zR#{;*BndD-*2l*!t=7Gjj4iA8*lMlX!=8HC|T zjDH-M*N9p-5;@t4UjuNnmf*~ zce#ZMg(OZq$?7F&rvK5@Kly+jZ!s(OAiM%H

509`xbmwBuqDS?v<= z+?*5hQ&}#a=ly4(Vi9ZHCn*;^PK%g1vR`5}BWJHPpbm)PexVqDYKB zOYdO>nV=p-n1BKN?q?+%zREkJ5ILA7IG!;3k99WK-T#N7!eg*2#PFg@{d}NH9Esi| z@2;w`Y#wS2=?>8gLAL>PkV?Zr4FQ$h`J)@mfn;2~Bx9_!Qv-}O-l2=cZG9qKK!7oj zc!t_jDSjWhm}d`)W}V_(UG1`OVTJO+JkY zTgl6Opwwjx7COPch{ZyNpyYo%o8=vW=@RnSYCd8?yv5pw1(pFfX^n)xeIk}pE<>BU z?y^4&yM@f%wF#LPJ={8=b`fo=h=o0)q72OfdbSLBcs9kOF<^frTdg+EOEZA4h5)e! z>a2rh-tNMa6Oa2pmL>!?547~N-S1Mj4e4VMK!_vpuQ~g1rNG!0| zBS_hH#wN0X^HbM`CzIXsRxZwV5;`zRR|o6{N}Vfhi!&Z^>p?A~4os-mHCgUiyM3nC@n7hM?jXNQ@Lv)*IzGdW>Xc% z%sLa3#A7QWTgzm>Kb26yz0?g@nJi_mC2pnG_l^>YI7(W~5~mmo`K}o{5v}wO%X1=2 z!pWocA8{E4@{6Kw>QM%$t zp@ymT;QiyUwy@!MbgUpW*#dOT!M17QPx>S6tBEf!k}WtB6?q~`v8XdMz_^Biqurpl z?VROfUTwP(C7xVyYMGV$#Lb^3b^ppJ1>Th`yM%BYS!??G%al#)&h3fg4My13wU@wY zG}C*+P0NSC_X#)yxMD8?cCG-Y6b6f1{I1>A5QRGz*RNu}Ln4bzDuk$uq~9g{QPBz1 zG{uI4fAirev6n_}z+OT&Fu+=Blyb-xVM3H-rEXtVkIa6zBkvU7G=-P3Ft%sS_|0}r z`Jr@GU>$BxPxk1=``vqs){LlJ=zYjft0{G95U%LToQkxi0+zDDTWcJo1g43v8lfhS zzACe5dap<>8ih*1)sGo}-34z1pz#*Blr?h4DNCaB*6)8uAIXJ}Sk}5BHSY=OwYr)N z|Mu*h%hZ4NhR3!<@n4;{MpRmh0jf7R0;;c$*HE#>k?Ecz6Dah4^&wAiu|3rP3{|zq zbBqPAfxT)g`Mt<2gKltZUkF|?4zk-&(&N8>-?__$ZBBbSF+pHTD@9PvvGTCzSvA;a ztvF1H3cvC|_;ba+sowZ=sqO$Hq)K(OdbSm6I(*n#g8xor~%HRxoEULA=2v@i|L(Q1*;Y0%p0Ior) zUvi;0Eyqnk>x5Z1IOUj9P?>Q#7GFraUlS52i*lw))7u`9H)0O-yB)Ba{Y3k^{wl0$sWF|Ef>0!WyUJm^J~=ZD zU17W!tXWFku$`}PBj_J0$gyw?6_#%@shsuL33<@icbpxc!FQk5J@6Thadq@Ek2g8T zNECW*d9aEd`Homn^TZdQ0zM-K4+q<>E3sb+G>`1l;cIWfvKH(;Mgrrc)GJPfv#bu4M-1fT$@`rFEKQOj+0*O+nbY!Q;9{CEX>Q5bRF*VGSBsC4zl{kRu1CU^xZ5ng!&X4|UFyU92F}neX z&TlI*eLE|EY8=f?ml)=vy8y6o>-hT#fnUU)<||8+sE8@KvItUJoe$huV3NrMgbGNQ zFp4O$LA&TJi!XmiOyLyeZ;Ef#u&t#bSRaoei6XEKj=c`T_y#RxdpdX3HsA!N$DTG3 zQb07e7*IGqZPKyUr{Zf}W>cq1#ev~xW0uNg zpR7_g?#r*+58ZOivPFC7l1}|sr0;-J4-y8l^L^n2)gJd2iKM<0EN-Vh31ClWNO$$rLGpaCb)TCO87mc zd#@qxs$!|#_mwS4Hqzw4x$U~Oxn@O0|MzsZ)H4htz+o>6eVXBR@PGGQEUPsi|LmXJ z3EW&SQ^cp@3>$e}#_2jxUDtT^W4Ryo5z-7=T*Vn86)s?);6gv=xwg&1b>I#gZxHwQ0`4y4J%(23YgU z(@b|8tP0WTC1Ppml}R;z2$b^k=YGCz$NHsbe!a$glvl@V9&y_6=hIOTa8Ct*9SNye zC&1v%ejauW4XLq4RkFjSMhV#zdo}NA3cI1R?!5&o;N)D;5sr70E`@}66~)m5{xrIs#oNKsgW6mKN%Tex zFL}jidMCDJhBvgT=U4+Rt6DZEY(ZUssSVsQc&J=itVeDv*Ja?xs|+9rjk2`UK7!wE z)z+{gFT&7Abn%wS%S0*R96S`rhv&Yd8&s7fhkCgc%40$&?A>Z&B|E%&64!D&05KJ< z{P`P~mhau2wze!evzA+hXfbTeifvG$1$ei8K8>r^^`7Pl5>zY}prO&hzw?{DJ;`cw zl=k^jSoAjndW@OR@LOrvV%DAaZ|kLP_HXEU#ldWE4-Xf_lD^=1nS`Ejrl_TV7%4v) zU0gq<)P7{Evtk>o7*N&z+~&73T4Z&ovp|sFt+m3$kYQEw=&Rw1P8Yq?njBQ)Hus(7 zUg{0Mc=ELK4$N;4Xv3q6snNHv!WWW-?fj97;J@0px*UM)GQ~@LsRCM}MVh{b;jC{! z`_=tHejb#z?p1Z5<1#boChLh4h3p~$H0Tjri2QKK+lraEt9lQWmZ;{?yfcT`#0;aCx+8vCh)|Z%K;o6Oa~07 z3L2=@OQuK}CmGbXl1&uqLkF|zRWjcz#>Q081517;D19;6j_tq??SycUm};_tq(G{~_IrN-rcz2SDo{pC!0ak5 zOL7$F42M(%qaGktn#3h4y0jpL|IrV(d4Yn6mwo3>(e=rvxUe2)Rty#j=)2V$&NFpP z{?%a{6k5`PZ=F}96YcX0g}*bkTDpHF&AM6-St2A33df?`c0~)sTnwmc6xwLmWAbIs zl?GCDXxU6Xq+JBxsP!9>UOzEFklILyJkDKZ(EtAJxwN;{INsW6p5^|=!VO~8y$VQn zT9;WvvsLBxPWe*|s$}zk5+6FLa>#EN}&cFh?o@vKmzHfo=L-|3GU)n!R}GMXjxQ z|KqSbCc-MCqc7I-@-XaBo6=vJ;8K#vHZsvCJsw$aPUQ3p<@^5&x?5hlwHE&r=ajhe zELE0VrRx64j>be;J;x(@!OBfz+_tDMzqA7C`Kw?<(cX}T1F|&62$11GnP)s7>nu7y%O|u%r(zkJ^+QL?Cvp-$ zKy?g4*#uXRC}Ofp9F`ee=7o?`=BP4Xh=u(I)*Lj6wmY@cqivH~>;N73V+W>gBJY69aMymcY&Zn4XWH8u(}RWjyDM)f~E_qhgIB!SHs*1kJG zPK16c)=6C57I<3no3~XBv?X8uz0k4FU?ub!hQq1re_eO=xFoKcxB`1$fGS75qe$_Q znyJ<%@m?7rRbj4hrg4%*nh7@zcHn?x76a&X`8{nOJREeiq}la&0%ajJ;?1sleAXXZ zKf9`-W|+}A{9@7dzC9;LhhZerxDn=^lxG+9TDFS$M)c+6%tK71(ycCs#iqFDc|niJ zl$g|s3tJaIB=nn~NMa${4cK{Wgn6o;u9IwK7YKLAY{1zuWnO3sH?LH=oBv5}s4|>G z_1D9HHjey|CAR7JC=ZS{?~mO7YUSb=)U$Z*tMp@WFH;p+lj>ooxTet_%x(4!ab9G` z#l5opN^?|Ypcx~rSn*a@W0j&KJ&de4kamo8n>`V`wc#a-ntNRQ4sODfufWO=I;>o= z+BYdoBLDi}&;1x*`J~CbJ5Qey-L0oJQ$QVW+=#!<1RvS9gXdDC(IZy7DNG-oXO&G_ zVg&H}eZD{Se9*nWy}#TI_5A+4eu+Bzy4`E(`5HL-?fdjTcm?_xWLqix3@REgZTW&q=&r=d-MszfE2*2J7;)c4 z@*QAYkli-I*GM7AN*A=i<-6J^1ygDsbd_ym&W{)x+)cnGs=1qBUbp z%jZie+hs0M@s?=q2kX_$+)t`1x64GaU>uc`cq+0In~A(*_YIp9vc1CjsWP#Xfl1fB z^{E|&b}a`;hLi_ES?rzBD)f)$ax@G8Z zDj@-fdP|WQV{zL5q83%{;q^ynQ-ij}`8mdC)#ha7qaMu(30c8dBPBZDxwPNr6w!Za zi1!p3r}o=aM&bS=aW=7d>Pq6@FYcc9_sgiWwQ0m9QzJiZ=O5k&N8Y(^bm z)7)yTfWoY{xg<8j7`ti4tU*I=R)bp~4tcPn7&+#FOqQ2CtI6UYb4wYKB0xh(m`KBf zn_Qjk8nC(>>9T)xRXmnFMW$gyiO52bolu#I>g7x>A6{Cgl zM6E_rm?i!$X$nu(u9rxGw%Sx{p$78!7%$rN73H{BI2F=_$z1I{RR2!glO=ko0~o63$+r zKv(Jh#a2PFl&Vd-Iv0v#sMfY@lFI<##W5vzXFs3aXZ7sgqV0q)RiYVxC$Ou<59W#A z>&X4#F=TAO$BoFC*cC{9V^Qn@38!&O);`y#x$q{kIpD)aV3Q6FA#Te9kevl}^R`3y z5>xa#zK$SH6vmJX885pL{-`Y~%)3zJF;?z2&x2U*LBQ8qE;G93wy^U3_$Pn+7;?tj z@z1aHnp^wfZl(lht;>^YRJW;^_E*8exHg=IkdH1CLak*GbXeEe)rt&rX9W!IR91eR z3Qa5Y0%9{9TG^6lxk*)r>hDs<3L8`C^%;D&ZdW+1dbF|T^7>6KKzQ}Y>eozY=s)3V z$XwUgbO3I_b7|<%F-KPn2GF;)u8G|vtux+dUbXQS(yh@^i$*N&)l=9l!}uEKDdnc7 zmV4Kd?0A0q5ar)a3T6B`A2&x@5(vIGrPs~P4#zHF%@+nCYm=om;(0d!yOV~VRUPa1 zPS`fza)WzzoDW&T@{508Bz{tRe5J^>E-!wa&lguc?w@;Zh+lEv7faZ7%qJ1@ETG{l zOt7)^=>Gdj`cE)^cL3q_eu)<}Js8bxi99sV!)Nc)PkE%bcfJjF+`rfXpWUBEEy!VK zBTlt8_hS1G@il~t#m4Kw{(c-eu=zzl&9}lk{v!1}VgovN3U(}YD9G2+?*e$#K(;kE zRBUf{j|=x&X2nhJ6<$nU%hLDxSaj6r${2}LQm{bVG6ouNz|zQ#er*A2tVWs8UCkNm ztsplmXKchM;=rr{*Sco(YO(@1)vune&DKNKszBqHjdX%eE63=}DlIM3z}n_V2?@~N6O9?@9I#4Q&GjU{tdrzbm;v*zkbH@#b8LGTwkUT$1aB;MeMQ+mt znV#w6djfA!=2R3y6lox{s1RNcG9FCGYSou40PMvlr)C+_X$fmGQ@Y}wjsehxRJy!% zXewik(#K_PaqIhQuwbvmcpYsy9hbZFpms+2tthQ~bMESg0*HJYuK#My0UY{8=K;2721 zw4UW4PNDK!$V`9WQzVxLw-geweN5{0^pJ4sPz63FN5S=rqDhIu7!Wyq2UHdR>c9rX z3@-C;jA$feWg!6`L3$aOxixwg9PkY#@d9$1$IHdxJo*!?i-gkSmL(mQ_Q0 z4V={)L})Mtm*$TOLGOnn(X8;!)se9BwJWdo7(mri%W z(c?|}*O^L=^MLfl?{&3B&=PYH^~s+LHqLn_ajKkh?i*)E+4W=mQeoKD`4>gok?Cvn zA9AUXa8U*b>bBQI-=~hc8)EfAQjjI#2H`5!`T9r*7=0rneqXPvfy+Nbw&e?=j)~z` z?Zj1RS6r+6mY-$7rvs@QF5aluMzglQc~1vl8XC`8o!Q?_E57D!K3#A`FmhhM1@}!@ z{iq+ysF3IHP&fAFbd$&J>>YoP00`9PWMDH}GK)P?L1 zzmjPL+w@&Wit>f2GgYaF5re5Uib0wT7*gmoOl-O9Swd>0v}D|4uYBC_Ybp`?^Qx3{ zPHB~*^zlttdX(OADyfji?L1g7$n;ukIn{K8>*C4p;)rT}geZd=qS=s@7f%aTu1Nj; z8>!krUO%Cn8Z9*L!hXopAJ^*SVVYFcXoCZR2&jnnXa0~5Ga8^u4?m%MWbyymGn z(Ra=(S!)mJeVz}`RlH_g$KQcYXP}RJ;JaXOjCLAyR@IG*6&l-Ygex;q6=Q4Ks2HPG zGzwO(js{@Xn_&pC2$>{ce_-@IobOWtq0e(SulW2MT(;!tAsq1l<-vK3?y5^sQZ|{V z57~KMVG2TR2ab_Rg!l^GkFD9VISp5rk{WXhSyqK9f>qA5mQTDB4r%1#XB`S{A+x2ZE%>kce8SS26^-5Nx2M3S{;*_LeP^cDgSQcwx8Q8 z?iwfiEw5CKOdht8dYa^oG`O)3JR!#(e)qoIc3^T^oiirIbnv&Ax7PR!S;E2nVrUPe z0w&N^)4ROu>3wqXy{zBd$SeB1-ahwGeq&{EzpRhe9unyRvhj(&?k_re^z^zvsd!%= zN;@?-%Kbh(-_bojroXYW)|wi{2<YUMXZGqc^Mvr%#+r4K*dbX@3J9w6P0z9$?5^`oI))sw>sTc-EWd#> zP2qHi1MY0xm;Dr(hkf3eOF;szVW6xR^BXPKT`6kr4UPG~&kH^1QM>Gs`V-0$> zxaDQwDRV)nh)##HGncTuUa14sh!vY%Z1ckx^U(JPnug>NA&s=P%&>x85Kq|%uPihd zG6d^4n2_MDG-0|Ejr-~ zLMN-W`M+D4z$=1_fKgUDv@E<<0{U=Plx%ZN4vASLOc+%bI?N6$O_or0`+C4Fsi=Xs zY}D{8R84YJ_y>flHT(EtDC}o44J`<>wPug>kw3QK{9`Z$o6Yubr1ocol+4$TP&^kO6b4{3vcFv}!2^We))oQG@wMM4H*oyj^-sSc`%K$=Q z#?=xVG1APXklC8t)$qj{qSfeCHo9<`ck%|%n-%=xBvLN8o0gQl?Qr5QUoVrY3dh=x zW4ov8U|%(f?5g@3UyXn%=Z+c`156^5?F0&}D)OYOyG3=Mujz;Kx-2g<1pH--8ZmTV z{bqvNg}~N9%4)|Ai4`p>r`n>YSGp4^p}GeYTmU&|i;U?YF?EZYwpgk8tNng&)_S8QOA9y>mIaL!( z>hA_f+U@hTYm*ZSq(?ZuIdLCc8G+FyZtdyf;mvuUYDCcz$yPC0dW|v*u|T{<@;Bg? zudQl&lSUlgV%W^_Z*uvyMBng`QAhtUlw7rM?Hk?xub!KqeBReH6de zv3@iHA4R6FRog7mR{>E zhcJgPyRdxR3aV-gT(|$BIC%Gw*~cG!eH*$N$kqq#o(46zv`=6J$8s?v?z2t!CLfGG z(1jP&TC?7p&Ar~;xwNy_Hn;b{H(?tC%9gh&EO?IF5s#jzDb68@aalf?4^7X1p^Jxd z8^cEYFLz245ynIQTLKsI6&OK=d5Qhj@`qr2Yiw-(Q^b6e+Bnv4t!yxl`JPhX_y_rg zLpwWbfEofAeBy+I+)ID`Vrm(+1z?7BCgD2gU#bf|Z)T-)FAWV7P}`kR_n6&y9KgQ{YY@?k8FfY@|TWIwE`~;nYzc~Y#4 zOYp}T(4fZ|bodQnuV^)7xIN)Fq<_Nee@pU5tS5Z}Uzb#gkG=8PT9FAHQG>ugW(b2m z{y6s%z5b0K>Ock&k!QOeYnom=zdhdhHwlDBJVv5pr6)dQ@I5HemR{2KC>%b&R;JMvXYlsS^PGe8xle2 z0vj&2MIj`*2=Q4I40U8-<|ZWC1x+}0HghO6@&$!`nLPf`mP}znfRGm~+8U{Vx!xHX z!H*v}D8cG5rd%A@Bd~Wbe_OZX*z`Bf@neqUpn~M=2~)T3VmR&p#3eq809|rcXmrCKXg;}{IlKOZ<;-o5 zOLZTm1M^IPc7F=Y+$$DRDDaOw&io1KpL3)kW6q@oPc_zS*U zo?se~cQlmYy2`)b2Ffrz%gDgAz|n+A6^;2sskx+BA3@ab(9%(GlF)~RK|xebA5Oi% zR6fxB(7JVk%%+6ElwGhK(3rsc#T%_1ZyqCqze1!zJUuO#q;>>RUVTO%JSK|Y&M2HB zJ_3bEBVe$+r29$wB^VQ2z`-Lg*||zQWJN4_Me+j^xUvLniN>}u>9}4@41x%qf)Ew( zV>{l7;(@8YUqQIuBa`&sHcfU%enzHQ{j^7L3(v~w`#zGbJ~`abHc5?J$DauBToLkh zloIu_!I(*rf;(X>M6UG8%xOEYRU!bi2a-gKC+>^uw*mB9!i&qro z%&v>KO_#peUJ)Va20>hopHEfn>Dq8P)u5T7aeDRtpv+QWlaiA>u(BW&4}h#~TY;A> z0YKI_q&VHGVy%X!poF$a2U=q!FLoc^y6p|c;B>ju&oujHA{j1GLN(u(0D8(dZ zE$j)Tjkez_anVWJCPFFcx-b$s+tTXpBw{x2j}`lkm~fbO%#6&GsIJV(!dTdartT-N z%7X)QpwlcV%_Y~Kiy8g-6A0DFPY4oRFP@b{IT|Th* z834Y4T=&N!3xw~=e(J$sTUT^joc$LNoYRT_MfeQ_9TbY(RDkv8_Ow19Ke?4yG3 zNvz^&=Dx)38~3xLhV(#c%t#CNYuf_x9&v9lOO=oczL;tctN#u5Xa*a>k5F?pGFw&} zu~*BwT%)_8YE)iMhT^j10W03}`!n-*3*`7HLj2(9`B0uN%9jqA?6a>CDbV$Uq7JSw z{#N-H^0Y%mD4|x}jTN;=g(Wd{La6P0HTR4Iv_{dgYB!}>5FFC5^D6mg3Y|#3B!Q}= z`T=-WPPns8&NAUeIENSkFU=SU)Gzd-4uiQ55FUgwbltS=Hfgo?ga!9dDBWdTas17MMa6>vr%MZVv=>_a4WSzAcaOWWa^CBzt&E%1LNMd%ig zqS=N>eg+JTGZoE0KXC2;g-1AsNNVGMeEvICw!k$`NDM?Se34Al4uYGqEOJw7D)C+bJnwUUswo!wp)JewjIWMSKcL)O_4NN6dK_~cTc z+WI`C={gR2O;2{3VyAzmKOM${ zmzt*6wF+@#)UH_G&BU4NE#%c9TlDIlb6tcS-)y^A?e|DbxIQ5)xD+_3m16Z=32#D) zpu>}r4F5=h4xDaSOHbrT?kPY0E^F0kDeXpnJL~ohOn!JrbO2o!IeA<>or~_O%5Ocx zS0w(9FGan|wwPx5dsq9@S4i&AZ5d8PV;2dB2>`$2W#*>y%7P0ACGw1B@==rGGA=$j zIeP{tcQD)7RM?+@Gp2T@pB~eWx1ue6y!~`9KQC_TdI{BdjQ_`5b#N)>*=lmVa%&&k z_nWxHV1GU`W;>d0?nw3tXMt#1$(UuZfz%d8tbyx!@`z!5&@i+Pon&5BMFn|vi8QPQ zgWQE%2agZp$H2MwOs=g5=!qT?X_(l;XKrt=aP)83%3tZBO_u}((`ijyDFljn4d4{8 zIwa-9WD%rI*oM~TJV!Cg=8G^Ek7dpzRmM6dGJnml&=00oTWQh+HSm8{H+TAX07z}a ze1SoJ7w!2TN~3C5#5`rc_y>BD_%f+*=z{KqWu&Ct2`8v0H|9Gu^QjAuN~hq>bRzo4lntuGXkY6 z7Rn!YbIEl8&MgW1;81#zb~>x!K1jgNlr7acdZ0XTN@ov%0GQK=}jcldBHehEV*Cs%i`KON6Z2}V#2bCjauwpp~i zGE>ssf&$%PUyw> zMs&df&@_$J&C@tnB~w!&XHqJd@HJa;Y1IW$>v9#A(dQIun<(u3>KZa*`Lv1&6=mn3 zd!T1b-w5a2*$m;j{_J+y)jGkU^o~Bl&s>@)NQ6ujPpDMy$H{FB0si^o-Kl*M=g6NX3Q8&AURzc}BohygFCW6&c^QD zs&D5R&z#vYJcs0;GmkKhjFVaNKhngZ=a7rJ`_CyrDL;CgR-|E2q~y*71qHBCEJU%*>9#=krFBgMRNLYgLo1lTCDedlL5-u$st4D?LX&>wEG4pme)6S3wK!+{0L`qf}-W$7vkOFpPoR^&8O! zdqc9|z_x3Q6r@m7xtRWk-dW1knoMbuxY@nuoDVpe^KcoKK#Qz| z)ycfTHQX1DWP@6OpGxYQl0d*4ir&xq8KBjF+c!%_3TTh8k5AVht0yf;A1>cr zUImgqdAq#b{MPpm4D3#{Ps()tzhB zQl5X?WKyv~DmEY|7gZQiugdIgvKq13Nw5?pr&aI%7GgX!4ES2i|N2)B9SkK*Yj{-P z`T4wzSpW6@x!$$7PFOzrWU3gs+Oi=Mg^Pfy981olSbeK`G}D6 z%PGR3V>Yx(Y4L1cNzP#)@$#;sr(DoSV8jc*uCq_LMchq_GMHD%`XKs_qC-9@J|;O?=+-HHo@H~8Ckb0xdWR1UCW zrt^$REo@E?eKuvsD(j3hGK{KB^rEZ#=uEW4-ek5Iht)2qui(cf^WU~(qL;zv6$KNoJ`nb$5Cj;13=qTWld ziXNU+P2W1EN6Vlo^fDWv@LY_cOKIj^lM5KTgrZ|&t_HMRI5}0C&^`Kg6pU}7@IX)I zRNTnYBKdyeea?PI^}NORe!a%e<`YiJT!KsA-ica=X_GeMoeO+{^0DS46a89QC_X}A z%==c0zk_76P_yW!S=?{52!#zs<{ZR0YfQDNew0wy*?LNaD9n@?3~a_lcRE=C&W^t8 zKp+B46W+TDHeX-?xDWO((haZyFZLYC3jURQjRr-S2JvX}*AQRMsDTAyz4TC5K=$~3 zwV>^8Ky3)SEA;Ar7}f1@Z7omwK(W+`a1kFWp+=epH6*NE~`zO4i+&h`FUgcg(p2G49 z*|~BfLcWWepv3>4grtqaIGWA+DpJDNt58>;#=VNaH8lpIWg11htVhJV{gWk4w{(;$ zlU*SzPLi`6`DI>;Eghniy^>S7mtm-4CQ)wu{!kg3*vMUTquTp}u6@(B%RNHxG9vH(F~%}mvF}%26e3vp zWD^@b^hq`cvuy;&V@Km5F5!hM*ai|9yt*ymTTCl)9O94s*V3PwY&bIfXnD++mC->R z4QPGcBMyWlLMo84P?(g)!?={U+%k(wJAMn8RWYBje1Tf=GN=o!^!ky#)DyKu&&POePFdywd8NUIwOj^dyihpX(5DmWwBH< zJ%A#W084jsoLrDO+vmv55_7l_yuG01F7K04jNrIMKsA^uxyTjj%24waO_WY9r9b^^Mf7z z>95Wqe)k0>>eda>Wu?ilO2VgZHy(U&TFbkjwSzAR%HS5&1-na;=Sf;&Hz|&Llu+|? zbSPJLS~}A<`e#W_`*PTFmuHPS5%L+%7u^rnR)9nf^%&GUK8BNq{Jii&tP(Oy>Y&Nu zB)$YyG4yzcg4lvWt@Yts{e>cCe)$>8ps>A0x?hvdq?DBunH3%5pA3V;`l;N`*s-R{ zS+)8sFWKL-E~M&9DEyw~oO?#V{4y1ikZ!?ndQ?OU6TtcXCgOvFz&NcH`}qA4I{NL+|MeU| z@XfaJ{rKy?Jh}HX-ZS{BozE`Fn=yN7mfgB?Ip8rfyi+UB2?bnH_e#Oqu`Wyd{9vzA z+?v0K@wicIOrY_1m3Jj_g`q_mX*P~b=O2$HXG0Kc((wKr-Cj*Fj!C~-8O_s6WcI*j z20-8*nw;G;F|+<2(W4-d-9>W<)42kSrVT&^Xe|o^vU!WKd8Jt*crB|{qQcH3+$Vf9 z3&S5ri3)7B`Q<(`4}om88C1wc4mRvG3j<`Cy>`bR52o|SJK`VUW|K2zwb@Xz-U?Z1 z*Qmdu>b0BH2PerFK8&!BLxZPqn7JaV8Buer@5{XdK4~M?X;4yd z?{c!EBgR4fTeXnty8oo{ zxFGH?4ViZT1eIU;G%$YZL=+rU!wgq3&zZ?>idxZ3P%$$QIWjr9GBnzKl3JTfa*LK~ zLdVN((ZHZu7(w<`71RXQS!C~Be%nLdA+Qlv*%bxeV6)%WKO^caIhz_A8xC{sN^$XH zB3L=c8S~{}Zh2dtBciRLGF^lzNj#f^Na-e9ZGmA=53BTxuRQU$qmk!J9{46Joe~p{ zt2wJoxeX8RV{iXoQj5AC&(P&I+gwo+G8>z>Vvq_ux&f2@3tZW)c03k~MPRyU8Qbg4 zc3dAli+tJc70t6{_++0=R!&w0avLT*mR&IOrkEK7fMz>Mhn=$`xnG(9%SD6)en4|b zX(ET+_gRUC1i(exY7rqtAJAO8Ae;T9c~*8sRuf(xj#BhKTIb#m(@wuN{JtYeLAZlcTxXgcf$wp0q zzjCXWn=6s4)9fyIl$Y2Graq0DO2C+*^pV7LIzb7yS#>~(GskoZn7ec(=|$mUOo-J zKHhgit#zx(=Qzl#0XK(mOuUTyyYH_gDj0)Z!f zcK^d(ADtlneE{VV_T68QBK+_ApQa4}P~HuW@qg`||M~oYkpDgaxbfh5`K;Sp^Pb>B zbFYrOCqlPZPzl{t+`YJ=-Pe;?PtFf|LU+~Nxn5IcpglcZe0;usmQo-`jI5^}g@XNx z1$|baodJT+h^Jq`TRY1TuHPq7*E?l`{nEK3Ej-}BHjC;cc73T`Kbu3&fDww;!#&Dar(!&b0{F>$EMKh?*8Ui>$f1uz_Un-cFr?Je&N|#? zvPQLcrVMOt8EX$r6S012FWuYAmDwkPAW*bLj;rH1x(-9~%n#pD@~i0os3$prKSUJr z2`rE}{8g&d0h#BBlxEgE2+(Mk^jH`{wwChpMBwJj& z+_^=Y#+?@=;^iBg(tFk+@x=cxTYr9wiD;iAq-aX63NCV#^)lh0Xl_;c1emHCQzV zW(CtlcpdjjSJKkpD~K=S))E-DPXfv`-pT3lPX6~hp}k;9t5MY=x%cDo#&mZWF~4n2 zH(tNUGsi1R8%4bTWzOU;$Nk7 zkda(MQ>mGSCbzk5dVZER%Lc4`A-XpG;6#2*hN;aCJI9dCSTj~dD-gc9Je~Qt0^Y?J zA?IhjMQzDpbo7oXI@RSAP;Df$3#1N{bBEjjz)j&5sFh{S*_4uVx@Yjb&j9~J z8DOceWu`Zf@yv=-{Z%+2NxDCy)wJq8Z7ACHPp<@@hR&FH;@MNE&e>N&-{@K{8#OLL z&XHxu$ipQGy=R*Qtk&?13XWq1kqrZQHA>LXE~FP`Jf}HcjYD~q6z(db_R>PP504Mf z=io?^G5SN14k2cE7FL}B&vqK*eATw*`>JOQz|a4IwuJHHzFhG5Y-^u;BI@Gw2 zXZ%lD_U&nFr=HQ^J2~&;O+}ynda2i+?mxUoEr9Yo-G}U7P=}m7b!Le#WxucQy zanpR+=0@J%QdJxWafDTML{onL(6g7yjMxxOGazCgxnUnx)aORea7o2KWqXc1{5evd z4$-Kl5Ze*ZT$^M#6w`z&C9OIxH-`E?X!lt=CAdVPU~_t0(^uo6?+>T6F|EO;);3uH z0K>9b*_B<8TG1%_W!EgyhP28w0g(P~0*VA%`XESFu^d4zYAOz&jaYMfsMTPO-- zjmr(eP?>zP@%pqfHcJ)?(tEW8)35BPk#Cn=l1Y#WiZpc$P*Vc|y1cOn=n@gMV}0Jb z^)U6CFD+xIuq1%M-UdSkNv&L(%RU^k=WAdd`lY+%^<@axkE9;5)?VwArl$AmF#wkR zYd=asC$|f_ebGQIMfO?;%DT@cRkOjhTu8oA;I)Gy|54^Kof@5IxI|+E5G(aMIla~_4yg(dK3Gluh;N1P@_j$%> z)WQfZrbcz)tMl!iXD2KS(Di%nkq_VeKnL^h!st<2P3913lpqoqG~XGY+59`-Bd@ma z?){7Nj8#axfC3quEVuR61gSq#Ef0pfbu%Zho3Jou8=37OfKf}0%1?J0bN|kKPP+-G zsw@Vcx5R#rx0hc)$i=w1=A2K_S4ApJdlgtn&<(K#u9m#O=hI`?KLMb} zJ;p=)T~u{OT$8_`yeZBQWb^BxOaz-`yMHb{Z<74jy2F)huB-(Q zR)=_S0)ivAk=>0pv(g3XIgQJEeSALTr9(R;3H_xNbR4x8t@^Vl1&UhYIJB7ChpB`r zHB?wYOgS}wdycb?IkvkdN-bvDhmaV26H6WL)G6eP1nw66ZPZAQ4o>1(S1Rg2l&hbp8@1@*sMJk zQ1&lrIXF4mAW46PAL;dnIX(vJmkqqV+W@?8$0y)(%$y3CU~>qX{F8GHo~Y z4(2|(Y2UtCZD=*wDBl!gxbB@asTb8yC%;>JUtyLWd7;(luB{THO$QW7rIPk#ax1G! z)#|xw6ly4a+_!Kr-Cr1;ic-Im96>Pa82k$nAu}dm(gvR0x!}?YmW2zE&`~4rOI?6f za8o*BdBX``F5p~*k{wvmHiI-gG<-{HZ$>%~PcKJlUFBbMTO6z9O7M(`9a%JR#65^> zx~!#HNaEV7?0fpg@tozTfyvv%VyuNv`P=^-F@VwD(sM7XzJUAhicWjeSisxgFo?(y z1v-w@gC^Mg0p_pLFv$Q;=1Xx=>9eW*ZPOW+tJMg@w~JS^8{MG2w%Y6&rGN65CW>C9 ziz7w#UOifG(EYs1PT5X1?D+3N_g5sQnD~p#LyRw4fG>yeEdNaVN51aVOA~abCK|R} zMMAIwKdG73qvm5US_GcdsKCAvwRrux$H`7N*dKngQz7YxLw)`D5;`p_RauYBy%qVj zBC7RZfQ?c<#;hZ9-;A~WDG>k5GRHYGc{d?x01q7<{yUSNr*D2}bPFypv z9om?T`j%&{Mgp7E z?kPsHI%iwVDcWnFz`hp)HK~$AG`gB~PIWP+R}a@XaP=gthRzxCd9{mO?=af?82W!prkXzXTCt1YQp$@ zoxQ9V%Qj@F5t|F=Mf%j?_OG~P)oZexwm`O$1bu!Jm6F+U28+kfi0D(PA6Dw8g^THuFzd{GtsXB3Cok&mkZ^eP zO9I{9D<{XAnVv59Gy~5W=AP25_^rMy%nNk_=)s1OgGpC0z}I@mI;>*FCa)XR8664~ zeam}775YliVM0^)gK5Sl6;PNIdKo_b?{m+D4DKXBk|XGpL1UcS$7jcH&pl@p#*NTz~CaO%{6_&f$vz$JNM*sl4&^CY4uonUDZD7EV z@++npzsaXEHX%Yq@5%2&aM-s-6we=~kiFcX?;9+(j@RA7s*2eKowA8Wg^Gh;sJ%cS zAxR}IzORp27+vlgWA0vPal)`4qgHDAoFa3$EOpASzVz) z-%Q7=;2(mAdAqH)@H8&1bLwXkhhrnng??f%x>|T47%jWwCq9(0{M2Jz z)HM8wz2jlQ*lP(H&4iS+pfX^7OH5KB0;V*e#_-KNWAI+!`!*if;Z)Ww#gS96gb5gd zn|1zHe5B@p3lwS4CvIrRhVHAUAyJ6qVQmmRw+?ELRMe40!o!ri4)zQ;g?@KPbyx3x zUjZa$zn-p(#S7cD4uMl~kSdBJV0tje2_LskmE?wt0{nN%lq5q81$a}Cvm$L2X#t8- z)dJBu<9*!x-BGIs7o@I|YHIys9SR0m43IAYKUOv`38X%e|XU-E6UZNAeyYa`e5uj*nLtgWm9H`p3~ef zCv}o>JR$Yvq})2?M%qa`qTwf2Z}Ob*Y*j9?Q8x`X-P9wTZzAZSQ{`Dwlbr=IKyu@jkBZex=(O}kIQa*Dj$|8 zXBst#lzBW;F+&~CL=qiSezWV&ida-8G&X)*JbTT*_yjl62_{>X8L@aIp!CZ@z=}Dl zE);3u_lZ$^{V4hobL6gs9a$Dy!%1$@b5;uob4{)&vt0~n2;PK**f};V*Y<|k-AD#@ z&Oo^@xV5bILU&8^MQ-JKoi0D;Kr1a+k$*^7-H0u}b#Pxm2l`61ANQGbb4CsRe4>MQ z*bxqpFp8+OXMqXDU!Frs6G_t61CME|SOjL^FdJMqK~QjP_fil-#if_T0exoP?(5jp zn=vSLJ5GLu$Fq`O_zGI&f7^ab^_w=P`gzyQb4*qkCT+NP^4mmP)FVSUTa9@bdajdm(&&fx6Nc0 z>jAsqprxi?318SljD>o=sEqN~Pr7a)9SV#&=R{U-+_yw#G_Dz%L_zH~76fvaMJ-uk zefxYHj`U5Z2m?|4&w$4%ZZ$N*@&<>J4+|wM-1n<^otZ@3c&j*fQgAsDO(G^WCf=X* zil87rcfust$!1AT3Kr2L8HNqpSn>{AE)_DN{!c0^Ix^Vk`zv@X;0E{>fKQHp`vpkQ zC1*6?2#Qa(?RRkBh*cO0EY0Zy%^Gi&3oe7^2EJ+3E?DslzT+$suMBB z#alYYyAVAiCyW^l%wnd!RBK%n|9^i#Fdl5T8X%UgT2bpS^^u3rGDn{77ZF<%=20{&60u7!y2PvTP)3FwhLnzsK|ax1sxy} zB$P?Em^_}7QCB5in>P}{sxwHm(!QD$JA8&plhw(Hn9E2oZ6xcOV-k^-N^WIYG(1@Z zYXP>elI%nyiFsC>RJ&5i6)0c%I!DP7i-ngI&}7c|j=q#1-C$|74cgl89xrahTs5Ow8(!;TZYH29T(MHz~g!G)VA1Y)lzH@)N@nK)le^UoCR*A8k zn?|=zl-fL94;wNwgoL0W-kRjqI7F~z@KQ2pv#CLR?K}l5XfdUg76XvUH-m4v4`7T$ zP^pqYJGthhn6C6hv;yN@mFN|RkJ20eu1kCtB9_e{9*z`o|6OVjd0BtXDWL6gZn=du z-iW=MqMfUF(6EdRoCZ2I0=KZ2sTL*N%`u-wwLMo|3#)aG4e_Npxf+MD(~109KdioA z=lb%z1!!hu>jERiGMM`hFe;#_CigjaP*=w%t*0T`tVqRqUfc_Zy@Z4_vIl4K+u~Ax zWR!=THOx=>Ca^ZpW7LOQMqeB(G#*(;P!hNi<5FMwx!2A8mT&dT>3nbMr34vnCRIHj zHK}T?rRM9Qae|MKpN|8T!(WJkbZZV@kSJkarY3pB4CtKzBD3hVfKC zg{vc(FHix!r}@1p2^C*!7e$CwT472?eQSnzPL?m#G^2X0&wfqNW(NS%uhcnp8%)u< zFEM^iT`t?TV<@}h%G}uuj+3JBPc8fm1m8t?&c=meiBUs(RVhs`zzqj;V9Zu;Mz_3@ z4Z|AJ0+@2=z26J)HBL#ay1}od4&pec%0uEcVQs2lk^e&wnONGQ5-79L??c3%blAF# zf12`mqIGD&o98WkW~+59yJr3V(AU$eP&&KPjUj~6>`EO{V&%H8b%oE89fnM=L zi+XY&Tj$>;H%(l2+<_1uPa##@dcRbFb+NE+yq$i5#1i%L2SaC5x-DcN9!^Zd(0rq+7DS^k>Z7RT}Fv^v@ zKLsp9X-!jC-GB9dOv^3xda-&?pHrn^urpT8S|GSOJ)vW78d}@o<1)Tb9ZZI*=k!iN zBq+m?6z$9{lnyr+z@{c4k3L2rfIEwBo6KHMshNN$8WATQ@3xqDG{?t;0e9g7mu8rn zYZeM-(s%q9PqVcNFEKtvWP!S6sX<3m!Vc?a%{&_DJ_<_O3_?*5m2bV7p&Po#U*v7X zm%DjNDoCo0v3R0to{7=6O zrSOE{?$A`D(C~jJ#l)_a=fN#xz>g8kGUCo zDNnjJtosIUhqR}?R%-99q-cptq#TnG=Nve52Maf-W;B4nQ>Po(1TZ_+P1L558F6Ep zrS@GLvC*&Nk6)}22_SQd5LnA{0QqMy=s7G(7J$nKx%RZsBnF^oY!Uq^OG2PGsHjl0 zVq;qNrQ_&4R=875fS0Z_6cb{I?xMl|t%r*ASX<#;2BOupg7hpUM=r+y6Wqzo%@E*; z&W2DS($JoOq99qdEboop0wfJQ!}3&ss*#0^-b+p`U2W*&KiwqqH%bY@o4V`ThPBSd zRe2$X&l0^ZRUzjvIBjTr7=kL1TZP{^G#Mj@njAeyx9fk(w0}a<$_m0DJZmuQi#^QpRj($b?d?{rDu9#Yb0UMj9O(@7#`_wUCcQJu+8Vf+@Awx@xU(#UE>$r&vj^Jbr!7Iir%(= zh@>2vNW&>(BHHCium=7mt$q0A;1b&T!48G;8SeF2OF(xM++BYa4KO*Ma1DWF=xKj* z(=R#&$^21$s!%$Zv|Vz6TPa7pq$&|E+Q89)lQGrJ0C*6DQ8C-OX*}~?%qiL~;xxJ2 zIAa&jQ8Ha{St6AX77^G~ygMdTO14Z0C76^j9?d;JD+kP!aOL$W0joWiw@)2 z{wtFmY=SS+?sTN5K{(*pho4sQD%u5r>A=<}g(BH(Eb-Flnmg!1c~@d+lDP~ZTO@R4 z!RDBewS2L+B*KyLU-`fi%pzkArjPt#wQ90YG_uppR`V)y>`YRn&!@nfMvyI#{ zK9+q|#>qcUT*hQlSQGJc^!TV(^t{0SHSMy0tHu!qB^fb#%VH;V74GKx`b5sQdIW zj#vB&2C)E3S{O-B(hd3qq}0`Xu@%e1X*F;7v`7Ht zrSD8`-JvOl&ykEEgWYMFKr9!^YzdET-*~lKW`*u~b+4S%OPo+LZT$Oczp6h`wbrGi ztz$w@sDs(~+_Ltd*;K4B7dtxn%LVLI)=Pn_pi#CYW3x&pDH#RUap-($!11xxU$(+Y zv4x;B%i=z@?XO?cH0#@Ha{Gz2k zl{>G8zbY=rxmt0nS1&#C>T^Fq!0$8{;D-CKv&?bYOMK-r7oaqqir`kZ)0L#2%*bQY zI?Y4$kOv(b2^56o(9CFTSb*rsJsvf;z7ccw5rX}GQ;JsATy~HnG6*DV&uxL$zZ9zh z%C>tWq1*L+bb~}2ha*NraVlNhuMT0LV3>*$WF?s<)Rrl8<~?ZE{wxFec|66&(dW2x zoXT^!+Hceq1pWxR!Gq0cehMnJ#z&3*GgqX!t6O#Iz%)%3ge6?rjiYGL3=Qh2Yy7ly z5v%XH2+=iN7MuKOJ!Gkrp_Q@Y^mXsxX!`u8Z-1g~sI@3Zp5eA4paDPB42&36aUNlThlnlnL6c{Vk!a zC(G``LagfcqA`FWMjkmh!bTd^1wuNjMXGgr26FO}7IQ@zb8%X^c#6w3u@Y|^9=12v z(zZ7@>^lM}Cs#cxKMA8ZS{IK~Wd^}VaTG~kfixsoe8r4IOoJ1J#pVKJ5C+1P9N$Xi zOg|>!2Sc@im_p0UC*i78Ax!N!Hp-(szjkz`K?#&CdPwT2uoUr0;i>RIOH(Z3iIW6D zoSp8*BFRgR{Z>kHgz_iB^{s5ZorH>H%BpI>GDg5QU!BD~h-3y4AZeZ0b>$C;wb~V9p9P)bBF_FizE&KY zxAv;{Dx!q{Zy3#ri>YyjL1#ry9l{A!`gY#D4UW_al?xo@6szuaE~l;+Bp<|b4tr)r zgZp%AbAdM9G|NWUQTuR(ox~&L)z?|gnUiLw;l(}mYZ0cZPoQ>d){2EO#ye#1+0c*t zRU|hMQLh=OfLXAQqk^tNif1gJ!d!1OUAsVL^-KjK7VY|uAUc3wF`nLGWU4o`PcEo& zxOxZ>J+9gfIxVhF%Oc`jNJzKhC&-fmkV-}dycz@=tTS%VdBsL>N?StgFK7l& zjWzDDT>IZGZ#2V51i-vQ)&fh0panN6m0%H3~aM zdxGuJcPa{aPUkn`Z_#^b9+8~mHf*bpvTite&cwlxd&Q(}zM071HbWis2;=59&c~7( zv1zM+!_xS=NGC0dshX&q>p9nl#lC9f&j5y8>boGK{j4un>z$SWg-zbjnI>4SGLG|} ziH5s@%MG&z9(|q94%(AUz>ZaZ(ZDr}b4<$ko_LP;Q@IHm%NeAEF&2 z7xQGwsQrR>kO$>#7_Qi$H2(YF@Yyh9Pq)4N29yl9YA1B^J#dwm<&`MwaZ`k&Yxr}y zf+8B&5jV3YHIn$>I19wO6fw$TXgU+=C&T7y{5nz`<#-D6!ZkT93M4N+a1F}TQXD6V zZ)oT{ekK2Co>Di6+0j@N;3gPM9&qkrkO=4+;~6uEI&+DK2|W8Ri8Ti!{5C)6Ga_q8~;< z&YIoJ)iTdC)qRAPfU;vcPowjh+@ROKgbLNmXr6B`5MpIQnwYmw*>0&yqE0;Y0k>)~ z&ghvJ5j+m}VXcNWQN-lNTx#*F!9h4JF)F9 z$0-PdD|2!4_-INF<8DU&;)AJ6vZ!UXb297SR`77F^VGJ#?f!NP|G9T;)>&UL%@GQN zkmriPz;W>0sj(4$G@Hk@XOTg|T?pwd*x_3+Po2wCpmI0?lwnedCk&Rq{gAFj8IogK zgP2kycuTvJ9J`PNGObw{&F;tY_7TRvgXEwKK z$2g9!s6T)6XS5M9K^}Hu!zNau?JlC#s-;4bdwmqtAJRO_Xz!((EpLCm9K5%~_(?qa zWRL9yrE0wis(i-)BS*)XSy1vXKsVotYj8g4&=C??;7*#3q`s!+2?wHt%)*{$K3VCQRL36*P;;7<~zq@iv+ zPjjc}fnlhHrO2hat82=w%Ywe>d_za1TC{R*jVPUlqsS5JT&LPIp98R;@evN3w@#K zi5Dv*0|p-A(!|c^W;2_@oo*@t)k@Utx#Vy8;hw5QYb;?!M!Xx`6ZP0nxyXOX`G@r; zw&lGlo~W7$7-lDF(s-f|>rk4kFZwkA8ZjnBqP~HLZKRM*%~9@^nM&HG+y9~Io#Pv8 z-v8m+wr$(CZDVWO?bfz!bBnEQw_DqGYX5qFzR&Z=nKRd%NhYr(bCQ|sjY%VU(Nu5$ zVV%>AZ953ZoV5>EHr5g#4Nz*CwBp9VNBT`2Ql)%`3gAwDuI&OM< zx#E*wFP>wd;J&x?@)D+=Q)mT=K1-e1^(xkkDz%L>)bZ^ zS_1+ean5=<(1**A+g&1rKwS!uy)O1;TcIoQ-Kmc}@_!F|t7Ebb%jLX@%W4!t<{}Fy zt#pqS@Uw}t-Ol% zz@l_#WKz{oPy{<~NW(k+j%Emh+gV)~IAtS$F6SF&l(@~LIPK)7oSJXKoc$oxn+KnE z%%sO9zrOH4JhFiRo7%g#IL%09at?AyK~DCSXDulG7od=bH+(Z{rc&~rkgrxh^SDg~ z=VD;!#FqZN4dz$xKu!-qWt|XhlILmNi9Ch$WM8Gt+;KTn5wx7EtLO^(5th#cuAqFm z+(?Q}DAn&y!CZB%u?eF#Cdi~v_?sC6iq=0}4Lhx)z!}f=X65x_60zPeSHD*vAo8nD zval|TS$M@>o|ckAQ}gei9p--?!J}{H)j1+p&^g7?IZ+)0Jupp^T6M^pjTTq8ZKWa> zUmBp}`SK3AqRZ+G1vO2%{R&;=WnFhO>WaEq>txd^GmCFG#+o<0s%0Z+zQ(0AHkD5| zmMq*^eWd|x+$>2J=FB~B1htT{)LhFYb3YWiOemYNf1Mzdf2H<1-fCp7mrL$}ItjH% zt1I8v}1TqeE$u*jg(eFVn#F zWQi{+Jr#_nIt>Qj*)RA$mFYHJ+lnqX1TUswylStmn#sBu7)IqWSp7Eg)^B(| zZ{IFIwl2ntY#c<}NyZm~<~Q?G$9$BQ)u!i>qKguh^->rz%CP)3OEPB*Zm7^9a$5DZI2m!Y zq3f#(w{5rXs}Af^ZzIk?X4{ks0>JjgFCOERZCl`QJT zH>nnrMhzr5p3+badtE^T`Vbbreo!q3jOTbkfs}+u7^XO)ADSj$bt>6Bxu0P@D{Ux4 z{isUb7j*P6?N5qJ+;=9@AF-SA^wJ0eAYFuHf||ZCH)f=1_f=4RZk>Op3+KIkvrWlj zhZfnFSj-C4mcliEU+zW~^6j~5KEt{$x9K^%Iz67B@2fhZ*eCHDsqijwC2=#%&@c;@ z5LxlqN;FcReU&+~IAu5eyiU7k z@4j^T8xOpXpVI^B^ajHFB8K11Rvu*1KjHT>i<7H6s5cC*dz$QF{9|3Gk^t7SY=vKo zxK499BF^9@nv;;45s$nmrEaQvALFrD-+YHdgKYK#GoH932++sGVmB*qX<;_@QbnotCn}Detk3u=o zv)9iV-|Hu zgl(%ZsJ(=HVJ0To z6!AVEXJ>^EKL&5UKQ?7a<1z1_b)9x@cw>r?;efS6O2#}(O(4k*Aax#Z8j8%Mxt@5U zQTZSjzkk0WN)MD#$um#qZW!nE5U-5$?uB!dZZB)fGzHgdvs2pxb5Ed zsE3A|h0lc94vmX>yB{yw&@gTh1`;$<_=>i!6?75BZCbi?8Ty^%d&nD8+=0Vk7LIx$ zr763!5`u(sox5d~?RbDWSq`qkJN3UCg)R(J{wursz9M?ny}Ar{n-d<%Lg_!Jo~yWl zi(7GV@a>dK;y~i9cH|@7p1Hb7=yk`%AvJcLZD<9>ei4sv(94PW!6pUB-Z zNZNC~q;b0rx0kyRg1yx8)Na&36##Kw*{^`wSKV>{Fud!%n(3~>F7v7q^R)3?vv%D! z)f4S=hTjEI3Ji|@>ZNHZ{D+8ba`S6u>8%u8F$%~YQX==KLLD78ee@S#FJSVOyRie< zam*3`dsxYYDOnbpE!7aHWYQl*U#9he7#~tn@yTpHZSdQD@5d1%6isd!Sz+`eQqD1;d~=woHVs z*#=}vPgczXi4JCT-eA-nSg;fGSrkA z51ZZ7EhQbhkYs_2yS<`M(d$gVY|`6}`Kne};iEhSJn}~50z>OZ1q8hW7pXTD-X;}U zSNaCc+01~IP^WcYOz-|hf%`o)vJgZ56~gDe#I<&k*}=tm0?+zLm@z*bixOd_C~+1>!#y@PP-?%=tx&-z`f=qQ8r!B`wmd9+|xx_ z`Rr}=PIA1bj8zhm>WLLcdC?as!PVSP=M0DSdSSo>Fs-eH)oGm2bRNSb66BJuq(>oL53k zAJM;chzImF9c(4c@fmDK^s)T|1RaNFR@VhCEM^_dH6VvtS$Eonp<~hSAJ>R!p@V4pG^rxkt`3a7RoX zI+ruc)g~%38PFk_z1v3Qt=ie^3s;ayaYXY3%0}oQSiwGh$)O!2+CMUQ8=Ebd zOq$cy7Td`Wx#xEiX$)~8WnxBR!8xchz&I!bDU*kDC=y8J+-vgLJFQxYM=p15;VD%X z182iFNu32kT*Qq1Fx$FFE72z@PE`~(S1C;Dm|gHe%8(dwwR4V6@P2aFJk{&o3MadP zMexY6F3$*bS<;-z z=eB#``!+M*4C^~qZ}D)FOHrMlpD$P_j%5Xaidm-&TVmpZ)BR-`!bcf=*QMXSETXWp)>DVtGKMs>1T!ua zXdvb#wl8^(S%1w7hZLH9&xR)C<48I;A;Q%S8FWc?T?NgTJXt8CuS4Loany3sc-~Xb5rsQlcj(Th(p2?DNyz1SQ%Y3s(`?Ho0 z!5!hpOuV~w%VrDec)IX4ew{hU`*s)k<_EnJ9#)>*um~4uFr%CXRX0Xh?=ABF7Gn*1)E9V z5zi+tQJH$`Vb0=z2y@|tI*^G*m^hrJQC7Q46dE%qI(E!f5qeU32EF8LuEG3zQ@*I} z6G>qCSqjeH1^B&Qyc{}=jtcSiy3^gHY6wiN2etq+?WHhWEiQztG4rpW||<-?9}(+UBD;0ym>LA~ z_Yu3zUJnL-t<=0LIE} z+CFS@pHlLOn6&`a4ut9&CX+N5bWR4R^~rA{L}Zq`=|v5l^NZEZbgxU{O^;`yu7^TX zfa+LoTv1H~(=i)z0(##?!;G3{d{&}kfwjwh)ER!=DVRrfo;Cs&M<-{@-;0lwln_=2 zWY{n<-!B%Qwg=~6WF`Q7#lbS~3)g26lDL(GVLb>_M zP^xfh`+0|aBCfIZPw$Lit`m*3iJT^r$y1g;a!Ik%JuJ0e60WL*TbZFS2EheVm9>=h znGo*}9s47}_nTf-Wh76Ta+)XtH^Y%|??+&fYRTdL z*J+7TjaW1dYV+8+_`8w8oJWhHX>F;}nY!Z*rRrsRl*Rxs@ue9dd38@{EW@eduk2m?!l{GMJ&-;0KBc!F{u2_PjuUa zx6Qn?g@=d1i>7;zddg^qp4${zQjYV!YBSv*)V@*bGE0N)K0CcZ(F%9HjLJ!^0lo~N zH8<5jl@|aIDn)B$7}rzy#0+obom~T!!S*Jqpc?O9Oa#8{OH>sVsiz^Ul>Hz6-q|Jm z_2Q!t3qc0+#r=d0I#-7m4$tzjyn)QgZ}t?^<%tQyR?ms0%veXg4`wToypP7COQK^V zEQlT}V{`9DW$NvA`t_M_$nvBDr(BGz9Gd#L+&e_kt{aoCJSf$Py#fSd^P#%#E5t0b z4q?dr6rK9`DUhRqzJ@Q=~dMNE{w-lSQ8VGs&rXm(nwg)4 zdgovZAh^ya0#I+%2AnAOht`1?Vk7PVbu=|2S#M746_-tF)$Hihq%38atuKAzKY{%e zN3^L){bJPVys@<57h=&uIKRvF&pp_9SiM!uU&L?MP>q_;9+NlIG4pMnyNvUghzgi& zM3nui9o_?%5JZ_C0>)s)cGD1i{n+g<46CjM`3~!lbq|EOSpeNdrSD}GnhEXos~evQ zZ~r!iZ>Z3P+HC@tZME@7{c)pKtprFs%AhlksiZ;c-T$OJj#1`^PIFh*j=nxg*~Hk6_j=)Yw)kIwjZ?<>8NbG|Rm}G9dr{34~$hCO`F7NbZy!-I$PhZQXoT zP02uhwP(^kx6&KQ`j_)Om20bYnreXkn(Yyl;gU9o0|dlz{8pr}SG2ulE6f&?U6I76 zdx#(kd>;8bv%?u;dfNNS);S77)VX>nFRbHa$*m!!9)Es$-j>9UT^_6snd_9TwrdaT&$^gjHka)PJHC!5F5B6IW;o!G^jb5=kXs;mgLz8l1LDF3{%6TOxwC(lN+sKHLsuR>rMU^rrk$<&s2Y6l@3>upb7!E4$2rKkiKJ%5Fws9#% z#RZccbBXc9eNygm37yA^l5eisWW@@tcv{N9XH$?0F~ZB2AY*!C=CGNjSF(_hQVuMb zJiu~utHH!b%KF~5oiRLR9qubt(jz3ykqE?!+rnvjerWUtH=jJ9@k+`3Sx`gklo3K6 zMi>kp8&Hu03(LIXv!>&F7ZRHRmL$5HsR+o-)gl}dfa7wTtqr3~CY@7z;M!OCgzqPd z-r{BBrouEPx(dfuUW9B==r5l>e%)G%D&P59qk>wG+_^d<#QTUp+1+7h`aWw5Ug*c) zT(kCIawv)9fKW7YCu(o3WPmNLgZ3GlWnk)ZAv2~ zCC)=jojLqqSj{1o92*Chdb{!CD ztHF#orCBCQbAj2o%+-ubc`=ig3MpmjKY4VPky-J&h&eSdH7cxub{LD)Z#$whCiOx4 z@?UX3<~SfEsdbBHw{pEOApJ?|%K=Kl1=;%iJw1xs#M>*3!Ii{jBSt(Fgw&W9HfDdv z)QY$Zntf+sshK}^;eXjfFn2nzmma^{gr?^v~cw#q>aSo|lCokuKY!Aw$f<6g1r|l@yc4x?d-cGLfRPxB4 z?UikNLyViCzD75?Nd#5cjBM5to?o&!p_5B!$}pBDfZ5m35p;XEUa1>*);~-@GW^k3 zFKrIZ%$I9ngx#MWnE;M>Tk~?Yu~@0kxTb64=8~>1I!0`{(Vvg15l!IXTO0m&vfqeRms?x3CF;$g}sc(;= z$UtAklGODk$LwhL?(R3w>Td649T}r#N0++@;Ij4OMPrV-VeRHG(w~P_ zRTK?GO*Ej2jIxPL@$3k8biz0s$PG=nXAmWQ0(82wn?;B7*OvVZzHU$=oDO~2?O9%s; zTdHZm8u>>w{kdd29YOindgQsahQ$KNj>JpUozh{66T&rZ0kAsUm=T&vwvT~x8|}NK zVw48VSTOSYzpj1%1xYPoSY+z5Z6lSLM8M9K#)Dq8pNS2UPAX_h*Scj(L`3{@-WRnU zr|m{jVNGqyXFx`mc>JFbi*;=CfgU797Cq!JL3!nl^_v|1IV*0zI=$SrzE(RpM#7So z_+#o1&S284_dI>&vFocIs5#VPF>~ZEnjom?$K;2JslB6ig02-6_xyhweT`qlURW~oQkXGO(GoD z-daK6Ckz!2ka!oILF29*h*L=*KQd{qI)rS;S*BK|cZ5(ldK{LPxR-cG%6upY`aFhH-Czl<7J4M>!oSFY7M z6vCLEef$kUm-YkETXDUJu+}}SxE{H*y`2XA#*aGfLMJ^rS~b;0WFLJlnPIFA?M_61 zV%nyyJW3ar4pG3)#qAbMTTG2ckthe?p<^qkVZ$StA4!-B+gk-;lyrelI-qDL&~@-p ztd|v;`U=+y91ZP9MaCX5wh#;tnOGns&EWpF;Ug!O1eJmywkU-ciL(n%V1?qw-5@%& zWqu(#g!^g9?@2)A?sFHXNR_8qmwPI1#HkB16yjN!=`U!p!Wk=Ra4vONv0>^un@d4C zX$9-X`mvki3mGsKJv0G16rpy$)FSSVuhPGLRTViSiP_}f27S8m_!qOzgO8&S3qL~~ z-K&Qb$l+Zr?@~MGDlCDKya(2)i>Miu0iB)>c1qe{V3?0IWhYMK(2R-^(F8u9dciiD zp07CNUSP`7o?FoT??qD$of_j%Y?_VgY(``PwiMnElN`)abUYkJ1|kr5r4A3xryvNj zM!Bt~$9vb*^jOdmC(m~ABIJ@i#6rrLkN`sF{aRGY*6H?hO|omD4qd~Va`vrDCx>>T zdyQzk4<+41A;sq6^3%&wuLbWS3!ToiRn`O7tvglRIL9CB&bkUbKw9ZW^U3cv(zT^u zk0}E-Xv2uXaovc)(k8gw=x1}_7-UJn&!vAC6+0wHcnsS5fA8}D3Vk~y=e(i>7o~iu z)ACTeA!{SFp|eFj@Fd7yk10{w zNh39q(ZLLshYHQJtZ%rb8ME*24di5s!>o4M$dSARG=|3JV$S(~M6kVhmuQc@7-&Aq zxN9vTGcT5GHYuz7xrB?tN<&1!4}N>wUcVbaWI~yp$k`n9s+H)80E%^T+33P;@W79# z`u{)AHaq&L=Nn%bx|Rzqdp7S?Y47vwWCr!WK5D%WO(}=l*$cYHQd4jw2+ZL?}?tFYj(2;wnQ5Dp%kYy z8%VWv=9;qBnku2&zKe(@p?7iu}-0h!5@ zc;uJ=iDN^sJECi@i3&nG^*?kuEi`l8hCb~t2G_NT>HbRvS4)c^njLuJZNl7~W(oI* z5nuQy_REr=8C%DN^Y;%Z&0NBdLloda%N>@$`Atd<)8_Ua zWUH*lf~KQ#<-b5eQJ$SQ$Vk++5Rm?WVUe`0Op!^U36@k9KTSTE4J!KmrQ9GqgFo?@>2hyhkFV*rveKr5O=E z-(a+w;BuMzE)T)OZ19LXh@!K)XDfBj#aw13`I+##qu z6o#2Fk@RI;joz}S+&d~PdvlgD!*XAB$_}fw9Riop3X%JCCKi&dnwK1uJNO*u=pR~r z1k0y;p(c)tK2U4S6gFk;Xbu1t)Rjm}TEhH`A@G#Y`{F6$WKQGe>0FL5x{h^KS+OLW zEy^S`=c_yWh$BRxz(G2&fNp9tyJEJ1p8BkjD=#J2iREktZ(AhyleeBND)d}j*SFxe zw@&nzCOn^|ImGl-LFSn<#I&3ZHXAFx+1%7nx-cuNrFq9>LFS*I5H2gzu)(~{MA3bE zp#!cYnJO5T&QiroWc?w62K6YIsf|Ik1Ka1Kae`JQByZD>lF_DpD;4?gz_EZp;ZK%Z zaeK%G{X*m_^)7suRl}T`ESPNug?gPcX|5dL>P&G?xFtp#XT=s_BR^L6;>Vt&NRGeA zfU~S#00I}OAg!EDdqfc+Fo1_{hESQNUB?erbW(WRjM9HzU5v$|Md(?sF?xWNY1+1v zz>-o5@V4A*`4E3ZtDxtAV{rlJV^9OmKtxtXMF` z6r)y~l$#Sj`Zu*S{!8YPX`aB{?U48+C|SupVx|2XenuTMLSbErlc8%|YmtQr(v~RE{06sm_grMBYt(w7 z=wk2?*QG{__M^696jz0LvJ|61`ZUBrrYZ_5@9#e(jY zIpxpV-Ic)ZcW1f|&8FwkU8M)2zt@PSCq1&b&psYR9hfJDkWH31!s`#dA8-7}xH=8> zM`Xo&sZh|K3qxu0Ds0>snZ{ETT}Hhkt~J?OK(j=r5Q& zy}9Xsw{4t8-=_dBlW@@xFX5_qa)b=5)!Vl=6$3 zuqnPWxJ<8~(<95TV{DdtF0+X5W#zCJhgg=O0GlU{p@3*A(T~>Mv7dtYOIPfG_$zzE z_NR~fPoMwVSZ5iDJcbguNUHeChLAG+q;TI>>n=4nOiDx5}M9GPqV?+t3*gxIsw}j$yntVTqDB@2s3op7e$}l|segKyV z3j(*d&V)rgaX21-4?rv7FroNlC6wkT`Wc8=Qn3~;D^$2?P90(zBt^Js_ve_?|M?8_ z!-CC?=jgal@z`L0YPIJ-y_f#)Wx1x0?tKBU^bCJS=qAAQUB0-$9YfS?vIV_ zY@5lk28%v6wFUtbZzp2VGG0X8l`f`tF&mCkKK8TuqZ(%o3*@|c{>FN-+=;G1gQjaAyB^o&vZ&U!I@KZw&as*@Oh>9rGXn(V!c51(wSr~_D=FjL#g71`t1lArys&GoN5!}0dS#Zb(nGD&-B;D5C6^pF)qs(K~Zd%INboTLe9 z3Qm8{e|M20)0$0c3mw0zROSO0UVC981q>QsPGxsix=%7J1>2?E+x5MQU66m!ayKEt zx}&(NR4yLf2)B6G6cHQ0hA8ap4debK?YdMMDpGl$QlgfAC z17mtT=)Nf81-$JYg=3zw$-AA8CnZZ~o`u+jLouErmh7e+L7s*kp8?ZYy_MS$!s$|} z^gi$DfxLIr7*oN{p?uGcjYXi`#vmCA`prk5RjxS4LW zbJbHo=>1rfQjH`{3(+pF)lc{Rhl0sts-2iA#zTbl9&tQ11>*VTM`8w4u~BY`64<$_ zwUH}c)`N@#J=U%nbQ7Rk{d+l6+JBk@l7?fZ$iW5ngU~%?5Nw~TGCyV6YvheuT1-}w z8WUVa|FT6e(P>=4bR znOS{+>}>v8V;?Iw)6hEQ=-yQsMWCzZECf(Jng@YrHU@na+dMyc4PfY?!<;@ZOD8oJm{3!@04hmw%r>3$Y97MO>16xe%~BF|nT|DgkTHr14pfka zHOOrREZU3V_QjyG6nQzHlBU@q>)6M0C(^tBnE>8W5E7GAuyi|SPEB+9e?#Wu z(GpWzM)et5s@yc2v9711P+(DfFoM%!Zeh`VE%B)*LFNFvRM25NmE~gY`KzVb?CPsl z7N?@P_jhfQOj;v7!FMv6xc z-X9mAx(&e^ms?M8S!vOHV%-c*eT*h2dlUgPBk1c}WG5cgsqDmw6DzSDny;vo=|X~F zZDAy8Lo*mVB0UDH9XlO+mZFnz^RmM#oC6iglXP6AN**DC4Jl101#Feq$Q$pu0FC)R zt(n_mvTE&@IRga3s3n1l2u~33N2g;63|`WdWw12`-I)*=(63Nt+6qsO+XZgQlISp* zF}4lopwOSMwNG#*R1gOghxyS=m?L|*Y$4>N`+C6T)_I-jhNTZ`YxZkug!>8jK_2B`5S)QjKQaSITA4*9#c&++kN{yF~Tl zFJ-mEtFT$z4b;7+B!o^N?@$n8I2#{!Cw=bRNuUkz{x)ly;>Pdxd%n_0_mRcrC-e|t zTxwxtmj#^N=PWUQa{qTm-Z=Zfj}6Onb?}c z>6u@^7Ycr{A9rv0Zv%=9^9g%Y%xSlI=pv8~C_2#V$X`8_TnC3j`x-*I-uM7J=H{^= zv>&5@w)3VA4dSU&Obnm`|Jg{%nH@w{|6cW}({)a1&pL-#5c%SoWvm6YmtnlydT0k{ zK-%$9IU;Pl9q&1Oa(aD%<|_HBF_-7)M#aoc=pT7;kR{^v0;xWZr0--dTw}FeKC}B& zuisxYgp55rt365=qy@aYUZ53^%(d{I{&Y&X<@G>&^6{G}4#KOV?fkanpUOQvbveXj zPG)YafXPQv@*VI=kco(O9f8IeD&%7An9JS78t|&&`XlRh%NlX_Td8FgZ^GTwma*rK z9t=-h!a*I9l9wDZ=xjy?7>+^#$II{ow|bpgQz!^h@@m-on4Ke230}JXwHPPl%`$)8 zrDe{dw9Y~80;}p)t8QGM0+@d(YnNfpBc?K}1V_@qq#f*_B=C^g5s(seEk3Yj{ zRUJTti_>(rsI&RNVBkQ)bfUo_$bmZxxwSGmo+lmEvSMKDvLj!L>?s){46W&-x0Kn| zk&XP-9!b4>(o-HD?Rjv*73LIUiFMUnyXSeN}1a`kt|% zFR^;eRtIT25hq3@1uy9C>teT)bMJ0oYwHl|XHjZr^86uc6iTVc?LP01fOFz=w(aO` zNai*Kh`sFZ4;fC&E}>gC=brj4GtjXIQ*VH{ye0JobxF!tX&x`rtgxn?S@lY{VgLF- zn5{( zZl=}Nn;C`5t}b}Ko=EX$>Su6gE5`z*u9r@%0)mCzKK*^A_99~AxY=lVDY;bbb%0{y z*T{dDQTR%R0aP^Y=b5cSbzzQ2R5LKJ_MZ5sKHh+3yv<>PLg552AKf`AX#dh#ILQtG z8sO#OrE`OSOA^wW$V=TznuGKCiH|*t)d}s|;Q*<~NDsXFPBmXSN!#KrQ&MK_F?; zC(1Gpc!KQ)7)&jKWhWe(!X4ZZ!m+USb?O`i7+E3&B2J8@ni9>OurgO=6wdAULKh3L zfdykq$}d{jB@l4w4Lekb@1}E%Qb1-7DBWCSv=pAf#JO<(Seg{49}4ZE$SK?8Vzvu# zU_0J8as)%4r)b95Rhnzu_aYOBco-6K)8+SG#Z85;;#8hlvzP?xJYPIXWNp%eu z=drP%R1}tm@{)IDMWfvLw{dvLnbnWHgRzutJ&TN6$yiwlLUoGiWXn-KxIC3Z0Z$Bl zPux#3vWAE|H|{JOZ1Eip4vP2sFz47oS^&KX^R%QzzyBpy-)#TB-@0Eb zCkJU8CZmI551v9|rO}-hI=-tS==FB_hQ(nZ$j+f}R+EBu)r#!>Q|5I^zLnkJS+wIH z*yZ3d1zLqMH(s@^m|HnmtRuaTmsN0YV_2>pBjr<=_vxu&vZ^G9%H)_yMk1yoHjuQ* z;`J~Ntu>GsGN0{Cmd$s(z0*ORa{||m zd*%s7_x(2J)XGwouIVPjHZVx~fm&%qR;OLl8*9&umdphOy!@sV@!?fRJcM&G>kwD7 z$F$3WJ(+Yf@!=K=p?#`9)57crf~zjXoZ5Pwt*(Y`>E9?=$1Ewhy>!5Bw#Mh3J&oBS z=0K(yPy9Pl?Kl8LHiOVOV9Fb%0p|HMK(k-0WZa2baG@=#)SC(oK;hXLzyEi+@!WOV zvG**lnUj(!Vb1DHYfN;#r7iso-UfI(?0^aL^mB%HX+Q&enUwy}Vn9nYI(7)o9)Eg< z(?ZG6rgnEcyWkJcLn$?MpNXDRA8QM#8rc;gjjMpzEMX-mr z7!TB-j*zJ<*JM=V2UY_V64!Uf0rG5R^q2hp&)=9smoBWWgi=UnkfsY6XMs_DWHYso zm22SlV+*)2f>=au9DM5sWeI>DZ;-`DX+X6Ja5kliYUvBAlAGs@jG4&1FT0mqT74cc zw2j#GJl=_?jD&k1O(LS;x?FP^2m<2n8+Xu!q@TC^? zo3`U*66^k;NAe<`L(HQHU!7lUg-ESDBcq@>W7kxaJoL1=xE^@z)TE-fl{vIacrDU2 zuPI1L=T^SvoGeO#4vcw*K1_nR1NDEk+!EkDxKhulq?Fi9U%8DxyjR%?NgfVjDk$(l z16$#p;5$6i@ipgSXyu$i270MZ>8Hn1y7r+p)(%?tsg~zCZQc7>>_MAME^Nr8Kd8&N zvpmX=RcRNtK$tT{nO49V4kNWJ=#0omV$7&Y!KDvdT1Zt1`Kx`=zVnhhdncW^vVOHq zRD&biW?icxKZXA=f8@BChfY;EPT?)+Z&cj?i>v?ExBVbOX7hr?J}w{jZ_>X{05|1~ zJGs5jYCBF`Ouge)L71L$tmgr>@7yYFegj8}3&qVwuq|-O_v|y#MOKQ|Vh%v0$!|(O z+ag7c7KV4}-a`V{Tvw!={NRWZ9#`9cm8p|#Kyxzd($)7RT<`V(9|5EBQEXuL;Q=x7 zqjY;Uidu*)7OjH@?kjgJ;7_r)Kn{o`Ev};9|2EGErnS$zd)6%tyAKt3SJVrLq%?rj z<89Z*&Jd0FABtH`{b#i?DTOmyAmN@)N3Q|%zLZw)b~*7^aHV7xBKJs0RDtrlv?{(K zahxWLOimHoOVvvDPcH*;m5X5H9y$3sq^K`)^NAc6K*%Q`(U~gKQ_Q`@m2drm;uExq z^il^?4@4z#iTxnV#fu6=D}F=sLeL6=hid>*(|z`7C_`sqK5WK=z$3|Q=8F5ZeZ*aJCXXISt!(6# zWZJ-rIFwHTE=W9j_Y`R>pYN_|btmDMs+?X^SWXdrIH#@=eLP}D_#_P+6MkYwpO>Qj z@-Q5nX}O|cZE-AOzi~XI$^Ye+-Fa0ro~{;)z;YL?mWs#cvD;jL(B*h>l#gbsqBX6h3J>r zWS`kN{B@w|wJbl2%bo9el<*Wf5=}@{n0;$_;3xCKq$8c^;55(7Wjb&zc8Hf>hpPyp zWKBxz6S5j2)~3Q|!uPG}<40J~y9HGPTyKDAP=o9L0@Dxh5lw@1G(%jxc-U%jeVO8o(bv`c|}nOVe#_|yNuFeiK@jS+@2mzjaqWx5uthaXBnFzQ$_ zcSYt(rW^wgO%)uyIs;fD~kniuQmdy+JNoYLclC?FEG zr<``ZIhHuMSz_8#CVnJ$W&qD2gQ{744|y#_XMno?~J0BXyS{q z6|t->d5DCP;~MLG&aiQFm$o9!O2aon14CP1$tETKiblNGZB<2O0hW8AUj5A*4KNfL zJ5WR3=h?up+;2ZK$iunKvWB9qwhh;D=ogv$25EJ2-n5`pe5OA_wPH?$-aW;3lV0CHaCM%KMkQ(^Z!5_}Ha z4=?Qp98e+-5ed0~!T~gyo3M#4PcoXFY$7uULPn)5Pl8-+ATM|u`FO8JPEnOWL+Z6h zVx4IUrx6<^ey9Oo4`rZCq#D$@!MPg6n^@6w>cgJfUQOv37g+a2Nc;N(Q^!b0${W)u zOOaLOy=|-FqH&LyNk2v0*f5n-Q8K-9S-iYxVzip?rsNn*Tvo4-Q67) zc-;H{FL}x9q|?*WRnwEq$w^gpeP6Yzqw8(sqM(C|L~j;Ila`OQc(Bt+cen~Cd%~bd z8L71Idmg=P`lFLC(N}n1_Y7Ho9eY~~jf#M488>Qnr*Y{XOQ@>Xw8EIHh~Ew3P?Qs# z|1E#8D51y;+Y9$o;0DjdqizIiXS*TkFrxGkBNiv|lCVoo1oV>xEBk|4c?t9=3@*#I zG8S7{Ie`~=^d6=MD%?R=X$P)J+#H@hoo*+2fCjH1jV&+9)h`#If7n_@xSnkKN8VMn zQ#Y#Ro-VO&2B90J7g0wt$n;uhmXcxb#fQJYznE)Z5Jb~ zOq7AokNmT<+QXJ<6bjNf+)p0flP_Hlvj;>5AW4;2em~ec!i68DP{|(m{cC)c#+YAx z20=IAOfp3$k!NIE=#<}Q0o|>(j)I3+j4C}(#{234t1Z(rFB*YAKE^SzjP;v5In~!h zjpiW(C5tb?uQ*HYgp)+`atE^<^O&GOpIfnQ&K`u;q6XOEo}A%H@0vH{w|%NUVEYU@ ziij*Remj0SCZMID9Fd}zu-6w9g~Ceiw$DHQ^G6oaMyB{L$-<96=&}y?=f^8EVV~gH zmeLWBju)Wzwl|6o=MS_I)vV)B{<%-@=nsI|ANpz0i>_M%e;|pw`eaiU?tGjB9dBhP z%(Zqo6&QbD%ans<_B(@sV(zN&^6xK*hJM~#&3N%KQqZxZ7s%M9IE>PsoTBN|%jx!K z?O)&q&pe&UZ4VpGn!tDULbm1|jWPClmv5#qcVsf=eCvkOqvoA|`=leZ5%^dOn;|ET zouFOx2WzNA%FMI{qsCgX?ZV8q)A%vvRZ?N`LbL$6tFS-VEndHC7w-k1=oeHCEs~iy|MRLC~mNWteHvFID9xl=byni~)6U zW3NKc<(d>VM2n!6B_23*9x{t?ZIL*o7prDAv#H5`wD$u-?Td0NXkRM{7^?#o0Lecr z=Ks>V*2wDvPVuk5YA;y3@mXg5te)5Sg`qXEpq-XJQpL*MHhriWUK(v5#JA1cK%MS1!g%bnYyBO^!{Fa|Cx2uxK z%_Smtxm{anZEFON*EIik;3I;a{5yT?L{Tg;eau?T;nY(O2!-2+x>~U65*xQw`owQ9 zds3Jwfj5LVr2CKHYr=jtjhjH9msnv5;@HUtEd|!R+FDhJLd?Gd>-PUu(cer>Ycx>lP|Tbg~>ct zT_bG<27_zpvEj+8G($8#z_^(?X%gEZO~{>6zMFUe7w)xW8NVYt;WnSt0uD;J(1UH( zyK+{LTN=GD{Jy!V*!2B1>41yoPb1e50D`N`3wd9jbOD`We8O<*$4%E z71Pn*=>d*L0W2x>F1NX*N9rJ%TpOV#t+IdW58x=_i3$GL`#c9WEgbX-IK+`Y73xCi zT}ru3lXls|84!@!dVU;C`2s!jzsi=j&l8pTd(&N1lpP{t%qRb3{;89S*19(zT=DN$ zExJQDD8Lr`)G7r$oJoc%EzLXm`g;kK--kUqRqQE!7L4rtJV(RUZ&q_HOlP8Z;HB_{ zu}C4iFMTV;>~jhT9?lw7zAmsrvd~%*Pq{A#09x`M#BDHftiz#!#wKe*(B)Pp?*@?V zf)%zM%pKMF0Pu{eeseG)NTzCo0f&&yWNfX7M?~jn$Pwm0jnrZO#(vsQm9bW~L8tkH zi*g%CmBm^}<1t~8sC7kv6mVH8QWxzwt)>z3q`$6Wbx_n2n&hOtgx`+gKTYhQ@Te){ z1iL&N>$m0%GbOfH8 z>)Im+eepF!xw%~o-+>ZhU5s_|2BH25`u0U<}jj^yzM zz65`ZQ@lCYX7eSr@0YM;b6Fs+DNV8eP#agY@=L;l#Aq`TEqh13&+C(FnVv=B=IHMR z(*}CJz0)$lQVP-uL%qIdqVGS+sXcxE3X+)?6LVU9*~nwzIji6m!eirb7`$esA0`HU zx0!Ja(&L?5RQOA^Q}dP-IW=#_6Rw;PfR2Sop+UnK1(lF#1Z7yx_dFoRZ-9bX(XH%| zywgO8-{{<~isuXWOaBy2Y8&TxjXZe#R?h=|)z8c~)OXtJ98oc>P)SH(q++mhA8{XrIF&I2 zX&Gu#vyOg~>kgBzO)vc3Yp`a6MKmv5Xkv#%JHy(24W=bCBo7hTx;}$wfz)p4lGuHD zJ;L$v=St~c%6lfQqM2K4br3&mo1XZHgr5JdLsVURqGSz@S!_AiXjIXlSqc z;aB9eaG-N1_w=DGD$e%^qZz_6*`f~gpnxH#&Wdzu3U zQp=QTU>9Pf^5JB(hj!$LE4Jm+8e|j$!@MmdaW`>qsjide(Eh*8-P+hkT{M?>!V9*`e0aM(m&`ArVxYkZ~(jiO>H@l zrnU2{EnTS0M8#lVZ21Co1Tr4c=HbanBqg()l9j#u@e6demliYeNvLo4DnONLCRZ9N zOsx(0fY|IWUpzi|5M@8h__N4QiLKC4*nqeU!Z`33pLl8?B{DYZbM%;nM^Zt&KsKN=LM(Hw`p0EKRyWJ87#_$6R+$!`;OmmbH84pnV_*AE+)bE0Dp(Cq)q+j($ zR+zpdp^7AYTn51feTgzo@UlDe$lUw2$;t7ja5~C;T-b|#3kdaQxPQ&LVT(`}Z(;;H zWSBP1o`gXpJ-tk0E9Stc*win)Xk(8)|u?d!K$K;3{kXq6M%CgSc(gBX6pGccy}}8AulY z_4lPir)|B&J@XW>Pc_nBfwKghHc5n!Pslf6tG#hL4I^;&O$mnKs3~C80)(oOZvJT* zjfXbZiz$E{pI;;@w)dbBaE$MKEtn4S4{s^noZAGWFcfGhM!}12;7JvsJ%rth4lgm=Mzocq5zi^I@8WuEG$+cJzhISwJ(`i$v_7OA z@e;x6d|fiG)NE?Q72rNsmx1AL7-Q;QK{S-XSFG9_bv+jT_snk?b;x(sIA{tQ#HNe- zIuBibv1-r|{kF}9k9bse4^d^4l$hdB&9VbcvecWFriZR&Ae5`VSYp!8A@%s$gwx}B zG>=klsk!}k+%7?#BVW%tUU2PsewA7cNBx9u4;-B|E|#&fGaVYw$%5DaGG_H+Pa;xj z7e?ti6n)V$<6vdXq1^Yk{`9;wWlO37KB{>Wv&eLfpr@vRw*+fB#4mDA@t|I30NVZj z?p_GNB*T=zUjg6G6bftb0dT&T=l8d&sfS1MpI-XpcH(qs+zT#gi}*4xzc-0w8Zan1Er`pm=f|(;vS%rh8wl`YOyayVDAkC0;r1 zhUg>~xsoA5@@Sz_sr}ye> z$hdFND5rR-`lL_`rs19B?Gf(j&FW`rDr**pij?u^9_Q@xZX z)&ALq9i`bu?tL}e&R4h(PcJX+&#RGx_iz&X>OWgz6aiPX3RHoBHamkJA_1 z=^JmWUn5ZTK8}BH)F%eK$xT?Xz5OxgCES1LDo9rD{}}$fKHMVm=)V}jt%izkv_?+-Lkz_zq=JUC_olr>KEK*T*cR9zsBncgmd_oldZA+lZ6G*rS$% zOCci3^w<35IoV;sAub7O5{OZZ9|52V0zKdp$&CwGET~$i3;VR1>gf$*29FevYCcOw zOW3kF@s*kH`UUV9X>d(lbPG5pFX=^z6mIzFwR)E+b8EeLAFNoPO^yT2A1wGfE#7`E zP)R&lct0HX`CaEZU<1hww6|aK7xzvYIw$85R=9~;DBynb$5S2TtK+l7n()mer&ph% zV?vogp^uHS@>nP<_5PWB#Ab<0(OGz#5_5L*WF`kMmx5D5yy(Lq73kpn+<7s%ID!UK z?~+*b#P(@S^Z?DC47iITHNjKj7N~&`-$`3Ct1wL32e)4x;^xOAPQK|aV$8#7*i}gm zlXsMz54K9urq%pQ{+WxbKbQH@_h_yBVL3J{HCQz}TvY^@wMRxBii?)iI;ZFPSdNkM zhYJ0WN@CedS7`ZH_oHxE_BVI(Gt#IT8sMA6iE!?j|T+6RR!yJ+rv0ao-MJ zv{R@IBKyLg7xm%voLnxy?DQuB2?R4E3!1aisY2$tfzA<$Yr-K~{sJSpW!Qmlqp>>R zByo=m9oG%MS5zyYkp*X?LA${EvF?bAyU#H`YeyASfR~fRi_RY(^21q^9%Z`X@2O+n z) zljjpU_T2?0%o{$E!H{)6l4W~}d3um{u3~pM>GI+uLT{A*aXYXv7I!$ZW@3J0KUkQ{ z;+Rpk^Q8p%DuwGRNG$BrIX05~5!lh4RAScsO5OP%KtbaW79AuNo}w9E;(KmrmFic@ z9%e>jN_!!R_^AND`T2&LJgO{c)V@?PKIjD@9(B?QOUwE&mn^FLhX=+Bc1~O}hAKRy zWrUirtQL0n3&&rTy*pS^up4vAW`;mtej5 zZa9ChRu#!&uGTNviaBQPnHPIh!9!}6hjfg!lQ36S5a|tE`yh8t+9>`tP)kfR*}Rxt zYDGQhZEnltuktRcIN8PQ=#7_7h#E}Q~Br?G^^-3 z=sml$02%mM-$oF+?3JZWk4WFf`btI5M(x0%vT&%&4NxqrCa(ZNZnPTK>M z-;B{|+5h~Rx?A6!A|?)qr+S|Pg$En;+i@dA7oJ;&E(O0;+SwA~MNuP1D}f9tS601$ zTn{oO$%H}Y4A1X>6<41L@7Ib$H}qOC74RhLdQJwlRL?{%5~Rkfd?MB> zhW<+CtA79}IINi6LjW3McyKFlK)0#B? z?GuNA_M@eOxBhjozp}`+**)SlB6YVKQ79RtxE$%n;)NqEp>H{#2mSlcsdgMv@bESz z=p{;yugZcy`YAAFPxhFpx%I9eXR?FBpCL!DXTMKdqb;ejsNuq7DFZ5Kmv2U%aWRL9 zVnbve%P}M#oOqES$EqMp=}=Y2DUMW_dU^NrJ>#Po z&ItA>nrn&vJa?JZS4V%c(d7yy)3=}j!djjaP>K=dzn&dFH%#wY0wl;VW|n$EsYS#o z6ZcWP?N&e%R~1v#P+89lbe+T;0461?H{q;~r`jX0AqeeM=@8^vl945Urbk5TH9y<1 zjcLFA#!>{9hEM1(Wa55Sz)Mt zby+4n={4ex&8)eLG#rJo|LIt^e=-3E@WZbn^iq>z-NsZqD6Q_O9VapO&7cei%b2nl4CJHZuD+2~w-Sz~ZJ^{$6wI#tdj!jB7~< zG3D(cOTdE&AC3l&M5iefan7|@TpWZ5`ebEY??eh{>pkZ3Rc{Gqfl_^bHq$&~H)!HJ zYx;CRgtY2Qn~BN*oc2;#npb;8u5$X`xW%6X2T!tpEcNU9pBV+FVy$+p3xvWBbC}U7 zOn|pl<*WCGr?-wS9RiCy!)yy&zxoR7$)cYsQO@)&3ryUIwjC*;v6?2DJn90^$3m4q zaE%3JRtOkeYa?ahm=V$|vTI;{&>g?FjySm5wa`W85v`pBpzm3sA0}%}Z1IAL`2!7? zAjOYm3gfI^Zn5Vo9{RpchnvVhDpIN2EsxVx(ETSdRQb)kBFuw_(ztZ8aDf+EYa3-( z`)F0{Z7@HV$X!gyfrUy)Q&s3kX9-n!zH9G@D3gH0-F$r`2hsKgp+>fOO+tQ%8`cVc zc!h8rcB#sSJB{`}T$C`S)m!ciL$k1-@XYa9u1p7cAu5xXW!+pMk`J0z9V@{!7)>nk zW%tXp6wq(5!FH4V6%ub z_^9&CG%mxYD37-zGFe(GsAl!e31AtDWEEy99sQf=U%FAA6cmX zy8NEZ>YD$K3SE_}H!)jfm{+O$EY)ipaw^ z<;xPHibn%y^yq_C4n60J+6^gLDp~d+HtY8mc}LI0Y_L8AtV16rgsXUVR@kwx>_(m8 z25NuBkoD0dbyY_Th=fUv&A>?W1MxpMx`c{}r@@Xra3c;}U5Q5J6KwT!USO{|zTP(( zdAwG&QV}yj=%5S-nea^5-k5me19A9Dy6O}5kE-1IuYy>pJ}v!s<1B+WUyVc08|ssf zpTFw;Y5%2u@AuG@ujB0khp(HO?P8(iGpDz6{@^kVL$VY_Bh5)IAh8#9DOBt56pyS~`tJZzgP} zq5lDTh@HzaiXrgkP)s?VK#CA2g;iP-EGr|=HU|02>E-FyP01j zO%8aQAwI`7eEbK_p}19^Uuy^n6*vMIoFxd(1gd!1FYtDpUTQlyGU?x(8dDAAEOaQ5 zh|7>68bTxmYfyX~{Es3uV~UlP&gcgMoaA872atv$zthA0WqiDBMCuuq{;Z>W^UQ>gO-om~T9@_EhRU zF-i{7btH1dB-*4b)Uc^jcso#dJwgt@%0uq%o0H2d^45T%e81HAqQwmvzZ0vw7Cz)Z z{)`+zuE91XKP{NgQ&ClW9LS7Wmra)sJ&Y1m{HD7b++h#GOZsv{N9zOa6zR)fSqd*a}!gotQT+4 zRUiC9?!VI+?IHH#^Pleu4?wRaueds?4?GL6IAaZ12g|RkK6mIZcTl3Wre25cD0unX zh4LY}cts3ZzH%NOUdRVwW@yl*U)WW(zB4C|E_2x-yQ zI7|K+-qx{%x(J6IK|kvGff-Qldt6xqvaO~RTXT^*LDMYvm7v3;rKth)CgHO7ME3YI zehQ$bVHXk>39VSzR`cg4uoCwC(|vkmS$h|&7Q-^X&?Ijb6$|7O)({mlKSdFy;CGR; z8qe&^EAt2`2@l)2>5jNU4=D3JE**}QiUC8|6_&0wV5Xk)}bev6y-`W%H^^eObj6*x(ffF)OrVCb^dHWI8j(K|?Z)5ZDe0|9U zoN_bS>^V)w35CxM9RC}vDL>7P1SPyCC!x}}y7mq_A^({4w!*L2R^B!V(79kA_XAdf zIuqq@9W}JlTbheF>#ZpBEhNP)6xl7l`jde(B*ASaqDyNjES=tfdu6uLLuJ+8S$Q*r zXGBa;L_LBdehOsWU6j^I1ps1Cwo*u(!IdSQ^}r{pg+JX{OXH*OcTA)v(P`*Xy{A{_ zJ3>O`nNJWG@sfCW_$a{tw7}=VOU_)4df#s#X#1yLqa?bD?i2EgiO*{#t$MT%4vvqUVgD-$VIO??f>3j$6*!s1;_sr2$ zGhPTr2%~Rj77YuL(agt}0vj9LLB7q}WyHV&Vx-EM+jl5=h|HpR5w#+IO;kCqWinAh zm1$+Oa7}Yh6_qBK1i@jwa@}SJfe}d@= z!10+H?y|B)8SwKElfco0(CUjQEzv)gGl3`y;18N%4ONl?#!|*he$_Xn-V_^nQIYb1 z;*NKK5#7(PAJ!DR#fE*zukXV)uSMT|&Y2!o_m26zY(}^Bh5i0^*YtdIU&w0d&eWrd zThVkKHNVnkz%zl`fSUWN;QJH&!qp+9`SNbevlIf@pfmIAS6sG!Qfq+{*_3=`&OH$B;yMw z-Q_fryv;;Ve0y!T@H@-O!mN&CDKsJg-gaw!Iq8oIt6O@AbMj^N^?1e#;(dbUW7` zKW~#%Xp=LNmh&2bnIUZ_^R|^ljdnUe*Ift`CEy$xwOtjPGaVG;%g-lFrD1Hv^+dU@ z@?H`i8WdMCJh_ zu#d;OKoJ)yW=fBy&O?ZH=^TuCncCYxt z{=0XzD)uL|lwI^-zZe#{V!HNxL`~eA@Q(|?$+vqD=z{`gk z4KgUWku(;AHXDfgYMT)N(Y~$FnLLwrxF&Z^K#M(bsE95%O<-5=Swg)(+#M^q+8D3( zYF~$^yN2sJ?8{ER=bek0qn^m3H(t(2cQMXaYy{VRS?8rY{MbscqW)@jxt zHoD)6Tjc?-1_BMi0FKopDvs6hOq`8A-3RsyvG<8~64%iv9}MQ3=&L$>-G>{zU$zOh z4U2sn%=0!fT{9r|Pq8Pve9QCz(8u9++|Z5~{e{6)xW`&Uezr@cne3fi0|}b_{MIq% z#u51gJ3zdh8AtpqBN_y=T6In`!-x=GdUc;^>5YB`%QQ*g#V6 z*wA{y)fO^wY8xEA2z{`T0Rp|TNQ$>}NQ?6bd`gr;uV(*XW{$N+*nb>H!dNj;`CwGV z&wym6Cbj8jugI#GNYYDOX8;-iY^`f>q)+WaH@Hw(Fyh-YqL|vZlt-1x^PIW%1VHtqsqA-;|ywE{~YYL9MH$@9F`=)At=p-RfZ zU81le0;2*|jXJ(^M~l8XABRnSG6g(-^~enc~>RX6yk}QSD3kIyqv1 zoaBSeume%occ7v;zl|FYyFaqjQro6<#>$jxlViMe15UWUIOt^ILOIkZS**By8 zwQQx8NIudipE!@yu#Pnmtce3|@evcMV<3Q%u9Y;JGfPV4Q6+xS<*{VH4if?S!Vsu0 zhcxpdf@-k;jVvLfTLuwMndpFJ&_=~dnKduXV^5h?{w1k{$mQovX|Vo5SlPhH3XGWb z#f?B`<>K`Q(W?ZrLxf{qqL_n{zEwp6RhFeokeuIyg5x522cHn!&}?+Ziz_r$G2zZK zYn66~WS9QZB;hRb!C+X89InQV>d^0}D6`7ltimIZ$E}J-fLabAuPl79?T+f1?0t+j z8AV@c>K0oQuu;o&GYh51m1~&7{h5vniU4k%; zI(V2E*#u|JXY#YuLZy6f_^)3bb05TCnfiC(^<)!*)+y!QN7_F!FCS$2;+Qf&0KYlq z^KTPd7PJz+1B}!p$A3ab&`UvsI1W;Oa>Z42o}))uHy5-N>bSQOXL8MIY4|7Hzs1;+ zn6qAGXq`>Bo4HY1SH6#TK2sXIc;~exW>G%Sw?E~n*aC+(cw0nH4^}9Iy+)gp} z`}_SyGkkJ(@fMy>Mjcnti|bOlXvE##F~bqU zY?WzKr6Io`4RS%UXc2AB`J~n#MTk&gglAvFuJgwbraq|K6W~(d8nl=)?9*>Kkc6QmgWxp<`NIcq#o2fF{V*`GM0PIGL>53u*&w45qXDn zEW52`?(s=7eWRdG8M%zJOII>6bw&9@myeFmEM4Sa1ot>^}ON6}YG(Ju|9CZdE|0_ev z&>2dexz>ve;%f)>wXsmbS3V{wdq2=}4e50q#;S}ZrxQ~%0%q(cOpL6`q6)3Rl zb-Feympx*wJH}n&fC2*VbgG`sP(^u2aCaiBOcbpnU)#5Ea6v((y9)QngP!_8g;`*FdC{*QK7ysyTF7ahLa*)v8|vt;0BL~2Yoqy zmz#Uzw?;BI!Xm~o!j56$P}xX%klBv+$@{Ntw|C6hCGL+3Z)$#!$KU-M1&{fX%o`Oh8(~`j7AcBKEXcaCFwV^^>mzT{;sfO~b(> zDHnQEir4~|&+xd?v2AlVujwMCuaFtwG zJ(GC_N$zvh)G)=Trt@R3?Y>f+A`6tk0rQISDB7^Ml9cqyy)WueL9R<0GVv&qrTS16 zO{t`}pT4|Y?p5aFU5FwR#PX(n9?%c-^@AhDA~hi^QfUl@5M1))zDp zb2z4`{zHSu`(uGLDkcPS+Aiu@!JJ=Q2-RGpvf4*>fjq3?u9%9JxFAS-(+ zYv5-rhn57|IIPtq191SbLH%)opzAA-kJ7+h2m{@^FY2p+Zt-C=XlryOdY>--+YhYP z7+2T7dd+%pxl)Mo>ZIR-YW+1Fmv*EEK@E77ROymnO%G6Q-0jO?WxQR-hDOtcvj~n2 zuFfvCu6~c5zEqziGgF%fD+{6#(Onw47TFmNTBTCrs3<+a7IU%>nee}n{B)bkFL*IvVyDPdPR^0rzZI>B9*tnY)>)KE!`q3f3a+VY zJ{781P#WdC{U=nc63^)Bef(i1bA?Ow@-ko+$u*3J1G-NdIKAPW*zKOi&co;0c9n)# z+_e(H{CC{!Q3kqJ5r$*0XUnE`P|c7Gw+z9(^|1^!)mmlGPg%^z@MPawy&1%J%xnO{ zoV6Sq*c+xlV-OdYBT@M2Ofo3=K40v86)1Po`9g~8CGJKgXDIVB2GExP$9SQK)!Dr_ZPnZ-Z=E|2(HG&&mjxlUQ`_Zq?6QPoeF$F zT%?(cOh=JKb*h*Cn(E>s67^ zn$1*?1-UTV;6-Y|>@D`RI5XO8=wmK5Cav|e&wJjyVMPaz3-k3kVMqIXMPK5BLf0KM z8p(V82=M#4Eg3B?H2dV}EwZ}T2NA7fD-e^_wdx6rIxUXt5a0zW62-Yfhq=<3U$hOf zziQwXiNX~$rb=SlqrhShJFSbkDRW8fm!I;mmfx~yT9h|s>QndRGZ~SrRY_jc1dE(O zWzKyW?Hu@rafaN*wV8MUC#C+B;!9I8U#)ruR!6}1F~m08Jyr>qg}<09E9DNeWG##* zSYEGhoSD$xy0*uvu?s;>p5-%fjerVDHjd;>U$YzI z#W`)D`H}uASE>tAQC6UNu@>~4oG(CzM{Df=-ppoBby@xDU+azG{}nF%T3g{i>1l9e zyug*=f%)PaZm4fZ_>cZ?BOZb@^P|X{D#pLgh^Cf>-Pcewq9Mms(4h(piIqDw>evqnXV`+(bB7wX%A}q}ry90D%**K?a8|NQ z-wRfUOIony7feI%m^7XU9Gz>T&%ZvwFH7;BpERpW-(o+!idDBKo)dGlLI-%#3%}FP zUaWX8d9t?7kcm>KCQk#9Mhfa$$)Hlu{TCdqQ0`5eR^0TGjqY5yzx>CDb)j7bo`|fG zE|;UH<*Wjp%L=VJ7oL_L)Ux1>D5ULGhh>{zn`aPC*2_K#|1kVY_psVy>{Q_Iabg*r zye>`e12N}4?>B}v!9MaPd)gN;;%_n~zo?{bB=Xkg*`%${xKv$qM0%?CqQGV&15DC#$`E#kYzMkD&HcY7D=d z-fiJ|TT14lAXNDH+*EeYU2%tEW$4^ok70)BJyKBo$UG&_fKkYEmHqHkNlP0(vGq+j z4P4)oqZ_5Yvlp&?9=!W__g$x!~$C1v=;*9ujJNx5-1;z>>q*DFcS z{gUhgq{uIg0RquZpJ5%(pAVzkFWt3Y(W(XsMhXSQIjh5d^{jgPCkdV{k94eYc2zy$ z*MwJCdZvhHDAAi`o845sF#iYJlqD{n!tMD-F3yU)UH=3OJ4I-(HVGw30C#zUilo)@ z#qf6lPJqWM&x++}%zQHLJFxwI#;dHVDl;*AF7$weSF^@NuxjavUSjfPJl2ahDey|G zQ%ZaOEXrnfwp@4+wRRI-ocFa{rDL*FXU`xPDC(o>Z6K(Uj&q^o`uG|Jgl&wMQnQ&O z@2ah-vP6wDKiF4qwLoW;l`Nl@QPPD^ZtKAF8~A((C{#1<9Ihb@nOwq%eN?J>FHuVg z^4Vtb)m@E4E5^ zo1LDlUL&Q!UCt~lJ2o??$7Y7OQRtM9l%46RS?dc?mqZ}IyT|kQ6z9B4nhTQ7|1Zws zuy!K|8Y-ltp`)nU&h|aY*F(`awbeL{LCd*~ig2jMNXf86!{;>(Z8#q}A+*)z8MBN2X zg36=MpFS;mM!-z!wU~6^i{%P&7D16nh{r+QT9n)+ap^wqm@6D+_^(DzVUP^ zc6>PIHu8}Ye3x2O8PQR7T1hA7SGp3*i*ppy8Q{aSNKG}$0w2M}Wc8r5sW7Vplnjp+ z$I3KGKdGAfz_{v=@e&GU8&hIxaF$NQn3-RD!9Vyyv+2P%+uP*4qBwXKGrGH&IHd1x zDJ1~EzOlNVe*3Gbx#)Zvy1A(rZ*4an)fY#x!n%s;{ffkcx2dgYJz=7Xs8QeJw>*fDrTc;Y0`0ty|YMU?KOS2kB@g!S~aN#(aswjOj%ep-zvcRAlo$K;YGw| z7`v$#McGdFr=e9aNn0exd&QOTd~1azoQ2fz>hhvxEq77Y;b3xd^m6v`Q`6G>DVP*r z;9L6aXkLH+O;juFheTI-+jJB2v;nAM-22u49Hnd} z@pp0zMqU1~%B(EF6JWNlB(8Qg1)C>Fl>M=Yj-M8RaRicK@7+h$;|^pjtB=R!g}=d3 zdJO2XoA3>~dETU!f8dL2AFg^e;pMC(BJQ$gIBead%dR-DA6j^8g>7j&KLLj9FSYvv z2OJ;Ak2m+Y)f`)!pC^l~u#Z*}bs_1)Bj2n>$+3Kv>~m#XtKFuH)}^)0lwSuz*iAz0 z^DpS{q1%UBW{Rx9J=&v5tVcTr64(#$ccn5MY;Ou>SG+S%4kdV^Ijl$d2C~>qK+khU zyehaB?V-Bof2qAwJydrKILq$Cl{fa7PGUT+%xyhb0%vZj%E`|_&l`hX?1g%`R>~e- zQ8)IrvSHyd)>2)ZD-%Gz#oCX!O}&5TgQ4xwAnVb|J@bsZx0cl+E3VEaswcGHYxIVe zH%+qc(=BU7RzG~#65ZfKLfzJj?q_WW%8l~(oHAw!G9pp%8Ygc#CLgd=sY)`w~Ovov+iRs zZARPnXZePZIS#V-LNn@;+;)p9`uHmQ1S)T4MOC6b6FZ0&J)!{=&E;Tqvd%c@9=tVN zY|UZR47c0NHxW*0>JO=@O!S?eH`XLqPbsThyZ>V_0z3a>F#aQ(-e&ZN#tha6Xk&d1 zkM2nH2p``O=n>>z8e18y`g{c7L?4)Lk<+fl5tdM|&oM1~8N#Zv#mO_~gAA|xKy^HL zxM=+FLqXi7UGU>G`sCQXXx6qNsjp>uOLf`*YLq??b47N|M)x6N+=Xs`rejbs3K)`? zK8TKI6ZNs1l?8!BX33aRN2uSTbRyXFQ@@PHvRZJ^d+EtvYM_$kJZ=eB2WLp9(MAo8 zVEtTJCRu=a85q_7XEurwPWkNO;MkS%Wrk_JO1QBz>c`BpHK?~P(XPL(Rr8?umtT(p zl}OZl6_5ihIrVDhfio*AXG~w&ncxh&wL|*6T}seIQz8E|R7bP?SL{pTH1xk>Uu(@tJ#L#E{r{CyGhxgoh&+PX zd->8X91sRfO<_H`vRbJBaHA2IL#}gpVysgeIc_#GsD5J(=)m<>kNxK$MgdlPqOW(w z5Hr=u&raq)n*um%B@*n3&F!WNbpF)e5KwibsmWj{ulrq|BhI z)E!s|j%3zoDcNbDq_9Fa1t zKsA_|w@x%7i2|`Oc#ZrvJrO`9e9v_amPFQ+4}+MYHKn#c87qor%KIhHZk=}U3fx07 zZBwpq$dU_Iki(yExP*OClw7#Kzzz8MhF@UL?^ux@icjKNk|^r(m=xThaT@&^J-zef z%7Jvs5u+Pdwu>`@uGKGBvXe{MiBck6JH~T5M1?5I&{f^;m57wj)Kg$-af@@FO#j#p z#(~{kD?=~pA^B+E{%yj1`v~mjWWQyW$W~)J^5{rq>(V%4?a6#vmGAYBM-sjDTgZJ>ga55V5PYdCl6Ai~`rvToibeu=%{qjVJ4v zh&w_mGu8HKD$&AP^Gj`XP{ z)o>vP-wQW1LB{SRMKi-Wy8h$wAD>?XNp0O!$4hkf`b~FlaTXue&t8rY0Cv9}$iSHm zoY}ycJuXIL;LLh%*ua?$oY}yc4V>A)nYrcH#F=?M&WR{!(t>Jh5UFd`avXD#lm!(_ z6QYURmrT`enWk}&S_MKs(#NHkkz8ojEP}hNH)znRjgK*Jb$w-P^MZcOVV$2?RSKFz zXv}|3#LRE^*K}I~1@K&C+(VrDwRjSZ1W=ap&yWE4^nhqTP5OXvY$ZScu|1o|DTQ-;guRgJE;xEo2j%%(mFwjAV;Y zZ#@XDXzD1=Y-~NFu^#3+JuI*`vA>FmoV1HwHdMz03>`LG+0D3MbM#;Xzs8AR0f|^- z42FKO7kb59un{*xi?68G{r~#%pQERL+TZ_45~^SB|JNb>X9g|A5fo-(9OQoY@qFv$9B9;Y)?|gsAN9 z&4Hk66Ph)i+_qcOGrm`?KfQvZ-$LYskzUUT^N}2zk0u41kMO9&CHquG1SQJA#>sO4 ziz--_`Msw)Ihhy?^sWvs`cBJjyTePMU;tncMkvB&{PH*-Z&8gl&R3rU38+K53CLG4lk-We=vq%2&+M?-_|Y5N?-h)IKt+J1pL#Q zYc~#edRB{q$#aXb8VE`y<}BT+lauUEPS?baYt7Qp_ntHsUs(wY*S4 z!m0}E$P$4w?doQ%_>PZ{j{!K2|L})DAPDrGl7!AzD?+WWPfkJu{-4u#Zy}oHLU1%@ zVy4HH&1+rr1N7I+5AUmB$n~#4@Y}rzjk+4N8G=0m_!%_&PIl(TjSh9H0=LuY%!JPb zYJr+S6cBXU`j3GJBUW)L1GnI zu#TV+?X>kSh(bS=p_Tx&UyJ~{6S2Ad)C@vk&)CGgMsroe$g?2Svo`>8V0Qv!TW#_` zRCBcHW+3W>{6%HcLs-|+R9q*Pz?B@j>r%#$cQEut;Bo2mv|Kn8XkA*4h0Ty*X#*Qh z*^0Uq&Ey@zeI=f}@M82Re6IGOU<*9;Sn~AWie|qkB|_4XIpJu=?hGhOCSjp#kyOQJ zGPyzhj}>!wS5q#ER*@VNE?5~#Dh4@f;K3x~KyhHsgx|BAn1I{ zb3v0oXDqn^t?st)NL$~veaX@3kC*5rL2`>akoksJ(rHmPiA_3BQW4TZH8AnVe>`7=F~om`nCjy z>tWbg2pZyP&>DbhJ2tTD{E%-0O3x=IbIw6cSx33;M8c&WMI!V*kocMvrs+{iZjX41 zPYz(3?t@mX33Ie}5|L8i(ojq_33%1dgcWu`xs<)*J+#jX6T18VXYcR3Be#u2Vf_F7 z6gW!GZ=`H@%VX#6-JP3Xa^%sBSJ$4g?nt(ueZ09DG>Ps;L;?%}O4Hu#cYhA501)gK z66_aA;}AI~9K)k$4Jo9T&*YTY zb8^U4{qW(c_o9CIaOKuy{wZgTDOG&wcDor9YDYywmrUWDouHCq@(JU{HoHpa4WaomNw7dl`1;ltHII1od) z`f(uUi;Wxz{BRRd6BId(M`J>cj-TnT0Y9A&NN-lA{>)wc-VMb0Tehi5UGv2j5t(i* z6}_-j6#6%4@@91L_Aa8HhsX!~-Kq~~xP^f%=p-9GOO!L-7#nOme3a(|@83W#zM!0?r zu6%GiO5O!eDM@6Ou>^B8%n&^8vt5K~W_4DRyMG07+6vC+xOL|r-dtS1do#(?-z?n&(4TbY`p{IyDKSo`!TMviq2E9cG3Mo8K%i*AKB{U-)yCndPGW!(QpfD z)v;BU;TGwVu~DdGJpX(css?bLHFx!R7~c1u>|&hA4jWYW+}xs@#&hrIswFttf~V?C zmIlqsCQ34$094K^#mWhG|I8pBb5Fqie`KZNQj9>sF(MUD{}j>lqo$RiTIL&*n$^t^i$fnZ(_1OJ~N^f$Gu0ed2w7h7is&J_1P}$t;w|8XVyIFT|1}~ z*;#5hdF#m0^yBF5tFgLo`BMEY8{-VdMOts%0r>u>aLRaIy5VQwYH^4SC(nw(e%2bH zN7#dSHu~6HU47p`S!IP$ua;>;vKrG@rde4>b0$)Vm@=ALVu626le?}h7&x(k z6N}-*j_&p0kesJRq_JL1wVNxR|7So@o|*FoW>9!XTQgiXHKFc{6~4+pwhB&JW$h3t zWKm@lO0aV0u73bVD2TZ}G_r-^+zpBx6*-@j45OS32V}S%+g%Ut>9IoTpDLKX8RqcC zzx@995ntF$b)2a%K%{U14nn%|vz;8>&iwd3F5*p7OSW9xI9W9yS2n?%~EvF&z{j+A@HwLNn1 ztahLuwHCykFRg8NLuoHRw{D( zH8TIeN)m#(Gp3pQsrwqP*I~0%7+%>t{XrCs=LyZS z2uY%uhRNMQ$b!2J7Km`%;G%;L_(dVV1lo-loz6zUDw1Q30VBH!2mKMDS+;&KgMqDXyBpY!?g>!W8KFVCuFdstVz1H;kKKb==y5(5T9F%R+^rC9JnK|nP z0Ds4nrNCpmH%UM(tSZCPnSgFbGEfuG=>U_14__#f%A_)qaJ}WV4-aaA;x?}HKtu+b zb#Vq!qowjeJkT<|xNeOUZbk{$--NbM_n4UHbSf*|d8@b-OfFm5=Vuz-q#4!HP}^41 zXRYzvX@tSrI#^o=Yb#kjuULTrqym?iu0fPK35s1#H$Zo>c3swF6IuM#INU($h+)K} zJ?pjpc%@X2p{~I19oRAkeMZQ58({FF4xzhYnc-|n)0Q2pPnYQ{0*n|HLgJOIMz(b9 z$f_Vjip4hy8sV3T%^YQat9ND?v2*DKJQ&3@-?3k;COE{eeWLbc!Ey@!d~0CYl4EjH zi!w%-?!5mGVvpG7r zU9YXdxnXhcW2_F%2hKP>Wlp@X0*sJx1cktvb7pB-HocBsOeQbT?`YCp382wsrDx-R zB}^nTHFLU!xt2-;e^zVl`ma8>t7~{c!93%5f}S^kOUw6mcg`xBc-DNEPX=fKBN@**B#KFa;xHAFrU=_9emY5tYGk{a&N* zsG{|C>sP*h{kvX^S=pYOMzwEQ>7vq>pcA>hDC>FyL!M1*?GMTd&;0Tvy2EE%PQPw@ z6xI)$1J;h%tsjk`B2DA9E0q|TYppJi*jZyn~=>$B{Ioh%cZl8ZOW z)8LSZZV-JnHvi}JUe3lkWi#}B!f!xVpxWcTP?MK24dG+V7Z5^+tX$q3?Ea_LE`Ctf zKF&KRGd*hrgDaHk1!F13u4VPq%Sv=ie0t_QVBypYBQj;a?i1+SN@n%~a+#GfCrZ#l zEu;p04=rfIb*Iz4E@^USdH|a$%(Q)4$(fBT2$7%}rKcCAtmX>{G{d)&j4F%`YNKGXqx5w-g-uiGG}M8g1)TiO35#^|l+R+YcJpFo366uV(h(D>tUY^L`@FcmLREL8 z{FtqI0Y79?%){)D{>-=bYi>0`xJdauPb-??eb&9c*Ed%ve;Of&v%l4zlthK|e_JJ-Ti>!6`ZTKj;as=3Ym;Nbtccw*~t`%PZv)(B*PMt|fT?@f4377RY9Qb(SmGCa+#ksAd9Khn7l@b+eJ> z&^-_q3h+4vO)zF>84)cdkhx9@Y}$n&>=RdzbP7QYyG3o(hGVqMs0IOiaHAkMajmF?ZdYsR3WzfnS(|R%aOJFa_zzjtV_9JW4nPt z1(sVaSt5nfWtG70Q8F#%9TRnIP&X1cLmq0MY;gFIwsgHuBSCVS0_uG0MWSvfNWVdJ zW`qo`VW*~sXL2Uch?zQF^{6%|8i4ZbkkJo0(=?@;9xDRk9rZO&t%DUnI&i$QoQRW- zWWmFn9M?a-jv5EVApkC<#M1_At&tw17CZZN_cwos=|V4>mH_XcK2b^O6O*SfYlq`&bD)P|Y31EuS;3YL8>QQ6qcTmixjP z0*~i**(#AXE-0#R#1kd$&1rarm`(0$Fvh~b?_?TpVcyMT-x#V6yu$cC1qw`j0lZmM zBcTkE@&#?LZ{2J=YR_sGe(Y=g!L-IOt?|pq2}C;Ay0(K+I5rU9HA7x+dRZ-Z-ROEG zd&600CGXy5W6K#ggfSjSziY65RzmO!8jR>WbsC$A-BFkMulf4fj)Ma0x>(X!V9rPpj`$?f;u@eH&ZgQo}kmrFdP9Q`T4Be&{_s>ePFYAP=FRQ z{4{P1yy6=lPP~V~E6M|YY z7|)5nbNIut4c>`j%FH3HQ_01HpWqgR<81IFtxv(XP$$fqS6ylVbLCuIU*YWfjr|r# zz|!)Hdcn(dT+mW4Q6DvG%*;nU_wn`F#qB7jLSon&TMQs_CQNHP@8wbA+Ul+zd)2X_ z*se8J9oFP>N}U(1wODN2!Xi_4Xs$-`AfsDeL3$M}~~6rZ*q5F(8Ln zy{HUBN9Bi?sOyjc+lA5~+H7Wt&cI*uosX0+_ZGx^vRY}5_*KJxF70Rq=F?SO*wdX_-^a6HqP02K01f&gcWnGV|Xysu~?h zwQ-GnE--fmS5Ap(qqR=cQWk|ZX5?qPuMu2l%6q23E6YWSnXQ^L!Ah#Z5NlHl!_~Js znONl@wjE@(j?G7F`R2`b@7P~^%##b;cXvK}Y$POqJ0m|R+#Y`;_{h5`$sDafRygl5 z_(fJMg3&`6*GEk^Vbqw{>ryK9-hFa}DGu_lZG-%~+6MVIru`b^Us6-0$2!yRLr$wn z7Xz5>0|!FhOKm+OfFY(^^@|h;=mT9&1k*Nqn^T>CaASW{8m7uhI>9+~1ihz$7C4{o4b^5w_JutzjVkyoSMc5 z7#>@_QiuEoe%N7PLH)wMM#ifd`M?r+&q_p*H=hbBjEMf0^2{KJLzLR80rf?jZUBKv z%%6I@(RpXu;IR3$ai(AEF(%OGx@%fj!SzBU$KqP6eH_v7f@Yj-ER2eFOH=^%I|A zVK{V~+i>XmOyh&arqyF-d4;xPw~H8Rc?LTsS48GqYvx>|{V^I5t{aIMEO7u^1v)sh zPrfK}&B*tf3JBW|Tp^n-2+s>Flmdr*Y$Fw&Uf$0-0k=uQK7sWFC-x6PdwPF@86D!& zkTek4eQc9K(kaWx-zruviHu37@0yP*f+E6-rx-@#>|w{$l7TVo%_qZzLn5=CCF|9W z>in4f@O@^%=s_E@+33Z&6XQ*+!{){N%YNjbr<)+zlh_e*(EI9JTQZn^kYIyRfyMc>)ioLK#Jr1Te@G-{BClDEJVeVWO{l0NUt^|>#1>sKT zfVrV@P-kJNt=XGKwRte@qh4xJ5?*hniz{(br*v%)9M5opN5KjFcCyZz?#6CDhRkyacTB6) zeVtLX!W`RVusYtR`g1qIJGJG@#=}0DjvLZ|L`Nm{KJ=@#YaVS!whkNw?)qHWW(R)U z^g$4_%vIk_S}*V(m~YOD&#HW}l57qQPeDQ~AvZ4~dOpsv5``q6 z^9ZMc@!c=be-;c>NTPMry2}>v!-B<)a?G9m_{6!uEpDgov0*K z^w+`YD3+8=N5nVxE>+<=Zi21xcrC#v{_4Vr>UzHsqY1?|zi(uChWr>*DK8$vwO|jf zYNWL2Mqy9~^BECxWtL&Ely^aBywcgZH|*t@Z=VW?7SytO+EO+DAe2492=w18e4v6f8JCkckMh_Q&ENQ zuV}06L(6tL?y*a$v`sr@X-B{q7(BIuw03GuEkqftt3x;|(Lv^-8CI&PVmd}e+xJ)o zT^phoo>2P}*by1zgmGDW$@q_!2NsPt4R;#@FVkEZE#|$Hag5aLa1xPWJNoe0+5Pat z)nz}Pzy8j#!0_)Tcw#c&bA@(5{{$70*xVOAY=2pd4IYR? zpy<`iMPW64GPv@c)D8}C(e**Yx4yOyIZxUBxk~BF5lqtseK*%c6*+l%(mlcr&v{16 zY}qJrU-x4!UpFB59DZ>^PGt!rCsdG(x#Vk>04-7eIeT^(e;kuZksgD8!d`>xy-^tE zvcBTDF!$bs{9tb-%LX7e7@)W}p4)Cj6NICyYF3mk2T`h!b>r4E-GOe!Pn-aU7`r#` z$n^(S$b)f=*xia*fotsVsU{TZT~cM#$bx7%Xy32PH`gEDyuP@7bNPyVV@Khk zm@y%@VNI(bCf8QB@$(qjyP-q-=Bu1S?FlN#mEgLru#aJOnH1LJ%Jggv9&@g3=5HLx z{Oo#b9kQ-+0cD;23Jzi|apjEz6pMqme44n}2y^FAhEWIo4#NJc5u0D&&-I{nFq4xuAWHk*Z zZM~1@{N5(@JeU!qo?0&q2v=mK=MUcHu zJtRrJIJ^+47Y>3on7q)WBSJ2pA*7y!#a;s+YER%eyYhc^LA!#LImc+a$Kt(@x+{lb zyZyOtXU?f^%eo##*$rvE?l@9?5XAM@r0Ye=#=cC_jAsxQRWl?3nQ!gfDQ=wx7<5l>`AVUanqLc z&iqwps=-6`{`*^~5DwlJM^#9h$#ftSA>(oT&fk82`Tgl%jii!hXXGbl=MJ$|y5xx_ z4-4t5DZ~0}3;_CoE_e2=bMvN<9S8wjLZdIv6bAV?PmDu|HAlO2oOx)|QHat_qIwXo zFG|!h&$zf7`BGjpY4fWxVt#N3q+~SP{bD;fYW29(^bxEaU}Z3;{@)$(LZwiz8|mca z^8#h0{^tN!3|EQbhq_;&v&Q8j$kom3o2$>kNVtvnfJGft;z$;>xTy5vk}JqS+m8uc z`#Okq!y@R`AlHfV+-;5R=k>o|ToYOufNERc^+1eOz2+Ot&#=>q?YDcb*Y$GD)jow2 z?_l(O6r(SYgU{5^%LUh*YFQq`e%9#RE9NStWo}R2m3sr6lcG4NwNC43eUMgRH?D+{ z4QawwVm?MtBNfNy?w!t2|6rBZP>Cq}4y^fjGFD)OPE)I9&2I{6@axN@Ms3 zz6{BrFjUNNnAb#>gcpCIXsMVeCZl0ya&mtUKX}++wJRX=t+@({g*F* z<^1Z)fBB*lN1iU`?;pi{f9x=dMlb|q5i%^}4aN=_!VkFGy~Bvh266m#){pTVy#5ET z|Cl6fh-pYP53Yv^`i5L5>vS4P^!4XMq7SN#;eTs8#$$7}xBeaicwenf7ZK>Q`Jo$J zOss1iB6|7$<}cq}eEsG-*b(bhXHK#ee-7=+eGsYH20&q8JSX!(teKkdl0L|*e-kDE3nvJ|N1;ox7+BaFfz<7WjxD(- z@gjht+rARxQLN4zk`=DzqlBz&hqx4=qhqKdeaEY5K4>5K5~>`VV!e8M}{(?V(~b`09w^l_8oT*Di$ed5?iYKGw}-Yg51{Vg*fg)_pc zXkVZM(1;-&&SNF}i+A!&dxl?|4;-woE-lOMVyBhGRT7D;WF282m3v9AF84nBveXZ< z?3>c7`PqsOpZ(3=POT7$I^NI!2;aaFUMUp3?I=ITll*ii_~=*uuO#~t9;Tku&V6JR zUS@A=T1P=WYEEkBQX@|CfoYqY`QG%clz)XB?(w9}eSuapEUB4gW@n`c3wPQ)OYH>^ zu;^q?3x$o#jmbQm2XcT7U_-hp&=*WkBo6W}v4*7=`>{t&(~jsxBkb=m)%4D z$Hlwv2u(ol!CajBMz7eRA2GIST`6*<&O-ekq+f|aNRgYvH{rDWsR@GZ&+ z=K3)NLlHWkL&>#!Lq5x#X8e~rUGsvG>o@Npb_O_f!~SX39Tbhthr%0-s=4wBA#aq_ zkfzx5ZZ|{uN-*FgHlAiO=}ySw!DUOciIl*HWWi|4Y;94)UKIsPCxpB`0{=~+X2pBjZY7BG$L=S(?bu9F4c>MQt92udTgPhCQW*Ee_P%e$yD zJu!Thu4tAm$Ly1#&E|l>od5y-uJjb^Rq7NFyC|8){CX$29w8yx?F2i8I#QL!gg~Rs zpY&PdJu8>C|LD(lE9<;Z$?@Y99giwI-m}O3D?#p9F?Qd|!q2Gu_~8nW?^A+&$0Fp% zDMNnfLgaf^7v8-X`5{VRKYBs($16#`=f3P(mi#cg@^yCx$<4%vSZ2eLliCF0~7WmJx^S^{K<=#KacX|JEHndAMIbn zJU)s7+x}v!!@LbTqUq9=vaq7#x@6g7K#)NLc@^qtg~EFLuI_N4r7JY@2%t3=dReg% zNu_w9ty-s$DP|O`3KxOko%7NS&_9hRT2?n&GBXstr#z$6%*pxSJBErpNLJuH(l!m) zRb*>rKwBhRNT4c^#U~uJ-soWHrgE^yXl-Z%w6!kTjjD-XSSfq-zd>=+7aL=&x^;{3 zO0Qc36+eI!ac`|h5WQUoNc329DRJw-G7eo#VdY0XhV@21L)BcMtnPEebm-e|ZRROV z88x#-dr;55ABy^r@JiHW(!Y=U%Y5>e@BZQj86XBMr|lMm6djp z_4s=v7@@3*md<8(Bn5X*k!bhRgANf*N1zd5G+7w-aEwNH!@xRD_0p^#xkkBq!}Y;* zzby{G11Ak6nXZTI<*+A5ajcfB)l0{W-@nd>Ca$~(Kf86 z&MjfiiFF>S#M(GeVzl2_po4-%P^a<>GFdEm0y)A=$M#*fn|>Sms2zf>QOvM9Fm1>^ zV%EcyA{^kG)AEj`o-Lb@YqM~to9J_mx$6*o3hAs6y=^Q;!Z$(7o z+`XfPLRE_4jm$QH`Y)O&x@JvuG&&TZZo8_RcThENQ#0FjTm0{<4%%6Y&m-KWT9>ec z(h(eB8ubmMoT+R9%|1++Yfs=!wc4J_yK1#v&437O&YT`Px_SOd_0=hmM{&DaZAW#( zT5WyYvQ}HXo7QUUCm3Pd_ppX}p38=GW!V^DFhI5}0z$UK8MW6F9#cA1GOKiKD(P*V zg?AlH+Nt;YU2v=21~(;eD0p@4(&vtZdlxl&Uln=}xdhuDy2L&z^T$#G?w(c!+tVgj z!FH?^E7%@i)#yI=rM_IU$$m0TEk((am@5FJ2xt4lM3(VVS$`c@?~}5x^4$5_UtC}9 zpbH4T-mDFX)d2+kJb!(_6^i)IN6C5l8xi>cX9qFS5gTXRR(P8a>$nwq7- zF{Gis`FoTb4_oa(8t-sS_K?(IoQO5Mb9qx@x!Vwm%Tk(Y(EZaDp|0+Jz>MP1{J5xj$K>6 z);d3fVuzKT@%x*boQ)d6btm^R1t&MmZXdUdnOoN0;J$9K_bf9K`A%>_Rld*T;8knp z0=UOLePl50?tkLJ`&iB-hcTIBdkQtruIinUXT+N7n%)x_)H{QE=O0SF6YwYQdfUM< ziLB^(!c2o!*|Wn@bg{6Lx}2mr;ZDud+eeQy?HDg6lNV^on0Re(rDx-R?cFUCiAigr zJmWdHj@pK9GSyRtG3^vPnIuIuvK>xxmdkQE@|~I=8>84a&VY?hs|N9)%Q%0eOc&~-*dHFd;}HC z?|Yvmf+=QqzA>6T?Cj3nK#Uv9I-ts5R=TMAM*N&)#py_>^+L&|#DT|a8Q z6;x|hidW?Sp8n@Q|9yP+r_2% z>vK1OTv{pdkq`Usg5ZwJeFk#iZdRk`Xa(vy2s!;T{a0Z-eJsuQqtT4W4gjmnq)tZ4wn1%X-^)4SrO+c%Z z8_D}Ih>063EEX$LmexO5N}~+`Cgg&YEa3&WNf; zNs|Rr!MsqMu-W?iN1PW~HRl3l59r;no7s|-QagW3yNK1P-3G&&&wC7t+?+0#P)0|F zgW*c~Ec`3t5$F5|%D|3D5fM zrbuhAB26+zl_oF0AUPM6?vu|T5P$yV_dQQpKfz~@EC{_$Rw(AczrCzuRghTpu#jBn zRmsQRQoB$~P;vh1WAJ;t948J$b@;bRPM12qgo%B>nU?SW*oSL1FI(5KV?E4R7G_?` zsxzBG-?IRnIzir<4{V<7ZdWH)_6l_6*jLm}KZk-Ko9a%weRo;WpRV>~ylhdjIaj(o z0-&(p=E<;0p=3$&D$~5kYM^~^AK1IPTVk!bP#V|*D3<%dn#^EEJN08Rp`lg+c=oe` zmelV|BJ-R^6gq1rsOYr9_O5^py%PB#uofUAbAHdn zDjr)N|7)7uG0`pG{-7L8)1{!fEofbo@}3)XXX#4+YGf7Wm}%POt4FTxPynpd;j5pT zKKG@43hfppzfYKBPEEguTK9ctMJ}?r+>gzGjAsh2CU11cY^Rx_W!>sGSI1=qr)(jB zN3Cb>4ruF3ozh1X8&OWar6ONL_P0w0Vokr|+P%xHvQIQGGNvYX z{|Y)tdv4FmX?p(Q&Bf)rHbe%2)3oH$OFZ+mXT!>Z+Y>Gyb-D@S)I3f zbtpsM4pw>%cjVP0l~UZhBy&0KzBo|typRthmE?huqGb0*Mh0gGMS>a<7OIe>E|Gar z%A6~AhjrKaBYh|+&*}W&I0>D4Jq#RZd=!@?Zr3yVn}vKBYdNkI8}m4+Dgr`xYzc0a z2ZoXDwjp3^2`YDZZrH33Utj*9Vw84)sBzA8a-Ohaac)QW+~A!{!L=;=)u4(1xa$|M z{zPV(tqvq-aq<&O&Y7~vn?a3dm_`a<4!47#1bCQd88U_$c*?G4sRI3(rdYKFpM8evP7 z_pB^=$`pyF<)PAvXU}BI`q&|3T^V-KYwzy9@U)H#$8uTdeRo9Zt9LicA5D$XxOm`6 z?~8|~IgiLm@SLumIK2UI=B;ly#%N!)fl6q`uD*{}9oYAq`hgq!FsLcNM-BCFJ*E;N z({_8`bC&btW%(y4obKiJKIaWft{;jAn^VmmXg?Ore&aw6(4c8rGNs%lVv(_PT^H9^ zNtNjiA%4+i#@F!uZd~+lJ;!}$ufjS(`KwAASA`YrI)u_8BT%@jsa-FNwy#d67`q)79n4B_lyWq*)bzp6k zrFkZTN4?mLp5I2JrCr8#UsYQ0ox77A3B9q9F~4;#kt!t0-=yN|K5Gdn>nPZWek9{Oa2QJ4M0V%=c@3D-!ow!0qE@#96s9x4j9TZ7Pul5Ge$ zU;NAOe;;ve@)BytaVVk%k>%cWNlOMSIfkq{9Rm71=_t+h@xx<}8V=hh{59U|JIV;y z+dK~`I<6imMaQEg=6H;B9LG<>@d&9m9xLI-QPXThn#N;OYWOr65prp4B8`5bchN~R z4w)*WXXHeDT8!O7P97@-#*-z!c-nLqM@@3^Sg9=@A)!V8G!}hhxZ>ltb~{K%PET=w zq!b5DMRBME6urn{d=Ob&iiyZDvx7&C#b+Prk#itmNIF-vdzqcSHjrZ|aO$2nDzaRT zKv&V@g$n9#XlY37(Or|HauG)2ew-2oCm>rHpG`W??{8Kt{r<5N5Udfu-O@i8_@BUv-X>lnioP&`eD>v9!(} zW*KG2%2KUaUPNSNAFRQHH8{o^{Fo-8MU_)AHpB)@#tjdhl^b$GNM!Xn*ium1Lb!G% z_}?m4rwjF5$`Ooc(C_iUhRoFp5lZA*ESz1d2ce@UaiD`i8p=7nV94iPukd*ddD@D~ zG|S{eoMtm*V9eH=wb-OAQ$})Lma??wyl^?_gJmRgR-$Z*o-y52#%ZL*h%iY{m@LP9RDet0Uo|CVsiZBqpqk_&+?{j){{q?&ugHWKOy1Lxx$8r-6 z{{C=r_A4OieZ8-Jy%{W>00FSIfaQRx1>DUUQyp?c8iniC6jA7C;_}aRGmR_M>ON2J z4zsX02b6jh`_b{P(Z;Z6TYl{9zfG05ePp*f6d||%y#7nee57C>n4wnmnw9T28icyZ z_gW{Q2QFn6I08yiR)V~QO27pxL3d+$1FK6TRA@e?vl$m$FG)fRI^`MH8y)Py2NOT$ zwYwO)3LA!35a0~V8%b6v!!rR-P|7SrPj-B|-glemT~MVSWSPE!!f_iSo0=~9&9?&< z*8O5D(3OFI^@g?HKn+}7cwFs--wg=};rV%?I$e4_5bWyRBu|%tp)Ur|+1U>%}Yb z)fb!J;KIG}a^nkiy|ka{_?Iun|Mut8pU3uJzjKeaRX1xzrj{G1NT<8pIo?B98TtH@ ztFnUEzpm1`jZ`t{^V-3fTxV3zWQhq_q}ZZ=t6d8`y>oOW&G$VVCli|!+qP{_tQ*_5 zZQB#uwr$&**nabQzVG_|QC)TF)?K$(S5@EcbN1PL?D1$Nh+R9rq<2^nIKlL1Nw)zg zG1Drdo{ALBM^uj= z{s-X=qslc9IuI(RShG!Uc?2pA=$vDr26b;#Ii=o&dG zFHe(wEA+HU@vtsgsT%L{5-S&MS;C2x(hG4dTjD!hueEseFPdy6HSDe!_02}OF8ofv43I$60*-|w_aMwLm7z~wmJ)3hfO7Vku=?p6WcAb+K4 z5+A$tTIv7NX{fw+S!0w-RQ8iBFghdsU4g?NUeOl!b(<+qQwDgeLe}ATM$rD`$T^s^ zXWPX!@vTJ_Di~Vf+EAWas+4{T`HctP`cGMr>B3C)!aZA$d6h-XNYlKZ)s2G;hLXFm zmg0(F@+@Zpc0c!T@85g~?~C$M8@ofr^BK2P^=#>)3t5MtMc9263ddO|D%n5a;Fb88 zx%7?LNPK61Xa#O{GiU-RkD|+zoGM33iu@?jDNc7BLL<(-Lf}8`hk5&MdMWw2I_VizxVLT1RxboC0(u z*i1u(Ny;fQXi8~5x2f!p?O$p^MZHe$<(ZJVn5oqLysRqh$$Ez zSb3&?R2j)_kT3ugY$AKb&2vfG`h+Pf%T+lzHk4{T3JzC8jV#$waHM2%9BUNB`B+mMgmNEacK}q$XT#(v?LzvZP(Zu`BX^I2UoU6MVkY5nciQXmReIwqn*1V{vu-?-? z6aS*E;*#&77?gZ8l4LemKKjQ#y%lk{_yA5e(~9wPVA3eS%$95!7C(rVF%3>gOU?O) zQN!zm0i#^1w$Dh^E2V-uJ^x|*Z)xjLkZ5l;_^fFyJAY3(nHcABoV2WDHU`daIGO3* zLn~|0#Ddi>5vTcj{Tm{S4a|Ni)bXIt=zTz?h=E?EsE*)FJ zTa!;!DXQbB&fh&B`;nNi*ElYlTiDmQ9xV=ou$gho74PU_{&f$;f9)ahPELgle-*av93Kl6$71l*+>s zI2)D(XouJrOl`PFDKjU@Nvf=5fXgD1EL=jUqos^eaD4I~&P1GkNz&&<$$=ZM_C{S0 zLV`QBsvR2B-l)?_95xi$4z?nw=0%DqsYBM-;EF9nwgyaG z0cZJ%_#p-*CImUAL4lEF2$@W_%IL$N?53AAggP$a%4x)kdx<(Om~uqrcvZ`*=iM5hvwC^dj9Yy7?R_}~ZFS#x?C2HlW2PJg|%LMIs z2Ef}E>oU17d_BGEb5&DW7>=}>H>cFMLD_d$#T>P3o6TD+hUN5G*#`18 zlA$cb-IjGS)|)7aGqxH1k5Ex4QRS^aeKw6SN35!;zf&aL)zG?OH7W0POGiYB98XfC zzM>#pX;nAcQ(u0E1Z$0k{POysLyhN0E*}-&bpz)NMwsCn&cx$6Rp>HZ(0N7u>t8S? z+ytjN2in2nN=TraH~p3bJvGz0Z6E~rw*GRu6*~C$d&?eoaO0DA&=LlRD$l+GCz#uh z1vn9D>$_^9MT^piY=Tl=nXFfEQx-Sksw$5|J!zmT8vlVv*`aY=Pbk=N+4R_oVeVg! zopCRgPHYSZPJyvNgMlFEWpNGCsCLB0u~)T7-YWsKn6nBKMW;6jeJU>9!q=owV5N!n z8SW{STC9ww8szU%OLAv4B?K_Ga$a(fj*!#$h1DiHNTzr9I1RnAqhD1prLrQnbII!r z>mdr4e~p}O)%=)mywCrIChsb7;Ak>XBowJEI6Z{P$s`0&sts%^MF9{`nSHPj8&oW{ zMBA~4RGwkwS~v@Z;!#en5Yf50&g^S-$OQQB&U`L_|G|V^~ zfb_L_hzS|5A0yD%#Pg@>hD%BBW4fnqo?P4?t216#@PmamrjTWoKbMfub3m_n=L`44 zfi8LvZ^lYl{JSkb6V|yNJxm6mfR`r z=rJ{M4O*PS9}uGUw`3``)ETdKYvmd%S%zOngu|y&ARdN-nF?Omi}-5=v6NX#WK5dp z)rHC?MBsrZQKATL84C|>RLd78SJgsp$5dk1oe$d}Gj&@#Zg~&(9-b4xuL2}_rH100 zx7{lUO+JqH4 z#>j9|3Dw}VXTS!Npl+3BK!*GClom66M$8ab(_r$dNCl_UAH3CAOYLBB^=f5)IS*I9 z4nXAU5ZBq^b^N%=+F@37L@GJ|H_5nLp{-!L^KK`(b=X7i+R)$R^z`$G{3>jR`(2k= zbM_k~_AiVcY;()8X*)xEs8E5c-J(qyN-P$t^PpcT`Ivp{*5dJ$DKF=~9CIe2$L;VG zA6Kln4Dkcaq(!bJUcRhJqmE1jBxAm}*jW(XoYB({K5B+6dln^aB*)nx-!OeBq?1?h z{p0@WpV8I&%wp3(&Xp8)&TQvnP;pfWo8_a(y0|Rv(hiId#-?XwZ-Kb8r!PFPsQmuL z7mLr;$b-G_15knZFFX&X*eAS7*_nx&9pmm2$agtGA@2B*5g7Qlf0T#tf`Xv&UQR^r zKh*Cd&_LJ{M?QZYN(6F2&BtSrcJEvJcp(w~xqsy41VTQ*rUb)T*U~gL_SG|}qeDyx z$>7kyKw^2-(!~AOlLwa)+*dzq^$B9+($`S}73DsemnIB3$fLn9d9UE`0PC{`PMj?DbjXwy)-v`x#$DTvf2oN{x*2BuV0jpfvH`f67__yFWrmXa5 zeHk*mbYx+^q-v3Q@!(7`wxrHiSTSenG9C43tyxXj7;hzHoJZI=#{`G!9yZxMfbGzC zV?N~L$CW<%-MqdL_f1;>_qxL+j(6AdQxoz1)WNwwt>z}e@1IYtODFHCOK}-dW5O(E z%IpRe(oHF_82=o<(v)5(q?5ZGo`?WK$9X{0oqt9$|2bY;{rNeq_5U`l{?G2Lu&$ki zO~GPPH~HDMxv`KFGB0aCdw3aQV)ADU)ji<S>gP*`FkOx8u1xZTWVG#~g=VAkU#Z9Q?A&K_UwM*p(^bdYfv&Hvb! z4{!e)o$C!Ak^eEc{G>fD56kMowQ)Z>#<6(1Hp}M;&AE7LZaEVy0nh63RVQ(zP-t2@ z$Nbaxf799A)K?GmGrM3v#mY9&IDaNI&{+S+M)^$x^V2F>3B~5Uu>S8WYuh>EFF&*B zjb-uhLA-Q&<_4V9L=kJPYlzQQf>LV_$)2Vhs9)zGBkb>&1*52$GR*@V&$7(C(%EX9 zltq`F;L%RK919ZzyNR}Cul z$bCe~KOVo6GbMtDwzNv96tr?ko@9vxopE7!-g%xU20^%BTnRfdxomI%;nV?z&)6z z?G}X7HV`7VN77Ur!BcQmQb4BkzVmzMexucKhy`(2G<*U0H+LQ^JPm3zpmHI#1H7kcG?fNRvsM9 zT)Zn?sx2<{$F;4kN~QI7;luo-b=6m>1=BTPLT4%L)QvOFV20z>sfAQUI9kzVKXt_7qzHcxftheidjsQ!65YEKjbsi1Bl zP1zw+J>(%;ZEu1==Y-%yiaA3(u0hpSYd~f5Dw};Wu&^(MDvv}l6 z$i4bIA*kefiZ5rRHTD zi>!K_&f08y9~6h~T9@#r*eZWU(2(0VxI|d~czr+Yk4V z{9fb7mk?pFhFL^o6_a$;HKV-!_hS$I4Wl}qs0n+E__ncfT%83& zS0$+;y7{6*p%RHvC!3o4*4gV&N}sB%-5d?IF%Qg}RS!6s=!W+MY%Yzk0&h09F9I)<^w>WHu05vfZ=750hNz zGJ%KtbWrS|wlEzdjCJO?|oEJKhg+ zXQt)keZQWz*jrX?zb0qCz8XsJxIZqgOZXeuePjL|{`)82b7`4=C=_eVDHhj5)Lz-% zcPOy%t=(GQQ)5wnNS^{q?EKM%sL}qeSPedukZ?8-RlU&<8hGZ_2h-VK)|}fiC&7@J ziD3N)mFny3ELXGJJ=`b$4mc~OyRE%)fDt3AvkMri#p|2YrzS1uK1qgCB#)watPFr) zG|XHqp~QqesII}#YX9MN2{5HC^bRgWtDNL)P02t)n(6tz>3@qzLO8h7=fR8B!th}w zPF9eK#rE7)wk$Xp9+yi4)rhUixq}-hMtepZ8X0;kY&PjkIQRAD$|6`;G+Qhn~HVjBFw>NOl>3d`V_gw7eO^2_1>lW1b>ut1`y3|j@tdNj8K5BzEd-O!m68Kg4+ElQ19;nKPlPmofG)d7m9#8IsD396h_Ur42B3v`K`r$V#=+v)72?oX%ss>>vr$_IBNwSUKQhL+my@yoIm#p=8rB+o-h4&> z3VkFJwUVV{Q?7!q!f;6xYa??F?@XKE5jF%nMscCp=}~`$I6)ndL8Lkd(P!Xb*sNhGAyto#xx$x|vvC}M zKDS(TVUa{@YC4v@9#TpG$PIQid6@Db{>8xDFzE!RCYI9REP=D7-h#`M(`s}qud^U1 zGVviB_z3t+Nnsgv24_1`VX+7M1bz?zT})<;h_UEglR^h6a?DxZi-wkWow@?}fs57! zUmjp`^?+oUEXROMI{&PPM-k{c08cu0=_$+%tr=`oQAB(D=(j58EI3I1+$uz3R?a-- zUn`G2XBcq7*P|R#@tHr5*T%g;~f;B5jhRsVGh( zoL|s=jOVVxKwSifB*@FrV`@!p_$&j|rBhoJJ9qRGjA0oCk9Rf-=UT7YPLC&)6N{mJ zUcoi0PNAB!cDLV;J%)1uN53TS%zcKD-U6Iz?YitRs4F}}MY|;5=(f=sw&lpFVX=!x z%}Brx;b!kM6egR^oIE&rZad)wB)czQlDbx+(h!5wnol?G!DJcj%o|rG>O^g<4TtHS zht%d9*|XvkdsTB4x~>#I6iU0;|K%LwkZ5X0-GiyEokrQ(<6iR4qvgU=XMI9>I=^Zi z^vwM&$9wF?Ck*aq4nx1KLYsuZd}WH4f_Fli-@uf}*!d-!{rTlDi=njb?BsF&Tkb@gzWnTG9qwYWsd`mU(^kh$ z-AzMbV8zL};tL1`Q#^a80ru5^Jb@tBJ7y~Bk)ZTNEOsS`8oGtI_K2f()|rGecmFKX z^>*}vG?74Rl&Vl*ZePW5yj(lCkg%>8!MFCB5)%G0qO^td*6${HTEM82q7$O4hrQ0S zl$b;_ixF@Jp2k@>wt23!G|bUq4=^t|l|UmAWXc5YQck#+H-XpB?c*V+OG7=F;%{ls zL#!qB#L_p~#dI;OEw2RlgZQ}3Jp4Qi+Fj<~_CYBct10+acGR~BJ@MdVuY#gWZqyJy zT(xs&1t(OhQwm;jW)&q^HLKd#)osq`O5#mW$if#(Ub*E{v;|R`{3*M1Tk0)ovJKz~ zOWOnYB@cJ+li<=SzJ^xFb+9AYbRcu2>ozo~#;6&ch^Aj;G~{2nrPqu4zMLuHkG<^i zIl;4zygB!CP#ib^EpwQ(gvIXtLT_TFm=TebLdg-gi`ETJLRwfxxOL8R@I3iZc!lj$ zPrJTiV>0^a4%NLnGh-Q<{2bp$x}NSSZ=J_{y1r4&CTKe7shYwwBt4iaV^1{<1sDV# zWFaP2Bkj;hlEK>hj7xHEvK@&#)V}E)&+mmn_3JUc(ov~^0P>=^ZkJ+!&Gv5}+q0xJ z(HIIMTftgl*2w6)6N27_LHYIMnyLuz1P+(io>YH21l!y4TpK%D_1WlH_R*B*-T`AL zJaWI3iiBFr4VwaElh!1iGI#VpKp4Wfw)N>YbIMQhWs%Cq0D@Dob)&MkAYG}@3T;S} zPNgN?znc2s%PB;p{MB!X4NWI9fVzCw?(}re&bBVGA3|RfM&+U1B|df&HZJ7KsSqC` z=Ysm-sK>z)i@rbtP(Z!aEiS1gG>>JtMX~frEAr- z;~L|AzjB<0QES#S5Y+y8TC|g1ffc2;dF5 z>qEV&gVIei=Rgp!yzn-!SucpFs1xpiYF?(Ht)8lBAe> z=7s{#dRItJFMb6ZM4)kJdg*lAxj$sU`!9Z*`_=&g5Vh7#v^}_grPf~^UFZBQI5qUC z0mnSA0CJyrPWj8^_1Wx&+u$*`95w6-Ol^JL-=m0#9F`+)9S@G*Z;1W8GDP&jO@dq< zIcr738&yvug`7d6hXkN7Sn45!`T_%l`E`{-#ffmMExe$zTQa#TKY8fndq0}Jaclj* zCu99;o#E0w#~Y@#-@!zHC2$1~yut7m`u+)A8D>%?oHSzY)EUDZJ5AbX#ouSyOi%>A z>a`%Ow(uF6p3l7`70#83t*n*scItDPvSd$G5|LwHyMJ|N!= z3pU3_<8-RD@zKh))!MEhNAR-pU!qzAJ5|0q?-zl;fz}%YAeBj(kCFPZPAp_7SD8+t zyNd z0G6#{?+?;fs8-*eHYerbsSy4{GN5X?;`}K6zUZ;5g%i=o9RmAy1!Kjx?KL*D=Z9Uh z!(->}Eq=kjsUwT5F;6+?_GzPCk3e*l{P!0Nue`LzE|d1uN-IT#imy_M2k7r~*3gX9 zKd0-t-n6>sSR<_qjj`JgAVio0O)Wk+DnxCJy_PGF^>mvO)jd6JZ@&BDr0Ads#Qei4 zhHP%j6GrHH%M&u>6{@YQuOrXaR(E!zA+P~)AKtKs3~NAE6PsnQ0uH%Gd;cZLUeH;!Ye`er48cLue5gO>HCYxY3eUIAcLvbK-x^G0!4SYd2HEIm>Pt?kN1boDv#V z8tPd|jKQyO7$~ma_bODj@3svZA@TUd^6z7g#bLq_%Q14Hu$4bGA?SsaXB2E@t~XVy z2BqW48mE!pj~f%#P8gz<5OgyR*k%-H#p*vpdl4og`I$!_Lz0L(pIEuKsWqtjso5W- zgYnnUidU2MVAE4Qu{~Z(MtR5jR!THX`to*DpCfl-UG~_qAomk+I4zX%P7;g$$`;`Q z9H80fx|f~3XEpDPHm=0N;IynD*kb6{h4m6BLz$NdOOY7W+*)m$J4`W&V&H% z2io2U0z8fkPb{<+bcU!5zGt5VQziCSX+s{ytthE;6!Y~Zl)L$NUp(&K<-3yp+WU%T&*gA}_>)#n;@3opxOc=*1mP?*!_#$pIW0iIio(&+BNWMWG=6kEkd za3FO({s0>opz}vt?li_Mju=#2_*Hw`uDh?ix`|=QlLGl?C2`uhu8ra7vz3g*GK<@WjIl9#TLA|Ru<7X^Hccz zyorqxa9pj{KY^Aam@2$=;bys7tpQI^cS2m*8Bq-Ilq*h^ZEt(+OI3UyIW@m7B1>{t zZfIeyT?R<(%~Vs0^sUOCD)@bE)6Q~x8u$ku!5FLfD+vtQN*^(>6*WnhRQ1Oo!5~=y zMX>u;n6a7P=)9DEs_R3Vm}1AoA@E3}Xc|1gE5R51ZDIsklhSNclRwjlrWseI%PTsT zOrA?fOXT_C4ZOarU}PtX7yMy?*16=^ROqs6VPW9jotx(oD=DpMRNv-G$l??_rW~P& zva%Td@%GYac%W~>f62&?u1J^QSw&_rt)!u}5FiduFX3@?c(Rr;z>e@zkC{{L;keA8 zc(W0H(^DIhlhdyLUfOxO;mS^-!wU8ijPMea%a`uI&nn8YNTHp{k}KF?ys14h;<9vn z5G=sg@rlJwqu{RuM0U-=%|#QI<%BsH&)5sI-R}1kw&A6IK?hJ%uKkuH%&Fp?0sJ+q zpIXzN5HfM-?xd6wTUb$|&;glRja}QEH_u))AjF4iO3pciT~pAQ!VmyM^Aa~xk}C4D zB}wKy5|Rz;xRw?;u~wBIK^53hF1J`vQkpRX;YztgVH^C~|2$&*;>#iI+F}}%QYGto zt5V-v6H~{SDl#TN`M|s5++%oWhyyHl>tjj7yD|D=xST7I`N8l*;@YAWJ0R-G;P;%JsnhKy0hdA8H^HeS@y26+2@9 z6=(+G0RaTS+hlSSQ41QG3nFv=K_rX;1OZY2{Y9*EOXAR(mFy@6J)0-ujV!5tY4MgXZxe;D98ph8&LyJ+j)nNCx}Bg+^~FVnB3 zt;V*Tl^6oH9CJslXM01SiFPswqhQkH3X=^?ogsDapL=(%v?bOQ_Pkm=S#}7kkD`*2 zZi#PWk>smT0TI+oReut~a(Z0cQep+`Adx`1fWs`2fyR>WLRxLSp7e%ePLxSFez^E) zc%B?qwT*(LEr35WH~ns}70@MD|9EyB!}~i%SJ0I@yitjb9*YZRpf1obO?k9Xw$#dTI zrE}8P;N*F9DFiOvGq7ou;iM_YhnPs|iet;muPV;tTr*uG*vQMon&BRaK8XYssRoBb zMQ{{YoI|(p51~C6f9{pC<#_C%{t7a**Sn92`_xOwn{f|Kl0R#hTh6CFR(dBp;TlWQ z?>qFDKdLFd*Dn#;i5J7ZQ@&i?*qKw%y-yB{B;(N!jZeROouidOJRsb2;mo=}^e$z9 zeGtrZS-Eg~e^hAFO%H*SPC2`Tv$sSGs58>Tvwc{7+{ONyb#8Ml@}?g5J5zIeuk9r_ zLx<3_`{e@zr}3gmr_I|m4#g+K)OqDe%WMDUXE}L}qIvNG_5n=Sl|`!5H3oFVIsUej zbQ@vyF46;JKxKyF;3{}SK;^Q2lKw8CSJj3jwic~QZ#%FOZ7V^8?9la!jpj&mK5vy8 zBy#Brgs$dT=V0Gr&@z3r?@$ zhE?o)4$=;5oW5^9C|}#5%J9cFg&!WT-+A-DBdVq=?Ncy4PA1CZ!=31L%qxeTY}~q7 zGcWmLJq^;ls#Wda#LBFr;oxMw)ud1xF4SG2;cWn3Lwua|X+Dnru${-r!4yi~YXhvE z%}9srpBls4Uf$-cC-OVdqgv^}%U81~MVEMGceLH@MTg^uR*xE}ZsvO=A1j=G11mhx z9{6QPj;wC@COYhsU(T{L%inh#TNL=@a(yTdRFpRNZ)>%cJyajwZoRdiD|nE<`uWxV zQy`o1ud1Y);y7gE=8f=Uy=))R;loH~M_8~N*44YX1^-@NtxyAfBlrdc+>swHH5ysI zLjk6eoiO5w%+Rj(V41Zct6}h!i65`*At1-)dc_02`Yzau0D(;#X?6iZHE4m8-B-js za98N&`R@_@C$0%Xt6<%)SH37`s|!b&FCA!&ZXq!oZ@bUWR_BbAV=|580{M?|xNUpU zs4+AOMP29UT@_jllapm$JMNUg*I~WIJv8uVWN~9#kwpQs=xS2W32I1Dg zy#mg_0e}a)gp;vqQ7dYgsP%|t%AEI>+l|C#z{1!bg2<}vg?(?HrIWXY==HK9eE3__ zNn2&(GiOOU7;kwS!X$CZI)*7zr2%S$Mb&^lUFSNC)ne}vALKAF&3@SL3yxhUAC;3n z{e_m$`~L2#4yTA3ZU_u6D`Ki_@>)%5rVUJv#z1x5pb9y|;H~ z6eAGVg`nR13=d|DzXtZoO0?eQO9 z&3%DY%aeZ$6uAl$-1|u&Cx&!MYz+c6hpnP|Mp7}bRSwxTl*IO!@3t(=>l=xTEGsNl zzPOJ*%daRnXRCjUE)z`>IbX;t^R^_JlPn06(OFE%iG%9<_;_+%80XQ=!h(_{2ooHf z6~3Jvod$Z^;{~zTy$`1>3cbgAGphe73<7j2t#qSy*(EN^#8=+AG6}=ZO64vTgcw|L zmWf>Dla)1H(&iP;pi9(W*IvhU#t$QYCqm|})?==-b@{>Jb z?!VG#BMJTkZHBx_{)dteV;7duaXO4(p@GueuAsM zLg@he>qHh?u{gS7t@!?GWt+pEQ8kusiMtXi3Pmp)JS4tmx`)Tt-2!lblVawZ_<$*x0Jr}4r$oya;bpSwx>83-YkQL#v+(F30S!z36oOm)Ir^mA`M2#jszA^3 zZ5unA^-wT%A9R42LM2+zuoCuIomkx?-ujZ5^*9k+j8Xe$?`MsO%f@qn1T=F|JD>HZ z*ci0Nc{Ini;(gDSBTiH9d(fo%C*|ras$`o3xa8+1H(A)Fg_v&7C;GsAqzqklWa70+ zBl4^X#YReZ)-4kGz&Rh;g-Tj}SUnx}lfCCrz6YhYJMcn#(Z*3A!+HunKQCJ(K}8?~jY@_F}1YPxk`; zv)HB;!(s{fDYmwL6jd?&^eEMfs9C|7s4rBjn_A}3%U3ph&h0ytJX zwNY7Fqh_@%2x`i;(V4e({>^X+V~uvTRD0|<&3mFplmL@RPWZKhoT0SQT|k#F)(8}| zmGW$*9nMXNKZrR2YfDojOWhSm`VC$^uo2B!l^Ln+y+hl03tI2%7JVn{hSyYz{-<%H zm9s(5u)i-ev;JubrER)2XN;-Fv{BNsPWBp^T}@^7??}+zquugLo?QQhX^(#S#l>xe zWVN=&x(`e|$N)nJ*vH$D*cEr!!Aj7!at`o8BxITmHQ}z31JTfsayQ>zl|ScH{a+g? zL6v!(V^r=6n`5fNI1lG>o7bn#l4w?zZUPJ7F&TY0sTGZMo|~3>V1z$NF7gc#%@Tcb z@o7p^!^QWiXjU-t`X;VgO8Ee#F7%BLs~I%Q9V}_aK}G1}YBW1mFww8My?ExLQyzGz zC!G!lDRdRNp;jXn(H`x0W^MEz#?zKTqyXUCx&Fcae&Uvv-6sP96}55dbV zT52vW(E^9JOAvLXj2iE%*;}fr;CpB2!%pP7{W3MEEDi0oI{%cZbzW|O?`Vk46*m+Jl2|%>Ra`JkrG-cF~P&UoXv@#RE zzE?f(uScyd<$3r|YI@CQ+?B{xifnAhE^2Zejmo$cHzUOoF4HBMkRn9N5bK~afQsnk zx4*x5TQPtH(J^Y#C9_edB{!)OR_*OqW@L>5Js!?4i)?>F<(e1433V(c=9w7V>ktD$ z(nCrq>``Q>&qWz|vx~0gtPn2r`RTO4IRs5xnTLCuOAG@_E+%Z zbyszehP|A;uC1vb_$YU*jRn)*)f3y1eyIOs6G&SQ}pOclC$IrI^t^-h=%(+jS zd>A5#pY&K@b-;etH+-GAeou5R=YU(_2!$>+;5?&mlf0vTg_UTI#Rtm4MqpxdZ`;`Q>Vn! z>9q7|M43rphA!|KAMSqa55$_Ln&NNgc6}cRCWf$)Lt^lE+Inh#ZWC2MKY&R@C7#3Hy0-AE|;>BDnw>Q z*xcym=EEYMx3)S%cSAjc#4F+ZL%=-p`Hw|F$?kfYo}r{~RV1rk{6L7rY8-flQ^d>s zt@1Kps>^lR4*@~BrRqRN=D;|wyW-BKq#369o6bqczk9}+{RHv(SeA=aCG%OKO6y5< zqb_nKRc)8NeZRL^OJ!8y%+~eiog`uBYI@?yN%UgWQ@E%rCqG2WgFF5nLc-mD05k7q zJ;AF5e2o0&4U3_fcFeg0U#peKj{9zNJ%ev86%5 z?PIE5zpq}Wo8tTRir&}NM2*km-9(M=^Xo*7Zs*7OP>rtF*U)wM*S^}}&{gPng&vyH z+=m)Hn@t5@tNh=nkpsPjD6J*Pe5@Y=B4~oU#El(LhrX=|y`4K2A5l5zvcdiS*%W1n zQaJ6uJEfzLCb*U#xK}hDvy#T8f{*AJGlFzu@1RKepd*X;WWJ zQcyW%HwofsW<;xb5+7H2hC+FQ{}|Vd;~SH(T)JNQWsI>mfU`zXi!lMDdGeHv?}$joyEmYK~b@OsK3&dVk@|-Pze_5Dd4(v$n~!E zaimL%VrUc%8=mw=Ee)ZIoQ4_do3*9FgqWg zDK)UQHM)Ni#arB_9MT}OQ+^LET{2bUU`#7LM`-Yqe58_B)ze93@G;xdThC0K96>Mz7}VO6?W6jb*Mci_ehBn@*OVSkFU|!(&Aga^<5g zfU6;6>X4}@`&6Jn(rFmkCmNn>NXeZBkdiwsotcbS7O9EGJQ9IbrT8K&>*>OIF{r6e z%%6`W6PxUTVH@BH1!6ZYN}}c71yvkr@xoj{8C5h@f<<}I14`XVowLx`;L0fG)6(&+ zgeYZpWVaarLrvW5<2JKhO7HK9AOx)?#b=KJNyCy$3!TzWNbt zch> z`sNMl+G7k2ObZU;*=IvqCPkX~&t5-5TWqy_uD%rHU0MOMqv!F&kI}I9?8ys%eeHlK zr7%atZS~-rTm9HbX~w6zHc->=x=;q7s2X?XDn*A5Dcoq^s;t3`aFC8mC$8~Hy3NGR zzCgIUuqdR7kvc59rh@bKIxh|iX39+ltQLJ!U`UIHDu>G2U*ix_!LA(U?j%}f??%~L z10`)@hkvJPmF#H*ch$5km8NNhxzQ%xb0aliFR?Ff&a;%Zi=7{#n|-cz+#_J9c|6kV z;^+FfeLwkb_{TUL5LO;{nCEI}T-ilpAsWF!qI+x0o>?XsorSzhu48D^(9C66Cqz)(Ni^`7IU$Z!jKq1O z*G8ac0OIqocC$qtE&UbI6<6uUZx_jtOR_PZ5t#I{8QxxKBDcvS`g7i?OVz6r!;4X) zH30HLsIcW^>hbyVq%Bu%$*$=h*EXnoK-WZYAoRj!nDx#h6WPdH_SFR=$%4IFuIgK| z2XMnF+`Xe93ds^*rjkoTp$Re*7;;2lEool+@;e`pT6N?**7&y@%oe-ghJHZ%YFhQfJLKXc+e#;~joEm!7|Kr@xQt4xOew#0JgXz;kI6>2p|_lSp(s1-||{ zXtfHlQT6Gl`;qH^>Mp1DP_nu4fF_Kae7gT>rs*mm?t#I(OuwB?umbfL zdPRZt<;Y))HI2*ZUBA6@$s@2&BkV`&=uPv_1}>Y~vCQicn2dQG^y_J?T8#&-GsnQc zE72%aC+uxQeMQH^x!R3V9gR9;OWoILX*Lx8M5|KL}J#Rw~s@nED+a0phr zP$bO=&-)C`dMLu%tE4f$%xbp}cc%OL^$>nJc4j;$Z- z4`w66Tf)qVmfpt_>5fr0f41|l%xj=D6(+Z7=~9`BG*-;?7|?1&3DX}al#x94fH;}A zU~jn*RQx6;AQ_BY>jEYJS2|OMt4^wl38ZedBlpX}g1#$WA}MAN|IUI0<%HV@SgLpL zoqDsk@pYO@V`O1ShJa0=6oVxvC4wYBpyB$Lgho(Kq`({S_44xDK;75nm_qD08XurW zZ7rynkmz~NlSqax;0g|r1r@}>ZSoO!^LaahB_?+XV&5kQd3&25k4I8i4pYcLuS0-nvI|WDeP;6`Zn~1!AR)ly@Z7xafv|wA%YDQcV&VK zTmRLWnGhijb5)Unem{lKio94eo3<(!iw!)6qAFw0!(9sHGxlA}9QW3D^tCtqs!IkZ zqqIsa{vLVh=x)IC?nhwidM!blNfiG3W8pb9yKUc^Q+c^X-0_KBMz9=p zb7yNY*Tdu(lO2XHygG>AJ})=#%Dd-WwpbkO=v{2lOx^)TS~`r_L3DAE67cjdqpTlF zPm!aEYcnTmlLps^gZ4zF3NUgLLH>lSs^Z^fRLUQ3lrz)E$_H#wMT^AE;6)?_ipmqB3hC|2eY#5y+ zzvOLi@$z1NvO1hKWLAzmKjgbCm!+yfF^#;zsq*PZ=Kb5YB-=DySQ&eRF4NTf*}4l8 znwV*nsd%fwF$ZjDHY|WYX;XDAG~;pfC-dljnEA{E;TVoaKsGQu4($4}ivUti;pVdcBsJJ9V&DassMpw4=9OomQ0U zedjgH`Pdtn5{kG9^=8XX$3te*5C{ho^O=P~%w5KU7wmY6{yzYhKxn_$sFT$HTBt;t z7(!6BwR+}u`{wHTg4(;DL!%up=)QD3hW_=e!v-njT9K@JR+tR{rCJ4SLXCatK;>4u z&!cESvNh0P|KZiq(d0KB18ki-fbc&VfY;c1mse|QL~{&)#|L$SqPI+vEN77>R}mxP zj^!RO64v8p(`X$$tVqIJ^g5fyABKTmJzLE+9RYj^=9g7@0YTr6zoQud6m^gy7q>t9 zYx-ApbVS(XW?~fuA|GKsiIH*m8m;*5wN$(6^d={!f!|sw;aT$r>{U4rXBEPE##SDp zViDRT-7^VF`MiF*=fI0I;J)k4^13p$ex}!2gdg%4AhlF1Y#pVkC2OcmaO#yjhiNDQEdbLV^|68^^Lf{pvqk1A+(c6Y! zf3X=^+AbOxn1H7koRhsmBJJ zRMJ(}GLm^rPk7jTTQA1sq$PLQn7pC9DU(~CHvE`mg`JjD8f${n2+h2%jo0kYy>=N zMfhp!cXQ<1zeS3yP4R&o(OJO;TA!lqVSonpr>{>d{o2C-?O}kL9`0d)R?8j+XtnHN zfc7vzK@#E~251ih6b=J)9FRP&1Ak@pbGsV7@q-Jd<{}0*a*$}#oEc(JuU#TC-VPbl z;f5L9xvRIAgZc%o6qU?kO}*nyss!{Txq5p!Ox%)UrcMVbKpMViR)XjktrDc6!&WWw z1eGAN&2Cgv#FcVUgDvRfV%WxMBk>``y<$ok)NCuc4I#7-t8;negl|C^*4D}Y^@|X< zjAbkjOaa!F|Lf(;mtTGU<=3_RUtfOp`HOx2uZJj4IRBTo&7NEeu>WKG2EUbAz})XE ziNMOy;E7$y1@=p&$}#!n7GHFE!Tc9?ks7R)p%EA1qWWV{YOYEq>soCzUJj}1$z}Os zO?kZ@Fq2p1mUFwUrtY*iTKW9={H(m!_SwMp*}(SM!2Tt(ft4q|(ZRpN`K$*UG#nSS z_HZM_(tl7Y+j9S}^s3btw5+Ap)o=jJ?V%O5sY-j)k~?yYtvO;hJ6{itT-)(vkzjA? zC*sE17Z=s-Io+dcEjRZ$mGTO;pW8VtUWMMlF-~6Oo-QH!5nYf!rL*)XK{10s=uFUB z)4>aiYk8PMxTWBkr$*a=f399*k3G|$61nRkSP*1-X&}`$Ayk!$TF~9Pf!hF!AZ09e z0q-nEPtXQN28=YFA-w&Rryu!kIO1D-b}d_ifVQ@Em_rfWh9kKdoVJdE4gnV1)_8-F z+J+;vx%KTB@&IJEN12{re6?^2zf(N5r-!4qt(6#vm$oKOS|2`3Ke$sEs8a}-(-0iA z!T4tmtE!tGJ>)=x@y&+gngw8Z1!8yYa@6Y&xe2fADXnl19@zl)_+jwJc7Qv!HEAOV zUu-b0Scw|eF)f4e#I`lyaNMx)ZL~X_upQ%r?FbiaJ8RV=Ib}IdBc9RZ9nCVH-dq%| zsX96{Sp@c@EptVC$W++=X+U5?EE$n|`s)E$ObtHKSweYwJtEgJzhP229HtSuPGXu} zlmF-z<+_r^L)|UUu(_6pt>{Z*qC3^{s2!AP?UZMYKujH*57l}f?pU7lxHtHtap7xK zc83(m4 zjbnWf(e`HKZ!W=57@*zVCEbBtu*sZ41=U%7D{j90^S}AL>T|V`A`U8W8J^0?jh881 z@Ccq)2ibL09S2}Cco{YTn9`VKi2x0UR5?>o+l5@#s@r*Yabmt)uvAIlc#Ts5Pot!W z8KLH|mmlJwcuLUPae5*VD+ZPy&D)YKrb+9q^a%Z~m|NKi@ zEN=0ye;)pYz5ZKZCC{7e6CXYA)iF=iSma}z1>M;04c*&71z8FUmXl1x z6Qf#&1um%|+)t;M77M34|KZt;aHs_Hz{VrOQ>hpQFaeCGaL#X5)*eAubrVgU)6Fv) z&80H`m4s^+Xh@BIB1GXt|`$DMVtiU}?-^!e?YD3KF3!nZ6y| zyj&i?cMgMBZ!fE`ZFV(QT?YM9Ip3%6FUg{i;INi6DUv(LHY%+c9u;FJ z#O6wPM&nCf^gsx;2pVA3x1sC?iVX{zfz*J0%C~F@avJz6cby)}a|w5Ax!paI>$l>t zQaX8zz*(&En+uwa@vEDhrbR;A3^};l1343X*@eX8Uw(kOla%`JmhJg>Ao;z@>1@WM zbCK|1iyWS` zkFqyCdC*dJtAcdVqRBR7CtXjQSPakX$u+?tkw|5+$ol*(8`utaWm`7?sM?UnR2!MA zLOnZMOVNrC7Dk8v2(?BuMXq1voN2b-$DS}Shn2vqdfA?TKpzu1V9|W$5x1wuD1l=c zzhkMnjk;wS=6Ee62z(Xp{lV@nLqpC*u0qeQ|4C&+D%jihwVs1;C_DVldQWy0>#Xco z30=;;eG18%;hlqSPCfkB9X&$d!fkZA-ML+geiX0DyF9O4Zdhu7k{&nxCzac-QV?5z3E@u~lrpcJ( z%s@-)v7a5kKQ4P~wwQVKkV=yE=2ax*;?2qU>o30e3it%;FMof3KjAc`6OrE>Q7QRN z3Z|MP)5aLucs>alPdSTYjF*dv8=n^o-dD{*$t_H{IGTSR9gs2k)791a(dQWAOKwwf zpRoAGo3QjkMFsfkD<|!EPgAUzn2G^`}~PbFGY0A)aL#D`pd7rTCXSaV6`V#Z!g#FL&%Q! z07|Cv@zujp-Ru>>UfbUBH{;%KoPW5%JeZMyFy2WJXQ1CnE|Lut#a z*$`IHk6ERN6|jJYS*0f>r|&QS{`UC0*Khj?)p3FxnY8s%dz)QmEW$eH^p24twT)gKF(FFs~MTGN(7 z2(I2X-kZJ?k(0NcR5c;w2U*Z0SrWWCO53trO2rlvEiq8Xg7!A#Om8E?(=iBTh^ncj z4xS>}P}Woe48;h&1n#+HK|9BwDqHRTjPhjS1RJk?YR@1xMUzBCRH1=GPik*NW`9}T zqSTuXTT&$-!e!muh=3XC4WYp;;7Z4WNf<=RbT8G2SnLgdq#h5{Z*anL&okROu<}Fa zT;ocRRFFiZH((5frpY0uXPeXX1_CzPvJd(N^v!OkDPa{hXXgP~_!|NNtCwFaB6$>v zG-6rF+en-2ho?98wZHs2pR7qL&(7P#7;=f0VM(4{ot!@#k!L@g>i=l+^X&5E>ik*%Has;l zH~ zv#@RGfEJFt?RUp>RnTP2GkNrx>FT(@t9=GGJ2f4z=uvH^DXuJX7yb}gRn0bhTgxw5 zafI%ee3uY4beY4nwI%}Ue1OM^{iJIky1TeIJ=EpwoDAQ;;i_n219UH0B+@uQ**BD3 zsJF11T@-$G^Ko`=LY~ZcrQ*@;5-RDx2#6&eMad9+`-1$(e~@qf>-S%O`QpW)zQkUV zm@c1dsnAG7jzay{f01Xl8v(py$vrwM@$$v*O)FoJxhV23JBBSoxc4Fa`+%FF-uN(^ z={J9C++}}DUVb}5Ke=o8)yF_gIQeHS8fyE(9VND z#BsFGJ+z~lR>#p#$URiE5P?&!U#+Mx;D<-?&e}V*wvAyY2eryzZsUa3Sk{_IY`j^B zz^7(+Ie|q^O5;%qDso9~gubq*j941Or+EylwVG=lG3%NWVwqE$(SStyR_$6eXY#XF zYG<~bQLeW|t;bfkUD4pL#5Q}Ye|&ys0-{6Jbl%6hcLchJ4RJ}Xzj*QD#fxh)Cf8ql z{=2U~?;uKH!uW!xd{Hc3k#>C1AfT$@Zk9b7*9ITVM*quxFH1t+h}>Y!IFwH(hwIUe z?9l|=P$w6G{~^Lu;n!0klvFv*`cLuRwX?PCT|4)#oqN~Ly=&**wbL(q*Us*;ckOH} zd)LmrYv)RC?cBR|?p-_guAO_=&i1l* z?cBR|)~54`xpvM)D>{GGg4y^|PxHAbR7hq7crVoN6W{K(wrSq(L&nm}IiIzttM*=> zPsQsq6gm~{1J^CE_g$?KjHLGxI8r5y zhR#YzXqt+|9i+!d5)kz~Uj#FmO+Mb2#nj%No~~}&Dz`rMm+QsO^k2J+d)!4zz>+pN zM%9YD!2qrei|qsQUXRGN75lHzB5)0xX^pIae!V>!hL*?ef`0D-eXvY`b4KHYNojOZ zJ!x}lZ+Ged46!Pgyknbyy06!>y4$^9wGv=&jAL|T z24?5Y_hS^v;((dOay4hNTCqM<3zpxoxb&&!sopxr{#$8`Vt1Cah{Y^zYohmBAAY5G zaZiu1;9Fs(R@U0oy47Vib+)hYTl2yrE-s|tm-F{RT`(FikK;IJQnoE(U_Qf^I%`wj z`dX(U*o7b%XT_@iU*!dxw6JyhQOC5lDM&gdoiFH39}RDuCHSyTZ9GqY*b%TzxFWHL zZdq==salqr#O-zrk9@IlJLf zH;x4wL&Ny0LaVh&IzkN0N?QnL2 zz^ZOCd9W+Ytm%J`OE(kU{q0XuwUGy$sjNtnE@>!~9@$##ta+iW`XN{^^q^#;d~*!y zSIz9cXLrE$0;hX6doR>^&Lm4!tK8Bo>I8h+#VccnS{_0lTb}vtuDc$X@cn|dxUq#V ziK~b>F9~NR&Y6-G6)1SSXA~V;jcak!`nBEnKvnd+u6Dh&F(f*TjC$8TnX-r$()FXI zN|U`}A&OKn>ljZm5s%2UP==1Jw21L=;5Ua(a@YFCPFVX68tCujj;TDtDLMMgg#GdK z29K`pleHM6)7ycgbD5WGau|H$2s}XwV&9=cOA`#Rf95;hABZFa1@nK4&X} z2EJ9YpUz&GGfZ=1qU%oHd~XawjjYm@|7l&`$Xw`}CS=AqIb}9~e9Rh^W}5TLMC{i# z0+0XeOvG1gktI~IiTAW&OLuax!?;(Ug?{8UeOog6o-DD8mGnf4%@z?WYFIyfu-m1( z{k=571E(!ki2j+c*D*{vV%gsg9kG9N8@A!vGR+C1TC{!Kv8fUsu~ha64d$)7jB0*e zb^hqHy@aF&@8ZOQY3y|(R=@}}*U z0sm(%?1^`=wtQ@_TYbS!B0IhM%Ecfhksle~nWIRIO*0s&ikZ~MrF4<7JC@jYnpuj? zw3LM0Bw|XFw{072WnC)odvor5AsVyGw{b(xC?n@IFD*3-k(!3=I;WgMrirzg}CaC`l9slxT{GWe2{L9$<>o@kN zrgZY8Z^L%nCyBUu0_pu%dQm6G;^tp9x&MNxoJW0G{mom|RE#Vta+oXBI!SkQ@a@K< zjS(7yRZ)eSvs8s^qpBa&)o;~@l{>cOU{^=hB762bxwRYrRz}cZ=d+7Y>;HnOdADO& zJ?;V&6ARVI``OZGgVmq6KHk{A+8UYC`!&}+k}in`jU)oCO9J$F>2o&{6`6J3w!K66H{@s}%I z$)&CY!(y*J_!$Frua8RyXTB{T)ZS>D$|~DH8gJc%`LTI-cFg3eiX|Ywd!rG4;W~Fv$3w$< zppQ(SBDQf)RcnBl(VBOSGfy}1qjQGXy~$GVHmRs$vm%j9Rqrfxwlv$*ZCcOH)=;-$ z9d63{ z%m|J?gOK>K^|GOItlO63SuPgnaI*{7%~nY!gaW;*?iXhUqvW10frEh!LnuMyR%bL5 zwawC4ySIUwM&5VF-?HUdmzY)=pnVy5c8Qt94~(NyWbH&!i`zP7ppJA zTVK6=+1KFzK7RKW-1{;m$yBJhX;*(h-A!f<`$0+xCL&J3INsB`N@LioFb5cZd)%-z}k;U!fzRw$v@_z$VSfZ zJ!ewi3`T0krplesLPN?DjXiDf*ilk6jap*pK zYQ722->2*Al?f`FWq^>`HhUrLbO1BGAuHXpdR^<*EsO;)(M^kCI8b!r*o22RHIzKG z;ehVU??C+kTN$0xOP_FLjv8ui=B*z-o(G2jyx&GKUw%CmhY*-EF|)VP0^hLuEWnKI zL{{yYogTKW()l0DKDvAg5Jjke!SqUmnzsxW*GeU5sfTVmlp*XLG=1K4xeU2l&OHva zsx7C=LC!ngz~Q%+UXj2vbvEJO5(lq3DS8k+$2rJFMsGSid4^9#yS0%VKaiqlsi%TqshyH@)Fu&}9rsz91r*}*e$rn7K zc>-emB@PT?%UF8Ha{+mv$Q{i&*xNkj@qZltczgkX=+80bl^p>BHP(CSRky3PBewr~ zVSrfL@qnGRP?)8Jebj6WzuS~Z^oa=L^5SiMLleGEMz=#m=oS#}+89zYklpIyvlBP@V0xsh(H{r+V zy?mWesd)5VBBEQc>TZjUG}T?1my{g;bV*LRymcCGTtqGjRf_*Uy@WTS3G+~UZ=9inah*7(v%kS>e*0X zIZb*bEjD5Xr{4Bnf24~nVe%Du#y+YqpN+_~k29(Nld73~HX&z=Ea4GXn(;|zEYF=B ziyvrq$m4XjpP^y19b;zo!|8`tz}Clt+(UHaoxUDfo{QXtl6%t(w{|2JSuPgbU5nmv8FpPkK!fk3j{(-RZHBv(s%) ztgRQMc1+WFcIvVwv0MUhvm$Zjj^}vsA0990FCrzczq>RQ?I5w*wr07P_=Tmru@lzI z?)NwX(_f05Y0fE_S#w|1Sup)OIi-psCkCXhb4pD5E4ZFDmo?>SY$#+Hj}^-EL~uFX zyz4c>)`oiEeQ58CKk43{;O_xuT>@DqQ#K+OjK)M$2J_FKa<16qU|Tn)J{j+aW^lD1 z*}=W{3@5Q(NjPsE+FaMoIV00VOo=%s+Z@#o7iWV9^~1%P9h3g2m{o?;p*1hdE{3yf z=KD>J8xCh%oWXyEquw4nJ$WETI(Rv5dD@d6p-vF=7g`WR2QV)=`sJKznoSl(qIlM8 z!#CSY??*^+Za12i(}4hzQ-;3K@hhU4>>)KaSNM*m^hQ?)1e`4J&)!=SY0+c+)S5-iXIy(3ia!4@_mP&j6dQ4!Uc42_;~GCcDP8^;b+ow zb_aAXj9!$J-~F2H^QJT-V%dBa9we_{e{)$?rJt~DPTpLuQi0BS1Fet&>H+2Zfg}l^ zF~vIv6-px(BIQcty)ocJX@sp;@0AO?qU4?TD*LdRuP2N6v$?n*D={u48#e$HR!eWhDVD(j@?C+jSo-}K>#U;nR4iR| ze~_AKGUy|%PX5)B3!z3Nrv_Mx8g*=uB)CK>XKdsv8IL|4hN?0-Pnx@WxE((9p6p|s z$Qlb&)?8hp%gXQ0&s7O1^@vth-^rB4n+6yQHG*GSeHNC?Ugj$Kp;)Bkcaj z z0X07;tPE9R(Fkf*7ELU+ebjWFkZ;t#lyetQKw}~C9lactLqy|6fFAUT5v?%pJ%G&% z29673f9D{u|>g%>x%Ab=l_F$aF<-%=& z?|%%ZjHjg=egdu*+gNb&q!{cctr2>FH3(;;cg@w6_YLIbl^FGEm^LJu-S(@?x&Hz1jS5?g~W?ik!EJ z?0^H(+>WVk0QdAzq4bXxOkWLic=7d@Uj}?(km>+FzYGw`Y=A>5Y;?TkG0Qm40FU7v zN8;}^7Jpa1kwH52p@$19tuf&v!e}%nw`@5s6H8hzTksRZz`N?j9|b7IPaL_jxC{oX z!w=N3LZZX3xt|MZV#84+>TSnDplHsFr7oKZjAla4W_93*giGB8fI&1p>usZ<=dM;b z2NHKwk*?H^fCT|90G)>pQ;Ty_wt)dy27S@IYgfrl^e9Lquu)q~6=rF`i(L1eNl7sI z-h$@0EOzvF0s(Z=CZY@wZVc!H2>lJ%3kQ?QfkA}GeLRH_7=}Rm(qKfJ0G_W8^Tw7T zJbM5JPUDc)#KN&<0Q*XUuyGnY87N!q9xKO|N4V&*Jl1uOWhWRqw(R}}$FkFV9Ltc~ z9Lo@VY!Yar#F@Mx|lq+3?hdi0wk7hte*0%PRyQaAA{5g zp&k<<3ZtR>a6LuQ<0*-Dp&$z0PENudvIzDg7f)7CY6k3J@4!V)G;su8)utH7EG660 z+y?I0^^{(bnc9zZAg5`SdO&vCdc}~+fK>;{o zIZ!tC5ffW>)_8JxM&g{`v0ReF@0gaj7*$2y9Um2}tAU!guBL%n?KR^gd6lEViNRTs zz6PqF7MzF_ZgU{#OHt%#*mbx{k;rq+KS0A&5=`~Y@-k6zD_&H!JdKzTXXNV$zv!*Y zaCjE17#TcpDk(E_XHez$46Sc|6p-$?*R3UZ8B!6m z^J1ECIqyl-U6!GX($oezU#__Kw3&ti%ucD~z?tbAPqUm{3o`;%$ky&3B>}c57|aTt^e%`59)e@L^+?-5Os07;?>!({IuWWgXMNAC@}zh1^az(VA~tm%Cf$JZRef3&CX3%04~QXp?4C2}p6@W%?{No@=$Rx3=!Bt$S-Lsh?NOzyMN#1*WSIrCx$! zhSNWx>sY%^OR|Y9emxG?lR82eF=5VnsXwlz>e18{_`NM##-Pps8Lwdu4$2U^OO|NP zmQ-!oq55d&Xg`lu_eXqC?0NKFV-r?}WO&0`szuBNw9w3KdSzj8%vTL*S zy5{JSQ>a&YoWN%H=IFgSnmlE5w0FCn8-sJj;ylDy?VAs*aeB(Ecwq#XRD=-}0%y*e zrA1!#Iy#t44$$vt(w_;SQe~lL<>Y zL9PA_-UHse!LqmRIp#H+q=ZJdD5be64$+xb5W=55Gfof-MpLJQ2S*qYvjgeg#ij?T z!_j_jycZ8mMb9-K`wkeDokJ!EEIS#5$HISMZ#6U4YY+^%*@xZdgKqJ`k;8Ui)(c7r zke>}y*^DG2^1Q@+-V8V3YfA${O}UVYn*YL(xdr8OBGJQ!N01~3WO3Lh!F%rt(gJ+s zi()|vse3BYY8_=q?`@tRz{cV!d{ogx^po#7BbRRGO63>Cwp-y@79dfXUKoi$%)rsZ zG0xJZRvCPNQ=U{$u+3B9Cbme8ALLUxZ%>wK+kjOIyLqj@<<_oV=fGLHd;NqGRcB6W zoeAApHpctTX0Dt*%UsyeGBS`{ypo;o!^lN#bQn7d&zqKXP%$B^Sp025t5Ymy&ar zpaE@yCkf>Xawr)iukD$@CzmMepk}u}JB{zcC|q97)WB3)4YlWI0Vlt=!)e^y<>w*0 zwt2832ggC1>4>GVC_Q^R>pVU`LsfSr{g}yl0S^+9-uUQ`?#y@At8cZG@HFOkJT7R0 z_gVk=PA<=|Rem#9<9i0$Zsa&h0%!ZmS6s8XgsV>xCAyCyGu940+IzYL6j|f$Tk%n{ z=?Jj;KK;|e-kE0G^o{r!C`Uw7;IzS7p|=o_ht=Ws9X2mhiTecae@XS`?2)WOrJlQT z<6W^umQb~Im!O|K>xgHi*W`z$@t7uhx1axbVuC}FXbf^6ys~#j>T*D8*0qsd0Epp~ z#X$2-&qD0%;yz`$-9hI+o{R{eu!;T4Rb}roC2la-#Rhxz`y7aPf;usIhP~1*XI;<6m7^)SYoMS7KqNYkiiwK)Kv3K)&v^RQ>&{Ul?FvUp*-1U z^uvNF8dF7g6#?;%x}2xR!3t*DbG$N~h?R~+#(hkV^B+%w+5vG0CKn*_l-{+*NRLqq zAQaFf5%&hT(zb~7mc=A4g7x_&%?`094pPu--gQ@taaDRJMb+4YM&=rA;w)7>XC4+y zP*Y|dixdx3bwzQ>Z55xwo0va>g}b44S0#aBL@I1gx=a z##*aB2v}oJL)#wiV+7vc;FlQw#rougpq32Uv*Pa!{9)M!=R`4O`jD1Ta^cfYa0&c& z8vIDhQ}8|H2{YzZ3k{&Joa6H|?A@@o-v9|%8eUP&c^;25nyV%1qehjUxv1wMzCP=? z9ff2_^h;%lVT!B?)7Z`jd6d{vU)5cYIy4m9mddF8oLp8Z^a+f5m}?Ng5AhytsQ+@1 zstC(qKcdZj{YjOwJ{*6f$+)a~^C24pa){B33O}UOF~y)|(KU?-pXrNSq+>Ao26v;h zsTl@*VjSF2GXm7e>y6h$N#w|38WiY-1qdY8`5a>oTC6G4aI`^Eau>cv#UtF7z2RxB zPZV66plgvu6fx#>n}$Y(^X!!i!A#YHs%Xw6kpi%*rJ_l~VrO5&g%rT?8QWWMdmh6W zJ~f`6$*6U+gc{}AtVkpD%jIh6=Y6g)@1Q4PD)cdgkFS@b7xKJaQo{cVzndr8#2a4N3SqG*6n zM%6|KTOSk{o$dKMq8<;{z2-!V@I^pmH! z?)H2RSV#bWdrp3kxIFGgaFKUGk~vy|jBq}n@#7?$d#(F2u8W$k&QYabC%KUFz5Qed zUEIsRrtIb4dfCgrA?05|{v{<NgtYW4p4?!99i@lVtS}wz#UpnO9PEF$i40o+wDMNleKWsm+pnPFdBjeeOT(C&o zu^hL^>yH^twTS+P@HXz9T$bP z;S`0!Yg;NKozD4g8RpBXFA}>?2rDuw(xgv}f=qi0BXwLsHqu_G1GENvA9!KNl=t5)lHYZ;Oj7 zf+WI{#~4Oq?P0srl7TVo^+(Nw1CZI;l6AeJ5+8HeexI3XbW`iI+33Z&7UNBf!{+h( z(_!Rbpqn7skk}D&+%W?Htriz2?j|2%@8Q%An+&q9`U{I)&kd(#@V4~Zu7*$FvgLs^ z_-7)ObDr7c>2NErvth9O2!7SJQIyEf(h+$tl>X0ah&q8yc`BHEFBJUppsRs{dyKU( zMm-LuHt;b<m`I-9 zB&_nxSQ)%(1~w1IL%sFxXu>eAk)|#=q?oPnnIn@mT3_?dwd~m~TRs~NQi~G*dec>$ zrO!%8*9yUL3>SD5JcDP?R$0^a*v*HKdA8w>X_UGr2}LW+u1yB@_L}m~U3%}7mM;?z z`)E3DfB^}PN*a9V>$z(lY(-id_5ybuR<>S&ADce#VwSlax=5=D-aVWPKZ-`=CiZ#7 zKNphWm5G1CQec*)^sC63%mn(cHV)KqCUZ!4Z@u0W$%;G^(quNPZ}LG=LnegFhEZZf zvD^9jyf{?l;~Ll;8lF5rtW-1)BDg=+u@Z$Ohk1lu!T9b2^k4BzY+9sHzW0+7)qXp(=>?VXnI5N!s~vNpk>9YC6l2|ZY321GE^WQu*W)R^-8~sQrIcIn>q@s$AFm2~7@zU5ZvJf$! z8UMCR&qg^yhy{a?-~&nrcVp-@Zjbike@prj4caqxzr1Egh-R|7x&OnOH&ICXD_b_Z zdLT)F1y8Hsf0l6*8*%|Z0$~(0@}^8|$|Y#wxrJ8KM~A0TQW#@A(l||Rc0AK-U-ISW zmW#5H7tXsU+@V1Ogo0v>v<`#-JsWIoj?wiwVOp%<=Y!R z%^5kF(==s?hgIFD?A6kpQZ$<5?Ldj9a0%15@?1zo7Brgk)Zucb7KOaC(h?tL8z5Rc z&AV(izMrtTl8(8z9tYgJQb(Du(GVS&P!ulV5`=gATWC)RP0kk1u*g&Ij%Vfr%|Cb? zPXN{zyO=faQ4&jS_ppDlYQT(8ONYt~K z^0b7LESFE;Klw-#W(Dp9TPU~vIGOvCi z1JZO_%=R$Y%;1f)=WbfL8y~XWYd&TfOJm5j_om#|I6qrk7Lyz9X{9hfuo>$rmzk#! zn2RJJ5Sx8eIn}gwp{c5?b4F;o?9DR>)2si^hR50-K+2$ffQ zD|d#y1>)_~6e9Vtk`V+u^Ywe)JjqC#ZFlXOH99gsU15Sww}Hc&U*`5Pmfx1&{v_ ztZf>=7Y1#;bcQ)ruMReQEgH;t(_U zys5d{konTZrqN=~OBvgU^$JG;2;0Gj$Mo)pAI?sP@%-g?mIa1?SEnZg`JPL(1M;5> zU&4i)4Q>~k`nEIbphI{Qu~O51%H{30 zU%H7{X|RjAy!`|;)^%CTCNuH!7cE6W?hPV*psaVrvsdJGDvO+zZqD_lG<&r*$q#Z0 z$X5@h-G0EWVy5&-s?#%?E09{Zy+d8amg;&xq}$k{XEPgxRrSf>(p6GAIKV|WWE;M5 zxqZk{%OgXIwmT~vzO2MTe##4p3pp5R#M!T_2|pjHV8h4FP@P@kweQ7 zO-aHm_?jU=OO$_}Ke-*h8qmd%aFypI^K_Ilg**`ilI~w8DKcV?wU{oK{{;uE}iU`Y|$hLyz{& zWjTf16Er1fDOY8NeGIcpL~1;)bj`-#al@5C{>Fy%V_REilVz3*NbBrIuoY{GO>ew) z(bJ`-wxC&POf7#8yL#W*G&MHii^wspC9dDWWO6WpOaEYUU^&mk`S_Z9v}|-p!m;WO zoe=WDMpy$%Z_S<9c?y@=XA#`3y3YgjexQvkrhcc5_wfzCGoYSZGh&oo8?*!b5gFwiqg{n_;fNRn#4eIZiK?F^RF3Wv4u}hOQ;|YXCl?;hT<~u95id(Az#u}1kU4dJ&v`(Ln@X&n;B3({TqZ^|) znC2)qw!AFocRXP?keisNH?l<4Gr>fC_9UCfxN1v!r~fLEYVc6K|8NBv!ok~OrwVD^ znV!u=$avhn@>d^DKOFu;ODb{loczR0-yyb2ta+&EC+!c`f>E1x+Graik)|vPN$4HET0ajXll~Asj1d2u|MQDKH<~b2L;o0A59Othf z-?GUI7{(Pym%4_g&V%GoEi;q2?ds$lYLevlU%vpB^NY{Fe$l%}9xvwa-^F~t>oAH+ zFa)3oX_oO4V+Sv|ZkZooQOrPD~F z&p#a!y;W@t|GDcJkM-5w`P`r2O|?3GL}19``)+U{v94u^=;`~*zrQ{H?)6((5#v>- zPqGnzw(ZKj6{-=mC(`X1+tZqvJtgnoTn@Cb@6!B`&bnsn(RK7*N`;C#LQf(jBMr#7 zywe#XPu?o5rwXU<$=QQ-$mPj7&;PX+OpNyA`X& z*bIBqD==$9D%=*)Zmis36k3Qy&%#~_r0zC!v|vx-MF2^+T_(nzSe+Zd3hQ{3fZDc= zO93j{g(}ijT!;CfL*|!IY1tIx)jI(1<53rYJgGb9ryVH@wyPuvBVIh6V~{947p=#( zZQHhO+qP}n<{8^Q<2hs7wr$*bzgzeINGjRsbahpCs=Cu_Kg-VCRwnOQDAHxBV5&5} z3gran7gE~S5V#04sGg&V#`J-0CQ!T#K^^QH*eXE$?7#sJ`iy>khzSqVyNtiu!N<)? z(-oVWW>%NfHzlRUei`gUf46ovY_5NJu6HO**j<^wMmg)z&G+Z{yqFH0d4E3AQ`5)qLoa<*+wh4--1{jXq8 zrM&lb>&8!ds7J#War^!JXyTjf=jE=eEkumqg+PtG6~_8Volg94CLMn}z5RKq ztX_8W5o8oL552K2tkepw3D%O_jG6umfGkBpaEuMHHfCqikjoQlg8^{Gsx}+~31k9X|Fyrnjd$;EQk+A3g2>;}kSjdqho4W} z5xIbHx=sF3PvD})j)k{g;;A}sAql^}00ETCE!qDP=#XJJB4f)UBi;c$H(fFpZ7gMW zg_+D*%*fix&FUIs{viv=Jx1o-LCo)*n=?j3PYnTo3m7=7JBx|nF;D8U5GU$axHAgU zpqbRP_d-o76{`*5PGmXc-FDS^r+9cB0~Hf!P|v?CJ~?3Csi1uNwa z3{N|iBIw^>#*w2UTs^~3hw>wp)2xNU6&%_sLZ`vL>h2=hl7ed}uTqzqci! z-7z4y5%a?1bbTu#r}xJ?n^@UAxAtxJM0&WTfTGEcu5mkIJ&h=p&K@6#h^tCE3IG!X zdpcAdEjog}*sJOs4n$*{8wHlB>6v{9ij|<52R2>g%8Wo%tRJ-j338tPMacg!5Ljwz zT1>krKgQjM$RSgo1m9p#-2+tjc@?v=uBMw*Ef+{8TA$}E$$SwV|HQ-S9h91-bv9*n^Nlqpg5XWiz9UFf=R$&IMX?t^)bPz z$`~GU^M)M>@d+;FlvU$74L+W3)WY1O2#HO}%;POK*|&=7N_ZruSstz^Lf18<3}$TV z?Ob@t2hr;_xAzvUVTqBy*pjlNo|1~q9E%T}ziPtGA-*FIj>(oZ;>g6Sewa#pK^D4f}X7aJt>ePd`n4`L% zWNfiw#2_3!VMW;fm7HX1x4M`+2w1}wQ8ti1axzX6i+0Y#6=UEoqn#EQAS_mX@{mMx z#sd(`sM~C}RGp<6My&U1V~w#?0dIj_BJ$#qk?t|{LTBwXt~Qt=JJo{QxgrbKGJ4|% z$rI|TDdf1i!;vKe2UoU6o#AZG8i4UUOyTTd5mJoCFsoZ0OaVlqmWC>?5Xyf%~SL)$SbXDq2 zn+bqqB`)}ivybqP6>@>z6WFOgH7c`LdtvUUsnYM+X+1H?Fbp)F89q7YJw&;fu3{K4 z2((V}2(=DlvaTTGDRZR~QL0d+xM-Vx>w@RDo_8Cf>vU_~l!Cy4*44V6>m)nW6^Y?j z3gHu^8>|VWbBLIJD@gS{8LHOv(6vLQ=?YdGczUQ7eQlP!HyR`lnq(f2mh89W3=n8P zXoNAcVoNSp>wFX2nJZcN$Iw=4W#s^4Nn!sDcsBf{#FY@njgt&Z!fHVdU|FqK8Tmzj z*<#&XR&IdF21GNkPxG&Cwo!aRh2k*)vkaPyl zvkl|Zs%G+B4s9nO_BxbF&N8)|-K*BYCrlJ>+RN|_J31q_YS2aARwzl1&FL1I9VRn( zb!^$k-+}EW5$QwgDd@_3+_+%nnltEKxRuAiGE3hdK%2qr_62 zBSR)m0jcqRb9ZP~tUrId*00DRth$6@TZd|QSXvffdde%RITW|c-a4=c{%CT!2iSJ; zIosA@$XW-Q^yCsLKBK~QEC)tfXE>eQr$4r+wKQ7>F2&G=b4ZFzQ7uL$G#OMo!iUo- z^*lUPZ4!GXFg7lV$Gk!+4Nv$h;Ilb9&k&Euv|>Jr$&ij>5y!k4t%%*3bM2^HW&TuO z)2mG_)}19?cm`xGB{c5s7ySKCeAea7@K%!ug0bs4R-AoOhEAHGzBag7Z?nxH|potw>E;EY-;K_fv3Zu=o2p|KP-*gXeQ1`p*CRsx90< zw~ycN;S+x5$MWa(>fz*9mn`LqK>?fLx)|6?3G ztwsWnSJ^N+(mq+&7wZ&Tg|Po8)sxCM&%AVS|{fcMt25cjr0JK6rfl!S?2@RXz4v zwa9y>O>51&=SnB+znXXFTa;%C8HQjhcJIMUdu*jIifrV zU?G9~H@|MmH8y>@>0ZH2CSmMoveL6Bo5*fcteO|I3Cty35i;ls+1_-RiOz~7jALv3 zH16hN9!G6Q)Xm|n=dk}K38p+OoQPH)_CjKOCq3Y}zmr6XV(~?Gn&&OXG6PHC1U+$v zk8ovw(;VkLWA+rW8*T4YI&~>0P)S%OoCJ$Fll6KPau_VW28pMeire=n$MF=p%-EAj z$3h#w)65W_YIQxQ&S$_`qBe8J(-XwRUt{+q-X?#9krId4b`EazEf`q`jJYJ7DF6?Y z+R`o3w04B9rhL9hGoy*pk@;QMq+e}Etx6rwREs4B%2f`Jpc{8B3&VCXJ@#i-^x=3+ z2SM^-6%fF3Y4j%p{kb(q$_W_H49Pqy&y(UiN|p=L3idzKRw)Dlv#{1#M+G=dp@A(p3=lqX6lM%A4Nq618 zeN9ulL@zF87$>oSR)^QoX)9|$*p~mLveH3$m2A;A`ldTX<6L>MwcLK=#q5-L?7|NQ zh&h9zBRhQ>V^J1aYWj7~o;_01S|&pj06t}I2XApA-90akfSo8ms0{ja+3bU*Zg~nC z8%nYR_`X32++e2Rbk%REwkF;=ibO`<)(ehX%-JUX#=_U>;p_8${bVvHik|0WH6(@S zk<(g2G0H2dG11o?`Tx}VnvvSN_EHONH6?n3sGd&(6)5a-V>$94^l*#ZGyixaK|9Pz zCf0J(68qN#k?6xiGF1U8qKAln^)k}l;ZG-T#KII5`m@wNYrqT{ooA)@GR@6YPNCi&eJFMBRcUx!hOd^&ikyzp~qT+}X z$Ks`-^0qzb|0$#gofJT2+H273z9mQ^$KXiJ4ns_xUj~pf>jmKd0KUg7bQzI})G=C} zUS4ojp#b_p5<_f1PnTUNK8SD5#uHWB(^|W?t9%zc;1PWmVcQ9iEX-!QqXyfJG(|25 zO=(toggk>CkX$A^Ik5>FGQ!oDL~*B`@R%imEI8?(4JDH|nh0Me6xPCAoVKjE>wD;o zgz9$C!1QnjJuY2jAGwzfm+SD{PV7d94@2VxNZzK@<}q{wIvnTPYYbZ`w*1qN6FPP#Z-nQt%XIY6;$4POxygq& z7#w4BA2DFF#5t3dbc;-yUE;3Xy+MA%L;2KQzoxa=8}E+5v!sN`-*Lo zJccp69#9-B{iN&Y^?)weBw{5t>_n37n<8E-ekYh5+^WMA>JK)`0a+t$A^4|CvCPBry0y*-u|qL-C9 zH{%s9QG$XI7Js)-HP^?*BK?$W!&4sQr# zMUT~&fXb$$up|uO&-`pnV3j!<1(IvMWdze|2+yeY{0BMYUPRC0uvI<`-<6YxW*HAH z!J&o4x)PfJmtRNavh|O_2P;G>#adLr!~O+*FHAd|CtSw?2gzK}sFQhTF(+^uj<8w{ z9H4KWO2V<%%U%OFY&b5`H`etNt_cW^O&)keToZWEsRx2VTzJ62Dlfzcuz)=e%I>h7 zAsdkFL16+G92v0y9W3ZP2AUT-Ojd(zc}!p;@?Jg0MQ9EW3dnE~pgs@X=07<>Iy|WL zeLw)(ut5!&*gdHD9jzOJD~voN=mHe&&_Ana0RIS_Fz`gsz!(uR%vzty8yp@30W*N{ zgy*^cJS|+pv;VeHnmh~afi0)m2 zgMxH+tR+`nEN%>a+#4&f4h>Mrj9e0@Te;R=BCW}=z>m`IjLA5|@IQkwsRw6#)m7>| zY?1P;hnTZv2u83VAUM3LydLw;$SgZ4N_sT&aO=*sg@QaGm4neDDHN zKkjJqE1CEwQ)I04p5vx^eHS~Zcd>Vs%eq{MXEc;7o*eS!S&=yXKqBiz)M<7Mho6t! z1JriT$^@K5pmdaGQM4Z8Mhsynkh(RsALHh_d5x)%4EA21opr)?7=9C&`}1nQJfC$` z66p84@RV)Eyi+cqcipePq(0EEQS^U7#s7?=cC#}h5}|F++8WeQ^>iH*H*E2``q`5| z{IpfuY%8NZnq|$wT}Lsjp*C)I?rsa4h*C6{UhiSC;`)CO_tO|HE zsS!rX+0~?s(nx^>XiLU3qq0u@G>hyGw*E!FSq0*_VQJ6s=7~unGSf~ibp`?NS11PO zYQCqvFocFn@Y9s~|=!}ZL7^()BWE^iqken^G%mH08)9{LZ02Jn%inKDQcDZ{Z zOLj^a*3EXSk;}N?>}SN(q@CgenIU6eU_4(lZpKnep4!cTsqRzsDVOe%+~hWE~JZpxEz$b5COBOe`- zG~>SQfVwD8gKL1mXYzx0Y1H&4K1l!s(96Tdc&$NA;j9gU$Zsn zIc#JhN6aHYt3i)&ZQ{tO`8Y~~>^Y~(uN;-m0D%nz89$5CCfr<&z<8R7vI z7SHXIZthqxH)5J=t@X}A@{*aN@rSLU2Wb2_m)4GkC5 zj1ExM0PR@EY|m*EG9_JlK2P1aiy!D&?Q<&lqX(zRlTR}{^^D`mUGNX?BJV=?eF*Oy zq}I{J`Hj47HANczcFVx65Hmy^6m~7_Ce5+v?Pa(pJ2D+y2@ZGTMBe-a<0P~=8y8ms z)LLKV#Oo9kQ(f(5Thm``czx&vMjLYJ^&$_}1bR^?7WrsKb0@N6r7(=4Ff;z*iw8xI zo9$_uV~t#(yfe@RsH5zP6M>{q84cv~gLl11{8Q+&nB^?%7TT=H+N+o3$vy`$DFQd0jzi7 zqraYYrgYqBg~5Hd!tF`Or{dnPp9h2fdKPm$vG=Gaznmh{;)9hB)zqUA3!gJ{sr;8_ zrKWgJLm+I22dpJl^L0Rl#E63|duznRAMGb}Gwawk_D^w%@tXIekWetw=R4Oip^Px1vlTN(P2bHLlCs@>w#@myCD`Unc!T;o)JS$ zH0qbJ6B532eaX~?a~dUMM@B*)9$eE{$v=p9gh!60~0~f$IH|sI$iPbnDg8e|s8yzOMb-WR2!d&oXifYs{S9Wacx6mzg=W zzo9&$L-a%@7`fRYktn&p7%>JDB0d!P?yng)#;(r|Tpt>_;89DN%8}ft9U;%N zxbX;K}u{TDhbk!cm+We*cYONA*=2rZdsNjlYGae;&O{i{+Ym2isu7#nC z3QjsZczQBwd~wRfZGZ)@W>Yiwyk5!BSj!b-)5^P|9G%#rVr)|H6;oYCM0`;(Hk#E0 zm@}pAz>LL&sns*M32|b*?Pp#4L00?^o4OGT8Y+SPN8TC5;rtu>K2VZY0YkRsXR^# z%>U`y`lNV&b!}Lipesh~E6YD{?9daz-%9 z&mEezShogYw?f!`i{KPYzbBMN@wSK}>GvORrzt}(iXKnt9O3XNmI?)#5vAIWa{ z#CaNM3Ooz3T1v10=9bs9V>2kjZiZ%Y)=I3T6I8F{K2Xuxx$oCr%1C{9DZrp;-B_sJ zI>65zr)&8rz>FWB<>ErhN9ZDGjtt9wPOJpVRJh!(#Kh%J9f0}P_xv)Pv?zxYTZ^Gw zP+E4u|a>XBUajhw0YYqnv0UH7DP9q zV?Mr;xW*3op2&16JLnd5I=lh2o6ICC4I)u+Ib^SL`EW_2H_LC=17vVh|!TgS(bRK`rVd5GM6}5pp$g z%X z=jS+mLm&??Y6^VlQ^WKC`fIgUNx5cS__Q^w->H4d;EUK7CaiLC zoV!&Z-!N00;{pHSlZ+d5Q_g13w;e-#$y#HXk7l>CD|+zgV-boUsDAD^MqD=$>xz|h zBqwX0p~#&D&YHv<(0N`fMt%o5ZV=DaIPIA<65h@$@cs7mwllr%%&xdVGxyS7yoH?7 z&Yx|5s+iK!2D%C^ja%P_{${IxQ3w=;KY#wl0E*&^totatbMBSLe*uRl@JiS%ls}&9 z0kv)-z1xV(*qICdQWF$v6N-mN$9Y^c9@Pc`g_XGPPduy*3c#ZRunEQ|YO_0O6b!Zn%&;{wV z0vx{XhQIcu<%+S0r0p6;ZP&oadjKz6-MLf`cw8QkmQhkknO+2oEFPSlE~uSjp5NIh z#+SMI2`lDJT_vI%S#nnuGR0d9o8}cV$#=u1dWMbj2x8y&wlov|Xcxi0?PPWTRz&Lw zKQ-=$gg+YzKeYP?zeBHUzmb~Xp|DT;-^u;~>xja85#`SrP~tGZCrLv54bA{{!KHc{ ziTlYwxRp;b7ig~hp8Pi+Yg<0KFb_5{X^;u|-=b~pXJXbcn>EP9q+#Ch;n6S~m;sxR z(f(c2zst9L(s*4V)BJb7$}uL@!{Yz%cs{0jS~;@kn|tP6r86v^Vp=^`w-k!WOJiF- z!mxUUVezVBGo8U^KCZ7PNW%XXdJAE)?q@cW`Hka2!sPAWK*nx@r2S~Id(}$#@6jKZ z)Cw?1Cf~r)ReD#N-DGMdrdEmyCxBMP*gIXe6AAr*E!>KtpaO!cA zKDmUBii?5_Vk+gB4<{9MHCvgHQfMND{7az<{0DU;vWG$qlOwco)(!!u5V3D*=2dkI zA2DoHanelybHr29gt}?YLCYyv=UD|7)rjdIhbDzO6CX!qW+3#YIF9V8B1JU(kW_j| zu{txgQiL9%wHn*eS3P-4CYM)#^rF!$AccdmN{16&`coRjY=D!lq0n74FP5(G%pRhyp|MN@Z_c;;Ol?+xQ43gqo+f^f%?vAim4eQ93r36!hS*2+z9 zh-~GRGQ}Nu30;#BWJTn-%v;Ann_a4)3(?RTz|K)O&TO0U0@B^e#C+yDc z{<-uv;jSye2h{<59-$`$AAZ-(4M>q8oME=%=Y9Ki)|J1V)8pp}VG-a%!yxT_K9w>b z`WGdLhLYa2_5RS0`BD42KUf>QhglZcI@ZOa@r@(K4?^8QHS>W*ZYquBN^KtF(whAb zQwmy%)9Z#NzjPW6Lw2%Dklw9Q{L{wHfEi>`n&gZg=D$KjHGgiWoQPw!h9PPRE33pCqT%OcfU=-DXc3!omYe=auDn#7gCxQ zJI!iz36aYBwp;-pgdRM%_vJ_@=&7~B7zb`1=4WAI{sYESHq=&3@0F-L%^dXM6RDTg%rq#7!eF*^4D$0P^Rx%(cHe*FE+rMxkktW(7nv_~lMChsVgWQZl{MgUWaxHt4 z|GAf){_{3M&hH1|4;_-Q8@eqy9z=pXtb7kP9L`Vs4+F%o`TdmFM0^7J3TH5~@4+OCWAdcHitX2@MI#H z!gN=y-RQWq<7xg$+-?i(k&0blkYSiI>F@aE<30}Ul%F5d*9^`5A|8k-$J0oaw>Yle zoYBmJG|^0~=)Z7@qL|}Ft$o|vb-ySF1HLR0QO-tO8K)%YhI{`cBSELB!1$7Vpqa5z zcYD4E|4evmWR0Ko2y017mYswe9HL8g8oOY&PqOX~SmMVa=)17QdjY7w4@u^xawa*X zTXWvTObsQ+%}2?)#!)GB6*0~N{Wedn=vs-2?RJS%WS>Oq0S$ruh0EcQ=~B?mWPmel z5p9}r{9|w26->);^KfHndKAx{- zgZi8JKRzBF4!7UgEBgAne?JrPzVGu=-&)=-(t}?PkKz+^aqzy++BUSvD3y)rhRr7O ziAl%5ZJo56zPcS${qxl|#*ou+fn9lYBWSk12uuW%L=alA9hV-DPWJYCfeS!oSFK$Wp(veNXDIiIX2)G9fYj7Z59R>VtSKEOy z9)_}o0e0}+-OSS(E7mtG)LsnA=KTxONhv{O{jlaq+}wXkFH=#Km&;fL#iaLq z&a|51Tb=pdzxtythWfcIuSnD!^Z z=m);ac~%HIOPR#6iEaA1OC&i^iH8B(rHogA&TnNoNi+9UW9}v+h}k_zYe_dawaGV8atE5-=;%@S@Zb%iKv;I(qLZC>Z za2XteO<9PMNP+YV#-wh6vB%}t;a=7oH=CO^2SwxrSy$lA^}TJl%U9P$v|~nR-+Ay{ z>%6|fq{<+%R^|rE*I44PW04oqo3OUJ)GC_^>W=(`Q6rg9G-tA`1XBs3{wBj12|`O~ zj@xrBW(#(%?)=m~)nGKN>yYOkT187fFWcM2ONOqruA%77kh}0v|L!nET|m)#w>Ze?~xTlC5 zkjILluHb4nwINX_1GZHtE~(HFHZBC*<&x|wR9NVVrYJ}Ebn^Mcs)v1U;1cI256oR5XMRjyUCM3dhTikw6o(}FVGoW=ajHC z^k*z@^aL>=5VKMkLE`##vUc65UpqWB@f)?5LEL7P{lzcm(-gJ zbb$<{ARqJ^mc4AfLA%7jJ$}Lgc26=)#q5xwO}Wlt{(*!$xW65p!)jhoo z@J|B%WZjmM>?o=E`DnYmwieYG-rtixLUn;~!+_(9U@skY``IWr2)IVLQ6SaFrv0!? zi(x=cD&^Hp0bjarz3o>8Z=qRrVVt6Q^Z+lqLDs-}_|Yg}o7VvxO`)}r_JEqgr+(MR zK93BYhj@kY#ZuP|sxov!y$T?#R_h zu&ZgY^An$Y%>#JI-CLaMj8GOYqo<6nQBXo&4KMFRQli53b40gP&mq_T(#C`@#wg+9EHLSXYu~-DX^a zjy$;R@D$;JaEh>_cp1l}!&v77r*9{7T^DTs_+LwyB5NXyF@-?T>BxDXz~oEr&KTFm zXh-f1jJxP91hy2K+GFF88CCno>-Cf#_c6L_OF2e3rCd7EV^9r^o7n5S-1FX9G#vM8 ztdIW3a|@mQZh5ydJZGN#VW7U|(2%x@(0jvS-Wb(hr)NW#%QkWPOtj4#Dza(k$eED5 z;y)Z+G!l){p1T(->19vbfb>FM*xkwR?jg$Ny}g7BpeHN5xp*Am3!JLaPF#{6cphP~ zq`4Es&=*HVRnVQUoxLafrw%xU~wW%mgUR&eTv6URLAg>6}sBazZ1^uyanbnfl1SM##)SrAG+f_6cDzy%( z!sadaK;9E%!O$POr<|fU7cVgRst3FW1OXdPz5l1Zy(&vj2!rX z-R*v@eqTtxl+zAWnWsbdmpOV5logM+pAGuU4x?2tNH<9I2M#6NrqLpTlwr9}6vfa* zev2=$o|d;AU-PyA&S0!;)3ro8is>K`T3AIy&}Z(e z#2{uPwh?w(Vs@Y$S`kJp4t&rtS~uB`Bpjy9{hciAgGLF^M|!EPRspX6)j_zX8bmmP zor{N?=S(#wF@(}FRh#LY_TL9F??NNPJ-eqX!nuI9$huOR#-cOZ^pp(p5w+bfOm{q* z2>x31>}JKCtSvymtm1=7V=hguLnrMmkxFt%yN~PGo^CUzneveiP<`)#^C+{eR}dvY z)5Kn&F}CPdThry#HHTh3As`m6_LdscdLc7Zm+3jUpU|tTqnic0_qU*nC=h&ffz@b@ z0AlLiVh@>*qi{BEd!Wi;1dyx>(sB8S&t(D4=xYr6KqR+v1NP*xqdakE7SI$vcoWi3 z^>mF!`?lrxtfHHnnkB9Q(X+w~&E>W@=?75r=lGN-5&Chw0XW~{fDBDoerlkFNjf~d zj7>ehz{6-@Wq4Lx@6E4xUlWrK_u%B9PeqFSy^J;deliFwFVL7!zX^JJ%KdlW1AM_< z-(z9m3%=}b;LGmLQ{N+qt+5mMg!^B$1$nXY5G22hR(Mc*kDE2Z#u>D|rUdFrX_YE& zUr`~)B-6DSw%>mZ;|1hjJ&pmBcIWkn>!cDK58|5q!7+U#7m~ywbV3(#yDx72sJBb? z>%{KhDH?TDU%88gp3}}1Og(b#rUsotMiW+`n7k4 zNFK9wu!|e7uT)DL_f`DMF#=j*Fbs`}0cKbTAZvKYdLvYx9Gif?H&|BX86UmJdAHnv zGYC1MZwO}wKA=Gr7L&A0)3(kBgb1JnZs3702;O|Zjrg^3HdWF|JBEI;D)`~!WNpo; zXWRzUc*bYl6|kLlegpfHh0plhsY+2iQ}Rg-v&XRhyS*%(fjAMZdK5p9dbqP57J3xf zQVOGLPpgcChOt$g)8uVV%vXRaA-<;z`%;!92T#Do2}JG9V>OHW9*39maNHg< zt9m7;R=UbPBOyu4!t11+$qclU``afQ`NIR{r&Tm7_!>kwb4i>RW|SFSFG1`Mn%@+1 zh@S?+gXDw&f~~MnINjRu$kN5|(u@<(Krh0t{}>ZFy=jo_(`znBRLdi5HmwJluaVlN zaV$$T|42&V-)@$C&CDyb3`wvt9cY@z$X5dz1k%zRbBdB6lK1uZL`!sjYa38N%Zpa-w7WAI(C(uS1??K}r zME@dOXqmeF+_v4(`7sJE)pi>mUgkamTnZr|u1S3QT7Ti2>e|O--0o(aunEm9!1ng` znKKhWWztM&1_2x=f}<5$3pqnj2HkVaU?LSSPq}IX{i_5*%M`@-xtCQf=3puw#`Sd< z4EsT%T9(x|6b1db2Y;RKZv#1U~Lau-SG%@^=1Pf5cbgh2iQdQnV2GZlLo zi)_2_9GcC*_si@;i>*M*f8$@w-q4i9++F~$%S8z#tPJo4YeSb|6&ST$8j~RXgHVlv z978f2oIJGU-URRA1vq(*hUAnZv7qHH`{#VnIfSmjtL+_y z(^MInikzRWD*L)fW#5NPCXV+Qb~&2T4e#)I%{6rqyGdx-8sq@Jh5eDc~kxJlZE~7lX%Cv~h0n zedh2{o@0#AMA;{gE6#(U;&4FMTX(OZ@4rsx{k7$kvcoy;pn(i-wa)`<3snlCW*liE z1;HtU>?V@Pt{j3tq98X%#h97cPi@_Q<;qGx`V;6S{usLe=n`d}kd$a7+PI#&AbrIJ zcF~eAXlEN^6TEL9y_B;pjKafOG@$4bZ(*dICsL$7d4To|6&6SNZv9y>r! zZFL^t#-PZq=S-o}dkmjcO$Z_6CdzP*wa3+99x^=Do`_6!zrQ2S7@> z#T|&;ReIl677;jEdVa^JOEAbt`TFdY8oEzR5VJ=pu z6=rE2{?7*DGaSm)?_ZCNzt{t7l){p7n zbwEOxu}`2o2~n_6@C76`fQ#JOc~n`Vk%`C*WR(Cg((`1AAuIJJ+}ELD&n&cL)zRjL z9tTAG4&zH-Rw{JGSF4|>fGD8s`L3=FGHpn5Bv-Tzy(xq1Fpy)6*YlqzsL|dcAmze0 zT@uP{^Wx`h+I%b*WJZ&Q+MYfb#AG0m`0YdK=JJUW!fd_b?Ow8~FU62Kj3v6aZ_W*T zPgAF>0k0rO z$A1DC*nqciscQlBy5FPIj4?b#iABnMBplM?F!zXq6@9;i;rxAygU?Qy%?d93Ts$@2 zy^d6Z$-jbBZM$r2jUAqPxPKY#7Y}pswzS$I^}L=Shp;#1J07P4b#Cq2shZRc&f9pl zW1=Z#m6M0j$@XY#V}qAoipc_9gMAJzVDUs`9piWbP1W4nW-;skP_E#=QnII?!&M6Z zWw({ek&+{3Q!~pX`w*yz{WNa23V^64@~%}3uEh6pA0H+NC&@x;VGJ(T6ZBn~UIUfC zQ1YjhHQ^P(#BKMN=|*Z;@Fog^ULAIBPUmYSUA++1#;30vo4US5by<-pPEG0{7}mt7 z#nl8=E5lCv!M8ildLY!QS@c{`3~yc8?VUYi>XFqpX5pPOz1o_rh)cOLzp(BNaJVi5d5d}I zyR7~2xYL;l^uSx}t2TTFfaV1-!6U+6ATo2;GPjmXRymZJx7y!yH%7Q${p@w3AU)37 z?@GcFn89mCoiTsq5G_nyX5$*Hj@QBAXCapkLVM~1=w~q9P!X@% z&>qy8;LN-WHHXLKTbq}`g2)En<|y!lN#L{mh}Lp{;0ccFm!!c>#LY`!s;&2T+Ya^7+ET0>3&yFQbtS zX`)H54Z}tns71GlM}jLeuin1 zH^CIlZ2kLb^Ss!^bQ-92RlC;dz^b&X@$__{(;Bm%4C-~-d@0tnIV!{Xxr|bCw*<`D z!354efES1$myr%BFg>ojv(e9G1aYM}i(1{Rho7aPWMy=Tqmd8qn+<1hLD5+F@}bUc zN`mLgjKpmiG~?%mDH1ir9^|qPu2Pp1Jta^ZSPYX*=~{}$WDcn}qk$JRiU zBbWF~JcSJcBB(4mjr);hQqKX_2>FpM#`W^tIp%u+6MY7@$kxY!*ViVu^k0XhTIn!( zk6^#I#1KYqFw&9d4usxPlBt{B7qGi9XNEmbA)F-2EU8sWw<~GWH>w*XszaZzkiAFz zFd2797Y1Dxb306@JFLiwmuixeSwZ=Q*A$bFIy;^-X>H$`$qPEsW!nQ+MuGLg`#i|a zw4xj2d+G@%ed-J62qrjhWhwYOqU2RHGoBhFlxWNJo($dJacCQr;3HeQn2q`fYA5}b zewh>eb3P7>cQbdrRdv;LxjR?cfPz6rtda*1HEU5bY+&=EK!LGP`!~K5a4|h3BA5D47Jn%%k|S?R($NGPRLT&x{R0O#UT8$~lHYC%r&<24#K9~sABpT$vDZ;x%Pyu}LSPq0rnwBiZwRez+wI%xYcPT` z?B~sRq#%xq^++8b7SgiSqTq4d;!!4<{aUHR0?-16uWI>r_A%#`!?C$xxbG6|U<2_J zG4uZ?cn^p0=S?#$6`E5h?6{`4+@zZ{`rZY}3M5EcCM3ck0QigU%MdC$Oj06;e)nr< zzi-pB#Ip}{1{eX@bUH(1NyG{jTuQ)6Ku@rgbk4vTV&fmy?UX=mG$S1d4WfR`O47P{dgwQ&jd&|xJ~S#1Z+9WyY3%j$1` zx5x_$N-)b%g}%(WAYTSuJv@Qvb3q$B)oJVR0iW6W&KePFdGk)e7#$xAQe-s28|)nY z6wiI@INp><*!@b!=ib8b!<&+L z^shVoJ_xdKIT6M_$((%=CHhTZ*cjh*dR4x#5vtWf3BUKnAlEwR_Wf=zidkDJ3xfUY z!w>%61wx3i_3W5*p( zo7^(%G5%Teps&8YtXIg|_E>PK_}7F%NM3qI#NFbe)_beX*JTCQ)0sKrqag6vc<#RQ zp-gQ!XhG1~DG0U&rotyv>`J@Po)yJZmf~V{fz{%iow@W5ciD!vJ{yPUUxQ43Ub*Ps zhTKmrLwvXapdP@w3RtC3WkLL4o?PipE_Eko@ZE>XE7me5dK}V{459a4_mIySE$#%(`uoO_ z)vM9*8G3boaS7&@jAEwHpLxlW6*|LGWwv(7U-1%yW1!xKs(5@-RMo_vw6Q<>db`wc z6Zq?rB!Z}BdL%ei4-wO3cC9(1>ICf*ePRuW*o-fGeZH;wEHWRSQ?^xm>FUNoo_^p} z^)mEkc5qAe&4=32!6x3Rszx`LHFhiLfWlUuX!A|D3tVpQv6joy@2+{*rtEO=P~XWm z=(m7cmBII0eLGAWKwiY^gSW#H-X_FL-vNgxyQ`Z2^_xpnIC#G$u$%GTk&bGz@p>8G zS#wqO)J7Xt7_k=9HY7Jnc_Jr?JIM*-`f!0i!P{Vi9$1QlqgEK&3^(Bs zZIKY`6T(bCynI5Qzx9MS1I`$wSmEz^R_5dk7dWA6)p!9C)-|4GeBSX*%N(S_s%+q~ z8c3NJtdYUM44+COmLMi#F{Mgiv3h|O?vZC|?^eF%g-;>v zUw}PCSW2GIme`WYcojvlYVQ6JH!GH8T(WD%Z`jz>3Eo&A8<%Rq1^pRl=heof)b&L+ z-**eG{a|=SLv!h-OA)oG4!E_)xH&anZNkBuo6_!86S>H+nsJd=Guot7Xj7cT%~cjS z*p>+A8FMJiog+3gm>nTez9lkBS(Ysu>%5MLp@#54mg*<4oK zRs+E0)HLYX-01ZQw?@{~>x#N51!YBVGpE>D^>bnwhTN%Baz)z{m)6!$`vS=YWFv(& zNL8g(@|)kvGu&W_$P#BI?hu)sCNRZ{jCJRoI@AsZM9=O@U?yQwTP?Q!*&SD`d}kyz zF^ZfKM?%0?5H#`kz8^V}63^o{!MO6frn@O@EH)|b9`xk>N_Ih=mB5t1cm^5w=mQL8QMhdzKBiE+7{(+ZMxKv1x zL_^fP`qh2Vaw74d*qwH;bCFg||DFgLvBLV>Zh0Pbmi9TH>HD-5`&%rq>|@?HUVZqm z5d&QlPrHN=o53c*3=s-?&?!MrF5bQU{`~U%?VIyAUq9KzIt%pV-FI)=ey)G-a#{Aw z1Uzy)x}96Ya!QJfudD$D>dq3JuFz_;=b@ie?3fEI(UcH|WSJyH%2}CZD?jK~=LZvu zq&u~DJE;z=_C9D%q!U5YUm(U$;4YJrs!iqJn3j9dP3+yv%PVwxalUSKs%dDp5xRSf z!Rb=}C`tPAqq+SrSqjw}V(e%gUk8>STBSfGFtU+0$(QokV8s8#g zWgLUpnkxdAYGIt7+m%1-`?B^?K=tZBc9p9NEU%XOXH+WET4beXsl=YqDIkf+rL2Dx zEXDnZF#OuJ7T{sLIJ1joI8fVS5$={=1k!Xf;LY}#btssA`bp?ae8Q6)!;!;ePQdNT2E}_?yMU- z#sF-4tzQ|wIMAtE|E};!ITb|mQY00Df^}7+=rJ6dae>w1IhsJRH%Ggx7eVpRd=(xx zU$*)U^uK@K`_0hqsd-D{c*aFwd^vje^7O^)myTIXXCd_06G)`AITfrekKR1tgp)!8253m>Ij9k&qz8Ddg*Bc&`7bdZrAm zcqvdJ=u(TK&>tdfNd<=>hzUAZ&Kpr`q{31xjF=~BUSyX3&ajCPNlK}BPJbpNJNBp= zd83S{7J`@a1xiVhVPV#BdT~DKSiUGBIb86_xc0hYuln`+day_qRFOoLf8isvwqqeBj&02V-1}fz>`zwAi~b9qXK0k#JB>>k_`=(T{}40+xy~+ zFTOx$aMRwH8~mbvoA>sDPhrzv1GV2suL6@_(`ye;z?xU5?Q^GN)3B)hOur%wp3sq7mGo&EjDhIdot& z*CQl&My3=>49G)|&d%9PV5vlDAP`G*##4e0&hgpd1a{-X;nZnKGc~3RRZwsIKtt3n zZMj4=B~s&KoG9w~$uGf`LL*}ZDj0$i|a*bal?8zp~}O__jFo!Twn8R z((hcBMZtvug`gs=IUI-Vn>;C##Hzx!KL>$D_7P?wIt(JqhWah7!h znuGoCin+ikk$d&&*aIaggxu&mR~9Kav%+w-shEHrIqC1g3}vjnj3b&C*od?M?aqgR zW>l@*{4Nu$KWcE5$WXiJnxy_GFTp6Id9O$wqfS>0dxM@Gk5jxtN@z4{tE9PHDi~!jO$dpY z?CqV-^mosWQHob`)H`fAm{o8zx(ww3DN7=&0eG2cP<3dnLEbArB zF?6tnw$~zH@HVL8n)|lKcAU?&>|%ngf|-ttt8k)%ZymkD3ca`U`@i9oemuxA%@lvW z=|?le+&L4Ayv8Db2Pl0LoiM;femqF{*lxFTBX)m}ugMBhm+6H-6Ee zB1iQ-(qa^_Ec}KM0V2XhMzGW;Xh4mv5M@}CBb)$-?J78H+QkKu<$MlKhYXRFs)>g| zEko1+aBooIJz^ka-0(c@Ry&P|kq`(!yKDu}SjI*|-oSr;^A}btfn2 z&#r(XFNNt*QE4hJX9Nod0~;?`P*Xr*Yb`>3H99^%cE&ImBw%3lG&}eXqt`K2+9;!( z0Vh@oZJXr>6G~0k0{h6H!u~XUA`!{3R5YP#H9~-9`OM83YSdWi+=?C(G+@l34Q*)m T+x~w500960k4Ow>05&%OI%>JX literal 0 HcmV?d00001 diff --git a/assets/speedscale/speedscale-operator-2.2.419.tgz b/assets/speedscale/speedscale-operator-2.2.419.tgz new file mode 100644 index 0000000000000000000000000000000000000000..2a4ab7de91e794ce8468649db47ef876d17570e7 GIT binary patch literal 16996 zcmV)dK&QVSiwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PMYef7`Z_Fna#I`V?5DdlPp>$#$HiM|*nqs)5`Q(w^S7 z*M&$(LQDcI0NPR0KA-*hVemqbqF!w0rQOFoztdPGFc=I5gPFkqBXdF$8RL{hJSPGx zE_#P^EL3-av-EH8<=Nfc-F<#=0RQgp?$-a^+dp{zx4nbsFZTDI?e0C>{oC%|v%RO! z|AuzoPxI@aLMkl&wtMfk>Ye+GJeV=Au%evFehZ-(E1dFKH^xe(q)T}(CPL9EB}pIU zSSUtBW3hzFJjIKM;f(ar$a57svs~3!>#CTL=$Z&gIqRdx|NIi|b@yI$ccb0MjpYSN z36{jR(!jedoYU_dyz9Ld&U62Bzq{W(*!z1cAu<*;SMYMA1d$RcA{AQjLZHF~l3*%sKW+nRHY>s+Z^ z_Ite&=Wfii7L7F$Q<{=~uZN{1O7`?S*=y)rH)pff6V?=Mfq(E%VS7Ss*HrAiow=kOV1?V$PVBbc!Q2C*c&1Q(h$9)+2O0)lw5NLK1`l z28e?d(x9uw^S5NtN9}g2^#~1+B(We0WCV&aLlc4onG!)*OcF$yR0Jo8PXPg(Q-h|G zB%SK!$8+L9WQA0^x-C29BEzcRdenM^)FLN+be7{^3(|Uo60C5)^#~y}Iv);?Mu&rw z;pO1``10G~4}J8HE3)|K^4Igr*B2*!^befpuSNP#+mR8p?Ya{XDB)U4YRVOo=x*y; zebmNz-mTIEYU+Lf4fxcoLUCG1MMSq{|2PF%+0GV`eNk^P=2^}eVM-#J;h83j((8ci zw&1s3+y$9Ysl=j>X0g!AX|R4Er0}eduARh1C@<3VoToHi^wA)_!3(LIJmE8xl53J` z3O6IrZKZs6qRaGAo3befTy+m*j$$5i5zD5Yvq$Bv1JQ2_ktRbi<6qL`p0c`YUCM2plW3*oRa{ zQ^B)3%O_aQCmf5U+wy-7Vhyj4lqiTs<0VaX^@}1Ux&@r)>7rrwyyW5ri-d^Q6e{TQ zebkl;vjmF-$aRDjMkicKbS}s>VOm=W#xzNDJ)*06P8gm5&I+Sc1IbGuQ-W0?h-@KS zEa{^uP9?N?e0J8&CEbVdhJjo0X$-0_Q;idq=gwy(}-NjNV8mI07gOEni{9(rymm|C1Dl>y1J#J z<}hk#iqkaYF+ozSNMh$ersrj+^$1BKu4znU2fg7F+0m4e9Yj>z1xY!4i?ci>S~`}E zb*EHF)kmNfRKG|PbC$SIvy@M8ItVNZ^zM&J4^liK=|?~w+Sw~nhTr>DJWl|Z62)ne zrbsKljH(6VlQ*E`YaUUU!Ypx&QI0lPK0KB^h2@p(#dhwHDCbF}85Y!Jt=Q8U(=TPj zctT`UNXlTMMO35l^ln$?gW3W?;L7ioe- z!OVh~3wljcG9!uZa;y9~G5};Cp#tz)QoANBNVCfH5-MR)Dx_D^WQK)836m)0{Hn;^ z+Jv51%1U%P9A6HOULBwAv@8JI{z%uoAlg(UN2j9z8?Qq6<CYL^u#SSd%IWvQIT3; zV$&FF!`_Ihoo>r5jz%Z5%8CAgEQ;oDgyOvDqi4Ijnf;xSjBEAn+1~yu3hy+Xh^*Dv zTduLU{{_@|gy#GPrQFPo8%z}}lc1oy9vi_N^Gp*6C*as1QeEbPjQ~$w0{4k4BXb==cbQ zlr+CWTDmt?YPz>1pOcIToJLY{p*3esPhX%Ucm?oY1Kg)ugQYXZ1-X?2~j zsSSjV|G~wqUYzE#kG|-_|2k-|3;zoXB~sl6rY^n)CX+;{OD#Gstx{lSo&Km&c?n}! zz7j+ir8uR(kxQB@kZ`Vm8$K)Ky;AH4+o*8n<^2bFclXu$A$;0YZU5Qst5%7H#`RNM z?Cpj* zQ1mQvy;kdZ8Z0tepU_PUo~C*^5(HF3z1(D4XM(jE$8+Sp2iA3OWJyaca$;;|sa21l z2ex6OF%)^CZIZsWlC`26s}w~H{li23=Mn~GUt6s+7Lz&!z~5Fd=E&_Z#S^Q(x3BlwsBN60ZPdLmyLDaf`a|u2-K&okR zMb&_o8jBfWhl55iZS?f{v)!OPF+4CMY(!^_B!~J%b4^CmptAr+x3@HopT)QfU}}Q_ zjn%#wvYRj8l7;_3SOR}XQB>LR_2SBUx{Z_S>I?8kT<^86C`(KL6#E^xlqq!Z#~&WBrq>^Tw45Kd--=37U65-^ZY&7_ z;|N{v>E5T5FlDG?Iuhfr3YMg#kKVm=0}8xPSd46QcG+_F=sH5V@4%)2vw?dpScGz{ z=6%%5^x%;eLQ_oBLJ+q@aSZlLIW%S|?KbX4SGN!Veuh;%AHL1)hPk(=BXmU;eN^>q zIUeb1V74IgF7G~SpK^7~+Ww1mH~HTHwwRDeE~Fya@_XdR%qu z0<#&}1_6VF9!m5(`nBMSRKEq>xb#z7i`P5`M)t!xJ%vpG{kceqH2( zOZ(?UkEEG*UNZP{z}T+u;fKSE;b1(pKVF|7l|PP#Cqw(A=BtT9W!AotnmeaODv5uU zV3Khbym-SW?$5wG)ZDRl`y+KF=gA5b0=cycm-grF_lk^Fq%}f%A`hoi5-Zt9r<}n~ zrSTSxVDmxt(cbQ#a3zR*Y|z7k@ZlGPD1aFAEV|x{Y$TH(hT4Mh64P@0OreL>;;*z? ztXU40#_|0~&?PxlVX+S`tzhr!L0&m&6Ah{rs_3JKujS`X)MWWpD|Ab7rAdztzSpoOaM9-~cYQ?qH+D=HAAjK+Y zt5mkUNC$`4YRP52SGGXoXP7(s^A%ZCK7VQ_+=+cd%O%X9)iOEY4tSq#HDA zzStd+ckhC2jDMFAY<4sdwyeem6X+^w~w5n=S`Y`$s3| zmxpJkFORD7Jc!;|5w;rQZ*%j47W@Z!6{NgwU$ zmHzwV@i)5Nr3P)NbyaJG(#NNx^Wow6?4nwy8e?9qXAdh_23ls+@Nh!4=F#x{6KuNfQJUi@Tz7 zZSI$$kLGh3Fj)ayFILgz8bHcA%+U&(W)gl#O=NHG{9iI%p9v)qe zj*o_igNrKRmIE?tBYiv?e04Is9K9M`jE`#Lwl^IK=;h zbm9&ApGah{Y9`)66I`$VJ>T8ids@@~_ID2+&i{Rsr{adpDS4|11E0f^`|+@lif0$r ziEu>VutMGOxTM|L`IQn8%?Rsi`*u>$G$C*R%^&o=-tF!^>+Wu0X4kl}<~Wf#iFLy> z!Hc}V>{bCC)nI0NH8$WboX-tGkjA&m-%hAh@I6lpfzvu7#&mUTL{URYun#zTuBR|>xw@UCkfCRr{@CBtsU~T$V&gu8_C%@_!qlUVO7X3jupKo z6({B(d}Z7X6V6kDSp$@u#NCW1RS2)j7pA^BX0Z~9m@|X7{4v_=|J==plz3K!If9~F zLG_NlB_65vb5=z%F#!Yavvs1$cuq3x9DzJ1Y;b=3-P2L!HA0ok0xArFs5BvuP{W7O zSJ^_VY93ZDw1`!->VFJoVDPrq^6ydQ8>oP`7E1I~BnBDFHYBnAGbb(JTyHLjB+N`s zbDGQ^=IPczkBGPqPK3mqT@#_;$i$4%-#l#TjyA$tq0E6whEwBXg##-!$QfQBLEr#U z!2)>pzlXMng5znb2u_^@V z;haX$5jedlyIJzcyF)9@E^(lFKv>*jc(ee~41(QBB_x9 zdZ^9Ak2_X+RAi(FVXM&!SEPDjL*C$nTQXJ*ZDr1nauQeOTS6op0E4&>J*$@26ZbUF ze*M6LIL5R3`%O%ypRa6Plu~x3`K@5|*McC0XB`6=&9R)Dvqx^i&Ir@09;weyppw1G z#0W6`4;QM7#&fLD4Tf`Wa8lo24lpOSkmlneRZc84z_!xK9si1XqIn(wn=4qBnQrA6 z>nGNWSCQX^Zil9-6XNdhy@iPM(r3;J8@Wzp1B}X8FC$J^ku9SZAquR`#iHSx+Xtz> zWo9d8d%Bn_YEJlUiPyHGO1t8H((bB509euv8!O)n-b`9|GwFacSG^ew90}P@&O$mz^y_DaWYZZ8*@H5nLXhN{LUqeGe*IL(aB5_UxTyw&->Y!Kk>Kub(cIzkEt>%nIas%zOflwEzb|G1o zsCSj0(;`hHvAn<{YjMe(vxJC9Gg3nVKU~cP)-V#&#-x!(8|ZM%5*ll*7~RZ?niGL= z4KYU+fC*ng$lYo{z;*a)^Qbg(^tr3-^%>)d^uYx<4aN-4K~ttxC#~(+=<2)hRwHFS zZSFBeFKRHtDeB?>51*puE~E=Gz0Nr-`MUy^YCRd!`M|*)*QJ8w8q^JuE0M zq%WV+D}tVo?yPJ4BvDGQNrL|S`?0$a1UPN7s0!5v$eQf9P;)NmZ^oPj_WWi%K1VT5 zQ@OKDQmRPSK$LCBg3t+%ae4-Z!-b=V>$z5ucrlxU^&>KakK!ohFLPohTAM*l?MA2)mQ{zjWR8U&u@Fl# z-kl*`C3*_oszSxe6AlRBT1WwsnU?8Q?&H>uwXKePexl{ z9yE=vNQ3$nJ{v~N!-G4oZqpN}@E$s1;JmMXm?i5L{jgi@#^GoFh9$}M;)*P!y$oa`~fNAt` zW&`Tpb_X zN%Qix9jj7*tE=+{xfbr>aa}X|+W0aqySw#Z9MoU#gEi)>Vz4x78sOE<9Cs&)HB+6U zb&n3)E4A*@R~rRmyQv{nZVR)$g-t(g#8O7(yfkc^R61@qz%0Ffu`xNnxXYg02OpPn ztFEeaFjYic5S%RT)Zy_-37}lnu>OFaxc+N`#*fsDsjD>RiYC}M)>HVT`9;|i+t#Aab(K-ADoA;4J z(z<)ZJ~@OkU(XnJh!({17syNeK(lE)M-crGtAUoN)E z_H+B4$6I+j*Qn{`2Blj~+{#c@P=jm)<#ppwa-FeJ?tlBu11~h_6k%i+O2(Dndu`a? zG|xu!hBC{^-;xGRsDUnzn|9n~vw!iH?XR@i?}5NdzTOhQb)IGOfatz2OTE%S;Mzcg zi@kSVaYPfs6rC=ROlhpG!l^a{jlaiRK;;Jc$`&-5m`UD9-}9e*n`w&tA`X2cF+KjmI*M>m@NW|oMS1`MEoU&@8ZOq4@A}l6#8ZUDSh^{B)vTG+DR}c&`!kcJanl z8`s|;??A@1#X_BrYZ*x$e>-U^X zg;R=G)z*|*wPmxB@GB!n%(Lz68=oDW^^MwX%{HnRdo3bJ(m{|tV}e0xvk5|DqQ$-- zG1$B=3I)_buN?Xq6rcTIRr~jkVnJK31nZ(y8fbQ_SQYbZ-mgOI<5n8bxM%c=c{awd zg!pgTZd?`5VtcpM9{2j#7V~_N2p99L-KD=>KhU;2_6?od9Qm>ZMC1c3w%)!s&z8I2 zwu@VA4Jw?QXNPLj~ZL`PU(7$aWWwz>?iKe-Iyv(h;x<#~rc{WARnCEVBG#k5A zMoIhy=IO?upz_f?@t2#Xx9#6wYL?!zbDLv!Zr!b|XXM%_9`oGB=0fiyqQ^Y9jO#Ja zcG}Wb^x0TMg<0k5&(^9k95vq34eq4)vKPEL7RWqaf!0&eZN_Zl20v!rVQ9SFs}*jC z5M_7tf`hkvwX0`4FZdN%7}p_qZ7cpm&f?W9XA#3`TH19TG$|Cq>pkmc>Xz>2b#|X| z#p*W9d|&N^9+wW^t)0-pSpA88&^0XoJTB;UqX9PuX#R(+%eg)HWrJumN9fVD`iaZx zZWR+YOG$LI$(GVnF(oq`yCZLw`PO*BJy2HzH6AcB4~JW%0wfcnh{!0TQkBQpx3Y;p zw8!~QCtjMJMNtrtS^E%1I<~fG-rUtvzX1V!WOZ8biDp}p*we5e{-eEG&6Rg2Ks%M& z6CAwzU7ujCy4esTVlKZybm?HGNgZ6h^ngkf7eWxG8V-meRIr4I8!fs7V*HkeHp@G4 zmNDKgYNLJVK$MGyNyaSg0cwJpF#+Rik4#T@B@5QFn$|7<8BpCXK=oIm!1Z)npEV1CQ^4Qs+%W7F6K7Nn1UY7ee4 zO|_=@Q@ewHYM%=Zssv>-{X)ygpV~)cCU8QMpW0=MjWGWM+*z-Pn2~SE;!E9jfTQ_3 zQUWV7TYQ=6V&UhMN;O{Om{5c~EU+;BGuKeYV>o`iZnBzFEY(b}bJGDK%?>Mu4b8*Wi?bXUH# zo}GecAPNk#n(XM%)zzA=nd#=*rwK88I=TrEcK_tDe+7tg=AE14P={CiSt z8Dbb^s7X>@^ENBX0Do1v{RT@Ui9!>sZOS5FN5Ypbw=IiF2kvNXY9w6t(cZq%Qvs#r z`|RHS+->LzmFVxC8lGCOE?_D47tu96;9n8MtlM_`v9b=i#oYB{(;T5pJwI5*AC%Fo z$ogn^EobPZeny(tV?nUIKRXyGr5=N|pq&YvWms$P)=fa+;s!sB%*HNMbXz)}+>fOd zk6TQvbHS4$CIZ&}aQn>3(?w3q%(EfHy9^XI|OpLhQ2v%3niCL^bOD%@(c}O>8Y@3sj0?P`#HXkyKi4TGyAq>CpsXd0pHH_z8(I*eYT| zmB3;Vm}u6;w-T2^l4+5mCz24u*cdvH->&Z{uwcmF>*Qf>4`{y5{a&C8j{(R@Zf^R!_oayUtB3V|c z8;e!1sjYr9>rUe*8Qx@D{j|b7yyF!p?zmvHl~IcVC@-b)%6HA%F~`z_TxP<}D)*Wp zfh(eMN`JctvP3FG*fkZLLD(edeFbDim=Rm}f@@~%8bQ4}NX|Cx zjtH3SW^f2dagH**tU*%}@i;CT%=G)vTQ4#jPri>E59U{Hf;IQE-}0VTQ+4yzl)C*w zr2d$2<5je`Y1p2udyj(BLVT~1rEwWpdTAzPAFfU{FBBJeM#4A6q?Y8*Yrg2+AFWae zHl7xvAXKiyxA~^s9ry4v@L0R6_;u4H@#zW8>rb7^;NiK$vp)Yvkl_3t8Q|9E|Jd8z zd$wQC|90^7A^*omd6rTU=eaC%ew3#l)@S+f*LGABZuIDkaY6d1t-PiCagueWkWk7X zhx2@O24AZPK>D9L_A$?L&InU|RH@V01)IWZ4fa0C)jGuQn_$n~X0Mkl8e?gEFLF5< z@JT?S4K%t7m89FtX_brF1u@D)3n3?BEJC&W`j`0YgD}n)LFV3C-rgz$Z9$;BG17Zv zrZt@j6C7AaD-l5k=$L024$oFasJDbBVb@^+!=~qFN059j&}P69^HT7d+Y9`Q4L8cv zQcqStLM4;?r8&oQ9gorZ;P7K312ZoqQ?BR}fV^PGyU z2tkvohVEjY0(IK7;O|s!0{{5kJH$wH;>C6w{f;0dj##WH5nzXNdPNp(o9VI%FSsn) ze}hb)27#4nLj5%EuSgO4xC-vv=PKPIk*Rr7dQBLS@?7vq#m2J9>&J6J^WCoWVUnJ*D!QK)=|ghZqdS3n0Jto!MRqH z)Di?IbjtzT+ud@+G|0--39-)hZAuN&L95$LKlqH(^!o*GUVgiawxtxT5QYi}}d(WOfeQ{84_q8M< z+*UR>3DdWp7s7eJ>Tx*`7_UY|KIMx!SkB`Z|}wa{@#QC?_)f5|K9|wcwRaH z|C>+Nd;aDm&AM_9oYL1eS_JWFHjQ2QH8LAsQEm;437K+1A|ujmLf4L2(X}Q=5_@lQ z1;!1bv$^V{_QA*WCT_|}++<`{NwJOVE_6D5I2WVy22F5$#i!E~no(sGHlAA?6J%9i?e_I@MWlzmZi%q{phC}_{wOkXj86gbky9cynnNd zH??_sw%njEd7IW??#C(x+Z9FNT)Gid5fnv?MF5==7A?9Xc=CbpvA?2c@#U+`y{ zKD%Xd(kl2jrPBP7+Y|ngO~wy@-oVQ((RKj%S~p5g40aat690A!0;8Q{%gx@joQjt z-9QR6y9H0lgtEk5MOb-%tEM4@u-1mRhSxz_GpJ244RJD@+gWO|&KiE(e0&twmp@bA%TDXn$-GM!U~YSC5BpGy5rDgL?g04~Jif%- z4P5=PIDnbG9?E82u+FFwO}PdN2r6HfzZz!Zqex zBzA9WB}0HW?o$!75-YZhn+-y@SK<5>aP0Y$Pz}>KXe?i`WQ!Tk1%I<@>ZZJ?i|bo; z?p_-2S4M196yHCaddpK{JuHs0YkJvoq5q*;zphWRfHMi8K%1JQ%3kw(2x6@d(e+*n z7mCB4e6_JLzaq?Td^aMqoq_TJ!-elli%-HrpV}&Ycs|y%-v48@=zF?=Hu!&bpTF3v z`+uGtJotY;%A-Z?yLS~IF*wz=6sU<{Cto#7tY80(`+aKxcb`pVzajke<826=(+p=h z{VERX%B z94BAl6tkF^h|Nv&U#0ht{@Qr{bAR{6)7t!h{`|$m{QoGA=Go6;p-}%z)NZ2))|d!= zc10HTS5m)tl5&1k( zy;!KWS^g3dS8;1B4}1Q#@`$98Am0=*U7ZnjI6&=@$FYr`K7Y1b#|g@J4|Szl>*kAI z(%lC=^P>ji^{*09_w3IeQD>Z8(VHvz5K#9Q38?!(xZNwX4ic>@&Qla!kp7Cuqu(NA?c)ZmZF6AhgB%FjaK`#idA9kl9L|R`{2OO6 z7lJ6o-&fdPWs!2DeXEeYEl+MmkncbbXnCE`(($Z^!%=^cpu!Kdq$$#(&fF?D5h$gMbX(n{(d9^SL0XT{An)OOR6C7U^IVACwtgIyO?Yv!@5Zp7x1%K1(Udxy#r1w{lkWKUd zVg7%N2W@%=IgaN9ozR#txi+z})!5K}cejK7 z8?yq71=`=;U6mgOIalt@%}p0WGhHrbz0@=%d*CS^4=-Mg(BSk49iE*Y9gmOCPDkkF z*#&w%8g|gd@ciQJ==Gs~-GNd^$D{GZ@mH_)8vwA^MMvd5`!HaEQ>KqJpMU}aWtia^ft(b4iewSbEn*#?-)Ukq4PbyBQs#zgZsGzxp>)R#kDSw7 zLz>d5TIjVe)}Ws}+x_<)Xil%pJWPGe3ndi>qgoG>AksmkJ7_`}nbMfzvG$}MJfkOVU0LWV+VhXwbaw4qb!}6J#1TZX1tTqB4NEF@?fGLa90!T3_6eQY6X-1VvH!k^9-9R34b4RIO zo;!Z-m9`$T1v+m2mmU_QAC#z{fmOVWI%W&=P7qn7Fh3v_V@BdRW;FJx^C3f7nRGz2 zvVN1=pHqa9ArFA-R6FQ>(3Nh+Jjzq4 zoOEMc(U^GgW++7x-L@7hO6j#FacLzqwid(_%v@qwUD2kHPF()$L7o$q(6?wpQhu{j zQsIaQdTq2^O%U0xbAWE6nFhA^7LuWXL)@e?)XFgzDA8@$M4m=g>84<~^jx@^Qg2Q3V~}GX#ty*SRYQ;r`vl;U<2FgdlEcKBr6K7ji@`TcKQnH*ZK!4d;yA*lZ6}G`yfD_6vO?BmzN+mntlI2w) zbMvbVML1l_s+W)$)<|2z48LCajJD!+t&r%QK#WwlAfPtnFQqarAZfK}F#~yN)yVHb z;+0DidFzN!?W^O*m@}EvxZs6M7bwHxN{c>GYDZ4xB9hJ+$bQOTjDWC>oT!CW`;;q$ zQ8-t-?d2(4)31HE-3;8Q@`MD`@-eG53fY1tgfJvXOhA%P7L|6&Nhry$g~>WgSDx2OLmtY%{^&d*Z)1`xWHMkWry@~_q%nwgP;UAfj9!MXNC(aFH32Qp zAp~|bpH8)&$B`sy+OhvN;dN$Uyd1EKvegPf%($Lu5|}Y^t>QdSwYkYzx-eAMvdf|t zrLSr{N8b-mnVBqmZ~L1A`I1!Xg5(Gcp^zHs6{kvj;dkSx|3fZ4>JKeuZ= z74-_PLoS~JFreaA$*Uq~n=ok*?ONAG$5TE2-WHOID$Ub=P!zR(S3JY|GYC0rxIZZu zEU#M&E@cD+)7^lLJ|fI-$`D2=zL5o0x~nOfnMJ^+=>ERcueG47O2u^o4%P&NxU{Br z2`4TGXW_c##v=nw6%x+tZdEzasZ7oowKK&T8s!|bOP|(9bfT zr!J&YPDx@!!9f>YkkB*Kg{Cu;%+5%*x)h3ePMvO3kwMAdSEaQbrR{g))DfD61kWhbd}6G}@K$)K zT%vK)cN@r?n2u{W)t2L+WkD3CtmE|Nz=Q|ufGw6f7c}e}EE%GsXIQy9b}V;yv{+1t z)|)zkG65{A%IRkNW?T>r_|!#eRdX}a)4>4b5)KM&PK55JCa0NkLX`^_vKoB7qgA3M zJ6dS@@wbMb9_se#+4%Ty*hY%HRX}e&?Q9!b8ZIyDi<|&3yREs8d zIF__7DOBMqxfX~2425}x$-;SEbwD9HE#-_}GH2xqxD20*&N7v;)Aa%`m$eNVs5Gt3 z6i^_pi7eZJQ!2jJNa-L7_VAG zsiI@&7D%i`#W(Ml4V)zUZ=vm-kRt;q4s}bRZDvBpP+wMaB5|;%Fw>0^mK2#&TPqyn z1dFl%+;G-q8W7kyF>u;EnZR3xCMJcu5=EW=3}II7TQriWv?@St1!uic0BVk}U??;Y z+m8@sE>J?Jka8=~avL=G(zVyHWn{nvdqsTOfK8{IHd8Pb7b{GW&^za+62Q|<2j09A zfu-H5$|~%&?wDsrmDYSzam#p1rDh3K2ILtSJ9a0)*s7%#D7)x2ONo>)Xyk34(wJ)V z7a#^3B;LQVsB4jdGb?aot#nqjCp3LYnY)L(Ql! zZW{wt>T1H@g}%ECGg6FS_W6N-&*FQu6Py&~#b&N#IePEQ|pQmbW&s zN-+SV2*yk41?!XpX6L>vQGKFuB{-hfP1LY7RkAv`JBY)MUwbe@$D=m-YA`w;IpThQ zJpShF^%#9WxVRXcj*o{UbaoML%b&eOgVP_-x5uYP9Ymnec&ug>gQ(7#|XjB$(%DuVb=k6 zW{g!>Wfz?1g6D#2^&C1pMFsduf&WU08~96&w^7O>16#$3YbrsqSJNzlP`CT6;EfG8 zT9=Jk!+T$J(TOLiu5?22gr=~0eymqsb3r8FVPG(hQgC*vIpJavxLVv!mf}K%E(1np zDV-4(lbw#=?e0`ux!&`$k>8&fMM0v3q;vub9UwOoTuQ%h;hIzk$4bKPc=P-)(zCLB zaDgUn$WjUoTaN$?Eza<)>ciKyT}VI~93XQN)6&UCSxghH*qW^bt-u(cF2$(>>LheL z$C^Y$AS}$Dxn9NnS}luI)eT*sX5nQ_Vct+?2Q!eXp~v9K+C6cHmF{-R4a3ejPi|-$ z`VOyK%R7LI)2PzVmgrj0<3*bAFF{=E0^t-pI!yWNS zYQ0dPxAe5w(VDN>YM~MqDQjO*S=sI(UGxpV(Uy=gB|X7_o&n&pe-P2a(qK2l>)du* z1f00`wHBnM7zKPm(2iUKyUK4EP$(W#NodcvFe4z!ti+9YI3SYm3-d73o1 z&aucq5;^7CQ?Z=Rg%IU#ne`lFDT&b2$2w6v%YNg@!YUhOhZdRwB~86De-m(Hpf-A3 z3fw;<2cg$-W_L-+JIK;_2oB_V{yTUO}UFp8=- z!Ku}prbNJP2G*MEl$JakE|!R}IOWm^{fWTw6;TqkfBd;!8YwA`-DC*&VOnU&iv5x-mF&ETkf=W%B+r?&0%Y#`f+kO~Tpr$LLE(io+f z%?dmtXvVLJVD&&g>l`W7bGh8F?q4C?{o$!SP4WL1!@<$3VK+(4Iw)AnWk>cPf@$Fdi5rWX_0gR~z> z6y&Y;48GHX)fx^pTMH=2@&ZY*T_}N%8nyW^U>#TZib#llhvP%iNpT-+Y4!>H?Eo=E z#lh|>Mkd7^>_g^C8&UT1bVQl97QCTn7oIX)Qxa9=5MU>{jS^NwDn!^d6`X<2f(0*F z(!xQ1jIbwCFH=>#5LJ?-Q$y&Wf*}qyE>WD`;Dtms#Lem_o*J6iE&W1sfK5pV!G>_? z7WTm(JwoS#z>+GdBC^$rP%x-_-TmGFXhrB74dAK%Yfx%r=tr9#!Gyh1L2k@$Xb_lP za)TcK`eh9eL{3;tdS#-89Uw`-sd37S1e&mC>)n_D_Fof)E=bPNF`M#M>z7}CnP53@ zL63!gkCP<4*~y_3U}96MQ(m1iy#RnCj9;Q}nz|i3Q7+sNt9x|u%bkT^;7%FmO9HAel+Rh4yr3A%k ziBgT;x^x6ZdOO-w(@LM+*8;aQXQW%Bp=Fk)^W(w0Ueo8FTK`wXLfY#W?xHwuM+;_+JH3wH@QHJ}v|8UA4^UqFu0_h6#8>4;kQ-jzgg=RoB+uMIl2X(4_fd3P zExRr6+9U}|3gP^gwngitUGU1;!maL6 z7H|>Nd&4J9JXcBV3oXOterQVHIub$OJE&l8bi9BR=8S&F-Pr~-GhKeeCoNc8#KO@F zyah8%S-&=8s@Rt8G~H&?+(X;GChb;zeDnyt_RU!Nac7hOBJ3CmlJRT3lv*MM>w>>! zXW12AX1_H?bqW;>JDWQYDpS)VvvG3zlAEUI;l+`(m#mbhn=DEKd?2=K@HHV*T%-ou z(h-qiR>1aUoD$5mrIM|EvQ;mu2nSIYoN0G}Q(cMmM&KO46 zJY!6`ZI-i=G2ze^1%(vZTT8%ki5R(Y$6{Ko0m|?j4HT&9PRp1`JoF@`R|H+}b@#hZ zQS?uAz2DvK?(X=5V$z4B3UIh!)}l;{6s%wyZz6~}OK9O~zJ#NNFcwy|*K47kQs0m? zZ-p$Wi4b}tgY#=xp&uLc(6ve`Y+$|Nl%Ybltb+YxsGgbw6l#G+DUPp7Sh`ME>UW@f zsbFIIIz2cUnp{$LO%>_=rlPmcL@a(|2hqR2`FijF{WbpP^k2uX{@1~R|8^mM`(m*3 zZx4=~|8t%u{}0adND!Q4yHI!P&Em?ikp5EqZLscK`+DGkXYt!6X$5?PFO5HB+n#>NS zyw8|qE;g4+m?&gO?9qo74Bj(yC;p&NbHbGMqqH6*+r#tlJUkDNd;WI-00960lN|h? H08{}0oUdD7 literal 0 HcmV?d00001 diff --git a/charts/codefresh/cf-runtime/6.3.61/.helmignore b/charts/codefresh/cf-runtime/6.3.61/.helmignore new file mode 100644 index 000000000..bc71d4240 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/.helmignore @@ -0,0 +1,3 @@ +tests/ +.ci/ +test-values/ \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/Chart.yaml b/charts/codefresh/cf-runtime/6.3.61/Chart.yaml new file mode 100644 index 000000000..0ec115a39 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/Chart.yaml @@ -0,0 +1,28 @@ +annotations: + artifacthub.io/changes: | + - kind: fixed + description: "engine image upgraded to v1.174.12 with fix to codefresh run --local command" + artifacthub.io/containsSecurityUpdates: "false" + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Codefresh + catalog.cattle.io/kube-version: '>=1.18-0' + catalog.cattle.io/release-name: cf-runtime +apiVersion: v2 +dependencies: +- name: cf-common + repository: file://./charts/cf-common + version: 0.16.0 +description: A Helm chart for Codefresh Runner +home: https://codefresh.io/ +icon: file://assets/icons/cf-runtime.png +keywords: +- codefresh +- runner +kubeVersion: '>=1.18-0' +maintainers: +- name: codefresh + url: https://codefresh-io.github.io/ +name: cf-runtime +sources: +- https://github.com/codefresh-io/venona +version: 6.3.61 diff --git a/charts/codefresh/cf-runtime/6.3.61/README.md b/charts/codefresh/cf-runtime/6.3.61/README.md new file mode 100644 index 000000000..06bef5a35 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/README.md @@ -0,0 +1,1228 @@ +## Codefresh Runner + +![Version: 6.3.61](https://img.shields.io/badge/Version-6.3.61-informational?style=flat-square) + +Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/installation/codefresh-runner/) to Kubernetes. + +## Table of Content + +- [Prerequisites](#prerequisites) +- [Get Chart Info](#get-chart-info) +- [Install Chart](#install-chart) +- [Chart Configuration](#chart-configuration) +- [Upgrade Chart](#upgrade-chart) + - [To 2.x](#to-2-x) + - [To 3.x](#to-3-x) + - [To 4.x](#to-4-x) + - [To 5.x](#to-5-x) + - [To 6.x](#to-6-x) +- [Architecture](#architecture) +- [Configuration](#configuration) + - [EBS backend volume configuration in AWS](#ebs-backend-volume-configuration) + - [Azure Disks backend volume configuration in AKS](#azure-disks-backend-volume-configuration) + - [GCE Disks backend volume configuration in GKE](#gce-disks-backend-volume-configuration-in-gke) + - [Custom volume mounts](#custom-volume-mounts) + - [Custom global environment variables](#custom-global-environment-variables) + - [Volume reuse policy](#volume-reuse-policy) + - [Volume cleaners](#volume-cleaners) + - [Rootless DinD](#rootless-dind) + - [ARM](#arm) + - [Openshift](#openshift) + - [On-premise](#on-premise) + +## Prerequisites + +- Kubernetes **1.19+** +- Helm **3.8.0+** + +⚠️⚠️⚠️ +> Since version 6.2.x chart is pushed **only** to OCI registry at `oci://quay.io/codefresh/cf-runtime` + +> Versions prior to 6.2.x are still available in ChartMuseum at `http://chartmuseum.codefresh.io/cf-runtime` + +## Get Chart Info + +```console +helm show all oci://quay.io/codefresh/cf-runtime +``` +See [Use OCI-based registries](https://helm.sh/docs/topics/registries/) + +## Install Chart + +**Important:** only helm3 is supported + +- Specify the following mandatory values + +`values.yaml` +```yaml +# -- Global parameters +# @default -- See below +global: + # -- User token in plain text (required if `global.codefreshTokenSecretKeyRef` is omitted!) + # Ref: https://g.codefresh.io/user/settings (see API Keys) + # Minimal API key scopes: Runner-Installation(read+write), Agent(read+write), Agents(read+write) + codefreshToken: "" + # -- User token that references an existing secret containing API key (required if `global.codefreshToken` is omitted!) + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Account ID (required!) + # Can be obtained here https://g.codefresh.io/2.0/account-settings/account-information + accountId: "" + + # -- K8s context name (required!) + context: "" + # E.g. + # context: prod-ue1-runtime-1 + + # -- Agent Name (optional!) + # If omitted, the following format will be used '{{ .Values.global.context }}_{{ .Release.Namespace }}' + agentName: "" + # E.g. + # agentName: prod-ue1-runtime-1 + + # -- Runtime name (optional!) + # If omitted, the following format will be used '{{ .Values.global.context }}/{{ .Release.Namespace }}' + runtimeName: "" + # E.g. + # runtimeName: prod-ue1-runtime-1/namespace +``` + +- Install chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace codefresh +``` + +## Chart Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). + +## Upgrade Chart + +### To 2.x + +This major release renames and deprecated several values in the chart. Most of the workload templates have been refactored. + +Affected values: +- `dockerRegistry` is deprecated. Replaced with `global.imageRegistry` +- `re` is renamed to `runtime` +- `storage.localVolumeMonitor` is replaced with `volumeProvisioner.dind-lv-monitor` +- `volumeProvisioner.volume-cleanup` is replaced with `volumeProvisioner.dind-volume-cleanup` +- `image` values structure has been updated. Split to `image.registry` `image.repository` `image.tag` +- pod's `annotations` is renamed to `podAnnotations` + +### To 3.x + +⚠️⚠️⚠️ +### READ this before the upgrade! + +This major release adds [runtime-environment](https://codefresh.io/docs/docs/installation/codefresh-runner/#runtime-environment-specification) spec into chart templates. +That means it is possible to set parametes for `dind` and `engine` pods via [values.yaml](./values.yaml). + +**If you had any overrides (i.e. tolerations/nodeSelector/environment variables/etc) added in runtime spec via [codefresh CLI](https://codefresh-io.github.io/cli/) (for example, you did use [get](https://codefresh-io.github.io/cli/runtime-environments/get-runtime-environments/) and [patch](https://codefresh-io.github.io/cli/runtime-environments/apply-runtime-environments/) commands to modify the runtime-environment), you MUST add these into chart's [values.yaml](./values.yaml) for `.Values.runtime.dind` or(and) .`Values.runtime.engine`** + +**For backward compatibility, you can disable updating runtime-environment spec via** `.Values.runtime.patch.enabled=false` + +Affected values: +- added **mandatory** `global.codefreshToken`/`global.codefreshTokenSecretKeyRef` **You must specify it before the upgrade!** +- `runtime.engine` is added +- `runtime.dind` is added +- `global.existingAgentToken` is replaced with `global.agentTokenSecretKeyRef` +- `global.existingDindCertsSecret` is replaced with `global.dindCertsSecretRef` + +### To 4.x + +This major release adds **agentless inCluster** runtime mode (relevant only for [Codefresh On-Premises](#on-premise) users) + +Affected values: +- `runtime.agent` / `runtime.inCluster` / `runtime.accounts` / `runtime.description` are added + +### To 5.x + +This major release converts `.runtime.dind.pvcs` from **list** to **dict** + +> 4.x chart's values example: +```yaml +runtime: + dind: + pvcs: + - name: dind + storageClassName: my-storage-class-name + volumeSize: 32Gi + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +> 5.x chart's values example: +```yaml +runtime: + dind: + pvcs: + dind: + name: dind + storageClassName: my-storage-class-name + volumeSize: 32Gi + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +Affected values: +- `.runtime.dind.pvcs` converted from **list** to **dict** + +### To 6.x + +⚠️⚠️⚠️ +### READ this before the upgrade! + +This major release deprecates previously required `codefresh runner init --generate-helm-values-file`. + +Affected values: +- **Replaced** `.monitor.clusterId` with `.global.context` as **mandatory** value! +- **Deprecated** `.global.agentToken` / `.global.agentTokenSecretKeyRef` +- **Removed** `.global.agentId` +- **Removed** `.global.keys` / `.global.dindCertsSecretRef` +- **Removed** `.global.existingAgentToken` / `existingDindCertsSecret` +- **Removed** `.monitor.clusterId` / `.monitor.token` / `.monitor.existingMonitorToken` + +#### Migrate the Helm chart from version 5.x to 6.x + +Given this is the legacy `generated_values.yaml` values: + +> legacy `generated_values.yaml` +```yaml +{ + "appProxy": { + "enabled": false, + }, + "monitor": { + "enabled": false, + "clusterId": "my-cluster-name", + "token": "1234567890" + }, + "global": { + "namespace": "namespace", + "codefreshHost": "https://g.codefresh.io", + "agentToken": "0987654321", + "agentId": "agent-id-here", + "agentName": "my-cluster-name_my-namespace", + "accountId": "my-account-id", + "runtimeName": "my-cluster-name/my-namespace", + "codefreshToken": "1234567890", + "keys": { + "key": "-----BEGIN RSA PRIVATE KEY-----...", + "csr": "-----BEGIN CERTIFICATE REQUEST-----...", + "ca": "-----BEGIN CERTIFICATE-----...", + "serverCert": "-----BEGIN CERTIFICATE-----..." + } + } +} +``` + +Update `values.yaml` for new chart version: + +> For existing installation for backward compatibility `.Values.global.agentToken/agentTokenSecretKeyRef` **must be provided!** For installation from scratch this value is no longer required. + +> updated `values.yaml` +```yaml +global: + codefreshToken: "1234567890" + accountId: "my-account-id" + context: "my-cluster-name" + agentToken: "0987654321" # MANDATORY when migrating from < 6.x chart version ! + agentName: "my-cluster-name_my-namespace" # optional + runtimeName: "my-cluster-name/my-namespace" # optional +``` + +> **Note!** Though it's still possible to update runtime-environment via [get](https://codefresh-io.github.io/cli/runtime-environments/get-runtime-environments/) and [patch](https://codefresh-io.github.io/cli/runtime-environments/apply-runtime-environments/) commands, it's recommended to enable sidecar container to pull runtime spec from Codefresh API to detect any drift in configuration. + +```yaml +runner: + # -- Sidecar container + # Reconciles runtime spec from Codefresh API for drift detection + sidecar: + enabled: true +``` + +## Architecture + +[Codefresh Runner architecture](https://codefresh.io/docs/docs/installation/codefresh-runner/#codefresh-runner-architecture) + +## Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). + +### EBS backend volume configuration + +`dind-volume-provisioner` should have permissions to create/attach/detach/delete/get EBS volumes + +Minimal IAM policy for `dind-volume-provisioner` + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:AttachVolume", + "ec2:CreateSnapshot", + "ec2:CreateTags", + "ec2:CreateVolume", + "ec2:DeleteSnapshot", + "ec2:DeleteTags", + "ec2:DeleteVolume", + "ec2:DescribeInstances", + "ec2:DescribeSnapshots", + "ec2:DescribeTags", + "ec2:DescribeVolumes", + "ec2:DetachVolume" + ], + "Resource": "*" + } + ] +} +``` + +There are three options: + +1. Run `dind-volume-provisioner` pod on the node/node-group with IAM role + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + +volumeProvisioner: + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] +``` + +2. Pass static credentials in `.Values.storage.ebs.accessKeyId/accessKeyIdSecretKeyRef` and `.Values.storage.ebs.secretAccessKey/secretAccessKeySecretKeyRef` + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + + # -- Set AWS_ACCESS_KEY_ID for volume-provisioner (optional) + accessKeyId: "" + # -- Existing secret containing AWS_ACCESS_KEY_ID. + accessKeyIdSecretKeyRef: {} + # E.g. + # accessKeyIdSecretKeyRef: + # name: + # key: + + # -- Set AWS_SECRET_ACCESS_KEY for volume-provisioner (optional) + secretAccessKey: "" + # -- Existing secret containing AWS_SECRET_ACCESS_KEY + secretAccessKeySecretKeyRef: {} + # E.g. + # secretAccessKeySecretKeyRef: + # name: + # key: +``` + +3. Assign IAM role to `dind-volume-provisioner` service account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + +volumeProvisioner: + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Additional service account annotations + annotations: + eks.amazonaws.com/role-arn: "arn:aws:iam:::role/" +``` + +### Custom volume mounts + +You can add your own volumes and volume mounts in the runtime environment, so that all pipeline steps will have access to the same set of external files. + +```yaml +runtime: + dind: + userVolumes: + regctl-docker-registry: + name: regctl-docker-registry + secret: + items: + - key: .dockerconfigjson + path: config.json + secretName: regctl-docker-registry + optional: true + userVolumeMounts: + regctl-docker-registry: + name: regctl-docker-registry + mountPath: /home/appuser/.docker/ + readOnly: true + +``` + +### Azure Disks backend volume configuration + +`dind-volume-provisioner` should have permissions to create/delete/get Azure Disks + +Role definition for `dind-volume-provisioner` + +`dind-volume-provisioner-role.json` +```json +{ + "Name": "CodefreshDindVolumeProvisioner", + "Description": "Perform create/delete/get disks", + "IsCustom": true, + "Actions": [ + "Microsoft.Compute/disks/read", + "Microsoft.Compute/disks/write", + "Microsoft.Compute/disks/delete" + + ], + "AssignableScopes": ["/subscriptions/"] +} +``` + +When creating an AKS cluster in Azure there is the option to use a [managed identity](https://learn.microsoft.com/en-us/azure/aks/use-managed-identity) that is assigned to the kubelet. This identity is assigned to the underlying node pool in the AKS cluster and can then be used by the dind-volume-provisioner. + +```console +export ROLE_DEFINITIN_FILE=dind-volume-provisioner-role.json +export SUBSCRIPTION_ID=$(az account show --query "id" | xargs echo ) +export RESOURCE_GROUP= +export AKS_NAME= +export LOCATION=$(az aks show -g $RESOURCE_GROUP -n $AKS_NAME --query location | xargs echo) +export NODES_RESOURCE_GROUP=MC_${RESOURCE_GROUP}_${AKS_NAME}_${LOCATION} +export NODE_SERVICE_PRINCIPAL=$(az aks show -g $RESOURCE_GROUP -n $AKS_NAME --query identityProfile.kubeletidentity.objectId | xargs echo) + +az role definition create --role-definition @${ROLE_DEFINITIN_FILE} +az role assignment create --assignee $NODE_SERVICE_PRINCIPAL --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$NODES_RESOURCE_GROUP --role CodefreshDindVolumeProvisioner +``` + +Deploy Helm chart with the following values: + +`values.yaml` +```yaml +volumeProvisioner: + podSecurityContext: + enabled: true + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + +storage: + backend: azuredisk + azuredisk: + availabilityZone: northeurope-1 # replace with your zone + resourceGroup: my-resource-group-name + + mountAzureJson: true + +runtime: + dind: + nodeSelector: + topology.kubernetes.io/zone: northeurope-1 +``` + +### GCE Disks backend volume configuration in GKE + +`dind-volume-provisioner` should have `ComputeEngine.StorageAdmin` permissions + +There are three options: + +1. Run `dind-volume-provisioner` pod on the node/node-group with IAM Service Account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + +volumeProvisioner: + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +2. Pass static credentials in `.Values.storage.gcedisk.serviceAccountJson` (inline) or `.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef` (from your own secret) + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "`pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + # -- Set Google SA JSON key for volume-provisioner (optional) + serviceAccountJson: | + { + "type": "service_account", + "project_id": "...", + "private_key_id": "...", + "private_key": "...", + "client_email": "...", + "client_id": "...", + "auth_uri": "...", + "token_uri": "...", + "auth_provider_x509_cert_url": "...", + "client_x509_cert_url": "..." + } + # -- Existing secret containing containing Google SA JSON key for volume-provisioner (optional) + serviceAccountJsonSecretKeyRef: {} + # E.g.: + # serviceAccountJsonSecretKeyRef: + # name: gce-service-account + # key: service-account.json + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +3. Assign IAM role to `dind-volume-provisioner` service account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "`pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + +volumeProvisioner: + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Additional service account annotations + annotations: + iam.gke.io/gcp-service-account: @.iam.gserviceaccount.com + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +### Custom global environment variables + +You can add your own environment variables to the runtime environment. All pipeline steps have access to the global variables. + +```yaml +runtime: + engine: + userEnvVars: + - name: GITHUB_TOKEN + valueFrom: + secretKeyRef: + name: github-token + key: token +``` + +### Volume reuse policy + +Volume reuse behavior depends on the configuration for `reuseVolumeSelector` in the runtime environment spec. + +```yaml +runtime: + dind: + pvcs: + - name: dind + ... + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +The following options are available: +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName'` - PV can be used by ANY pipeline in the specified account (default). +Benefit: Fewer PVs, resulting in lower costs. Since any PV can be used by any pipeline, the cluster needs to maintain/reserve fewer PVs in its PV pool for Codefresh. +Downside: Since the PV can be used by any pipeline, the PVs could have assets and info from different pipelines, reducing the probability of cache. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,project_id'` - PV can be used by ALL pipelines in your account, assigned to the same project. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id'` - PV can be used only by a single pipeline. +Benefit: More probability of cache without “spam” from other pipelines. +Downside: More PVs to maintain and therefore higher costs. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id,io.codefresh.branch_name'` - PV can be used only by single pipeline AND single branch. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id,trigger'` - PV can be used only by single pipeline AND single trigger. + +### Volume cleaners + +Codefresh pipelines require disk space for: + * [Pipeline Shared Volume](https://codefresh.io/docs/docs/pipelines/introduction-to-codefresh-pipelines/#sharing-the-workspace-between-build-steps) (`/codefresh/volume`, implemented as [docker volume](https://docs.docker.com/storage/volumes/)) + * Docker containers, both running and stopped + * Docker images and cached layers + +Codefresh offers two options to manage disk space and prevent out-of-space errors: +* Use runtime cleaners on Docker images and volumes +* [Set the minimum disk space per pipeline build volume](https://codefresh.io/docs/docs/pipelines/pipelines/#set-minimum-disk-space-for-a-pipeline-build) + +To improve performance by using Docker cache, Codefresh `volume-provisioner` can provision previously used disks with Docker images and pipeline volumes from previously run builds. + +### Types of runtime volume cleaners + +Docker images and volumes must be cleaned on a regular basis. + +* [IN-DIND cleaner](https://github.com/codefresh-io/dind/tree/master/cleaner): Deletes extra Docker containers, volumes, and images in **DIND pod**. +* [External volume cleaner](https://github.com/codefresh-io/dind-volume-cleanup): Deletes unused **external** PVs (EBS, GCE/Azure disks). +* [Local volume cleaner](https://github.com/codefresh-io/dind-volume-utils/blob/master/local-volumes/lv-cleaner.sh): Deletes **local** volumes if node disk space is close to the threshold. + +### IN-DIND cleaner + +**Purpose:** Removes unneeded *docker containers, images, volumes* inside Kubernetes volume mounted on the DIND pod + +**How it runs:** Inside each DIND pod as script + +**Triggered by:** SIGTERM and also during the run when disk usage > 90% (configurable) + +**Configured by:** Environment Variables which can be set in Runtime Environment spec + +**Configuration/Logic:** [README.md](https://github.com/codefresh-io/dind/tree/master/cleaner#readme) + +Override `.Values.runtime.dind.env` if necessary (the following are **defaults**): + +```yaml +runtime: + dind: + env: + CLEAN_PERIOD_SECONDS: '21600' # launch clean if last clean was more than CLEAN_PERIOD_SECONDS seconds ago + CLEAN_PERIOD_BUILDS: '5' # launch clean if last clean was more CLEAN_PERIOD_BUILDS builds since last build + IMAGE_RETAIN_PERIOD: '14400' # do not delete docker images if they have events since current_timestamp - IMAGE_RETAIN_PERIOD + VOLUMES_RETAIN_PERIOD: '14400' # do not delete docker volumes if they have events since current_timestamp - VOLUMES_RETAIN_PERIOD + DISK_USAGE_THRESHOLD: '0.8' # launch clean based on current disk usage DISK_USAGE_THRESHOLD + INODES_USAGE_THRESHOLD: '0.8' # launch clean based on current inodes usage INODES_USAGE_THRESHOLD +``` + +### External volumes cleaner + +**Purpose:** Removes unused *kubernetes volumes and related backend volumes* + +**How it runs:** Runs as `dind-volume-cleanup` CronJob. Installed in case the Runner uses non-local volumes `.Values.storage.backend != local` + +**Triggered by:** CronJob every 10min (configurable) + +**Configuration:** + +Set `codefresh.io/volume-retention` for dinds' PVCs: + +```yaml +runtime: + dind: + pvcs: + dind: + ... + annotations: + codefresh.io/volume-retention: 7d +``` + +Or override environment variables for `dind-volume-cleanup` cronjob: + +```yaml +volumeProvisioner: + dind-volume-cleanup: + env: + RETENTION_DAYS: 7 # clean volumes that were last used more than `RETENTION_DAYS` (default is 4) ago +``` + +### Local volumes cleaner + +**Purpose:** Deletes local volumes when node disk space is close to the threshold + +**How it runs:** Runs as `dind-lv-monitor` DaemonSet. Installed in case the Runner uses local volumes `.Values.storage.backend == local` + +**Triggered by:** Disk space usage or inode usage that exceeds thresholds (configurable) + +**Configuration:** + +Override environment variables for `dind-lv-monitor` daemonset: + +```yaml +volumeProvisioner: + dind-lv-monitor: + env: + KB_USAGE_THRESHOLD: 60 # default 80 (percentage) + INODE_USAGE_THRESHOLD: 60 # default 80 +``` + +### Rootless DinD + +DinD pod runs a `priviliged` container with **rootfull** docker. +To run the docker daemon as non-root user (**rootless** mode), change dind image tag: + +`values.yaml` +```yaml +runtime: + dind: + image: + tag: rootless +``` + +### ARM + +With the Codefresh Runner, you can run native ARM64v8 builds. + +> **Note!** +> You cannot run both amd64 and arm64 images within the same pipeline. As one pipeline can map only to one runtime, you can run either amd64 or arm64 within the same pipeline. + +Provide `nodeSelector` and(or) `tolerations` for dind pods: + +`values.yaml` +```yaml +runtime: + dind: + nodeSelector: + arch: arm64 + tolerations: + - key: arch + operator: Equal + value: arm64 + effect: NoSchedule +``` + +### Openshift + +To install Codefresh Runner on OpenShift use the following `values.yaml` example + +```yaml +runner: + podSecurityContext: + enabled: false + +volumeProvisioner: + podSecurityContext: + enabled: false + env: + PRIVILEGED_CONTAINER: true + dind-lv-monitor: + containerSecurityContext: + enabled: true + privileged: true + volumePermissions: + enabled: true + securityContext: + privileged: true + runAsUser: auto +``` + +Grant `privileged` SCC to `cf-runtime-runner` and `cf-runtime-volume-provisioner` service accounts. + +```console +oc adm policy add-scc-to-user privileged system:serviceaccount:codefresh:cf-runtime-runner + +oc adm policy add-scc-to-user privileged system:serviceaccount:codefresh:cf-runtime-volume-provisioner +``` + +### On-premise + +If you have [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) deployed, you can install Codefresh Runner in **agentless** mode. + +**What is agentless mode?** + +Agent (aka venona) is Runner component which responsible for calling Codefresh API to run builds and create dind/engine pods and pvc objects. Agent can only be assigned to a single account, thus you can't share one runtime across multiple accounts. However, with **agentless** mode it's possible to register the runtime as **system**-type runtime so it's registered on the platform level and can be assigned/shared across multiple accounts. + +**What are the prerequisites?** +- You have a running [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) control-plane environment +- You have a Codefresh API token with platform **Admin** permissions scope + +### How to deploy agentless runtime when it's on the SAME k8s cluster as On-Premises control-plane environment? + +- Enable cluster-level permissions for cf-api (On-Premises control-plane component) + +> `values.yaml` for [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) Helm chart +```yaml +cfapi: + ... + # -- Enable ClusterRole/ClusterRoleBinding + rbac: + namespaced: false +``` + +- Set the following values for Runner Helm chart + +`.Values.global.codefreshHost=...` \ +`.Values.global.codefreshToken=...` \ +`.Values.global.runtimeName=system/...` \ +`.Values.runtime.agent=false` \ +`.Values.runtime.inCluster=true` + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart +```yaml +global: + # -- URL of Codefresh On-Premises Platform + codefreshHost: "https://myonprem.somedomain.com" + # -- User token in plain text with Admin permission scope + codefreshToken: "" + # -- User token that references an existing secret containing API key. + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Distinguished runtime name + # (for On-Premise only; mandatory!) Must be prefixed with "system/..." + runtimeName: "system/prod-ue1-some-cluster-name" + +# -- Set runtime parameters +runtime: + # -- (for On-Premise only; mandatory!) Disable agent + agent: false + # -- (for On-Premise only; optional) Set inCluster runtime (default: `true`) + # `inCluster=true` flag is set when Runtime and On-Premises control-plane are run on the same cluster + # `inCluster=false` flag is set when Runtime and On-Premises control-plane are on different clusters + inCluster: true + # -- (for On-Premise only; optional) Assign accounts to runtime (list of account ids; default is empty) + # Accounts can be assigned to the runtime in Codefresh UI later so you can kepp it empty. + accounts: [] + # -- Set parent runtime to inherit. + runtimeExtends: [] +``` + +- Install the chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace cf-runtime +``` + +- Verify the runtime and run test pipeline + +Go to [https:///admin/runtime-environments/system](https:///admin/runtime-environments/system) to check the runtime. Assign it to the required account(s). Run test pipeline on it. + +### How to deploy agentless runtime when it's on the DIFFERENT k8s cluster than On-Premises control-plane environment? + +In this case, it's required to mount runtime cluster's `KUBECONFIG` into On-Premises `cf-api` deployment + +- Create the neccessary RBAC resources + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart +```yaml +extraResources: +- apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + name: codefresh-role + namespace: '{{ .Release.Namespace }}' + rules: + - apiGroups: [""] + resources: ["pods", "persistentvolumeclaims", "persistentvolumes"] + verbs: ["list", "watch", "get", "create", "patch", "delete"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots"] + verbs: ["list", "watch", "get", "create", "patch", "delete"] +- apiVersion: v1 + kind: ServiceAccount + metadata: + name: codefresh-runtime-user + namespace: '{{ .Release.Namespace }}' +- apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: codefresh-runtime-user + namespace: '{{ .Release.Namespace }}' + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: codefresh-role + subjects: + - kind: ServiceAccount + name: codefresh-runtime-user + namespace: '{{ .Release.Namespace }}' +- apiVersion: v1 + kind: Secret + metadata: + name: codefresh-runtime-user-token + namespace: '{{ .Release.Namespace }}' + annotations: + kubernetes.io/service-account.name: codefresh-runtime-user + type: kubernetes.io/service-account-token +``` + +- Set up the following environment variables to create a `KUBECONFIG` file + +```shell +NAMESPACE=cf-runtime +CLUSTER_NAME=prod-ue1-some-cluster-name +CURRENT_CONTEXT=$(kubectl config current-context) + +USER_TOKEN_VALUE=$(kubectl -n cf-runtime get secret/codefresh-runtime-user-token -o=go-template='{{.data.token}}' | base64 --decode) +CURRENT_CLUSTER=$(kubectl config view --raw -o=go-template='{{range .contexts}}{{if eq .name "'''${CURRENT_CONTEXT}'''"}}{{ index .context "cluster" }}{{end}}{{end}}') +CLUSTER_CA=$(kubectl config view --raw -o=go-template='{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}"{{with index .cluster "certificate-authority-data" }}{{.}}{{end}}"{{ end }}{{ end }}') +CLUSTER_SERVER=$(kubectl config view --raw -o=go-template='{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}{{ .cluster.server }}{{end}}{{ end }}') + +export -p USER_TOKEN_VALUE CURRENT_CONTEXT CURRENT_CLUSTER CLUSTER_CA CLUSTER_SERVER CLUSTER_NAME +``` + +- Create a kubeconfig file + +```console +cat << EOF > $CLUSTER_NAME-kubeconfig +apiVersion: v1 +kind: Config +current-context: ${CLUSTER_NAME} +contexts: +- name: ${CLUSTER_NAME} + context: + cluster: ${CLUSTER_NAME} + user: codefresh-runtime-user + namespace: ${NAMESPACE} +clusters: +- name: ${CLUSTER_NAME} + cluster: + certificate-authority-data: ${CLUSTER_CA} + server: ${CLUSTER_SERVER} +users: +- name: ${CLUSTER_NAME} + user: + token: ${USER_TOKEN_VALUE} +EOF +``` + +- **Switch context to On-Premises control-plane cluster**. Create k8s secret (via any tool like [ESO](https://external-secrets.io/v0.4.4/), `kubectl`, etc ) containing runtime cluster's `KUBECONFG` created in previous step. + +```shell +NAMESPACE=codefresh +kubectl create secret generic dind-runtime-clusters --from-file=$CLUSTER_NAME=$CLUSTER_NAME-kubeconfig -n $NAMESPACE +``` + +- Mount secret containing runtime cluster's `KUBECONFG` into cf-api in On-Premises control-plane cluster + +> `values.yaml` for [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) helm chart +```yaml +cf-api: + ... + volumes: + dind-clusters: + enabled: true + type: secret + nameOverride: dind-runtime-clusters + optional: true +``` +> volumeMount `/etc/kubeconfig` is already configured in cf-api Helm chart template. No need to specify it. + +- Set the following values for Runner helm chart + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart + +`.Values.global.codefreshHost=...` \ +`.Values.global.codefreshToken=...` \ +`.Values.global.runtimeName=system/...` \ +`.Values.runtime.agent=false` \ +`.Values.runtime.inCluster=false` + +**Important!** +`.Values.global.name` ("system/" prefix is ignored!) should match the cluster name (key in `dind-runtime-clusters` secret created previously) +```yaml +global: + # -- URL of Codefresh On-Premises Platform + codefreshHost: "https://myonprem.somedomain.com" + # -- User token in plain text with Admin permission scope + codefreshToken: "" + # -- User token that references an existing secret containing API key. + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Distinguished runtime name + # (for On-Premise only; mandatory!) Must be prefixed with "system/..." + name: "system/prod-ue1-some-cluster-name" + +# -- Set runtime parameters +runtime: + # -- (for On-Premise only; mandatory!) Disable agent + agent: false + # -- (for On-Premise only; optional) Set inCluster runtime (default: `true`) + # `inCluster=true` flag is set when Runtime and On-Premises control-plane are run on the same cluster + # `inCluster=false` flag is set when Runtime and On-Premises control-plane are on different clusters + inCluster: false + # -- (for On-Premise only; optional) Assign accounts to runtime (list of account ids; default is empty) + # Accounts can be assigned to the runtime in Codefresh UI later so you can kepp it empty. + accounts: [] + # -- (optional) Set parent runtime to inherit. + runtimeExtends: [] +``` + +- Install the chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace cf-runtime +``` + +- Verify the runtime and run test pipeline + +Go to [https:///admin/runtime-environments/system](https:///admin/runtime-environments/system) to see the runtime. Assign it to the required account(s). + +## Requirements + +| Repository | Name | Version | +|------------|------|---------| +| oci://quay.io/codefresh/charts | cf-common | 0.16.0 | + +## Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| appProxy.affinity | object | `{}` | Set affinity | +| appProxy.enabled | bool | `false` | Enable app-proxy | +| appProxy.env | object | `{}` | Add additional env vars | +| appProxy.image | object | `{"registry":"quay.io","repository":"codefresh/cf-app-proxy","tag":"0.0.47"}` | Set image | +| appProxy.ingress.annotations | object | `{}` | Set extra annotations for ingress object | +| appProxy.ingress.class | string | `""` | Set ingress class | +| appProxy.ingress.host | string | `""` | Set DNS hostname the ingress will use | +| appProxy.ingress.pathPrefix | string | `""` | Set path prefix for ingress (keep empty for default `/` path) | +| appProxy.ingress.tlsSecret | string | `""` | Set k8s tls secret for the ingress object | +| appProxy.nodeSelector | object | `{}` | Set node selector | +| appProxy.podAnnotations | object | `{}` | Set pod annotations | +| appProxy.podSecurityContext | object | `{}` | Set security context for the pod | +| appProxy.rbac | object | `{"create":true,"namespaced":true,"rules":[]}` | RBAC parameters | +| appProxy.rbac.create | bool | `true` | Create RBAC resources | +| appProxy.rbac.namespaced | bool | `true` | Use Role(true)/ClusterRole(true) | +| appProxy.rbac.rules | list | `[]` | Add custom rule to the role | +| appProxy.readinessProbe | object | See below | Readiness probe configuration | +| appProxy.replicasCount | int | `1` | Set number of pods | +| appProxy.resources | object | `{}` | Set requests and limits | +| appProxy.serviceAccount | object | `{"annotations":{},"create":true,"name":"","namespaced":true}` | Service Account parameters | +| appProxy.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| appProxy.serviceAccount.create | bool | `true` | Create service account | +| appProxy.serviceAccount.name | string | `""` | Override service account name | +| appProxy.serviceAccount.namespaced | bool | `true` | Use Role(true)/ClusterRole(true) | +| appProxy.tolerations | list | `[]` | Set tolerations | +| appProxy.updateStrategy | object | `{"type":"RollingUpdate"}` | Upgrade strategy | +| dockerRegistry | string | `""` | | +| event-exporter | object | See below | Event exporter parameters | +| event-exporter.affinity | object | `{}` | Set affinity | +| event-exporter.enabled | bool | `false` | Enable event-exporter | +| event-exporter.env | object | `{}` | Add additional env vars | +| event-exporter.image | object | `{"registry":"docker.io","repository":"codefresh/k8s-event-exporter","tag":"latest"}` | Set image | +| event-exporter.nodeSelector | object | `{}` | Set node selector | +| event-exporter.podAnnotations | object | `{}` | Set pod annotations | +| event-exporter.podSecurityContext | object | See below | Set security context for the pod | +| event-exporter.rbac | object | `{"create":true,"rules":[]}` | RBAC parameters | +| event-exporter.rbac.create | bool | `true` | Create RBAC resources | +| event-exporter.rbac.rules | list | `[]` | Add custom rule to the role | +| event-exporter.replicasCount | int | `1` | Set number of pods | +| event-exporter.resources | object | `{}` | Set resources | +| event-exporter.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Service Account parameters | +| event-exporter.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| event-exporter.serviceAccount.create | bool | `true` | Create service account | +| event-exporter.serviceAccount.name | string | `""` | Override service account name | +| event-exporter.tolerations | list | `[]` | Set tolerations | +| event-exporter.updateStrategy | object | `{"type":"Recreate"}` | Upgrade strategy | +| extraResources | list | `[]` | Array of extra objects to deploy with the release | +| fullnameOverride | string | `""` | String to fully override cf-runtime.fullname template | +| global | object | See below | Global parameters | +| global.accountId | string | `""` | Account ID (required!) Can be obtained here https://g.codefresh.io/2.0/account-settings/account-information | +| global.agentName | string | `""` | Agent Name (optional!) If omitted, the following format will be used `{{ .Values.global.context }}_{{ .Release.Namespace }}` | +| global.agentToken | string | `""` | DEPRECATED Agent token in plain text. !!! MUST BE provided if migrating from < 6.x chart version | +| global.agentTokenSecretKeyRef | object | `{}` | DEPRECATED Agent token that references an existing secret containing API key. !!! MUST BE provided if migrating from < 6.x chart version | +| global.codefreshHost | string | `"https://g.codefresh.io"` | URL of Codefresh Platform (required!) | +| global.codefreshToken | string | `""` | User token in plain text (required if `global.codefreshTokenSecretKeyRef` is omitted!) Ref: https://g.codefresh.io/user/settings (see API Keys) Minimal API key scopes: Runner-Installation(read+write), Agent(read+write), Agents(read+write) | +| global.codefreshTokenSecretKeyRef | object | `{}` | User token that references an existing secret containing API key (required if `global.codefreshToken` is omitted!) | +| global.context | string | `""` | K8s context name (required!) | +| global.imagePullSecrets | list | `[]` | Global Docker registry secret names as array | +| global.imageRegistry | string | `""` | Global Docker image registry | +| global.runtimeName | string | `""` | Runtime name (optional!) If omitted, the following format will be used `{{ .Values.global.context }}/{{ .Release.Namespace }}` | +| monitor.affinity | object | `{}` | Set affinity | +| monitor.enabled | bool | `false` | Enable monitor Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#install-monitoring-component | +| monitor.env | object | `{}` | Add additional env vars | +| monitor.image | object | `{"registry":"quay.io","repository":"codefresh/cf-k8s-agent","tag":"1.3.17"}` | Set image | +| monitor.nodeSelector | object | `{}` | Set node selector | +| monitor.podAnnotations | object | `{}` | Set pod annotations | +| monitor.podSecurityContext | object | `{}` | | +| monitor.rbac | object | `{"create":true,"namespaced":true,"rules":[]}` | RBAC parameters | +| monitor.rbac.create | bool | `true` | Create RBAC resources | +| monitor.rbac.namespaced | bool | `true` | Use Role(true)/ClusterRole(true) | +| monitor.rbac.rules | list | `[]` | Add custom rule to the role | +| monitor.readinessProbe | object | See below | Readiness probe configuration | +| monitor.replicasCount | int | `1` | Set number of pods | +| monitor.resources | object | `{}` | Set resources | +| monitor.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Service Account parameters | +| monitor.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| monitor.serviceAccount.create | bool | `true` | Create service account | +| monitor.serviceAccount.name | string | `""` | Override service account name | +| monitor.tolerations | list | `[]` | Set tolerations | +| monitor.updateStrategy | object | `{"type":"RollingUpdate"}` | Upgrade strategy | +| nameOverride | string | `""` | String to partially override cf-runtime.fullname template (will maintain the release name) | +| podMonitor | object | See below | Add podMonitor (for engine pods) | +| podMonitor.main.enabled | bool | `false` | Enable pod monitor for engine pods | +| podMonitor.runner.enabled | bool | `false` | Enable pod monitor for runner pod | +| podMonitor.volume-provisioner.enabled | bool | `false` | Enable pod monitor for volumeProvisioner pod | +| re | object | `{}` | | +| runner | object | See below | Runner parameters | +| runner.affinity | object | `{}` | Set affinity | +| runner.enabled | bool | `true` | Enable the runner | +| runner.env | object | `{}` | Add additional env vars | +| runner.image | object | `{"registry":"quay.io","repository":"codefresh/venona","tag":"1.10.2"}` | Set image | +| runner.init | object | `{"image":{"registry":"quay.io","repository":"codefresh/cli","tag":"0.85.0-rootless"},"resources":{"limits":{"cpu":"1","memory":"512Mi"},"requests":{"cpu":"0.2","memory":"256Mi"}}}` | Init container | +| runner.nodeSelector | object | `{}` | Set node selector | +| runner.podAnnotations | object | `{}` | Set pod annotations | +| runner.podSecurityContext | object | See below | Set security context for the pod | +| runner.rbac | object | `{"create":true,"rules":[]}` | RBAC parameters | +| runner.rbac.create | bool | `true` | Create RBAC resources | +| runner.rbac.rules | list | `[]` | Add custom rule to the role | +| runner.readinessProbe | object | See below | Readiness probe configuration | +| runner.replicasCount | int | `1` | Set number of pods | +| runner.resources | object | `{}` | Set requests and limits | +| runner.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Service Account parameters | +| runner.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| runner.serviceAccount.create | bool | `true` | Create service account | +| runner.serviceAccount.name | string | `""` | Override service account name | +| runner.sidecar | object | `{"enabled":false,"env":{"RECONCILE_INTERVAL":300},"image":{"registry":"quay.io","repository":"codefresh/codefresh-shell","tag":"0.0.2"},"resources":{}}` | Sidecar container Reconciles runtime spec from Codefresh API for drift detection | +| runner.tolerations | list | `[]` | Set tolerations | +| runner.updateStrategy | object | `{"type":"RollingUpdate"}` | Upgrade strategy | +| runtime | object | See below | Set runtime parameters | +| runtime.accounts | list | `[]` | (for On-Premise only) Assign accounts to runtime (list of account ids) | +| runtime.agent | bool | `true` | (for On-Premise only) Enable agent | +| runtime.description | string | `""` | Runtime description | +| runtime.dind | object | `{"affinity":{},"env":{"DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE":true},"image":{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/dind","tag":"26.1.4-1.28.7"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"pvcs":{"dind":{"annotations":{},"name":"dind","reuseVolumeSelector":"codefresh-app,io.codefresh.accountName","reuseVolumeSortOrder":"pipeline_id","storageClassName":"{{ include \"dind-volume-provisioner.storageClassName\" . }}","volumeSize":"16Gi"}},"resources":{"limits":{"cpu":"400m","memory":"800Mi"},"requests":null},"schedulerName":"","serviceAccount":"codefresh-engine","tolerations":[],"userAccess":true,"userVolumeMounts":{},"userVolumes":{}}` | Parameters for DinD (docker-in-docker) pod (aka "runtime" pod). | +| runtime.dind.affinity | object | `{}` | Set affinity | +| runtime.dind.env | object | `{"DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE":true}` | Set additional env vars. | +| runtime.dind.image | object | `{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/dind","tag":"26.1.4-1.28.7"}` | Set dind image. | +| runtime.dind.nodeSelector | object | `{}` | Set node selector. | +| runtime.dind.podAnnotations | object | `{}` | Set pod annotations. | +| runtime.dind.podLabels | object | `{}` | Set pod labels. | +| runtime.dind.pvcs | object | `{"dind":{"annotations":{},"name":"dind","reuseVolumeSelector":"codefresh-app,io.codefresh.accountName","reuseVolumeSortOrder":"pipeline_id","storageClassName":"{{ include \"dind-volume-provisioner.storageClassName\" . }}","volumeSize":"16Gi"}}` | PV claim spec parametes. | +| runtime.dind.pvcs.dind | object | `{"annotations":{},"name":"dind","reuseVolumeSelector":"codefresh-app,io.codefresh.accountName","reuseVolumeSortOrder":"pipeline_id","storageClassName":"{{ include \"dind-volume-provisioner.storageClassName\" . }}","volumeSize":"16Gi"}` | Default dind PVC parameters | +| runtime.dind.pvcs.dind.annotations | object | `{}` | PV annotations. | +| runtime.dind.pvcs.dind.name | string | `"dind"` | PVC name prefix. Keep `dind` as default! Don't change! | +| runtime.dind.pvcs.dind.reuseVolumeSelector | string | `"codefresh-app,io.codefresh.accountName"` | PV reuse selector. Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#volume-reuse-policy | +| runtime.dind.pvcs.dind.storageClassName | string | `"{{ include \"dind-volume-provisioner.storageClassName\" . }}"` | PVC storage class name. Change ONLY if you need to use storage class NOT from Codefresh volume-provisioner | +| runtime.dind.pvcs.dind.volumeSize | string | `"16Gi"` | PVC size. | +| runtime.dind.resources | object | `{"limits":{"cpu":"400m","memory":"800Mi"},"requests":null}` | Set dind resources. | +| runtime.dind.schedulerName | string | `""` | Set scheduler name. | +| runtime.dind.serviceAccount | string | `"codefresh-engine"` | Set service account for pod. | +| runtime.dind.tolerations | list | `[]` | Set tolerations. | +| runtime.dind.userAccess | bool | `true` | Keep `true` as default! | +| runtime.dind.userVolumeMounts | object | `{}` | Add extra volume mounts | +| runtime.dind.userVolumes | object | `{}` | Add extra volumes | +| runtime.dindDaemon | object | See below | DinD pod daemon config | +| runtime.engine | object | `{"affinity":{},"command":["npm","run","start"],"env":{"CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_PROMETHEUS_COLLECT_PROCESS_METRICS":false,"METRICS_PROMETHEUS_ENABLED":true,"METRICS_PROMETHEUS_ENABLE_LEGACY_METRICS":false,"METRICS_PROMETHEUS_HOST":"0.0.0.0","METRICS_PROMETHEUS_PORT":9100},"image":{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"1.174.12"},"nodeSelector":{},"podAnnotations":{},"podLabels":{},"resources":{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}},"runtimeImages":{"COMPOSE_IMAGE":"quay.io/codefresh/compose:v2.28.1-1.5.0","CONTAINER_LOGGER_IMAGE":"quay.io/codefresh/cf-container-logger:1.11.6","COSIGN_IMAGE_SIGNER_IMAGE":"quay.io/codefresh/cf-cosign-image-signer:2.4.0-cf.2","CR_6177_FIXER":"quay.io/codefresh/alpine:edge","DOCKER_BUILDER_IMAGE":"quay.io/codefresh/cf-docker-builder:1.3.13","DOCKER_PULLER_IMAGE":"quay.io/codefresh/cf-docker-puller:8.0.17","DOCKER_PUSHER_IMAGE":"quay.io/codefresh/cf-docker-pusher:6.0.16","DOCKER_TAG_PUSHER_IMAGE":"quay.io/codefresh/cf-docker-tag-pusher:1.3.14","FS_OPS_IMAGE":"quay.io/codefresh/fs-ops:1.2.3","GC_BUILDER_IMAGE":"quay.io/codefresh/cf-gc-builder:0.5.3","GIT_CLONE_IMAGE":"quay.io/codefresh/cf-git-cloner:10.1.28","KUBE_DEPLOY":"quay.io/codefresh/cf-deploy-kubernetes:16.1.11","PIPELINE_DEBUGGER_IMAGE":"quay.io/codefresh/cf-debugger:1.3.0","TEMPLATE_ENGINE":"quay.io/codefresh/pikolo:0.14.1"},"schedulerName":"","serviceAccount":"codefresh-engine","tolerations":[],"userEnvVars":[],"workflowLimits":{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}}` | Parameters for Engine pod (aka "pipeline" orchestrator). | +| runtime.engine.affinity | object | `{}` | Set affinity | +| runtime.engine.command | list | `["npm","run","start"]` | Set container command. | +| runtime.engine.env | object | `{"CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS":1000,"DOCKER_REQUEST_TIMEOUT_MS":30000,"FORCE_COMPOSE_SERIAL_PULL":false,"LOGGER_LEVEL":"debug","LOG_OUTGOING_HTTP_REQUESTS":false,"METRICS_PROMETHEUS_COLLECT_PROCESS_METRICS":false,"METRICS_PROMETHEUS_ENABLED":true,"METRICS_PROMETHEUS_ENABLE_LEGACY_METRICS":false,"METRICS_PROMETHEUS_HOST":"0.0.0.0","METRICS_PROMETHEUS_PORT":9100}` | Set additional env vars. | +| runtime.engine.env.CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS | int | `1000` | Interval to check the exec status in the container-logger | +| runtime.engine.env.DOCKER_REQUEST_TIMEOUT_MS | int | `30000` | Timeout while doing requests to the Docker daemon | +| runtime.engine.env.FORCE_COMPOSE_SERIAL_PULL | bool | `false` | If "true", composition images will be pulled sequentially | +| runtime.engine.env.LOGGER_LEVEL | string | `"debug"` | Level of logging for engine | +| runtime.engine.env.LOG_OUTGOING_HTTP_REQUESTS | bool | `false` | Enable debug-level logging of outgoing HTTP/HTTPS requests | +| runtime.engine.env.METRICS_PROMETHEUS_COLLECT_PROCESS_METRICS | bool | `false` | Enable collecting process metrics | +| runtime.engine.env.METRICS_PROMETHEUS_ENABLED | bool | `true` | Enable emitting metrics from engine | +| runtime.engine.env.METRICS_PROMETHEUS_ENABLE_LEGACY_METRICS | bool | `false` | Enable legacy metrics | +| runtime.engine.env.METRICS_PROMETHEUS_HOST | string | `"0.0.0.0"` | Host for Prometheus metrics server | +| runtime.engine.env.METRICS_PROMETHEUS_PORT | int | `9100` | Port for Prometheus metrics server | +| runtime.engine.image | object | `{"pullPolicy":"IfNotPresent","registry":"quay.io","repository":"codefresh/engine","tag":"1.174.12"}` | Set image. | +| runtime.engine.nodeSelector | object | `{}` | Set node selector. | +| runtime.engine.podAnnotations | object | `{}` | Set pod annotations. | +| runtime.engine.podLabels | object | `{}` | Set pod labels. | +| runtime.engine.resources | object | `{"limits":{"cpu":"1000m","memory":"2048Mi"},"requests":{"cpu":"100m","memory":"128Mi"}}` | Set resources. | +| runtime.engine.runtimeImages | object | See below. | Set system(base) runtime images. | +| runtime.engine.schedulerName | string | `""` | Set scheduler name. | +| runtime.engine.serviceAccount | string | `"codefresh-engine"` | Set service account for pod. | +| runtime.engine.tolerations | list | `[]` | Set tolerations. | +| runtime.engine.userEnvVars | list | `[]` | Set extra env vars | +| runtime.engine.workflowLimits | object | `{"MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS":600,"MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION":86400,"MAXIMUM_ELECTED_STATE_AGE_ALLOWED":900,"MAXIMUM_RETRY_ATTEMPTS_ALLOWED":20,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED":900,"MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE":300,"TIME_ENGINE_INACTIVE_UNTIL_TERMINATION":300,"TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY":60,"TIME_INACTIVE_UNTIL_TERMINATION":2700}` | Set workflow limits. | +| runtime.engine.workflowLimits.MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS | int | `600` | Maximum time allowed to the engine to wait for the pre-steps (aka "Initializing Process") to succeed; seconds. | +| runtime.engine.workflowLimits.MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION | int | `86400` | Maximum time for workflow execution; seconds. | +| runtime.engine.workflowLimits.MAXIMUM_ELECTED_STATE_AGE_ALLOWED | int | `900` | Maximum time allowed to workflow to spend in "elected" state; seconds. | +| runtime.engine.workflowLimits.MAXIMUM_RETRY_ATTEMPTS_ALLOWED | int | `20` | Maximum retry attempts allowed for workflow. | +| runtime.engine.workflowLimits.MAXIMUM_TERMINATING_STATE_AGE_ALLOWED | int | `900` | Maximum time allowed to workflow to spend in "terminating" state until force terminated; seconds. | +| runtime.engine.workflowLimits.MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE | int | `300` | Maximum time allowed to workflow to spend in "terminating" state without logs activity until force terminated; seconds. | +| runtime.engine.workflowLimits.TIME_ENGINE_INACTIVE_UNTIL_TERMINATION | int | `300` | Time since the last health check report after which workflow is terminated; seconds. | +| runtime.engine.workflowLimits.TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY | int | `60` | Time since the last health check report after which the engine is considered unhealthy; seconds. | +| runtime.engine.workflowLimits.TIME_INACTIVE_UNTIL_TERMINATION | int | `2700` | Time since the last workflow logs activity after which workflow is terminated; seconds. | +| runtime.gencerts | object | See below | Parameters for `gencerts-dind` post-upgrade/install hook | +| runtime.inCluster | bool | `true` | (for On-Premise only) Set inCluster runtime | +| runtime.patch | object | See below | Parameters for `runtime-patch` post-upgrade/install hook | +| runtime.rbac | object | `{"create":true,"rules":[]}` | RBAC parameters | +| runtime.rbac.create | bool | `true` | Create RBAC resources | +| runtime.rbac.rules | list | `[]` | Add custom rule to the engine role | +| runtime.runtimeExtends | list | `["system/default/hybrid/k8s_low_limits"]` | Set parent runtime to inherit. Should not be changes. Parent runtime is controlled from Codefresh side. | +| runtime.serviceAccount | object | `{"annotations":{},"create":true}` | Set annotation on engine Service Account Ref: https://codefresh.io/docs/docs/administration/codefresh-runner/#injecting-aws-arn-roles-into-the-cluster | +| serviceMonitor | object | See below | Add serviceMonitor | +| serviceMonitor.main.enabled | bool | `false` | Enable service monitor for dind pods | +| storage.azuredisk.cachingMode | string | `"None"` | | +| storage.azuredisk.skuName | string | `"Premium_LRS"` | Set storage type (`Premium_LRS`) | +| storage.backend | string | `"local"` | Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) | +| storage.ebs.accessKeyId | string | `""` | Set AWS_ACCESS_KEY_ID for volume-provisioner (optional) Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#dind-volume-provisioner-permissions | +| storage.ebs.accessKeyIdSecretKeyRef | object | `{}` | Existing secret containing AWS_ACCESS_KEY_ID. | +| storage.ebs.availabilityZone | string | `"us-east-1a"` | Set EBS volumes availability zone (required) | +| storage.ebs.encrypted | string | `"false"` | Enable encryption (optional) | +| storage.ebs.kmsKeyId | string | `""` | Set KMS encryption key ID (optional) | +| storage.ebs.secretAccessKey | string | `""` | Set AWS_SECRET_ACCESS_KEY for volume-provisioner (optional) Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#dind-volume-provisioner-permissions | +| storage.ebs.secretAccessKeySecretKeyRef | object | `{}` | Existing secret containing AWS_SECRET_ACCESS_KEY | +| storage.ebs.volumeType | string | `"gp2"` | Set EBS volume type (`gp2`/`gp3`/`io1`) (required) | +| storage.fsType | string | `"ext4"` | Set filesystem type (`ext4`/`xfs`) | +| storage.gcedisk.availabilityZone | string | `"us-west1-a"` | Set GCP volume availability zone | +| storage.gcedisk.serviceAccountJson | string | `""` | Set Google SA JSON key for volume-provisioner (optional) | +| storage.gcedisk.serviceAccountJsonSecretKeyRef | object | `{}` | Existing secret containing containing Google SA JSON key for volume-provisioner (optional) | +| storage.gcedisk.volumeType | string | `"pd-ssd"` | Set GCP volume backend type (`pd-ssd`/`pd-standard`) | +| storage.local.volumeParentDir | string | `"/var/lib/codefresh/dind-volumes"` | Set volume path on the host filesystem | +| storage.mountAzureJson | bool | `false` | | +| volumeProvisioner | object | See below | Volume Provisioner parameters | +| volumeProvisioner.affinity | object | `{}` | Set affinity | +| volumeProvisioner.dind-lv-monitor | object | See below | `dind-lv-monitor` DaemonSet parameters (local volumes cleaner) | +| volumeProvisioner.enabled | bool | `true` | Enable volume-provisioner | +| volumeProvisioner.env | object | `{}` | Add additional env vars | +| volumeProvisioner.image | object | `{"registry":"quay.io","repository":"codefresh/dind-volume-provisioner","tag":"1.35.0"}` | Set image | +| volumeProvisioner.nodeSelector | object | `{}` | Set node selector | +| volumeProvisioner.podAnnotations | object | `{}` | Set pod annotations | +| volumeProvisioner.podSecurityContext | object | See below | Set security context for the pod | +| volumeProvisioner.rbac | object | `{"create":true,"rules":[]}` | RBAC parameters | +| volumeProvisioner.rbac.create | bool | `true` | Create RBAC resources | +| volumeProvisioner.rbac.rules | list | `[]` | Add custom rule to the role | +| volumeProvisioner.replicasCount | int | `1` | Set number of pods | +| volumeProvisioner.resources | object | `{}` | Set resources | +| volumeProvisioner.serviceAccount | object | `{"annotations":{},"create":true,"name":""}` | Service Account parameters | +| volumeProvisioner.serviceAccount.annotations | object | `{}` | Additional service account annotations | +| volumeProvisioner.serviceAccount.create | bool | `true` | Create service account | +| volumeProvisioner.serviceAccount.name | string | `""` | Override service account name | +| volumeProvisioner.tolerations | list | `[]` | Set tolerations | +| volumeProvisioner.updateStrategy | object | `{"type":"Recreate"}` | Upgrade strategy | + diff --git a/charts/codefresh/cf-runtime/6.3.61/README.md.gotmpl b/charts/codefresh/cf-runtime/6.3.61/README.md.gotmpl new file mode 100644 index 000000000..96e5ca574 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/README.md.gotmpl @@ -0,0 +1,1007 @@ +## Codefresh Runner + +{{ template "chart.versionBadge" . }}{{ template "chart.typeBadge" . }}{{ template "chart.appVersionBadge" . }} + +Helm chart for deploying [Codefresh Runner](https://codefresh.io/docs/docs/installation/codefresh-runner/) to Kubernetes. + +## Table of Content + +- [Prerequisites](#prerequisites) +- [Get Chart Info](#get-chart-info) +- [Install Chart](#install-chart) +- [Chart Configuration](#chart-configuration) +- [Upgrade Chart](#upgrade-chart) + - [To 2.x](#to-2-x) + - [To 3.x](#to-3-x) + - [To 4.x](#to-4-x) + - [To 5.x](#to-5-x) + - [To 6.x](#to-6-x) +- [Architecture](#architecture) +- [Configuration](#configuration) + - [EBS backend volume configuration in AWS](#ebs-backend-volume-configuration) + - [Azure Disks backend volume configuration in AKS](#azure-disks-backend-volume-configuration) + - [GCE Disks backend volume configuration in GKE](#gce-disks-backend-volume-configuration-in-gke) + - [Custom volume mounts](#custom-volume-mounts) + - [Custom global environment variables](#custom-global-environment-variables) + - [Volume reuse policy](#volume-reuse-policy) + - [Volume cleaners](#volume-cleaners) + - [Rootless DinD](#rootless-dind) + - [ARM](#arm) + - [Openshift](#openshift) + - [On-premise](#on-premise) + +## Prerequisites + +- Kubernetes **1.19+** +- Helm **3.8.0+** + +⚠️⚠️⚠️ +> Since version 6.2.x chart is pushed **only** to OCI registry at `oci://quay.io/codefresh/cf-runtime` + +> Versions prior to 6.2.x are still available in ChartMuseum at `http://chartmuseum.codefresh.io/cf-runtime` + +## Get Chart Info + +```console +helm show all oci://quay.io/codefresh/cf-runtime +``` +See [Use OCI-based registries](https://helm.sh/docs/topics/registries/) + +## Install Chart + +**Important:** only helm3 is supported + +- Specify the following mandatory values + +`values.yaml` +```yaml +# -- Global parameters +# @default -- See below +global: + # -- User token in plain text (required if `global.codefreshTokenSecretKeyRef` is omitted!) + # Ref: https://g.codefresh.io/user/settings (see API Keys) + # Minimal API key scopes: Runner-Installation(read+write), Agent(read+write), Agents(read+write) + codefreshToken: "" + # -- User token that references an existing secret containing API key (required if `global.codefreshToken` is omitted!) + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Account ID (required!) + # Can be obtained here https://g.codefresh.io/2.0/account-settings/account-information + accountId: "" + + # -- K8s context name (required!) + context: "" + # E.g. + # context: prod-ue1-runtime-1 + + # -- Agent Name (optional!) + # If omitted, the following format will be used '{{ `{{ .Values.global.context }}_{{ .Release.Namespace }}` }}' + agentName: "" + # E.g. + # agentName: prod-ue1-runtime-1 + + # -- Runtime name (optional!) + # If omitted, the following format will be used '{{ `{{ .Values.global.context }}/{{ .Release.Namespace }}` }}' + runtimeName: "" + # E.g. + # runtimeName: prod-ue1-runtime-1/namespace +``` + +- Install chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace codefresh +``` + +## Chart Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). + +## Upgrade Chart + +### To 2.x + +This major release renames and deprecated several values in the chart. Most of the workload templates have been refactored. + +Affected values: +- `dockerRegistry` is deprecated. Replaced with `global.imageRegistry` +- `re` is renamed to `runtime` +- `storage.localVolumeMonitor` is replaced with `volumeProvisioner.dind-lv-monitor` +- `volumeProvisioner.volume-cleanup` is replaced with `volumeProvisioner.dind-volume-cleanup` +- `image` values structure has been updated. Split to `image.registry` `image.repository` `image.tag` +- pod's `annotations` is renamed to `podAnnotations` + +### To 3.x + +⚠️⚠️⚠️ +### READ this before the upgrade! + +This major release adds [runtime-environment](https://codefresh.io/docs/docs/installation/codefresh-runner/#runtime-environment-specification) spec into chart templates. +That means it is possible to set parametes for `dind` and `engine` pods via [values.yaml](./values.yaml). + +**If you had any overrides (i.e. tolerations/nodeSelector/environment variables/etc) added in runtime spec via [codefresh CLI](https://codefresh-io.github.io/cli/) (for example, you did use [get](https://codefresh-io.github.io/cli/runtime-environments/get-runtime-environments/) and [patch](https://codefresh-io.github.io/cli/runtime-environments/apply-runtime-environments/) commands to modify the runtime-environment), you MUST add these into chart's [values.yaml](./values.yaml) for `.Values.runtime.dind` or(and) .`Values.runtime.engine`** + +**For backward compatibility, you can disable updating runtime-environment spec via** `.Values.runtime.patch.enabled=false` + +Affected values: +- added **mandatory** `global.codefreshToken`/`global.codefreshTokenSecretKeyRef` **You must specify it before the upgrade!** +- `runtime.engine` is added +- `runtime.dind` is added +- `global.existingAgentToken` is replaced with `global.agentTokenSecretKeyRef` +- `global.existingDindCertsSecret` is replaced with `global.dindCertsSecretRef` + +### To 4.x + +This major release adds **agentless inCluster** runtime mode (relevant only for [Codefresh On-Premises](#on-premise) users) + +Affected values: +- `runtime.agent` / `runtime.inCluster` / `runtime.accounts` / `runtime.description` are added + +### To 5.x + +This major release converts `.runtime.dind.pvcs` from **list** to **dict** + +> 4.x chart's values example: +```yaml +runtime: + dind: + pvcs: + - name: dind + storageClassName: my-storage-class-name + volumeSize: 32Gi + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +> 5.x chart's values example: +```yaml +runtime: + dind: + pvcs: + dind: + name: dind + storageClassName: my-storage-class-name + volumeSize: 32Gi + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +Affected values: +- `.runtime.dind.pvcs` converted from **list** to **dict** + +### To 6.x + +⚠️⚠️⚠️ +### READ this before the upgrade! + +This major release deprecates previously required `codefresh runner init --generate-helm-values-file`. + +Affected values: +- **Replaced** `.monitor.clusterId` with `.global.context` as **mandatory** value! +- **Deprecated** `.global.agentToken` / `.global.agentTokenSecretKeyRef` +- **Removed** `.global.agentId` +- **Removed** `.global.keys` / `.global.dindCertsSecretRef` +- **Removed** `.global.existingAgentToken` / `existingDindCertsSecret` +- **Removed** `.monitor.clusterId` / `.monitor.token` / `.monitor.existingMonitorToken` + +#### Migrate the Helm chart from version 5.x to 6.x + +Given this is the legacy `generated_values.yaml` values: + +> legacy `generated_values.yaml` +```yaml +{ + "appProxy": { + "enabled": false, + }, + "monitor": { + "enabled": false, + "clusterId": "my-cluster-name", + "token": "1234567890" + }, + "global": { + "namespace": "namespace", + "codefreshHost": "https://g.codefresh.io", + "agentToken": "0987654321", + "agentId": "agent-id-here", + "agentName": "my-cluster-name_my-namespace", + "accountId": "my-account-id", + "runtimeName": "my-cluster-name/my-namespace", + "codefreshToken": "1234567890", + "keys": { + "key": "-----BEGIN RSA PRIVATE KEY-----...", + "csr": "-----BEGIN CERTIFICATE REQUEST-----...", + "ca": "-----BEGIN CERTIFICATE-----...", + "serverCert": "-----BEGIN CERTIFICATE-----..." + } + } +} +``` + +Update `values.yaml` for new chart version: + +> For existing installation for backward compatibility `.Values.global.agentToken/agentTokenSecretKeyRef` **must be provided!** For installation from scratch this value is no longer required. + +> updated `values.yaml` +```yaml +global: + codefreshToken: "1234567890" + accountId: "my-account-id" + context: "my-cluster-name" + agentToken: "0987654321" # MANDATORY when migrating from < 6.x chart version ! + agentName: "my-cluster-name_my-namespace" # optional + runtimeName: "my-cluster-name/my-namespace" # optional +``` + +> **Note!** Though it's still possible to update runtime-environment via [get](https://codefresh-io.github.io/cli/runtime-environments/get-runtime-environments/) and [patch](https://codefresh-io.github.io/cli/runtime-environments/apply-runtime-environments/) commands, it's recommended to enable sidecar container to pull runtime spec from Codefresh API to detect any drift in configuration. + +```yaml +runner: + # -- Sidecar container + # Reconciles runtime spec from Codefresh API for drift detection + sidecar: + enabled: true +``` + +## Architecture + +[Codefresh Runner architecture](https://codefresh.io/docs/docs/installation/codefresh-runner/#codefresh-runner-architecture) + +## Configuration + +See [Customizing the Chart Before Installing](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). + +### EBS backend volume configuration + +`dind-volume-provisioner` should have permissions to create/attach/detach/delete/get EBS volumes + +Minimal IAM policy for `dind-volume-provisioner` + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "ec2:AttachVolume", + "ec2:CreateSnapshot", + "ec2:CreateTags", + "ec2:CreateVolume", + "ec2:DeleteSnapshot", + "ec2:DeleteTags", + "ec2:DeleteVolume", + "ec2:DescribeInstances", + "ec2:DescribeSnapshots", + "ec2:DescribeTags", + "ec2:DescribeVolumes", + "ec2:DetachVolume" + ], + "Resource": "*" + } + ] +} +``` + +There are three options: + +1. Run `dind-volume-provisioner` pod on the node/node-group with IAM role + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + +volumeProvisioner: + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] +``` + +2. Pass static credentials in `.Values.storage.ebs.accessKeyId/accessKeyIdSecretKeyRef` and `.Values.storage.ebs.secretAccessKey/secretAccessKeySecretKeyRef` + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + + # -- Set AWS_ACCESS_KEY_ID for volume-provisioner (optional) + accessKeyId: "" + # -- Existing secret containing AWS_ACCESS_KEY_ID. + accessKeyIdSecretKeyRef: {} + # E.g. + # accessKeyIdSecretKeyRef: + # name: + # key: + + # -- Set AWS_SECRET_ACCESS_KEY for volume-provisioner (optional) + secretAccessKey: "" + # -- Existing secret containing AWS_SECRET_ACCESS_KEY + secretAccessKeySecretKeyRef: {} + # E.g. + # secretAccessKeySecretKeyRef: + # name: + # key: +``` + +3. Assign IAM role to `dind-volume-provisioner` service account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: ebs-csi + + ebs: + availabilityZone: "us-east-1a" + +volumeProvisioner: + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Additional service account annotations + annotations: + eks.amazonaws.com/role-arn: "arn:aws:iam:::role/" +``` + +### Custom volume mounts + +You can add your own volumes and volume mounts in the runtime environment, so that all pipeline steps will have access to the same set of external files. + +```yaml +runtime: + dind: + userVolumes: + regctl-docker-registry: + name: regctl-docker-registry + secret: + items: + - key: .dockerconfigjson + path: config.json + secretName: regctl-docker-registry + optional: true + userVolumeMounts: + regctl-docker-registry: + name: regctl-docker-registry + mountPath: /home/appuser/.docker/ + readOnly: true + +``` + +### Azure Disks backend volume configuration + +`dind-volume-provisioner` should have permissions to create/delete/get Azure Disks + +Role definition for `dind-volume-provisioner` + +`dind-volume-provisioner-role.json` +```json +{ + "Name": "CodefreshDindVolumeProvisioner", + "Description": "Perform create/delete/get disks", + "IsCustom": true, + "Actions": [ + "Microsoft.Compute/disks/read", + "Microsoft.Compute/disks/write", + "Microsoft.Compute/disks/delete" + + ], + "AssignableScopes": ["/subscriptions/"] +} +``` + +When creating an AKS cluster in Azure there is the option to use a [managed identity](https://learn.microsoft.com/en-us/azure/aks/use-managed-identity) that is assigned to the kubelet. This identity is assigned to the underlying node pool in the AKS cluster and can then be used by the dind-volume-provisioner. + +```console +export ROLE_DEFINITIN_FILE=dind-volume-provisioner-role.json +export SUBSCRIPTION_ID=$(az account show --query "id" | xargs echo ) +export RESOURCE_GROUP= +export AKS_NAME= +export LOCATION=$(az aks show -g $RESOURCE_GROUP -n $AKS_NAME --query location | xargs echo) +export NODES_RESOURCE_GROUP=MC_${RESOURCE_GROUP}_${AKS_NAME}_${LOCATION} +export NODE_SERVICE_PRINCIPAL=$(az aks show -g $RESOURCE_GROUP -n $AKS_NAME --query identityProfile.kubeletidentity.objectId | xargs echo) + +az role definition create --role-definition @${ROLE_DEFINITIN_FILE} +az role assignment create --assignee $NODE_SERVICE_PRINCIPAL --scope /subscriptions/$SUBSCRIPTION_ID/resourceGroups/$NODES_RESOURCE_GROUP --role CodefreshDindVolumeProvisioner +``` + +Deploy Helm chart with the following values: + +`values.yaml` +```yaml +volumeProvisioner: + podSecurityContext: + enabled: true + runAsUser: 0 + runAsGroup: 0 + fsGroup: 0 + +storage: + backend: azuredisk + azuredisk: + availabilityZone: northeurope-1 # replace with your zone + resourceGroup: my-resource-group-name + + mountAzureJson: true + +runtime: + dind: + nodeSelector: + topology.kubernetes.io/zone: northeurope-1 +``` + +### GCE Disks backend volume configuration in GKE + +`dind-volume-provisioner` should have `ComputeEngine.StorageAdmin` permissions + +There are three options: + +1. Run `dind-volume-provisioner` pod on the node/node-group with IAM Service Account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + +volumeProvisioner: + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +2. Pass static credentials in `.Values.storage.gcedisk.serviceAccountJson` (inline) or `.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef` (from your own secret) + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "`pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + # -- Set Google SA JSON key for volume-provisioner (optional) + serviceAccountJson: | + { + "type": "service_account", + "project_id": "...", + "private_key_id": "...", + "private_key": "...", + "client_email": "...", + "client_id": "...", + "auth_uri": "...", + "token_uri": "...", + "auth_provider_x509_cert_url": "...", + "client_x509_cert_url": "..." + } + # -- Existing secret containing containing Google SA JSON key for volume-provisioner (optional) + serviceAccountJsonSecretKeyRef: {} + # E.g.: + # serviceAccountJsonSecretKeyRef: + # name: gce-service-account + # key: service-account.json + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +3. Assign IAM role to `dind-volume-provisioner` service account + +```yaml +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: gcedisk + + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "`pd-standard" + # -- Set GCP volume availability zone + availabilityZone: "us-central1-c" + +volumeProvisioner: + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Additional service account annotations + annotations: + iam.gke.io/gcp-service-account: @.iam.gserviceaccount.com + +# -- Set runtime parameters +runtime: + # -- Parameters for DinD (docker-in-docker) pod + dind: + # -- Set node selector. + nodeSelector: + topology.kubernetes.io/zone: us-central1-c +``` + +### Custom global environment variables + +You can add your own environment variables to the runtime environment. All pipeline steps have access to the global variables. + +```yaml +runtime: + engine: + userEnvVars: + - name: GITHUB_TOKEN + valueFrom: + secretKeyRef: + name: github-token + key: token +``` + +### Volume reuse policy + +Volume reuse behavior depends on the configuration for `reuseVolumeSelector` in the runtime environment spec. + +```yaml +runtime: + dind: + pvcs: + - name: dind + ... + reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName' + reuseVolumeSortOrder: pipeline_id +``` + +The following options are available: +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName'` - PV can be used by ANY pipeline in the specified account (default). +Benefit: Fewer PVs, resulting in lower costs. Since any PV can be used by any pipeline, the cluster needs to maintain/reserve fewer PVs in its PV pool for Codefresh. +Downside: Since the PV can be used by any pipeline, the PVs could have assets and info from different pipelines, reducing the probability of cache. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,project_id'` - PV can be used by ALL pipelines in your account, assigned to the same project. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id'` - PV can be used only by a single pipeline. +Benefit: More probability of cache without “spam” from other pipelines. +Downside: More PVs to maintain and therefore higher costs. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id,io.codefresh.branch_name'` - PV can be used only by single pipeline AND single branch. + +- `reuseVolumeSelector: 'codefresh-app,io.codefresh.accountName,pipeline_id,trigger'` - PV can be used only by single pipeline AND single trigger. + +### Volume cleaners + +Codefresh pipelines require disk space for: + * [Pipeline Shared Volume](https://codefresh.io/docs/docs/pipelines/introduction-to-codefresh-pipelines/#sharing-the-workspace-between-build-steps) (`/codefresh/volume`, implemented as [docker volume](https://docs.docker.com/storage/volumes/)) + * Docker containers, both running and stopped + * Docker images and cached layers + +Codefresh offers two options to manage disk space and prevent out-of-space errors: +* Use runtime cleaners on Docker images and volumes +* [Set the minimum disk space per pipeline build volume](https://codefresh.io/docs/docs/pipelines/pipelines/#set-minimum-disk-space-for-a-pipeline-build) + +To improve performance by using Docker cache, Codefresh `volume-provisioner` can provision previously used disks with Docker images and pipeline volumes from previously run builds. + +### Types of runtime volume cleaners + +Docker images and volumes must be cleaned on a regular basis. + +* [IN-DIND cleaner](https://github.com/codefresh-io/dind/tree/master/cleaner): Deletes extra Docker containers, volumes, and images in **DIND pod**. +* [External volume cleaner](https://github.com/codefresh-io/dind-volume-cleanup): Deletes unused **external** PVs (EBS, GCE/Azure disks). +* [Local volume cleaner](https://github.com/codefresh-io/dind-volume-utils/blob/master/local-volumes/lv-cleaner.sh): Deletes **local** volumes if node disk space is close to the threshold. + +### IN-DIND cleaner + +**Purpose:** Removes unneeded *docker containers, images, volumes* inside Kubernetes volume mounted on the DIND pod + +**How it runs:** Inside each DIND pod as script + +**Triggered by:** SIGTERM and also during the run when disk usage > 90% (configurable) + +**Configured by:** Environment Variables which can be set in Runtime Environment spec + +**Configuration/Logic:** [README.md](https://github.com/codefresh-io/dind/tree/master/cleaner#readme) + +Override `.Values.runtime.dind.env` if necessary (the following are **defaults**): + +```yaml +runtime: + dind: + env: + CLEAN_PERIOD_SECONDS: '21600' # launch clean if last clean was more than CLEAN_PERIOD_SECONDS seconds ago + CLEAN_PERIOD_BUILDS: '5' # launch clean if last clean was more CLEAN_PERIOD_BUILDS builds since last build + IMAGE_RETAIN_PERIOD: '14400' # do not delete docker images if they have events since current_timestamp - IMAGE_RETAIN_PERIOD + VOLUMES_RETAIN_PERIOD: '14400' # do not delete docker volumes if they have events since current_timestamp - VOLUMES_RETAIN_PERIOD + DISK_USAGE_THRESHOLD: '0.8' # launch clean based on current disk usage DISK_USAGE_THRESHOLD + INODES_USAGE_THRESHOLD: '0.8' # launch clean based on current inodes usage INODES_USAGE_THRESHOLD +``` + +### External volumes cleaner + +**Purpose:** Removes unused *kubernetes volumes and related backend volumes* + +**How it runs:** Runs as `dind-volume-cleanup` CronJob. Installed in case the Runner uses non-local volumes `.Values.storage.backend != local` + +**Triggered by:** CronJob every 10min (configurable) + +**Configuration:** + +Set `codefresh.io/volume-retention` for dinds' PVCs: + +```yaml +runtime: + dind: + pvcs: + dind: + ... + annotations: + codefresh.io/volume-retention: 7d +``` + +Or override environment variables for `dind-volume-cleanup` cronjob: + +```yaml +volumeProvisioner: + dind-volume-cleanup: + env: + RETENTION_DAYS: 7 # clean volumes that were last used more than `RETENTION_DAYS` (default is 4) ago +``` + +### Local volumes cleaner + +**Purpose:** Deletes local volumes when node disk space is close to the threshold + +**How it runs:** Runs as `dind-lv-monitor` DaemonSet. Installed in case the Runner uses local volumes `.Values.storage.backend == local` + +**Triggered by:** Disk space usage or inode usage that exceeds thresholds (configurable) + +**Configuration:** + +Override environment variables for `dind-lv-monitor` daemonset: + +```yaml +volumeProvisioner: + dind-lv-monitor: + env: + KB_USAGE_THRESHOLD: 60 # default 80 (percentage) + INODE_USAGE_THRESHOLD: 60 # default 80 +``` + +### Rootless DinD + +DinD pod runs a `priviliged` container with **rootfull** docker. +To run the docker daemon as non-root user (**rootless** mode), change dind image tag: + +`values.yaml` +```yaml +runtime: + dind: + image: + tag: rootless +``` + +### ARM + +With the Codefresh Runner, you can run native ARM64v8 builds. + +> **Note!** +> You cannot run both amd64 and arm64 images within the same pipeline. As one pipeline can map only to one runtime, you can run either amd64 or arm64 within the same pipeline. + +Provide `nodeSelector` and(or) `tolerations` for dind pods: + +`values.yaml` +```yaml +runtime: + dind: + nodeSelector: + arch: arm64 + tolerations: + - key: arch + operator: Equal + value: arm64 + effect: NoSchedule +``` + +### Openshift + +To install Codefresh Runner on OpenShift use the following `values.yaml` example + +```yaml +runner: + podSecurityContext: + enabled: false + +volumeProvisioner: + podSecurityContext: + enabled: false + env: + PRIVILEGED_CONTAINER: true + dind-lv-monitor: + containerSecurityContext: + enabled: true + privileged: true + volumePermissions: + enabled: true + securityContext: + privileged: true + runAsUser: auto +``` + +Grant `privileged` SCC to `cf-runtime-runner` and `cf-runtime-volume-provisioner` service accounts. + +```console +oc adm policy add-scc-to-user privileged system:serviceaccount:codefresh:cf-runtime-runner + +oc adm policy add-scc-to-user privileged system:serviceaccount:codefresh:cf-runtime-volume-provisioner +``` + +### On-premise + +If you have [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) deployed, you can install Codefresh Runner in **agentless** mode. + +**What is agentless mode?** + +Agent (aka venona) is Runner component which responsible for calling Codefresh API to run builds and create dind/engine pods and pvc objects. Agent can only be assigned to a single account, thus you can't share one runtime across multiple accounts. However, with **agentless** mode it's possible to register the runtime as **system**-type runtime so it's registered on the platform level and can be assigned/shared across multiple accounts. + +**What are the prerequisites?** +- You have a running [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) control-plane environment +- You have a Codefresh API token with platform **Admin** permissions scope + + +### How to deploy agentless runtime when it's on the SAME k8s cluster as On-Premises control-plane environment? + +- Enable cluster-level permissions for cf-api (On-Premises control-plane component) + +> `values.yaml` for [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) Helm chart +```yaml +cfapi: + ... + # -- Enable ClusterRole/ClusterRoleBinding + rbac: + namespaced: false +``` + +- Set the following values for Runner Helm chart + +`.Values.global.codefreshHost=...` \ +`.Values.global.codefreshToken=...` \ +`.Values.global.runtimeName=system/...` \ +`.Values.runtime.agent=false` \ +`.Values.runtime.inCluster=true` + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart +```yaml +global: + # -- URL of Codefresh On-Premises Platform + codefreshHost: "https://myonprem.somedomain.com" + # -- User token in plain text with Admin permission scope + codefreshToken: "" + # -- User token that references an existing secret containing API key. + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Distinguished runtime name + # (for On-Premise only; mandatory!) Must be prefixed with "system/..." + runtimeName: "system/prod-ue1-some-cluster-name" + +# -- Set runtime parameters +runtime: + # -- (for On-Premise only; mandatory!) Disable agent + agent: false + # -- (for On-Premise only; optional) Set inCluster runtime (default: `true`) + # `inCluster=true` flag is set when Runtime and On-Premises control-plane are run on the same cluster + # `inCluster=false` flag is set when Runtime and On-Premises control-plane are on different clusters + inCluster: true + # -- (for On-Premise only; optional) Assign accounts to runtime (list of account ids; default is empty) + # Accounts can be assigned to the runtime in Codefresh UI later so you can kepp it empty. + accounts: [] + # -- Set parent runtime to inherit. + runtimeExtends: [] +``` + +- Install the chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace cf-runtime +``` + +- Verify the runtime and run test pipeline + +Go to [https:///admin/runtime-environments/system](https:///admin/runtime-environments/system) to check the runtime. Assign it to the required account(s). Run test pipeline on it. + + +### How to deploy agentless runtime when it's on the DIFFERENT k8s cluster than On-Premises control-plane environment? + +In this case, it's required to mount runtime cluster's `KUBECONFIG` into On-Premises `cf-api` deployment + +- Create the neccessary RBAC resources + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart +```yaml +extraResources: +- apiVersion: rbac.authorization.k8s.io/v1 + kind: Role + metadata: + name: codefresh-role + namespace: '{{ "{{ .Release.Namespace }}" }}' + rules: + - apiGroups: [""] + resources: ["pods", "persistentvolumeclaims", "persistentvolumes"] + verbs: ["list", "watch", "get", "create", "patch", "delete"] + - apiGroups: ["snapshot.storage.k8s.io"] + resources: ["volumesnapshots"] + verbs: ["list", "watch", "get", "create", "patch", "delete"] +- apiVersion: v1 + kind: ServiceAccount + metadata: + name: codefresh-runtime-user + namespace: '{{ "{{ .Release.Namespace }}" }}' +- apiVersion: rbac.authorization.k8s.io/v1 + kind: RoleBinding + metadata: + name: codefresh-runtime-user + namespace: '{{ "{{ .Release.Namespace }}" }}' + roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: codefresh-role + subjects: + - kind: ServiceAccount + name: codefresh-runtime-user + namespace: '{{ "{{ .Release.Namespace }}" }}' +- apiVersion: v1 + kind: Secret + metadata: + name: codefresh-runtime-user-token + namespace: '{{ "{{ .Release.Namespace }}" }}' + annotations: + kubernetes.io/service-account.name: codefresh-runtime-user + type: kubernetes.io/service-account-token +``` + +- Set up the following environment variables to create a `KUBECONFIG` file + +```shell +NAMESPACE=cf-runtime +CLUSTER_NAME=prod-ue1-some-cluster-name +CURRENT_CONTEXT=$(kubectl config current-context) + +USER_TOKEN_VALUE=$(kubectl -n cf-runtime get secret/codefresh-runtime-user-token -o=go-template='{{ `{{.data.token}}` }}' | base64 --decode) +CURRENT_CLUSTER=$(kubectl config view --raw -o=go-template='{{ `{{range .contexts}}{{if eq .name "'''${CURRENT_CONTEXT}'''"}}{{ index .context "cluster" }}{{end}}{{end}}` }}') +CLUSTER_CA=$(kubectl config view --raw -o=go-template='{{ `{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}"{{with index .cluster "certificate-authority-data" }}{{.}}{{end}}"{{ end }}{{ end }}` }}') +CLUSTER_SERVER=$(kubectl config view --raw -o=go-template='{{ `{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}{{ .cluster.server }}{{end}}{{ end }}` }}') + +export -p USER_TOKEN_VALUE CURRENT_CONTEXT CURRENT_CLUSTER CLUSTER_CA CLUSTER_SERVER CLUSTER_NAME +``` + +- Create a kubeconfig file + +```console +cat << EOF > $CLUSTER_NAME-kubeconfig +apiVersion: v1 +kind: Config +current-context: ${CLUSTER_NAME} +contexts: +- name: ${CLUSTER_NAME} + context: + cluster: ${CLUSTER_NAME} + user: codefresh-runtime-user + namespace: ${NAMESPACE} +clusters: +- name: ${CLUSTER_NAME} + cluster: + certificate-authority-data: ${CLUSTER_CA} + server: ${CLUSTER_SERVER} +users: +- name: ${CLUSTER_NAME} + user: + token: ${USER_TOKEN_VALUE} +EOF +``` + +- **Switch context to On-Premises control-plane cluster**. Create k8s secret (via any tool like [ESO](https://external-secrets.io/v0.4.4/), `kubectl`, etc ) containing runtime cluster's `KUBECONFG` created in previous step. + +```shell +NAMESPACE=codefresh +kubectl create secret generic dind-runtime-clusters --from-file=$CLUSTER_NAME=$CLUSTER_NAME-kubeconfig -n $NAMESPACE +``` + +- Mount secret containing runtime cluster's `KUBECONFG` into cf-api in On-Premises control-plane cluster + +> `values.yaml` for [Codefresh On-Premises](https://artifacthub.io/packages/helm/codefresh-onprem/codefresh) helm chart +```yaml +cf-api: + ... + volumes: + dind-clusters: + enabled: true + type: secret + nameOverride: dind-runtime-clusters + optional: true +``` +> volumeMount `/etc/kubeconfig` is already configured in cf-api Helm chart template. No need to specify it. + +- Set the following values for Runner helm chart + +> `values.yaml` for [Codefresh Runner](https://artifacthub.io/packages/helm/codefresh-runner/cf-runtime) helm chart + +`.Values.global.codefreshHost=...` \ +`.Values.global.codefreshToken=...` \ +`.Values.global.runtimeName=system/...` \ +`.Values.runtime.agent=false` \ +`.Values.runtime.inCluster=false` + +**Important!** +`.Values.global.name` ("system/" prefix is ignored!) should match the cluster name (key in `dind-runtime-clusters` secret created previously) +```yaml +global: + # -- URL of Codefresh On-Premises Platform + codefreshHost: "https://myonprem.somedomain.com" + # -- User token in plain text with Admin permission scope + codefreshToken: "" + # -- User token that references an existing secret containing API key. + codefreshTokenSecretKeyRef: {} + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Distinguished runtime name + # (for On-Premise only; mandatory!) Must be prefixed with "system/..." + name: "system/prod-ue1-some-cluster-name" + +# -- Set runtime parameters +runtime: + # -- (for On-Premise only; mandatory!) Disable agent + agent: false + # -- (for On-Premise only; optional) Set inCluster runtime (default: `true`) + # `inCluster=true` flag is set when Runtime and On-Premises control-plane are run on the same cluster + # `inCluster=false` flag is set when Runtime and On-Premises control-plane are on different clusters + inCluster: false + # -- (for On-Premise only; optional) Assign accounts to runtime (list of account ids; default is empty) + # Accounts can be assigned to the runtime in Codefresh UI later so you can kepp it empty. + accounts: [] + # -- (optional) Set parent runtime to inherit. + runtimeExtends: [] +``` + +- Install the chart + +```console +helm upgrade --install cf-runtime oci://quay.io/codefresh/cf-runtime -f values.yaml --create-namespace --namespace cf-runtime +``` + +- Verify the runtime and run test pipeline + +Go to [https:///admin/runtime-environments/system](https:///admin/runtime-environments/system) to see the runtime. Assign it to the required account(s). + +{{ template "chart.requirementsSection" . }} + +{{ template "chart.valuesSection" . }} + diff --git a/charts/codefresh/cf-runtime/6.3.61/files/cleanup-runtime.sh b/charts/codefresh/cf-runtime/6.3.61/files/cleanup-runtime.sh new file mode 100644 index 000000000..c1fc5f368 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/files/cleanup-runtime.sh @@ -0,0 +1,37 @@ +#!/bin/bash + +echo "-----" +echo "API_HOST: ${API_HOST}" +echo "AGENT_NAME: ${AGENT_NAME}" +echo "RUNTIME_NAME: ${RUNTIME_NAME}" +echo "AGENT: ${AGENT}" +echo "AGENT_SECRET_NAME: ${AGENT_SECRET_NAME}" +echo "DIND_SECRET_NAME: ${DIND_SECRET_NAME}" +echo "-----" + +auth() { + codefresh auth create-context --api-key ${API_TOKEN} --url ${API_HOST} +} + +remove_runtime() { + if [ "$AGENT" == "true" ]; then + codefresh delete re ${RUNTIME_NAME} || true + else + codefresh delete sys-re ${RUNTIME_NAME} || true + fi +} + +remove_agent() { + codefresh delete agent ${AGENT_NAME} || true +} + +remove_secrets() { + kubectl patch secret $(kubectl get secret -l codefresh.io/internal=true | awk 'NR>1{print $1}' | xargs) -p '{"metadata":{"finalizers":null}}' --type=merge || true + kubectl delete secret $AGENT_SECRET_NAME || true + kubectl delete secret $DIND_SECRET_NAME || true +} + +auth +remove_runtime +remove_agent +remove_secrets \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/files/configure-dind-certs.sh b/charts/codefresh/cf-runtime/6.3.61/files/configure-dind-certs.sh new file mode 100644 index 000000000..a1092eb1e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/files/configure-dind-certs.sh @@ -0,0 +1,132 @@ +#!/usr/bin/env bash +# + +#--- +fatal() { + echo "ERROR: $1" + exit 1 +} + +msg() { echo -e "\e[32mINFO ---> $1\e[0m"; } +err() { echo -e "\e[31mERR ---> $1\e[0m" ; return 1; } + +exit_trap () { + local lc="$BASH_COMMAND" rc=$? + if [ $rc != 0 ]; then + if [[ -n "$SLEEP_ON_ERROR" ]]; then + echo -e "\nSLEEP_ON_ERROR is set - Sleeping to fix error" + sleep $SLEEP_ON_ERROR + fi + fi +} +trap exit_trap EXIT + +usage() { + echo "Usage: + $0 [-n | --namespace] [--server-cert-cn] [--server-cert-extra-sans] codefresh-api-host codefresh-api-token + +Example: + $0 -n workflow https://g.codefresh.io 21341234.423141234.412431234 + +" +} + +# Args +while [[ $1 =~ ^(-(n|h)|--(namespace|server-cert-cn|server-cert-extra-sans|help)) ]] +do + key=$1 + value=$2 + + case $key in + -h|--help) + usage + exit + ;; + -n|--namespace) + NAMESPACE="$value" + shift + ;; + --server-cert-cn) + SERVER_CERT_CN="$value" + shift + ;; + --server-cert-extra-sans) + SERVER_CERT_EXTRA_SANS="$value" + shift + ;; + esac + shift # past argument or value +done + +API_HOST=${1:-"$CF_API_HOST"} +API_TOKEN=${2:-"$CF_API_TOKEN"} + +[[ -z "$API_HOST" ]] && usage && fatal "Missing API_HOST" +[[ -z "$API_TOKEN" ]] && usage && fatal "Missing token" + + +API_SIGN_PATH=${API_SIGN_PATH:-"api/custom_clusters/signServerCerts"} + +NAMESPACE=${NAMESPACE:-default} +RELEASE=${RELEASE:-cf-runtime} + +DIR=$(dirname $0) +TMPDIR=/tmp/codefresh/ + +TMP_CERTS_FILE_ZIP=$TMPDIR/cf-certs.zip +TMP_CERTS_HEADERS_FILE=$TMPDIR/cf-certs-response-headers.txt +CERTS_DIR=$TMPDIR/ssl +SRV_TLS_CA_CERT=${CERTS_DIR}/ca.pem +SRV_TLS_KEY=${CERTS_DIR}/server-key.pem +SRV_TLS_CSR=${CERTS_DIR}/server-cert.csr +SRV_TLS_CERT=${CERTS_DIR}/server-cert.pem +CF_SRV_TLS_CERT=${CERTS_DIR}/cf-server-cert.pem +CF_SRV_TLS_CA_CERT=${CERTS_DIR}/cf-ca.pem +mkdir -p $TMPDIR $CERTS_DIR + +K8S_CERT_SECRET_NAME=codefresh-certs-server +echo -e "\n------------------\nGenerating server tls certificates ... " + +SERVER_CERT_CN=${SERVER_CERT_CN:-"docker.codefresh.io"} +SERVER_CERT_EXTRA_SANS="${SERVER_CERT_EXTRA_SANS}" +### + + openssl genrsa -out $SRV_TLS_KEY 4096 || fatal "Failed to generate openssl key " + openssl req -subj "/CN=${SERVER_CERT_CN}" -new -key $SRV_TLS_KEY -out $SRV_TLS_CSR || fatal "Failed to generate openssl csr " + GENERATE_CERTS=true + CSR=$(sed ':a;N;$!ba;s/\n/\\n/g' ${SRV_TLS_CSR}) + + SERVER_CERT_SANS="IP:127.0.0.1,DNS:dind,DNS:*.dind.${NAMESPACE},DNS:*.dind.${NAMESPACE}.svc${KUBE_DOMAIN},DNS:*.cf-cd.com,DNS:*.codefresh.io" + if [[ -n "${SERVER_CERT_EXTRA_SANS}" ]]; then + SERVER_CERT_SANS=${SERVER_CERT_SANS},${SERVER_CERT_EXTRA_SANS} + fi + echo "{\"reqSubjectAltName\": \"${SERVER_CERT_SANS}\", \"csr\": \"${CSR}\" }" > ${TMPDIR}/sign_req.json + + rm -fv ${TMP_CERTS_HEADERS_FILE} ${TMP_CERTS_FILE_ZIP} + + SIGN_STATUS=$(curl -k -sSL -d @${TMPDIR}/sign_req.json -H "Content-Type: application/json" -H "Authorization: ${API_TOKEN}" -H "Expect: " \ + -o ${TMP_CERTS_FILE_ZIP} -D ${TMP_CERTS_HEADERS_FILE} -w '%{http_code}' ${API_HOST}/${API_SIGN_PATH} ) + + echo "Sign request completed with HTTP_STATUS_CODE=$SIGN_STATUS" + if [[ $SIGN_STATUS != 200 ]]; then + echo "ERROR: Cannot sign certificates" + if [[ -f ${TMP_CERTS_FILE_ZIP} ]]; then + mv ${TMP_CERTS_FILE_ZIP} ${TMP_CERTS_FILE_ZIP}.error + cat ${TMP_CERTS_FILE_ZIP}.error + fi + exit 1 + fi + unzip -o -d ${CERTS_DIR}/ ${TMP_CERTS_FILE_ZIP} || fatal "Failed to unzip certificates to ${CERTS_DIR} " + cp -v ${CF_SRV_TLS_CA_CERT} $SRV_TLS_CA_CERT || fatal "received ${TMP_CERTS_FILE_ZIP} does not contains ca.pem" + cp -v ${CF_SRV_TLS_CERT} $SRV_TLS_CERT || fatal "received ${TMP_CERTS_FILE_ZIP} does not contains cf-server-cert.pem" + + +echo -e "\n------------------\nCreating certificate secret " + +kubectl -n $NAMESPACE create secret generic $K8S_CERT_SECRET_NAME \ + --from-file=$SRV_TLS_CA_CERT \ + --from-file=$SRV_TLS_KEY \ + --from-file=$SRV_TLS_CERT \ + --dry-run=client -o yaml | kubectl apply --overwrite -f - +kubectl -n $NAMESPACE label --overwrite secret ${K8S_CERT_SECRET_NAME} codefresh.io/internal=true +kubectl -n $NAMESPACE patch secret $K8S_CERT_SECRET_NAME -p '{"metadata": {"finalizers": ["kubernetes"]}}' diff --git a/charts/codefresh/cf-runtime/6.3.61/files/init-runtime.sh b/charts/codefresh/cf-runtime/6.3.61/files/init-runtime.sh new file mode 100644 index 000000000..eb3488af1 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/files/init-runtime.sh @@ -0,0 +1,80 @@ +#!/bin/bash + +echo "-----" +echo "API_HOST: ${API_HOST}" +echo "AGENT_NAME: ${AGENT_NAME}" +echo "KUBE_CONTEXT: ${KUBE_CONTEXT}" +echo "KUBE_NAMESPACE: ${KUBE_NAMESPACE}" +echo "OWNER_NAME: ${OWNER_NAME}" +echo "RUNTIME_NAME: ${RUNTIME_NAME}" +echo "SECRET_NAME: ${SECRET_NAME}" +echo "-----" + +create_agent_secret() { + + kubectl apply -f - < $1\e[0m"; } +err() { echo -e "\e[31mERR ---> $1\e[0m" ; return 1; } + + +if [ -z "${USER_CODEFRESH_TOKEN}" ]; then + err "missing codefresh user token. must supply \".global.codefreshToken\" if agent-codefresh-token does not exist" + exit 1 +fi + +codefresh auth create-context --api-key ${USER_CODEFRESH_TOKEN} --url ${API_HOST} + +while true; do + msg "Reconciling ${RUNTIME_NAME} runtime" + + sleep $RECONCILE_INTERVAL + + codefresh get re \ + --name ${RUNTIME_NAME} \ + -o yaml \ + | yq 'del(.version, .metadata.changedBy, .metadata.creationTime)' > /tmp/runtime.yaml + + kubectl get cm ${CONFIGMAP_NAME} -n ${KUBE_NAMESPACE} -o yaml \ + | yq 'del(.metadata.resourceVersion, .metadata.uid)' \ + | yq eval '.data["runtime.yaml"] = load_str("/tmp/runtime.yaml")' \ + | kubectl apply -f - +done diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_deployment.yaml new file mode 100644 index 000000000..26f3576b7 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_deployment.yaml @@ -0,0 +1,70 @@ +{{- define "app-proxy.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "app-proxy.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "app-proxy.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "app-proxy.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + containers: + - name: app-proxy + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + env: + {{- include "app-proxy.environment-variables" . | nindent 8 }} + ports: + - name: http + containerPort: 3000 + readinessProbe: + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + httpGet: + path: /health + port: http + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_env-vars.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_env-vars.yaml new file mode 100644 index 000000000..c9b9a0e36 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_env-vars.yaml @@ -0,0 +1,19 @@ +{{- define "app-proxy.environment-variables.defaults" }} +PORT: 3000 +{{- end }} + +{{- define "app-proxy.environment-variables.calculated" }} +CODEFRESH_HOST: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} +{{- with .Values.ingress.pathPrefix }} +API_PATH_PREFIX: {{ . | quote }} +{{- end }} +{{- end }} + +{{- define "app-proxy.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "app-proxy.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "app-proxy.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_helpers.tpl b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_helpers.tpl new file mode 100644 index 000000000..2d4272ca9 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_helpers.tpl @@ -0,0 +1,43 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "app-proxy.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "app-proxy" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "app-proxy.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "app-proxy" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "app-proxy.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: app-proxy +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "app-proxy.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: app-proxy +{{- end }} + + +{{/* +Create the name of the service account to use +*/}} +{{- define "app-proxy.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "app-proxy.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_ingress.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_ingress.yaml new file mode 100644 index 000000000..d7860b363 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_ingress.yaml @@ -0,0 +1,32 @@ +{{- define "app-proxy.resources.ingress" -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: {{- include "app-proxy.labels" . | nindent 4 }} + {{- with .Values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.ingress.class (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.ingress.class }} + {{- end }} + {{- if .Values.ingress.tlsSecret }} + tls: + - hosts: + - {{ .Values.ingress.host }} + secretName: {{ .Values.tlsSecret }} + {{- end }} + rules: + - host: {{ .Values.ingress.host }} + http: + paths: + - path: {{ .Values.ingress.pathPrefix | default "/" }} + pathType: ImplementationSpecific + backend: + service: + name: {{ include "app-proxy.fullname" . }} + port: + number: 80 +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_rbac.yaml new file mode 100644 index 000000000..87bd869ba --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_rbac.yaml @@ -0,0 +1,47 @@ +{{- define "app-proxy.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "app-proxy.serviceAccountName" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: {{ .Values.rbac.namespaced | ternary "Role" "ClusterRole" }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "get" ] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: {{ .Values.rbac.namespaced | ternary "RoleBinding" "ClusterRoleBinding" }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "app-proxy.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "app-proxy.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_service.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_service.yaml new file mode 100644 index 000000000..4c3a93bf2 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/app-proxy/_service.yaml @@ -0,0 +1,17 @@ +{{- define "app-proxy.resources.service" -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "app-proxy.fullname" . }} + labels: + {{- include "app-proxy.labels" . | nindent 4 }} +spec: + type: ClusterIP + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 3000 + selector: + {{- include "app-proxy.selectorLabels" . | nindent 4 }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_deployment.yaml new file mode 100644 index 000000000..62588b4d3 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_deployment.yaml @@ -0,0 +1,62 @@ +{{- define "event-exporter.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "event-exporter.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "event-exporter.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "event-exporter.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + containers: + - name: event-exporter + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + args: [--running-in-cluster=true] + env: + {{- include "event-exporter.environment-variables" . | nindent 8 }} + ports: + - name: metrics + containerPort: 9102 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_env-vars.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_env-vars.yaml new file mode 100644 index 000000000..d28d0776f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_env-vars.yaml @@ -0,0 +1,14 @@ +{{- define "event-exporter.environment-variables.defaults" }} +{{- end }} + +{{- define "event-exporter.environment-variables.calculated" }} +{{- end }} + +{{- define "event-exporter.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "event-exporter.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "event-exporter.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_helpers.tpl b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_helpers.tpl new file mode 100644 index 000000000..5b8b5eff7 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_helpers.tpl @@ -0,0 +1,43 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "event-exporter.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "event-exporter" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "event-exporter.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "event-exporter" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "event-exporter.labels" -}} +{{ include "cf-runtime.labels" . }} +app: event-exporter +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "event-exporter.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +app: event-exporter +{{- end }} + + +{{/* +Create the name of the service account to use +*/}} +{{- define "event-exporter.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "event-exporter.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_rbac.yaml new file mode 100644 index 000000000..69d7b6b2f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_rbac.yaml @@ -0,0 +1,47 @@ +{{- define "event-exporter.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "event-exporter.serviceAccountName" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +rules: + - apiGroups: [""] + resources: [events] + verbs: [get, list, watch] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "event-exporter.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "event-exporter.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_service.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_service.yaml new file mode 100644 index 000000000..6fa29ec1a --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_service.yaml @@ -0,0 +1,17 @@ +{{- define "event-exporter.resources.service" -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +spec: + type: ClusterIP + ports: + - name: metrics + port: 9102 + targetPort: metrics + protocol: TCP + selector: + {{- include "event-exporter.selectorLabels" . | nindent 4 }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_serviceMontor.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_serviceMontor.yaml new file mode 100644 index 000000000..6092443f0 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/event-exporter/_serviceMontor.yaml @@ -0,0 +1,14 @@ +{{- define "event-exporter.resources.serviceMonitor" -}} +apiVersion: monitoring.coreos.com/v1 +kind: ServiceMonitor +metadata: + name: {{ include "event-exporter.fullname" . }} + labels: + {{- include "event-exporter.labels" . | nindent 4 }} +spec: + endpoints: + - port: metrics + selector: + matchLabels: + {{- include "event-exporter.selectorLabels" . | nindent 6 }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_deployment.yaml new file mode 100644 index 000000000..7efa6557b --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_deployment.yaml @@ -0,0 +1,70 @@ +{{- define "monitor.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "monitor.fullname" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "monitor.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "monitor.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "monitor.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + containers: + - name: monitor + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + env: + {{- include "monitor.environment-variables" . | nindent 8 }} + ports: + - name: http + containerPort: 9020 + readinessProbe: + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + httpGet: + path: /api/ping + port: 9020 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_env-vars.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_env-vars.yaml new file mode 100644 index 000000000..f58c7fa25 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_env-vars.yaml @@ -0,0 +1,26 @@ +{{- define "monitor.environment-variables.defaults" }} +SERVICE_NAME: {{ include "monitor.fullname" . }} +PORT: 9020 +HELM3: true +NODE_OPTIONS: "--max_old_space_size=4096" +{{- end }} + +{{- define "monitor.environment-variables.calculated" }} +API_TOKEN: {{ include "runtime.installation-token-env-var-value" . | nindent 2 }} +CLUSTER_ID: {{ include "runtime.runtime-environment-spec.context-name" . }} +API_URL: {{ include "runtime.runtime-environment-spec.codefresh-host" . }}/api/k8s-monitor/events +ACCOUNT_ID: {{ .Values.global.accountId }} +NAMESPACE: {{ .Release.Namespace }} +{{- if .Values.rbac.namespaced }} +ROLE_BINDING: true +{{- end }} +{{- end }} + +{{- define "monitor.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "monitor.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "monitor.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_helpers.tpl b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_helpers.tpl new file mode 100644 index 000000000..71cc1c027 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_helpers.tpl @@ -0,0 +1,42 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "monitor.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "monitor" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "monitor.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "monitor" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "monitor.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: monitor +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "monitor.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: monitor +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "monitor.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "monitor.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_rbac.yaml new file mode 100644 index 000000000..88204796a --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_rbac.yaml @@ -0,0 +1,56 @@ +{{- define "monitor.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "monitor.serviceAccountName" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: {{ .Values.rbac.namespaced | ternary "Role" "ClusterRole" }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "monitor.fullname" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "*" ] + verbs: [ "get", "list", "watch", "create", "delete" ] + - apiGroups: [ "" ] + resources: [ "pods" ] + verbs: [ "get", "list", "watch", "create", "deletecollection" ] + - apiGroups: [ "extensions" ] + resources: [ "*" ] + verbs: [ "get", "list", "watch" ] + - apiGroups: [ "apps" ] + resources: [ "*" ] + verbs: [ "get", "list", "watch" ] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: {{ .Values.rbac.namespaced | ternary "RoleBinding" "ClusterRoleBinding" }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "monitor.fullname" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "monitor.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: {{ .Values.rbac.namespaced | ternary "Role" "ClusterRole" }} + name: {{ include "monitor.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_service.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_service.yaml new file mode 100644 index 000000000..f6ae9bb0f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/monitor/_service.yaml @@ -0,0 +1,17 @@ +{{- define "monitor.resources.service" -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "monitor.fullname" . }} + labels: + {{- include "monitor.labels" . | nindent 4 }} +spec: + type: ClusterIP + ports: + - name: http + port: 80 + protocol: TCP + targetPort: 9020 + selector: + {{- include "monitor.selectorLabels" . | nindent 4 }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_deployment.yaml new file mode 100644 index 000000000..e1fb9439a --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_deployment.yaml @@ -0,0 +1,103 @@ +{{- define "runner.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "runner.fullname" . }} + labels: + {{- include "runner.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "runner.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "runner.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "runner.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + initContainers: + - name: init + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.init.image "context" .) }} + imagePullPolicy: {{ .Values.init.image.pullPolicy | default "IfNotPresent" }} + command: + - /bin/bash + args: + - -ec + - | {{ .Files.Get "files/init-runtime.sh" | nindent 10 }} + env: + {{- include "runner-init.environment-variables" . | nindent 8 }} + {{- with .Values.init.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + containers: + - name: runner + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "IfNotPresent" }} + env: + {{- include "runner.environment-variables" . | nindent 8 }} + ports: + - name: http + containerPort: 8080 + readinessProbe: + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds }} + periodSeconds: {{ .Values.readinessProbe.periodSeconds }} + timeoutSeconds: {{ .Values.readinessProbe.timeoutSeconds }} + successThreshold: {{ .Values.readinessProbe.successThreshold }} + failureThreshold: {{ .Values.readinessProbe.failureThreshold }} + httpGet: + path: /health + port: http + {{- with .Values.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- with .Values.extraVolumeMounts }} + volumeMounts: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.sidecar.enabled }} + - name: reconcile-runtime + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.sidecar.image "context" .) }} + imagePullPolicy: {{ .Values.sidecar.image.pullPolicy | default "IfNotPresent" }} + command: + - /bin/bash + args: + - -ec + - | {{ .Files.Get "files/reconcile-runtime.sh" | nindent 10 }} + env: + {{- include "runner-sidecar.environment-variables" . | nindent 8 }} + {{- with .Values.sidecar.resources }} + resources: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + {{- with .Values.extraVolumes }} + volumes: + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_helpers.tpl b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_helpers.tpl new file mode 100644 index 000000000..2608cb67e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_helpers.tpl @@ -0,0 +1,42 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "runner.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "runner" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "runner.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "runner" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "runner.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: runner +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "runner.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: runner +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "runner.serviceAccountName" -}} + {{- if .Values.serviceAccount.create }} + {{- default (include "runner.fullname" .) .Values.serviceAccount.name }} + {{- else }} + {{- default "default" .Values.serviceAccount.name }} + {{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_rbac.yaml new file mode 100644 index 000000000..d95b958d5 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/_rbac.yaml @@ -0,0 +1,53 @@ +{{- define "runner.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "runner.serviceAccountName" . }} + labels: + {{- include "runner.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "runner.fullname" . }} + labels: + {{- include "runner.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "pods", "persistentvolumeclaims" ] + verbs: [ "get", "create", "delete", patch ] + - apiGroups: [ "" ] + resources: [ "configmaps", "secrets" ] + verbs: [ "get", "create", "update", patch ] + - apiGroups: [ "apps" ] + resources: [ "deployments" ] + verbs: [ "get" ] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "runner.fullname" . }} + labels: + {{- include "runner.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "runner.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: Role + name: {{ include "runner.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_init-container.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_init-container.yaml new file mode 100644 index 000000000..6dda110f7 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_init-container.yaml @@ -0,0 +1,30 @@ +{{- define "runner-init.environment-variables.defaults" }} +HOME: /tmp +{{- end }} + +{{- define "runner-init.environment-variables.calculated" }} +AGENT_NAME: {{ include "runtime.runtime-environment-spec.agent-name" . }} +API_HOST: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} +AGENT_CODEFRESH_TOKEN: + valueFrom: + secretKeyRef: + name: {{ include "runner.fullname" . }} + key: agent-codefresh-token + optional: true +EXISTING_AGENT_CODEFRESH_TOKEN: {{ include "runtime.agent-token-env-var-value" . | nindent 2 }} +KUBE_CONTEXT: {{ include "runtime.runtime-environment-spec.context-name" . }} +KUBE_NAMESPACE: {{ .Release.Namespace }} +OWNER_NAME: {{ include "runner.fullname" . }} +RUNTIME_NAME: {{ include "runtime.runtime-environment-spec.runtime-name" . }} +SECRET_NAME: {{ include "runner.fullname" . }} +USER_CODEFRESH_TOKEN: {{ include "runtime.installation-token-env-var-value" . | nindent 2 }} +{{- end }} + +{{- define "runner-init.environment-variables" }} + {{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} + {{- $defaults := (include "runner-init.environment-variables.defaults" . | fromYaml) }} + {{- $calculated := (include "runner-init.environment-variables.calculated" . | fromYaml) }} + {{- $overrides := .Values.env }} + {{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_main-container.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_main-container.yaml new file mode 100644 index 000000000..4d3f0304e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_main-container.yaml @@ -0,0 +1,28 @@ +{{- define "runner.environment-variables.defaults" }} +AGENT_MODE: InCluster +SELF_DEPLOYMENT_NAME: + valueFrom: + fieldRef: + fieldPath: metadata.name +{{- end }} + +{{- define "runner.environment-variables.calculated" }} +AGENT_ID: {{ include "runtime.runtime-environment-spec.agent-name" . }} +CODEFRESH_HOST: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} +CODEFRESH_IN_CLUSTER_RUNTIME: {{ include "runtime.runtime-environment-spec.runtime-name" . }} +CODEFRESH_TOKEN: + valueFrom: + secretKeyRef: + name: {{ include "runner.fullname" . }} + key: agent-codefresh-token +DOCKER_REGISTRY: {{ .Values.global.imageRegistry }} +{{- end }} + +{{- define "runner.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "runner.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "runner.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_sidecar-container.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_sidecar-container.yaml new file mode 100644 index 000000000..3adcbe5d4 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/runner/environment-variables/_sidecar-container.yaml @@ -0,0 +1,22 @@ +{{- define "runner-sidecar.environment-variables.defaults" }} +HOME: /tmp +{{- end }} + +{{- define "runner-sidecar.environment-variables.calculated" }} +API_HOST: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} +USER_CODEFRESH_TOKEN: {{ include "runtime.installation-token-env-var-value" . | nindent 2 }} +KUBE_CONTEXT: {{ include "runtime.runtime-environment-spec.context-name" . }} +KUBE_NAMESPACE: {{ .Release.Namespace }} +OWNER_NAME: {{ include "runner.fullname" . }} +RUNTIME_NAME: {{ include "runtime.runtime-environment-spec.runtime-name" . }} +CONFIGMAP_NAME: {{ printf "%s-%s" (include "runtime.fullname" .) "spec" }} +{{- end }} + +{{- define "runner-sidecar.environment-variables" }} + {{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} + {{- $defaults := (include "runner-sidecar.environment-variables.defaults" . | fromYaml) }} + {{- $calculated := (include "runner-sidecar.environment-variables.calculated" . | fromYaml) }} + {{- $overrides := .Values.sidecar.env }} + {{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_cronjob.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_cronjob.yaml new file mode 100644 index 000000000..20bd2d56e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_cronjob.yaml @@ -0,0 +1,58 @@ +{{- define "dind-volume-provisioner.resources.cronjob" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- if not (eq .Values.storage.backend "local") }} +apiVersion: batch/v1 +kind: CronJob +metadata: + name: {{ include "dind-volume-cleanup.fullname" . }} + labels: + {{- include "dind-volume-cleanup.labels" . | nindent 4 }} +spec: + concurrencyPolicy: {{ .Values.concurrencyPolicy }} + schedule: {{ .Values.schedule | quote }} + successfulJobsHistoryLimit: {{ .Values.successfulJobsHistory }} + failedJobsHistoryLimit: {{ .Values.failedJobsHistory }} + {{- with .Values.suspend }} + suspend: {{ . }} + {{- end }} + jobTemplate: + spec: + template: + metadata: + labels: + {{- include "dind-volume-cleanup.selectorLabels" . | nindent 12 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 12 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 10 }} + serviceAccountName: {{ include "dind-volume-provisioner.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 12 }} + {{- end }} + restartPolicy: {{ .Values.restartPolicy | default "Never" }} + containers: + - name: dind-volume-cleanup + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + env: + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" .Values.env "context" .) | nindent 12 }} + - name: PROVISIONED_BY + value: {{ include "dind-volume-provisioner.volumeProvisionerName" . }} + resources: + {{- toYaml .Values.resources | nindent 14 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 10 }} + {{- end }} + {{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_daemonset.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_daemonset.yaml new file mode 100644 index 000000000..cb463231d --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_daemonset.yaml @@ -0,0 +1,98 @@ +{{- define "dind-volume-provisioner.resources.daemonset" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $localVolumeParentDir := .Values.storage.local.volumeParentDir }} +{{- if eq .Values.storage.backend "local" }} +--- +apiVersion: apps/v1 +kind: DaemonSet +metadata: + name: {{ include "dind-lv-monitor.fullname" . }} + labels: + {{- include "dind-lv-monitor.labels" . | nindent 4 }} +spec: + selector: + matchLabels: + {{- include "dind-lv-monitor.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "dind-lv-monitor.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "dind-volume-provisioner.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + {{- if .Values.volumePermissions.enabled }} + initContainers: + - name: volume-permissions + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.volumePermissions.image "context" .) }} + imagePullPolicy: {{ .Values.volumePermissions.image.pullPolicy | default "Always" }} + command: + - /bin/sh + args: + - -ec + - | + chown -R {{ .Values.podSecurityContext.runAsUser }}:{{ .Values.podSecurityContext.fsGroup }} {{ $localVolumeParentDir }} + volumeMounts: + - mountPath: {{ $localVolumeParentDir }} + name: dind-volume-dir + {{- if eq ( toString ( .Values.volumePermissions.securityContext.runAsUser )) "auto" }} + securityContext: {{- omit .Values.volumePermissions.securityContext "runAsUser" | toYaml | nindent 10 }} + {{- else }} + securityContext: {{- .Values.volumePermissions.securityContext | toYaml | nindent 10 }} + {{- end }} + resources: + {{- toYaml .Values.volumePermissions.resources | nindent 10 }} + {{- end }} + containers: + - name: dind-lv-monitor + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + {{- if .Values.containerSecurityContext.enabled }} + securityContext: {{- omit .Values.containerSecurityContext "enabled" | toYaml | nindent 10 }} + {{- end }} + command: + - /home/dind-volume-utils/bin/local-volumes-agent + env: + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" .Values.env "context" .) | nindent 10 }} + - name: NODE_NAME + valueFrom: + fieldRef: + fieldPath: spec.nodeName + - name: VOLUME_PARENT_DIR + value: {{ $localVolumeParentDir }} + resources: + {{- toYaml .Values.resources | nindent 10 }} + volumeMounts: + - mountPath: {{ $localVolumeParentDir }} + readOnly: false + name: dind-volume-dir + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + - name: dind-volume-dir + hostPath: + path: {{ $localVolumeParentDir }} + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_deployment.yaml new file mode 100644 index 000000000..9252b4520 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_deployment.yaml @@ -0,0 +1,67 @@ +{{- define "dind-volume-provisioner.resources.deployment" -}} +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "dind-volume-provisioner.fullname" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicasCount }} + strategy: + type: {{ .Values.updateStrategy.type }} + selector: + matchLabels: + {{- include "dind-volume-provisioner.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "dind-volume-provisioner.selectorLabels" . | nindent 8 }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- include (printf "%s.image.pullSecrets" $cfCommonTplSemver ) . | nindent 8 }} + serviceAccountName: {{ include "dind-volume-provisioner.serviceAccountName" . }} + {{- if .Values.podSecurityContext.enabled }} + securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }} + {{- end }} + containers: + - name: dind-volume-provisioner + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" .Values.image "context" .) }} + imagePullPolicy: {{ .Values.image.pullPolicy | default "Always" }} + command: + - /usr/local/bin/dind-volume-provisioner + - -v=4 + - --resync-period=50s + env: + {{- include "dind-volume-provisioner.environment-variables" . | nindent 8 }} + ports: + - name: http + containerPort: 8080 + resources: + {{- toYaml .Values.resources | nindent 12 }} + volumeMounts: + {{- include "dind-volume-provisioner.volumeMounts.calculated" . | nindent 8 }} + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + volumes: + {{- include "dind-volume-provisioner.volumes.calculated" . | nindent 6 }} + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 6 }} + {{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_env-vars.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_env-vars.yaml new file mode 100644 index 000000000..e1f5dfe60 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_env-vars.yaml @@ -0,0 +1,88 @@ +{{- define "dind-volume-provisioner.environment-variables.defaults" }} +{{- end }} + +{{- define "dind-volume-provisioner.environment-variables.calculated" }} +DOCKER_REGISTRY: {{ .Values.global.imageRegistry }} +PROVISIONER_NAME: {{ include "dind-volume-provisioner.volumeProvisionerName" . }} + +{{- if or .Values.storage.ebs.accessKeyId .Values.storage.ebs.accessKeyIdSecretKeyRef }} +AWS_ACCESS_KEY_ID: + {{- if .Values.storage.ebs.accessKeyId }} + valueFrom: + secretKeyRef: + name: {{ include "dind-volume-provisioner.fullname" . }} + key: aws_access_key_id + {{- else if .Values.storage.ebs.accessKeyIdSecretKeyRef }} + valueFrom: + secretKeyRef: + {{- .Values.storage.ebs.accessKeyIdSecretKeyRef | toYaml | nindent 6 }} + {{- end }} +{{- end }} + +{{- if or .Values.storage.ebs.secretAccessKey .Values.storage.ebs.secretAccessKeySecretKeyRef }} +AWS_SECRET_ACCESS_KEY: + {{- if .Values.storage.ebs.secretAccessKey }} + valueFrom: + secretKeyRef: + name: {{ include "dind-volume-provisioner.fullname" . }} + key: aws_secret_access_key + {{- else if .Values.storage.ebs.secretAccessKeySecretKeyRef }} + valueFrom: + secretKeyRef: + {{- .Values.storage.ebs.secretAccessKeySecretKeyRef | toYaml | nindent 6 }} + {{- end }} +{{- end }} + +{{- if or .Values.storage.gcedisk.serviceAccountJson .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef }} +GOOGLE_APPLICATION_CREDENTIALS: {{ printf "/etc/dind-volume-provisioner/credentials/%s" (.Values.storage.gcedisk.serviceAccountJsonSecretKeyRef.key | default "google-service-account.json") }} +{{- end }} + +{{- if and .Values.storage.mountAzureJson }} +AZURE_CREDENTIAL_FILE: /etc/kubernetes/azure.json +CLOUDCONFIG_AZURE: /etc/kubernetes/azure.json +{{- end }} + +{{- end }} + +{{- define "dind-volume-provisioner.environment-variables" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{- $defaults := (include "dind-volume-provisioner.environment-variables.defaults" . | fromYaml) }} +{{- $calculated := (include "dind-volume-provisioner.environment-variables.calculated" . | fromYaml) }} +{{- $overrides := .Values.env }} +{{- $mergedValues := mergeOverwrite (merge $defaults $calculated) $overrides }} +{{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $mergedValues "context" .) }} +{{- end }} + + +{{- define "dind-volume-provisioner.volumes.calculated" }} + {{- if .Values.storage.gcedisk.serviceAccountJson }} +- name: credentials + secret: + secretName: {{ include "dind-volume-provisioner.fullname" . }} + optional: true + {{- else if .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef }} +- name: credentials + secret: + secretName: {{ .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef.name }} + optional: true + {{- end }} + {{- if .Values.storage.mountAzureJson }} +- name: azure-json + hostPath: + path: /etc/kubernetes/azure.json + type: File + {{- end }} +{{- end }} + +{{- define "dind-volume-provisioner.volumeMounts.calculated" }} + {{- if or .Values.storage.gcedisk.serviceAccountJson .Values.storage.gcedisk.serviceAccountJsonSecretKeyRef }} +- name: credentials + readOnly: true + mountPath: "/etc/dind-volume-provisioner/credentials" + {{- end }} + {{- if .Values.storage.mountAzureJson }} +- name: azure-json + readOnly: true + mountPath: "/etc/kubernetes/azure.json" + {{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_helpers.tpl b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_helpers.tpl new file mode 100644 index 000000000..e3d3a0d3f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_helpers.tpl @@ -0,0 +1,93 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "dind-volume-provisioner.name" -}} + {{- printf "%s-%s" (include "cf-runtime.name" .) "volume-provisioner" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "dind-volume-provisioner.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "volume-provisioner" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{- define "dind-volume-cleanup.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "volume-cleanup" | trunc 52 | trimSuffix "-" }} +{{- end }} + +{{- define "dind-lv-monitor.fullname" -}} + {{- printf "%s-%s" (include "cf-runtime.fullname" .) "lv-monitor" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Provisioner name for storage class +*/}} +{{- define "dind-volume-provisioner.volumeProvisionerName" }} + {{- printf "codefresh.io/dind-volume-provisioner-runner-%s" .Release.Namespace }} +{{- end }} + +{{/* +Common labels for dind-lv-monitor +*/}} +{{- define "dind-lv-monitor.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: lv-monitor +{{- end }} + +{{/* +Selector labels for dind-lv-monitor +*/}} +{{- define "dind-lv-monitor.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: lv-monitor +{{- end }} + +{{/* +Common labels for dind-volume-provisioner +*/}} +{{- define "dind-volume-provisioner.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: volume-provisioner +{{- end }} + +{{/* +Selector labels for dind-volume-provisioner +*/}} +{{- define "dind-volume-provisioner.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: volume-provisioner +{{- end }} + +{{/* +Common labels for dind-volume-cleanup +*/}} +{{- define "dind-volume-cleanup.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: pv-cleanup +{{- end }} + +{{/* +Common labels for dind-volume-cleanup +*/}} +{{- define "dind-volume-cleanup.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: pv-cleanup +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "dind-volume-provisioner.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "dind-volume-provisioner.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{- define "dind-volume-provisioner.storageClassName" }} +{{- printf "dind-local-volumes-runner-%s" .Release.Namespace }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_rbac.yaml new file mode 100644 index 000000000..fbcbc684f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_rbac.yaml @@ -0,0 +1,71 @@ +{{- define "dind-volume-provisioner.resources.rbac" -}} +{{- if .Values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "dind-volume-provisioner.serviceAccountName" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if .Values.rbac.create }} +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "dind-volume-provisioner.fullname" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "persistentvolumes" ] + verbs: [ "get", "list", "watch", "create", "delete", "patch" ] + - apiGroups: [ "" ] + resources: [ "persistentvolumeclaims" ] + verbs: [ "get", "list", "watch", "update", "delete" ] + - apiGroups: [ "storage.k8s.io" ] + resources: [ "storageclasses" ] + verbs: [ "get", "list", "watch" ] + - apiGroups: [ "" ] + resources: [ "events" ] + verbs: [ "list", "watch", "create", "update", "patch" ] + - apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "get", "list" ] + - apiGroups: [ "" ] + resources: [ "nodes" ] + verbs: [ "get", "list", "watch" ] + - apiGroups: [ "" ] + resources: [ "pods" ] + verbs: [ "get", "list", "watch", "create", "delete", "patch" ] + - apiGroups: [ "" ] + resources: [ "endpoints" ] + verbs: [ "get", "list", "watch", "create", "update", "delete" ] + - apiGroups: [ "coordination.k8s.io" ] + resources: [ "leases" ] + verbs: [ "get", "create", "update" ] +{{- with .Values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and .Values.serviceAccount.create .Values.rbac.create }} +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: {{ include "dind-volume-provisioner.fullname" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: {{ include "dind-volume-provisioner.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ include "dind-volume-provisioner.fullname" . }} + apiGroup: rbac.authorization.k8s.io +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_secret.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_secret.yaml new file mode 100644 index 000000000..f361a7991 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_secret.yaml @@ -0,0 +1,22 @@ +{{- define "dind-volume-provisioner.resources.secret" -}} +{{- if or .Values.storage.ebs.accessKeyId .Values.storage.ebs.secretAccessKey .Values.storage.gcedisk.serviceAccountJson }} +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ include "dind-volume-provisioner.fullname" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +stringData: + {{- with .Values.storage.gcedisk.serviceAccountJson }} + google-service-account.json: | +{{- . | nindent 4 }} + {{- end }} + {{- with .Values.storage.ebs.accessKeyId }} + aws_access_key_id: {{ . }} + {{- end }} + {{- with .Values.storage.ebs.secretAccessKey }} + aws_secret_access_key: {{ . }} + {{- end }} +{{- end }} +{{- end -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_storageclass.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_storageclass.yaml new file mode 100644 index 000000000..62e910c87 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_components/volume-provisioner/_storageclass.yaml @@ -0,0 +1,47 @@ +{{- define "dind-volume-provisioner.resources.storageclass" -}} +kind: StorageClass +apiVersion: storage.k8s.io/v1 +metadata: + {{/* has to be exactly that */}} + name: {{ include "dind-volume-provisioner.storageClassName" . }} + labels: + {{- include "dind-volume-provisioner.labels" . | nindent 4 }} +provisioner: {{ include "dind-volume-provisioner.volumeProvisionerName" . }} +parameters: +{{- if eq .Values.storage.backend "local" }} + volumeBackend: local + volumeParentDir: {{ .Values.storage.local.volumeParentDir }} +{{- else if eq .Values.storage.backend "gcedisk" }} + volumeBackend: {{ .Values.storage.backend }} + type: {{ .Values.storage.gcedisk.volumeType | default "pd-ssd" }} + zone: {{ required ".Values.storage.gcedisk.availabilityZone is required" .Values.storage.gcedisk.availabilityZone }} + fsType: {{ .Values.storage.fsType | default "ext4" }} +{{- else if or (eq .Values.storage.backend "ebs") (eq .Values.storage.backend "ebs-csi")}} + volumeBackend: {{ .Values.storage.backend }} + VolumeType: {{ .Values.storage.ebs.volumeType | default "gp3" }} + AvailabilityZone: {{ required ".Values.storage.ebs.availabilityZone is required" .Values.storage.ebs.availabilityZone }} + fsType: {{ .Values.storage.fsType | default "ext4" }} + encrypted: {{ .Values.storage.ebs.encrypted | default "false" | quote }} + {{- with .Values.storage.ebs.kmsKeyId }} + kmsKeyId: {{ . | quote }} + {{- end }} + {{- with .Values.storage.ebs.iops }} + iops: {{ . | quote }} + {{- end }} + {{- with .Values.storage.ebs.throughput }} + throughput: {{ . | quote }} + {{- end }} +{{- else if or (eq .Values.storage.backend "azuredisk") (eq .Values.storage.backend "azuredisk-csi")}} + volumeBackend: {{ .Values.storage.backend }} + kind: managed + skuName: {{ .Values.storage.azuredisk.skuName | default "Premium_LRS" }} + fsType: {{ .Values.storage.fsType | default "ext4" }} + cachingMode: {{ .Values.storage.azuredisk.cachingMode | default "None" }} + {{- with .Values.storage.azuredisk.availabilityZone }} + availabilityZone: {{ . | quote }} + {{- end }} + {{- with .Values.storage.azuredisk.resourceGroup }} + resourceGroup: {{ . | quote }} + {{- end }} +{{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/_helpers.tpl b/charts/codefresh/cf-runtime/6.3.61/templates/_helpers.tpl new file mode 100644 index 000000000..72f44e36a --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/_helpers.tpl @@ -0,0 +1,51 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "cf-runtime.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "cf-runtime.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- $name := default .Chart.Name .Values.nameOverride }} +{{- if contains $name .Release.Name }} +{{- .Release.Name | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "cf-runtime.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "cf-runtime.labels" -}} +helm.sh/chart: {{ include "cf-runtime.chart" . }} +{{ include "cf-runtime.selectorLabels" . }} +{{- if .Chart.AppVersion }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +{{- end }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "cf-runtime.selectorLabels" -}} +app.kubernetes.io/name: {{ include "cf-runtime.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/deployment.yaml new file mode 100644 index 000000000..90341b305 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/deployment.yaml @@ -0,0 +1,9 @@ +{{- $appProxyContext := deepCopy . }} +{{- $_ := set $appProxyContext "Values" (get .Values "appProxy") }} +{{- $_ := set $appProxyContext.Values "global" (get .Values "global") }} +{{- $_ := set $appProxyContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $appProxyContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $appProxyContext.Values.enabled }} +{{- include "app-proxy.resources.deployment" $appProxyContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/ingress.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/ingress.yaml new file mode 100644 index 000000000..56ab5e95e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/ingress.yaml @@ -0,0 +1,9 @@ +{{- $appProxyContext := deepCopy . }} +{{- $_ := set $appProxyContext "Values" (get .Values "appProxy") }} +{{- $_ := set $appProxyContext.Values "global" (get .Values "global") }} +{{- $_ := set $appProxyContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $appProxyContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $appProxyContext.Values.enabled }} +{{- include "app-proxy.resources.ingress" $appProxyContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/rbac.yaml new file mode 100644 index 000000000..4db87dcb4 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/rbac.yaml @@ -0,0 +1,9 @@ +{{- $appProxyContext := deepCopy . }} +{{- $_ := set $appProxyContext "Values" (get .Values "appProxy") }} +{{- $_ := set $appProxyContext.Values "global" (get .Values "global") }} +{{- $_ := set $appProxyContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $appProxyContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $appProxyContext.Values.enabled }} +{{- include "app-proxy.resources.rbac" $appProxyContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/service.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/service.yaml new file mode 100644 index 000000000..0b9d85ec0 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/app-proxy/service.yaml @@ -0,0 +1,9 @@ +{{- $appProxyContext := deepCopy . }} +{{- $_ := set $appProxyContext "Values" (get .Values "appProxy") }} +{{- $_ := set $appProxyContext.Values "global" (get .Values "global") }} +{{- $_ := set $appProxyContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $appProxyContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $appProxyContext.Values.enabled }} +{{- include "app-proxy.resources.service" $appProxyContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/deployment.yaml new file mode 100644 index 000000000..494288240 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/deployment.yaml @@ -0,0 +1,9 @@ +{{- $eventExporterContext := deepCopy . }} +{{- $_ := set $eventExporterContext "Values" (get .Values "event-exporter") }} +{{- $_ := set $eventExporterContext.Values "global" (get .Values "global") }} +{{- $_ := set $eventExporterContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $eventExporterContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $eventExporterContext.Values.enabled }} +{{- include "event-exporter.resources.deployment" $eventExporterContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/rbac.yaml new file mode 100644 index 000000000..6a9bf5c65 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/rbac.yaml @@ -0,0 +1,9 @@ +{{- $eventExporterContext := deepCopy . }} +{{- $_ := set $eventExporterContext "Values" (get .Values "event-exporter") }} +{{- $_ := set $eventExporterContext.Values "global" (get .Values "global") }} +{{- $_ := set $eventExporterContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $eventExporterContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $eventExporterContext.Values.enabled }} +{{- include "event-exporter.resources.rbac" $eventExporterContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/service.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/service.yaml new file mode 100644 index 000000000..c5d856dfe --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/event-exporter/service.yaml @@ -0,0 +1,11 @@ +{{- $eventExporterContext := deepCopy . }} +{{- $_ := set $eventExporterContext "Values" (get .Values "event-exporter") }} +{{- $_ := set $eventExporterContext.Values "global" (get .Values "global") }} +{{- $_ := set $eventExporterContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $eventExporterContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $eventExporterContext.Values.enabled }} +{{- include "event-exporter.resources.service" $eventExporterContext }} +--- +{{- include "event-exporter.resources.serviceMonitor" $eventExporterContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/extra/extra-resources.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/extra/extra-resources.yaml new file mode 100644 index 000000000..1a9777c64 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/extra/extra-resources.yaml @@ -0,0 +1,6 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} + +{{- range .Values.extraResources }} +--- +{{ include (printf "%s.tplrender" $cfCommonTplSemver) (dict "Values" . "context" $) }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/extra/runtime-images-cm.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/extra/runtime-images-cm.yaml new file mode 100644 index 000000000..f269c84b2 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/extra/runtime-images-cm.yaml @@ -0,0 +1,19 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.engine.runtimeImages }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + {{- /* dummy template just to list runtime images */}} + name: {{ include "runtime.fullname" . }}-images + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +data: + images: | + {{- range $key, $val := $values }} + image: {{ $val }} + {{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/cm-update-runtime.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/cm-update-runtime.yaml new file mode 100644 index 000000000..46a306c56 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/cm-update-runtime.yaml @@ -0,0 +1,18 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.patch }} +{{- if $values.enabled }} +--- +kind: ConfigMap +apiVersion: v1 +metadata: + name: {{ include "runtime.fullname" . }}-spec + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +data: + runtime.yaml: | + {{ include "runtime.runtime-environment-spec.template" . | nindent 4 | trim }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/job-gencerts-dind.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/job-gencerts-dind.yaml new file mode 100644 index 000000000..4a08a229c --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/job-gencerts-dind.yaml @@ -0,0 +1,68 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.gencerts }} +{{- if and $values.enabled }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-weight: "3" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with $values.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ . }} + {{- end }} + {{- with $values.backoffLimit }} + backoffLimit: {{ . | int }} + {{- end }} + template: + metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + labels: + {{- include "runtime.labels" . | nindent 8 }} + spec: + {{- if $values.rbac.enabled }} + serviceAccountName: {{ template "runtime.fullname" . }}-gencerts-dind + {{- end }} + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + containers: + - name: gencerts-dind + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $values.image "context" .) }} + imagePullPolicy: {{ $values.image.pullPolicy | default "Always" }} + command: + - "/bin/bash" + args: + - -ec + - | {{ .Files.Get "files/configure-dind-certs.sh" | nindent 10 }} + env: + - name: NAMESPACE + value: {{ .Release.Namespace }} + - name: RELEASE + value: {{ .Release.Name }} + - name: CF_API_HOST + value: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} + - name: CF_API_TOKEN + {{- include "runtime.installation-token-env-var-value" . | indent 10}} + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $values.env "context" .) | nindent 8 }} + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + restartPolicy: OnFailure +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/job-update-runtime.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/job-update-runtime.yaml new file mode 100644 index 000000000..955e882d7 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/job-update-runtime.yaml @@ -0,0 +1,77 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.patch }} +{{- if $values.enabled }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "runtime.fullname" . }}-patch + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + helm.sh/hook: post-install,post-upgrade + helm.sh/hook-weight: "5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with $values.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ . }} + {{- end }} + {{- with $values.backoffLimit }} + backoffLimit: {{ . | int }} + {{- end }} + template: + metadata: + name: {{ include "runtime.fullname" . }}-patch + labels: + {{- include "runtime.labels" . | nindent 8 }} + spec: + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + containers: + - name: patch-runtime + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $values.image "context" .) }} + imagePullPolicy: {{ $values.image.pullPolicy | default "Always" }} + command: + - "/bin/bash" + args: + - -ec + - | + codefresh auth create-context --api-key $API_KEY --url $API_HOST + cat /usr/share/extras/runtime.yaml + codefresh get re +{{- if .Values.runtime.agent }} + codefresh patch re -f /usr/share/extras/runtime.yaml +{{- else }} + codefresh patch sys-re -f /usr/share/extras/runtime.yaml +{{- end }} + env: + - name: API_KEY + {{- include "runtime.installation-token-env-var-value" . | indent 10}} + - name: API_HOST + value: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $values.env "context" .) | nindent 8 }} + volumeMounts: + - name: config + mountPath: /usr/share/extras/runtime.yaml + subPath: runtime.yaml + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + restartPolicy: OnFailure + volumes: + - name: config + configMap: + name: {{ include "runtime.fullname" . }}-spec +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/rbac-gencerts-dind.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/rbac-gencerts-dind.yaml new file mode 100644 index 000000000..4907dac38 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/post-install/rbac-gencerts-dind.yaml @@ -0,0 +1,37 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.gencerts }} +{{- if and $values.enabled }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + namespace: {{ .Release.Namespace }} +rules: + - apiGroups: + - "" + resources: + - secrets + - configmaps + verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "runtime.fullname" . }}-gencerts-dind + namespace: {{ .Release.Namespace }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "runtime.fullname" . }}-gencerts-dind +subjects: + - kind: ServiceAccount + name: {{ include "runtime.fullname" . }}-gencerts-dind + namespace: {{ .Release.Namespace }} +{{ end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/hooks/pre-delete/job-cleanup-resources.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/pre-delete/job-cleanup-resources.yaml new file mode 100644 index 000000000..0e3c7659f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/pre-delete/job-cleanup-resources.yaml @@ -0,0 +1,73 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.patch }} +{{- if and $values.enabled }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "runtime.fullname" . }}-cleanup + labels: + {{- include "runtime.labels" . | nindent 4 }} + annotations: + helm.sh/hook: pre-delete + helm.sh/hook-delete-policy: hook-succeeded,before-hook-creation + {{- with $values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with $values.ttlSecondsAfterFinished }} + ttlSecondsAfterFinished: {{ . }} + {{- end }} + {{- with $values.backoffLimit }} + backoffLimit: {{ . | int }} + {{- end }} + template: + metadata: + name: {{ include "runtime.fullname" . }}-cleanup + labels: + {{- include "runtime.labels" . | nindent 8 }} + spec: + {{- if $values.rbac.enabled }} + serviceAccountName: {{ template "runtime.fullname" . }}-cleanup + {{- end }} + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + containers: + - name: cleanup + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $values.image "context" .) }} + imagePullPolicy: {{ $values.image.pullPolicy | default "Always" }} + command: + - "/bin/bash" + args: + - -ec + - | {{ .Files.Get "files/cleanup-runtime.sh" | nindent 10 }} + env: + - name: AGENT_NAME + value: {{ include "runtime.runtime-environment-spec.agent-name" . }} + - name: RUNTIME_NAME + value: {{ include "runtime.runtime-environment-spec.runtime-name" . }} + - name: API_HOST + value: {{ include "runtime.runtime-environment-spec.codefresh-host" . }} + - name: API_TOKEN + {{- include "runtime.installation-token-env-var-value" . | indent 10}} + - name: AGENT + value: {{ .Values.runtime.agent | quote }} + - name: AGENT_SECRET_NAME + value: {{ include "runner.fullname" . }} + - name: DIND_SECRET_NAME + value: codefresh-certs-server + {{- include (printf "%s.env-vars" $cfCommonTplSemver) (dict "Values" $values.env "context" .) | nindent 8 }} + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 6 }} + {{- end }} + restartPolicy: OnFailure +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/hooks/pre-delete/rbac-cleanup-resources.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/pre-delete/rbac-cleanup-resources.yaml new file mode 100644 index 000000000..468ec2212 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/hooks/pre-delete/rbac-cleanup-resources.yaml @@ -0,0 +1,46 @@ +{{ $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version }} +{{ $values := .Values.runtime.patch }} +{{- if and $values.enabled }} +--- +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "runtime.fullname" . }}-cleanup + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: Role +metadata: + name: {{ include "runtime.fullname" . }}-cleanup + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed +rules: + - apiGroups: + - "*" + resources: + - "*" + verbs: + - "*" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: {{ include "runtime.fullname" . }}-cleanup + namespace: {{ .Release.Namespace }} + annotations: + "helm.sh/hook": pre-delete + "helm.sh/hook-delete-policy": hook-succeeded,before-hook-creation,hook-failed +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: {{ include "runtime.fullname" . }}-cleanup +subjects: + - kind: ServiceAccount + name: {{ include "runtime.fullname" . }}-cleanup + namespace: {{ .Release.Namespace }} +{{ end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/monitor/deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/monitor/deployment.yaml new file mode 100644 index 000000000..00c9fb2f9 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/monitor/deployment.yaml @@ -0,0 +1,9 @@ +{{- $monitorContext := deepCopy . }} +{{- $_ := set $monitorContext "Values" (get .Values "monitor") }} +{{- $_ := set $monitorContext.Values "global" (get .Values "global") }} +{{- $_ := set $monitorContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $monitorContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $monitorContext.Values.enabled }} +{{- include "monitor.resources.deployment" $monitorContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/monitor/rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/monitor/rbac.yaml new file mode 100644 index 000000000..f9812d565 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/monitor/rbac.yaml @@ -0,0 +1,9 @@ +{{- $monitorContext := deepCopy . }} +{{- $_ := set $monitorContext "Values" (get .Values "monitor") }} +{{- $_ := set $monitorContext.Values "global" (get .Values "global") }} +{{- $_ := set $monitorContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $monitorContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $monitorContext.Values.enabled }} +{{- include "monitor.resources.rbac" $monitorContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/monitor/service.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/monitor/service.yaml new file mode 100644 index 000000000..f99706614 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/monitor/service.yaml @@ -0,0 +1,9 @@ +{{- $monitorContext := deepCopy . }} +{{- $_ := set $monitorContext "Values" (get .Values "monitor") }} +{{- $_ := set $monitorContext.Values "global" (get .Values "global") }} +{{- $_ := set $monitorContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $monitorContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $monitorContext.Values.enabled }} +{{- include "monitor.resources.service" $monitorContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/other/external-secrets.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/other/external-secrets.yaml new file mode 100644 index 000000000..dc24e24e5 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/other/external-secrets.yaml @@ -0,0 +1,2 @@ +{{ $templateName := printf "cf-common-%s.external-secrets" (index .Subcharts "cf-common").Chart.Version }} +{{- include $templateName . -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/other/podMonitor.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/other/podMonitor.yaml new file mode 100644 index 000000000..4319b722b --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/other/podMonitor.yaml @@ -0,0 +1,2 @@ +{{ $templateName := printf "cf-common-%s.podMonitor" (index .Subcharts "cf-common").Chart.Version }} +{{- include $templateName . -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/other/serviceMonitor.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/other/serviceMonitor.yaml new file mode 100644 index 000000000..29f890fe2 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/other/serviceMonitor.yaml @@ -0,0 +1,2 @@ +{{ $templateName := printf "cf-common-%s.serviceMonitor" (index .Subcharts "cf-common").Chart.Version }} +{{- include $templateName . -}} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/runner/deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/runner/deployment.yaml new file mode 100644 index 000000000..85777c487 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/runner/deployment.yaml @@ -0,0 +1,9 @@ +{{- $runnerContext := deepCopy . }} +{{- $_ := set $runnerContext "Values" (get .Values "runner") }} +{{- $_ := set $runnerContext.Values "global" (get .Values "global") }} +{{- $_ := set $runnerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $runnerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $runnerContext.Values.enabled .Values.runtime.agent }} +{{- include "runner.resources.deployment" $runnerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/runner/rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/runner/rbac.yaml new file mode 100644 index 000000000..d5f8c1323 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/runner/rbac.yaml @@ -0,0 +1,9 @@ +{{- $runnerContext := deepCopy . }} +{{- $_ := set $runnerContext "Values" (get .Values "runner") }} +{{- $_ := set $runnerContext.Values "global" (get .Values "global") }} +{{- $_ := set $runnerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $runnerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $runnerContext.Values.enabled .Values.runtime.agent }} +{{- include "runner.resources.rbac" $runnerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/runtime/_helpers.tpl b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/_helpers.tpl new file mode 100644 index 000000000..6ba04fcc3 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/_helpers.tpl @@ -0,0 +1,123 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "runtime.name" -}} + {{- printf "%s" (include "cf-runtime.name" .) | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +If release name contains chart name it will be used as a full name. +*/}} +{{- define "runtime.fullname" -}} + {{- printf "%s" (include "cf-runtime.fullname" .) | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Common labels +*/}} +{{- define "runtime.labels" -}} +{{ include "cf-runtime.labels" . }} +codefresh.io/application: runtime +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "runtime.selectorLabels" -}} +{{ include "cf-runtime.selectorLabels" . }} +codefresh.io/application: runtime +{{- end }} + +{{/* +Return runtime image (classic runtime) with private registry prefix +*/}} +{{- define "runtime.runtimeImageName" -}} + {{- if .registry -}} + {{- $imageName := (trimPrefix "quay.io/" .imageFullName) -}} + {{- printf "%s/%s" .registry $imageName -}} + {{- else -}} + {{- printf "%s" .imageFullName -}} + {{- end -}} +{{- end -}} + +{{/* +Environment variable value of Codefresh installation token +*/}} +{{- define "runtime.installation-token-env-var-value" -}} + {{- if .Values.global.codefreshToken }} +valueFrom: + secretKeyRef: + name: {{ include "runtime.installation-token-secret-name" . }} + key: codefresh-api-token + {{- else if .Values.global.codefreshTokenSecretKeyRef }} +valueFrom: + secretKeyRef: + {{- .Values.global.codefreshTokenSecretKeyRef | toYaml | nindent 4 }} + {{- end }} +{{- end }} + +{{/* +Environment variable value of Codefresh agent token +*/}} +{{- define "runtime.agent-token-env-var-value" -}} + {{- if .Values.global.agentToken }} +{{- printf "%s" .Values.global.agentToken | toYaml }} + {{- else if .Values.global.agentTokenSecretKeyRef }} +valueFrom: + secretKeyRef: + {{- .Values.global.agentTokenSecretKeyRef | toYaml | nindent 4 }} + {{- end }} +{{- end }} + +{{/* +Print Codefresh API token secret name +*/}} +{{- define "runtime.installation-token-secret-name" }} +{{- print "codefresh-user-token" }} +{{- end }} + +{{/* +Print Codefresh host +*/}} +{{- define "runtime.runtime-environment-spec.codefresh-host" }} +{{- if and (not .Values.global.codefreshHost) }} + {{- fail "ERROR: .global.codefreshHost is required" }} +{{- else }} + {{- printf "%s" (trimSuffix "/" .Values.global.codefreshHost) }} +{{- end }} +{{- end }} + +{{/* +Print runtime-environment name +*/}} +{{- define "runtime.runtime-environment-spec.runtime-name" }} +{{- if and (not .Values.global.runtimeName) }} + {{- printf "%s/%s" .Values.global.context .Release.Namespace }} +{{- else }} + {{- printf "%s" .Values.global.runtimeName }} +{{- end }} +{{- end }} + +{{/* +Print agent name +*/}} +{{- define "runtime.runtime-environment-spec.agent-name" }} +{{- if and (not .Values.global.agentName) }} + {{- printf "%s_%s" .Values.global.context .Release.Namespace }} +{{- else }} + {{- printf "%s" .Values.global.agentName }} +{{- end }} +{{- end }} + +{{/* +Print context +*/}} +{{- define "runtime.runtime-environment-spec.context-name" }} +{{- if and (not .Values.global.context) }} + {{- fail "ERROR: .global.context is required" }} +{{- else }} + {{- printf "%s" .Values.global.context }} +{{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/runtime/cm-dind-daemon.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/cm-dind-daemon.yaml new file mode 100644 index 000000000..fc7f92905 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/cm-dind-daemon.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + {{- /* has to be a constant */}} + name: codefresh-dind-config + labels: + {{- include "runtime.labels" . | nindent 4 }} +data: + daemon.json: | +{{ coalesce .Values.re.dindDaemon .Values.runtime.dindDaemon | toPrettyJson | indent 4 }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/runtime/rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/rbac.yaml new file mode 100644 index 000000000..a51b12526 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/rbac.yaml @@ -0,0 +1,48 @@ +{{ $values := .Values.runtime }} +--- +{{- if or $values.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + {{- /* has to be a constant */}} + name: codefresh-engine + labels: + {{- include "runtime.labels" . | nindent 4 }} + {{- with $values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +--- +{{- if $values.rbac.create }} +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: codefresh-engine + labels: + {{- include "runner.labels" . | nindent 4 }} +rules: + - apiGroups: [ "" ] + resources: [ "secrets" ] + verbs: [ "get" ] +{{- with $values.rbac.rules }} + {{ toYaml . | nindent 2 }} +{{- end }} +{{- end }} +--- +{{- if and $values.serviceAccount.create $values.rbac.create }} +kind: RoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: codefresh-engine + labels: + {{- include "runner.labels" . | nindent 4 }} +subjects: + - kind: ServiceAccount + name: codefresh-engine +roleRef: + kind: Role + name: codefresh-engine + apiGroup: rbac.authorization.k8s.io +{{- end }} + diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/runtime/runtime-env-spec-tmpl.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/runtime-env-spec-tmpl.yaml new file mode 100644 index 000000000..c0ae0ff82 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/runtime-env-spec-tmpl.yaml @@ -0,0 +1,211 @@ +{{- define "runtime.runtime-environment-spec.template" }} +{{- $cfCommonTplSemver := printf "cf-common-%s" (index .Subcharts "cf-common").Chart.Version -}} +{{- $kubeconfigFilePath := (include "runtime.runtime-environment-spec.runtime-name" .) -}} +{{- $name := (include "runtime.runtime-environment-spec.runtime-name" .) -}} +{{- $engineContext := .Values.runtime.engine -}} +{{- $dindContext := .Values.runtime.dind -}} +{{- $imageRegistry := .Values.global.imageRegistry -}} +metadata: + name: {{ include "runtime.runtime-environment-spec.runtime-name" . }} + agent: {{ .Values.runtime.agent }} +runtimeScheduler: + type: KubernetesPod + {{- if $engineContext.image }} + image: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $engineContext.image "context" .) | squote }} + {{- end }} + imagePullPolicy: {{ $engineContext.image.pullPolicy }} + {{- with $engineContext.command }} + command: {{- toYaml . | nindent 4 }} + {{- end }} + envVars: + {{- with $engineContext.env }} + {{- range $key, $val := . }} + {{- if or (kindIs "bool" $val) (kindIs "int" $val) (kindIs "float64" $val) }} + {{ $key }}: {{ $val | squote }} + {{- else }} + {{ $key }}: {{ $val }} + {{- end }} + {{- end }} + {{- end }} + COMPOSE_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.COMPOSE_IMAGE) | squote }} + CONTAINER_LOGGER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.CONTAINER_LOGGER_IMAGE) | squote }} + DOCKER_BUILDER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.DOCKER_BUILDER_IMAGE) | squote }} + DOCKER_PULLER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.DOCKER_PULLER_IMAGE) | squote }} + DOCKER_PUSHER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.DOCKER_PUSHER_IMAGE) | squote }} + DOCKER_TAG_PUSHER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.DOCKER_TAG_PUSHER_IMAGE) | squote }} + FS_OPS_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.FS_OPS_IMAGE) | squote }} + GIT_CLONE_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.GIT_CLONE_IMAGE) | squote }} + KUBE_DEPLOY: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.KUBE_DEPLOY) | squote }} + PIPELINE_DEBUGGER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.PIPELINE_DEBUGGER_IMAGE) | squote }} + TEMPLATE_ENGINE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.TEMPLATE_ENGINE) | squote }} + CR_6177_FIXER: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.CR_6177_FIXER) | squote }} + GC_BUILDER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.GC_BUILDER_IMAGE) | squote }} + COSIGN_IMAGE_SIGNER_IMAGE: {{ include "runtime.runtimeImageName" (dict "registry" $imageRegistry "imageFullName" $engineContext.runtimeImages.COSIGN_IMAGE_SIGNER_IMAGE) | squote }} + {{- with $engineContext.userEnvVars }} + userEnvVars: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $engineContext.workflowLimits }} + workflowLimits: {{- toYaml . | nindent 4 }} + {{- end }} + cluster: + namespace: {{ .Release.Namespace }} + serviceAccount: {{ $engineContext.serviceAccount }} + {{- if .Values.runtime.agent }} + clusterProvider: + accountId: {{ .Values.global.accountId }} + selector: {{ include "runtime.runtime-environment-spec.context-name" . }} + {{- else }} + {{- if .Values.runtime.inCluster }} + inCluster: true + kubeconfigFilePath: null + {{- else }} + name: {{ $name }} + kubeconfigFilePath: {{ printf "/etc/kubeconfig/%s" $kubeconfigFilePath }} + {{- end }} + {{- end }} + {{- with $engineContext.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $engineContext.affinity }} + affinity: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $engineContext.tolerations }} + tolerations: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $engineContext.podAnnotations }} + annotations: + {{- range $key, $val := . }} + {{ $key }}: {{ $val | squote }} + {{- end }} + {{- end }} + {{- with $engineContext.podLabels }} + labels: {{- toYaml . | nindent 4 }} + {{- end }} + {{- if $engineContext.schedulerName }} + schedulerName: {{ $engineContext.schedulerName }} + {{- end }} + resources: + {{- if $engineContext.resources}} + {{- toYaml $engineContext.resources | nindent 4 }} + {{- end }} +dockerDaemonScheduler: + type: DindKubernetesPod + {{- if $dindContext.image }} + dindImage: {{ include (printf "%s.image.name" $cfCommonTplSemver ) (dict "image" $dindContext.image "context" .) | squote }} + {{- end }} + imagePullPolicy: {{ $dindContext.image.pullPolicy }} + {{- with $dindContext.userAccess }} + userAccess: {{ . }} + {{- end }} + {{- with $dindContext.env }} + envVars: + {{- range $key, $val := . }} + {{- if or (kindIs "bool" $val) (kindIs "int" $val) (kindIs "float64" $val) }} + {{ $key }}: {{ $val | squote }} + {{- else }} + {{ $key }}: {{ $val }} + {{- end }} + {{- end }} + {{- end }} + cluster: + namespace: {{ .Release.Namespace }} + serviceAccount: {{ $dindContext.serviceAccount }} + {{- if .Values.runtime.agent }} + clusterProvider: + accountId: {{ .Values.global.accountId }} + selector: {{ include "runtime.runtime-environment-spec.context-name" . }} + {{- else }} + {{- if .Values.runtime.inCluster }} + inCluster: true + kubeconfigFilePath: null + {{- else }} + name: {{ $name }} + kubeconfigFilePath: {{ printf "/etc/kubeconfig/%s" $kubeconfigFilePath }} + {{- end }} + {{- end }} + {{- with $dindContext.nodeSelector }} + nodeSelector: {{- toYaml . | nindent 6 }} + {{- end }} + {{- with $dindContext.affinity }} + affinity: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $dindContext.tolerations }} + tolerations: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $dindContext.podAnnotations }} + annotations: + {{- range $key, $val := . }} + {{ $key }}: {{ $val | squote }} + {{- end }} + {{- end }} + {{- with $dindContext.podLabels }} + labels: {{- toYaml . | nindent 4 }} + {{- end }} + {{- if $dindContext.schedulerName }} + schedulerName: {{ $dindContext.schedulerName }} + {{- end }} + {{- if $dindContext.pvcs }} + pvcs: + {{- range $index, $pvc := $dindContext.pvcs }} + - name: {{ $pvc.name }} + reuseVolumeSelector: {{ $pvc.reuseVolumeSelector | squote }} + reuseVolumeSortOrder: {{ $pvc.reuseVolumeSortOrder }} + storageClassName: {{ include (printf "%v.tplrender" $cfCommonTplSemver) (dict "Values" $pvc.storageClassName "context" $) }} + volumeSize: {{ $pvc.volumeSize }} + {{- with $pvc.annotations }} + annotations: {{ . | toYaml | nindent 8 }} + {{- end }} + {{- end }} + {{- end }} + defaultDindResources: + {{- with $dindContext.resources }} + {{- if not .requests }} + limits: {{- toYaml .limits | nindent 6 }} + requests: null + {{- else }} + {{- toYaml . | nindent 4 }} + {{- end }} + {{- end }} + {{- with $dindContext.terminationGracePeriodSeconds }} + terminationGracePeriodSeconds: {{ . }} + {{- end }} + {{- with $dindContext.userVolumeMounts }} + userVolumeMounts: {{- toYaml . | nindent 4 }} + {{- end }} + {{- with $dindContext.userVolumes }} + userVolumes: {{- toYaml . | nindent 4 }} + {{- end }} + {{- if and (not .Values.runtime.agent) }} + clientCertPath: /etc/ssl/cf/ + volumeMounts: + codefresh-certs-server: + name: codefresh-certs-server + mountPath: /etc/ssl/cf + readOnly: false + volumes: + codefresh-certs-server: + name: codefresh-certs-server + secret: + secretName: codefresh-certs-server + {{- end }} +extends: {{- toYaml .Values.runtime.runtimeExtends | nindent 2 }} + {{- if .Values.runtime.description }} +description: {{ .Values.runtime.description }} + {{- else }} +description: null + {{- end }} +{{- if .Values.global.accountId }} +accountId: {{ .Values.global.accountId }} +{{- end }} +{{- if not .Values.runtime.agent }} +accounts: {{- toYaml .Values.runtime.accounts | nindent 2 }} +{{- end }} +{{- if .Values.appProxy.enabled }} +appProxy: + externalIP: >- + {{ printf "https://%s%s" .Values.appProxy.ingress.host (.Values.appProxy.ingress.pathPrefix | default "/") }} +{{- end }} +{{- if not .Values.runtime.agent }} +systemHybrid: true +{{- end }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/runtime/secret.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/secret.yaml new file mode 100644 index 000000000..2366d3ccf --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/secret.yaml @@ -0,0 +1,11 @@ +{{- if and .Values.global.codefreshToken }} +apiVersion: v1 +kind: Secret +type: Opaque +metadata: + name: {{ include "runtime.installation-token-secret-name" . }} + labels: + {{- include "runtime.labels" . | nindent 4 }} +stringData: + codefresh-api-token: {{ .Values.global.codefreshToken }} +{{- end }} \ No newline at end of file diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/runtime/svc-dind.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/svc-dind.yaml new file mode 100644 index 000000000..098edb4e8 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/runtime/svc-dind.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + {{- include "runtime.labels" . | nindent 4 }} + app: dind + {{/* has to be a constant */}} + name: dind +spec: + ports: + - name: "dind-port" + port: 1300 + protocol: TCP + clusterIP: None + selector: + app: dind diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/cronjob.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/cronjob.yaml new file mode 100644 index 000000000..db955bc77 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/cronjob.yaml @@ -0,0 +1,11 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values.volumeProvisioner "dind-volume-cleanup") }} +{{- $_ := set $volumeProvisionerContext.Values "serviceAccount" (get .Values.volumeProvisioner "serviceAccount") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $volumeProvisionerContext.Values.enabled .Values.volumeProvisioner.enabled }} +{{- include "dind-volume-provisioner.resources.cronjob" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/daemonset.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/daemonset.yaml new file mode 100644 index 000000000..39927149e --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/daemonset.yaml @@ -0,0 +1,11 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values.volumeProvisioner "dind-lv-monitor") }} +{{- $_ := set $volumeProvisionerContext.Values "serviceAccount" (get .Values.volumeProvisioner "serviceAccount") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if and $volumeProvisionerContext.Values.enabled .Values.volumeProvisioner.enabled }} +{{- include "dind-volume-provisioner.resources.daemonset" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/deployment.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/deployment.yaml new file mode 100644 index 000000000..522fa8791 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/deployment.yaml @@ -0,0 +1,10 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values "volumeProvisioner") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $volumeProvisionerContext.Values.enabled }} +{{- include "dind-volume-provisioner.resources.deployment" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/rbac.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/rbac.yaml new file mode 100644 index 000000000..f3ae9609f --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/rbac.yaml @@ -0,0 +1,9 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values "volumeProvisioner") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $volumeProvisionerContext.Values.enabled }} +{{- include "dind-volume-provisioner.resources.rbac" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/secret.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/secret.yaml new file mode 100644 index 000000000..accf601d1 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/secret.yaml @@ -0,0 +1,10 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values "volumeProvisioner") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $volumeProvisionerContext.Values.enabled }} +{{- include "dind-volume-provisioner.resources.secret" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/storageclass.yaml b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/storageclass.yaml new file mode 100644 index 000000000..77a7602da --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/templates/volume-provisioner/storageclass.yaml @@ -0,0 +1,10 @@ +{{- $volumeProvisionerContext := deepCopy . }} +{{- $_ := set $volumeProvisionerContext "Values" (get .Values "volumeProvisioner") }} +{{- $_ := set $volumeProvisionerContext.Values "global" (get .Values "global") }} +{{- $_ := set $volumeProvisionerContext.Values "storage" (get .Values "storage") }} +{{- $_ := set $volumeProvisionerContext.Values "nameOverride" (get .Values "nameOverride") }} +{{- $_ := set $volumeProvisionerContext.Values "fullnameOverride" (get .Values "fullnameOverride") }} + +{{- if $volumeProvisionerContext.Values.enabled }} +{{- include "dind-volume-provisioner.resources.storageclass" $volumeProvisionerContext }} +{{- end }} diff --git a/charts/codefresh/cf-runtime/6.3.61/values.yaml b/charts/codefresh/cf-runtime/6.3.61/values.yaml new file mode 100644 index 000000000..88ad3fac0 --- /dev/null +++ b/charts/codefresh/cf-runtime/6.3.61/values.yaml @@ -0,0 +1,947 @@ +# -- String to partially override cf-runtime.fullname template (will maintain the release name) +nameOverride: "" +# -- String to fully override cf-runtime.fullname template +fullnameOverride: "" + +# -- Global parameters +# @default -- See below +global: + # -- Global Docker image registry + imageRegistry: "" + # -- Global Docker registry secret names as array + imagePullSecrets: [] + + # -- URL of Codefresh Platform (required!) + codefreshHost: "https://g.codefresh.io" + # -- User token in plain text (required if `global.codefreshTokenSecretKeyRef` is omitted!) + # Ref: https://g.codefresh.io/user/settings (see API Keys) + # Minimal API key scopes: Runner-Installation(read+write), Agent(read+write), Agents(read+write) + codefreshToken: "" + # -- User token that references an existing secret containing API key (required if `global.codefreshToken` is omitted!) + codefreshTokenSecretKeyRef: {} + + # E.g. + # codefreshTokenSecretKeyRef: + # name: my-codefresh-api-token + # key: codefresh-api-token + + # -- Account ID (required!) + # Can be obtained here https://g.codefresh.io/2.0/account-settings/account-information + accountId: "" + + # -- K8s context name (required!) + context: "" + # E.g. + # context: prod-ue1-runtime-1 + + # -- Agent Name (optional!) + # If omitted, the following format will be used `{{ .Values.global.context }}_{{ .Release.Namespace }}` + agentName: "" + # E.g. + # agentName: prod-ue1-runtime-1 + + # -- Runtime name (optional!) + # If omitted, the following format will be used `{{ .Values.global.context }}/{{ .Release.Namespace }}` + runtimeName: "" + # E.g. + # runtimeName: prod-ue1-runtime-1/namespace + + # -- DEPRECATED Agent token in plain text. + # !!! MUST BE provided if migrating from < 6.x chart version + agentToken: "" + # -- DEPRECATED Agent token that references an existing secret containing API key. + # !!! MUST BE provided if migrating from < 6.x chart version + agentTokenSecretKeyRef: {} + # E.g. + # agentTokenSecretKeyRef: + # name: my-codefresh-agent-secret + # key: codefresh-agent-token + +# DEPRECATED -- Use `.Values.global.imageRegistry` instead +dockerRegistry: "" + +# DEPRECATED -- Use `.Values.runtime` instead +re: {} + +# -- Runner parameters +# @default -- See below +runner: + # -- Enable the runner + enabled: true + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: RollingUpdate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: quay.io + repository: codefresh/venona + tag: 1.10.2 + + # -- Init container + init: + image: + registry: quay.io + repository: codefresh/cli + tag: 0.85.0-rootless + + resources: + limits: + memory: 512Mi + cpu: '1' + requests: + memory: 256Mi + cpu: '0.2' + + # -- Sidecar container + # Reconciles runtime spec from Codefresh API for drift detection + sidecar: + enabled: false + image: + registry: quay.io + repository: codefresh/codefresh-shell + tag: 0.0.2 + env: + RECONCILE_INTERVAL: 300 + resources: {} + + # -- Add additional env vars + env: {} + # E.g. + # env: + # WORKFLOW_CONCURRENCY: 50 # The number of workflow creation and termination tasks the Runner can handle in parallel. Defaults to 50 + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Additional service account annotations + annotations: {} + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Add custom rule to the role + rules: [] + + # -- Set security context for the pod + # @default -- See below + podSecurityContext: + enabled: true + runAsUser: 10001 + runAsGroup: 10001 + fsGroup: 10001 + + # -- Readiness probe configuration + # @default -- See below + readinessProbe: + failureThreshold: 5 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + + # -- Set requests and limits + resources: {} + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + +# -- Volume Provisioner parameters +# @default -- See below +volumeProvisioner: + # -- Enable volume-provisioner + enabled: true + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: Recreate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: quay.io + repository: codefresh/dind-volume-provisioner + tag: 1.35.0 + # -- Add additional env vars + env: {} + # E.g. + # env: + # THREADINESS: 4 # The number of PVC requests the dind-volume-provisioner can process in parallel. Defaults to 4 + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Additional service account annotations + annotations: {} + # E.g. + # serviceAccount: + # annotations: + # eks.amazonaws.com/role-arn: "arn:aws:iam:::role/" + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Add custom rule to the role + rules: [] + + # -- Set security context for the pod + # @default -- See below + podSecurityContext: + enabled: true + runAsUser: 3000 + runAsGroup: 3000 + fsGroup: 3000 + + # -- Set node selector + nodeSelector: {} + # -- Set resources + resources: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + + # -- `dind-lv-monitor` DaemonSet parameters + # (local volumes cleaner) + # @default -- See below + dind-lv-monitor: + enabled: true + image: + registry: quay.io + repository: codefresh/dind-volume-utils + tag: 1.29.4 + podAnnotations: {} + podSecurityContext: + enabled: true + runAsUser: 1000 + fsGroup: 1000 + containerSecurityContext: {} + env: {} + resources: {} + nodeSelector: {} + tolerations: + - key: 'codefresh/dind' + operator: 'Exists' + effect: 'NoSchedule' + volumePermissions: + enabled: true + image: + registry: docker.io + repository: alpine + tag: 3.18 + resources: {} + securityContext: + runAsUser: 0 # auto + + # `dind-volume-cleanup` CronJob parameters + # (external volumes cleaner) + # @default -- See below + dind-volume-cleanup: + enabled: true + image: + registry: quay.io + repository: codefresh/dind-volume-cleanup + tag: 1.2.0 + env: {} + concurrencyPolicy: Forbid + schedule: "*/10 * * * *" + successfulJobsHistory: 3 + failedJobsHistory: 1 + suspend: false + podAnnotations: {} + podSecurityContext: + enabled: true + fsGroup: 3000 + runAsGroup: 3000 + runAsUser: 3000 + nodeSelector: {} + affinity: {} + tolerations: [] + +# Storage parameters for volume-provisioner +# @default -- See below +storage: + # -- Set backend volume type (`local`/`ebs`/`ebs-csi`/`gcedisk`/`azuredisk`) + backend: local + # -- Set filesystem type (`ext4`/`xfs`) + fsType: "ext4" + + # Storage parametrs example for local volumes on the K8S nodes filesystem (i.e. `storage.backend=local`) + # https://kubernetes.io/docs/concepts/storage/volumes/#local + # @default -- See below + local: + # -- Set volume path on the host filesystem + volumeParentDir: /var/lib/codefresh/dind-volumes + + # Storage parameters example for aws ebs disks (i.e. `storage.backend=ebs`/`storage.backend=ebs-csi`) + # https://aws.amazon.com/ebs/ + # https://codefresh.io/docs/docs/installation/codefresh-runner/#aws-backend-volume-configuration + # @default -- See below + ebs: + # -- Set EBS volume type (`gp2`/`gp3`/`io1`) (required) + volumeType: "gp2" + # -- Set EBS volumes availability zone (required) + availabilityZone: "us-east-1a" + # -- Enable encryption (optional) + encrypted: "false" + # -- Set KMS encryption key ID (optional) + kmsKeyId: "" + + # -- Set AWS_ACCESS_KEY_ID for volume-provisioner (optional) + # Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#dind-volume-provisioner-permissions + accessKeyId: "" + # -- Existing secret containing AWS_ACCESS_KEY_ID. + accessKeyIdSecretKeyRef: {} + # E.g. + # accessKeyIdSecretKeyRef: + # name: + # key: + + # -- Set AWS_SECRET_ACCESS_KEY for volume-provisioner (optional) + # Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#dind-volume-provisioner-permissions + secretAccessKey: "" + # -- Existing secret containing AWS_SECRET_ACCESS_KEY + secretAccessKeySecretKeyRef: {} + # E.g. + # secretAccessKeySecretKeyRef: + # name: + # key: + + # E.g. + # ebs: + # volumeType: gp3 + # availabilityZone: us-east-1c + # encrypted: false + # iops: "5000" + # # I/O operations per second. Only effetive when gp3 volume type is specified. + # # Default value - 3000. + # # Max - 16,000 + # throughput: "500" + # # Throughput in MiB/s. Only effective when gp3 volume type is specified. + # # Default value - 125. + # # Max - 1000. + # ebs: + # volumeType: gp2 + # availabilityZone: us-east-1c + # encrypted: true + # kmsKeyId: "1234abcd-12ab-34cd-56ef-1234567890ab" + # accessKeyId: "MYKEYID" + # secretAccessKey: "MYACCESSKEY" + + # Storage parameters example for gce disks + # https://cloud.google.com/compute/docs/disks#pdspecs + # https://codefresh.io/docs/docs/installation/codefresh-runner/#gke-google-kubernetes-engine-backend-volume-configuration + # @default -- See below + gcedisk: + # -- Set GCP volume backend type (`pd-ssd`/`pd-standard`) + volumeType: "pd-ssd" + # -- Set GCP volume availability zone + availabilityZone: "us-west1-a" + # -- Set Google SA JSON key for volume-provisioner (optional) + serviceAccountJson: "" + # -- Existing secret containing containing Google SA JSON key for volume-provisioner (optional) + serviceAccountJsonSecretKeyRef: {} + # E.g. + # gcedisk: + # volumeType: pd-ssd + # availabilityZone: us-central1-c + # serviceAccountJson: |- + # { + # "type": "service_account", + # "project_id": "...", + # "private_key_id": "...", + # "private_key": "...", + # "client_email": "...", + # "client_id": "...", + # "auth_uri": "...", + # "token_uri": "...", + # "auth_provider_x509_cert_url": "...", + # "client_x509_cert_url": "..." + # } + + # Storage parameters example for Azure Disks + # https://codefresh.io/docs/docs/installation/codefresh-runner/#install-codefresh-runner-on-azure-kubernetes-service-aks + # @default -- See below + azuredisk: + # -- Set storage type (`Premium_LRS`) + skuName: Premium_LRS + cachingMode: None + # availabilityZone: northeurope-1 + # resourceGroup: + # DiskIOPSReadWrite: 500 + # DiskMBpsReadWrite: 100 + + mountAzureJson: false + +# -- Set runtime parameters +# @default -- See below + +runtime: + # -- Set annotation on engine Service Account + # Ref: https://codefresh.io/docs/docs/administration/codefresh-runner/#injecting-aws-arn-roles-into-the-cluster + serviceAccount: + create: true + annotations: {} + # E.g. + # serviceAccount: + # annotations: + # eks.amazonaws.com/role-arn: "arn:aws:iam:::role/" + + # -- Set parent runtime to inherit. + # Should not be changes. Parent runtime is controlled from Codefresh side. + runtimeExtends: + - system/default/hybrid/k8s_low_limits + # -- Runtime description + description: "" + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Add custom rule to the engine role + rules: [] + + # -- (for On-Premise only) Enable agent + agent: true + # -- (for On-Premise only) Set inCluster runtime + inCluster: true + # -- (for On-Premise only) Assign accounts to runtime (list of account ids) + accounts: [] + + # -- Parameters for DinD (docker-in-docker) pod (aka "runtime" pod). + dind: + # -- Set dind image. + image: + registry: quay.io + repository: codefresh/dind + tag: 26.1.4-1.28.7 # use `latest-rootless/rootless/26.1.4-1.28.7-rootless` tags for rootless-dind + pullPolicy: IfNotPresent + # -- Set dind resources. + resources: + requests: null + limits: + cpu: 400m + memory: 800Mi + # -- PV claim spec parametes. + pvcs: + # -- Default dind PVC parameters + dind: + # -- PVC name prefix. + # Keep `dind` as default! Don't change! + name: dind + # -- PVC storage class name. + # Change ONLY if you need to use storage class NOT from Codefresh volume-provisioner + storageClassName: '{{ include "dind-volume-provisioner.storageClassName" . }}' + # -- PVC size. + volumeSize: 16Gi + # -- PV reuse selector. + # Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#volume-reuse-policy + reuseVolumeSelector: codefresh-app,io.codefresh.accountName + reuseVolumeSortOrder: pipeline_id + # -- PV annotations. + annotations: {} + # E.g.: + # annotations: + # codefresh.io/volume-retention: 7d + # -- Set additional env vars. + env: + DOCKER_ENABLE_DEPRECATED_PULL_SCHEMA_1_IMAGE: true + # -- Set pod annotations. + podAnnotations: {} + # -- Set pod labels. + podLabels: {} + # -- Set node selector. + nodeSelector: {} + # -- Set affinity + affinity: {} + # -- Set tolerations. + tolerations: [] + # -- Set scheduler name. + schedulerName: "" + # -- Set service account for pod. + serviceAccount: codefresh-engine + # -- Keep `true` as default! + userAccess: true + # -- Add extra volumes + userVolumes: {} + # E.g.: + # userVolumes: + # regctl-docker-registry: + # name: regctl-docker-registry + # secret: + # items: + # - key: .dockerconfigjson + # path: config.json + # secretName: regctl-docker-registry + # optional: true + # -- Add extra volume mounts + userVolumeMounts: {} + # E.g.: + # userVolumeMounts: + # regctl-docker-registry: + # name: regctl-docker-registry + # mountPath: /home/appuser/.docker/ + # readOnly: true + + # -- Parameters for Engine pod (aka "pipeline" orchestrator). + engine: + # -- Set image. + image: + registry: quay.io + repository: codefresh/engine + tag: 1.174.12 + pullPolicy: IfNotPresent + # -- Set container command. + command: + - npm + - run + - start + # -- Set resources. + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 1000m + memory: 2048Mi + # -- Set system(base) runtime images. + # @default -- See below. + runtimeImages: + COMPOSE_IMAGE: quay.io/codefresh/compose:v2.28.1-1.5.0 + CONTAINER_LOGGER_IMAGE: quay.io/codefresh/cf-container-logger:1.11.6 + DOCKER_BUILDER_IMAGE: quay.io/codefresh/cf-docker-builder:1.3.13 + DOCKER_PULLER_IMAGE: quay.io/codefresh/cf-docker-puller:8.0.17 + DOCKER_PUSHER_IMAGE: quay.io/codefresh/cf-docker-pusher:6.0.16 + DOCKER_TAG_PUSHER_IMAGE: quay.io/codefresh/cf-docker-tag-pusher:1.3.14 + FS_OPS_IMAGE: quay.io/codefresh/fs-ops:1.2.3 + GIT_CLONE_IMAGE: quay.io/codefresh/cf-git-cloner:10.1.28 + KUBE_DEPLOY: quay.io/codefresh/cf-deploy-kubernetes:16.1.11 + PIPELINE_DEBUGGER_IMAGE: quay.io/codefresh/cf-debugger:1.3.0 + TEMPLATE_ENGINE: quay.io/codefresh/pikolo:0.14.1 + CR_6177_FIXER: 'quay.io/codefresh/alpine:edge' + GC_BUILDER_IMAGE: 'quay.io/codefresh/cf-gc-builder:0.5.3' + COSIGN_IMAGE_SIGNER_IMAGE: 'quay.io/codefresh/cf-cosign-image-signer:2.4.0-cf.2' + # -- Set additional env vars. + env: + # -- Interval to check the exec status in the container-logger + CONTAINER_LOGGER_EXEC_CHECK_INTERVAL_MS: 1000 + # -- Timeout while doing requests to the Docker daemon + DOCKER_REQUEST_TIMEOUT_MS: 30000 + # -- If "true", composition images will be pulled sequentially + FORCE_COMPOSE_SERIAL_PULL: false + # -- Level of logging for engine + LOGGER_LEVEL: debug + # -- Enable debug-level logging of outgoing HTTP/HTTPS requests + LOG_OUTGOING_HTTP_REQUESTS: false + # -- Enable emitting metrics from engine + METRICS_PROMETHEUS_ENABLED: true + # -- Enable legacy metrics + METRICS_PROMETHEUS_ENABLE_LEGACY_METRICS: false + # -- Enable collecting process metrics + METRICS_PROMETHEUS_COLLECT_PROCESS_METRICS: false + # -- Host for Prometheus metrics server + METRICS_PROMETHEUS_HOST: '0.0.0.0' + # -- Port for Prometheus metrics server + METRICS_PROMETHEUS_PORT: 9100 + # -- Set workflow limits. + workflowLimits: + # -- Maximum time allowed to the engine to wait for the pre-steps (aka "Initializing Process") to succeed; seconds. + MAXIMUM_ALLOWED_TIME_BEFORE_PRE_STEPS_SUCCESS: 600 + # -- Maximum time for workflow execution; seconds. + MAXIMUM_ALLOWED_WORKFLOW_AGE_BEFORE_TERMINATION: 86400 + # -- Maximum time allowed to workflow to spend in "elected" state; seconds. + MAXIMUM_ELECTED_STATE_AGE_ALLOWED: 900 + # -- Maximum retry attempts allowed for workflow. + MAXIMUM_RETRY_ATTEMPTS_ALLOWED: 20 + # -- Maximum time allowed to workflow to spend in "terminating" state until force terminated; seconds. + MAXIMUM_TERMINATING_STATE_AGE_ALLOWED: 900 + # -- Maximum time allowed to workflow to spend in "terminating" state without logs activity until force terminated; seconds. + MAXIMUM_TERMINATING_STATE_AGE_ALLOWED_WITHOUT_UPDATE: 300 + # -- Time since the last health check report after which workflow is terminated; seconds. + TIME_ENGINE_INACTIVE_UNTIL_TERMINATION: 300 + # -- Time since the last health check report after which the engine is considered unhealthy; seconds. + TIME_ENGINE_INACTIVE_UNTIL_UNHEALTHY: 60 + # -- Time since the last workflow logs activity after which workflow is terminated; seconds. + TIME_INACTIVE_UNTIL_TERMINATION: 2700 + # -- Set pod annotations. + podAnnotations: {} + # -- Set pod labels. + podLabels: {} + # -- Set node selector. + nodeSelector: {} + # -- Set affinity + affinity: {} + # -- Set tolerations. + tolerations: [] + # -- Set scheduler name. + schedulerName: "" + # -- Set service account for pod. + serviceAccount: codefresh-engine + # -- Set extra env vars + userEnvVars: [] + # E.g. + # userEnvVars: + # - name: GITHUB_TOKEN + # valueFrom: + # secretKeyRef: + # name: github-token + # key: token + + # -- Parameters for `runtime-patch` post-upgrade/install hook + # @default -- See below + patch: + enabled: true + image: + registry: quay.io + repository: codefresh/cli + tag: 0.85.0-rootless + rbac: + enabled: true + annotations: {} + affinity: {} + nodeSelector: {} + podSecurityContext: {} + resources: {} + tolerations: [] + ttlSecondsAfterFinished: 180 + env: + HOME: /tmp + + # -- Parameters for `gencerts-dind` post-upgrade/install hook + # @default -- See below + gencerts: + enabled: true + image: + registry: quay.io + repository: codefresh/kubectl + tag: 1.28.4 + rbac: + enabled: true + annotations: {} + affinity: {} + nodeSelector: {} + podSecurityContext: {} + resources: {} + tolerations: [] + ttlSecondsAfterFinished: 180 + + # -- DinD pod daemon config + # @default -- See below + dindDaemon: + hosts: + - unix:///var/run/docker.sock + - tcp://0.0.0.0:1300 + tlsverify: true + tls: true + tlscacert: /etc/ssl/cf-client/ca.pem + tlscert: /etc/ssl/cf/server-cert.pem + tlskey: /etc/ssl/cf/server-key.pem + insecure-registries: + - 192.168.99.100:5000 + metrics-addr: 0.0.0.0:9323 + experimental: true + +# App-Proxy parameters +# Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#app-proxy-installation +# @default -- See below +appProxy: + # -- Enable app-proxy + enabled: false + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: RollingUpdate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: quay.io + repository: codefresh/cf-app-proxy + tag: 0.0.47 + # -- Add additional env vars + env: {} + + # Set app-proxy ingress parameters + # @default -- See below + ingress: + # -- Set path prefix for ingress (keep empty for default `/` path) + pathPrefix: "" + # -- Set ingress class + class: "" + # -- Set DNS hostname the ingress will use + host: "" + # -- Set k8s tls secret for the ingress object + tlsSecret: "" + # -- Set extra annotations for ingress object + annotations: {} + # E.g. + # ingress: + # pathPrefix: "/cf-app-proxy" + # class: "nginx" + # host: "mydomain.com" + # tlsSecret: "tls-cert-app-proxy" + # annotations: + # nginx.ingress.kubernetes.io/whitelist-source-range: 123.123.123.123/130 + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Use Role(true)/ClusterRole(true) + namespaced: true + # -- Additional service account annotations + annotations: {} + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Use Role(true)/ClusterRole(true) + namespaced: true + # -- Add custom rule to the role + rules: [] + + # -- Set security context for the pod + podSecurityContext: {} + + # -- Readiness probe configuration + # @default -- See below + readinessProbe: + failureThreshold: 5 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + + # -- Set requests and limits + resources: {} + # -- Set node selector + nodeSelector: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + +# Monitor parameters +# @default -- See below +monitor: + # -- Enable monitor + # Ref: https://codefresh.io/docs/docs/installation/codefresh-runner/#install-monitoring-component + enabled: false + + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: RollingUpdate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: quay.io + repository: codefresh/cf-k8s-agent + tag: 1.3.17 + # -- Add additional env vars + env: {} + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Additional service account annotations + annotations: {} + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Use Role(true)/ClusterRole(true) + namespaced: true + # -- Add custom rule to the role + rules: [] + + # -- Readiness probe configuration + # @default -- See below + readinessProbe: + failureThreshold: 5 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + + podSecurityContext: {} + + # -- Set node selector + nodeSelector: {} + # -- Set resources + resources: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + +# -- Add serviceMonitor +# @default -- See below +serviceMonitor: + main: + # -- Enable service monitor for dind pods + enabled: false + nameOverride: dind + selector: + matchLabels: + app: dind + endpoints: + - path: /metrics + targetPort: 9100 + relabelings: + - action: labelmap + regex: __meta_kubernetes_pod_label_(.+) + +# -- Add podMonitor (for engine pods) +# @default -- See below +podMonitor: + main: + # -- Enable pod monitor for engine pods + enabled: false + nameOverride: engine + selector: + matchLabels: + app: runtime + podMetricsEndpoints: + - path: /metrics + targetPort: 9100 + + runner: + # -- Enable pod monitor for runner pod + enabled: false + nameOverride: runner + selector: + matchLabels: + codefresh.io/application: runner + podMetricsEndpoints: + - path: /metrics + targetPort: 8080 + + volume-provisioner: + # -- Enable pod monitor for volumeProvisioner pod + enabled: false + nameOverride: volume-provisioner + selector: + matchLabels: + codefresh.io/application: volume-provisioner + podMetricsEndpoints: + - path: /metrics + targetPort: 8080 + +# -- Event exporter parameters +# @default -- See below +event-exporter: + # -- Enable event-exporter + enabled: false + # -- Set number of pods + replicasCount: 1 + # -- Upgrade strategy + updateStrategy: + type: Recreate + # -- Set pod annotations + podAnnotations: {} + + # -- Set image + image: + registry: docker.io + repository: codefresh/k8s-event-exporter + tag: latest + # -- Add additional env vars + env: {} + + # -- Service Account parameters + serviceAccount: + # -- Create service account + create: true + # -- Override service account name + name: "" + # -- Additional service account annotations + annotations: {} + + # -- RBAC parameters + rbac: + # -- Create RBAC resources + create: true + # -- Add custom rule to the role + rules: [] + + # -- Set security context for the pod + # @default -- See below + podSecurityContext: + enabled: false + + # -- Set node selector + nodeSelector: {} + # -- Set resources + resources: {} + # -- Set tolerations + tolerations: [] + # -- Set affinity + affinity: {} + +# -- Array of extra objects to deploy with the release +extraResources: [] +# E.g. +# extraResources: +# - apiVersion: rbac.authorization.k8s.io/v1 +# kind: ClusterRole +# metadata: +# name: codefresh-role +# rules: +# - apiGroups: [ "*"] +# resources: ["*"] +# verbs: ["get", "list", "watch", "create", "update", "patch", "delete"] +# - apiVersion: v1 +# kind: ServiceAccount +# metadata: +# name: codefresh-user +# namespace: "{{ .Release.Namespace }}" +# - apiVersion: rbac.authorization.k8s.io/v1 +# kind: ClusterRoleBinding +# metadata: +# name: codefresh-user +# roleRef: +# apiGroup: rbac.authorization.k8s.io +# kind: ClusterRole +# name: codefresh-role +# subjects: +# - kind: ServiceAccount +# name: codefresh-user +# namespace: "{{ .Release.Namespace }}" +# - apiVersion: v1 +# kind: Secret +# type: kubernetes.io/service-account-token +# metadata: +# name: codefresh-user-token +# namespace: "{{ .Release.Namespace }}" +# annotations: +# kubernetes.io/service-account.name: "codefresh-user" diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/Chart.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/Chart.yaml new file mode 100644 index 000000000..c8ebb7542 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/Chart.yaml @@ -0,0 +1,23 @@ +annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Confluent for Kubernetes + catalog.cattle.io/kube-version: '>=1.15-0' + catalog.cattle.io/release-name: confluent-for-kubernetes +apiVersion: v1 +appVersion: 2.9.3 +description: A Helm chart to deploy Confluent for Kubernetes +home: https://www.confluent.io/ +icon: file://assets/icons/confluent-for-kubernetes.png +keywords: +- Confluent +- Confluent Operator +- Confluent Platform +- CFK +kubeVersion: '>=1.15-0' +maintainers: +- email: operator@confluent.io + name: Confluent Operator +name: confluent-for-kubernetes +sources: +- https://docs.confluent.io/current/index.html +version: 0.1033.33 diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/README.md b/charts/confluent/confluent-for-kubernetes/0.1033.33/README.md new file mode 100644 index 000000000..512ca36c7 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/README.md @@ -0,0 +1,72 @@ +Confluent for Kubernetes +================================================================== + +Confluent for Kubernetes (CFK) is a cloud-native control plane for deploying and managing Confluent in your private cloud environment. It provides standard and simple interface to customize, deploy, and manage Confluent Platform through declarative API. + +Confluent for Kubernetes runs on Kubernetes, the runtime for private cloud architectures. + + + + + + NOTE: Confluent for Kubernetes is the next generation of Confluent Operator. For Confluent Operator 1.x documentation, see [Confluent Operator 1](https://docs.confluent.io/operator/1.7.0/overview.html), or use the version picker to browse to a specific version of the documentation. + +See [Introducing Confluent for Kubernetes](https://www.confluent.io/blog/confluent-for-kubernetes-offers-cloud-native-kafka-automation/) for an overview. + +The following shows the high-level architecture of Confluent for Kubernetes and Confluent Platform in Kubernetes. + +[![_images/co-architecture.png](https://docs.confluent.io/operator/current/_images/co-architecture.png)](_images/co-architecture.png) + +Features +--------------------------------------------------- + +The following are summaries of the main, notable features of Confluent for Kubernetes. + +#### Cloud Native Declarative API + +* Declarative Kubernetes-native API approach to configure, deploy, and manage Confluent Platform components (Apache KafkaB., Connect workers, ksqlDB, Schema Registry, Confluent Control Center) and resources (topics, rolebindings) through Infrastructure as Code (IaC). +* Provides built-in automation for cloud-native security best practices: + * Complete granular RBAC, authentication and TLS network encryption + * Auto-generated certificates + * Support for credential management systems, such as Hashicorp Vault, to inject sensitive configurations in memory to Confluent deployments +* Provides server properties, JVM, and Log4j configuration overrides for customization of all Confluent Platform components. + +#### Upgrades + +* Provides automated rolling updates for configuration changes. +* Provides automated rolling upgrades with no impact to Kafka availability. + +#### Scaling + +* Provides single command, automated scaling and reliability checks of Confluent Platform. + +#### Resiliency + +* Restores a Kafka pod with the same Kafka broker ID, configuration, and persistent storage volumes if a failure occurs. +* Provides automated rack awareness to spread replicas of a partition across different racks (or zones), improving availability of Kafka brokers and limiting the risk of data loss. + +#### Scheduling + +* Supports Kubernetes labels and annotations to provide useful context to DevOps teams and ecosystem tooling. +* Supports Kubernetes tolerations and pod/node affinity for efficient resource utilization and pod placement. + +#### Monitoring + +* Supports metrics aggregation using JMX/Jolokia. +* Supports aggregated metrics export to Prometheus. + +Licensing +----------------------------------------------------- + +You can use Confluent for Kubernetes and Confluent Control Center for a 30-day trial period without a license key. + +After 30 days, Confluent for Kubernetes and Control Center require a license key. Confluent issues keys to subscribers, along with providing [enterprise-level support](https://www.confluent.io/subscription/) for Confluent components and Confluent for Kubernetes. + +If you are a subscriber, contact Confluent Support at [support@confluent.io](mailto:support@confluent.io) for more information. + +See [Update Confluent Platform License](co-license.html#co-license-key) if you have received a key for Confluent for Kubernetes. + +© Copyright 2021 , Confluent, Inc. [Privacy Policy](https://www.confluent.io/confluent-privacy-statement/) | [Terms & Conditions](https://www.confluent.io/terms-of-use/). Apache, Apache Kafka, Kafka and the Kafka logo are trademarks of the [Apache Software Foundation](http://www.apache.org/). All other trademarks, servicemarks, and copyrights are the property of their respective owners. + +[Please report any inaccuracies on this page or suggest an edit.](mailto:docs@confluent.io) + diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/app-readme.md b/charts/confluent/confluent-for-kubernetes/0.1033.33/app-readme.md new file mode 100644 index 000000000..cfcabdd21 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/app-readme.md @@ -0,0 +1,3 @@ +##Confluent For Kubernetes + +With Confluent for Kubernetes, Confluent brings a cloud-native experience for data in motion workloads in on-premises environments. Based on our expertise and learnings from operating over 5,000 clusters in Confluent Cloud, Confluent for Kubernetes offers an opinionated deployment of Confluent Platform that enhances the platformb's elasticity, ease of operations, and resiliency. diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_clusterlinks.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_clusterlinks.yaml new file mode 100644 index 000000000..5c8a627c3 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_clusterlinks.yaml @@ -0,0 +1,883 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: clusterlinks.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: ClusterLink + listKind: ClusterLinkList + plural: clusterlinks + shortNames: + - cl + - clusterlink + - clink + singular: clusterlink + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.clusterLinkID + name: ID + type: string + - jsonPath: .status.state + name: Status + type: string + - jsonPath: .status.destinationKafkaClusterID + name: DestClusterID + type: string + - jsonPath: .status.sourceKafkaClusterID + name: SrcClusterID + type: string + - jsonPath: .status.numMirrorTopics + name: MirrorTopicCount + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: ClusterLink is the schema for the ClusterLink API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the cluster link. + properties: + aclFilters: + description: |- + aclFilters specify the list of ACLs to be migrated from the source cluster to the + destination cluster. + items: + description: |- + AclFilter defines the configuration for the ACLs filter. This follows the same pattern as defined in the + cluster linking documentation. More info: + https://docs.confluent.io/platform/current/multi-dc-deployments/cluster-linking/security.html#cluster-link-acls-migrate + properties: + accessFilter: + description: AclSyncAccessFilter defines the access filter for + ACLs. + properties: + host: + description: |- + host is the host for which operations can be coming from. + The default value is `*` that matches all hosts. + type: string + operation: + description: |- + operation specifies the operation type of the filter. It can be `ANY` or operations + based on resource type defined in the following Confluent documentation: + https://docs.confluent.io/platform/current/kafka/authorization.html#acl-operations + type: string + permissionType: + description: permissionType is the permission type of the + filter. Valid options are `any`, `allow`, and `deny`. + enum: + - any + - allow + - deny + type: string + principal: + description: |- + principal is the name of the principal. + The default value is `*`. + type: string + required: + - operation + - permissionType + type: object + resourceFilter: + description: AclSyncResourceFilter specifies the resource filter + for ACLs. + properties: + name: + description: |- + name is the name of the resource associated with this filter. + The default value is `*`. + type: string + patternType: + description: patternType is the pattern of the resource. + Valid options are `prefixed`, `literal`, `any`, and `match`. + enum: + - prefixed + - literal + - any + - match + type: string + resourceType: + description: resourceType is the type of the filter. Valid + options are `any`, `cluster`, `group`, `topic`, `transactionId`, + and `delegationToken`. + enum: + - any + - cluster + - group + - topic + - transcationId + - delegationToken + type: string + required: + - patternType + - resourceType + type: object + required: + - accessFilter + - resourceFilter + type: object + type: array + configs: + additionalProperties: + type: string + description: |- + configs is a map of string key and value pairs. It specifies additional configurations for the cluster link. + More info: https://docs.confluent.io/platform/current/multi-dc-deployments/cluster-linking/configs.html + type: object + x-kubernetes-map-type: granular + consumerGroupFilters: + description: |- + consumerGroupFilters specify a list of consumer groups to be migrated from + the source cluster to the destination cluster. + items: + description: ClusterLinkOptionsFilter defines the scheme for a filter + properties: + filterType: + description: filterType specifies the filter type. Valid options + are `INCLUDE` and `EXCLUDE`. + enum: + - INCLUDE + - EXCLUDE + type: string + name: + description: name is the resource name associated with this + filter. + type: string + patternType: + description: patternType is the pattern of the resource. Valid + options are `PREFIXED` and `LITERAL`. + enum: + - PREFIXED + - LITERAL + type: string + required: + - filterType + - name + - patternType + type: object + type: array + destinationKafkaCluster: + description: destinationKafkaCluster specifies the destination Kafka + cluster and its REST API configuration. + properties: + authentication: + description: authentication specifies the authentication for the + Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side JaaS + configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way to + provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: |- + bootstrapEndpoint specifies the bootstrap endpoint for the Kafka cluster. + When `spec.sourceInitiatedLink.linkMode` is configured as `Source`, this is required for + `spec.destinationKafkaCluster` and not required for `spec.sourceKafkaCluster`. + For other cluster links this is required for `spec.sourceKafkaCluster` and not required for + `spec.destinationKafkaCluster`. + minLength: 1 + pattern: .+:[0-9]+ + type: string + clusterID: + description: |- + clusterID specifies the id of the Kafka cluster. + If clusterID is defined for the Kafka cluster, it takes precedence over using the REST API + for getting the cluster ID. + minLength: 1 + type: string + kafkaRestClassRef: + description: |- + kafkaRestClassRef references the KafkaRestClass application resource which + defines the Kafka REST API connection information. + When `spec.sourceInitiatedLink.linkMode` is configured as `Source`, this is required for + `spec.sourceKafkaCluster` and optional for `spec.destinationKafkaCluster` if `spec.clusterID` is set. + For other cluster links this is required for 'spec.destinationKafkaCluster` and optional for + `spec.sourceKafkaCluster` if the `spec.clusterID` is set. + properties: + name: + description: name specifies the name of the KafkaRestClass + application resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + tls: + description: tls specifies the client-side TLS configuration for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `fullchain.pem`, `privkey.pem`, `cacerts.pem` or `tls.crt`, `tls.key`, `ca.crt` keys are mounted. + minLength: 1 + type: string + enabled: + description: enabled specifies whether to enable the TLS configuration + for the cluster link. The default value is `false`. + type: boolean + keyPassword: + description: |- + keyPassword references the secret containing the SSL key password if the private key passed + in the secretRef above is encrypted. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mirrorTopicOptions: + description: mirrorTopicOptions specify configuration options for + mirror topics. + properties: + autoCreateTopics: + description: |- + autoCreateTopics specifies configurations for the cluster link to + automatically create mirror topics on the destination cluster for topics that exist on the source cluster based on defined filters. + More info: https://docs.confluent.io/platform/current/multi-dc-deployments/cluster-linking/mirror-topics-cp.html#auto-create-mirror-topics + properties: + enabled: + description: |- + enabled specifies whether to auto-create mirror topics based on topics on the source cluster. + When set to “true”, mirror topics will be auto-created. Setting this option to “false” disables mirror topic creation and clears any existing filters. + type: boolean + topicFilters: + description: topicFilter contains an array of filters to apply + to indicate which topics should be mirrored. + items: + description: ClusterLinkOptionsFilter defines the scheme + for a filter + properties: + filterType: + description: filterType specifies the filter type. Valid + options are `INCLUDE` and `EXCLUDE`. + enum: + - INCLUDE + - EXCLUDE + type: string + name: + description: name is the resource name associated with + this filter. + type: string + patternType: + description: patternType is the pattern of the resource. + Valid options are `PREFIXED` and `LITERAL`. + enum: + - PREFIXED + - LITERAL + type: string + required: + - filterType + - name + - patternType + type: object + type: array + type: object + prefix: + description: |- + prefix specifies prefix for the mirror topics of the cluster link. + If configured, the valid mirror topic name should be defined with `` format + which mirrors the topic name of the format `` from source cluster. + When auto-create is enabled and the prefix is configured then the topics created on the destination will automatically contain the prefix. + Otherwise, `spec.mirrorTopic.name` should be defined with `` format. + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9\._\-]*$ + type: string + type: object + mirrorTopics: + description: mirrorTopics specify the mirror topics under this cluster + link. + items: + description: MirrorTopic defines the mirror topic configuration. + properties: + configs: + additionalProperties: + type: string + description: configs is a map of string key and value pairs. + It specifies any additional configuration or configuration + overrides for the mirror topic. + type: object + x-kubernetes-map-type: granular + name: + description: |- + name is the mirror topic name. If the sourceTopicName is not configured, + we assume that the sourceTopicName is the same as mirrorTopicName, + so a topic with the exact same name must exist on the source cluster and + no topic with this name should exist on the destination cluster. + When `spec.mirrorTopicOptions.prefix: ` is configured for the cluster link, + the name has to be of the format ``. + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9\._\-]*$ + type: string + replicationFactor: + description: |- + replicationFactor specifies the replication factor for the mirror topic on the destination cluster. + If this is not configured, mirror topic will inherit the broker `default.replication.factor` configuration. + format: int32 + type: integer + sourceTopicName: + description: |- + sourceTopicName is topic name on the source cluster that will be mirrored to the destination cluster. + When `spec.mirrorTopicOptions.prefix: ` is not configured, you should not configure this field. + If it is configured, a topic with the exact same name must exist on the source cluster. + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9\._\-]*$ + type: string + state: + description: |- + state specifies the desired state for this mirror topic. Valid options are + `ACTIVE`, `FAILOVER`, `PAUSE`, and `PROMOTE`. The default value is `ACTIVE`. + enum: + - PAUSE + - PROMOTE + - FAILOVER + - ACTIVE + type: string + required: + - name + type: object + type: array + name: + description: |- + name specifies the cluster link name. If not configured, then ClusterLink CR name is used + as the cluster link name. + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9\._\-]*$ + type: string + sourceInitiatedLink: + description: sourceInitiatedLink specify configs for source initiated + cluster links. + properties: + linkMode: + description: linkMode specifies if this source initiated cluster + link is in Source or Destination mode. + enum: + - Source + - Destination + - Bidirectional + type: string + required: + - linkMode + type: object + sourceKafkaCluster: + description: sourceKafkaCluster specifies the source Kafka cluster + and its REST API configuration. + properties: + authentication: + description: authentication specifies the authentication for the + Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side JaaS + configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way to + provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: |- + bootstrapEndpoint specifies the bootstrap endpoint for the Kafka cluster. + When `spec.sourceInitiatedLink.linkMode` is configured as `Source`, this is required for + `spec.destinationKafkaCluster` and not required for `spec.sourceKafkaCluster`. + For other cluster links this is required for `spec.sourceKafkaCluster` and not required for + `spec.destinationKafkaCluster`. + minLength: 1 + pattern: .+:[0-9]+ + type: string + clusterID: + description: |- + clusterID specifies the id of the Kafka cluster. + If clusterID is defined for the Kafka cluster, it takes precedence over using the REST API + for getting the cluster ID. + minLength: 1 + type: string + kafkaRestClassRef: + description: |- + kafkaRestClassRef references the KafkaRestClass application resource which + defines the Kafka REST API connection information. + When `spec.sourceInitiatedLink.linkMode` is configured as `Source`, this is required for + `spec.sourceKafkaCluster` and optional for `spec.destinationKafkaCluster` if `spec.clusterID` is set. + For other cluster links this is required for 'spec.destinationKafkaCluster` and optional for + `spec.sourceKafkaCluster` if the `spec.clusterID` is set. + properties: + name: + description: name specifies the name of the KafkaRestClass + application resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + tls: + description: tls specifies the client-side TLS configuration for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `fullchain.pem`, `privkey.pem`, `cacerts.pem` or `tls.crt`, `tls.key`, `ca.crt` keys are mounted. + minLength: 1 + type: string + enabled: + description: enabled specifies whether to enable the TLS configuration + for the cluster link. The default value is `false`. + type: boolean + keyPassword: + description: |- + keyPassword references the secret containing the SSL key password if the private key passed + in the secretRef above is encrypted. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + required: + - destinationKafkaCluster + - sourceKafkaCluster + type: object + status: + description: status defines the observed state of the cluster link. + properties: + appState: + default: Unknown + description: appState is the current state of the cluster link application. + enum: + - Unknown + - Created + - Failed + - Deleted + type: string + clusterLinkID: + description: clusterLinkID is the id of the cluster link. + type: string + clusterLinkName: + description: clusterLinkName is the name of the cluster link. + type: string + conditions: + description: conditions are the latest available observations of the + cluster link's state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + destinationKafkaClusterID: + description: destinationKafkaClusterID is the ID of the destination + Kafka cluster. + type: string + kafkaCluster: + description: 'kafkaCluster is the Kafka cluster this cluster link + belongs to. The format is: `/`' + type: string + mirrorTopics: + additionalProperties: + description: |- + MirrorTopicStatus specifies the status reported for each mirror topic as part of + the cluster link status. + properties: + observedGeneration: + description: observedGeneration is the most recent generation + observed for this Confluent component. + format: int64 + type: integer + replicationFactor: + description: replicationFactor specifies the replication factor + for the mirror topic on the destination cluster. + format: int32 + type: integer + sourceTopicName: + description: sourceTopicName is the name of the topic being + mirrored on the source cluster. + type: string + status: + description: |- + status is the status of the mirror topic. + It can be `ACTIVE`, `FAILED`, `PAUSED`, `STOPPED`, and `PENDING_STOPPED`. + type: string + type: object + description: mirrorTopics is a map of mirror topic name to its status + type: object + x-kubernetes-map-type: granular + numMirrorTopics: + description: numMirrorTopics is the number of mirror topics for the + cluster link. + type: integer + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + sourceKafkaClusterID: + description: sourceKafkaClusterID is the ID of the source Kafka cluster. + type: string + state: + description: state is the current state of the cluster link. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_confluentrolebindings.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_confluentrolebindings.yaml new file mode 100644 index 000000000..8ff4d8c9e --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_confluentrolebindings.yaml @@ -0,0 +1,296 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: confluentrolebindings.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: ConfluentRolebinding + listKind: ConfluentRolebindingList + plural: confluentrolebindings + shortNames: + - cfrb + - confluentrolebinding + singular: confluentrolebinding + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.state + name: Status + type: string + - jsonPath: .status.kafkaClusterID + name: KafkaClusterID + type: string + - jsonPath: .status.principal + name: Principal + type: string + - jsonPath: .status.role + name: Role + type: string + - jsonPath: .status.kafkaRestClass + name: KafkaRestClass + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.kafkaCluster + name: KafkaCluster + priority: 1 + type: string + - jsonPath: .status.clusterRegistryName + name: ClusterRegistryName + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ConfluentRolebinding is the schema for the ConfluentRolebinding + API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the ConfluentRolebinding. + properties: + clustersScopeByIds: + description: clustersScopeByIds specify the scope of the Confluent + component cluster(s) via cluster id(s). + properties: + connectClusterId: + description: connectClusterId specifies the Connect cluster id. + minLength: 1 + type: string + kafkaClusterId: + description: kafkaClusterId specifies the id of the Kafka cluster + id. + minLength: 1 + type: string + ksqlClusterId: + description: ksqlClusterId specifies the ksqlDB cluster id. + minLength: 1 + type: string + schemaRegistryClusterId: + description: schemaRegistryClusterId specifies the Schema Registry + cluster id. + minLength: 1 + type: string + type: object + clustersScopeByRegistryName: + description: clustersScopeByRegistryName specifies the unique cluster + name you registered in the cluster registry. + minLength: 1 + type: string + kafkaRestClassRef: + description: kafkaRestClassRef references the KafkaRestClass that + defines the Kafka REST API connection information. + properties: + name: + description: name specifies the name of the KafkaRestClass application + resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + principal: + description: RolebindingPrincipal defines the principal(user/group) + the rolebinding belongs to. + properties: + name: + description: name specifies the name of the principal. + minLength: 1 + type: string + type: + description: type specifies the type of the principal. Valid options + are `user` and `group`. + enum: + - user + - group + type: string + required: + - name + - type + type: object + resourcePatterns: + description: resourcePatterns specify the qualified resources associated + with this rolebinding. + items: + description: ResourcePattern specifies the qualified resource info + associated with this rolebinding. + properties: + name: + description: name specifies the name of the resource associated + with this rolebinding. + minLength: 1 + type: string + patternType: + description: |- + patternType specifies the pattern of the resource. Valid options are + `PREFIXED` or `LITERAL`. The default value is `LITERAL`. + enum: + - PREFIXED + - LITERAL + type: string + resourceType: + description: |- + resourceType refers to the type of the resource. + Valid options are `Topic`, `Group`, `Subject`, `KsqlCluster`, `Cluster`, `TransactionalId`, etc. + minLength: 1 + type: string + required: + - name + - resourceType + type: object + type: array + role: + description: role specifies the name of the role. + minLength: 1 + type: string + required: + - principal + - role + type: object + status: + description: status is the observed state of the ConfluentRolebinding. + properties: + appState: + default: Unknown + description: appState is the current state of the rolebinding application. + enum: + - Unknown + - Created + - Failed + - Deleted + type: string + clusterRegistryName: + description: clusterRegistryName is the cluster registry name the + rolebinding associated with. + type: string + conditions: + description: conditions are the latest available observations of the + rolebinding's state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + kafkaCluster: + description: 'kafkaCluster is the Kafka cluster the rolebinding belongs + to. The format is: `/`.' + type: string + kafkaClusterID: + description: kafkaClusterID is the id of the Kafka cluster. + type: string + kafkaRestClass: + description: 'kafkaRestClass is the kafkaRestClass this rolebinding + uses. The format is: `/`.' + type: string + mdsEndpoint: + description: mdsEndpoint is the MDS endpoint. + type: string + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + principal: + description: 'principal is the principal the rolebinding belongs to. + The format is: `:`.' + type: string + resourcePatterns: + description: resourcePatterns are the resource patterns this rolebinding + is associated with. + items: + description: ResourcePattern specifies the qualified resource info + associated with this rolebinding. + properties: + name: + description: name specifies the name of the resource associated + with this rolebinding. + minLength: 1 + type: string + patternType: + description: |- + patternType specifies the pattern of the resource. Valid options are + `PREFIXED` or `LITERAL`. The default value is `LITERAL`. + enum: + - PREFIXED + - LITERAL + type: string + resourceType: + description: |- + resourceType refers to the type of the resource. + Valid options are `Topic`, `Group`, `Subject`, `KsqlCluster`, `Cluster`, `TransactionalId`, etc. + minLength: 1 + type: string + required: + - name + - resourceType + type: object + type: array + role: + description: role is the role this rolebinding is associated with. + type: string + state: + description: state is the state of this rolebinding. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_connectors.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_connectors.yaml new file mode 100644 index 000000000..07bf6d1bb --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_connectors.yaml @@ -0,0 +1,496 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: connectors.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: Connector + listKind: ConnectorList + plural: connectors + shortNames: + - ctr + - connector + singular: connector + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.state + name: Status + type: string + - jsonPath: .status.connectorState + name: ConnectorStatus + type: string + - jsonPath: .status.tasksReady + name: Tasks-Ready + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.connectRestEndpoint + name: ConnectEndpoint + priority: 1 + type: string + - jsonPath: .status.failedTasksCount + name: Tasks-Failed + priority: 1 + type: string + - jsonPath: .status.workerID + name: WorkerID + priority: 1 + type: string + - jsonPath: .status.restartPolicy.type + name: RestartPolicy + priority: 1 + type: string + - jsonPath: .status.kafkaClusterID + name: KafkaClusterID + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: Connector is the schema for the Connector API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the Connector. + properties: + class: + description: |- + class specifies the class name of the connector. + The Connect cluster displays the supported class names in its status. + minLength: 1 + type: string + configs: + additionalProperties: + type: string + description: configs is a map of string key and value pairs. It specifies + the additional configurations for the connector. + type: object + x-kubernetes-map-type: granular + connectClusterRef: + description: connectClusterRef references the CFK managed Connect + cluster. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + connectRest: + description: connectRest specifies the Connect REST API connection + configuration. + properties: + authentication: + description: authentication specifies the REST API authentication + mechanism. + properties: + basic: + description: basic specifies the basic authentication settings + for the REST API client. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + bearer: + description: bearer specifies the bearer authentication settings + for the REST API client. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication settings + for the REST API client. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the + basic credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass + the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the REST API authentication type. + Valid options are `basic`, `bearer`, `mtls` and `oauth`. + enum: + - basic + - bearer + - mtls + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies where Confluent REST API is running. + minLength: 1 + pattern: ^https?://.* + type: string + kafkaClusterID: + description: |- + kafkaClusterID specifies the id of Kafka cluster. + It takes precedence over using the Kafka REST API to get the cluster id. + minLength: 1 + type: string + tls: + description: "tls specifies the custom TLS structure for the application + resources,\n\t// e.g. connector, topic, schema, of the Confluent + Platform components.\n\t// +optional" + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `keystore.jks`, `truststore.jks`, `jksPassword.txt` keys are mounted. + minLength: 1 + type: string + jksPassword: + description: jksPassword specifies the secret name that contains + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef specifies the secret name that contains the certificates. + More info about certificates key/value format: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + name: + description: |- + name specifies the connector name. If not configured, + the Connector CR name is used as the connector name. + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9\._\-]*$ + type: string + restartPolicy: + description: restartPolicy specifies the policy to restart failed + tasks of the connector. + properties: + maxRetry: + description: maxRetry specifies the max number of tries to restart + failed tasks when the `restartPolicy` type is `OnFailure`. The + default value is `10`. + format: int32 + minimum: 1 + type: integer + type: + description: |- + type specifies the policy type to restart connector tasks. Valid options are `OnFailure` and `Never`. + Default value is `OnFailure`, which means it will restart automatically when a task fails if the `maxRetry` value is not reached. + enum: + - OnFailure + - Never + type: string + required: + - type + type: object + taskMax: + description: |- + taskMax specifies the maximum number of tasks for the connector. It must be greater than 0. + The connector may create fewer tasks if it cannot achieve this level of parallelism. + format: int32 + minimum: 1 + type: integer + required: + - class + - taskMax + type: object + status: + description: status defines the observed state of the Connector. + properties: + appState: + default: Unknown + description: appState is the current state of the connector application. + enum: + - Unknown + - Created + - Failed + - Deleted + type: string + conditions: + description: conditions are the latest available observations of the + connector state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + connectRestEndpoint: + description: connectRestEndpoint is the REST endpoint of the Connect + cluster. + type: string + connectorState: + description: connectorState is the status of the connector instance. + type: string + failedTasks: + additionalProperties: + description: TaskStatus defines the connector task status. + properties: + id: + description: Id is the id of the task. + format: int32 + type: integer + retryCount: + description: retryCount is the number of retry attempts to restart + the failed task. + format: int32 + type: integer + workerID: + description: workerID is the workerId for the task. + type: string + required: + - id + type: object + description: |- + failedTasks is the map of connector tasks in the `FAILED` state. + Error messages of failed tasks are logged in the CFK logs as `INFO`. + You can also get the error message via Connect REST API calls. + type: object + x-kubernetes-map-type: granular + failedTasksCount: + description: failedTasksCount is the number of failed tasks. + format: int32 + type: integer + kafkaClusterID: + description: kafkaClusterID is the Kafka cluster id the connector + belongs to. + type: string + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + restartPolicy: + description: restartPolicy is the policy to restart failed tasks of + the connector. + properties: + maxRetry: + description: maxRetry specifies the max number of tries to restart + failed tasks when the `restartPolicy` type is `OnFailure`. The + default value is `10`. + format: int32 + minimum: 1 + type: integer + type: + description: |- + type specifies the policy type to restart connector tasks. Valid options are `OnFailure` and `Never`. + Default value is `OnFailure`, which means it will restart automatically when a task fails if the `maxRetry` value is not reached. + enum: + - OnFailure + - Never + type: string + required: + - type + type: object + state: + description: state is the custom resource state of the connector. + This is not the connector state, which can be `CREATED`, `ERROR`, + etc. + type: string + tasksReady: + description: |- + tasksReady is the number of running tasks based on `taskMax`. + The value is in the following format: `/` + type: string + trace: + description: trace is the error trace message for the connector instance. + type: string + workerID: + description: workerID is the workerId of the connector instance. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_connects.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_connects.yaml new file mode 100644 index 000000000..70e45faaa --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_connects.yaml @@ -0,0 +1,6941 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: connects.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: Connect + listKind: ConnectList + plural: connects + shortNames: + - connect + singular: connect + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.readyReplicas + name: Ready + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.kafka.bootstrapEndpoint + name: Kafka + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: Connect is the schema for the Connect API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the Connect cluster. + properties: + authentication: + description: authentication specifies authentication configuration. + properties: + basic: + description: basic specifies the configuration for basic authentication. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth authentication. + properties: + configuration: + description: configuration specifies the OAuth server settings. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the basic + credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass the + required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme for the + REST API server. Valid options are `basic`, `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + authorization: + description: authorization specifies the authorization configuration. + properties: + kafkaRestClassRef: + description: |- + kafkaRestClassRef references the KafkaRestClass + which specifies the Kafka REST API connection configuration. + properties: + name: + description: name specifies the name of the KafkaRestClass + application resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + type: + description: type specifies the client-side authorization type. + The valid option is `rbac`. + enum: + - rbac + type: string + required: + - type + type: object + build: + description: build defines the build configurations for connector + plugins. + properties: + onDemand: + description: OnDemand defines the build configurations for the + `onDemand` build type. + properties: + plugins: + description: plugins define the installation information for + connector plugins. + properties: + confluentHub: + description: confluentHub contains a list of connector + plugins you get from Confluent Hub. + items: + description: ConfluentHubPlugin contains the required + information to get the connector plugin from Confluent + Hub. + properties: + name: + description: name specifies the name of the connector + plugin. + minLength: 1 + type: string + owner: + description: owner specifies the individual or organization + that provides the connector plugin, for example, + `confluentinc`. + minLength: 1 + type: string + version: + description: version specifies the version of the + connector plugin, which can be either the version + of the plugin or the literal `latest`. + minLength: 1 + type: string + required: + - name + - owner + - version + type: object + type: array + locationType: + description: This field is deprecated and will be ignored + if set. + enum: + - confluentHub + - url + type: string + url: + description: url contains a list of URL plugins you get + from external URLs. + items: + description: URLPlugin defines the information to get + the connector plugin from an external URL. + properties: + archivePath: + description: |- + archivePath specifies the archive path of the connector plugin. + Currently, only support ZIP archives. + minLength: 1 + pattern: ^https?://.* + type: string + checksum: + description: |- + checksum defines the sha512sum checksum of the connector plugin's remote file. + It is used to verify the remote file after it is downloaded. + type: string + name: + description: name specifies the connector plugin + name. + minLength: 1 + type: string + required: + - archivePath + - checksum + - name + type: object + type: array + type: object + storageLimit: + anyOf: + - type: integer + - type: string + description: storageLimit specifies the max amount of node + volume that can be used to store connector plugins. The + default value is `4G`. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + required: + - plugins + type: object + type: + description: type specifies the build type for connector plugins. + Currently only the `onDemand` type is supported. + enum: + - onDemand + type: string + required: + - type + type: object + configOverrides: + description: configOverrides specifies the configs to override the + server, JVM, Log4j properties for the Connect cluster. + properties: + jvm: + description: |- + jvm is a list of JVM configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + log4j: + description: |- + log4j is a list of Log4J configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + server: + description: |- + server is a list of server configuration supported by the Confluent Platform component. + This will either add or update existing configuration. + items: + type: string + type: array + type: object + connectorOverridePolicy: + description: |- + connectorOverridePolicy allows the policy to permit per-connector override configuration + for producer/consumer/admin prefix. + More info: https://docs.confluent.io/platform/current/connect/security.html#separate-principals + enum: + - All + - Principal + type: string + connectorTLSCerts: + description: |- + connectorTLSCerts are the custom TLS certificates injected into the Connect cluster for connectors to use. + Check the Connect status for the mount path of the certificates. + A change will roll the cluster. + items: + description: MountedCustomTLSCertificate defines the mounted custom + TLS structure for the Confluent Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `keystore.jks`, `truststore.jks`, `jksPassword.txt` keys are mounted. + minLength: 1 + type: string + jksPassword: + description: jksPassword specifies the secret name that contains + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef specifies the secret name that contains the certificates. + More info about certificates key/value format: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: array + dependencies: + description: ConnectDependencies contains the dependencies the Connect + requires or can enable. + properties: + admin: + description: |- + admin contains the security configuration to connect to the admin client. + If `bootstrapEndpoint` is not configured, the security is configured based on the Kafka dependency configuration. + Configure this property if different bootstrap endpoint is required for the admin client. + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + consumer: + description: |- + consumer contains the security configuration to connect to the Kafka cluster. It is used for sink connectors. + If `bootstrapEndpoint` is not configured, the security is configured based on the Kafka dependency configuration. + Configure this property if different bootstrap endpoint is required for the consumer. + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + interceptor: + description: interceptor contains the dependency configuration + for the monitoring interceptor. + properties: + configs: + description: |- + configs describe the configurations for the Confluent Platform interceptor. + The config override feature can be used to pass the configuration settings. + items: + type: string + type: array + consumer: + description: |- + consumer specifies the consumer configuration for the interceptor. If not + configured, it uses the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication + for the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another + way to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + enabled: + description: enabled indicates whether the Confluent Platform + interceptor is enabled or disabled. + type: boolean + producer: + description: |- + producer specifies the producer configuration for the interceptor. If not + configured, it uses the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication + for the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another + way to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + publishMs: + type: integer + required: + - enabled + type: object + kafka: + description: kafka contains the Connect dependency for connecting + to Kafka. The discovery method is used if this is not specified. + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + licenseCluster: + description: |- + licenseCluster contains the security configuration to connect to the License containing Kafka cluster.Note that this entry is only needed + if the license topic is stored on a different Kafka cluster than the Kafka cluster that Connect uses. + properties: + kafka: + description: |- + KafkaClientDependency configures the Confluent Platform component dependency + for the Kafka cluster. + properties: + authentication: + description: authentication defines the authentication + for the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another + way to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + topic: + description: The name of the Kafka topic where the license + is stored. This defaults to _confluent-command. + type: string + type: object + mds: + description: mds contains the configuration for MDS dependency + when RBAC is enabled. + properties: + authentication: + description: authentication specifies the client side authentication + configuration for the MDS. + properties: + bearer: + description: bearer specifies the bearer authentication + settings. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication + settings. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication method + for the MDS. The valid option is `bearer`, `oauth`. + enum: + - bearer + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies the MDS endpoint. + minLength: 1 + pattern: ^https?://.* + type: string + ssoProtocol: + description: sso protocol, valid options are ldap and oidc. + enum: + - ldap + - oidc + type: string + tls: + description: ClientTLSConfig specifies the TLS configuration + for the Confluent component (dependencies, listeners). + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + tokenKeyPair: + description: tokenKeyPair specifies the token keypair to configure + the MDS. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the MDS token key pair are mounted. + minLength: 1 + type: string + encryptedTokenKey: + description: |- + EncryptedTokenKey boolean value indicating whether the tokenKeypair(private used for signing) is encrypted using a passphrase. If true, cfk + operator will look for a file named mdsTokenKeyPassphrase.txt containing key value pair + mdsTokenKeyPassphrase=. Relevant only for mds server. Ignored if set for a client configuration. + type: boolean + secretRef: + description: secretRef references the name of the secret + that contains the MDS token key pair. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - authentication + - endpoint + - tokenKeyPair + type: object + producer: + description: |- + producer contains the security configuration to connect to the Kafka cluster. It is used for source connectors. + If `bootstrapEndpoint` is not configured, the security is configured based on the Kafka dependency configuration. + Configure this property if different bootstrap endpoint of security is required for the producer. + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + schemaRegistry: + description: schemaRegistry contains the dependency configuration + for the Schema Registry cluster. + properties: + authentication: + description: authentication specifies the authentication for + the Schema Registry cluster. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + tls: + description: tls defines the client-side TLS setting for the + Schema Registry cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the Schema + Registry cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - url + type: object + type: object + enableExternalInterInstance: + description: |- + ExternalInterInstance is only needed for multi-cluster deployment or stretch cluster. + when set to true the connect server will use the external listener for inter-instance communication. + type: boolean + enableSchemas: + description: enableSchemas indicates whether to enable scheme or not. + type: boolean + externalAccess: + description: CPExternalAccess holds all external access policies for + the non-Kafka component clusters. + properties: + loadBalancer: + description: loadBalancer specifies the configuration to create + a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are `Local` + and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided service + port(s). + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create a + Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create a route + service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the Confluent + component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + headlessService: + description: headlessService specifies the configuration of the Kubernetes + headless service. + properties: + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs. + It specifies the annotations to be added to the CFK-created headless service. + These annotations are merged with the injectAnnotations and take precedence. + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs. + It specifies the labels to be added to the CFK-created headless service. + These labels are merged with the injectLabels and take precedence. + type: object + x-kubernetes-map-type: granular + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses specifies the publishNotReadyAddresses field. + For Kafka, this value must be true. The default value is true. + type: boolean + type: object + image: + description: |- + image specifies the application and the init docker image configurations. + A change to this setting will roll the cluster. + properties: + application: + description: |- + application is the Docker image name of the application. Specify + `//:`. + pattern: .+:.+ + type: string + init: + description: |- + init is the init-container name. Specify + `//:`. + pattern: .+:.+ + type: string + pullPolicy: + description: |- + pullPolicy is the policy for pulling images. Valid options are `Always`, `Never`, and `IfNotPresent`. + The default value is `IfNotPresent`. + enum: + - Always + - Never + - IfNotPresent + type: string + pullSecretRef: + description: |- + pullSecretRef references the secrets in the same namespace to be used for pulling images. + Image pull secrets are distinct from secrets because secrets + can be mounted in the pod, but image pull secrets are only accessed by `kubelet`. + More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod + items: + type: string + type: array + required: + - application + - init + type: object + injectAnnotations: + additionalProperties: + type: string + description: |- + injectAnnotations are the annotations injected to the internal resources that CFK created. + The internal annotations are preserved and cannot be overridden. + For pod annotations, use `podTemplate.annotations`. + type: object + x-kubernetes-map-type: granular + injectLabels: + additionalProperties: + type: string + description: |- + injectLabels are the labels injected to the internal resources that CFK created. + The internal labels are preserved and cannot be overridden. + For pod labels, use `podTemplate.labels`. + type: object + x-kubernetes-map-type: granular + internalTopicReplicationFactor: + description: |- + internalTopicReplicationFactor specifies the replication factor for the internal topics. + The default value is `3`. + format: int32 + type: integer + k8sClusterDomain: + description: |- + k8sClusterDomain specifies the configuration of the Kubernetes cluster domain. + The default is the `cluster.local` domain. + type: string + keyConverterType: + description: |- + keyConverterType specifies the supported key converters package for the Confluent Platform. + For the supported converter types, see https://docs.confluent.io/current/connect/concepts.html#connect-converters. + The default value is `org.apache.kafka.connect.json.JsonConverter`. + minLength: 1 + type: string + license: + description: license specifies the license configuration for the Confluent + Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + the license key is mounted. More info: + https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + minLength: 1 + type: string + globalLicense: + description: globalLicense specifies whether the Confluent Platform + component shares the common global license. + type: boolean + secretRef: + description: |- + secretRef references the secret that provides the license for the Confluent Platform component. + More info: https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + metrics: + description: metrics specify the security settings for the metric + services. + properties: + authentication: + description: authentication specifies the authentication configuration + for the metrics. + properties: + type: + description: type specifies the metrics authentication method. + The valid option is `mtls`. + enum: + - mtls + type: string + required: + - type + type: object + prometheus: + description: prometheus specifies the configuration overrides + for the JMX-Prometheus exporter. + properties: + blacklist: + items: + type: string + type: array + rules: + items: + description: Rule defines the Prometheus Exporter rule override. + properties: + attrNameSnakeCase: + type: boolean + cache: + type: boolean + help: + minLength: 1 + type: string + labels: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: granular + name: + minLength: 1 + type: string + pattern: + minLength: 1 + type: string + type: + minLength: 1 + type: string + value: + minLength: 1 + type: string + valueFactor: + anyOf: + - type: integer + - type: string + default: 1 + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: array + whitelist: + items: + type: string + type: array + type: object + tls: + description: tls specifies the TLS configuration for the metrics. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mountedSecrets: + description: |- + mountedSecrets list the secrets injected to + the underlying statefulset configuration. The secret reference is mounted + in the default path `/mnt/secrets/`. The underlying resources + will follow the secret as a file configuration. + More info: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. + A change to this setting will roll the cluster. + items: + description: |- + MountedSecrets provides a way to inject a custom secret to the underlying + statefulset. + properties: + keyItems: + description: keyItems are key and path names. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + secretRef: + description: secretRef references the name of the secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + type: array + mountedVolumes: + description: |- + mountedVolumes list the custom volumes that need to be mounted into the + underlying statefulset. + A change to this setting will roll the cluster. + properties: + volumeMounts: + description: |- + volumeMounts specify the list of volume mounts for the pods in the + statefulset. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + volumes specify the list of volumes that can be mounted into the pods + of statefulset. + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + format: int32 + type: integer + readOnly: + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: boolean + volumeID: + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in + the blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the + blob storage + type: string + fsType: + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. + properties: + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime + properties: + monitors: + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is /' + type: string + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: boolean + secretFile: + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + secretRef: + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + required: + - monitors + type: object + cinder: + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: boolean + secretRef: + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should + populate this volume + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume + properties: + defaultMode: + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: Items is a list of downward API volume + file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must not + be absolute or contain the ''..'' path. Must + be utf-8 encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. + + + A pod can use both types of ephemeral volumes and + persistent volumes at the same time. + properties: + volumeClaimTemplate: + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. + + + Required, must not be nil. + properties: + metadata: + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. + type: object + spec: + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over + volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#volumeattributesclass + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + items: + type: string + type: array + type: object + flexVolume: + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use + for this volume. + type: string + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds + extra command options if any.' + type: object + readOnly: + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running + properties: + datasetName: + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + properties: + fsType: + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + format: int32 + type: integer + pdName: + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: boolean + required: + - pdName + type: object + gitRepo: + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. + properties: + directory: + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md + properties: + endpoints: + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + path: + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + readOnly: + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. + properties: + path: + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + type: + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + required: + - path + type: object + iscsi: + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication + type: boolean + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + initiatorName: + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + nfs: + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + properties: + path: + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + readOnly: + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: boolean + server: + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine + properties: + fsType: + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx + volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along + with other supported volume types + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume + root to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + required: + - path + type: object + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the + ConfigMap or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the + downwardAPI data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute or + contain the ''..'' path. Must be utf-8 + encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env + vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource + to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + format: int64 + type: integer + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: |- + group to map volume access to + Default is no group + type: string + readOnly: + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. + type: boolean + registry: + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes + type: string + tenant: + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin + type: string + user: + description: |- + user to map volume access to + Defaults to serivceaccount user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + image: + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + keyring: + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + monitors: + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + items: + type: string + type: array + pool: + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: boolean + secretRef: + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. + type: string + system: + description: system is the name of the storage system + as configured in ScaleIO. + type: string + volumeName: + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume + names are only unique within a namespace. + type: string + volumeNamespace: + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - volumeMounts + - volumes + type: object + oneReplicaPerNode: + description: |- + oneReplicaPerNode controls whether to run 1 pod per node using the pod anti-affinity capability. + Enabling this configuration in an existing cluster will roll the cluster. + type: boolean + pdb: + description: |- + configures PodDisruptionBudget for the Confluent Platform component. + by default PDB is configured based on pre-detemined formula. + properties: + enabled: + description: enabled specifies whether the PodDisruptionBudget + is enabled + type: boolean + maxUnavailable: + description: maxUnavailable is the maximum number of pods that + can be unavailable during the disruption. + format: int32 + type: integer + required: + - enabled + type: object + podTemplate: + description: podTemplate specifies the statefulset pod template configuration. + properties: + affinity: + description: |- + affinity specifies a group of affinity scheduling rules. + More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs stored with the resource and + may be set by external tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying objects. More + info: http://kubernetes.io/docs/user-guide/annotations. + type: object + x-kubernetes-map-type: granular + envVars: + description: |- + envVars contain environment variables to be injected into containers. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs that can be used to organize and categorize + (scope and select) objects. + More info: http://kubernetes.io/docs/user-guide/labels. + type: object + x-kubernetes-map-type: granular + podSecurityContext: + description: |- + PodSecurityContext holds pod-level security attributes and common container settings. + Some fields are also present in container.securityContext. Field values of + container.securityContext take precedence over field values of PodSecurityContext. + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + priorityClassName: + description: priorityClassName specifies the priority class for + the pod (if any). + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + probe: + description: probe contains the fields for standard Kubernetes + readiness/liveness probe configuration. + properties: + liveness: + description: |- + liveness configures the Kubernetes probe settings. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + readiness: + description: |- + readiness configures the Kubernetes probe setting. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + type: object + resources: + description: resources describe the compute resource requirements. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: |- + SecurityContext holds security configuration that will be applied to a container. + Some fields are present in both SecurityContext and PodSecurityContext. When both + are set, the values in SecurityContext take precedence. + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the service account used to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account. + type: string + terminationGracePeriodSeconds: + description: terminationGracePeriodSeconds is the grace period + before the pod is deleted. + format: int64 + type: integer + tolerations: + description: |- + tolerations specify the pods to schedule onto the nodes with matching taints, using + the triple `` and the matching operator ``. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + topologySpreadConstraints describe how a group of pods ought to spread across topology domains. Scheduler will + schedule pods based on the constraints. All topologySpreadConstraints are ANDed. + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + + + This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + replicas: + description: |- + replicas is the desired number of replicas. + A change to this setting will roll the cluster. + format: int32 + type: integer + telemetry: + description: telemetry specifies the Confluent telemetry reporter + configuration. + properties: + global: + description: |- + global allows disabling telemetry configuration. + If CFK is deployed with telemetry, this field is only + used to disable telemetry. The default value is `true` if + telemetry is enabled at the global level. + type: boolean + type: object + tls: + description: tls specifies the global-level TLS configuration. + properties: + autoGeneratedCerts: + description: |- + autoGeneratedCerts specifies that the certificates are auto-generated based on + the CA key pair provided. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the cp component's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS + configuration for cp components. + type: boolean + required: + - enabled + type: object + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing the + JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + valueConverterType: + description: |- + valueConverterType specifies the supported value converters package for the Confluent Platform. + For the supported converter types, see https://docs.confluent.io/current/connect/concepts.html#connect-converters. + The default value is `org.apache.kafka.connect.json.JsonConverter`. + minLength: 1 + type: string + required: + - image + type: object + status: + description: status defines the observed state of the Connect cluster. + properties: + arbitraryData: + description: arbitraryData is the map for any arbitrary data associated + with this Confluent component. + x-kubernetes-preserve-unknown-fields: true + authorizationType: + description: authorizationType is the authorization type for this + Confluent component. + type: string + clusterName: + description: clusterName is the name of the Confluent Platform component + cluster. + type: string + clusterNamespace: + description: clusterNamespace is the namespace where the Confluent + Platform component cluster is running. + type: string + conditions: + description: conditions specify the latest available observations + of the current state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + connectorPlugins: + description: connectorPlugins are the installed connector plugins. + items: + description: ConnectorPluginStatus defines the state of the connector + plugin. + properties: + class: + description: class specifies the class name of the connector + plugin. + type: string + type: + description: type is the connector plugin type, which can be + `SOURCE`, `SINK` or `UNKNOWN`. + type: string + version: + description: version is the current version of the connector + plugin. + type: string + required: + - class + type: object + type: array + connectorTLSFilePaths: + description: connectorTLSFilePaths are the connector TLS file paths. + items: + description: CustomTLSFilePathStatus specifies the file paths of + the custom TLS certificates. + properties: + jksPasswordPath: + description: jksPasswordPath contains the absolute path of the + `jksPassword.txt` file. + type: string + keyStorePath: + description: keyStorePath contains the absolute path of the + keystore file, `.jks` or `.p12`. + type: string + trustStorePath: + description: trustStorePath contains the absolute path of the + truststore file, `.jks` or `.p12`. + type: string + type: object + type: array + currentReplicas: + description: currentReplicas is the number of currently running replicas. + format: int32 + type: integer + groupID: + description: groupID is the group id of the Connect cluster. + type: string + internalSecrets: + description: |- + internalSecrets are internal secrets created + by CFK for this Confluent component. + items: + type: string + type: array + internalTopicNames: + description: internalTopicNames are the topics used by the component + for internal use. + items: + type: string + type: array + kafka: + description: kafka is the Kafka client side status for the Connect + cluster. + properties: + authenticationType: + description: authenticationType describes the authentication method + for the Kafka cluster. + type: string + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap endpoint. + type: string + tls: + description: tls indicates whether TLS is enabled for the Kafka + dependency. + type: boolean + type: object + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + operatorVersion: + description: operatorVersion is the internal version of CFK. + type: string + phase: + description: |- + phase describes the state of the Confluent Platform component. This can either be 'PROVISIONING' + or 'RUNNING' + 'PROVISIONING' means the Confluent Platform component is currently getting deployed and not ready yet. + 'RUNNING' means the Confluent Platform component has been successfully deployed. + type: string + rbac: + description: rbac contains the RBAC-related status when RBAC is enabled. + properties: + clusterID: + description: clusterID specifies the id of the cluster. + type: string + internalRolebindings: + description: internalRolebindings specifies the internal rolebindings. + items: + type: string + type: array + type: object + readyReplicas: + description: readyReplicas is the number of currently ready replicas. + format: int32 + type: integer + replicas: + description: replicas is the number of replicas. + format: int32 + type: integer + restConfig: + description: restConfig is the REST configuration of the Connect cluster. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + selector: + description: |- + selector gets the label selector of the child pod. + The Horizontal Pod Autoscaler(HPA) will scale using the label selector of the child pod. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_controlcenters.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_controlcenters.yaml new file mode 100644 index 000000000..0b1288d2f --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_controlcenters.yaml @@ -0,0 +1,6394 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: controlcenters.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: ControlCenter + listKind: ControlCenterList + plural: controlcenters + shortNames: + - controlcenter + - c3 + singular: controlcenter + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.readyReplicas + name: Ready + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.kafka.bootstrapEndpoint + name: Kafka + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ControlCenter is the schema for the Control Center API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the Control Center cluster. + properties: + authentication: + description: authentication specifies the authentication configurations. + properties: + basic: + description: basic specifies the configuration for basic authentication. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + ldap: + description: ldap specifies the configuration for Control Center + LDAP authentication. + properties: + debug: + description: debug enables basic authentication debug logs + for JaaS configuration. + type: boolean + property: + additionalProperties: + type: string + description: |- + property is a map of string key and value pairs that specifies the LDAP configuration. + Use a secret object to pass username/password. + type: object + x-kubernetes-map-type: granular + restrictedRoles: + description: restrictedRoles specify the restricted access + roles. + items: + type: string + minItems: 1 + type: array + roles: + description: roles specify the roles on the server side only. + items: + type: string + minItems: 1 + type: array + secretRef: + description: |- + secretRef references the secret to pass required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#ldap-authentication-for-c3 + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: type specifies the authentication type of the Control + Center. Valid options are `basic`, `ldap`, and `mtls`. + enum: + - basic + - ldap + - mtls + type: string + required: + - type + type: object + authorization: + description: authorization specifies the authorization configurations. + properties: + kafkaRestClassRef: + description: |- + kafkaRestClassRef references the KafkaRestClass + which specifies the Kafka REST API connection configuration. + properties: + name: + description: name specifies the name of the KafkaRestClass + application resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + type: + description: type specifies the client-side authorization type. + The valid option is `rbac`. + enum: + - rbac + type: string + required: + - type + type: object + configOverrides: + description: configOverrides specifies the configs to override the + server, JVM, Log4j properties for the Control Center. + properties: + jvm: + description: |- + jvm is a list of JVM configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + log4j: + description: |- + log4j is a list of Log4J configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + server: + description: |- + server is a list of server configuration supported by the Confluent Platform component. + This will either add or update existing configuration. + items: + type: string + type: array + type: object + dataVolumeCapacity: + anyOf: + - type: integer + - type: string + description: dataVolumeCapacity specifies the data size for the persistent + volume. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + dependencies: + description: dependencies specify the dependencies configurations. + properties: + connect: + description: connect defines the Connect worker dependency configurations. + items: + description: ControlCenterConnectDependency defines the Connect + dependency settings. + properties: + authentication: + description: authentication specifies the authentication + configuration for the Connect cluster. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience + claim in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max + retry backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry + backoff with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of + claim in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to + pass the basic credential through a directory + path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference + to pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + name: + description: name specifies the Connect cluster name. + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + tls: + description: tls specifies the client-side TLS setting for + the Connect cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the Connect + cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - name + - url + type: object + type: array + kafka: + description: kafka defines the Kafka dependency configurations. + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + ksqldb: + description: ksqldb defines the ksqlDB dependency configurations. + items: + description: ControlCenterKSQLDependency defines the ksqlDB + dependency settings. + properties: + advertisedUrl: + description: advertisedUrl specifies the advertised URL + to use in the browser. + minLength: 1 + pattern: ^https?://.* + type: string + authentication: + description: authentication specifies the authentication + for the ksqlDB cluster. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience + claim in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max + retry backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry + backoff with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of + claim in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to + pass the basic credential through a directory + path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference + to pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + name: + description: name specifies the ksqlDB cluster name. + minLength: 1 + type: string + tls: + description: tls specifies the client-side TLS setting for + the ksqlDB cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the ksqlDB + cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - name + - url + type: object + type: array + mds: + description: mds defines the RBAC dependency configurations. + properties: + authentication: + description: authentication specifies the client side authentication + configuration for the MDS. + properties: + bearer: + description: bearer specifies the bearer authentication + settings. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication + settings. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication method + for the MDS. The valid option is `bearer`, `oauth`. + enum: + - bearer + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies the MDS endpoint. + minLength: 1 + pattern: ^https?://.* + type: string + ssoProtocol: + description: sso protocol, valid options are ldap and oidc. + enum: + - ldap + - oidc + type: string + tls: + description: ClientTLSConfig specifies the TLS configuration + for the Confluent component (dependencies, listeners). + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + tokenKeyPair: + description: tokenKeyPair specifies the token keypair to configure + the MDS. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the MDS token key pair are mounted. + minLength: 1 + type: string + encryptedTokenKey: + description: |- + EncryptedTokenKey boolean value indicating whether the tokenKeypair(private used for signing) is encrypted using a passphrase. If true, cfk + operator will look for a file named mdsTokenKeyPassphrase.txt containing key value pair + mdsTokenKeyPassphrase=. Relevant only for mds server. Ignored if set for a client configuration. + type: boolean + secretRef: + description: secretRef references the name of the secret + that contains the MDS token key pair. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - authentication + - endpoint + - tokenKeyPair + type: object + schemaRegistry: + description: schemaRegistry defines the Schema Registry dependency + configurations. + properties: + authentication: + description: authentication specifies the authentication for + the Schema Registry cluster. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + clusters: + items: + description: ControlCenterMultiSchemaRegistryDependency + defines the Schema Registry dependency List. + properties: + authentication: + description: authentication specifies the authentication + for the Schema Registry cluster. + properties: + basic: + description: basic specifies the configuration for + basic authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for + OAuth authentication. + properties: + configuration: + description: configuration specifies the OAuth + server settings. + properties: + audience: + description: audience specifies the audience + claim in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the + expected issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the + name of claim in token for identifying + the groups of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets + connect timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read + timeout with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets + max retry backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry + backoff with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name + of claim in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows + to pass the basic credential through a directory + path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference + to pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + name: + description: name defines the Schema Registry cluster + name. + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + tls: + description: tls defines the client-side TLS setting + for the Schema Registry cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS + configuration for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the Schema + Registry cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - name + - url + type: object + type: array + tls: + description: tls defines the client-side TLS setting for the + Schema Registry cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the Schema + Registry cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - url + type: object + type: object + externalAccess: + description: externalAccess specifies the external access configuration + for the Control Center cluster. + properties: + loadBalancer: + description: loadBalancer specifies the configuration to create + a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are `Local` + and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided service + port(s). + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create a + Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create a route + service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the Confluent + component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + headlessService: + description: headlessService specifies the configuration of the Kubernetes + headless service. + properties: + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs. + It specifies the annotations to be added to the CFK-created headless service. + These annotations are merged with the injectAnnotations and take precedence. + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs. + It specifies the labels to be added to the CFK-created headless service. + These labels are merged with the injectLabels and take precedence. + type: object + x-kubernetes-map-type: granular + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses specifies the publishNotReadyAddresses field. + For Kafka, this value must be true. The default value is true. + type: boolean + type: object + id: + description: |- + id specifies the prefix used for this instance of Control Center + when multiple instances of Control Center co-exist. + format: int32 + type: integer + image: + description: |- + image specifies the application and the init docker image configurations. + A change to this setting will roll the cluster. + properties: + application: + description: |- + application is the Docker image name of the application. Specify + `//:`. + pattern: .+:.+ + type: string + init: + description: |- + init is the init-container name. Specify + `//:`. + pattern: .+:.+ + type: string + pullPolicy: + description: |- + pullPolicy is the policy for pulling images. Valid options are `Always`, `Never`, and `IfNotPresent`. + The default value is `IfNotPresent`. + enum: + - Always + - Never + - IfNotPresent + type: string + pullSecretRef: + description: |- + pullSecretRef references the secrets in the same namespace to be used for pulling images. + Image pull secrets are distinct from secrets because secrets + can be mounted in the pod, but image pull secrets are only accessed by `kubelet`. + More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod + items: + type: string + type: array + required: + - application + - init + type: object + injectAnnotations: + additionalProperties: + type: string + description: |- + injectAnnotations are the annotations injected to the internal resources that CFK created. + The internal annotations are preserved and cannot be overridden. + For pod annotations, use `podTemplate.annotations`. + type: object + x-kubernetes-map-type: granular + injectLabels: + additionalProperties: + type: string + description: |- + injectLabels are the labels injected to the internal resources that CFK created. + The internal labels are preserved and cannot be overridden. + For pod labels, use `podTemplate.labels`. + type: object + x-kubernetes-map-type: granular + internalTopicReplicatorFactor: + description: internalTopicReplicationFactor specifies the replication + factor for internal topics. + format: int32 + type: integer + k8sClusterDomain: + description: |- + k8sClusterDomain specifies the configuration of the Kubernetes cluster domain. + The default is the `cluster.local` domain. + type: string + license: + description: license specifies the license configuration for the Confluent + Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + the license key is mounted. More info: + https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + minLength: 1 + type: string + globalLicense: + description: globalLicense specifies whether the Confluent Platform + component shares the common global license. + type: boolean + secretRef: + description: |- + secretRef references the secret that provides the license for the Confluent Platform component. + More info: https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + mail: + description: |- + mail specifies the settings that control the SMTP server and + account used when an alert triggers an email action. + properties: + authentication: + description: |- + authentication specifies the authentication for SMTP. SMP only supports basic authentication. + For other types of authentication, use the config overrides capability. + properties: + basic: + description: basic specifies the configuration for basic authentication. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the + basic credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass + the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme for + the REST API client. Valid options are `basic`, `oauth` + and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + checkServerIdentity: + description: checkServerIdentity forces validation of server’s + certificate when using STARTTLS or SSL. + type: boolean + hostname: + description: hostname is the hostname of the outgoing SMTP server. + minLength: 1 + type: string + mailBounceAddress: + description: mailBounceAddress is the override for the `mailFrom` + config to send message. + minLength: 1 + type: string + mailFrom: + description: mailFrom is the originating address for emails sent + from the Control Center. + minLength: 1 + type: string + port: + description: port is the SMTP port open on the hostname. + format: int32 + type: integer + startTLSRequired: + description: startTLSRequired forces using STARTTLS. + type: boolean + required: + - hostname + type: object + metrics: + description: metrics specify the security settings for the metric + services. + properties: + authentication: + description: authentication specifies the authentication configuration + for the metrics. + properties: + type: + description: type specifies the metrics authentication method. + The valid option is `mtls`. + enum: + - mtls + type: string + required: + - type + type: object + prometheus: + description: prometheus specifies the configuration overrides + for the JMX-Prometheus exporter. + properties: + blacklist: + items: + type: string + type: array + rules: + items: + description: Rule defines the Prometheus Exporter rule override. + properties: + attrNameSnakeCase: + type: boolean + cache: + type: boolean + help: + minLength: 1 + type: string + labels: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: granular + name: + minLength: 1 + type: string + pattern: + minLength: 1 + type: string + type: + minLength: 1 + type: string + value: + minLength: 1 + type: string + valueFactor: + anyOf: + - type: integer + - type: string + default: 1 + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: array + whitelist: + items: + type: string + type: array + type: object + tls: + description: tls specifies the TLS configuration for the metrics. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + monitoringKafkaClusters: + description: monitoringKafkaClusters specify the configurations for + the Kafka clusters that this Control Center monitors. + items: + description: MonitoringKafkaClusters defines the configuration of + the additional Kafka clusters the Control Center monitors. + properties: + authentication: + description: authentication defines the authentication for the + Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in + the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in + JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used to + discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + name: + description: name defines the Kafka cluster name. + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - name + type: object + type: array + mountedSecrets: + description: |- + mountedSecrets list the secrets injected to + the underlying statefulset configuration. The secret reference is mounted + in the default path `/mnt/secrets/`. The underlying resources + will follow the secret as a file configuration. + More info: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. + A change to this setting will roll the cluster. + items: + description: |- + MountedSecrets provides a way to inject a custom secret to the underlying + statefulset. + properties: + keyItems: + description: keyItems are key and path names. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + secretRef: + description: secretRef references the name of the secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + type: array + mountedVolumes: + description: |- + mountedVolumes list the custom volumes that need to be mounted into the + underlying statefulset. + A change to this setting will roll the cluster. + properties: + volumeMounts: + description: |- + volumeMounts specify the list of volume mounts for the pods in the + statefulset. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + volumes specify the list of volumes that can be mounted into the pods + of statefulset. + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + format: int32 + type: integer + readOnly: + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: boolean + volumeID: + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in + the blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the + blob storage + type: string + fsType: + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. + properties: + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime + properties: + monitors: + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is /' + type: string + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: boolean + secretFile: + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + secretRef: + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + required: + - monitors + type: object + cinder: + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: boolean + secretRef: + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should + populate this volume + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume + properties: + defaultMode: + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: Items is a list of downward API volume + file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must not + be absolute or contain the ''..'' path. Must + be utf-8 encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. + + + A pod can use both types of ephemeral volumes and + persistent volumes at the same time. + properties: + volumeClaimTemplate: + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. + + + Required, must not be nil. + properties: + metadata: + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. + type: object + spec: + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over + volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#volumeattributesclass + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + items: + type: string + type: array + type: object + flexVolume: + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use + for this volume. + type: string + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds + extra command options if any.' + type: object + readOnly: + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running + properties: + datasetName: + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + properties: + fsType: + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + format: int32 + type: integer + pdName: + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: boolean + required: + - pdName + type: object + gitRepo: + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. + properties: + directory: + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md + properties: + endpoints: + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + path: + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + readOnly: + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. + properties: + path: + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + type: + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + required: + - path + type: object + iscsi: + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication + type: boolean + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + initiatorName: + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + nfs: + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + properties: + path: + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + readOnly: + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: boolean + server: + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine + properties: + fsType: + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx + volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along + with other supported volume types + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume + root to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + required: + - path + type: object + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the + ConfigMap or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the + downwardAPI data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute or + contain the ''..'' path. Must be utf-8 + encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env + vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource + to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + format: int64 + type: integer + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: |- + group to map volume access to + Default is no group + type: string + readOnly: + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. + type: boolean + registry: + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes + type: string + tenant: + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin + type: string + user: + description: |- + user to map volume access to + Defaults to serivceaccount user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + image: + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + keyring: + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + monitors: + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + items: + type: string + type: array + pool: + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: boolean + secretRef: + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. + type: string + system: + description: system is the name of the storage system + as configured in ScaleIO. + type: string + volumeName: + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume + names are only unique within a namespace. + type: string + volumeNamespace: + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - volumeMounts + - volumes + type: object + name: + description: name is the Control Center cluster name. + type: string + oneReplicaPerNode: + description: |- + oneReplicaPerNode controls whether to run 1 pod per node using the pod anti-affinity capability. + Enabling this configuration in an existing cluster will roll the cluster. + type: boolean + pdb: + description: |- + configures PodDisruptionBudget for the Confluent Platform component. + by default PDB is configured based on pre-detemined formula. + properties: + enabled: + description: enabled specifies whether the PodDisruptionBudget + is enabled + type: boolean + maxUnavailable: + description: maxUnavailable is the maximum number of pods that + can be unavailable during the disruption. + format: int32 + type: integer + required: + - enabled + type: object + podTemplate: + description: podTemplate specifies the statefulset pod template configuration. + properties: + affinity: + description: |- + affinity specifies a group of affinity scheduling rules. + More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs stored with the resource and + may be set by external tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying objects. More + info: http://kubernetes.io/docs/user-guide/annotations. + type: object + x-kubernetes-map-type: granular + envVars: + description: |- + envVars contain environment variables to be injected into containers. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs that can be used to organize and categorize + (scope and select) objects. + More info: http://kubernetes.io/docs/user-guide/labels. + type: object + x-kubernetes-map-type: granular + podSecurityContext: + description: |- + PodSecurityContext holds pod-level security attributes and common container settings. + Some fields are also present in container.securityContext. Field values of + container.securityContext take precedence over field values of PodSecurityContext. + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + priorityClassName: + description: priorityClassName specifies the priority class for + the pod (if any). + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + probe: + description: probe contains the fields for standard Kubernetes + readiness/liveness probe configuration. + properties: + liveness: + description: |- + liveness configures the Kubernetes probe settings. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + readiness: + description: |- + readiness configures the Kubernetes probe setting. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + type: object + resources: + description: resources describe the compute resource requirements. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: |- + SecurityContext holds security configuration that will be applied to a container. + Some fields are present in both SecurityContext and PodSecurityContext. When both + are set, the values in SecurityContext take precedence. + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the service account used to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account. + type: string + terminationGracePeriodSeconds: + description: terminationGracePeriodSeconds is the grace period + before the pod is deleted. + format: int64 + type: integer + tolerations: + description: |- + tolerations specify the pods to schedule onto the nodes with matching taints, using + the triple `` and the matching operator ``. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + topologySpreadConstraints describe how a group of pods ought to spread across topology domains. Scheduler will + schedule pods based on the constraints. All topologySpreadConstraints are ANDed. + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + + + This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + replicas: + description: |- + replicas is the desired number of replicas. + A change to this setting will roll the cluster. + format: int32 + type: integer + storageClass: + description: storageClass references the user-provided storage class. + properties: + name: + description: name is the storage class name. + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + telemetry: + description: telemetry specifies the Confluent telemetry reporter + configuration. + properties: + global: + description: |- + global allows disabling telemetry configuration. + If CFK is deployed with telemetry, this field is only + used to disable telemetry. The default value is `true` if + telemetry is enabled at the global level. + type: boolean + type: object + tls: + description: tls specifies the TLS configurations. + properties: + autoGeneratedCerts: + description: |- + autoGeneratedCerts specifies that the certificates are auto-generated based on + the CA key pair provided. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the cp component's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS + configuration for cp components. + type: boolean + required: + - enabled + type: object + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing the + JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - dataVolumeCapacity + - image + type: object + status: + description: status defines the observed state of the Control Center cluster. + properties: + arbitraryData: + description: arbitraryData is the map for any arbitrary data associated + with this Confluent component. + x-kubernetes-preserve-unknown-fields: true + authorizationType: + description: authorizationType is the authorization type for this + Confluent component. + type: string + clusterName: + description: clusterName is the name of the Confluent Platform component + cluster. + type: string + clusterNamespace: + description: clusterNamespace is the namespace where the Confluent + Platform component cluster is running. + type: string + conditions: + description: conditions specify the latest available observations + of the current state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + controlCenterName: + description: name is the name of the Control Center cluster. + type: string + currentReplicas: + description: currentReplicas is the number of currently running replicas. + format: int32 + type: integer + id: + description: id is the identifier of the Control Center cluster. + format: int32 + type: integer + internalSecrets: + description: |- + internalSecrets are internal secrets created + by CFK for this Confluent component. + items: + type: string + type: array + internalTopicNames: + description: internalTopicNames are the topics used by the component + for internal use. + items: + type: string + type: array + kafka: + description: kafka is the Kafka client side status for the Control + Center cluster. + properties: + authenticationType: + description: authenticationType describes the authentication method + for the Kafka cluster. + type: string + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap endpoint. + type: string + tls: + description: tls indicates whether TLS is enabled for the Kafka + dependency. + type: boolean + type: object + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + operatorVersion: + description: operatorVersion is the internal version of CFK. + type: string + phase: + description: |- + phase describes the state of the Confluent Platform component. This can either be 'PROVISIONING' + or 'RUNNING' + 'PROVISIONING' means the Confluent Platform component is currently getting deployed and not ready yet. + 'RUNNING' means the Confluent Platform component has been successfully deployed. + type: string + rbac: + description: rbac contains the RBAC-related status when RBAC is enabled. + properties: + clusterID: + description: clusterID specifies the id of the cluster. + type: string + internalRolebindings: + description: internalRolebindings specifies the internal rolebindings. + items: + type: string + type: array + type: object + readyReplicas: + description: readyReplicas is the number of currently ready replicas. + format: int32 + type: integer + replicas: + description: replicas is the number of replicas. + format: int32 + type: integer + restConfig: + description: restConfig is the REST API configuration of the Control + Center cluster. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + selector: + description: |- + selector gets the label selector of the child pod. + The Horizontal Pod Autoscaler(HPA) will scale using the label selector of the child pod. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkarestclasses.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkarestclasses.yaml new file mode 100644 index 000000000..4eb8d72fc --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkarestclasses.yaml @@ -0,0 +1,557 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: kafkarestclasses.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: KafkaRestClass + listKind: KafkaRestClassList + plural: kafkarestclasses + shortNames: + - krc + - kafkarestclass + singular: kafkarestclass + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: KafkaRestClass is the schema for the Kafka REST API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the KafkaRestClass. + properties: + kafkaClusterRef: + description: kafkaClusterRef specifies the name of the Kafka cluster. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + kafkaRest: + description: kafkaRest specifies the Kafka REST API configuration. + properties: + authentication: + description: authentication specifies the REST API authentication + mechanism. + properties: + basic: + description: basic specifies the basic authentication settings + for the REST API client. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + bearer: + description: bearer specifies the bearer authentication settings + for the REST API client. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication settings + for the REST API client. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the + basic credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass + the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the REST API authentication type. + Valid options are `basic`, `bearer`, `mtls` and `oauth`. + enum: + - basic + - bearer + - mtls + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies where Confluent REST API is running. + minLength: 1 + pattern: ^https?://.* + type: string + kafkaClusterID: + description: |- + kafkaClusterID specifies the id of Kafka cluster. + It takes precedence over using the Kafka REST API to get the cluster id. + minLength: 1 + type: string + tls: + description: "tls specifies the custom TLS structure for the application + resources,\n\t// e.g. connector, topic, schema, of the Confluent + Platform components.\n\t// +optional" + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `keystore.jks`, `truststore.jks`, `jksPassword.txt` keys are mounted. + minLength: 1 + type: string + jksPassword: + description: jksPassword specifies the secret name that contains + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef specifies the secret name that contains the certificates. + More info about certificates key/value format: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + secondaryKafkaClusterRef: + description: secondaryKafkaClusterRef specifies the name of the secondary + Kafka cluster when using centralized RBAC. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + secondaryKafkaRest: + description: secondaryKafkaRest specifies the secondary Kafka REST + API configuration when using centralized RBAC. + properties: + authentication: + description: authentication specifies the REST API authentication + mechanism. + properties: + basic: + description: basic specifies the basic authentication settings + for the REST API client. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + bearer: + description: bearer specifies the bearer authentication settings + for the REST API client. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication settings + for the REST API client. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the + basic credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass + the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the REST API authentication type. + Valid options are `basic`, `bearer`, `mtls` and `oauth`. + enum: + - basic + - bearer + - mtls + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies where Confluent REST API is running. + minLength: 1 + pattern: ^https?://.* + type: string + kafkaClusterID: + description: |- + kafkaClusterID specifies the id of Kafka cluster. + It takes precedence over using the Kafka REST API to get the cluster id. + minLength: 1 + type: string + tls: + description: "tls specifies the custom TLS structure for the application + resources,\n\t// e.g. connector, topic, schema, of the Confluent + Platform components.\n\t// +optional" + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `keystore.jks`, `truststore.jks`, `jksPassword.txt` keys are mounted. + minLength: 1 + type: string + jksPassword: + description: jksPassword specifies the secret name that contains + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef specifies the secret name that contains the certificates. + More info about certificates key/value format: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + type: object + status: + description: status defines the observed state of the KafkaRestClass. + properties: + conditions: + description: conditions are the latest available observed state of + the kafkaRestClass. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + endpoint: + description: endpoint specifies the Kafka REST API / MDS endpoint. + type: string + kafkaClusterID: + description: |- + kafkaClusterID specifies the id of the Kafka cluster. + If using centralized RBAC and kafkaRestClass is for the secondary Kafka cluster, it will be the cluster id of the secondary Kafka cluster. + type: string + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkarestproxies.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkarestproxies.yaml new file mode 100644 index 000000000..2311a6118 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkarestproxies.yaml @@ -0,0 +1,5834 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: kafkarestproxies.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: KafkaRestProxy + listKind: KafkaRestProxyList + plural: kafkarestproxies + shortNames: + - kafkarestproxy + - krp + singular: kafkarestproxy + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.readyReplicas + name: Ready + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.kafka.bootstrapEndpoint + name: Kafka + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: KafkaRestProxy is the schema for the Kafka REST Proxy API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the KafkaRestProxy cluster. + properties: + authentication: + description: authentication specifies the authentication configurations + for the KafkaRestProxy cluster. + properties: + basic: + description: basic specifies the configuration for basic authentication. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth authentication. + properties: + configuration: + description: configuration specifies the OAuth server settings. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the basic + credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass the + required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme for the + REST API server. Valid options are `basic`, `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + authorization: + description: authorization specifies the RBAC configuration for the + KafkaRestProxy cluster. + properties: + kafkaRestClassRef: + description: |- + kafkaRestClassRef references the KafkaRestClass + which specifies the Kafka REST API connection configuration. + properties: + name: + description: name specifies the name of the KafkaRestClass + application resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + type: + description: type specifies the client-side authorization type. + The valid option is `rbac`. + enum: + - rbac + type: string + required: + - type + type: object + configOverrides: + description: |- + configOverrides specifies the configs to override the server, JVM, Log4j properties for the KafkaRestProxy cluster. + A change will roll the cluster. + properties: + jvm: + description: |- + jvm is a list of JVM configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + log4j: + description: |- + log4j is a list of Log4J configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + server: + description: |- + server is a list of server configuration supported by the Confluent Platform component. + This will either add or update existing configuration. + items: + type: string + type: array + type: object + dependencies: + description: dependencies specifies the dependency configurations + for Kafka, Interceptor, Schema Registry, and the MDS. + properties: + interceptor: + description: interceptor specifies the interceptor dependency + configuration. + properties: + configs: + description: |- + configs describe the configurations for the Confluent Platform interceptor. + The config override feature can be used to pass the configuration settings. + items: + type: string + type: array + consumer: + description: |- + consumer specifies the consumer configuration for the interceptor. If not + configured, it uses the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication + for the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another + way to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + enabled: + description: enabled indicates whether the Confluent Platform + interceptor is enabled or disabled. + type: boolean + producer: + description: |- + producer specifies the producer configuration for the interceptor. If not + configured, it uses the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication + for the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another + way to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + publishMs: + type: integer + required: + - enabled + type: object + kafka: + description: kafka specifies the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mds: + description: mds specifies the MDS dependencies configuration. + properties: + authentication: + description: authentication specifies the client side authentication + configuration for the MDS. + properties: + bearer: + description: bearer specifies the bearer authentication + settings. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication + settings. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication method + for the MDS. The valid option is `bearer`, `oauth`. + enum: + - bearer + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies the MDS endpoint. + minLength: 1 + pattern: ^https?://.* + type: string + ssoProtocol: + description: sso protocol, valid options are ldap and oidc. + enum: + - ldap + - oidc + type: string + tls: + description: ClientTLSConfig specifies the TLS configuration + for the Confluent component (dependencies, listeners). + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + tokenKeyPair: + description: tokenKeyPair specifies the token keypair to configure + the MDS. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the MDS token key pair are mounted. + minLength: 1 + type: string + encryptedTokenKey: + description: |- + EncryptedTokenKey boolean value indicating whether the tokenKeypair(private used for signing) is encrypted using a passphrase. If true, cfk + operator will look for a file named mdsTokenKeyPassphrase.txt containing key value pair + mdsTokenKeyPassphrase=. Relevant only for mds server. Ignored if set for a client configuration. + type: boolean + secretRef: + description: secretRef references the name of the secret + that contains the MDS token key pair. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - authentication + - endpoint + - tokenKeyPair + type: object + schemaRegistry: + description: schemaRegistry specifies the Schema Registry dependency + configuration. + properties: + authentication: + description: authentication specifies the authentication for + the Schema Registry cluster. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + tls: + description: tls defines the client-side TLS setting for the + Schema Registry cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the Schema + Registry cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - url + type: object + type: object + externalAccess: + description: externalAccess specifies the external access configuration. + properties: + loadBalancer: + description: loadBalancer specifies the configuration to create + a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are `Local` + and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided service + port(s). + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create a + Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create a route + service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the Confluent + component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + headlessService: + description: headlessService specifies the configuration of the Kubernetes + headless service. + properties: + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs. + It specifies the annotations to be added to the CFK-created headless service. + These annotations are merged with the injectAnnotations and take precedence. + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs. + It specifies the labels to be added to the CFK-created headless service. + These labels are merged with the injectLabels and take precedence. + type: object + x-kubernetes-map-type: granular + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses specifies the publishNotReadyAddresses field. + For Kafka, this value must be true. The default value is true. + type: boolean + type: object + image: + description: |- + image specifies the application and the init docker image configurations. + A change to this setting will roll the cluster. + properties: + application: + description: |- + application is the Docker image name of the application. Specify + `//:`. + pattern: .+:.+ + type: string + init: + description: |- + init is the init-container name. Specify + `//:`. + pattern: .+:.+ + type: string + pullPolicy: + description: |- + pullPolicy is the policy for pulling images. Valid options are `Always`, `Never`, and `IfNotPresent`. + The default value is `IfNotPresent`. + enum: + - Always + - Never + - IfNotPresent + type: string + pullSecretRef: + description: |- + pullSecretRef references the secrets in the same namespace to be used for pulling images. + Image pull secrets are distinct from secrets because secrets + can be mounted in the pod, but image pull secrets are only accessed by `kubelet`. + More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod + items: + type: string + type: array + required: + - application + - init + type: object + injectAnnotations: + additionalProperties: + type: string + description: |- + injectAnnotations are the annotations injected to the internal resources that CFK created. + The internal annotations are preserved and cannot be overridden. + For pod annotations, use `podTemplate.annotations`. + type: object + x-kubernetes-map-type: granular + injectLabels: + additionalProperties: + type: string + description: |- + injectLabels are the labels injected to the internal resources that CFK created. + The internal labels are preserved and cannot be overridden. + For pod labels, use `podTemplate.labels`. + type: object + x-kubernetes-map-type: granular + k8sClusterDomain: + description: |- + k8sClusterDomain specifies the configuration of the Kubernetes cluster domain. + The default is the `cluster.local` domain. + type: string + license: + description: license specifies the license configuration for the Confluent + Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + the license key is mounted. More info: + https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + minLength: 1 + type: string + globalLicense: + description: globalLicense specifies whether the Confluent Platform + component shares the common global license. + type: boolean + secretRef: + description: |- + secretRef references the secret that provides the license for the Confluent Platform component. + More info: https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + metrics: + description: metrics specify the security settings for the metric + services. + properties: + authentication: + description: authentication specifies the authentication configuration + for the metrics. + properties: + type: + description: type specifies the metrics authentication method. + The valid option is `mtls`. + enum: + - mtls + type: string + required: + - type + type: object + prometheus: + description: prometheus specifies the configuration overrides + for the JMX-Prometheus exporter. + properties: + blacklist: + items: + type: string + type: array + rules: + items: + description: Rule defines the Prometheus Exporter rule override. + properties: + attrNameSnakeCase: + type: boolean + cache: + type: boolean + help: + minLength: 1 + type: string + labels: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: granular + name: + minLength: 1 + type: string + pattern: + minLength: 1 + type: string + type: + minLength: 1 + type: string + value: + minLength: 1 + type: string + valueFactor: + anyOf: + - type: integer + - type: string + default: 1 + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: array + whitelist: + items: + type: string + type: array + type: object + tls: + description: tls specifies the TLS configuration for the metrics. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mountedSecrets: + description: |- + mountedSecrets list the secrets injected to + the underlying statefulset configuration. The secret reference is mounted + in the default path `/mnt/secrets/`. The underlying resources + will follow the secret as a file configuration. + More info: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. + A change to this setting will roll the cluster. + items: + description: |- + MountedSecrets provides a way to inject a custom secret to the underlying + statefulset. + properties: + keyItems: + description: keyItems are key and path names. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + secretRef: + description: secretRef references the name of the secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + type: array + mountedVolumes: + description: |- + mountedVolumes list the custom volumes that need to be mounted into the + underlying statefulset. + A change to this setting will roll the cluster. + properties: + volumeMounts: + description: |- + volumeMounts specify the list of volume mounts for the pods in the + statefulset. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + volumes specify the list of volumes that can be mounted into the pods + of statefulset. + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + format: int32 + type: integer + readOnly: + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: boolean + volumeID: + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in + the blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the + blob storage + type: string + fsType: + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. + properties: + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime + properties: + monitors: + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is /' + type: string + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: boolean + secretFile: + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + secretRef: + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + required: + - monitors + type: object + cinder: + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: boolean + secretRef: + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should + populate this volume + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume + properties: + defaultMode: + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: Items is a list of downward API volume + file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must not + be absolute or contain the ''..'' path. Must + be utf-8 encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. + + + A pod can use both types of ephemeral volumes and + persistent volumes at the same time. + properties: + volumeClaimTemplate: + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. + + + Required, must not be nil. + properties: + metadata: + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. + type: object + spec: + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over + volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#volumeattributesclass + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + items: + type: string + type: array + type: object + flexVolume: + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use + for this volume. + type: string + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds + extra command options if any.' + type: object + readOnly: + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running + properties: + datasetName: + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + properties: + fsType: + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + format: int32 + type: integer + pdName: + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: boolean + required: + - pdName + type: object + gitRepo: + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. + properties: + directory: + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md + properties: + endpoints: + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + path: + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + readOnly: + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. + properties: + path: + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + type: + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + required: + - path + type: object + iscsi: + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication + type: boolean + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + initiatorName: + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + nfs: + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + properties: + path: + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + readOnly: + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: boolean + server: + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine + properties: + fsType: + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx + volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along + with other supported volume types + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume + root to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + required: + - path + type: object + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the + ConfigMap or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the + downwardAPI data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute or + contain the ''..'' path. Must be utf-8 + encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env + vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource + to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + format: int64 + type: integer + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: |- + group to map volume access to + Default is no group + type: string + readOnly: + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. + type: boolean + registry: + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes + type: string + tenant: + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin + type: string + user: + description: |- + user to map volume access to + Defaults to serivceaccount user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + image: + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + keyring: + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + monitors: + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + items: + type: string + type: array + pool: + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: boolean + secretRef: + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. + type: string + system: + description: system is the name of the storage system + as configured in ScaleIO. + type: string + volumeName: + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume + names are only unique within a namespace. + type: string + volumeNamespace: + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - volumeMounts + - volumes + type: object + oneReplicaPerNode: + description: |- + oneReplicaPerNode controls whether to run 1 pod per node using the pod anti-affinity capability. + Enabling this configuration in an existing cluster will roll the cluster. + type: boolean + pdb: + description: |- + configures PodDisruptionBudget for the Confluent Platform component. + by default PDB is configured based on pre-detemined formula. + properties: + enabled: + description: enabled specifies whether the PodDisruptionBudget + is enabled + type: boolean + maxUnavailable: + description: maxUnavailable is the maximum number of pods that + can be unavailable during the disruption. + format: int32 + type: integer + required: + - enabled + type: object + podTemplate: + description: podTemplate specifies the statefulset pod template configuration. + properties: + affinity: + description: |- + affinity specifies a group of affinity scheduling rules. + More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs stored with the resource and + may be set by external tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying objects. More + info: http://kubernetes.io/docs/user-guide/annotations. + type: object + x-kubernetes-map-type: granular + envVars: + description: |- + envVars contain environment variables to be injected into containers. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs that can be used to organize and categorize + (scope and select) objects. + More info: http://kubernetes.io/docs/user-guide/labels. + type: object + x-kubernetes-map-type: granular + podSecurityContext: + description: |- + PodSecurityContext holds pod-level security attributes and common container settings. + Some fields are also present in container.securityContext. Field values of + container.securityContext take precedence over field values of PodSecurityContext. + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + priorityClassName: + description: priorityClassName specifies the priority class for + the pod (if any). + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + probe: + description: probe contains the fields for standard Kubernetes + readiness/liveness probe configuration. + properties: + liveness: + description: |- + liveness configures the Kubernetes probe settings. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + readiness: + description: |- + readiness configures the Kubernetes probe setting. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + type: object + resources: + description: resources describe the compute resource requirements. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: |- + SecurityContext holds security configuration that will be applied to a container. + Some fields are present in both SecurityContext and PodSecurityContext. When both + are set, the values in SecurityContext take precedence. + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the service account used to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account. + type: string + terminationGracePeriodSeconds: + description: terminationGracePeriodSeconds is the grace period + before the pod is deleted. + format: int64 + type: integer + tolerations: + description: |- + tolerations specify the pods to schedule onto the nodes with matching taints, using + the triple `` and the matching operator ``. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + topologySpreadConstraints describe how a group of pods ought to spread across topology domains. Scheduler will + schedule pods based on the constraints. All topologySpreadConstraints are ANDed. + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + + + This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + replicas: + description: |- + replicas is the desired number of replicas. + A change to this setting will roll the cluster. + format: int32 + type: integer + telemetry: + description: telemetry specifies the Confluent telemetry reporter + configuration. + properties: + global: + description: |- + global allows disabling telemetry configuration. + If CFK is deployed with telemetry, this field is only + used to disable telemetry. The default value is `true` if + telemetry is enabled at the global level. + type: boolean + type: object + tls: + description: tls specifies the TLS configurations for the KafkaRestProxy + cluster. + properties: + autoGeneratedCerts: + description: |- + autoGeneratedCerts specifies that the certificates are auto-generated based on + the CA key pair provided. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the cp component's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS + configuration for cp components. + type: boolean + required: + - enabled + type: object + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing the + JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - image + type: object + status: + description: status defines the observed state of the KafkaRestProxy cluster. + properties: + arbitraryData: + description: arbitraryData is the map for any arbitrary data associated + with this Confluent component. + x-kubernetes-preserve-unknown-fields: true + authorizationType: + description: authorizationType is the authorization type for this + Confluent component. + type: string + clusterName: + description: clusterName is the name of the Confluent Platform component + cluster. + type: string + clusterNamespace: + description: clusterNamespace is the namespace where the Confluent + Platform component cluster is running. + type: string + conditions: + description: conditions specify the latest available observations + of the current state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + currentReplicas: + description: currentReplicas is the number of currently running replicas. + format: int32 + type: integer + internalSecrets: + description: |- + internalSecrets are internal secrets created + by CFK for this Confluent component. + items: + type: string + type: array + internalTopicNames: + description: internalTopicNames are the topics used by the component + for internal use. + items: + type: string + type: array + kafka: + description: kafka is the Kafka client side status for the KafkaRestProxy + cluster. + properties: + authenticationType: + description: authenticationType describes the authentication method + for the Kafka cluster. + type: string + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap endpoint. + type: string + tls: + description: tls indicates whether TLS is enabled for the Kafka + dependency. + type: boolean + type: object + metricPrefix: + description: metricPrefix is the prefix for the JMX metric of the + KafkaRestProxy. + type: string + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + operatorVersion: + description: operatorVersion is the internal version of CFK. + type: string + phase: + description: |- + phase describes the state of the Confluent Platform component. This can either be 'PROVISIONING' + or 'RUNNING' + 'PROVISIONING' means the Confluent Platform component is currently getting deployed and not ready yet. + 'RUNNING' means the Confluent Platform component has been successfully deployed. + type: string + rbac: + description: rbac contains the RBAC-related status when RBAC is enabled. + properties: + clusterID: + description: clusterID specifies the id of the cluster. + type: string + internalRolebindings: + description: internalRolebindings specifies the internal rolebindings. + items: + type: string + type: array + type: object + readyReplicas: + description: readyReplicas is the number of currently ready replicas. + format: int32 + type: integer + replicas: + description: replicas is the number of replicas. + format: int32 + type: integer + restConfig: + description: restConfig is the REST API configuration of the KafkaRestProxy. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + selector: + description: |- + selector gets the label selector of the child pod. + The Horizontal Pod Autoscaler(HPA) will scale using the label selector of the child pod. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkas.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkas.yaml new file mode 100644 index 000000000..ad422466d --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkas.yaml @@ -0,0 +1,10948 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: kafkas.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: Kafka + listKind: KafkaList + plural: kafkas + shortNames: + - kafka + - broker + singular: kafka + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.readyReplicas + name: Ready + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.zookeeperConnect + name: Zookeeper + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: Kafka is the schema for the Kafka API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the Kafka cluster. + properties: + authorization: + description: authorization specifies the authorization configuration. + properties: + superUsers: + description: |- + superUsers specify the super users to give the admin privilege on the Kafka Cluster. + This list takes the format as `User:` + items: + type: string + type: array + type: + description: type specifies the authorization type. The valid + options are `rbac` and `simple`. + enum: + - rbac + - simple + type: string + required: + - type + type: object + configOverrides: + description: configOverrides specifies the configs to override the + server, JVM, Log4j properties for the Kafka cluster. + properties: + jvm: + description: |- + jvm is a list of JVM configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + log4j: + description: |- + log4j is a list of Log4J configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + server: + description: |- + server is a list of server configuration supported by the Confluent Platform component. + This will either add or update existing configuration. + items: + type: string + type: array + type: object + dataVolumeCapacity: + anyOf: + - type: integer + - type: string + description: dataVolumeCapacity specifies the persistent volume capacity + for the Kafka cluster. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + dependencies: + description: dependencies specify the Kafka dependencies, such as + Zookeeper and centralized MDS. + properties: + kRaftController: + description: |- + kRaftController specifies the dependency configuration for the KRaftController cluster. + You cannot configure both zookeeper and kRaftController dependencies. + properties: + clusterRef: + description: clusterRef specifies the name of the KRaft Controller + cluster. + properties: + name: + description: name specifies the name of the Confluent + Platform component cluster. + type: string + namespace: + description: namespace specifies the namespace where the + Confluent Platform component cluster is running. + type: string + required: + - name + type: object + controllerListener: + description: |- + controllerListener specifies the controller listener which must match + the controller listener on the referenced KRaft Controller cluster. + properties: + authentication: + description: authentication specifies the authentication + configuration for the listener. + properties: + jaasConfig: + description: |- + jaasConfig specifies the JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: |- + jaasConfigPassThrough specifies another way to provide JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + principalMappingRules: + items: + type: string + type: array + type: + description: |- + type specifies the Kafka or Zookeeper authentication type. + Valid options are `plain`, `digest`, `mtls`, `ldap` & `oauth`. + enum: + - plain + - digest + - mtls + - ldap + - oauth + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for the + listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + kafkaRest: + description: kafkaRest provides the REST client configuration + for the MDS when RBAC is enabled. + properties: + authentication: + description: authentication specifies the Kafka authentication + for Kafka REST API or MDS. + properties: + bearer: + description: |- + bearer is the authentication mechanism to provide principals. + Only supported in RBAC deployment. + Required when authentication type is set to `bearer`. + This field will be deprecated, please configure oauthbearer instead. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provide principals. + Only supported in RBAC deployment. + Required when authentication type is set to `oauthbearer`. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `bearer`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - bearer + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: |- + bootstrapEndpoint specifies Kafka bootstrap endpoint for the admin REST API. It is not needed when RBAC is enabled. + If not configured, then default to the replication listener endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + endpoint: + description: endpoint specifies the custom MDS http|s endpoint. + Not required to configure in most of the scenarios. + minLength: 1 + pattern: ^https?://.* + type: string + tls: + description: tls specifies the client-side TLS configuration + to connect to the Kafka REST API. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mds: + description: mds specifies the dependency configuration for the + primary MDS. + properties: + endpoint: + description: endpoint defines the primary Kafka cluster boostrap + endpoint. + minLength: 1 + pattern: ^https?://.* + type: string + kafka: + description: kafka specifies the dependency configuration + for Kafka cluster. + properties: + authentication: + description: authentication defines the authentication + for the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another + way to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + tls: + description: tls specifies the TLS configuration for the primary + MDS. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + tokenKeyPair: + description: tokenKeyPair specifies the token key pair for + the MDS. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the MDS token key pair are mounted. + minLength: 1 + type: string + encryptedTokenKey: + description: |- + EncryptedTokenKey boolean value indicating whether the tokenKeypair(private used for signing) is encrypted using a passphrase. If true, cfk + operator will look for a file named mdsTokenKeyPassphrase.txt containing key value pair + mdsTokenKeyPassphrase=. Relevant only for mds server. Ignored if set for a client configuration. + type: boolean + secretRef: + description: secretRef references the name of the secret + that contains the MDS token key pair. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - endpoint + - kafka + - tokenKeyPair + type: object + schemaRegistry: + description: schemaRegistry specifies the dependency configuration + for the Schema Registry cluster. + properties: + authentication: + description: authentication specifies the authentication for + the Schema Registry cluster. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + tls: + description: tls defines the client-side TLS setting for the + Schema Registry cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the Schema + Registry cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - url + type: object + zookeeper: + description: |- + zookeeper specifies the dependency configuration for Zookeeper. + You cannot configure both zookeeper and kRaftController dependencies. + properties: + authentication: + description: authentication specifies the client side authentication + configuration of Zookeeper for Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + discovery: + description: discovery specifies the capability to discover + the Zookeeper cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + endpoint: + description: endpoint specifies the Zookeeper endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + tls: + description: tls specifies the TLS configuration of Zookeeper + for Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the Kafka cluster's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS configuration + for cp components. + type: boolean + required: + - enabled + type: object + headlessService: + description: headlessService specifies the configuration of the Kubernetes + headless service. + properties: + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs. + It specifies the annotations to be added to the CFK-created headless service. + These annotations are merged with the injectAnnotations and take precedence. + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs. + It specifies the labels to be added to the CFK-created headless service. + These labels are merged with the injectLabels and take precedence. + type: object + x-kubernetes-map-type: granular + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses specifies the publishNotReadyAddresses field. + For Kafka, this value must be true. The default value is true. + type: boolean + type: object + identityProvider: + description: |- + identityProvider specifies the identity provider configuration. + It is only required for the Kafka authentication type `ldap`. + When the MDS is enabled, this property is ignored, and + the LDAP configuration in `spec.services.mds.provider` will be used. + properties: + ldap: + description: ldap defines the LDAP service configuration. + properties: + address: + description: address defines the LDAP server address. + type: string + authentication: + description: LdapAuthentication specifies the LDAP authentication + configuration. + properties: + simple: + description: simple specifies simple authentication configuration + for the LDAP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name of the + secret that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: type defines the authentication method for + LDAP. Valid options are `simple` and `mtls`. + enum: + - simple + - mtls + type: string + required: + - type + type: object + configurations: + description: configurations defines the LDAP configurations + for Confluent RBAC. + properties: + groupMemberAttribute: + description: groupMemberAttribute specifies the LDAP group + member attribute. + minLength: 1 + type: string + groupMemberAttributePattern: + description: groupMemberAttributePattern specifies the + regular expression pattern for the LDAP group member + attribute. + minLength: 1 + type: string + groupNameAttribute: + description: groupNameAttribute specifies the LDAP group + name attribute. + minLength: 1 + type: string + groupObjectClass: + description: groupObjectClass specifies the LDAP group + object class. + minLength: 1 + type: string + groupSearchBase: + description: groupSearchBase specifies the LDAP search + base for the group-based search. + minLength: 1 + type: string + groupSearchFilter: + description: groupSearchFilter specifies the LDAP search + filter for the group-based search. + minLength: 1 + type: string + groupSearchScope: + description: groupSearchScope specifies the LDAP search + scope for the group-based search. + format: int32 + type: integer + userMemberOfAttributePattern: + description: userMemberOfAttributePattern specifies the + regular expression pattern for the LDAP user member + attribute. + minLength: 1 + type: string + userNameAttribute: + description: userNameAttribute specifies the LDAP username + attribute. + minLength: 1 + type: string + userObjectClass: + description: userObjectClass specifies the LDAP user object + class. + minLength: 1 + type: string + userSearchBase: + description: userSearchBase specifies the LDAP search + base for the user-based search. + minLength: 1 + type: string + userSearchFilter: + description: userSearchFilter specifies the LDAP search + filter for the user-based search. + minLength: 1 + type: string + userSearchScope: + description: userSearchScope specifies the LDAP search + scope for the user-based search. + format: int32 + type: integer + type: object + tls: + description: tls specifies the TLS configuration for the LDAP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - address + - authentication + - configurations + type: object + oauth: + description: oauth defines the OAuth service configuration. + properties: + configurations: + description: configurations defines the OAuth configurations. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + tls: + description: tls specifies the TLS configuration for the OAuth + IDP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - configurations + type: object + oidc: + description: |- + this field has been superseded with sso field + oidc defines the OIDC service configuration. + properties: + clientCredentials: + description: clientCredentials define the IDP clientID and + clientSecret. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name of the secret + that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + configurations: + description: configurations defines the OIDC configurations. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + authorizeBaseEndpointUri: + description: authorizeBaseEndpointUri specifies the base + uri for authorize endpoint. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + groupsClaimScope: + description: |- + groupsClaimScope specifies additional scope needed for the token to contain groups claim (field). + Leave this field empty (or null) if id token always contains the claims identified as groups. + minLength: 1 + type: string + issuer: + description: |- + issuer specifies the authorization server's URL. + This value should match the issuer claim ("iss") in id tokens issued by Authorization Server? + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + refreshToken: + description: refreshToken specifies whether offline_access + scope should be requested in the authorization URI. + type: boolean + sessionMaxTimeout: + description: sessionMaxTimeout specifies the maximum expiration + time for a user's session. + format: int32 + type: integer + sessionTokenExpiry: + description: sessionTokenExpiry specifies the validity + of cookie issued by Confluent. + format: int32 + type: integer + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenBaseEndpointUri: + description: tokenBaseEndpointUri specifies the base uri + for token endpoint. + minLength: 1 + type: string + required: + - authorizeBaseEndpointUri + - issuer + - jwksEndpointUri + - refreshToken + - tokenBaseEndpointUri + type: object + enabled: + default: true + description: |- + enabled specifies whether the SSO is enabled. + default is true. + type: boolean + required: + - clientCredentials + - configurations + type: object + sso: + description: sso defines the SSO service configuration. + properties: + clientCredentials: + description: clientCredentials define the IDP clientID and + clientSecret. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name of the secret + that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + configurations: + description: configurations defines the OIDC configurations. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + authorizeBaseEndpointUri: + description: authorizeBaseEndpointUri specifies the base + uri for authorize endpoint. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + groupsClaimScope: + description: |- + groupsClaimScope specifies additional scope needed for the token to contain groups claim (field). + Leave this field empty (or null) if id token always contains the claims identified as groups. + minLength: 1 + type: string + issuer: + description: |- + issuer specifies the authorization server's URL. + This value should match the issuer claim ("iss") in id tokens issued by Authorization Server? + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + refreshToken: + description: refreshToken specifies whether offline_access + scope should be requested in the authorization URI. + type: boolean + sessionMaxTimeout: + description: sessionMaxTimeout specifies the maximum expiration + time for a user's session. + format: int32 + type: integer + sessionTokenExpiry: + description: sessionTokenExpiry specifies the validity + of cookie issued by Confluent. + format: int32 + type: integer + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenBaseEndpointUri: + description: tokenBaseEndpointUri specifies the base uri + for token endpoint. + minLength: 1 + type: string + required: + - authorizeBaseEndpointUri + - issuer + - jwksEndpointUri + - refreshToken + - tokenBaseEndpointUri + type: object + enabled: + default: true + description: |- + enabled specifies whether the SSO is enabled. + default is true. + type: boolean + required: + - clientCredentials + - configurations + type: object + type: + description: This field has been deprecated and its value will + be ignored if set. + type: string + type: object + image: + description: |- + image specifies the application and the init docker image configurations. + A change to this setting will roll the cluster. + properties: + application: + description: |- + application is the Docker image name of the application. Specify + `//:`. + pattern: .+:.+ + type: string + init: + description: |- + init is the init-container name. Specify + `//:`. + pattern: .+:.+ + type: string + pullPolicy: + description: |- + pullPolicy is the policy for pulling images. Valid options are `Always`, `Never`, and `IfNotPresent`. + The default value is `IfNotPresent`. + enum: + - Always + - Never + - IfNotPresent + type: string + pullSecretRef: + description: |- + pullSecretRef references the secrets in the same namespace to be used for pulling images. + Image pull secrets are distinct from secrets because secrets + can be mounted in the pod, but image pull secrets are only accessed by `kubelet`. + More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod + items: + type: string + type: array + required: + - application + - init + type: object + injectAnnotations: + additionalProperties: + type: string + description: |- + injectAnnotations are the annotations injected to the internal resources that CFK created. + The internal annotations are preserved and cannot be overridden. + For pod annotations, use `podTemplate.annotations`. + type: object + x-kubernetes-map-type: granular + injectLabels: + additionalProperties: + type: string + description: |- + injectLabels are the labels injected to the internal resources that CFK created. + The internal labels are preserved and cannot be overridden. + For pod labels, use `podTemplate.labels`. + type: object + x-kubernetes-map-type: granular + k8sClusterDomain: + description: |- + k8sClusterDomain specifies the configuration of the Kubernetes cluster domain. + The default is the `cluster.local` domain. + type: string + license: + description: license specifies the license configuration for the Confluent + Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + the license key is mounted. More info: + https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + minLength: 1 + type: string + globalLicense: + description: globalLicense specifies whether the Confluent Platform + component shares the common global license. + type: boolean + secretRef: + description: |- + secretRef references the secret that provides the license for the Confluent Platform component. + More info: https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + listeners: + description: listeners specify the listeners configurations. + properties: + custom: + description: custom defines the list of KafkaCustomListener. + items: + description: KafkaCustomListener defines the Kafka custom listener. + properties: + authentication: + description: authentication specifies the authentication + configuration for the listener. + properties: + jaasConfig: + description: |- + jaasConfig specifies the JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: |- + jaasConfigPassThrough specifies another way to provide JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups of + subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + principalMappingRules: + items: + type: string + type: array + type: + description: |- + type specifies the Kafka or Zookeeper authentication type. + Valid options are `plain`, `digest`, `mtls`, `ldap` & `oauth`. + enum: + - plain + - digest + - mtls + - ldap + - oauth + type: string + required: + - type + type: object + externalAccess: + description: externalAccess defines the external access + configuration for the Kafka cluster. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create Kubernetes load balancer services. + properties: + advertisedPort: + description: |- + advertisedPort specifies the advertised port for Kafka external access. + If not configured, it will be the same as the listener port. + Information about the advertised port can be retrieved through the status API. + format: int32 + type: integer + annotations: + additionalProperties: + type: string + description: annotations is a map of string key + and value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + bootstrapPrefix: + description: |- + bootstrapPrefix specifies the prefix for the Kafka bootstrap advertised endpoint and will be added as `bootstrapPrefix.domain`. + The default value is the Kafka cluster name. + minLength: 1 + type: string + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the Kafka broker advertised endpoint and will be added as `brokerPrefix.domain`. + The default value is `b`, such as `b#.domain` where `#` starts from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain is the domain name of the component + cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the + external traffic policy for the service. Valid + options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this + service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the + source ranges. + items: + type: string + type: array + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information + on service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed + by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the + configurations of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to + create Kubernetes node port services. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key + and value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this + service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information + on service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed + by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the + configurations of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create + route services in OpenShift. + properties: + annotations: + additionalProperties: + type: string + description: annotations is a map of string key + and value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + bootstrapPrefix: + description: |- + bootstrapPrefix specifies the prefix for the Kafka bootstrap advertised endpoint and will be added as `bootstrapPrefix.domain`. + The default value is the Kafka cluster name. + minLength: 1 + type: string + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the Kafka broker advertised endpoint and will be added as `brokerPrefix.domain`. + The default value is `b`, such as `b#.domain` where `#` starts from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain specifies the domain name of + the Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this + service. + type: object + x-kubernetes-map-type: granular + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + staticForHostBasedRouting: + description: |- + staticForHostBasedRouting enables external access by doing host based + routing through the SNI capability. + With this schema, CFK only configures Kafka advertised listeners, and no Kubernetes external + service is created. + properties: + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the broker advertised endpoints and are added as `brokerPrefix.domain`. + If not configured, it will add `b` as a prefix, such as `b#.domain` where `#` will start from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain specifies the domain name for + the Kafka cluster. + minLength: 1 + type: string + port: + description: port specifies the port to be used + in the advertised listener for a broker. + format: int32 + type: integer + required: + - domain + - port + type: object + staticForPortBasedRouting: + description: |- + staticForPortBasedRouting enables external access by port routing. + With this schema, CFK only configures Kafka advertised listeners, and no Kubernetes external + service is created. + properties: + host: + description: host defines the host name to be used + in the advertised listener for a broker. + minLength: 1 + type: string + portOffset: + description: |- + portOffset specifies the starting port number. The port numbers go in ascending order with + respect to the replicas count. + format: int32 + type: integer + required: + - host + - portOffset + type: object + type: + description: |- + type specifies the Kubernetes service for external access. + Valid options are `loadBalancer`, `nodePort`, `route`, `staticForPortBasedRouting`, and `staticForHostBasedRouting`. + enum: + - loadBalancer + - nodePort + - route + - staticForPortBasedRouting + - staticForHostBasedRouting + type: string + required: + - type + type: object + name: + description: |- + name specifies the name of the custom listener. + `internal`, `external`, and `token` are reserved by CFK and + can't be used for this property. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + port: + description: |- + port binds the given port to the custom listener. Port numbers lower than `9093` are + reserved by CFK. + format: int32 + minimum: 9093 + type: integer + tls: + description: tls specifies the TLS configuration for the + listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - name + - port + type: object + type: array + external: + description: external specifies the Kafka external listener. + properties: + authentication: + description: authentication specifies the authentication configuration + for the listener. + properties: + jaasConfig: + description: |- + jaasConfig specifies the JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: |- + jaasConfigPassThrough specifies another way to provide JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + principalMappingRules: + items: + type: string + type: array + type: + description: |- + type specifies the Kafka or Zookeeper authentication type. + Valid options are `plain`, `digest`, `mtls`, `ldap` & `oauth`. + enum: + - plain + - digest + - mtls + - ldap + - oauth + type: string + required: + - type + type: object + externalAccess: + description: externalAccess defines the external access configuration + for the Kafka cluster. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create Kubernetes load balancer services. + properties: + advertisedPort: + description: |- + advertisedPort specifies the advertised port for Kafka external access. + If not configured, it will be the same as the listener port. + Information about the advertised port can be retrieved through the status API. + format: int32 + type: integer + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + bootstrapPrefix: + description: |- + bootstrapPrefix specifies the prefix for the Kafka bootstrap advertised endpoint and will be added as `bootstrapPrefix.domain`. + The default value is the Kafka cluster name. + minLength: 1 + type: string + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the Kafka broker advertised endpoint and will be added as `brokerPrefix.domain`. + The default value is `b`, such as `b#.domain` where `#` starts from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain is the domain name of the component + cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are + `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the + source ranges. + items: + type: string + type: array + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create + Kubernetes node port services. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create + route services in OpenShift. + properties: + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + bootstrapPrefix: + description: |- + bootstrapPrefix specifies the prefix for the Kafka bootstrap advertised endpoint and will be added as `bootstrapPrefix.domain`. + The default value is the Kafka cluster name. + minLength: 1 + type: string + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the Kafka broker advertised endpoint and will be added as `brokerPrefix.domain`. + The default value is `b`, such as `b#.domain` where `#` starts from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain specifies the domain name of the + Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + staticForHostBasedRouting: + description: |- + staticForHostBasedRouting enables external access by doing host based + routing through the SNI capability. + With this schema, CFK only configures Kafka advertised listeners, and no Kubernetes external + service is created. + properties: + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the broker advertised endpoints and are added as `brokerPrefix.domain`. + If not configured, it will add `b` as a prefix, such as `b#.domain` where `#` will start from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain specifies the domain name for + the Kafka cluster. + minLength: 1 + type: string + port: + description: port specifies the port to be used in + the advertised listener for a broker. + format: int32 + type: integer + required: + - domain + - port + type: object + staticForPortBasedRouting: + description: |- + staticForPortBasedRouting enables external access by port routing. + With this schema, CFK only configures Kafka advertised listeners, and no Kubernetes external + service is created. + properties: + host: + description: host defines the host name to be used + in the advertised listener for a broker. + minLength: 1 + type: string + portOffset: + description: |- + portOffset specifies the starting port number. The port numbers go in ascending order with + respect to the replicas count. + format: int32 + type: integer + required: + - host + - portOffset + type: object + type: + description: |- + type specifies the Kubernetes service for external access. + Valid options are `loadBalancer`, `nodePort`, `route`, `staticForPortBasedRouting`, and `staticForHostBasedRouting`. + enum: + - loadBalancer + - nodePort + - route + - staticForPortBasedRouting + - staticForHostBasedRouting + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + internal: + description: internal specifies the internal listener. + properties: + authentication: + description: authentication specifies the authentication configuration + for the listener. + properties: + jaasConfig: + description: |- + jaasConfig specifies the JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: |- + jaasConfigPassThrough specifies another way to provide JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + principalMappingRules: + items: + type: string + type: array + type: + description: |- + type specifies the Kafka or Zookeeper authentication type. + Valid options are `plain`, `digest`, `mtls`, `ldap` & `oauth`. + enum: + - plain + - digest + - mtls + - ldap + - oauth + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + replication: + description: replication specifies the Kafka replication listener. + properties: + authentication: + description: authentication specifies the authentication configuration + for the listener. + properties: + jaasConfig: + description: |- + jaasConfig specifies the JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: |- + jaasConfigPassThrough specifies another way to provide JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + principalMappingRules: + items: + type: string + type: array + type: + description: |- + type specifies the Kafka or Zookeeper authentication type. + Valid options are `plain`, `digest`, `mtls`, `ldap` & `oauth`. + enum: + - plain + - digest + - mtls + - ldap + - oauth + type: string + required: + - type + type: object + externalAccess: + description: externalAccess defines the external access configuration + for the Kafka cluster. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create Kubernetes load balancer services. + properties: + advertisedPort: + description: |- + advertisedPort specifies the advertised port for Kafka external access. + If not configured, it will be the same as the listener port. + Information about the advertised port can be retrieved through the status API. + format: int32 + type: integer + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + bootstrapPrefix: + description: |- + bootstrapPrefix specifies the prefix for the Kafka bootstrap advertised endpoint and will be added as `bootstrapPrefix.domain`. + The default value is the Kafka cluster name. + minLength: 1 + type: string + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the Kafka broker advertised endpoint and will be added as `brokerPrefix.domain`. + The default value is `b`, such as `b#.domain` where `#` starts from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain is the domain name of the component + cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are + `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the + source ranges. + items: + type: string + type: array + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create + Kubernetes node port services. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create + route services in OpenShift. + properties: + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + bootstrapPrefix: + description: |- + bootstrapPrefix specifies the prefix for the Kafka bootstrap advertised endpoint and will be added as `bootstrapPrefix.domain`. + The default value is the Kafka cluster name. + minLength: 1 + type: string + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the Kafka broker advertised endpoint and will be added as `brokerPrefix.domain`. + The default value is `b`, such as `b#.domain` where `#` starts from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain specifies the domain name of the + Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + staticForHostBasedRouting: + description: |- + staticForHostBasedRouting enables external access by doing host based + routing through the SNI capability. + With this schema, CFK only configures Kafka advertised listeners, and no Kubernetes external + service is created. + properties: + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the broker advertised endpoints and are added as `brokerPrefix.domain`. + If not configured, it will add `b` as a prefix, such as `b#.domain` where `#` will start from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain specifies the domain name for + the Kafka cluster. + minLength: 1 + type: string + port: + description: port specifies the port to be used in + the advertised listener for a broker. + format: int32 + type: integer + required: + - domain + - port + type: object + staticForPortBasedRouting: + description: |- + staticForPortBasedRouting enables external access by port routing. + With this schema, CFK only configures Kafka advertised listeners, and no Kubernetes external + service is created. + properties: + host: + description: host defines the host name to be used + in the advertised listener for a broker. + minLength: 1 + type: string + portOffset: + description: |- + portOffset specifies the starting port number. The port numbers go in ascending order with + respect to the replicas count. + format: int32 + type: integer + required: + - host + - portOffset + type: object + type: + description: |- + type specifies the Kubernetes service for external access. + Valid options are `loadBalancer`, `nodePort`, `route`, `staticForPortBasedRouting`, and `staticForHostBasedRouting`. + enum: + - loadBalancer + - nodePort + - route + - staticForPortBasedRouting + - staticForHostBasedRouting + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + metricReporter: + description: |- + metricsReporter specifies the configuration of the metric reporter. The metric reporter is enabled by default. + If authentication and TLS are not set, the metrics reporter uses internal listener's authentication and TLS . + properties: + authentication: + description: authentication specifies the Kafka client-side authentication + configuration. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side JaaS + configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way to + provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap endpoint. + type: string + enabled: + description: enabled specifies whether to enable or disable the + metric reporter. + type: boolean + replicationFactor: + description: replicationFactor specifies the number of replicas + in the metric topic. + format: int32 + type: integer + tls: + description: tls specifies the Kafka client-side TLS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - enabled + type: object + metrics: + description: metrics specify the security settings for the metric + services. + properties: + authentication: + description: authentication specifies the authentication configuration + for the metrics. + properties: + type: + description: type specifies the metrics authentication method. + The valid option is `mtls`. + enum: + - mtls + type: string + required: + - type + type: object + prometheus: + description: prometheus specifies the configuration overrides + for the JMX-Prometheus exporter. + properties: + blacklist: + items: + type: string + type: array + rules: + items: + description: Rule defines the Prometheus Exporter rule override. + properties: + attrNameSnakeCase: + type: boolean + cache: + type: boolean + help: + minLength: 1 + type: string + labels: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: granular + name: + minLength: 1 + type: string + pattern: + minLength: 1 + type: string + type: + minLength: 1 + type: string + value: + minLength: 1 + type: string + valueFactor: + anyOf: + - type: integer + - type: string + default: 1 + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: array + whitelist: + items: + type: string + type: array + type: object + tls: + description: tls specifies the TLS configuration for the metrics. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mountedSecrets: + description: |- + mountedSecrets list the secrets injected to + the underlying statefulset configuration. The secret reference is mounted + in the default path `/mnt/secrets/`. The underlying resources + will follow the secret as a file configuration. + More info: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. + A change to this setting will roll the cluster. + items: + description: |- + MountedSecrets provides a way to inject a custom secret to the underlying + statefulset. + properties: + keyItems: + description: keyItems are key and path names. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + secretRef: + description: secretRef references the name of the secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + type: array + mountedVolumes: + description: |- + mountedVolumes list the custom volumes that need to be mounted into the + underlying statefulset. + A change to this setting will roll the cluster. + properties: + volumeMounts: + description: |- + volumeMounts specify the list of volume mounts for the pods in the + statefulset. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + volumes specify the list of volumes that can be mounted into the pods + of statefulset. + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + format: int32 + type: integer + readOnly: + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: boolean + volumeID: + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in + the blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the + blob storage + type: string + fsType: + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. + properties: + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime + properties: + monitors: + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is /' + type: string + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: boolean + secretFile: + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + secretRef: + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + required: + - monitors + type: object + cinder: + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: boolean + secretRef: + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should + populate this volume + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume + properties: + defaultMode: + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: Items is a list of downward API volume + file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must not + be absolute or contain the ''..'' path. Must + be utf-8 encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. + + + A pod can use both types of ephemeral volumes and + persistent volumes at the same time. + properties: + volumeClaimTemplate: + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. + + + Required, must not be nil. + properties: + metadata: + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. + type: object + spec: + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over + volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#volumeattributesclass + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + items: + type: string + type: array + type: object + flexVolume: + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use + for this volume. + type: string + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds + extra command options if any.' + type: object + readOnly: + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running + properties: + datasetName: + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + properties: + fsType: + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + format: int32 + type: integer + pdName: + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: boolean + required: + - pdName + type: object + gitRepo: + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. + properties: + directory: + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md + properties: + endpoints: + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + path: + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + readOnly: + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. + properties: + path: + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + type: + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + required: + - path + type: object + iscsi: + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication + type: boolean + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + initiatorName: + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + nfs: + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + properties: + path: + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + readOnly: + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: boolean + server: + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine + properties: + fsType: + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx + volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along + with other supported volume types + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume + root to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + required: + - path + type: object + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the + ConfigMap or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the + downwardAPI data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute or + contain the ''..'' path. Must be utf-8 + encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env + vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource + to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + format: int64 + type: integer + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: |- + group to map volume access to + Default is no group + type: string + readOnly: + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. + type: boolean + registry: + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes + type: string + tenant: + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin + type: string + user: + description: |- + user to map volume access to + Defaults to serivceaccount user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + image: + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + keyring: + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + monitors: + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + items: + type: string + type: array + pool: + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: boolean + secretRef: + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. + type: string + system: + description: system is the name of the storage system + as configured in ScaleIO. + type: string + volumeName: + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume + names are only unique within a namespace. + type: string + volumeNamespace: + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - volumeMounts + - volumes + type: object + oneReplicaPerNode: + description: |- + oneReplicaPerNode controls whether to run 1 pod per node using the pod anti-affinity capability. + Enabling this configuration in an existing cluster will roll the cluster. + type: boolean + passwordEncoder: + description: passwordEncoder specifies password encoder secret for + Kafka. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + the required secret is mounted. + Directory should have the file `password-encoder.txt`. The contents should include a new password. + Old password is optional and required only for rotation. + More info: https://docs.confluent.io/operator/current/co-password-encoder-secret. + type: string + secretRef: + description: |- + secretRef specifies the secret name. The secret should have the key + `password-encoder.txt`. The contents should include a new password. + Old password is optional and required only for rotation. + More info: https://docs.confluent.io/operator/current/co-password-encoder-secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + pdb: + description: |- + configures PodDisruptionBudget for the Confluent Platform component. + by default PDB is configured based on pre-detemined formula. + properties: + enabled: + description: enabled specifies whether the PodDisruptionBudget + is enabled + type: boolean + maxUnavailable: + description: maxUnavailable is the maximum number of pods that + can be unavailable during the disruption. + format: int32 + type: integer + required: + - enabled + type: object + podTemplate: + description: podTemplate specifies the statefulset pod template configuration. + properties: + affinity: + description: |- + affinity specifies a group of affinity scheduling rules. + More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs stored with the resource and + may be set by external tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying objects. More + info: http://kubernetes.io/docs/user-guide/annotations. + type: object + x-kubernetes-map-type: granular + envVars: + description: |- + envVars contain environment variables to be injected into containers. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs that can be used to organize and categorize + (scope and select) objects. + More info: http://kubernetes.io/docs/user-guide/labels. + type: object + x-kubernetes-map-type: granular + podSecurityContext: + description: |- + PodSecurityContext holds pod-level security attributes and common container settings. + Some fields are also present in container.securityContext. Field values of + container.securityContext take precedence over field values of PodSecurityContext. + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + priorityClassName: + description: priorityClassName specifies the priority class for + the pod (if any). + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + probe: + description: probe contains the fields for standard Kubernetes + readiness/liveness probe configuration. + properties: + liveness: + description: |- + liveness configures the Kubernetes probe settings. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + readiness: + description: |- + readiness configures the Kubernetes probe setting. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + type: object + resources: + description: resources describe the compute resource requirements. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: |- + SecurityContext holds security configuration that will be applied to a container. + Some fields are present in both SecurityContext and PodSecurityContext. When both + are set, the values in SecurityContext take precedence. + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the service account used to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account. + type: string + terminationGracePeriodSeconds: + description: terminationGracePeriodSeconds is the grace period + before the pod is deleted. + format: int64 + type: integer + tolerations: + description: |- + tolerations specify the pods to schedule onto the nodes with matching taints, using + the triple `` and the matching operator ``. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + topologySpreadConstraints describe how a group of pods ought to spread across topology domains. Scheduler will + schedule pods based on the constraints. All topologySpreadConstraints are ANDed. + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + + + This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + rackAssignment: + description: rackAssignment specifies the rack awareness capability + of the Kafka cluster. + properties: + availabilityZoneCount: + description: |- + availabilityZoneCount configures `broker.rack` with the formula (`pod_id % azCount`). + This is mainly for backwards compatibility with Operator 1.x. + format: int32 + type: integer + nodeLabels: + description: |- + nodeLabels use the Kubernetes node API + to retrieve the label values to be used in `broker.rack`. This + feature requires CFK to run with the cluster-level access. + items: + type: string + minItems: 1 + type: array + type: object + replicas: + description: |- + replicas is the desired number of replicas. + A change to this setting will roll the cluster. + format: int32 + type: integer + services: + description: services specify the supported Kafka services. + properties: + kafkaRest: + description: kafkaRest specifies the embedded REST API server + configuration. + properties: + authentication: + description: authentication specifies the REST API server + authentication configuration. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API server. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + externalAccess: + description: externalAccess specifies the external access + configuration. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component + cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are + `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the + source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create + a Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create + a route service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the + Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + listeners: + description: listeners specify the listeners configurations + for embedded REST API server. + properties: + external: + description: external specifies the Confluent component + external listener. + properties: + externalAccess: + description: externalAccess defines the external access + configuration for the Confluent component. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string + key and value pairs. It specifies Kubernetes + annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of + the component cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies + the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key + and value pairs. It specifies Kubernetes + labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify + the source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information + on service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed + by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains + the configurations of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration + to create a Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string + key and value pairs. It specifies Kubernetes + annotations for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of + the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key + and value pairs. It specifies Kubernetes + labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information + on service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed + by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains + the configurations of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration + to create a route service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string + key and value pairs. It specifies Kubernetes + annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name + of the Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key + and value pairs. It specifies Kubernetes + labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for + the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS + configuration for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret + containing the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + internal: + description: |- + internal specifies the Confluent component's internal listener. + This internal listener is for intra-communication between the pods. + properties: + port: + description: |- + port binds the given port to the internal listener. If not configured, + it will be defaulted to the component-specific internal port. + Port numbers lower than `9093` are reserved by CFK. + format: int32 + minimum: 9093 + type: integer + tls: + description: tls specifies the TLS configuration for + the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS + configuration for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret + containing the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + tls: + description: tls specifies the TLS configuration for embedded + REST API server. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mds: + description: mds specifies the MDS server configuration. + properties: + authentication: + description: authentication specifies the MDS server authentication + configuration. + properties: + type: + description: type defines the MDS authentication type. + The valid option is `bearer`. + enum: + - bearer + type: string + required: + - type + type: object + externalAccess: + description: externalAccess specifies the external access + configuration. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component + cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are + `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the + source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create + a Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create + a route service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the + Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + listeners: + description: listeners specify the listeners configurations + for MDS server. + properties: + external: + description: external specifies the Confluent component + external listener. + properties: + externalAccess: + description: externalAccess defines the external access + configuration for the Confluent component. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string + key and value pairs. It specifies Kubernetes + annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of + the component cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies + the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key + and value pairs. It specifies Kubernetes + labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify + the source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information + on service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed + by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains + the configurations of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration + to create a Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string + key and value pairs. It specifies Kubernetes + annotations for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of + the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key + and value pairs. It specifies Kubernetes + labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information + on service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed + by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains + the configurations of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration + to create a route service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string + key and value pairs. It specifies Kubernetes + annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name + of the Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key + and value pairs. It specifies Kubernetes + labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for + the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS + configuration for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret + containing the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + internal: + description: |- + internal specifies the Confluent component's internal listener. + This internal listener is for intra-communication between the pods. + properties: + port: + description: |- + port binds the given port to the internal listener. If not configured, + it will be defaulted to the component-specific internal port. + Port numbers lower than `9093` are reserved by CFK. + format: int32 + minimum: 9093 + type: integer + tls: + description: tls specifies the TLS configuration for + the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS + configuration for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret + containing the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + provider: + description: provider specifies the identity provider configuration. + properties: + ldap: + description: ldap defines the LDAP service configuration. + properties: + address: + description: address defines the LDAP server address. + type: string + authentication: + description: LdapAuthentication specifies the LDAP + authentication configuration. + properties: + simple: + description: simple specifies simple authentication + configuration for the LDAP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name + of the secret that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: type defines the authentication method + for LDAP. Valid options are `simple` and `mtls`. + enum: + - simple + - mtls + type: string + required: + - type + type: object + configurations: + description: configurations defines the LDAP configurations + for Confluent RBAC. + properties: + groupMemberAttribute: + description: groupMemberAttribute specifies the + LDAP group member attribute. + minLength: 1 + type: string + groupMemberAttributePattern: + description: groupMemberAttributePattern specifies + the regular expression pattern for the LDAP + group member attribute. + minLength: 1 + type: string + groupNameAttribute: + description: groupNameAttribute specifies the + LDAP group name attribute. + minLength: 1 + type: string + groupObjectClass: + description: groupObjectClass specifies the LDAP + group object class. + minLength: 1 + type: string + groupSearchBase: + description: groupSearchBase specifies the LDAP + search base for the group-based search. + minLength: 1 + type: string + groupSearchFilter: + description: groupSearchFilter specifies the LDAP + search filter for the group-based search. + minLength: 1 + type: string + groupSearchScope: + description: groupSearchScope specifies the LDAP + search scope for the group-based search. + format: int32 + type: integer + userMemberOfAttributePattern: + description: userMemberOfAttributePattern specifies + the regular expression pattern for the LDAP + user member attribute. + minLength: 1 + type: string + userNameAttribute: + description: userNameAttribute specifies the LDAP + username attribute. + minLength: 1 + type: string + userObjectClass: + description: userObjectClass specifies the LDAP + user object class. + minLength: 1 + type: string + userSearchBase: + description: userSearchBase specifies the LDAP + search base for the user-based search. + minLength: 1 + type: string + userSearchFilter: + description: userSearchFilter specifies the LDAP + search filter for the user-based search. + minLength: 1 + type: string + userSearchScope: + description: userSearchScope specifies the LDAP + search scope for the user-based search. + format: int32 + type: integer + type: object + tls: + description: tls specifies the TLS configuration for + the LDAP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS + configuration for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret + containing the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - address + - authentication + - configurations + type: object + oauth: + description: oauth defines the OAuth service configuration. + properties: + configurations: + description: configurations defines the OAuth configurations. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + tls: + description: tls specifies the TLS configuration for + the OAuth IDP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS + configuration for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret + containing the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - configurations + type: object + oidc: + description: |- + this field has been superseded with sso field + oidc defines the OIDC service configuration. + properties: + clientCredentials: + description: clientCredentials define the IDP clientID + and clientSecret. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name of + the secret that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + configurations: + description: configurations defines the OIDC configurations. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + authorizeBaseEndpointUri: + description: authorizeBaseEndpointUri specifies + the base uri for authorize endpoint. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + groupsClaimScope: + description: |- + groupsClaimScope specifies additional scope needed for the token to contain groups claim (field). + Leave this field empty (or null) if id token always contains the claims identified as groups. + minLength: 1 + type: string + issuer: + description: |- + issuer specifies the authorization server's URL. + This value should match the issuer claim ("iss") in id tokens issued by Authorization Server? + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + refreshToken: + description: refreshToken specifies whether offline_access + scope should be requested in the authorization + URI. + type: boolean + sessionMaxTimeout: + description: sessionMaxTimeout specifies the maximum + expiration time for a user's session. + format: int32 + type: integer + sessionTokenExpiry: + description: sessionTokenExpiry specifies the + validity of cookie issued by Confluent. + format: int32 + type: integer + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenBaseEndpointUri: + description: tokenBaseEndpointUri specifies the + base uri for token endpoint. + minLength: 1 + type: string + required: + - authorizeBaseEndpointUri + - issuer + - jwksEndpointUri + - refreshToken + - tokenBaseEndpointUri + type: object + enabled: + default: true + description: |- + enabled specifies whether the SSO is enabled. + default is true. + type: boolean + required: + - clientCredentials + - configurations + type: object + sso: + description: sso defines the SSO service configuration. + properties: + clientCredentials: + description: clientCredentials define the IDP clientID + and clientSecret. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name of + the secret that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + configurations: + description: configurations defines the OIDC configurations. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + authorizeBaseEndpointUri: + description: authorizeBaseEndpointUri specifies + the base uri for authorize endpoint. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + groupsClaimScope: + description: |- + groupsClaimScope specifies additional scope needed for the token to contain groups claim (field). + Leave this field empty (or null) if id token always contains the claims identified as groups. + minLength: 1 + type: string + issuer: + description: |- + issuer specifies the authorization server's URL. + This value should match the issuer claim ("iss") in id tokens issued by Authorization Server? + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + refreshToken: + description: refreshToken specifies whether offline_access + scope should be requested in the authorization + URI. + type: boolean + sessionMaxTimeout: + description: sessionMaxTimeout specifies the maximum + expiration time for a user's session. + format: int32 + type: integer + sessionTokenExpiry: + description: sessionTokenExpiry specifies the + validity of cookie issued by Confluent. + format: int32 + type: integer + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenBaseEndpointUri: + description: tokenBaseEndpointUri specifies the + base uri for token endpoint. + minLength: 1 + type: string + required: + - authorizeBaseEndpointUri + - issuer + - jwksEndpointUri + - refreshToken + - tokenBaseEndpointUri + type: object + enabled: + default: true + description: |- + enabled specifies whether the SSO is enabled. + default is true. + type: boolean + required: + - clientCredentials + - configurations + type: object + type: + description: This field has been deprecated and its value + will be ignored if set. + type: string + type: object + tls: + description: tls specifies the TLS configuration for MDS server. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + tokenKeyPair: + description: tokenKeyPair specifies the token key pair for + the MDS. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the MDS token key pair are mounted. + minLength: 1 + type: string + encryptedTokenKey: + description: |- + EncryptedTokenKey boolean value indicating whether the tokenKeypair(private used for signing) is encrypted using a passphrase. If true, cfk + operator will look for a file named mdsTokenKeyPassphrase.txt containing key value pair + mdsTokenKeyPassphrase=. Relevant only for mds server. Ignored if set for a client configuration. + type: boolean + secretRef: + description: secretRef references the name of the secret + that contains the MDS token key pair. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - provider + - tokenKeyPair + type: object + type: object + storageClass: + description: |- + storageClass specifies the user-provided storage class. If not + configured, it will use the default storage class. + properties: + name: + description: name is the storage class name. + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + telemetry: + description: telemetry specifies the Confluent telemetry reporter + configuration. + properties: + global: + description: |- + global allows disabling telemetry configuration. + If CFK is deployed with telemetry, this field is only + used to disable telemetry. The default value is `true` if + telemetry is enabled at the global level. + type: boolean + type: object + tls: + description: |- + tls specifies the global-level TLS configuration which can be used by + listeners and services. + properties: + autoGeneratedCerts: + description: |- + autoGeneratedCerts specifies that the certificates are auto-generated based on + the CA key pair provided. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the cp component's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS + configuration for cp components. + type: boolean + required: + - enabled + type: object + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing the + JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - dataVolumeCapacity + - image + type: object + status: + description: status defines the observed state of the Kafka cluster. + properties: + arbitraryData: + description: arbitraryData is the map for any arbitrary data associated + with this Confluent component. + x-kubernetes-preserve-unknown-fields: true + authorizationType: + description: authorizationType is the authorization type for this + Confluent component. + type: string + brokerIdOffset: + description: brokerIdOffset is the broker id offset of the Kafka cluster. + format: int32 + type: integer + clusterID: + description: clusterID is the ID of the Kafka cluster. + type: string + clusterName: + description: clusterName is the name of the Confluent Platform component + cluster. + type: string + clusterNamespace: + description: clusterNamespace is the namespace where the Confluent + Platform component cluster is running. + type: string + conditions: + description: conditions specify the latest available observations + of the current state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + currentClusterVersion: + description: currentClusterVersion is the current CP Server version + type: string + currentReplicas: + description: currentReplicas is the number of currently running replicas. + format: int32 + type: integer + internalSecrets: + description: |- + internalSecrets are internal secrets created + by CFK for this Confluent component. + items: + type: string + type: array + internalTopicNames: + description: internalTopicNames are the topics used by the component + for internal use. + items: + type: string + type: array + listeners: + additionalProperties: + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + client: + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + description: listeners is a map for the status of Kafka Listeners. + type: object + x-kubernetes-map-type: granular + minISR: + description: minISR is the minimum number of in sync replicas in the + Kafka cluster. + format: int32 + type: integer + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + operatorVersion: + description: operatorVersion is the internal version of CFK. + type: string + phase: + description: |- + phase describes the state of the Confluent Platform component. This can either be 'PROVISIONING' + or 'RUNNING' + 'PROVISIONING' means the Confluent Platform component is currently getting deployed and not ready yet. + 'RUNNING' means the Confluent Platform component has been successfully deployed. + type: string + previousClusterVersion: + description: previousClusterVersion is the previous CP Server version + of the kafka cluster. + type: string + readyReplicas: + description: readyReplicas is the number of currently ready replicas. + format: int32 + type: integer + replicas: + description: replicas is the number of replicas. + format: int32 + type: integer + replicationFactor: + description: replicationFactor is the replication factor of the topics + in the Kafka cluster. + format: int32 + type: integer + selector: + description: |- + selector gets the label selector of the child pod. + The Horizontal Pod Autoscaler(HPA) will scale using the label selector of the child pod. + type: string + services: + additionalProperties: + description: ListenerStatus describes general information about + the listeners. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + description: services is a map for the Kafka services. + type: object + x-kubernetes-map-type: granular + zookeeperConnect: + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkatopics.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkatopics.yaml new file mode 100644 index 000000000..0a71576b2 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kafkatopics.yaml @@ -0,0 +1,410 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: kafkatopics.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: KafkaTopic + listKind: KafkaTopicList + plural: kafkatopics + shortNames: + - kt + - topic + singular: kafkatopic + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.partitionCount + name: Partition + type: string + - jsonPath: .status.state + name: Status + type: string + - jsonPath: .status.kafkaClusterID + name: ClusterID + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.kafkaCluster + name: KafkaCluster + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: KafkaTopic is the schema for the Kafka Topic API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the KafkaTopic. + properties: + configs: + additionalProperties: + type: string + description: |- + configs is a map of string key and value pairs that are used to pass the configuration settings for the topic. + More info: https://docs.confluent.io/current/installation/configuration/topic-configs.html. + type: object + x-kubernetes-map-type: granular + kafkaClusterRef: + description: kafkaClusterRef specifies the name of the Kafka cluster. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + kafkaRest: + description: kafkaRest specifies the Kafka REST API configuration. + properties: + authentication: + description: authentication specifies the REST API authentication + mechanism. + properties: + basic: + description: basic specifies the basic authentication settings + for the REST API client. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + bearer: + description: bearer specifies the bearer authentication settings + for the REST API client. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication settings + for the REST API client. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the + basic credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass + the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the REST API authentication type. + Valid options are `basic`, `bearer`, `mtls` and `oauth`. + enum: + - basic + - bearer + - mtls + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies where Confluent REST API is running. + minLength: 1 + pattern: ^https?://.* + type: string + kafkaClusterID: + description: |- + kafkaClusterID specifies the id of Kafka cluster. + It takes precedence over using the Kafka REST API to get the cluster id. + minLength: 1 + type: string + tls: + description: "tls specifies the custom TLS structure for the application + resources,\n\t// e.g. connector, topic, schema, of the Confluent + Platform components.\n\t// +optional" + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `keystore.jks`, `truststore.jks`, `jksPassword.txt` keys are mounted. + minLength: 1 + type: string + jksPassword: + description: jksPassword specifies the secret name that contains + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef specifies the secret name that contains the certificates. + More info about certificates key/value format: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + kafkaRestClassRef: + description: kafkaRestClassRef references the KafkaRestClass which + defines Kafka REST API connection information. + properties: + name: + description: name specifies the name of the KafkaRestClass application + resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + name: + description: |- + name specifies the topic name. If not configured, the KafkaTopic CR name is used + as the topic name. + maxLength: 255 + minLength: 1 + pattern: ^[a-zA-Z0-9\._\-]*$ + type: string + partitionCount: + description: |- + partitionCount specifies the number of partitions for the topic. + If not configured, it will be defaulted to the partition count that Kafka REST V3 API supports. + format: int32 + type: integer + replicas: + description: |- + replicas specifies the replication factor for the topic. + If not configured, it will be defaulted to the replication factor that Kafka REST V3 API supports. + format: int32 + type: integer + type: object + status: + description: status defines the observed state of the KafkaTopic. + properties: + appState: + default: Unknown + description: appState is the current state of the topic application. + enum: + - Unknown + - Created + - Failed + - Deleted + type: string + conditions: + description: conditions are the latest available observed states of + the topic. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + kafkaCluster: + type: string + kafkaClusterID: + description: kafkaClusterID is the id of the Kafka cluster. + type: string + kafkaRestEndpoint: + description: kafkaRestEndpoint is the endpoint of the Kafka REST API. + type: string + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + partitionCount: + description: partitionCount is the partition count of the topic. + format: int32 + type: integer + replicas: + description: replicas is the replication factor of the topic. + format: int32 + type: integer + state: + description: state is the state of the topic. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kraftcontrollers.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kraftcontrollers.yaml new file mode 100644 index 000000000..dc6bd45ba --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kraftcontrollers.yaml @@ -0,0 +1,5752 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: kraftcontrollers.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: KRaftController + listKind: KRaftControllerList + plural: kraftcontrollers + shortNames: + - kraftcontroller + - kraft + singular: kraftcontroller + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.readyReplicas + name: Ready + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.controllerQuorumVoters + name: ControllerQuorumVoters + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: KRaftController is the schema for the KRaft Controller API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the KRaft Controller cluster. + properties: + authorization: + description: authorization specifies the authorization configuration. + properties: + superUsers: + description: |- + superUsers specify the super users to give the admin privilege on the Kafka Cluster. + This list takes the format as `User:` + items: + type: string + type: array + type: + description: type specifies the authorization type. The valid + options are `rbac` and `simple`. + enum: + - rbac + - simple + type: string + required: + - type + type: object + clusterID: + description: |- + clusterID specifies the ID of the KRaft Controller cluster. It must contain only alphanumeric characters and the + hyphen character and be of length 22. If omitted, a clusterID will be autogenerated. + In the case of attaching to existing Persistent Volumes, you must match the old clusterID. + maxLength: 22 + minLength: 22 + pattern: ^[a-zA-Z0-9\-\_]*$ + type: string + configOverrides: + description: configOverrides specifies the configs to override the + server, JVM, Log4j properties for the KRaft Controller cluster. + properties: + jvm: + description: |- + jvm is a list of JVM configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + log4j: + description: |- + log4j is a list of Log4J configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + server: + description: |- + server is a list of server configuration supported by the Confluent Platform component. + This will either add or update existing configuration. + items: + type: string + type: array + type: object + controllerQuorumVoters: + description: |- + QuorumVoters specify a list of kraft controllers. This is only required when deploying stretch + kafka clusters for MRC deployments in multiple DCs (or K8s clusters) and should include all the kraft controllers in other DCs that form the ensemble. + items: + description: ControllerQuorumVoter defines the KRaft controller + quorum voter. + properties: + brokerEndpoint: + description: brokerEndpoint is the endpoint of the KRaft Controller. + type: string + nodeId: + description: nodeId is the nodeId of the KRaft Controller. + format: int32 + type: integer + required: + - brokerEndpoint + - nodeId + type: object + type: array + dataVolumeCapacity: + anyOf: + - type: integer + - type: string + description: dataVolumeCapacity specifies the persistent volume capacity + for the KRaft Controller cluster. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + dependencies: + description: de + properties: + mdsKafkaCluster: + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the KRaft Controller + cluster's TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS configuration + for cp components. + type: boolean + required: + - enabled + type: object + headlessService: + description: headlessService specifies the configuration of the Kubernetes + headless service. + properties: + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs. + It specifies the annotations to be added to the CFK-created headless service. + These annotations are merged with the injectAnnotations and take precedence. + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs. + It specifies the labels to be added to the CFK-created headless service. + These labels are merged with the injectLabels and take precedence. + type: object + x-kubernetes-map-type: granular + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses specifies the publishNotReadyAddresses field. + For Kafka, this value must be true. The default value is true. + type: boolean + type: object + identityProvider: + description: |- + identityProvider specifies the identity provider configuration. + It is only required for the Kafka authentication type `ldap`. + properties: + ldap: + description: ldap defines the LDAP service configuration. + properties: + address: + description: address defines the LDAP server address. + type: string + authentication: + description: LdapAuthentication specifies the LDAP authentication + configuration. + properties: + simple: + description: simple specifies simple authentication configuration + for the LDAP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name of the + secret that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: type defines the authentication method for + LDAP. Valid options are `simple` and `mtls`. + enum: + - simple + - mtls + type: string + required: + - type + type: object + configurations: + description: configurations defines the LDAP configurations + for Confluent RBAC. + properties: + groupMemberAttribute: + description: groupMemberAttribute specifies the LDAP group + member attribute. + minLength: 1 + type: string + groupMemberAttributePattern: + description: groupMemberAttributePattern specifies the + regular expression pattern for the LDAP group member + attribute. + minLength: 1 + type: string + groupNameAttribute: + description: groupNameAttribute specifies the LDAP group + name attribute. + minLength: 1 + type: string + groupObjectClass: + description: groupObjectClass specifies the LDAP group + object class. + minLength: 1 + type: string + groupSearchBase: + description: groupSearchBase specifies the LDAP search + base for the group-based search. + minLength: 1 + type: string + groupSearchFilter: + description: groupSearchFilter specifies the LDAP search + filter for the group-based search. + minLength: 1 + type: string + groupSearchScope: + description: groupSearchScope specifies the LDAP search + scope for the group-based search. + format: int32 + type: integer + userMemberOfAttributePattern: + description: userMemberOfAttributePattern specifies the + regular expression pattern for the LDAP user member + attribute. + minLength: 1 + type: string + userNameAttribute: + description: userNameAttribute specifies the LDAP username + attribute. + minLength: 1 + type: string + userObjectClass: + description: userObjectClass specifies the LDAP user object + class. + minLength: 1 + type: string + userSearchBase: + description: userSearchBase specifies the LDAP search + base for the user-based search. + minLength: 1 + type: string + userSearchFilter: + description: userSearchFilter specifies the LDAP search + filter for the user-based search. + minLength: 1 + type: string + userSearchScope: + description: userSearchScope specifies the LDAP search + scope for the user-based search. + format: int32 + type: integer + type: object + tls: + description: tls specifies the TLS configuration for the LDAP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - address + - authentication + - configurations + type: object + oauth: + description: oauth defines the OAuth service configuration. + properties: + configurations: + description: configurations defines the OAuth configurations. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + tls: + description: tls specifies the TLS configuration for the OAuth + IDP. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - configurations + type: object + oidc: + description: |- + this field has been superseded with sso field + oidc defines the OIDC service configuration. + properties: + clientCredentials: + description: clientCredentials define the IDP clientID and + clientSecret. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name of the secret + that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + configurations: + description: configurations defines the OIDC configurations. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + authorizeBaseEndpointUri: + description: authorizeBaseEndpointUri specifies the base + uri for authorize endpoint. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + groupsClaimScope: + description: |- + groupsClaimScope specifies additional scope needed for the token to contain groups claim (field). + Leave this field empty (or null) if id token always contains the claims identified as groups. + minLength: 1 + type: string + issuer: + description: |- + issuer specifies the authorization server's URL. + This value should match the issuer claim ("iss") in id tokens issued by Authorization Server? + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + refreshToken: + description: refreshToken specifies whether offline_access + scope should be requested in the authorization URI. + type: boolean + sessionMaxTimeout: + description: sessionMaxTimeout specifies the maximum expiration + time for a user's session. + format: int32 + type: integer + sessionTokenExpiry: + description: sessionTokenExpiry specifies the validity + of cookie issued by Confluent. + format: int32 + type: integer + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenBaseEndpointUri: + description: tokenBaseEndpointUri specifies the base uri + for token endpoint. + minLength: 1 + type: string + required: + - authorizeBaseEndpointUri + - issuer + - jwksEndpointUri + - refreshToken + - tokenBaseEndpointUri + type: object + enabled: + default: true + description: |- + enabled specifies whether the SSO is enabled. + default is true. + type: boolean + required: + - clientCredentials + - configurations + type: object + sso: + description: sso defines the SSO service configuration. + properties: + clientCredentials: + description: clientCredentials define the IDP clientID and + clientSecret. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the credentials are mounted. + minLength: 1 + type: string + secretRef: + description: secretRef references the name of the secret + that contains the credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + configurations: + description: configurations defines the OIDC configurations. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + authorizeBaseEndpointUri: + description: authorizeBaseEndpointUri specifies the base + uri for authorize endpoint. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + groupsClaimScope: + description: |- + groupsClaimScope specifies additional scope needed for the token to contain groups claim (field). + Leave this field empty (or null) if id token always contains the claims identified as groups. + minLength: 1 + type: string + issuer: + description: |- + issuer specifies the authorization server's URL. + This value should match the issuer claim ("iss") in id tokens issued by Authorization Server? + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + refreshToken: + description: refreshToken specifies whether offline_access + scope should be requested in the authorization URI. + type: boolean + sessionMaxTimeout: + description: sessionMaxTimeout specifies the maximum expiration + time for a user's session. + format: int32 + type: integer + sessionTokenExpiry: + description: sessionTokenExpiry specifies the validity + of cookie issued by Confluent. + format: int32 + type: integer + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenBaseEndpointUri: + description: tokenBaseEndpointUri specifies the base uri + for token endpoint. + minLength: 1 + type: string + required: + - authorizeBaseEndpointUri + - issuer + - jwksEndpointUri + - refreshToken + - tokenBaseEndpointUri + type: object + enabled: + default: true + description: |- + enabled specifies whether the SSO is enabled. + default is true. + type: boolean + required: + - clientCredentials + - configurations + type: object + type: + description: This field has been deprecated and its value will + be ignored if set. + type: string + type: object + image: + description: |- + image specifies the application and the init docker image configurations. + A change to this setting will roll the cluster. + properties: + application: + description: |- + application is the Docker image name of the application. Specify + `//:`. + pattern: .+:.+ + type: string + init: + description: |- + init is the init-container name. Specify + `//:`. + pattern: .+:.+ + type: string + pullPolicy: + description: |- + pullPolicy is the policy for pulling images. Valid options are `Always`, `Never`, and `IfNotPresent`. + The default value is `IfNotPresent`. + enum: + - Always + - Never + - IfNotPresent + type: string + pullSecretRef: + description: |- + pullSecretRef references the secrets in the same namespace to be used for pulling images. + Image pull secrets are distinct from secrets because secrets + can be mounted in the pod, but image pull secrets are only accessed by `kubelet`. + More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod + items: + type: string + type: array + required: + - application + - init + type: object + injectAnnotations: + additionalProperties: + type: string + description: |- + injectAnnotations are the annotations injected to the internal resources that CFK created. + The internal annotations are preserved and cannot be overridden. + For pod annotations, use `podTemplate.annotations`. + type: object + x-kubernetes-map-type: granular + injectLabels: + additionalProperties: + type: string + description: |- + injectLabels are the labels injected to the internal resources that CFK created. + The internal labels are preserved and cannot be overridden. + For pod labels, use `podTemplate.labels`. + type: object + x-kubernetes-map-type: granular + k8sClusterDomain: + description: |- + k8sClusterDomain specifies the configuration of the Kubernetes cluster domain. + The default is the `cluster.local` domain. + type: string + license: + description: license specifies the license configuration for the Confluent + Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + the license key is mounted. More info: + https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + minLength: 1 + type: string + globalLicense: + description: globalLicense specifies whether the Confluent Platform + component shares the common global license. + type: boolean + secretRef: + description: |- + secretRef references the secret that provides the license for the Confluent Platform component. + More info: https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + listeners: + description: listeners specify the listeners configurations. + properties: + controller: + description: controller specifies the controller listener. + properties: + authentication: + description: authentication specifies the authentication configuration + for the listener. + properties: + jaasConfig: + description: |- + jaasConfig specifies the JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: |- + jaasConfigPassThrough specifies another way to provide JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + principalMappingRules: + items: + type: string + type: array + type: + description: |- + type specifies the Kafka or Zookeeper authentication type. + Valid options are `plain`, `digest`, `mtls`, `ldap` & `oauth`. + enum: + - plain + - digest + - mtls + - ldap + - oauth + type: string + required: + - type + type: object + externalAccess: + description: externalAccess defines the external access configuration + for the Kafka cluster. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create Kubernetes load balancer services. + properties: + advertisedPort: + description: |- + advertisedPort specifies the advertised port for Kafka external access. + If not configured, it will be the same as the listener port. + Information about the advertised port can be retrieved through the status API. + format: int32 + type: integer + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + bootstrapPrefix: + description: |- + bootstrapPrefix specifies the prefix for the Kafka bootstrap advertised endpoint and will be added as `bootstrapPrefix.domain`. + The default value is the Kafka cluster name. + minLength: 1 + type: string + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the Kafka broker advertised endpoint and will be added as `brokerPrefix.domain`. + The default value is `b`, such as `b#.domain` where `#` starts from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain is the domain name of the component + cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are + `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the + source ranges. + items: + type: string + type: array + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create + Kubernetes node port services. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create + route services in OpenShift. + properties: + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + bootstrapPrefix: + description: |- + bootstrapPrefix specifies the prefix for the Kafka bootstrap advertised endpoint and will be added as `bootstrapPrefix.domain`. + The default value is the Kafka cluster name. + minLength: 1 + type: string + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the Kafka broker advertised endpoint and will be added as `brokerPrefix.domain`. + The default value is `b`, such as `b#.domain` where `#` starts from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain specifies the domain name of the + Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + staticForHostBasedRouting: + description: |- + staticForHostBasedRouting enables external access by doing host based + routing through the SNI capability. + With this schema, CFK only configures Kafka advertised listeners, and no Kubernetes external + service is created. + properties: + brokerPrefix: + description: |- + brokerPrefix specifies the prefix for the broker advertised endpoints and are added as `brokerPrefix.domain`. + If not configured, it will add `b` as a prefix, such as `b#.domain` where `#` will start from `0` to the replicas count. + minLength: 1 + type: string + domain: + description: domain specifies the domain name for + the Kafka cluster. + minLength: 1 + type: string + port: + description: port specifies the port to be used in + the advertised listener for a broker. + format: int32 + type: integer + required: + - domain + - port + type: object + staticForPortBasedRouting: + description: |- + staticForPortBasedRouting enables external access by port routing. + With this schema, CFK only configures Kafka advertised listeners, and no Kubernetes external + service is created. + properties: + host: + description: host defines the host name to be used + in the advertised listener for a broker. + minLength: 1 + type: string + portOffset: + description: |- + portOffset specifies the starting port number. The port numbers go in ascending order with + respect to the replicas count. + format: int32 + type: integer + required: + - host + - portOffset + type: object + type: + description: |- + type specifies the Kubernetes service for external access. + Valid options are `loadBalancer`, `nodePort`, `route`, `staticForPortBasedRouting`, and `staticForHostBasedRouting`. + enum: + - loadBalancer + - nodePort + - route + - staticForPortBasedRouting + - staticForHostBasedRouting + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + metricReporter: + description: |- + metricsReporter specifies the configuration of the metric reporter. The metric reporter is enabled by default. + If authentication and TLS are not set, the metrics reporter uses internal listener's authentication and TLS . + properties: + authentication: + description: authentication specifies the Kafka client-side authentication + configuration. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side JaaS + configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way to + provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap endpoint. + type: string + enabled: + description: enabled specifies whether to enable or disable the + metric reporter. + type: boolean + replicationFactor: + description: replicationFactor specifies the number of replicas + in the metric topic. + format: int32 + type: integer + tls: + description: tls specifies the Kafka client-side TLS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + required: + - enabled + type: object + metrics: + description: metrics specify the security settings for the metric + services. + properties: + authentication: + description: authentication specifies the authentication configuration + for the metrics. + properties: + type: + description: type specifies the metrics authentication method. + The valid option is `mtls`. + enum: + - mtls + type: string + required: + - type + type: object + prometheus: + description: prometheus specifies the configuration overrides + for the JMX-Prometheus exporter. + properties: + blacklist: + items: + type: string + type: array + rules: + items: + description: Rule defines the Prometheus Exporter rule override. + properties: + attrNameSnakeCase: + type: boolean + cache: + type: boolean + help: + minLength: 1 + type: string + labels: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: granular + name: + minLength: 1 + type: string + pattern: + minLength: 1 + type: string + type: + minLength: 1 + type: string + value: + minLength: 1 + type: string + valueFactor: + anyOf: + - type: integer + - type: string + default: 1 + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: array + whitelist: + items: + type: string + type: array + type: object + tls: + description: tls specifies the TLS configuration for the metrics. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mountedSecrets: + description: |- + mountedSecrets list the secrets injected to + the underlying statefulset configuration. The secret reference is mounted + in the default path `/mnt/secrets/`. The underlying resources + will follow the secret as a file configuration. + More info: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. + A change to this setting will roll the cluster. + items: + description: |- + MountedSecrets provides a way to inject a custom secret to the underlying + statefulset. + properties: + keyItems: + description: keyItems are key and path names. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + secretRef: + description: secretRef references the name of the secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + type: array + mountedVolumes: + description: |- + mountedVolumes list the custom volumes that need to be mounted into the + underlying statefulset. + A change to this setting will roll the cluster. + properties: + volumeMounts: + description: |- + volumeMounts specify the list of volume mounts for the pods in the + statefulset. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + volumes specify the list of volumes that can be mounted into the pods + of statefulset. + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + format: int32 + type: integer + readOnly: + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: boolean + volumeID: + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in + the blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the + blob storage + type: string + fsType: + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. + properties: + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime + properties: + monitors: + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is /' + type: string + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: boolean + secretFile: + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + secretRef: + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + required: + - monitors + type: object + cinder: + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: boolean + secretRef: + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should + populate this volume + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume + properties: + defaultMode: + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: Items is a list of downward API volume + file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must not + be absolute or contain the ''..'' path. Must + be utf-8 encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. + + + A pod can use both types of ephemeral volumes and + persistent volumes at the same time. + properties: + volumeClaimTemplate: + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. + + + Required, must not be nil. + properties: + metadata: + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. + type: object + spec: + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over + volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#volumeattributesclass + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + items: + type: string + type: array + type: object + flexVolume: + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use + for this volume. + type: string + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds + extra command options if any.' + type: object + readOnly: + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running + properties: + datasetName: + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + properties: + fsType: + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + format: int32 + type: integer + pdName: + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: boolean + required: + - pdName + type: object + gitRepo: + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. + properties: + directory: + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md + properties: + endpoints: + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + path: + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + readOnly: + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. + properties: + path: + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + type: + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + required: + - path + type: object + iscsi: + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication + type: boolean + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + initiatorName: + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + nfs: + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + properties: + path: + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + readOnly: + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: boolean + server: + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine + properties: + fsType: + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx + volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along + with other supported volume types + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume + root to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + required: + - path + type: object + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the + ConfigMap or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the + downwardAPI data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute or + contain the ''..'' path. Must be utf-8 + encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env + vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource + to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + format: int64 + type: integer + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: |- + group to map volume access to + Default is no group + type: string + readOnly: + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. + type: boolean + registry: + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes + type: string + tenant: + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin + type: string + user: + description: |- + user to map volume access to + Defaults to serivceaccount user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + image: + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + keyring: + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + monitors: + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + items: + type: string + type: array + pool: + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: boolean + secretRef: + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. + type: string + system: + description: system is the name of the storage system + as configured in ScaleIO. + type: string + volumeName: + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume + names are only unique within a namespace. + type: string + volumeNamespace: + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - volumeMounts + - volumes + type: object + oneReplicaPerNode: + description: |- + oneReplicaPerNode controls whether to run 1 pod per node using the pod anti-affinity capability. + Enabling this configuration in an existing cluster will roll the cluster. + type: boolean + pdb: + description: |- + configures PodDisruptionBudget for the Confluent Platform component. + by default PDB is configured based on pre-detemined formula. + properties: + enabled: + description: enabled specifies whether the PodDisruptionBudget + is enabled + type: boolean + maxUnavailable: + description: maxUnavailable is the maximum number of pods that + can be unavailable during the disruption. + format: int32 + type: integer + required: + - enabled + type: object + podTemplate: + description: podTemplate specifies the statefulset pod template configuration. + properties: + affinity: + description: |- + affinity specifies a group of affinity scheduling rules. + More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs stored with the resource and + may be set by external tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying objects. More + info: http://kubernetes.io/docs/user-guide/annotations. + type: object + x-kubernetes-map-type: granular + envVars: + description: |- + envVars contain environment variables to be injected into containers. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs that can be used to organize and categorize + (scope and select) objects. + More info: http://kubernetes.io/docs/user-guide/labels. + type: object + x-kubernetes-map-type: granular + podSecurityContext: + description: |- + PodSecurityContext holds pod-level security attributes and common container settings. + Some fields are also present in container.securityContext. Field values of + container.securityContext take precedence over field values of PodSecurityContext. + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + priorityClassName: + description: priorityClassName specifies the priority class for + the pod (if any). + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + probe: + description: probe contains the fields for standard Kubernetes + readiness/liveness probe configuration. + properties: + liveness: + description: |- + liveness configures the Kubernetes probe settings. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + readiness: + description: |- + readiness configures the Kubernetes probe setting. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + type: object + resources: + description: resources describe the compute resource requirements. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: |- + SecurityContext holds security configuration that will be applied to a container. + Some fields are present in both SecurityContext and PodSecurityContext. When both + are set, the values in SecurityContext take precedence. + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the service account used to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account. + type: string + terminationGracePeriodSeconds: + description: terminationGracePeriodSeconds is the grace period + before the pod is deleted. + format: int64 + type: integer + tolerations: + description: |- + tolerations specify the pods to schedule onto the nodes with matching taints, using + the triple `` and the matching operator ``. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + topologySpreadConstraints describe how a group of pods ought to spread across topology domains. Scheduler will + schedule pods based on the constraints. All topologySpreadConstraints are ANDed. + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + + + This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + replicas: + description: |- + replicas is the desired number of replicas. + A change to this setting will roll the cluster. + format: int32 + type: integer + storageClass: + description: |- + storageClass specifies the user-provided storage class. If not + configured, it will use the default storage class. + properties: + name: + description: name is the storage class name. + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + telemetry: + description: telemetry specifies the Confluent telemetry reporter + configuration. + properties: + global: + description: |- + global allows disabling telemetry configuration. + If CFK is deployed with telemetry, this field is only + used to disable telemetry. The default value is `true` if + telemetry is enabled at the global level. + type: boolean + type: object + tls: + description: |- + tls specifies the global-level TLS configuration which can be used by + listeners and services. + properties: + autoGeneratedCerts: + description: |- + autoGeneratedCerts specifies that the certificates are auto-generated based on + the CA key pair provided. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the cp component's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS + configuration for cp components. + type: boolean + required: + - enabled + type: object + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing the + JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - dataVolumeCapacity + - image + type: object + status: + description: status defines the observed state of the KRaft Controller + cluster. + properties: + arbitraryData: + description: arbitraryData is the map for any arbitrary data associated + with this Confluent component. + x-kubernetes-preserve-unknown-fields: true + authorizationType: + description: authorizationType is the authorization type for this + Confluent component. + type: string + brokerIdOffset: + description: brokerIdOffset is the broker id offset of the KRaft Controller + cluster. + format: int32 + type: integer + clusterID: + description: clusterID is the ID of the KRaft Controller cluster. + type: string + clusterName: + description: clusterName is the name of the Confluent Platform component + cluster. + type: string + clusterNamespace: + description: clusterNamespace is the namespace where the Confluent + Platform component cluster is running. + type: string + conditions: + description: conditions specify the latest available observations + of the current state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + controllerQuorumVoters: + description: controllerQuorumVoters is the list KRaft Controller Quorum + Voters. + items: + description: ControllerQuorumVoter defines the KRaft controller + quorum voter. + properties: + brokerEndpoint: + description: brokerEndpoint is the endpoint of the KRaft Controller. + type: string + nodeId: + description: nodeId is the nodeId of the KRaft Controller. + format: int32 + type: integer + required: + - brokerEndpoint + - nodeId + type: object + type: array + currentReplicas: + description: currentReplicas is the number of currently running replicas. + format: int32 + type: integer + internalSecrets: + description: |- + internalSecrets are internal secrets created + by CFK for this Confluent component. + items: + type: string + type: array + internalTopicNames: + description: internalTopicNames are the topics used by the component + for internal use. + items: + type: string + type: array + listeners: + additionalProperties: + description: ListenerStatus describes general information about + the listeners. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + description: listeners is a map for the status of Kafka Listeners. + type: object + x-kubernetes-map-type: granular + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + operatorVersion: + description: operatorVersion is the internal version of CFK. + type: string + phase: + description: |- + phase describes the state of the Confluent Platform component. This can either be 'PROVISIONING' + or 'RUNNING' + 'PROVISIONING' means the Confluent Platform component is currently getting deployed and not ready yet. + 'RUNNING' means the Confluent Platform component has been successfully deployed. + type: string + readyReplicas: + description: readyReplicas is the number of currently ready replicas. + format: int32 + type: integer + replicas: + description: replicas is the number of replicas. + format: int32 + type: integer + selector: + description: |- + selector gets the label selector of the child pod. + The Horizontal Pod Autoscaler(HPA) will scale using the label selector of the child pod. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kraftmigrationjobs.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kraftmigrationjobs.yaml new file mode 100644 index 000000000..2e819ad8a --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_kraftmigrationjobs.yaml @@ -0,0 +1,194 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: kraftmigrationjobs.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: KRaftMigrationJob + listKind: KRaftMigrationJobList + plural: kraftmigrationjobs + shortNames: + - kraftmigrationjob + - kmj + singular: kraftmigrationjob + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1beta1 + schema: + openAPIV3Schema: + description: KRaftMigrationJob is the schema for the KRaftMigrationJob API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the KRaftMigrationJob. + properties: + dependencies: + description: dependencies specify the Kafka Broker, Zookeeper and + KRaft Controllers. + properties: + kRaftController: + description: |- + kRaftController specifies the dependency configuration for the KRaftController cluster. + You cannot configure both zookeeper and kRaftController dependencies. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + kafka: + description: kafka defines the Kafka dependency configurations. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + zookeeper: + description: zookeeper specifies the dependency configuration + for Zookeeper. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + required: + - kRaftController + - kafka + - zookeeper + type: object + required: + - dependencies + type: object + status: + description: status defines the observed state of the KRaftMigrationJob. + properties: + conditions: + description: conditions represents the latest available observations + of the kraft migration job. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + kafkaClusterId: + description: clusterId is the clusterId for migrating cluster + type: string + kafkaGeneration: + description: |- + kafkaGeneration is the last generation at which + kafka cluster was updated during migration workflow + format: int64 + type: integer + kraftControllerGeneration: + description: |- + kraftControllerGeneration is the last generation at which + kraftController cluster was updated during migration workflow + format: int64 + type: integer + phase: + description: phase is the state of the kraft migration job. + type: string + subPhase: + description: subPhase is the state of the kraft migration job. + type: string + zkEndpointWithNode: + description: |- + zkEndpointWithNode is the zkEndpoint with node fetched from kafka + / + type: string + required: + - kafkaClusterId + - kafkaGeneration + - kraftControllerGeneration + - phase + - subPhase + - zkEndpointWithNode + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_ksqldbs.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_ksqldbs.yaml new file mode 100644 index 000000000..c2a2e60fa --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_ksqldbs.yaml @@ -0,0 +1,6646 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: ksqldbs.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: KsqlDB + listKind: KsqlDBList + plural: ksqldbs + shortNames: + - ksqldb + - ksql + singular: ksqldb + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.readyReplicas + name: Ready + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.kafka.bootstrapEndpoint + name: Kafka + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: KsqlDB is the schema for the ksqlDB API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the ksqlDB cluster. + properties: + authentication: + description: authentication specifies whether authentication is needed + when accessing the ksqlDB cluster. + properties: + basic: + description: basic specifies the configuration for basic authentication. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth authentication. + properties: + configuration: + description: configuration specifies the OAuth server settings. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the basic + credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass the + required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme for the + REST API server. Valid options are `basic`, `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + authorization: + description: authorization specifies the RBAC configuration for the + ksqlDB cluster. + properties: + kafkaRestClassRef: + description: |- + kafkaRestClassRef references the KafkaRestClass + which specifies the Kafka REST API connection configuration. + properties: + name: + description: name specifies the name of the KafkaRestClass + application resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + type: + description: type specifies the client-side authorization type. + The valid option is `rbac`. + enum: + - rbac + type: string + required: + - type + type: object + configOverrides: + description: |- + configOverrides specifies the configs to override the server, JVM, Log4j properties for the ksqlDB cluster. + A change will roll the cluster. + properties: + jvm: + description: |- + jvm is a list of JVM configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + log4j: + description: |- + log4j is a list of Log4J configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + server: + description: |- + server is a list of server configuration supported by the Confluent Platform component. + This will either add or update existing configuration. + items: + type: string + type: array + type: object + dataVolumeCapacity: + anyOf: + - type: integer + - type: string + description: dataVolumeCapacity specifies the data volume for the + ksqlDB cluster. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + dependencies: + description: dependencies specifies the dependency configurations + for Kafka, Interceptor, Schema Registry, the MDS, and Connect. + properties: + connect: + description: connect specifies the Connect dependency configuration. + properties: + authentication: + description: authentication specifies the authentication configuration + for the Connect cluster. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + tls: + description: tls specifies the client-side TLS setting for + the Connect cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the Connect + cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - url + type: object + interceptor: + description: interceptor specifies the interceptor dependency + configuration. + properties: + configs: + description: |- + configs describe the configurations for the Confluent Platform interceptor. + The config override feature can be used to pass the configuration settings. + items: + type: string + type: array + consumer: + description: |- + consumer specifies the consumer configuration for the interceptor. If not + configured, it uses the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication + for the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another + way to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + enabled: + description: enabled indicates whether the Confluent Platform + interceptor is enabled or disabled. + type: boolean + producer: + description: |- + producer specifies the producer configuration for the interceptor. If not + configured, it uses the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication + for the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another + way to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for + the Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + publishMs: + type: integer + required: + - enabled + type: object + kafka: + description: kafka specifies the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mds: + description: mds specifies the MDS dependencies configuration. + properties: + authentication: + description: authentication specifies the client side authentication + configuration for the MDS. + properties: + bearer: + description: bearer specifies the bearer authentication + settings. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication + settings. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication method + for the MDS. The valid option is `bearer`, `oauth`. + enum: + - bearer + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies the MDS endpoint. + minLength: 1 + pattern: ^https?://.* + type: string + ssoProtocol: + description: sso protocol, valid options are ldap and oidc. + enum: + - ldap + - oidc + type: string + tls: + description: ClientTLSConfig specifies the TLS configuration + for the Confluent component (dependencies, listeners). + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + tokenKeyPair: + description: tokenKeyPair specifies the token keypair to configure + the MDS. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the MDS token key pair are mounted. + minLength: 1 + type: string + encryptedTokenKey: + description: |- + EncryptedTokenKey boolean value indicating whether the tokenKeypair(private used for signing) is encrypted using a passphrase. If true, cfk + operator will look for a file named mdsTokenKeyPassphrase.txt containing key value pair + mdsTokenKeyPassphrase=. Relevant only for mds server. Ignored if set for a client configuration. + type: boolean + secretRef: + description: secretRef references the name of the secret + that contains the MDS token key pair. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - authentication + - endpoint + - tokenKeyPair + type: object + schemaRegistry: + description: schemaRegistry specifies the Schema Registry dependency + configuration. + properties: + authentication: + description: authentication specifies the authentication for + the Schema Registry cluster. + properties: + basic: + description: basic specifies the configuration for basic + authentication. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth + authentication. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme + for the REST API client. Valid options are `basic`, + `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + tls: + description: tls defines the client-side TLS setting for the + Schema Registry cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + url: + description: url specifies the URL endpoint of the Schema + Registry cluster. + minLength: 1 + pattern: ^https?://.* + type: string + required: + - url + type: object + type: object + externalAccess: + description: |- + externalAccess specifies the configurations for the endpoints and services to make the ksqlDB + accessible from outside the cluster. + When `spec.listeners` is configured, configuring `spec.externalAccess` is not allowed. + Please configure `spec.listeners.external.externalAccess` instead". + properties: + loadBalancer: + description: loadBalancer specifies the configuration to create + a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are `Local` + and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided service + port(s). + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create a + Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create a route + service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the Confluent + component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + headlessService: + description: headlessService specifies the configuration of the Kubernetes + headless service. + properties: + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs. + It specifies the annotations to be added to the CFK-created headless service. + These annotations are merged with the injectAnnotations and take precedence. + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs. + It specifies the labels to be added to the CFK-created headless service. + These labels are merged with the injectLabels and take precedence. + type: object + x-kubernetes-map-type: granular + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses specifies the publishNotReadyAddresses field. + For Kafka, this value must be true. The default value is true. + type: boolean + type: object + image: + description: |- + image specifies the application and the init docker image configurations. + A change to this setting will roll the cluster. + properties: + application: + description: |- + application is the Docker image name of the application. Specify + `//:`. + pattern: .+:.+ + type: string + init: + description: |- + init is the init-container name. Specify + `//:`. + pattern: .+:.+ + type: string + pullPolicy: + description: |- + pullPolicy is the policy for pulling images. Valid options are `Always`, `Never`, and `IfNotPresent`. + The default value is `IfNotPresent`. + enum: + - Always + - Never + - IfNotPresent + type: string + pullSecretRef: + description: |- + pullSecretRef references the secrets in the same namespace to be used for pulling images. + Image pull secrets are distinct from secrets because secrets + can be mounted in the pod, but image pull secrets are only accessed by `kubelet`. + More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod + items: + type: string + type: array + required: + - application + - init + type: object + injectAnnotations: + additionalProperties: + type: string + description: |- + injectAnnotations are the annotations injected to the internal resources that CFK created. + The internal annotations are preserved and cannot be overridden. + For pod annotations, use `podTemplate.annotations`. + type: object + x-kubernetes-map-type: granular + injectLabels: + additionalProperties: + type: string + description: |- + injectLabels are the labels injected to the internal resources that CFK created. + The internal labels are preserved and cannot be overridden. + For pod labels, use `podTemplate.labels`. + type: object + x-kubernetes-map-type: granular + internalTopicReplicationFactor: + description: internalTopicReplicationFactor specifies the replication + factor for internal topics. + format: int32 + type: integer + k8sClusterDomain: + description: |- + k8sClusterDomain specifies the configuration of the Kubernetes cluster domain. + The default is the `cluster.local` domain. + type: string + license: + description: license specifies the license configuration for the Confluent + Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + the license key is mounted. More info: + https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + minLength: 1 + type: string + globalLicense: + description: globalLicense specifies whether the Confluent Platform + component shares the common global license. + type: boolean + secretRef: + description: |- + secretRef references the secret that provides the license for the Confluent Platform component. + More info: https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + listeners: + description: listeners specify the listeners configurations. + properties: + external: + description: external specifies the Confluent component external + listener. + properties: + externalAccess: + description: externalAccess defines the external access configuration + for the Confluent component. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component + cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are + `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the + source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create + a Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create + a route service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the + Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + internal: + description: |- + internal specifies the Confluent component's internal listener. + This internal listener is for intra-communication between the pods. + properties: + port: + description: |- + port binds the given port to the internal listener. If not configured, + it will be defaulted to the component-specific internal port. + Port numbers lower than `9093` are reserved by CFK. + format: int32 + minimum: 9093 + type: integer + tls: + description: tls specifies the TLS configuration for the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + metrics: + description: metrics specify the security settings for the metric + services. + properties: + authentication: + description: authentication specifies the authentication configuration + for the metrics. + properties: + type: + description: type specifies the metrics authentication method. + The valid option is `mtls`. + enum: + - mtls + type: string + required: + - type + type: object + prometheus: + description: prometheus specifies the configuration overrides + for the JMX-Prometheus exporter. + properties: + blacklist: + items: + type: string + type: array + rules: + items: + description: Rule defines the Prometheus Exporter rule override. + properties: + attrNameSnakeCase: + type: boolean + cache: + type: boolean + help: + minLength: 1 + type: string + labels: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: granular + name: + minLength: 1 + type: string + pattern: + minLength: 1 + type: string + type: + minLength: 1 + type: string + value: + minLength: 1 + type: string + valueFactor: + anyOf: + - type: integer + - type: string + default: 1 + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: array + whitelist: + items: + type: string + type: array + type: object + tls: + description: tls specifies the TLS configuration for the metrics. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mountedSecrets: + description: |- + mountedSecrets list the secrets injected to + the underlying statefulset configuration. The secret reference is mounted + in the default path `/mnt/secrets/`. The underlying resources + will follow the secret as a file configuration. + More info: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. + A change to this setting will roll the cluster. + items: + description: |- + MountedSecrets provides a way to inject a custom secret to the underlying + statefulset. + properties: + keyItems: + description: keyItems are key and path names. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + secretRef: + description: secretRef references the name of the secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + type: array + mountedVolumes: + description: |- + mountedVolumes list the custom volumes that need to be mounted into the + underlying statefulset. + A change to this setting will roll the cluster. + properties: + volumeMounts: + description: |- + volumeMounts specify the list of volume mounts for the pods in the + statefulset. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + volumes specify the list of volumes that can be mounted into the pods + of statefulset. + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + format: int32 + type: integer + readOnly: + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: boolean + volumeID: + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in + the blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the + blob storage + type: string + fsType: + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. + properties: + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime + properties: + monitors: + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is /' + type: string + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: boolean + secretFile: + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + secretRef: + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + required: + - monitors + type: object + cinder: + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: boolean + secretRef: + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should + populate this volume + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume + properties: + defaultMode: + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: Items is a list of downward API volume + file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must not + be absolute or contain the ''..'' path. Must + be utf-8 encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. + + + A pod can use both types of ephemeral volumes and + persistent volumes at the same time. + properties: + volumeClaimTemplate: + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. + + + Required, must not be nil. + properties: + metadata: + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. + type: object + spec: + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over + volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#volumeattributesclass + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + items: + type: string + type: array + type: object + flexVolume: + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use + for this volume. + type: string + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds + extra command options if any.' + type: object + readOnly: + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running + properties: + datasetName: + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + properties: + fsType: + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + format: int32 + type: integer + pdName: + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: boolean + required: + - pdName + type: object + gitRepo: + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. + properties: + directory: + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md + properties: + endpoints: + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + path: + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + readOnly: + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. + properties: + path: + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + type: + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + required: + - path + type: object + iscsi: + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication + type: boolean + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + initiatorName: + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + nfs: + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + properties: + path: + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + readOnly: + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: boolean + server: + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine + properties: + fsType: + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx + volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along + with other supported volume types + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume + root to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + required: + - path + type: object + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the + ConfigMap or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the + downwardAPI data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute or + contain the ''..'' path. Must be utf-8 + encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env + vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource + to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + format: int64 + type: integer + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: |- + group to map volume access to + Default is no group + type: string + readOnly: + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. + type: boolean + registry: + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes + type: string + tenant: + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin + type: string + user: + description: |- + user to map volume access to + Defaults to serivceaccount user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + image: + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + keyring: + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + monitors: + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + items: + type: string + type: array + pool: + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: boolean + secretRef: + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. + type: string + system: + description: system is the name of the storage system + as configured in ScaleIO. + type: string + volumeName: + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume + names are only unique within a namespace. + type: string + volumeNamespace: + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - volumeMounts + - volumes + type: object + oneReplicaPerNode: + description: |- + oneReplicaPerNode controls whether to run 1 pod per node using the pod anti-affinity capability. + Enabling this configuration in an existing cluster will roll the cluster. + type: boolean + pdb: + description: |- + configures PodDisruptionBudget for the Confluent Platform component. + by default PDB is configured based on pre-detemined formula. + properties: + enabled: + description: enabled specifies whether the PodDisruptionBudget + is enabled + type: boolean + maxUnavailable: + description: maxUnavailable is the maximum number of pods that + can be unavailable during the disruption. + format: int32 + type: integer + required: + - enabled + type: object + podTemplate: + description: podTemplate specifies the statefulset pod template configuration. + properties: + affinity: + description: |- + affinity specifies a group of affinity scheduling rules. + More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs stored with the resource and + may be set by external tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying objects. More + info: http://kubernetes.io/docs/user-guide/annotations. + type: object + x-kubernetes-map-type: granular + envVars: + description: |- + envVars contain environment variables to be injected into containers. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs that can be used to organize and categorize + (scope and select) objects. + More info: http://kubernetes.io/docs/user-guide/labels. + type: object + x-kubernetes-map-type: granular + podSecurityContext: + description: |- + PodSecurityContext holds pod-level security attributes and common container settings. + Some fields are also present in container.securityContext. Field values of + container.securityContext take precedence over field values of PodSecurityContext. + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + priorityClassName: + description: priorityClassName specifies the priority class for + the pod (if any). + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + probe: + description: probe contains the fields for standard Kubernetes + readiness/liveness probe configuration. + properties: + liveness: + description: |- + liveness configures the Kubernetes probe settings. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + readiness: + description: |- + readiness configures the Kubernetes probe setting. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + type: object + resources: + description: resources describe the compute resource requirements. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: |- + SecurityContext holds security configuration that will be applied to a container. + Some fields are present in both SecurityContext and PodSecurityContext. When both + are set, the values in SecurityContext take precedence. + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the service account used to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account. + type: string + terminationGracePeriodSeconds: + description: terminationGracePeriodSeconds is the grace period + before the pod is deleted. + format: int64 + type: integer + tolerations: + description: |- + tolerations specify the pods to schedule onto the nodes with matching taints, using + the triple `` and the matching operator ``. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + topologySpreadConstraints describe how a group of pods ought to spread across topology domains. Scheduler will + schedule pods based on the constraints. All topologySpreadConstraints are ANDed. + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + + + This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + replicas: + description: |- + replicas is the desired number of replicas. + A change to this setting will roll the cluster. + format: int32 + type: integer + storageClass: + description: storageClass specifies the storage class used for creating + the PVC for the ksqlDB cluster. + properties: + name: + description: name is the storage class name. + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + telemetry: + description: telemetry specifies the Confluent telemetry reporter + configuration. + properties: + global: + description: |- + global allows disabling telemetry configuration. + If CFK is deployed with telemetry, this field is only + used to disable telemetry. The default value is `true` if + telemetry is enabled at the global level. + type: boolean + type: object + tls: + description: tls specifies the global TLS configurations for the ksqlDB + cluster. + properties: + autoGeneratedCerts: + description: |- + autoGeneratedCerts specifies that the certificates are auto-generated based on + the CA key pair provided. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the cp component's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS + configuration for cp components. + type: boolean + required: + - enabled + type: object + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing the + JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - dataVolumeCapacity + - image + type: object + status: + description: status defines the observed state of ksqlDB Server. + properties: + arbitraryData: + description: arbitraryData is the map for any arbitrary data associated + with this Confluent component. + x-kubernetes-preserve-unknown-fields: true + authorizationType: + description: authorizationType is the authorization type for this + Confluent component. + type: string + clusterName: + description: clusterName is the name of the Confluent Platform component + cluster. + type: string + clusterNamespace: + description: clusterNamespace is the namespace where the Confluent + Platform component cluster is running. + type: string + conditions: + description: conditions specify the latest available observations + of the current state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + currentReplicas: + description: currentReplicas is the number of currently running replicas. + format: int32 + type: integer + internalSecrets: + description: |- + internalSecrets are internal secrets created + by CFK for this Confluent component. + items: + type: string + type: array + internalTopicNames: + description: internalTopicNames are the topics used by the component + for internal use. + items: + type: string + type: array + kafka: + description: kafka is the Kafka client side status for the ksqlDB + cluster. + properties: + authenticationType: + description: authenticationType describes the authentication method + for the Kafka cluster. + type: string + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap endpoint. + type: string + tls: + description: tls indicates whether TLS is enabled for the Kafka + dependency. + type: boolean + type: object + listeners: + additionalProperties: + description: ListenerStatus describes general information about + the listeners. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + description: listeners is a map of listener type and the status of + KsqlDB Listeners. + type: object + x-kubernetes-map-type: granular + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + operatorVersion: + description: operatorVersion is the internal version of CFK. + type: string + phase: + description: |- + phase describes the state of the Confluent Platform component. This can either be 'PROVISIONING' + or 'RUNNING' + 'PROVISIONING' means the Confluent Platform component is currently getting deployed and not ready yet. + 'RUNNING' means the Confluent Platform component has been successfully deployed. + type: string + rbac: + description: rbac contains the RBAC-related status when RBAC is enabled. + properties: + clusterID: + description: clusterID specifies the id of the cluster. + type: string + internalRolebindings: + description: internalRolebindings specifies the internal rolebindings. + items: + type: string + type: array + type: object + readyReplicas: + description: readyReplicas is the number of currently ready replicas. + format: int32 + type: integer + replicas: + description: replicas is the number of replicas. + format: int32 + type: integer + restConfig: + description: restConfig is the REST API configuration of the ksqlDB + cluster. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + selector: + description: |- + selector gets the label selector of the child pod. + The Horizontal Pod Autoscaler(HPA) will scale using the label selector of the child pod. + type: string + serviceID: + description: serviceID is the id of the ksqlDB service. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemaexporters.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemaexporters.yaml new file mode 100644 index 000000000..fd23b7028 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemaexporters.yaml @@ -0,0 +1,688 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: schemaexporters.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: SchemaExporter + listKind: SchemaExporterList + plural: schemaexporters + shortNames: + - se + - schemaexporter + singular: schemaexporter + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.contextName + name: ContextName + type: string + - jsonPath: .status.exporterStatus + name: ExporterStatus + type: string + - jsonPath: .status.state + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.sourceSchemaRegistry.endpoint + name: SourceSchemaRegistryEndpoint + priority: 1 + type: string + - jsonPath: .status.destinationSchemaRegistry.endpoint + name: DestinationSchemaRegistryEndpoint + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: SchemaExporter is the schema for the SchemaExporter API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the schema exporter. + properties: + configs: + additionalProperties: + type: string + description: |- + configs is a map of string key and value pairs. It specifies additional configurations for the schema exporter. More info: + https://docs.confluent.io/platform/current/schema-registry/schema-linking-cp.html#create-a-configuration-file-for-the-exporter + type: object + x-kubernetes-map-type: granular + contextName: + description: |- + contextName specifies the custom context name in the destination Schema Registry cluster where the + schemas will be exported. If this is defined, contextType will be ignored. If this is not defined, + schemas will be exported to context in destination based on contextType. + type: string + contextType: + description: |- + contextType specifies the type of context created in the destination Schema Registry cluster of + the schema exporter. + Valid options are `AUTO` and `NONE`. + The default value is `AUTO`. + enum: + - AUTO + - NONE + type: string + destinationCluster: + description: |- + destinationCluster specifies the destination Schema Registry cluster. If this is not defined, + sourceCluster is chosen as the destination and the schema exporter will be exporting + schemas across contexts within the sourceCluster. + Schema exporter should be enabled in Schema Registry cluster CR with `spec.enableSchemaExporter`. + properties: + schemaRegistryClusterRef: + description: schemaRegistryClusterRef references the CFK-managed + Schema Registry cluster. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + schemaRegistryRest: + description: schemaRegistryRest specifies the Schema Registry + REST API configuration. + properties: + authentication: + description: authentication specifies the REST API authentication + mechanism. + properties: + basic: + description: basic specifies the basic authentication + settings for the REST API client. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + bearer: + description: bearer specifies the bearer authentication + settings for the REST API client. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication + settings for the REST API client. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the REST API authentication + type. Valid options are `basic`, `bearer`, `mtls` and + `oauth`. + enum: + - basic + - bearer + - mtls + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies where Confluent REST API is + running. + minLength: 1 + pattern: ^https?://.* + type: string + kafkaClusterID: + description: |- + kafkaClusterID specifies the id of Kafka cluster. + It takes precedence over using the Kafka REST API to get the cluster id. + minLength: 1 + type: string + tls: + description: "tls specifies the custom TLS structure for the + application resources,\n\t// e.g. connector, topic, schema, + of the Confluent Platform components.\n\t// +optional" + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `keystore.jks`, `truststore.jks`, `jksPassword.txt` keys are mounted. + minLength: 1 + type: string + jksPassword: + description: jksPassword specifies the secret name that + contains the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef specifies the secret name that contains the certificates. + More info about certificates key/value format: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + type: object + sourceCluster: + description: |- + sourceCluster specifies the source Schema Registry cluster. Schema exporter will be set + up in the source cluster. If this is not defined, controller will try to auto discover Schema Registry + in the namespace of the schema exporter. If it cannot discover a Schema Registry cluster or more than + one Schema Registry clusters are found, controller will return error. + Schema exporter should be enabled in Schema Registry cluster CR with `spec.enableSchemaExporter`. + properties: + schemaRegistryClusterRef: + description: schemaRegistryClusterRef references the CFK-managed + Schema Registry cluster. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + schemaRegistryRest: + description: schemaRegistryRest specifies the Schema Registry + REST API configuration. + properties: + authentication: + description: authentication specifies the REST API authentication + mechanism. + properties: + basic: + description: basic specifies the basic authentication + settings for the REST API client. + properties: + debug: + description: debug enables the basic authentication + debug logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + bearer: + description: bearer specifies the bearer authentication + settings for the REST API client. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication + settings for the REST API client. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the REST API authentication + type. Valid options are `basic`, `bearer`, `mtls` and + `oauth`. + enum: + - basic + - bearer + - mtls + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies where Confluent REST API is + running. + minLength: 1 + pattern: ^https?://.* + type: string + kafkaClusterID: + description: |- + kafkaClusterID specifies the id of Kafka cluster. + It takes precedence over using the Kafka REST API to get the cluster id. + minLength: 1 + type: string + tls: + description: "tls specifies the custom TLS structure for the + application resources,\n\t// e.g. connector, topic, schema, + of the Confluent Platform components.\n\t// +optional" + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `keystore.jks`, `truststore.jks`, `jksPassword.txt` keys are mounted. + minLength: 1 + type: string + jksPassword: + description: jksPassword specifies the secret name that + contains the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef specifies the secret name that contains the certificates. + More info about certificates key/value format: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + type: object + subjectRenameFormat: + description: |- + subjectRenameFormat specifies the rename format for the subjects exported to the destination. + For example, if the value is `my-${subject}`, subjects at destination will become `my-firstSubject` + where `firstSubject` is the original subject name. + type: string + subjects: + description: |- + subjects specifies the list of subjects to be exported by schema exporter. + The default value is `["*"]`. This indicates all subjects in the default context. + items: + type: string + type: array + type: object + status: + description: status defines the observed state of the schema exporter. + properties: + appState: + default: Unknown + description: appState is the current state of the schema exporter + application. + enum: + - Unknown + - Created + - Failed + - Deleted + type: string + conditions: + description: conditions are the latest available observations of the + schema exporter's state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + contextName: + description: |- + contextName shows the name of the context in the destination Schema Registry cluster + where the schemas will be exported. + type: string + contextType: + description: contextType is the contextType of the schema exporter. + type: string + destinationSchemaRegistry: + description: |- + destinationSchemaRegistry shows the destination Schema Registry endpoint, authentication type + and if it is using TLS. + properties: + authenticationType: + description: authenticationType is the authentication method used + for Schema Registry. + type: string + endpoint: + description: endpoint is the Schema Registry REST endpoint. + type: string + tls: + description: tls shows whether the Schema Registry is using TLS. + type: boolean + type: object + exporterStatus: + description: exporterStatus is the status of the schema exporter. + type: string + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + sourceSchemaRegistry: + description: |- + sourceSchemaRegistry shows the source Schema Registry endpoint, authentication type + and if it is using TLS. + properties: + authenticationType: + description: authenticationType is the authentication method used + for Schema Registry. + type: string + endpoint: + description: endpoint is the Schema Registry REST endpoint. + type: string + tls: + description: tls shows whether the Schema Registry is using TLS. + type: boolean + type: object + state: + description: state is the current state of the schema exporter. + type: string + subjects: + description: subjects is the list of subjects exported by the schema + exporter. + items: + type: string + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemaregistries.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemaregistries.yaml new file mode 100644 index 000000000..2cc59aaf4 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemaregistries.yaml @@ -0,0 +1,5801 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: schemaregistries.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: SchemaRegistry + listKind: SchemaRegistryList + plural: schemaregistries + shortNames: + - schemaregistry + - sr + singular: schemaregistry + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.readyReplicas + name: Ready + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.kafka.bootstrapEndpoint + name: Kafka + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: SchemaRegistry is the schema for the Schema Registry API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the Schema Registry cluster. + properties: + authentication: + description: authentication specifies the authentication configurations + for the REST API endpoint. + properties: + basic: + description: basic specifies the configuration for basic authentication. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the configuration for OAuth authentication. + properties: + configuration: + description: configuration specifies the OAuth server settings. + properties: + audience: + description: audience specifies the audience claim in + the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim + in token for identifying the groups of subject in the + JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with + IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with + IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT + to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the basic + credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass the + required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication scheme for the + REST API server. Valid options are `basic`, `oauth` and `mtls`. + enum: + - basic + - mtls + - oauth + type: string + required: + - type + type: object + authorization: + description: authorization specifies the authorization configurations. + properties: + kafkaRestClassRef: + description: |- + kafkaRestClassRef references the KafkaRestClass + which specifies the Kafka REST API connection configuration. + properties: + name: + description: name specifies the name of the KafkaRestClass + application resource. + minLength: 1 + type: string + namespace: + description: namespace specifies the namespace of the KafkaRestClass. + type: string + required: + - name + type: object + type: + description: type specifies the client-side authorization type. + The valid option is `rbac`. + enum: + - rbac + type: string + required: + - type + type: object + configOverrides: + description: |- + configOverrides specifies the configs to override the server, JVM, Log4j properties for the Schema Registry cluster. + A change will roll the cluster. + properties: + jvm: + description: |- + jvm is a list of JVM configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + log4j: + description: |- + log4j is a list of Log4J configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + server: + description: |- + server is a list of server configuration supported by the Confluent Platform component. + This will either add or update existing configuration. + items: + type: string + type: array + type: object + dependencies: + description: dependencies specify the dependency configurations for + the Schema Registry. + properties: + kafka: + description: kafka specifies the Kafka dependency configuration. + properties: + authentication: + description: authentication defines the authentication for + the Kafka cluster. + properties: + jaasConfig: + description: jaasConfig specifies the Kafka client-side + JaaS configuration. + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: jaasConfigPassThrough specifies another way + to provide the Kafka client-side JaaS configuration. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + oauthbearer: + description: |- + oauthbearer is the authentication mechanism to provider principals. + Only supported in RBAC deployment. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: + description: |- + type specifies the Kafka client authentication type. + Valid options are `plain`, `oauthbearer`, `digest`, `mtls` and `oauth`. + enum: + - plain + - oauthbearer + - digest + - mtls + - oauth + type: string + required: + - type + type: object + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap + endpoint. + minLength: 1 + pattern: .+:[0-9]+ + type: string + discovery: + description: discovery specifies the capability to discover + the Kafka cluster. + properties: + name: + description: name is the name of the Confluent Platform + component cluster. + type: string + namespace: + description: |- + namespace is where the Confluent Platform component is running. + The default value is the namespace where CFK is running. + type: string + secretRef: + description: secretRef is the name of the secret used + to discover the Confluent Platform component. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls defines the client-side TLS setting for the + Kafka cluster. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mds: + description: mds specifies the MDS dependencies configurations. + properties: + authentication: + description: authentication specifies the client side authentication + configuration for the MDS. + properties: + bearer: + description: bearer specifies the bearer authentication + settings. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication + settings. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name + of claim in token for identifying the groups + of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect + timeout with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass + the basic credential through a directory path in + the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to + pass the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the authentication method + for the MDS. The valid option is `bearer`, `oauth`. + enum: + - bearer + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies the MDS endpoint. + minLength: 1 + pattern: ^https?://.* + type: string + ssoProtocol: + description: sso protocol, valid options are ldap and oidc. + enum: + - ldap + - oidc + type: string + tls: + description: ClientTLSConfig specifies the TLS configuration + for the Confluent component (dependencies, listeners). + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + tokenKeyPair: + description: tokenKeyPair specifies the token keypair to configure + the MDS. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer defines the directory path in the container + where the MDS token key pair are mounted. + minLength: 1 + type: string + encryptedTokenKey: + description: |- + EncryptedTokenKey boolean value indicating whether the tokenKeypair(private used for signing) is encrypted using a passphrase. If true, cfk + operator will look for a file named mdsTokenKeyPassphrase.txt containing key value pair + mdsTokenKeyPassphrase=. Relevant only for mds server. Ignored if set for a client configuration. + type: boolean + secretRef: + description: secretRef references the name of the secret + that contains the MDS token key pair. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - authentication + - endpoint + - tokenKeyPair + type: object + type: object + enableSchemaExporter: + description: enableSchemaExporter enables schema exporter in the Schema + Registry. + type: boolean + externalAccess: + description: |- + externalAccess specifies the external access configuration. + When `spec.listeners` is configured, configuring `spec.externalAccess` is not allowed. + Please configure `spec.listeners.external.externalAccess` instead". + properties: + loadBalancer: + description: loadBalancer specifies the configuration to create + a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are `Local` + and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided service + port(s). + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create a + Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create a route + service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the Confluent + component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + headlessService: + description: headlessService specifies the configuration of the Kubernetes + headless service. + properties: + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs. + It specifies the annotations to be added to the CFK-created headless service. + These annotations are merged with the injectAnnotations and take precedence. + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs. + It specifies the labels to be added to the CFK-created headless service. + These labels are merged with the injectLabels and take precedence. + type: object + x-kubernetes-map-type: granular + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses specifies the publishNotReadyAddresses field. + For Kafka, this value must be true. The default value is true. + type: boolean + type: object + image: + description: |- + image specifies the application and the init docker image configurations. + A change to this setting will roll the cluster. + properties: + application: + description: |- + application is the Docker image name of the application. Specify + `//:`. + pattern: .+:.+ + type: string + init: + description: |- + init is the init-container name. Specify + `//:`. + pattern: .+:.+ + type: string + pullPolicy: + description: |- + pullPolicy is the policy for pulling images. Valid options are `Always`, `Never`, and `IfNotPresent`. + The default value is `IfNotPresent`. + enum: + - Always + - Never + - IfNotPresent + type: string + pullSecretRef: + description: |- + pullSecretRef references the secrets in the same namespace to be used for pulling images. + Image pull secrets are distinct from secrets because secrets + can be mounted in the pod, but image pull secrets are only accessed by `kubelet`. + More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod + items: + type: string + type: array + required: + - application + - init + type: object + injectAnnotations: + additionalProperties: + type: string + description: |- + injectAnnotations are the annotations injected to the internal resources that CFK created. + The internal annotations are preserved and cannot be overridden. + For pod annotations, use `podTemplate.annotations`. + type: object + x-kubernetes-map-type: granular + injectLabels: + additionalProperties: + type: string + description: |- + injectLabels are the labels injected to the internal resources that CFK created. + The internal labels are preserved and cannot be overridden. + For pod labels, use `podTemplate.labels`. + type: object + x-kubernetes-map-type: granular + internalTopicReplicatorFactor: + description: internalTopicReplicatorFactor specifies the replication + factor for internal topics. + format: int32 + minimum: 1 + type: integer + k8sClusterDomain: + description: |- + k8sClusterDomain specifies the configuration of the Kubernetes cluster domain. + The default is the `cluster.local` domain. + type: string + license: + description: license specifies the license configuration for the Confluent + Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + the license key is mounted. More info: + https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + minLength: 1 + type: string + globalLicense: + description: globalLicense specifies whether the Confluent Platform + component shares the common global license. + type: boolean + secretRef: + description: |- + secretRef references the secret that provides the license for the Confluent Platform component. + More info: https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + listeners: + description: listeners specify the listeners configurations. + properties: + external: + description: external specifies the Confluent component external + listener. + properties: + externalAccess: + description: externalAccess defines the external access configuration + for the Confluent component. + properties: + loadBalancer: + description: loadBalancer specifies the configuration + to create a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component + cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are + `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the + source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided + service port(s). + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create + a Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on + service's port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by + this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations + of Client IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create + a route service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and + value pairs. It specifies Kubernetes annotations + for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the + Confluent component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value + pairs. It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + tls: + description: tls specifies the TLS configuration for the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + internal: + description: |- + internal specifies the Confluent component's internal listener. + This internal listener is for intra-communication between the pods. + properties: + port: + description: |- + port binds the given port to the internal listener. If not configured, + it will be defaulted to the component-specific internal port. + Port numbers lower than `9093` are reserved by CFK. + format: int32 + minimum: 9093 + type: integer + tls: + description: tls specifies the TLS configuration for the listener. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + type: object + metrics: + description: metrics specify the security settings for the metric + services. + properties: + authentication: + description: authentication specifies the authentication configuration + for the metrics. + properties: + type: + description: type specifies the metrics authentication method. + The valid option is `mtls`. + enum: + - mtls + type: string + required: + - type + type: object + prometheus: + description: prometheus specifies the configuration overrides + for the JMX-Prometheus exporter. + properties: + blacklist: + items: + type: string + type: array + rules: + items: + description: Rule defines the Prometheus Exporter rule override. + properties: + attrNameSnakeCase: + type: boolean + cache: + type: boolean + help: + minLength: 1 + type: string + labels: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: granular + name: + minLength: 1 + type: string + pattern: + minLength: 1 + type: string + type: + minLength: 1 + type: string + value: + minLength: 1 + type: string + valueFactor: + anyOf: + - type: integer + - type: string + default: 1 + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: array + whitelist: + items: + type: string + type: array + type: object + tls: + description: tls specifies the TLS configuration for the metrics. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mountedSecrets: + description: |- + mountedSecrets list the secrets injected to + the underlying statefulset configuration. The secret reference is mounted + in the default path `/mnt/secrets/`. The underlying resources + will follow the secret as a file configuration. + More info: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. + A change to this setting will roll the cluster. + items: + description: |- + MountedSecrets provides a way to inject a custom secret to the underlying + statefulset. + properties: + keyItems: + description: keyItems are key and path names. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + secretRef: + description: secretRef references the name of the secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + type: array + mountedVolumes: + description: |- + mountedVolumes list the custom volumes that need to be mounted into the + underlying statefulset. + A change to this setting will roll the cluster. + properties: + volumeMounts: + description: |- + volumeMounts specify the list of volume mounts for the pods in the + statefulset. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + volumes specify the list of volumes that can be mounted into the pods + of statefulset. + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + format: int32 + type: integer + readOnly: + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: boolean + volumeID: + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in + the blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the + blob storage + type: string + fsType: + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. + properties: + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime + properties: + monitors: + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is /' + type: string + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: boolean + secretFile: + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + secretRef: + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + required: + - monitors + type: object + cinder: + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: boolean + secretRef: + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should + populate this volume + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume + properties: + defaultMode: + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: Items is a list of downward API volume + file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must not + be absolute or contain the ''..'' path. Must + be utf-8 encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. + + + A pod can use both types of ephemeral volumes and + persistent volumes at the same time. + properties: + volumeClaimTemplate: + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. + + + Required, must not be nil. + properties: + metadata: + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. + type: object + spec: + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over + volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#volumeattributesclass + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + items: + type: string + type: array + type: object + flexVolume: + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use + for this volume. + type: string + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds + extra command options if any.' + type: object + readOnly: + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running + properties: + datasetName: + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + properties: + fsType: + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + format: int32 + type: integer + pdName: + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: boolean + required: + - pdName + type: object + gitRepo: + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. + properties: + directory: + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md + properties: + endpoints: + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + path: + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + readOnly: + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. + properties: + path: + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + type: + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + required: + - path + type: object + iscsi: + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication + type: boolean + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + initiatorName: + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + nfs: + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + properties: + path: + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + readOnly: + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: boolean + server: + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine + properties: + fsType: + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx + volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along + with other supported volume types + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume + root to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + required: + - path + type: object + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the + ConfigMap or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the + downwardAPI data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute or + contain the ''..'' path. Must be utf-8 + encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env + vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource + to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + format: int64 + type: integer + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: |- + group to map volume access to + Default is no group + type: string + readOnly: + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. + type: boolean + registry: + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes + type: string + tenant: + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin + type: string + user: + description: |- + user to map volume access to + Defaults to serivceaccount user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + image: + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + keyring: + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + monitors: + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + items: + type: string + type: array + pool: + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: boolean + secretRef: + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. + type: string + system: + description: system is the name of the storage system + as configured in ScaleIO. + type: string + volumeName: + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume + names are only unique within a namespace. + type: string + volumeNamespace: + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - volumeMounts + - volumes + type: object + oneReplicaPerNode: + description: |- + oneReplicaPerNode controls whether to run 1 pod per node using the pod anti-affinity capability. + Enabling this configuration in an existing cluster will roll the cluster. + type: boolean + passwordEncoder: + description: passwordEncoder specifies password encoder secret for + Schema Registry. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + the required secret is mounted. + Directory should have the file `password-encoder.txt`. The contents should include a new password. + Old password is optional and required only for rotation. + More info: https://docs.confluent.io/operator/current/co-password-encoder-secret. + type: string + secretRef: + description: |- + secretRef specifies the secret name. The secret should have the key + `password-encoder.txt`. The contents should include a new password. + Old password is optional and required only for rotation. + More info: https://docs.confluent.io/operator/current/co-password-encoder-secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + pdb: + description: |- + configures PodDisruptionBudget for the Confluent Platform component. + by default PDB is configured based on pre-detemined formula. + properties: + enabled: + description: enabled specifies whether the PodDisruptionBudget + is enabled + type: boolean + maxUnavailable: + description: maxUnavailable is the maximum number of pods that + can be unavailable during the disruption. + format: int32 + type: integer + required: + - enabled + type: object + podTemplate: + description: podTemplate specifies the statefulset pod template configuration. + properties: + affinity: + description: |- + affinity specifies a group of affinity scheduling rules. + More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs stored with the resource and + may be set by external tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying objects. More + info: http://kubernetes.io/docs/user-guide/annotations. + type: object + x-kubernetes-map-type: granular + envVars: + description: |- + envVars contain environment variables to be injected into containers. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs that can be used to organize and categorize + (scope and select) objects. + More info: http://kubernetes.io/docs/user-guide/labels. + type: object + x-kubernetes-map-type: granular + podSecurityContext: + description: |- + PodSecurityContext holds pod-level security attributes and common container settings. + Some fields are also present in container.securityContext. Field values of + container.securityContext take precedence over field values of PodSecurityContext. + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + priorityClassName: + description: priorityClassName specifies the priority class for + the pod (if any). + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + probe: + description: probe contains the fields for standard Kubernetes + readiness/liveness probe configuration. + properties: + liveness: + description: |- + liveness configures the Kubernetes probe settings. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + readiness: + description: |- + readiness configures the Kubernetes probe setting. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + type: object + resources: + description: resources describe the compute resource requirements. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: |- + SecurityContext holds security configuration that will be applied to a container. + Some fields are present in both SecurityContext and PodSecurityContext. When both + are set, the values in SecurityContext take precedence. + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the service account used to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account. + type: string + terminationGracePeriodSeconds: + description: terminationGracePeriodSeconds is the grace period + before the pod is deleted. + format: int64 + type: integer + tolerations: + description: |- + tolerations specify the pods to schedule onto the nodes with matching taints, using + the triple `` and the matching operator ``. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + topologySpreadConstraints describe how a group of pods ought to spread across topology domains. Scheduler will + schedule pods based on the constraints. All topologySpreadConstraints are ANDed. + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + + + This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + replicas: + description: |- + replicas is the desired number of replicas. + A change to this setting will roll the cluster. + format: int32 + type: integer + telemetry: + description: telemetry specifies the Confluent telemetry reporter + configuration. + properties: + global: + description: |- + global allows disabling telemetry configuration. + If CFK is deployed with telemetry, this field is only + used to disable telemetry. The default value is `true` if + telemetry is enabled at the global level. + type: boolean + type: object + tls: + description: tls specifies the global TLS configurations for the REST + API endpoint. + properties: + autoGeneratedCerts: + description: |- + autoGeneratedCerts specifies that the certificates are auto-generated based on + the CA key pair provided. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the cp component's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS + configuration for cp components. + type: boolean + required: + - enabled + type: object + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing the + JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - image + type: object + status: + description: status defines the observed state of the Schema Registry + cluster. + properties: + arbitraryData: + description: arbitraryData is the map for any arbitrary data associated + with this Confluent component. + x-kubernetes-preserve-unknown-fields: true + authorizationType: + description: authorizationType is the authorization type for this + Confluent component. + type: string + clusterName: + description: clusterName is the name of the Confluent Platform component + cluster. + type: string + clusterNamespace: + description: clusterNamespace is the namespace where the Confluent + Platform component cluster is running. + type: string + conditions: + description: conditions specify the latest available observations + of the current state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + currentReplicas: + description: currentReplicas is the number of currently running replicas. + format: int32 + type: integer + groupId: + description: groupId is the group id of the Schema Registry cluster. + type: string + internalSecrets: + description: |- + internalSecrets are internal secrets created + by CFK for this Confluent component. + items: + type: string + type: array + internalTopicNames: + description: internalTopicNames are the topics used by the component + for internal use. + items: + type: string + type: array + kafka: + description: kafka is the Kafka client side status for the Schema + Registry cluster. + properties: + authenticationType: + description: authenticationType describes the authentication method + for the Kafka cluster. + type: string + bootstrapEndpoint: + description: bootstrapEndpoint specifies the Kafka bootstrap endpoint. + type: string + tls: + description: tls indicates whether TLS is enabled for the Kafka + dependency. + type: boolean + type: object + listeners: + additionalProperties: + description: ListenerStatus describes general information about + the listeners. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + description: listeners is a map of listener type and the status of + Schema Registry Listeners. + type: object + x-kubernetes-map-type: granular + metricPrefix: + description: metricPrefix is the prefix for the JMX metric of the + Schema Registry cluster. + type: string + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + operatorVersion: + description: operatorVersion is the internal version of CFK. + type: string + phase: + description: |- + phase describes the state of the Confluent Platform component. This can either be 'PROVISIONING' + or 'RUNNING' + 'PROVISIONING' means the Confluent Platform component is currently getting deployed and not ready yet. + 'RUNNING' means the Confluent Platform component has been successfully deployed. + type: string + rbac: + description: rbac contains the RBAC-related status when RBAC is enabled. + properties: + clusterID: + description: clusterID specifies the id of the cluster. + type: string + internalRolebindings: + description: internalRolebindings specifies the internal rolebindings. + items: + type: string + type: array + type: object + readyReplicas: + description: readyReplicas is the number of currently ready replicas. + format: int32 + type: integer + replicas: + description: replicas is the number of replicas. + format: int32 + type: integer + restConfig: + description: restConfig is the REST API configuration of the Schema + Registry cluster. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + selector: + description: |- + selector gets the label selector of the child pod. + The Horizontal Pod Autoscaler(HPA) will scale using the label selector of the child pod. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + labelSelectorPath: .status.selector + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemas.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemas.yaml new file mode 100644 index 000000000..b50396d44 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_schemas.yaml @@ -0,0 +1,590 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: schemas.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: Schema + listKind: SchemaList + plural: schemas + shortNames: + - schema + singular: schema + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.format + name: Format + type: string + - jsonPath: .status.id + name: ID + type: string + - jsonPath: .status.version + name: Version + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.schemaRegistryEndpoint + name: SchemaRegistryEndpoint + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the Schema. + properties: + compatibilityLevel: + description: |- + compatibilityLevel specifies the compatibility level requirement for the schema under the specified subject. + Valid options are `BACKWARD`, `BACKWARD_TRANSITIVE`, `FORWARD`, `FORWARD_TRANSITIVE`, `FULL`, `FULL_TRANSITIVE` and `NONE`. + more info: https://docs.confluent.io/platform/current/schema-registry/avro.html#schema-evolution-and-compatibility + enum: + - BACKWARD + - BACKWARD_TRANSITIVE + - FORWARD + - FORWARD_TRANSITIVE + - FULL + - FULL_TRANSITIVE + - NONE + type: string + data: + description: data defines the data required to create the schema. + properties: + configRef: + description: configRef is the name of the Kubernetes ConfigMap + resource containing the schema. + minLength: 1 + type: string + format: + description: format is the format type of the encoded schema. + Valid options are `avro`, `json`, and `protobuf`. + enum: + - avro + - json + - protobuf + minLength: 1 + type: string + required: + - configRef + - format + type: object + mode: + description: |- + Mode specifies the schema registry mode for the schemas under the specified subject. + Valid options are `IMPORT`, `READONLY`, `READWRITE`. + enum: + - IMPORT + - READONLY + - READWRITE + type: string + name: + description: |- + name specifies the subject name of schema. If not configured, the Schema CR name is used + as the subject name. + maxLength: 255 + minLength: 1 + pattern: ^[^\\]*$ + type: string + normalize: + description: |- + Normalize specifies whether to normalize the schema at the time of registering to schema registry. + more info: https://docs.confluent.io/platform/current/schema-registry/fundamentals/serdes-develop/index.html#schema-normalization + type: boolean + schemaReferences: + description: schemaReferences defines the schema references in the + schema data. + items: + description: SchemaReference is the schema to be used as a reference + for the new schema. + properties: + avro: + description: avro is the data for the referenced Avro schema. + properties: + avro: + description: name is the fully qualified name of the referenced + Avro schema. + minLength: 1 + type: string + required: + - avro + type: object + format: + description: format is the format type of the referenced schema. + Valid options are `avro`, `json`, and `protobuf`. + enum: + - avro + - json + - protobuf + minLength: 1 + type: string + json: + description: json is the data for the referenced JSON schema. + properties: + url: + description: url is the referenced JSON schema url. + minLength: 1 + type: string + required: + - url + type: object + protobuf: + description: protobuf is the data for the referenced Protobuf + schema. + properties: + file: + description: file is the file name of the referenced Protobuf + schema. + minLength: 1 + type: string + required: + - file + type: object + subject: + description: subject is the subject name for the referenced + schema through the configRef. + minLength: 1 + type: string + version: + description: version is the version type of the referenced schema. + format: int32 + type: integer + required: + - format + - subject + - version + type: object + type: array + schemaRegistryClusterRef: + description: schemaRegistryClusterRef references the CFK-managed Schema + Registry cluster. + properties: + name: + description: name specifies the name of the Confluent Platform + component cluster. + type: string + namespace: + description: namespace specifies the namespace where the Confluent + Platform component cluster is running. + type: string + required: + - name + type: object + schemaRegistryRest: + description: schemaRegistryRest specifies the Schema Registry REST + API configuration. + properties: + authentication: + description: authentication specifies the REST API authentication + mechanism. + properties: + basic: + description: basic specifies the basic authentication settings + for the REST API client. + properties: + debug: + description: debug enables the basic authentication debug + logs for JaaS configuration. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer allows to pass the basic credential through a directory path in the container. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + minLength: 1 + type: string + restrictedRoles: + description: |- + restrictedRoles specify the restricted roles on the server side only. + Changes will be only reflected in Control Center. + This configuration is ignored on the client side configuration. + items: + type: string + minItems: 1 + type: array + roles: + description: |- + roles specify the roles on the server side only. + This configuration is ignored on the client side configuration. + items: + type: string + type: array + secretRef: + description: |- + secretRef defines secret reference to pass the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#basic-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + bearer: + description: bearer specifies the bearer authentication settings + for the REST API client. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container + where the credential is mounted. + minLength: 1 + type: string + secretRef: + description: |- + secretRef specifies the name of the secret that contains the credential. + More info: https://docs.confluent.io/operator/current/co-authenticate.html#bearer-authentication + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauth: + description: oauth specifies the OAuth authentication settings + for the REST API client. + properties: + configuration: + description: configuration specifies the OAuth server + settings. + properties: + audience: + description: audience specifies the audience claim + in the JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected + issuer in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of + claim in token for identifying the groups of subject + in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout + with IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry + backoff with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff + with IDP in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim + in JWT to use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + directoryPathInContainer: + description: directoryPathInContainer allows to pass the + basic credential through a directory path in the container. + minLength: 1 + type: string + secretRef: + description: secretRef defines secret reference to pass + the required credentials. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - configuration + type: object + type: + description: type specifies the REST API authentication type. + Valid options are `basic`, `bearer`, `mtls` and `oauth`. + enum: + - basic + - bearer + - mtls + - oauth + type: string + required: + - type + type: object + endpoint: + description: endpoint specifies where Confluent REST API is running. + minLength: 1 + pattern: ^https?://.* + type: string + kafkaClusterID: + description: |- + kafkaClusterID specifies the id of Kafka cluster. + It takes precedence over using the Kafka REST API to get the cluster id. + minLength: 1 + type: string + tls: + description: "tls specifies the custom TLS structure for the application + resources,\n\t// e.g. connector, topic, schema, of the Confluent + Platform components.\n\t// +optional" + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer contains the directory path in the container where + `keystore.jks`, `truststore.jks`, `jksPassword.txt` keys are mounted. + minLength: 1 + type: string + jksPassword: + description: jksPassword specifies the secret name that contains + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef specifies the secret name that contains the certificates. + More info about certificates key/value format: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 63 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + type: object + required: + - data + type: object + status: + description: status defines the observed state of the Schema. + properties: + appState: + default: Unknown + description: appState is the current state of the Schema application. + enum: + - Unknown + - Created + - Failed + - Deleted + type: string + compatibilityLevel: + description: compatibilityLevel specifies the compatibility level + of the schema under the subject. + type: string + conditions: + description: conditions are the latest available observed state of + the schema. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + deletedVersions: + description: deletedVersions are the successfully hard deleted versions + for the subject. + items: + format: int32 + type: integer + type: array + format: + description: format is the format of the latest schema for the subject. + type: string + id: + description: id is the id of the latest schema for the subject. + format: int32 + type: integer + mode: + description: Mode specifies the operating mode of schema under the + subject. + type: string + normalize: + description: Normalize specifies whether schema has been normalized + at the time of registering. + type: boolean + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + schemaReferences: + description: schemaReferences are the schema references for the subject. + items: + description: SchemaReference is the schema to be used as a reference + for the new schema. + properties: + avro: + description: avro is the data for the referenced Avro schema. + properties: + avro: + description: name is the fully qualified name of the referenced + Avro schema. + minLength: 1 + type: string + required: + - avro + type: object + format: + description: format is the format type of the referenced schema. + Valid options are `avro`, `json`, and `protobuf`. + enum: + - avro + - json + - protobuf + minLength: 1 + type: string + json: + description: json is the data for the referenced JSON schema. + properties: + url: + description: url is the referenced JSON schema url. + minLength: 1 + type: string + required: + - url + type: object + protobuf: + description: protobuf is the data for the referenced Protobuf + schema. + properties: + file: + description: file is the file name of the referenced Protobuf + schema. + minLength: 1 + type: string + required: + - file + type: object + subject: + description: subject is the subject name for the referenced + schema through the configRef. + minLength: 1 + type: string + version: + description: version is the version type of the referenced schema. + format: int32 + type: integer + required: + - format + - subject + - version + type: object + type: array + schemaRegistryAuthenticationType: + description: schemaRegistryAuthenticationType is the authentication + method used. + type: string + schemaRegistryEndpoint: + description: schemaRegistryEndpoint is the Schema Registry REST endpoint. + type: string + schemaRegistryTLS: + description: schemaRegistryTLS shows whether the Schema Registry is + using TLS. + type: boolean + softDeletedVersions: + description: softDeletedVersions are the successfully soft deleted + versions for the subject. + items: + format: int32 + type: integer + type: array + state: + description: state is the state of the Schema CR. + type: string + subject: + description: subject is the subject of the schema. + type: string + version: + description: version is the version of the latest schema for the subject. + format: int32 + type: integer + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_zookeepers.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_zookeepers.yaml new file mode 100644 index 000000000..5a89c94c7 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/crds/platform.confluent.io_zookeepers.yaml @@ -0,0 +1,4713 @@ +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + name: zookeepers.platform.confluent.io +spec: + group: platform.confluent.io + names: + categories: + - all + - confluent-platform + - confluent + kind: Zookeeper + listKind: ZookeeperList + plural: zookeepers + shortNames: + - zookeeper + - zk + singular: zookeeper + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.replicas + name: Replicas + type: string + - jsonPath: .status.readyReplicas + name: Ready + type: string + - jsonPath: .status.phase + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + - jsonPath: .status.endpoint + name: Endpoint + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: Zookeeper is the schema for the Zookeeper API. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec defines the desired state of the Zookeeper cluster. + properties: + authentication: + description: authentication specifies the authentication configuration. + properties: + jaasConfig: + description: |- + jaasConfig specifies the JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + secretRef: + description: |- + secretRef references the secret containing the required credentials. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + jaasConfigPassThrough: + description: |- + jaasConfigPassThrough specifies another way to provide JaaS configuration. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where required credentials are mounted. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + minLength: 1 + type: string + secretRef: + description: |- + secretRef references the secret containing the required credentials for authentication. + More info: https://docs.confluent.io/operator/current/co-authenticate.html + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + oauthSettings: + description: |- + oauthSettings specifies the OAuth settings. + This needs to passed with the authentication type `oauth`. + properties: + audience: + description: audience specifies the audience claim in the + JWT payload. + minLength: 1 + type: string + expectedIssuer: + description: expectedIssuer specifies the expected issuer + in the JWT payload. + minLength: 1 + type: string + groupsClaimName: + description: groupsClaimName specifies the name of claim in + token for identifying the groups of subject in the JWT payload. + minLength: 1 + type: string + jwksEndpointUri: + description: |- + jwksEndpointUri specifies the uri for the JSON Web Key Set (JWKS). + It is used to get set of keys containing the public keys used to verify any JWT issued by the IdP's Authorization Server. + minLength: 1 + type: string + loginConnectTimeoutMs: + description: LoginConnectTimeoutMs sets connect timeout with + IDP in ms + format: int32 + type: integer + loginReadTimeoutMs: + description: LoginReadTimeoutMs sets read timeout with IDP + in ms + format: int32 + type: integer + loginRetryBackoffMaxMs: + description: LoginRetryBackoffMaxMs sets max retry backoff + with IDP in ms + format: int32 + type: integer + loginRetryBackoffMs: + description: LoginRetryBackoffMs sets retry backoff with IDP + in ms + format: int32 + type: integer + scope: + description: |- + scope is optional and required only when your identity provider doesn't have + a default scope or your groups claim is linked to a scope. + minLength: 1 + type: string + subClaimName: + description: subClaimName specifies name of claim in JWT to + use for the subject. + minLength: 1 + type: string + tokenEndpointUri: + description: |- + tokenBaseEndpointUri specifies the base uri for token endpoint. + This is required for OAuth for inter broker communication along with + clientId & clientSecret in JassConfig or JassConfigPassthrough + minLength: 1 + type: string + type: object + principalMappingRules: + items: + type: string + type: array + type: + description: |- + type specifies the Kafka or Zookeeper authentication type. + Valid options are `plain`, `digest`, `mtls`, `ldap` & `oauth`. + enum: + - plain + - digest + - mtls + - ldap + - oauth + type: string + required: + - type + type: object + configOverrides: + description: |- + configOverrides specifies configs to override the server/JVM/log4j/peer + properties for the Zookeeper cluster. + A change to this property will roll the cluster. + properties: + jvm: + description: |- + jvm is a list of JVM configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + log4j: + description: |- + log4j is a list of Log4J configuration supported by the Confluent Platform component. + This will either add or update the existing configuration. + items: + type: string + type: array + peers: + description: |- + peers specify a list of dynamic peer configurations for the Zookeeper cluster. This is only required when deploying stretch + Zookeeper for MRC deployments and should include all the Zookeeper peers in other DCs that form the ensemble. + This will either add or update the existing configuration. + items: + type: string + type: array + server: + description: |- + server is a list of server configuration supported by the Confluent Platform component. + This will either add or update existing configuration. + items: + type: string + type: array + type: object + dataVolumeCapacity: + anyOf: + - type: integer + - type: string + description: dataVolumeCapacity specifies the data volume size. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + externalAccess: + description: |- + externalAccess specifies the external access configuration. + Should only be specified when Zookeeper peers are on another network. + properties: + loadBalancer: + description: loadBalancer specifies the configuration to create + a Kubernetes load balancer service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain is the domain name of the component cluster. + minLength: 1 + type: string + externalTrafficPolicy: + description: externalTrafficPolicy specifies the external + traffic policy for the service. Valid options are `Local` + and `Cluster`. + enum: + - Local + - Cluster + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + loadBalancerSourceRanges: + description: loadBalancerSourceRanges specify the source ranges. + items: + type: string + type: array + port: + description: |- + port specifies the external port for the client consumption. + If not configured, the same internal/external port is configured for the component. + Information about the port can be retrieved through the status API. + format: int32 + type: integer + prefix: + description: |- + prefix specify the prefix for the given domain. + The default value is the name of the cluster. + minLength: 1 + type: string + servicePorts: + description: servicePorts specify the user-provided service + port(s). + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - domain + type: object + nodePort: + description: nodePort specifies the configuration to create a + Kubernetes node port service. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to `://:, where`podId` starts from `0` to `replicaCount - 1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + externalTrafficPolicy: + description: |- + externalTrafficPolicy specifies the external traffic policy for the service. + Valid options are `Local` and `Cluster`. + enum: + - Local + - Cluster + type: string + host: + description: host defines the host name of the cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + nodePortOffset: + description: |- + nodePortOffset specifies the starting offset of the node ports. The port numbers go in ascending order with respect + to the replicas count. + NodePort service creation fails if the node port is not in the range supported by the Kubernetes API server. + The default Kubernetes Node Port range is `30000` - `32762`. + format: int32 + minimum: 0 + type: integer + servicePorts: + description: |- + servicePorts specify user-provided service port(s). + For Kafka with the nodePort type, this setting is only applied to Kafka bootstrap service. + items: + description: ServicePort contains information on service's + port. + properties: + appProtocol: + description: |- + The application protocol for this port. + This is used as a hint for implementations to offer richer behavior for protocols that they understand. + This field follows standard Kubernetes label syntax. + Valid values are either: + + + * Un-prefixed protocol names - reserved for IANA standard service names (as per + RFC-6335 and https://www.iana.org/assignments/service-names). + + + * Kubernetes-defined prefixed names: + * 'kubernetes.io/h2c' - HTTP/2 prior knowledge over cleartext as described in https://www.rfc-editor.org/rfc/rfc9113.html#name-starting-http-2-with-prior- + * 'kubernetes.io/ws' - WebSocket over cleartext as described in https://www.rfc-editor.org/rfc/rfc6455 + * 'kubernetes.io/wss' - WebSocket over TLS as described in https://www.rfc-editor.org/rfc/rfc6455 + + + * Other protocols should use implementation-defined prefixed names such as + mycompany.com/my-custom-protocol. + type: string + name: + description: |- + The name of this port within the service. This must be a DNS_LABEL. + All ports within a ServiceSpec must have unique names. When considering + the endpoints for a Service, this must match the 'name' field in the + EndpointPort. + Optional if only one ServicePort is defined on this service. + type: string + nodePort: + description: |- + The port on each node on which this service is exposed when type is + NodePort or LoadBalancer. Usually assigned by the system. If a value is + specified, in-range, and not in use it will be used, otherwise the + operation will fail. If not specified, a port will be allocated if this + Service requires one. If this field is specified when creating a + Service which does not need it, creation will fail. This field will be + wiped when updating a Service to no longer need it (e.g. changing type + from NodePort to ClusterIP). + More info: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport + format: int32 + type: integer + port: + description: The port that will be exposed by this service. + format: int32 + type: integer + protocol: + default: TCP + description: |- + The IP protocol for this port. Supports "TCP", "UDP", and "SCTP". + Default is TCP. + type: string + targetPort: + anyOf: + - type: integer + - type: string + description: |- + Number or name of the port to access on the pods targeted by the service. + Number must be in the range 1 to 65535. Name must be an IANA_SVC_NAME. + If this is a string, it will be looked up as a named port in the + target Pod's container ports. If this is not specified, the value + of the 'port' field is used (an identity map). + This field is ignored for services with clusterIP=None, and should be + omitted or set equal to the 'port' field. + More info: https://kubernetes.io/docs/concepts/services-networking/service/#defining-a-service + x-kubernetes-int-or-string: true + required: + - port + type: object + type: array + sessionAffinity: + description: |- + sessionAffinity defines the Kubernetes session affinity. The valid options are `ClientIP` and `None`. `ClientIP` enables the client IP-based session affinity. + The default value is `None`. + More info: https://kubernetes.io/docs/reference/networking/virtual-ips/#session-affinity. + enum: + - ClientIP + - None + type: string + sessionAffinityConfig: + description: SessionAffinityConfig contains the configurations + of the session affinity. + properties: + clientIP: + description: clientIP contains the configurations of Client + IP based session affinity. + properties: + timeoutSeconds: + description: |- + timeoutSeconds specifies the seconds of ClientIP type session sticky time. + The value must be >0 && <=86400(for 1 day) if ServiceAffinity == "ClientIP". + Default value is 10800(for 3 hours). + format: int32 + type: integer + type: object + type: object + required: + - host + - nodePortOffset + type: object + route: + description: route specifies the configuration to create a route + service in OpenShift. + properties: + advertisedURL: + description: |- + advertisedURL specifies the configuration for advertised listener per pod. It is only supported for MDS currently. + If it is enabled, instead of using internal endpoint, the MDS advertised listener for each broker will be + set to: `://-http-external.` where podId starts from `0` to `replicaCount -1`. + This is only recommended if you cannot add internal SANs to the TLS certificates for MDS and + the external DNS must be resolved inside the Kubernetes cluster. + This configuration will not take effect if MDS enabled dual listener setup. + properties: + enabled: + description: |- + enabled indicates whether to set the MDS advertised listener url with external endpoint for each broker. + Has no effect with Zookeeper, which will always create a listener per pod. + type: boolean + prefix: + description: |- + prefix specifies the broker prefix for MDS/Zookeeper advertised endpoint. + If not configured, it uses `b` as default prefix for MDS, such as `b#.domain` where `#` will start from `0` to `replicaCount -1`. + It uses 'zookeeper' as default prefix for Zookeeper in the same way. + minLength: 1 + type: string + required: + - enabled + type: object + annotations: + additionalProperties: + type: string + description: annotations is a map of string key and value + pairs. It specifies Kubernetes annotations for this service. + type: object + x-kubernetes-map-type: granular + domain: + description: domain specifies the domain name of the Confluent + component cluster. + minLength: 1 + type: string + labels: + additionalProperties: + type: string + description: labels is a map of string key and value pairs. + It specifies Kubernetes labels for this service. + type: object + x-kubernetes-map-type: granular + prefix: + description: |- + prefix specifies the component prefix when configured for the domain. + The default value is the name of the cluster. + minLength: 1 + type: string + wildcardPolicy: + description: |- + wildcardPolicy allows you to define a route that covers all hosts within a domain. Valid options are `Subdomain` and `None`. + The default value is `None`. + enum: + - Subdomain + - None + type: string + required: + - domain + type: object + type: + description: |- + type specifies the Kubernetes external service for the component. + Valid options are `loadBalancer`, `nodePort`, and `route`. + enum: + - loadBalancer + - nodePort + - route + minLength: 1 + type: string + required: + - type + type: object + headlessService: + description: headlessService specifies the configuration of the Kubernetes + headless service. + properties: + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs. + It specifies the annotations to be added to the CFK-created headless service. + These annotations are merged with the injectAnnotations and take precedence. + type: object + x-kubernetes-map-type: granular + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs. + It specifies the labels to be added to the CFK-created headless service. + These labels are merged with the injectLabels and take precedence. + type: object + x-kubernetes-map-type: granular + publishNotReadyAddresses: + description: |- + publishNotReadyAddresses specifies the publishNotReadyAddresses field. + For Kafka, this value must be true. The default value is true. + type: boolean + type: object + image: + description: |- + image specifies the application and the init docker image configurations. + A change to this setting will roll the cluster. + properties: + application: + description: |- + application is the Docker image name of the application. Specify + `//:`. + pattern: .+:.+ + type: string + init: + description: |- + init is the init-container name. Specify + `//:`. + pattern: .+:.+ + type: string + pullPolicy: + description: |- + pullPolicy is the policy for pulling images. Valid options are `Always`, `Never`, and `IfNotPresent`. + The default value is `IfNotPresent`. + enum: + - Always + - Never + - IfNotPresent + type: string + pullSecretRef: + description: |- + pullSecretRef references the secrets in the same namespace to be used for pulling images. + Image pull secrets are distinct from secrets because secrets + can be mounted in the pod, but image pull secrets are only accessed by `kubelet`. + More info: https://kubernetes.io/docs/concepts/containers/images/#specifying-imagepullsecrets-on-a-pod + items: + type: string + type: array + required: + - application + - init + type: object + injectAnnotations: + additionalProperties: + type: string + description: |- + injectAnnotations are the annotations injected to the internal resources that CFK created. + The internal annotations are preserved and cannot be overridden. + For pod annotations, use `podTemplate.annotations`. + type: object + x-kubernetes-map-type: granular + injectLabels: + additionalProperties: + type: string + description: |- + injectLabels are the labels injected to the internal resources that CFK created. + The internal labels are preserved and cannot be overridden. + For pod labels, use `podTemplate.labels`. + type: object + x-kubernetes-map-type: granular + k8sClusterDomain: + description: |- + k8sClusterDomain specifies the configuration of the Kubernetes cluster domain. + The default is the `cluster.local` domain. + type: string + license: + description: license specifies the license configuration for the Confluent + Platform component. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + the license key is mounted. More info: + https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + minLength: 1 + type: string + globalLicense: + description: globalLicense specifies whether the Confluent Platform + component shares the common global license. + type: boolean + secretRef: + description: |- + secretRef references the secret that provides the license for the Confluent Platform component. + More info: https://docs.confluent.io/operator/current/co-license.html#update-component-level-licenses + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + logVolumeCapacity: + anyOf: + - type: integer + - type: string + description: logVolumeCapacity specifies the log volume size. + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + metrics: + description: metrics specify the security settings for the metric + services. + properties: + authentication: + description: authentication specifies the authentication configuration + for the metrics. + properties: + type: + description: type specifies the metrics authentication method. + The valid option is `mtls`. + enum: + - mtls + type: string + required: + - type + type: object + prometheus: + description: prometheus specifies the configuration overrides + for the JMX-Prometheus exporter. + properties: + blacklist: + items: + type: string + type: array + rules: + items: + description: Rule defines the Prometheus Exporter rule override. + properties: + attrNameSnakeCase: + type: boolean + cache: + type: boolean + help: + minLength: 1 + type: string + labels: + additionalProperties: + type: string + type: object + x-kubernetes-map-type: granular + name: + minLength: 1 + type: string + pattern: + minLength: 1 + type: string + type: + minLength: 1 + type: string + value: + minLength: 1 + type: string + valueFactor: + anyOf: + - type: integer + - type: string + default: 1 + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + type: array + whitelist: + items: + type: string + type: array + type: object + tls: + description: tls specifies the TLS configuration for the metrics. + properties: + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + enabled: + description: enabled specifies to enable the TLS configuration + for the Confluent component. + type: boolean + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing + the JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - enabled + type: object + type: object + mountedSecrets: + description: |- + mountedSecrets list the secrets injected to + the underlying statefulset configuration. The secret reference is mounted + in the default path `/mnt/secrets/`. The underlying resources + will follow the secret as a file configuration. + More info: https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod. + A change to this setting will roll the cluster. + items: + description: |- + MountedSecrets provides a way to inject a custom secret to the underlying + statefulset. + properties: + keyItems: + description: keyItems are key and path names. + items: + description: Maps a string key to a path within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + secretRef: + description: secretRef references the name of the secret. + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + type: array + mountedVolumes: + description: |- + mountedVolumes list the custom volumes that need to be mounted into the + underlying statefulset. + A change to this setting will roll the cluster. + properties: + volumeMounts: + description: |- + volumeMounts specify the list of volume mounts for the pods in the + statefulset. + items: + description: VolumeMount describes a mounting of a Volume within + a container. + properties: + mountPath: + description: |- + Path within the container at which the volume should be mounted. Must + not contain ':'. + type: string + mountPropagation: + description: |- + mountPropagation determines how mounts are propagated from the host + to container and the other way around. + When not set, MountPropagationNone is used. + This field is beta in 1.10. + type: string + name: + description: This must match the Name of a Volume. + type: string + readOnly: + description: |- + Mounted read-only if true, read-write otherwise (false or unspecified). + Defaults to false. + type: boolean + subPath: + description: |- + Path within the volume from which the container's volume should be mounted. + Defaults to "" (volume's root). + type: string + subPathExpr: + description: |- + Expanded path within the volume from which the container's volume should be mounted. + Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. + Defaults to "" (volume's root). + SubPathExpr and SubPath are mutually exclusive. + type: string + required: + - mountPath + - name + type: object + type: array + volumes: + description: |- + volumes specify the list of volumes that can be mounted into the pods + of statefulset. + items: + description: Volume represents a named volume in a pod that + may be accessed by any container in the pod. + properties: + awsElasticBlockStore: + description: |- + awsElasticBlockStore represents an AWS Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + format: int32 + type: integer + readOnly: + description: |- + readOnly value true will force the readOnly setting in VolumeMounts. + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: boolean + volumeID: + description: |- + volumeID is unique ID of the persistent disk resource in AWS (Amazon EBS volume). + More info: https://kubernetes.io/docs/concepts/storage/volumes#awselasticblockstore + type: string + required: + - volumeID + type: object + azureDisk: + description: azureDisk represents an Azure Data Disk mount + on the host and bind mount to the pod. + properties: + cachingMode: + description: 'cachingMode is the Host Caching mode: + None, Read Only, Read Write.' + type: string + diskName: + description: diskName is the Name of the data disk in + the blob storage + type: string + diskURI: + description: diskURI is the URI of data disk in the + blob storage + type: string + fsType: + description: |- + fsType is Filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + kind: + description: 'kind expected values are Shared: multiple + blob disks per storage account Dedicated: single + blob disk per storage account Managed: azure managed + data disk (only in managed availability set). defaults + to shared' + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + required: + - diskName + - diskURI + type: object + azureFile: + description: azureFile represents an Azure File Service + mount on the host and bind mount to the pod. + properties: + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretName: + description: secretName is the name of secret that + contains Azure Storage Account Name and Key + type: string + shareName: + description: shareName is the azure share Name + type: string + required: + - secretName + - shareName + type: object + cephfs: + description: cephFS represents a Ceph FS mount on the host + that shares a pod's lifetime + properties: + monitors: + description: |- + monitors is Required: Monitors is a collection of Ceph monitors + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + items: + type: string + type: array + path: + description: 'path is Optional: Used as the mounted + root, rather than the full Ceph tree, default is /' + type: string + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: boolean + secretFile: + description: |- + secretFile is Optional: SecretFile is the path to key ring for User, default is /etc/ceph/user.secret + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + secretRef: + description: |- + secretRef is Optional: SecretRef is reference to the authentication secret for User, default is empty. + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is optional: User is the rados user name, default is admin + More info: https://examples.k8s.io/volumes/cephfs/README.md#how-to-use-it + type: string + required: + - monitors + type: object + cinder: + description: |- + cinder represents a cinder volume attached and mounted on kubelets host machine. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: boolean + secretRef: + description: |- + secretRef is optional: points to a secret object containing parameters used to connect + to OpenStack. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeID: + description: |- + volumeID used to identify the volume in cinder. + More info: https://examples.k8s.io/mysql-cinder-pd/README.md + type: string + required: + - volumeID + type: object + configMap: + description: configMap represents a configMap that should + populate this volume + properties: + defaultMode: + description: |- + defaultMode is optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the ConfigMap + or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + csi: + description: csi (Container Storage Interface) represents + ephemeral storage that is handled by certain external + CSI drivers (Beta feature). + properties: + driver: + description: |- + driver is the name of the CSI driver that handles this volume. + Consult with your admin for the correct name as registered in the cluster. + type: string + fsType: + description: |- + fsType to mount. Ex. "ext4", "xfs", "ntfs". + If not provided, the empty value is passed to the associated CSI driver + which will determine the default filesystem to apply. + type: string + nodePublishSecretRef: + description: |- + nodePublishSecretRef is a reference to the secret object containing + sensitive information to pass to the CSI driver to complete the CSI + NodePublishVolume and NodeUnpublishVolume calls. + This field is optional, and may be empty if no secret is required. If the + secret object contains more than one secret, all secret references are passed. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + readOnly: + description: |- + readOnly specifies a read-only configuration for the volume. + Defaults to false (read/write). + type: boolean + volumeAttributes: + additionalProperties: + type: string + description: |- + volumeAttributes stores driver-specific properties that are passed to the CSI + driver. Consult your driver's documentation for supported values. + type: object + required: + - driver + type: object + downwardAPI: + description: downwardAPI represents downward API about the + pod that should populate this volume + properties: + defaultMode: + description: |- + Optional: mode bits to use on created files by default. Must be a + Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: Items is a list of downward API volume + file + items: + description: DownwardAPIVolumeFile represents information + to create the file containing the pod field + properties: + fieldRef: + description: 'Required: Selects a field of the + pod: only annotations, labels, name and namespace + are supported.' + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in + the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the relative + path name of the file to be created. Must not + be absolute or contain the ''..'' path. Must + be utf-8 encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required for + volumes, optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of + the exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + emptyDir: + description: |- + emptyDir represents a temporary directory that shares a pod's lifetime. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + properties: + medium: + description: |- + medium represents what type of storage medium should back this directory. + The default is "" which means to use the node's default medium. + Must be an empty string (default) or Memory. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + type: string + sizeLimit: + anyOf: + - type: integer + - type: string + description: |- + sizeLimit is the total amount of local storage required for this EmptyDir volume. + The size limit is also applicable for memory medium. + The maximum usage on memory medium EmptyDir would be the minimum value between + the SizeLimit specified here and the sum of memory limits of all containers in a pod. + The default is nil which means that the limit is undefined. + More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + type: object + ephemeral: + description: |- + ephemeral represents a volume that is handled by a cluster storage driver. + The volume's lifecycle is tied to the pod that defines it - it will be created before the pod starts, + and deleted when the pod is removed. + + + Use this if: + a) the volume is only needed while the pod runs, + b) features of normal volumes like restoring from snapshot or capacity + tracking are needed, + c) the storage driver is specified through a storage class, and + d) the storage driver supports dynamic volume provisioning through + a PersistentVolumeClaim (see EphemeralVolumeSource for more + information on the connection between this volume type + and PersistentVolumeClaim). + + + Use PersistentVolumeClaim or one of the vendor-specific + APIs for volumes that persist for longer than the lifecycle + of an individual pod. + + + Use CSI for light-weight local ephemeral volumes if the CSI driver is meant to + be used that way - see the documentation of the driver for + more information. + + + A pod can use both types of ephemeral volumes and + persistent volumes at the same time. + properties: + volumeClaimTemplate: + description: |- + Will be used to create a stand-alone PVC to provision the volume. + The pod in which this EphemeralVolumeSource is embedded will be the + owner of the PVC, i.e. the PVC will be deleted together with the + pod. The name of the PVC will be `-` where + `` is the name from the `PodSpec.Volumes` array + entry. Pod validation will reject the pod if the concatenated name + is not valid for a PVC (for example, too long). + + + An existing PVC with that name that is not owned by the pod + will *not* be used for the pod to avoid using an unrelated + volume by mistake. Starting the pod is then blocked until + the unrelated PVC is removed. If such a pre-created PVC is + meant to be used by the pod, the PVC has to updated with an + owner reference to the pod once the pod exists. Normally + this should not be necessary, but it may be useful when + manually reconstructing a broken cluster. + + + This field is read-only and no changes will be made by Kubernetes + to the PVC after it has been created. + + + Required, must not be nil. + properties: + metadata: + description: |- + May contain labels and annotations that will be copied into the PVC + when creating it. No other fields are allowed and will be rejected during + validation. + type: object + spec: + description: |- + The specification for the PersistentVolumeClaim. The entire content is + copied unchanged into the PVC that gets created from this + template. The same fields as in a PersistentVolumeClaim + are also valid here. + properties: + accessModes: + description: |- + accessModes contains the desired access modes the volume should have. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1 + items: + type: string + type: array + dataSource: + description: |- + dataSource field can be used to specify either: + * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) + * An existing PVC (PersistentVolumeClaim) + If the provisioner or an external controller can support the specified data source, + it will create a new volume based on the contents of the specified data source. + When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, + and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. + If the namespace is specified, then dataSourceRef will not be copied to dataSource. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + required: + - kind + - name + type: object + x-kubernetes-map-type: atomic + dataSourceRef: + description: |- + dataSourceRef specifies the object from which to populate the volume with data, if a non-empty + volume is desired. This may be any object from a non-empty API group (non + core object) or a PersistentVolumeClaim object. + When this field is specified, volume binding will only succeed if the type of + the specified object matches some installed volume populator or dynamic + provisioner. + This field will replace the functionality of the dataSource field and as such + if both fields are non-empty, they must have the same value. For backwards + compatibility, when namespace isn't specified in dataSourceRef, + both fields (dataSource and dataSourceRef) will be set to the same + value automatically if one of them is empty and the other is non-empty. + When namespace is specified in dataSourceRef, + dataSource isn't set to the same value and must be empty. + There are three important differences between dataSource and dataSourceRef: + * While dataSource only allows two specific types of objects, dataSourceRef + allows any non-core object, as well as PersistentVolumeClaim objects. + * While dataSource ignores disallowed values (dropping them), dataSourceRef + preserves all values, and generates an error if a disallowed value is + specified. + * While dataSource only allows local objects, dataSourceRef allows objects + in any namespaces. + (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. + (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + properties: + apiGroup: + description: |- + APIGroup is the group for the resource being referenced. + If APIGroup is not specified, the specified Kind must be in the core API group. + For any other third-party types, APIGroup is required. + type: string + kind: + description: Kind is the type of resource + being referenced + type: string + name: + description: Name is the name of resource + being referenced + type: string + namespace: + description: |- + Namespace is the namespace of resource being referenced + Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. + (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled. + type: string + required: + - kind + - name + type: object + resources: + description: |- + resources represents the minimum resources the volume should have. + If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements + that are lower than previous value but must still be higher than capacity recorded in the + status field of the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources + properties: + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + selector: + description: selector is a label query over + volumes to consider for binding. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + storageClassName: + description: |- + storageClassName is the name of the StorageClass required by the claim. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1 + type: string + volumeAttributesClassName: + description: |- + volumeAttributesClassName may be used to set the VolumeAttributesClass used by this claim. + If specified, the CSI driver will create or update the volume with the attributes defined + in the corresponding VolumeAttributesClass. This has a different purpose than storageClassName, + it can be changed after the claim is created. An empty string value means that no VolumeAttributesClass + will be applied to the claim but it's not allowed to reset this field to empty string once it is set. + If unspecified and the PersistentVolumeClaim is unbound, the default VolumeAttributesClass + will be set by the persistentvolume controller if it exists. + If the resource referred to by volumeAttributesClass does not exist, this PersistentVolumeClaim will be + set to a Pending state, as reflected by the modifyVolumeStatus field, until such as a resource + exists. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#volumeattributesclass + (Alpha) Using this field requires the VolumeAttributesClass feature gate to be enabled. + type: string + volumeMode: + description: |- + volumeMode defines what type of volume is required by the claim. + Value of Filesystem is implied when not included in claim spec. + type: string + volumeName: + description: volumeName is the binding reference + to the PersistentVolume backing this claim. + type: string + type: object + required: + - spec + type: object + type: object + fc: + description: fc represents a Fibre Channel resource that + is attached to a kubelet's host machine and then exposed + to the pod. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + lun: + description: 'lun is Optional: FC target lun number' + format: int32 + type: integer + readOnly: + description: |- + readOnly is Optional: Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + targetWWNs: + description: 'targetWWNs is Optional: FC target worldwide + names (WWNs)' + items: + type: string + type: array + wwids: + description: |- + wwids Optional: FC volume world wide identifiers (wwids) + Either wwids or combination of targetWWNs and lun must be set, but not both simultaneously. + items: + type: string + type: array + type: object + flexVolume: + description: |- + flexVolume represents a generic volume resource that is + provisioned/attached using an exec based plugin. + properties: + driver: + description: driver is the name of the driver to use + for this volume. + type: string + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". The default filesystem depends on FlexVolume script. + type: string + options: + additionalProperties: + type: string + description: 'options is Optional: this field holds + extra command options if any.' + type: object + readOnly: + description: |- + readOnly is Optional: defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef is Optional: secretRef is reference to the secret object containing + sensitive information to pass to the plugin scripts. This may be + empty if no secret object is specified. If the secret object + contains more than one secret, all secrets are passed to the plugin + scripts. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + required: + - driver + type: object + flocker: + description: flocker represents a Flocker volume attached + to a kubelet's host machine. This depends on the Flocker + control service being running + properties: + datasetName: + description: |- + datasetName is Name of the dataset stored as metadata -> name on the dataset for Flocker + should be considered as deprecated + type: string + datasetUUID: + description: datasetUUID is the UUID of the dataset. + This is unique identifier of a Flocker dataset + type: string + type: object + gcePersistentDisk: + description: |- + gcePersistentDisk represents a GCE Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + properties: + fsType: + description: |- + fsType is filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + partition: + description: |- + partition is the partition in the volume that you want to mount. + If omitted, the default is to mount by volume name. + Examples: For volume /dev/sda1, you specify the partition as "1". + Similarly, the volume partition for /dev/sda is "0" (or you can leave the property empty). + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + format: int32 + type: integer + pdName: + description: |- + pdName is unique name of the PD resource in GCE. Used to identify the disk in GCE. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#gcepersistentdisk + type: boolean + required: + - pdName + type: object + gitRepo: + description: |- + gitRepo represents a git repository at a particular revision. + DEPRECATED: GitRepo is deprecated. To provision a container with a git repo, mount an + EmptyDir into an InitContainer that clones the repo using git, then mount the EmptyDir + into the Pod's container. + properties: + directory: + description: |- + directory is the target directory name. + Must not contain or start with '..'. If '.' is supplied, the volume directory will be the + git repository. Otherwise, if specified, the volume will contain the git repository in + the subdirectory with the given name. + type: string + repository: + description: repository is the URL + type: string + revision: + description: revision is the commit hash for the specified + revision. + type: string + required: + - repository + type: object + glusterfs: + description: |- + glusterfs represents a Glusterfs mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/glusterfs/README.md + properties: + endpoints: + description: |- + endpoints is the endpoint name that details Glusterfs topology. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + path: + description: |- + path is the Glusterfs volume path. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: string + readOnly: + description: |- + readOnly here will force the Glusterfs volume to be mounted with read-only permissions. + Defaults to false. + More info: https://examples.k8s.io/volumes/glusterfs/README.md#create-a-pod + type: boolean + required: + - endpoints + - path + type: object + hostPath: + description: |- + hostPath represents a pre-existing file or directory on the host + machine that is directly exposed to the container. This is generally + used for system agents or other privileged things that are allowed + to see the host machine. Most containers will NOT need this. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + --- + TODO(jonesdl) We need to restrict who can use host directory mounts and who can/can not + mount host directories as read/write. + properties: + path: + description: |- + path of the directory on the host. + If the path is a symlink, it will follow the link to the real path. + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + type: + description: |- + type for HostPath Volume + Defaults to "" + More info: https://kubernetes.io/docs/concepts/storage/volumes#hostpath + type: string + required: + - path + type: object + iscsi: + description: |- + iscsi represents an ISCSI Disk resource that is attached to a + kubelet's host machine and then exposed to the pod. + More info: https://examples.k8s.io/volumes/iscsi/README.md + properties: + chapAuthDiscovery: + description: chapAuthDiscovery defines whether support + iSCSI Discovery CHAP authentication + type: boolean + chapAuthSession: + description: chapAuthSession defines whether support + iSCSI Session CHAP authentication + type: boolean + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#iscsi + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + initiatorName: + description: |- + initiatorName is the custom iSCSI Initiator Name. + If initiatorName is specified with iscsiInterface simultaneously, new iSCSI interface + : will be created for the connection. + type: string + iqn: + description: iqn is the target iSCSI Qualified Name. + type: string + iscsiInterface: + description: |- + iscsiInterface is the interface Name that uses an iSCSI transport. + Defaults to 'default' (tcp). + type: string + lun: + description: lun represents iSCSI Target Lun number. + format: int32 + type: integer + portals: + description: |- + portals is the iSCSI Target Portal List. The portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + items: + type: string + type: array + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + type: boolean + secretRef: + description: secretRef is the CHAP Secret for iSCSI + target and initiator authentication + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + targetPortal: + description: |- + targetPortal is iSCSI Target Portal. The Portal is either an IP or ip_addr:port if the port + is other than default (typically TCP ports 860 and 3260). + type: string + required: + - iqn + - lun + - targetPortal + type: object + name: + description: |- + name of the volume. + Must be a DNS_LABEL and unique within the pod. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + nfs: + description: |- + nfs represents an NFS mount on the host that shares a pod's lifetime + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + properties: + path: + description: |- + path that is exported by the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + readOnly: + description: |- + readOnly here will force the NFS export to be mounted with read-only permissions. + Defaults to false. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: boolean + server: + description: |- + server is the hostname or IP address of the NFS server. + More info: https://kubernetes.io/docs/concepts/storage/volumes#nfs + type: string + required: + - path + - server + type: object + persistentVolumeClaim: + description: |- + persistentVolumeClaimVolumeSource represents a reference to a + PersistentVolumeClaim in the same namespace. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + properties: + claimName: + description: |- + claimName is the name of a PersistentVolumeClaim in the same namespace as the pod using this volume. + More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims + type: string + readOnly: + description: |- + readOnly Will force the ReadOnly setting in VolumeMounts. + Default false. + type: boolean + required: + - claimName + type: object + photonPersistentDisk: + description: photonPersistentDisk represents a PhotonController + persistent disk attached and mounted on kubelets host + machine + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + pdID: + description: pdID is the ID that identifies Photon Controller + persistent disk + type: string + required: + - pdID + type: object + portworxVolume: + description: portworxVolume represents a portworx volume + attached and mounted on kubelets host machine + properties: + fsType: + description: |- + fSType represents the filesystem type to mount + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + volumeID: + description: volumeID uniquely identifies a Portworx + volume + type: string + required: + - volumeID + type: object + projected: + description: projected items for all in one resources secrets, + configmaps, and downward API + properties: + defaultMode: + description: |- + defaultMode are the mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + sources: + description: sources is the list of volume projections + items: + description: Projection that may be projected along + with other supported volume types + properties: + clusterTrustBundle: + description: |- + ClusterTrustBundle allows a pod to access the `.spec.trustBundle` field + of ClusterTrustBundle objects in an auto-updating file. + + + Alpha, gated by the ClusterTrustBundleProjection feature gate. + + + ClusterTrustBundle objects can either be selected by name, or by the + combination of signer name and a label selector. + + + Kubelet performs aggressive normalization of the PEM contents written + into the pod filesystem. Esoteric PEM features such as inter-block + comments and block headers are stripped. Certificates are deduplicated. + The ordering of certificates within the file is arbitrary, and Kubelet + may change the order over time. + properties: + labelSelector: + description: |- + Select all ClusterTrustBundles that match this label selector. Only has + effect if signerName is set. Mutually-exclusive with name. If unset, + interpreted as "match nothing". If set but empty, interpreted as "match + everything". + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The + requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: |- + Select a single ClusterTrustBundle by object name. Mutually-exclusive + with signerName and labelSelector. + type: string + optional: + description: |- + If true, don't block pod startup if the referenced ClusterTrustBundle(s) + aren't available. If using name, then the named ClusterTrustBundle is + allowed not to exist. If using signerName, then the combination of + signerName and labelSelector is allowed to match zero + ClusterTrustBundles. + type: boolean + path: + description: Relative path from the volume + root to write the bundle. + type: string + signerName: + description: |- + Select all ClusterTrustBundles that match this signer name. + Mutually-exclusive with name. The contents of all selected + ClusterTrustBundles will be unified and deduplicated. + type: string + required: + - path + type: object + configMap: + description: configMap information about the configMap + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + ConfigMap will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the ConfigMap, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional specify whether the + ConfigMap or its keys must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + downwardAPI: + description: downwardAPI information about the + downwardAPI data to project + properties: + items: + description: Items is a list of DownwardAPIVolume + file + items: + description: DownwardAPIVolumeFile represents + information to create the file containing + the pod field + properties: + fieldRef: + description: 'Required: Selects a field + of the pod: only annotations, labels, + name and namespace are supported.' + properties: + apiVersion: + description: Version of the schema + the FieldPath is written in terms + of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to + select in the specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + mode: + description: |- + Optional: mode bits used to set permissions on this file, must be an octal value + between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: 'Required: Path is the + relative path name of the file to + be created. Must not be absolute or + contain the ''..'' path. Must be utf-8 + encoded. The first item of the relative + path must not start with ''..''' + type: string + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, requests.cpu and requests.memory) are currently supported. + properties: + containerName: + description: 'Container name: required + for volumes, optional for env + vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output + format of the exposed resources, + defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource + to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + required: + - path + type: object + type: array + type: object + secret: + description: secret information about the secret + data to project + properties: + items: + description: |- + items if unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path + within a volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: optional field specify whether + the Secret or its key must be defined + type: boolean + type: object + x-kubernetes-map-type: atomic + serviceAccountToken: + description: serviceAccountToken is information + about the serviceAccountToken data to project + properties: + audience: + description: |- + audience is the intended audience of the token. A recipient of a token + must identify itself with an identifier specified in the audience of the + token, and otherwise should reject the token. The audience defaults to the + identifier of the apiserver. + type: string + expirationSeconds: + description: |- + expirationSeconds is the requested duration of validity of the service + account token. As the token approaches expiration, the kubelet volume + plugin will proactively rotate the service account token. The kubelet will + start trying to rotate the token if the token is older than 80 percent of + its time to live or if the token is older than 24 hours.Defaults to 1 hour + and must be at least 10 minutes. + format: int64 + type: integer + path: + description: |- + path is the path relative to the mount point of the file to project the + token into. + type: string + required: + - path + type: object + type: object + type: array + type: object + quobyte: + description: quobyte represents a Quobyte mount on the host + that shares a pod's lifetime + properties: + group: + description: |- + group to map volume access to + Default is no group + type: string + readOnly: + description: |- + readOnly here will force the Quobyte volume to be mounted with read-only permissions. + Defaults to false. + type: boolean + registry: + description: |- + registry represents a single or multiple Quobyte Registry services + specified as a string as host:port pair (multiple entries are separated with commas) + which acts as the central registry for volumes + type: string + tenant: + description: |- + tenant owning the given Quobyte volume in the Backend + Used with dynamically provisioned Quobyte volumes, value is set by the plugin + type: string + user: + description: |- + user to map volume access to + Defaults to serivceaccount user + type: string + volume: + description: volume is a string that references an already + created Quobyte volume by name. + type: string + required: + - registry + - volume + type: object + rbd: + description: |- + rbd represents a Rados Block Device mount on the host that shares a pod's lifetime. + More info: https://examples.k8s.io/volumes/rbd/README.md + properties: + fsType: + description: |- + fsType is the filesystem type of the volume that you want to mount. + Tip: Ensure that the filesystem type is supported by the host operating system. + Examples: "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + More info: https://kubernetes.io/docs/concepts/storage/volumes#rbd + TODO: how do we prevent errors in the filesystem from compromising the machine + type: string + image: + description: |- + image is the rados image name. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + keyring: + description: |- + keyring is the path to key ring for RBDUser. + Default is /etc/ceph/keyring. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + monitors: + description: |- + monitors is a collection of Ceph monitors. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + items: + type: string + type: array + pool: + description: |- + pool is the rados pool name. + Default is rbd. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + readOnly: + description: |- + readOnly here will force the ReadOnly setting in VolumeMounts. + Defaults to false. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: boolean + secretRef: + description: |- + secretRef is name of the authentication secret for RBDUser. If provided + overrides keyring. + Default is nil. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + user: + description: |- + user is the rados user name. + Default is admin. + More info: https://examples.k8s.io/volumes/rbd/README.md#how-to-use-it + type: string + required: + - image + - monitors + type: object + scaleIO: + description: scaleIO represents a ScaleIO persistent volume + attached and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". + Default is "xfs". + type: string + gateway: + description: gateway is the host address of the ScaleIO + API Gateway. + type: string + protectionDomain: + description: protectionDomain is the name of the ScaleIO + Protection Domain for the configured storage. + type: string + readOnly: + description: |- + readOnly Defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef references to the secret for ScaleIO user and other + sensitive information. If this is not provided, Login operation will fail. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + sslEnabled: + description: sslEnabled Flag enable/disable SSL communication + with Gateway, default false + type: boolean + storageMode: + description: |- + storageMode indicates whether the storage for a volume should be ThickProvisioned or ThinProvisioned. + Default is ThinProvisioned. + type: string + storagePool: + description: storagePool is the ScaleIO Storage Pool + associated with the protection domain. + type: string + system: + description: system is the name of the storage system + as configured in ScaleIO. + type: string + volumeName: + description: |- + volumeName is the name of a volume already created in the ScaleIO system + that is associated with this volume source. + type: string + required: + - gateway + - secretRef + - system + type: object + secret: + description: |- + secret represents a secret that should populate this volume. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + properties: + defaultMode: + description: |- + defaultMode is Optional: mode bits used to set permissions on created files by default. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values + for mode bits. Defaults to 0644. + Directories within the path are not affected by this setting. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + items: + description: |- + items If unspecified, each key-value pair in the Data field of the referenced + Secret will be projected into the volume as a file whose name is the + key and content is the value. If specified, the listed keys will be + projected into the specified paths, and unlisted keys will not be + present. If a key is specified which is not present in the Secret, + the volume setup will error unless it is marked optional. Paths must be + relative and may not contain the '..' path or start with '..'. + items: + description: Maps a string key to a path within a + volume. + properties: + key: + description: key is the key to project. + type: string + mode: + description: |- + mode is Optional: mode bits used to set permissions on this file. + Must be an octal value between 0000 and 0777 or a decimal value between 0 and 511. + YAML accepts both octal and decimal values, JSON requires decimal values for mode bits. + If not specified, the volume defaultMode will be used. + This might be in conflict with other options that affect the file + mode, like fsGroup, and the result can be other mode bits set. + format: int32 + type: integer + path: + description: |- + path is the relative path of the file to map the key to. + May not be an absolute path. + May not contain the path element '..'. + May not start with the string '..'. + type: string + required: + - key + - path + type: object + type: array + optional: + description: optional field specify whether the Secret + or its keys must be defined + type: boolean + secretName: + description: |- + secretName is the name of the secret in the pod's namespace to use. + More info: https://kubernetes.io/docs/concepts/storage/volumes#secret + type: string + type: object + storageos: + description: storageOS represents a StorageOS volume attached + and mounted on Kubernetes nodes. + properties: + fsType: + description: |- + fsType is the filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + readOnly: + description: |- + readOnly defaults to false (read/write). ReadOnly here will force + the ReadOnly setting in VolumeMounts. + type: boolean + secretRef: + description: |- + secretRef specifies the secret to use for obtaining the StorageOS API + credentials. If not specified, default values will be attempted. + properties: + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + type: object + x-kubernetes-map-type: atomic + volumeName: + description: |- + volumeName is the human-readable name of the StorageOS volume. Volume + names are only unique within a namespace. + type: string + volumeNamespace: + description: |- + volumeNamespace specifies the scope of the volume within StorageOS. If no + namespace is specified then the Pod's namespace will be used. This allows the + Kubernetes name scoping to be mirrored within StorageOS for tighter integration. + Set VolumeName to any name to override the default behaviour. + Set to "default" if you are not using namespaces within StorageOS. + Namespaces that do not pre-exist within StorageOS will be created. + type: string + type: object + vsphereVolume: + description: vsphereVolume represents a vSphere volume attached + and mounted on kubelets host machine + properties: + fsType: + description: |- + fsType is filesystem type to mount. + Must be a filesystem type supported by the host operating system. + Ex. "ext4", "xfs", "ntfs". Implicitly inferred to be "ext4" if unspecified. + type: string + storagePolicyID: + description: storagePolicyID is the storage Policy Based + Management (SPBM) profile ID associated with the StoragePolicyName. + type: string + storagePolicyName: + description: storagePolicyName is the storage Policy + Based Management (SPBM) profile name. + type: string + volumePath: + description: volumePath is the path that identifies + vSphere volume vmdk + type: string + required: + - volumePath + type: object + required: + - name + type: object + type: array + required: + - volumeMounts + - volumes + type: object + oneReplicaPerNode: + description: |- + oneReplicaPerNode controls whether to run 1 pod per node using the pod anti-affinity capability. + Enabling this configuration in an existing cluster will roll the cluster. + type: boolean + pdb: + description: |- + configures PodDisruptionBudget for the Confluent Platform component. + by default PDB is configured based on pre-detemined formula. + properties: + enabled: + description: enabled specifies whether the PodDisruptionBudget + is enabled + type: boolean + maxUnavailable: + description: maxUnavailable is the maximum number of pods that + can be unavailable during the disruption. + format: int32 + type: integer + required: + - enabled + type: object + peers: + description: |- + peers specify a list of dynamic peer configurations for the Zookeeper cluster. This is only required when deploying stretch + Zookeeper for MRC deployments and should include all the Zookeeper peers in other DCs that form the ensemble. + This will either add or update the existing configuration. + items: + type: string + type: array + podTemplate: + description: podTemplate specifies the statefulset pod template configuration. + properties: + affinity: + description: |- + affinity specifies a group of affinity scheduling rules. + More info: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity. + properties: + nodeAffinity: + description: Describes node affinity scheduling rules for + the pod. + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node matches the corresponding matchExpressions; the + node(s) with the highest sum are the most preferred. + items: + description: |- + An empty preferred scheduling term matches all objects with implicit weight 0 + (i.e. it's a no-op). A null preferred scheduling term matches no objects (i.e. is also a no-op). + properties: + preference: + description: A node selector term, associated with + the corresponding weight. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + weight: + description: Weight associated with matching the + corresponding nodeSelectorTerm, in the range 1-100. + format: int32 + type: integer + required: + - preference + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to an update), the system + may or may not try to eventually evict the pod from its node. + properties: + nodeSelectorTerms: + description: Required. A list of node selector terms. + The terms are ORed. + items: + description: |- + A null or empty node selector term matches no objects. The requirements of + them are ANDed. + The TopologySelectorTerm type implements a subset of the NodeSelectorTerm. + properties: + matchExpressions: + description: A list of node selector requirements + by node's labels. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchFields: + description: A list of node selector requirements + by node's fields. + items: + description: |- + A node selector requirement is a selector that contains values, a key, and an operator + that relates the key and values. + properties: + key: + description: The label key that the selector + applies to. + type: string + operator: + description: |- + Represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists, DoesNotExist. Gt, and Lt. + type: string + values: + description: |- + An array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. If the operator is Gt or Lt, the values + array must have a single element, which will be interpreted as an integer. + This array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + type: object + x-kubernetes-map-type: atomic + type: array + required: + - nodeSelectorTerms + type: object + x-kubernetes-map-type: atomic + type: object + podAffinity: + description: Describes pod affinity scheduling rules (e.g. + co-locate this pod in the same node, zone, etc. as some + other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + podAntiAffinity: + description: Describes pod anti-affinity scheduling rules + (e.g. avoid putting this pod in the same node, zone, etc. + as some other pod(s)). + properties: + preferredDuringSchedulingIgnoredDuringExecution: + description: |- + The scheduler will prefer to schedule pods to nodes that satisfy + the anti-affinity expressions specified by this field, but it may choose + a node that violates one or more of the expressions. The node that is + most preferred is the one with the greatest sum of weights, i.e. + for each node that meets all of the scheduling requirements (resource + request, requiredDuringScheduling anti-affinity expressions, etc.), + compute a sum by iterating through the elements of this field and adding + "weight" to the sum if the node has pods which matches the corresponding podAffinityTerm; the + node(s) with the highest sum are the most preferred. + items: + description: The weights of all of the matched WeightedPodAffinityTerm + fields are added per-node to find the most preferred + node(s) + properties: + podAffinityTerm: + description: Required. A pod affinity term, associated + with the corresponding weight. + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list + of label selector requirements. The requirements + are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key + that the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + weight: + description: |- + weight associated with matching the corresponding podAffinityTerm, + in the range 1-100. + format: int32 + type: integer + required: + - podAffinityTerm + - weight + type: object + type: array + requiredDuringSchedulingIgnoredDuringExecution: + description: |- + If the anti-affinity requirements specified by this field are not met at + scheduling time, the pod will not be scheduled onto the node. + If the anti-affinity requirements specified by this field cease to be met + at some point during pod execution (e.g. due to a pod label update), the + system may or may not try to eventually evict the pod from its node. + When there are multiple elements, the lists of nodes corresponding to each + podAffinityTerm are intersected, i.e. all terms must be satisfied. + items: + description: |- + Defines a set of pods (namely those matching the labelSelector + relative to the given namespace(s)) that this pod should be + co-located (affinity) or not co-located (anti-affinity) with, + where co-located is defined as running on a node whose value of + the label with key matches that of any node on which + a pod of the set of pods is running + properties: + labelSelector: + description: |- + A label query over a set of resources, in this case pods. + If it's null, this PodAffinityTerm matches with no Pods. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key in (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + Also, MatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + mismatchLabelKeys: + description: |- + MismatchLabelKeys is a set of pod label keys to select which pods will + be taken into consideration. The keys are used to lookup values from the + incoming pod labels, those key-value labels are merged with `LabelSelector` as `key notin (value)` + to select the group of existing pods which pods will be taken into consideration + for the incoming pod's pod (anti) affinity. Keys that don't exist in the incoming + pod labels will be ignored. The default value is empty. + The same key is forbidden to exist in both MismatchLabelKeys and LabelSelector. + Also, MismatchLabelKeys cannot be set when LabelSelector isn't set. + This is an alpha field and requires enabling MatchLabelKeysInPodAffinity feature gate. + items: + type: string + type: array + x-kubernetes-list-type: atomic + namespaceSelector: + description: |- + A label query over the set of namespaces that the term applies to. + The term is applied to the union of the namespaces selected by this field + and the ones listed in the namespaces field. + null selector and null or empty namespaces list means "this pod's namespace". + An empty selector ({}) matches all namespaces. + properties: + matchExpressions: + description: matchExpressions is a list of label + selector requirements. The requirements are + ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that + the selector applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: |- + namespaces specifies a static list of namespace names that the term applies to. + The term is applied to the union of the namespaces listed in this field + and the ones selected by namespaceSelector. + null or empty namespaces list and null namespaceSelector means "this pod's namespace". + items: + type: string + type: array + topologyKey: + description: |- + This pod should be co-located (affinity) or not co-located (anti-affinity) with the pods matching + the labelSelector in the specified namespaces, where co-located is defined as running on a node + whose value of the label with key topologyKey matches that of any node on which any of the + selected pods is running. + Empty topologyKey is not allowed. + type: string + required: + - topologyKey + type: object + type: array + type: object + type: object + annotations: + additionalProperties: + type: string + description: |- + annotations is a map of string key and value pairs stored with the resource and + may be set by external tools to store and retrieve arbitrary metadata. They + are not queryable and should be preserved when modifying objects. More + info: http://kubernetes.io/docs/user-guide/annotations. + type: object + x-kubernetes-map-type: granular + envVars: + description: |- + envVars contain environment variables to be injected into containers. + More info: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container. + items: + description: EnvVar represents an environment variable present + in a Container. + properties: + name: + description: Name of the environment variable. Must be a + C_IDENTIFIER. + type: string + value: + description: |- + Variable references $(VAR_NAME) are expanded + using the previously defined environment variables in the container and + any service environment variables. If a variable cannot be resolved, + the reference in the input string will be unchanged. Double $$ are reduced + to a single $, which allows for escaping the $(VAR_NAME) syntax: i.e. + "$$(VAR_NAME)" will produce the string literal "$(VAR_NAME)". + Escaped references will never be expanded, regardless of whether the variable + exists or not. + Defaults to "". + type: string + valueFrom: + description: Source for the environment variable's value. + Cannot be used if value is not empty. + properties: + configMapKeyRef: + description: Selects a key of a ConfigMap. + properties: + key: + description: The key to select. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the ConfigMap or its + key must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + fieldRef: + description: |- + Selects a field of the pod: supports metadata.name, metadata.namespace, `metadata.labels['']`, `metadata.annotations['']`, + spec.nodeName, spec.serviceAccountName, status.hostIP, status.podIP, status.podIPs. + properties: + apiVersion: + description: Version of the schema the FieldPath + is written in terms of, defaults to "v1". + type: string + fieldPath: + description: Path of the field to select in the + specified API version. + type: string + required: + - fieldPath + type: object + x-kubernetes-map-type: atomic + resourceFieldRef: + description: |- + Selects a resource of the container: only resources limits and requests + (limits.cpu, limits.memory, limits.ephemeral-storage, requests.cpu, requests.memory and requests.ephemeral-storage) are currently supported. + properties: + containerName: + description: 'Container name: required for volumes, + optional for env vars' + type: string + divisor: + anyOf: + - type: integer + - type: string + description: Specifies the output format of the + exposed resources, defaults to "1" + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + resource: + description: 'Required: resource to select' + type: string + required: + - resource + type: object + x-kubernetes-map-type: atomic + secretKeyRef: + description: Selects a key of a secret in the pod's + namespace + properties: + key: + description: The key of the secret to select from. Must + be a valid secret key. + type: string + name: + description: |- + Name of the referent. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid? + type: string + optional: + description: Specify whether the Secret or its key + must be defined + type: boolean + required: + - key + type: object + x-kubernetes-map-type: atomic + type: object + required: + - name + type: object + type: array + labels: + additionalProperties: + type: string + description: |- + labels is a map of string key and value pairs that can be used to organize and categorize + (scope and select) objects. + More info: http://kubernetes.io/docs/user-guide/labels. + type: object + x-kubernetes-map-type: granular + podSecurityContext: + description: |- + PodSecurityContext holds pod-level security attributes and common container settings. + Some fields are also present in container.securityContext. Field values of + container.securityContext take precedence over field values of PodSecurityContext. + properties: + fsGroup: + description: |- + A special supplemental group that applies to all containers in a pod. + Some volume types allow the Kubelet to change the ownership of that volume + to be owned by the pod: + + + 1. The owning GID will be the FSGroup + 2. The setgid bit is set (new files created in the volume will be owned by FSGroup) + 3. The permission bits are OR'd with rw-rw---- + + + If unset, the Kubelet will not modify the ownership and permissions of any volume. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + fsGroupChangePolicy: + description: |- + fsGroupChangePolicy defines behavior of changing ownership and permission of the volume + before being exposed inside Pod. This field will only apply to + volume types which support fsGroup based ownership(and permissions). + It will have no effect on ephemeral volume types such as: secret, configmaps + and emptydir. + Valid values are "OnRootMismatch" and "Always". If not specified, "Always" is used. + Note that this field cannot be set when spec.os.name is windows. + type: string + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in SecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence + for that container. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to all containers. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in SecurityContext. If set in + both SecurityContext and PodSecurityContext, the value specified in SecurityContext + takes precedence for that container. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by the containers in this pod. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + supplementalGroups: + description: |- + A list of groups applied to the first process run in each container, in addition + to the container's primary GID, the fsGroup (if specified), and group memberships + defined in the container image for the uid of the container process. If unspecified, + no additional groups are added to any container. Note that group memberships + defined in the container image for the uid of the container process are still effective, + even if they are not included in this list. + Note that this field cannot be set when spec.os.name is windows. + items: + format: int64 + type: integer + type: array + sysctls: + description: |- + Sysctls hold a list of namespaced sysctls used for the pod. Pods with unsupported + sysctls (by the container runtime) might fail to launch. + Note that this field cannot be set when spec.os.name is windows. + items: + description: Sysctl defines a kernel parameter to be set + properties: + name: + description: Name of a property to set + type: string + value: + description: Value of a property to set + type: string + required: + - name + - value + type: object + type: array + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options within a container's SecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + priorityClassName: + description: priorityClassName specifies the priority class for + the pod (if any). + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + probe: + description: probe contains the fields for standard Kubernetes + readiness/liveness probe configuration. + properties: + liveness: + description: |- + liveness configures the Kubernetes probe settings. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + readiness: + description: |- + readiness configures the Kubernetes probe setting. The changes + will override the existing default configuration. + properties: + failureThreshold: + description: |- + failureThreshold is the minimum consecutive failures for the probe to be considered failed. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + initialDelaySeconds: + description: |- + initialDelaySeconds is the number of seconds after the container has started and before probes are initiated. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + path: + description: Path for the HTTP probe + type: string + periodSeconds: + description: |- + periodSeconds specifies how often to perform the probe. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + port: + description: Number of the port to access on the container + type: integer + successThreshold: + description: |- + successThreshold is the minimum consecutive successes for the probe to be considered successful after having failed. + The default values is `1`. Must be `1` for liveness and startup. The minimum value is `1`. + format: int32 + type: integer + timeoutSeconds: + description: |- + timeoutSeconds is the number of seconds after which the probe times out. + Confluent Platform components come with the right configuration, and this setting is not required to change most of the time. + format: int32 + type: integer + type: object + type: object + resources: + description: resources describe the compute resource requirements. + properties: + claims: + description: |- + Claims lists the names of resources, defined in spec.resourceClaims, + that are used by this container. + + + This is an alpha field and requires enabling the + DynamicResourceAllocation feature gate. + + + This field is immutable. It can only be set for containers. + items: + description: ResourceClaim references one entry in PodSpec.ResourceClaims. + properties: + name: + description: |- + Name must match the name of one entry in pod.spec.resourceClaims of + the Pod where this field is used. It makes that resource available + inside a container. + type: string + required: + - name + type: object + type: array + x-kubernetes-list-map-keys: + - name + x-kubernetes-list-type: map + limits: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Limits describes the maximum amount of compute resources allowed. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + requests: + additionalProperties: + anyOf: + - type: integer + - type: string + pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$ + x-kubernetes-int-or-string: true + description: |- + Requests describes the minimum amount of compute resources required. + If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, + otherwise to an implementation-defined value. Requests cannot exceed Limits. + More info: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + type: object + type: object + securityContext: + description: |- + SecurityContext holds security configuration that will be applied to a container. + Some fields are present in both SecurityContext and PodSecurityContext. When both + are set, the values in SecurityContext take precedence. + properties: + allowPrivilegeEscalation: + description: |- + AllowPrivilegeEscalation controls whether a process can gain more + privileges than its parent process. This bool directly controls if + the no_new_privs flag will be set on the container process. + AllowPrivilegeEscalation is true always when the container is: + 1) run as Privileged + 2) has CAP_SYS_ADMIN + Note that this field cannot be set when spec.os.name is windows. + type: boolean + capabilities: + description: |- + The capabilities to add/drop when running containers. + Defaults to the default set of capabilities granted by the container runtime. + Note that this field cannot be set when spec.os.name is windows. + properties: + add: + description: Added capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + drop: + description: Removed capabilities + items: + description: Capability represent POSIX capabilities + type + type: string + type: array + type: object + privileged: + description: |- + Run container in privileged mode. + Processes in privileged containers are essentially equivalent to root on the host. + Defaults to false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + procMount: + description: |- + procMount denotes the type of proc mount to use for the containers. + The default is DefaultProcMount which uses the container runtime defaults for + readonly paths and masked paths. + This requires the ProcMountType feature flag to be enabled. + Note that this field cannot be set when spec.os.name is windows. + type: string + readOnlyRootFilesystem: + description: |- + Whether this container has a read-only root filesystem. + Default is false. + Note that this field cannot be set when spec.os.name is windows. + type: boolean + runAsGroup: + description: |- + The GID to run the entrypoint of the container process. + Uses runtime default if unset. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + runAsNonRoot: + description: |- + Indicates that the container must run as a non-root user. + If true, the Kubelet will validate the image at runtime to ensure that it + does not run as UID 0 (root) and fail to start the container if it does. + If unset or false, no such validation will be performed. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: boolean + runAsUser: + description: |- + The UID to run the entrypoint of the container process. + Defaults to user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + format: int64 + type: integer + seLinuxOptions: + description: |- + The SELinux context to be applied to the container. + If unspecified, the container runtime will allocate a random SELinux context for each + container. May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is windows. + properties: + level: + description: Level is SELinux level label that applies + to the container. + type: string + role: + description: Role is a SELinux role label that applies + to the container. + type: string + type: + description: Type is a SELinux type label that applies + to the container. + type: string + user: + description: User is a SELinux user label that applies + to the container. + type: string + type: object + seccompProfile: + description: |- + The seccomp options to use by this container. If seccomp options are + provided at both the pod & container level, the container options + override the pod options. + Note that this field cannot be set when spec.os.name is windows. + properties: + localhostProfile: + description: |- + localhostProfile indicates a profile defined in a file on the node should be used. + The profile must be preconfigured on the node to work. + Must be a descending path, relative to the kubelet's configured seccomp profile location. + Must be set if type is "Localhost". Must NOT be set for any other type. + type: string + type: + description: |- + type indicates which kind of seccomp profile will be applied. + Valid options are: + + + Localhost - a profile defined in a file on the node should be used. + RuntimeDefault - the container runtime default profile should be used. + Unconfined - no profile should be applied. + type: string + required: + - type + type: object + windowsOptions: + description: |- + The Windows specific settings applied to all containers. + If unspecified, the options from the PodSecurityContext will be used. + If set in both SecurityContext and PodSecurityContext, the value specified in SecurityContext takes precedence. + Note that this field cannot be set when spec.os.name is linux. + properties: + gmsaCredentialSpec: + description: |- + GMSACredentialSpec is where the GMSA admission webhook + (https://github.com/kubernetes-sigs/windows-gmsa) inlines the contents of the + GMSA credential spec named by the GMSACredentialSpecName field. + type: string + gmsaCredentialSpecName: + description: GMSACredentialSpecName is the name of the + GMSA credential spec to use. + type: string + hostProcess: + description: |- + HostProcess determines if a container should be run as a 'Host Process' container. + All of a Pod's containers must have the same effective HostProcess value + (it is not allowed to have a mix of HostProcess containers and non-HostProcess containers). + In addition, if HostProcess is true then HostNetwork must also be set to true. + type: boolean + runAsUserName: + description: |- + The UserName in Windows to run the entrypoint of the container process. + Defaults to the user specified in image metadata if unspecified. + May also be set in PodSecurityContext. If set in both SecurityContext and + PodSecurityContext, the value specified in SecurityContext takes precedence. + type: string + type: object + type: object + serviceAccountName: + description: |- + ServiceAccountName is the name of the service account used to run this pod. + More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account. + type: string + terminationGracePeriodSeconds: + description: terminationGracePeriodSeconds is the grace period + before the pod is deleted. + format: int64 + type: integer + tolerations: + description: |- + tolerations specify the pods to schedule onto the nodes with matching taints, using + the triple `` and the matching operator ``. + items: + description: |- + The pod this Toleration is attached to tolerates any taint that matches + the triple using the matching operator . + properties: + effect: + description: |- + Effect indicates the taint effect to match. Empty means match all taint effects. + When specified, allowed values are NoSchedule, PreferNoSchedule and NoExecute. + type: string + key: + description: |- + Key is the taint key that the toleration applies to. Empty means match all taint keys. + If the key is empty, operator must be Exists; this combination means to match all values and all keys. + type: string + operator: + description: |- + Operator represents a key's relationship to the value. + Valid operators are Exists and Equal. Defaults to Equal. + Exists is equivalent to wildcard for value, so that a pod can + tolerate all taints of a particular category. + type: string + tolerationSeconds: + description: |- + TolerationSeconds represents the period of time the toleration (which must be + of effect NoExecute, otherwise this field is ignored) tolerates the taint. By default, + it is not set, which means tolerate the taint forever (do not evict). Zero and + negative values will be treated as 0 (evict immediately) by the system. + format: int64 + type: integer + value: + description: |- + Value is the taint value the toleration matches to. + If the operator is Exists, the value should be empty, otherwise just a regular string. + type: string + type: object + type: array + topologySpreadConstraints: + description: |- + topologySpreadConstraints describe how a group of pods ought to spread across topology domains. Scheduler will + schedule pods based on the constraints. All topologySpreadConstraints are ANDed. + items: + description: TopologySpreadConstraint specifies how to spread + matching pods among the given topology. + properties: + labelSelector: + description: |- + LabelSelector is used to find matching pods. + Pods that match this label selector are counted to determine the number of pods + in their corresponding topology domain. + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: |- + A label selector requirement is a selector that contains values, a key, and an operator that + relates the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: |- + operator represents a key's relationship to a set of values. + Valid operators are In, NotIn, Exists and DoesNotExist. + type: string + values: + description: |- + values is an array of string values. If the operator is In or NotIn, + the values array must be non-empty. If the operator is Exists or DoesNotExist, + the values array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: |- + matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels + map is equivalent to an element of matchExpressions, whose key field is "key", the + operator is "In", and the values array contains only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + matchLabelKeys: + description: |- + MatchLabelKeys is a set of pod label keys to select the pods over which + spreading will be calculated. The keys are used to lookup values from the + incoming pod labels, those key-value labels are ANDed with labelSelector + to select the group of existing pods over which spreading will be calculated + for the incoming pod. The same key is forbidden to exist in both MatchLabelKeys and LabelSelector. + MatchLabelKeys cannot be set when LabelSelector isn't set. + Keys that don't exist in the incoming pod labels will + be ignored. A null or empty list means only match against labelSelector. + + + This is a beta field and requires the MatchLabelKeysInPodTopologySpread feature gate to be enabled (enabled by default). + items: + type: string + type: array + x-kubernetes-list-type: atomic + maxSkew: + description: |- + MaxSkew describes the degree to which pods may be unevenly distributed. + When `whenUnsatisfiable=DoNotSchedule`, it is the maximum permitted difference + between the number of matching pods in the target topology and the global minimum. + The global minimum is the minimum number of matching pods in an eligible domain + or zero if the number of eligible domains is less than MinDomains. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 2/2/1: + In this case, the global minimum is 1. + | zone1 | zone2 | zone3 | + | P P | P P | P | + - if MaxSkew is 1, incoming pod can only be scheduled to zone3 to become 2/2/2; + scheduling it onto zone1(zone2) would make the ActualSkew(3-1) on zone1(zone2) + violate MaxSkew(1). + - if MaxSkew is 2, incoming pod can be scheduled onto any zone. + When `whenUnsatisfiable=ScheduleAnyway`, it is used to give higher precedence + to topologies that satisfy it. + It's a required field. Default value is 1 and 0 is not allowed. + format: int32 + type: integer + minDomains: + description: |- + MinDomains indicates a minimum number of eligible domains. + When the number of eligible domains with matching topology keys is less than minDomains, + Pod Topology Spread treats "global minimum" as 0, and then the calculation of Skew is performed. + And when the number of eligible domains with matching topology keys equals or greater than minDomains, + this value has no effect on scheduling. + As a result, when the number of eligible domains is less than minDomains, + scheduler won't schedule more than maxSkew Pods to those domains. + If value is nil, the constraint behaves as if MinDomains is equal to 1. + Valid values are integers greater than 0. + When value is not nil, WhenUnsatisfiable must be DoNotSchedule. + + + For example, in a 3-zone cluster, MaxSkew is set to 2, MinDomains is set to 5 and pods with the same + labelSelector spread as 2/2/2: + | zone1 | zone2 | zone3 | + | P P | P P | P P | + The number of domains is less than 5(MinDomains), so "global minimum" is treated as 0. + In this situation, new pod with the same labelSelector cannot be scheduled, + because computed skew will be 3(3 - 0) if new Pod is scheduled to any of the three zones, + it will violate MaxSkew. + + + This is a beta field and requires the MinDomainsInPodTopologySpread feature gate to be enabled (enabled by default). + format: int32 + type: integer + nodeAffinityPolicy: + description: |- + NodeAffinityPolicy indicates how we will treat Pod's nodeAffinity/nodeSelector + when calculating pod topology spread skew. Options are: + - Honor: only nodes matching nodeAffinity/nodeSelector are included in the calculations. + - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations. + + + If this value is nil, the behavior is equivalent to the Honor policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + nodeTaintsPolicy: + description: |- + NodeTaintsPolicy indicates how we will treat node taints when calculating + pod topology spread skew. Options are: + - Honor: nodes without taints, along with tainted nodes for which the incoming pod + has a toleration, are included. + - Ignore: node taints are ignored. All nodes are included. + + + If this value is nil, the behavior is equivalent to the Ignore policy. + This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag. + type: string + topologyKey: + description: |- + TopologyKey is the key of node labels. Nodes that have a label with this key + and identical values are considered to be in the same topology. + We consider each as a "bucket", and try to put balanced number + of pods into each bucket. + We define a domain as a particular instance of a topology. + Also, we define an eligible domain as a domain whose nodes meet the requirements of + nodeAffinityPolicy and nodeTaintsPolicy. + e.g. If TopologyKey is "kubernetes.io/hostname", each Node is a domain of that topology. + And, if TopologyKey is "topology.kubernetes.io/zone", each zone is a domain of that topology. + It's a required field. + type: string + whenUnsatisfiable: + description: |- + WhenUnsatisfiable indicates how to deal with a pod if it doesn't satisfy + the spread constraint. + - DoNotSchedule (default) tells the scheduler not to schedule it. + - ScheduleAnyway tells the scheduler to schedule the pod in any location, + but giving higher precedence to topologies that would help reduce the + skew. + A constraint is considered "Unsatisfiable" for an incoming pod + if and only if every possible node assignment for that pod would violate + "MaxSkew" on some topology. + For example, in a 3-zone cluster, MaxSkew is set to 1, and pods with the same + labelSelector spread as 3/1/1: + | zone1 | zone2 | zone3 | + | P P P | P | P | + If WhenUnsatisfiable is set to DoNotSchedule, incoming pod can only be scheduled + to zone2(zone3) to become 3/2/1(3/1/2) as ActualSkew(2-1) on zone2(zone3) satisfies + MaxSkew(1). In other words, the cluster can still be imbalanced, but scheduler + won't make it *more* imbalanced. + It's a required field. + type: string + required: + - maxSkew + - topologyKey + - whenUnsatisfiable + type: object + type: array + type: object + replicas: + description: |- + replicas is the desired number of replicas. + A change to this setting will roll the cluster. + format: int32 + type: integer + storageClass: + description: |- + storageClass specifies the user-provided storage class. If not + configured, the default storage class is used. + properties: + name: + description: name is the storage class name. + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - name + type: object + tls: + description: tls specifies the TLS configuration. + properties: + autoGeneratedCerts: + description: |- + autoGeneratedCerts specifies that the certificates are auto-generated based on + the CA key pair provided. + type: boolean + directoryPathInContainer: + description: |- + directoryPathInContainer specifies the directory path in the container where + `keystore.jks`, `truststore.jks`, and `jksPassword.txt` keys are mounted. + `truststore.jks` is not configured and can be ignored when the `ignoreTrustStoreConfig` field is set to `true`. + minLength: 1 + type: string + fips: + description: |- + fips specifies the configuration of FIPS compliant Bouncy Castle type Java Keystores for the cp component's + TLS settings. TLS Secrets must have the keys keystore.bcfks, truststore.bcfks, and jksPassword.txt + properties: + enabled: + description: enabled specifies whether to enable the FIPS + configuration for cp components. + type: boolean + required: + - enabled + type: object + ignoreTrustStoreConfig: + description: |- + ignoreTrustStoreConfig indicates whether to ignore the truststore configuration + for the Confluent component. + type: boolean + jksPassword: + description: jksPassword references the secret containing the + JKS password. + properties: + secretRef: + description: |- + secretRef references the name of the secret containing the JKS password. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + required: + - secretRef + type: object + secretRef: + description: |- + secretRef references the secret containing the certificates. + More info: https://docs.confluent.io/operator/current/co-network-encryption.html#configure-user-provided-tls-certificates + maxLength: 30 + minLength: 1 + pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ + type: string + type: object + required: + - dataVolumeCapacity + - image + - logVolumeCapacity + type: object + status: + description: status defines the observed state of the Zookeeper cluster. + properties: + arbitraryData: + description: arbitraryData is the map for any arbitrary data associated + with this Confluent component. + x-kubernetes-preserve-unknown-fields: true + authorizationType: + description: authorizationType is the authorization type for this + Confluent component. + type: string + clusterName: + description: clusterName is the name of the Confluent Platform component + cluster. + type: string + clusterNamespace: + description: clusterNamespace is the namespace where the Confluent + Platform component cluster is running. + type: string + conditions: + description: conditions specify the latest available observations + of the current state. + items: + description: Condition represent the latest available observations + of the current state. + properties: + lastProbeTime: + description: lastProbeTime shows the last time the condition + was evaluated. + format: date-time + type: string + lastTransitionTime: + description: lastTransitionTime shows the last time the condition + was transitioned from one status to another. + format: date-time + type: string + message: + description: message shows a human-readable message with details + about the transition. + type: string + reason: + description: reason shows the reason for the last transition + of the condition. + type: string + status: + description: status shows the status of the condition, one of + `True`, `False`, or `Unknown`. + type: string + type: + description: type shows the condition type. + type: string + type: object + type: array + currentReplicas: + description: currentReplicas is the number of currently running replicas. + format: int32 + type: integer + internalSecrets: + description: |- + internalSecrets are internal secrets created + by CFK for this Confluent component. + items: + type: string + type: array + internalTopicNames: + description: internalTopicNames are the topics used by the component + for internal use. + items: + type: string + type: array + myIdOffset: + description: myIdOffset shows the MyId offset configuration. + format: int32 + type: integer + observedGeneration: + description: observedGeneration is the most recent generation observed + for this Confluent component. + format: int64 + type: integer + operatorVersion: + description: operatorVersion is the internal version of CFK. + type: string + phase: + description: |- + phase describes the state of the Confluent Platform component. This can either be 'PROVISIONING' + or 'RUNNING' + 'PROVISIONING' means the Confluent Platform component is currently getting deployed and not ready yet. + 'RUNNING' means the Confluent Platform component has been successfully deployed. + type: string + readyReplicas: + description: readyReplicas is the number of currently ready replicas. + format: int32 + type: integer + replicas: + description: replicas is the number of replicas. + format: int32 + type: integer + restConfig: + description: restConfig is the REST API configuration of the Zookeeper + cluster. + properties: + advertisedExternalEndpoints: + description: advertisedExternalEndpoints specifies other advertised + endpoints used, especially for Kafka. + items: + type: string + type: array + authenticationType: + description: authenticationType shows the authentication type + configured by the listener. + type: string + externalAccessType: + description: externalAccessType shows the external access type + used for the listener. + type: string + externalEndpoint: + description: externalEndpoint specifies the external endpoint + to connect to the Confluent component cluster. + type: string + internalEndpoint: + description: internalEndpoint specifies the internal endpoint + to connect to the Confluent component cluster. + type: string + tls: + description: tls shows whether TLS is configured for the listener. + type: boolean + type: object + selector: + description: |- + selector gets the label selector of the child pod. + The Horizontal Pod Autoscaler(HPA) will scale using the label selector of the child pod. + type: string + type: object + required: + - spec + type: object + served: true + storage: true + subresources: + scale: + specReplicasPath: .spec.replicas + statusReplicasPath: .status.replicas + status: {} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/NOTES.txt b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/NOTES.txt new file mode 100644 index 000000000..13dc5b3bc --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/NOTES.txt @@ -0,0 +1,4 @@ + The Confluent Operator + +The Confluent Operator brings the component (Confluent Services) specific controllers for kubernetes by providing components specific Custom Resource +Definition (CRD) as well as managing other Confluent Platform services diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/_helpers.tpl b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/_helpers.tpl new file mode 100644 index 000000000..2815a8374 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/_helpers.tpl @@ -0,0 +1,42 @@ +{{/* vim: set filetype=mustache: */}} +{{/* +Expand the name of the chart. +*/}} +{{- define "confluent-operator.name" -}} +{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "confluent-operator.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .Chart.Name .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Create the name of the service account to use +*/}} +{{- define "confluent-operator.service-account" -}} +{{- if .Values.serviceAccount.create -}} + {{ default (include "confluent-operator.name" .) .Values.serviceAccount.name }} +{{- else -}} + {{ default "default" .Values.serviceAccount.name }} +{{- end -}} +{{- end -}} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "confluent-operator.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/clusterrole.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/clusterrole.yaml new file mode 100644 index 000000000..c689bfb5d --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/clusterrole.yaml @@ -0,0 +1,172 @@ +{{- if .Values.rbac }} +{{- $clusterRole := or (not .Values.namespaced) (.Values.kRaftEnabled) (gt (len .Values.namespaceList) 0)}} +apiVersion: rbac.authorization.k8s.io/v1 +{{- if not $clusterRole }} +kind: Role +{{- else }} +kind: ClusterRole +{{- end }} +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + name: {{ .Values.name }} + {{- if not $clusterRole }} + namespace: {{ .Release.Namespace }} + {{- end }} +rules: +- apiGroups: + - platform.confluent.io + resources: + - '*' + verbs: + - '*' +- apiGroups: + - policy + resources: + - poddisruptionbudgets + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +{{- if .Values.clusterRole.openshift }} +- apiGroups: + - route.openshift.io + resources: + - routes + - routes/custom-host + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +{{- end }} +- apiGroups: + - apps + resources: + - statefulsets + - statefulsets/scale + - statefulsets/status + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - apps + resources: + - deployments + verbs: + - get +- apiGroups: + - "" + resources: + - configmaps + - persistentvolumeclaims + - persistentvolumes + - secrets + - secrets/finalizers + - pods + - services + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +{{- if gt (int (.Values.replicas)) 1 }} +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - get + - update +{{- end }} +- apiGroups: + - "" + resources: + - events + verbs: + - create + - patch +- apiGroups: + - networking.k8s.io + resources: + - ingresses + - ingresses/status + verbs: + - get + - list + - watch + - create + - update + - patch + - delete +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get +{{- if $clusterRole }} + - list + - watch +{{- end }} +{{- if .Values.webhooks.enabled }} +# Webhook configurations are cluster scoped +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + name: {{ .Values.name }}-webhook-{{ .Release.Namespace }} +rules: + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - get + - update + - apiGroups: + - "" + resources: + - persistentvolumes + verbs: + - get + - list + - watch + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch +{{- end }} +{{- end }} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/clusterrolebinding.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/clusterrolebinding.yaml new file mode 100644 index 000000000..58aa9d043 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/clusterrolebinding.yaml @@ -0,0 +1,56 @@ +{{- if .Values.rbac }} +{{- $clusterRoleBinding := or (not .Values.namespaced) (.Values.kRaftEnabled) (gt (len .Values.namespaceList) 0)}} +{{- if not $clusterRoleBinding }} +kind: RoleBinding +{{- else }} +kind: ClusterRoleBinding +{{- end }} +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + name: {{ .Values.name }} + {{- if not $clusterRoleBinding }} + namespace: {{ .Release.Namespace }} + {{- end }} +subjects: +- kind: ServiceAccount + name: {{ template "confluent-operator.service-account" . }} + namespace: {{ .Release.Namespace }} +roleRef: + {{- if not $clusterRoleBinding }} + kind: Role + {{- else }} + kind: ClusterRole + {{- end }} + name: {{ .Values.name }} + apiGroup: rbac.authorization.k8s.io +# Webhook configurations are cluster scoped +{{- if and (.Values.webhooks.enabled) }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + name: {{ .Values.name }}-webhook-{{ .Release.Namespace }} +subjects: + - kind: ServiceAccount + name: {{ template "confluent-operator.service-account" . }} + namespace: {{ .Release.Namespace }} +roleRef: + kind: ClusterRole + name: {{ .Values.name }}-webhook-{{ .Release.Namespace }} + apiGroup: rbac.authorization.k8s.io + {{- end }} +{{- end }} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/deployment.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/deployment.yaml new file mode 100644 index 000000000..86a64d866 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/deployment.yaml @@ -0,0 +1,238 @@ +{{- $_ := required "Namespace is required" .Release.Namespace }} +{{- $_ := required "Name of operator is required." .Values.name }} +apiVersion: apps/v1 +kind: Deployment +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + version: {{ .Values.image.tag }} + name: {{ .Values.name }} + namespace: {{ .Release.Namespace }} +spec: + replicas: {{ .Values.replicas }} + selector: + matchLabels: + app.kubernetes.io/name: "confluent-operator" + app.kubernetes.io/instance: {{ .Release.Name }} + strategy: + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + type: RollingUpdate + template: + metadata: + annotations: + {{- range $key, $value := .Values.pod.annotations }} + {{ $key }}: {{ $value | quote }} + {{- end }} + labels: + app: "confluent-operator" + app.kubernetes.io/name: "confluent-operator" + app.kubernetes.io/instance: {{ .Release.Name }} + confluent-platform: "true" + version: {{ .Values.image.tag }} + {{- range $key, $value := .Values.pod.labels }} + {{ $key }}: {{ $value | quote }} + {{- end }} + spec: + {{- if not (empty $.Values.affinity) }} + affinity: +{{ toYaml .Values.affinity | trim | indent 8 }} + {{- end }} + {{- if not (empty $.Values.tolerations) }} + tolerations: +{{ toYaml .Values.tolerations | trim | indent 6 }} + {{- end }} + {{- if .Values.podSecurity.enabled }} + securityContext: +{{ toYaml .Values.podSecurity.securityContext | indent 8 }} + {{- end }} + containers: + - args: + - --debug={{.Values.debug}} + - --fipsmode={{.Values.fipsmode}} + - --kraftClusterIdRecovery={{.Values.kRaftEnabled}} + {{- if gt (int (.Values.replicas)) 1 }} + - --enable-leader-election + {{- end }} + {{- if .Values.namespaced }} + {{- if empty .Values.namespaceList }} + - --namespaces={{ .Release.Namespace }} + {{- else}} + {{- $ns := "" }} + {{- range $i, $v := .Values.namespaceList }} + {{- $ns = printf "%s,%s" $ns (trim $v) }} + {{- end }} + - --namespaces={{ substr 1 (len $ns) $ns }} + {{- end }} + {{- end }} + name: {{ .Values.name }} + image: {{ .Values.image.registry }}/{{ .Values.image.repository }}:{{.Values.image.tag }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + terminationMessagePath: /dev/termination-log + terminationMessagePolicy: File + readinessProbe: + httpGet: + port: 8080 + path: /readyz + livenessProbe: + httpGet: + port: 8080 + path: /healthz + resources: +{{ toYaml .Values.resources | trim | indent 10 }} + env: + - name: NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + - name: NODEIP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: DD_ENTITY_ID + valueFrom: + fieldRef: + fieldPath: metadata.uid + - name: DEPLOYMENT_NAME + value: {{ .Values.name }} + - name: CONFLUENT_SERVICE_ACCOUNT_NAME + value: {{ template "confluent-operator.service-account" . }} + {{- if .Values.numDay2Worker }} + - name: DEFAULT_DAY2_WORKER + value: "{{ .Values.numDay2Worker }}" + {{- end }} + {{- if .Values.managedCerts.enabled }} + {{- if and (empty .Values.managedCerts.caCertificate.secretRef) (empty .Values.managedCerts.caCertificate.directoryPathInContainer) }} + {{- $_ := required "secretRef or directoryPathInContainer must be configured when managedCerts is enabled" .Values.managedCerts.secretRef }} + {{- end }} + {{- if ge (.Values.managedCerts.renewBeforeInDays) (.Values.managedCerts.certDurationInDays) }} + {{- $_ := required "managedCerts.certDurationInDays for managed certs should be greater than managedCerts.renewBeforeInDays" "" }} + {{- end }} + {{- if .Values.managedCerts.certDurationInDays }} + - name: CONFLUENT_MANAGED_CERTS_DURATION_DAYS + value: "{{ .Values.managedCerts.certDurationInDays }}" + {{- end }} + {{- if .Values.managedCerts.renewBeforeInDays }} + - name: CONFLUENT_MANAGED_CERTS_RENEW_BEFORE_DAYS + value: "{{ .Values.managedCerts.renewBeforeInDays }}" + {{- end }} + {{- if .Values.managedCerts.sans }} + {{- if not (regexMatch "[ -~]" .Values.managedCerts.sans) }} + {{- $_ := required "invalid characters in managedCerts.sans. Only first 128 ASCII characters are allowed" "" }} + {{- end }} + - name: CONFLUENT_MANAGED_CERTS_SANS + value: "{{ .Values.managedCerts.sans }}" + {{- end }} + {{- if .Values.managedCerts.caCertificate.secretRef }} + - name: CONFLUENT_MANAGED_CERTS_SECRET_NAME + value: {{ .Values.managedCerts.caCertificate.secretRef }} + {{- end }} + {{- if .Values.managedCerts.caCertificate.directoryPathInContainer }} + - name: CONFLUENT_MANAGED_CERTS_DIRECTORY_PATH + value: {{ .Values.managedCerts.caCertificate.directoryPathInContainer }} + {{- end }} + {{- end }} + {{- if .Values.licenseSecretRef }} + - name: CONFLUENT_LICENSE_SECRET_NAME + value: {{ .Values.licenseSecretRef }} + {{- else if .Values.license.secretRef }} + - name: CONFLUENT_LICENSE_SECRET_NAME + value: {{ .Values.license.secretRef }} + {{- end }} + {{- if .Values.license.directoryPathInContainer }} + - name: CONFLUENT_LICENSE_DIRECTORY_PATH + value: {{ .Values.license.directoryPathInContainer }} + {{- end }} + {{- if or (.Values.telemetry.enabled) (.Values.telemetry.operator.enabled) }} + {{- if and (empty .Values.telemetry.secretRef) (empty .Values.telemetry.directoryPathInContainer) }} + {{- $_ := required "secretRef or directoryPathInContainer must be configured when telemetry is enabled" .Values.telemetry.secretRef }} + {{- end }} + - name: CP_TELEMETRY_ENABLED + value: {{ quote .Values.telemetry.enabled }} + - name: OPERATOR_TELEMETRY_ENABLED + value: {{ quote .Values.telemetry.operator.enabled }} + {{- if .Values.telemetry.secretRef }} + - name: CONFLUENT_TELEMETRY_SECRET_NAME + value: {{ .Values.telemetry.secretRef }} + {{- end }} + {{- if .Values.telemetry.directoryPathInContainer }} + - name: CONFLUENT_TELEMETRY_DIRECTORY_PATH + value: {{ .Values.telemetry.directoryPathInContainer }} + {{- end }} + {{- if .Values.telemetry.proxy.enabled }} + - name: CONFLUENT_TELEMETRY_PROXY_ENABLED + value: "true" + {{- end }} + {{- if .Values.telemetry.proxy.credentialRequired }} + - name: CONFLUENT_TELEMETRY_PROXY_CREDENTIAL_REQUIRED + value: "true" + {{- end }} + {{- end }} + {{- if .Values.webhooks.enabled }} + {{- if and (empty .Values.webhooks.tls.secretRef) (empty .Values.webhooks.tls.directoryPathInContainer) }} + {{- $_ := required "secretRef or directoryPathInContainer must be configured when webhooks are enabled" .Values.webhooks.tls.secretRef }} + {{- end }} + {{- if .Values.webhooks.tls.secretRef }} + - name: CONFLUENT_WEBHOOKS_SECRET_NAME + value: {{ .Values.webhooks.tls.secretRef }} + {{- end }} + {{- if .Values.webhooks.tls.directoryPathInContainer }} + - name: CONFLUENT_WEBHOOKS_DIRECTORY_PATH + value: {{ .Values.webhooks.tls.directoryPathInContainer }} + {{- end }} + - name: CONFLUENT_WEBHOOKS_PORT + value: {{ quote .Values.webhooks.port }} + {{- end }} + {{- if .Values.containerSecurity.enabled }} + securityContext: +{{ toYaml .Values.containerSecurity.securityContext | indent 10 }} + {{- end }} + {{- if or (not (empty .Values.mountedVolumes.volumeMounts)) (and (.Values.webhooks.enabled) (.Values.webhooks.tls.secretRef)) }} + volumeMounts: + {{- end }} + {{- if not (empty .Values.mountedVolumes.volumeMounts) }} + {{- range .Values.mountedVolumes.volumeMounts }} + {{- if and ($.Values.webhooks.enabled) (or (eq .mountPath "/mnt/sslcerts/webhook") (eq .name "webhook-certs")) }} + {{- $_ := fail "mount path \"/mnt/sslcerts/webhook\" and name \"webhook-certs\" are reserved for webhooks" }} + {{- end }} + - {{ toYaml . | indent 12 | trim }} + {{- end }} + {{- end }} + {{- if and (.Values.webhooks.enabled) (.Values.webhooks.tls.secretRef) }} + - mountPath: /mnt/sslcerts/webhook + name: webhook-certs + readOnly: true + {{- end }} + {{- if or (not (empty .Values.mountedVolumes.volumes)) (and (.Values.webhooks.enabled) (.Values.webhooks.tls.secretRef)) }} + volumes: + {{- end }} + {{- if not (empty .Values.mountedVolumes.volumes ) }} + {{- range .Values.mountedVolumes.volumes }} + {{- if and ($.Values.webhooks.enabled) (eq .name "webhook-certs") }} + {{- $_ := fail "name \"webhook-certs\" is reserved for webhooks" }} + {{- end }} + - {{ toYaml . | indent 10 | trim }} + {{- end }} + {{- end }} + {{- if and (.Values.webhooks.enabled) (.Values.webhooks.tls.secretRef) }} + - name: webhook-certs + secret: + defaultMode: 420 + secretName: {{ .Values.webhooks.tls.secretRef }} + {{- end }} + {{- if and .Values.imagePullSecretRef (not .Values.serviceAccount.create) }} + imagePullSecrets: + - name: {{ .Values.imagePullSecretRef }} + {{- end }} + serviceAccountName: {{ template "confluent-operator.service-account" . }} + {{- if .Values.priorityClassName }} + priorityClassName: {{ .Values.priorityClassName | quote }} + {{- end }} + restartPolicy: Always + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/licensing.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/licensing.yaml new file mode 100644 index 000000000..a8ab26bcd --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/licensing.yaml @@ -0,0 +1,19 @@ +{{- if not .Values.licenseSecretRef }} +apiVersion: v1 +kind: Secret +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + namespace: {{ .Release.Namespace }} + name: confluent-operator-licensing +type: Opaque +data: + {{- if .Values.licenseKey }} + license.txt: {{ .Values.licenseKey | b64enc }} + {{- end }} +{{- end }} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/service.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/service.yaml new file mode 100644 index 000000000..2f9ecbc98 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/service.yaml @@ -0,0 +1,28 @@ +apiVersion: v1 +kind: Service +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + name: confluent-operator + namespace: {{ .Release.Namespace }} +spec: + ports: + - name: http-metric + port: 7778 + protocol: TCP + targetPort: 7778 + {{- if (.Values.webhooks.enabled) }} + - name: webhook + port: {{ .Values.webhooks.port }} + protocol: TCP + targetPort: {{ .Values.webhooks.port }} + {{- end }} + selector: + app: "confluent-operator" + app.kubernetes.io/name: "confluent-operator" + type: ClusterIP diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/serviceaccount.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/serviceaccount.yaml new file mode 100644 index 000000000..9ed5b692d --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/serviceaccount.yaml @@ -0,0 +1,18 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +{{- if .Values.imagePullSecretRef }} +imagePullSecrets: +- name: {{ .Values.imagePullSecretRef }} +{{- end }} +kind: ServiceAccount +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + name: {{ template "confluent-operator.service-account" . }} + namespace: {{ .Release.Namespace }} +{{- end }} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/validatingwebhookconfiguration.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/validatingwebhookconfiguration.yaml new file mode 100644 index 000000000..e7235f9fd --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/templates/validatingwebhookconfiguration.yaml @@ -0,0 +1,184 @@ +{{- if (.Values.webhooks.enabled) }} +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + labels: + app: {{ include "confluent-operator.name" . }} + app.kubernetes.io/name: {{ include "confluent-operator.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + app.kubernetes.io/component: "confluent-operator" + helm.sh/chart: {{ include "confluent-operator.chart" . }} + name: confluent-operator-{{ .Release.Namespace }}.webhook.platform.confluent.io +webhooks: +- admissionReviewVersions: + - v1beta1 + clientConfig: + service: + name: confluent-operator + namespace: {{ .Release.Namespace }} + path: /confluent-operator/validate + port: {{ .Values.webhooks.port }} + failurePolicy: Fail + name: cfk-resources.webhooks.platform.confluent.io + namespaceSelector: + matchExpressions: + - key: confluent-operator.webhooks.platform.confluent.io/disable + operator: NotIn + values: [ "true" ] + {{- if .Values.namespaced }} + - key: kubernetes.io/metadata.name + operator: In + values: + {{- if empty .Values.namespaceList }} + - {{ .Release.Namespace }} + {{- else }} + {{- range $i, $v := .Values.namespaceList }} + - {{ trim $v }} + {{- end }} + {{- end }} + {{- end }} + objectSelector: + matchExpressions: + - key: confluent-operator.webhooks.platform.confluent.io/disable + operator: NotIn + values: [ "true" ] + rules: + - apiGroups: + - platform.confluent.io + apiVersions: + - v1beta1 + operations: + - UPDATE + - DELETE + resources: + - zookeepers + - kafkas + - kraftcontrollers + - ksqldbs + - controlcenters + scope: Namespaced + sideEffects: None + timeoutSeconds: 10 +- admissionReviewVersions: + - v1beta1 + clientConfig: + service: + name: confluent-operator + namespace: {{ .Release.Namespace }} + path: /confluent-operator/validate + port: {{ .Values.webhooks.port }} + failurePolicy: Fail + name: core-resources.webhooks.platform.confluent.io + namespaceSelector: + matchExpressions: + - key: confluent-operator.webhooks.platform.confluent.io/disable + operator: NotIn + values: [ "true" ] + {{- if .Values.namespaced }} + - key: kubernetes.io/metadata.name + operator: In + values: + {{- if empty .Values.namespaceList }} + - {{ .Release.Namespace }} + {{- else }} + {{- range $i, $v := .Values.namespaceList }} + - {{ trim $v }} + {{- end }} + {{- end }} + {{- end }} + objectSelector: + matchLabels: + confluent-platform: "true" + rules: + - apiGroups: + - apps + apiVersions: + - v1 + operations: + - DELETE + resources: + - statefulsets + scope: Namespaced + sideEffects: None + timeoutSeconds: 10 +- admissionReviewVersions: + - v1beta1 + clientConfig: + service: + name: confluent-operator + namespace: {{ .Release.Namespace }} + path: /confluent-operator/validate + port: {{ .Values.webhooks.port }} + failurePolicy: Fail + name: kafka-pods.webhooks.platform.confluent.io + namespaceSelector: + matchExpressions: + - key: confluent-operator.webhooks.platform.confluent.io/disable + operator: NotIn + values: [ "true" ] + {{- if .Values.namespaced }} + - key: kubernetes.io/metadata.name + operator: In + values: + {{- if empty .Values.namespaceList }} + - {{ .Release.Namespace }} + {{- else }} + {{- range $i, $v := .Values.namespaceList }} + - {{ trim $v }} + {{- end }} + {{- end }} + {{- end }} + objectSelector: + matchLabels: + confluent-platform: "true" + platform.confluent.io/type: kafka + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - DELETE + resources: + - pods + scope: Namespaced + sideEffects: None + timeoutSeconds: 30 +- admissionReviewVersions: + - v1beta1 + clientConfig: + service: + name: confluent-operator + namespace: {{ .Release.Namespace }} + path: /confluent-operator/validate + port: {{ .Values.webhooks.port }} + failurePolicy: Fail + name: evictions.webhooks.platform.confluent.io + namespaceSelector: + matchExpressions: + {{- if .Values.namespaced }} + - key: kubernetes.io/metadata.name + operator: In + values: + {{- if empty .Values.namespaceList }} + - {{ .Release.Namespace }} + {{- else }} + {{- range $i, $v := .Values.namespaceList }} + - {{ trim $v }} + {{- end }} + {{- end }} + {{- end }} + rules: + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + resources: + - pods/eviction + scope: Namespaced + sideEffects: None + timeoutSeconds: 30 +{{- end }} diff --git a/charts/confluent/confluent-for-kubernetes/0.1033.33/values.yaml b/charts/confluent/confluent-for-kubernetes/0.1033.33/values.yaml new file mode 100644 index 000000000..1186a9478 --- /dev/null +++ b/charts/confluent/confluent-for-kubernetes/0.1033.33/values.yaml @@ -0,0 +1,269 @@ +## Confluent operator name +## +name: confluent-operator +## +## license Key +## +licenseKey: "" +## +## Load license either from the secret or through directoryPath. +## This will take precedence over licenseKey field. +## +license: + ## + ## The license secret reference name is injected through + ## CONFLUENT_LICENSE_SECRET_NAME environment variable. + ## The expected key: license.txt. license.txt contains raw license data. + ## For backward compatibility, licenseSecretRef field takes precedence if configured. + secretRef: "" + ## The directoryPathInContainer value is injected through + ## CONFLUENT_LICENSE_DIRECTORY_PATH environment variable. + ## The expected key: license.txt. license.txt file must have value in pattern `license=`. + ## + ## This configuration takes precedence over license.secretRef or licenseSecretRef field. + ## + directoryPathInContainer: "" + +## +## AutoGenerated certificates configuration. +## We will continue using older model of reading CA from secret "ca-pair-sslcerts" unless +## managedCerts.enabled is set to true. +## +managedCerts: + ## + ## Denotes whether CFK managed certs are configured with helm values. If this is set to true + ## values below will be used for auto-generated certificates and will cause a cluster roll + ## first time after this is enabled. + ## + enabled: false + ## + ## CA certificate pair for AutoGenerated certificates in this CFK operator deployment. + ## + caCertificate: + ## + ## CA pair secret reference name is injected through + ## CONFLUENT_MANAGED_CERTS_SECRET_NAME environment variable. + ## The expected keys are tls.crt and tls.key for CA Certificate and CA Certificate Key + ## respectively. + ## + secretRef: "" + ## The directoryPathInContainer value for CA pair certificates are injected through + ## CONFLUENT_MANAGED_CERTS_DIRECTORY_PATH environment variable. + ## The expected files are tls.crt and tls.key for CA Certificate and CA Certificate Key + ## respectively. + ## + directoryPathInContainer: "" + ## + ## Validity for Auto-generated certificates is injected through + ## CONFLUENT_MANAGED_CERTS_DURATION_DAYS environment variable. + ## + certDurationInDays: 60 + ## + ## Renewal time for Auto-generated certificates is injected through + ## CONFLUENT_MANAGED_CERTS_RENEW_BEFORE_DAYS environment variable. + ## + renewBeforeInDays: 30 + ## + ## SANs to be added for all auto-generated certificates generated by this + ## CFK operator. This is injected through CONFLUENT_MANAGED_CERTS_SANS + ## environment variable. + ## Use this for adding wild card SANs. Modifying this will trigger regeneration of + ## certs for all CP clusters managed by the CFK operator. + ## + sans: "" + +### +## Image pull secret +imagePullSecretRef: confluent-registry +## Confluent Operator Image Information +## +image: + registry: docker.io + repository: confluentinc/confluent-operator + pullPolicy: IfNotPresent + tag: "0.1033.33" + +### +## Priority class for Confluent Operator pod +priorityClassName: "" +## Number of pods for Operator +## Enables leader election if more than one replica +replicas: 1 +## Confluent Operator Cluster Access +## If true, operator only creates roles/rolebinding for the release namespace +## Otherwise, it has cluster access with clusterrole/clusterrrolebinding +namespaced: true +### list of namespaces to watch by operator +### This field only takes in effect if `namespaced=true`. By default, it will only watch the release namespace +### Otherwise, it will watch specified namespaces. If watching only release namespace, do not specify this field +namespaceList: [] +## Confluent Operator Pod Resources +## +resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 256Mi +## Pod termination grace-period +## +terminationGracePeriodSeconds: 30 +## Enable debugging +## +debug: false +## Enable Fips Mode +## +fipsmode: false +## Set number of day2 workers +## +numDay2Worker: "" +## +## Configure affinity, +## More information here https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ +## +affinity: {} +## Example for nodeAffinity, configure as required. +##affinity: +## nodeAffinity: +## requiredDuringSchedulingIgnoredDuringExecution: +## nodeSelectorTerms: +## - matchExpressions: +## - key: "node-role.kubernetes.io/compute" +## operator: In +## values: +## - "true" + +## +## Configure tolerations +## https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/ +## +tolerations: [] +## +##tolerations: +##- key: "dedicated" +## operator: "Equal" +## value: "operator" +## effect: "NoSchedule" + +## Pod Security Context +## +podSecurity: + enabled: true + securityContext: + fsGroup: 1001 + runAsUser: 1001 + runAsNonRoot: true + +## Container Security Context +## Container security context overrides security context defined at pod level. +## For example following container security context would override the +## default PodSecurityContext defined above +## +## securityContext: +## runAsUser: 2001 +## runAsNonRoot: false +## +## Refer to this documentation on how configure security context for container +## https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-containerh +## +containerSecurity: + enabled: false + securityContext: {} + +## +## ServiceAccount +## If enabled it will create, otherwise it will +## not create +## +serviceAccount: + create: true + name: "" +## Enable Kubernetes RBAC +## When set to true, it will create a proper role/rolebinding or cluster/clusterrolebinding based on namespaced field. +## If a user doesn't have permission to create role/rolebinding then they can disable rbac field and +## create required resources out of band to be used by the Operator. In this case, follow the +## templates/clusterrole.yaml and templates/clusterrolebiding.yaml to create proper required resources. +rbac: true + +## Enable extra Kubernetes API groups in role/clusterrole resource +## When set to true, it will add apiGroups to role/clusterrole for OpenShift route resource +clusterRole: + openshift: true + +### +### Confluent Telemetry Report configuration +## The secretRef contains following data, +## telemetry.txt: |- +## api.key= +## api.secret= +## proxy.url= # only required if proxy is enabled +## proxy.username= # only required if proxy requires credential +## proxy.password= +## +telemetry: + operator: + enabled: false + enabled: false + proxy: + enabled: false + credentialRequired: false + secretRef: "" + ## To use directoryPathInContainer, need to make sure + ## you mount telemetry.txt in the path you provided here in each pod + directoryPathInContainer: "" + +## In case of KRaft, we need to preserve the KRaft ClusterID in PV annotation +## for disaster recovery case. Enabling this ensures we create proper ClusterRoles +## to be able to set this annotation in PersistentVolumes. +kRaftEnabled: false + +### +### Webhooks configuration +## To enable webhooks, it requires TLS certificates to set up webhook server, +## which used for secure communication between webhook server and kubernetes api server. +## Please provide the TLS keys and certificates with format as mentioned in this doc: +## https://docs.confluent.io/operator/current/co-network-encryption.html#provide-tls-keys-and-certificates-in-pem-format. +## The certificate must have the Subject Alternative Name (SAN) of the form: confluent-operator..svc +webhooks: + enabled: false + port: 8443 + tls: + secretRef: "" + directoryPathInContainer: "" + +## +## Pod annotations/labels configurations +## +pod: + annotations: + prometheus.io/path: "/metrics" + prometheus.io/port: "7778" + prometheus.io/scrape: "true" + labels: {} +# labels: +# key: "value" + +## +## Load license from the secret reference +## +Deprecated, use license.secretRef instead. +## +licenseSecretRef: "" + +## +## Volumes to mount on CFK operator +## Refer to the Kubernetes volume/volumeMounts format: https://kubernetes.io/docs/concepts/storage/volumes/ +## +## Example with a PVC. +## mountedVolumes: +## volumes: +## - name: custom-volume +## persistentVolumeClaim: +## claimName: pvc-test +## volumeMounts: +## - name: custom-volume +## mountPath: /mnt/ +## +mountedVolumes: + volumes: [] + volumeMounts: [] diff --git a/charts/speedscale/speedscale-operator/2.2.419/.helmignore b/charts/speedscale/speedscale-operator/2.2.419/.helmignore new file mode 100644 index 000000000..0e8a0eb36 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/speedscale/speedscale-operator/2.2.419/Chart.yaml b/charts/speedscale/speedscale-operator/2.2.419/Chart.yaml new file mode 100644 index 000000000..41057f666 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/Chart.yaml @@ -0,0 +1,27 @@ +annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Speedscale Operator + catalog.cattle.io/kube-version: '>= 1.17.0-0' + catalog.cattle.io/release-name: speedscale-operator +apiVersion: v1 +appVersion: 2.2.419 +description: Stress test your APIs with real world scenarios. Collect and replay + traffic without scripting. +home: https://speedscale.com +icon: file://assets/icons/speedscale-operator.png +keywords: +- speedscale +- test +- testing +- regression +- reliability +- load +- replay +- network +- traffic +kubeVersion: '>= 1.17.0-0' +maintainers: +- email: support@speedscale.com + name: Speedscale Support +name: speedscale-operator +version: 2.2.419 diff --git a/charts/speedscale/speedscale-operator/2.2.419/LICENSE b/charts/speedscale/speedscale-operator/2.2.419/LICENSE new file mode 100644 index 000000000..b78723d62 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2021 Speedscale + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/charts/speedscale/speedscale-operator/2.2.419/README.md b/charts/speedscale/speedscale-operator/2.2.419/README.md new file mode 100644 index 000000000..6ca25eed9 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/README.md @@ -0,0 +1,111 @@ +![GitHub Tag](https://img.shields.io/github/v/tag/speedscale/operator-helm) + + +# Speedscale Operator + +The [Speedscale](https://www.speedscale.com) Operator is a [Kubernetes operator](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/) +that watches for deployments to be applied to the cluster and takes action based on annotations. The operator +can inject a proxy to capture traffic into or out of applications, or setup an isolation test environment around +a deployment for testing. The operator itself is a deployment that will be always present on the cluster once +the helm chart is installed. + +## Prerequisites + +- Kubernetes 1.20+ +- Helm 3+ +- Appropriate [network and firewall configuration](https://docs.speedscale.com/reference/networking) for Speedscale cloud and webhook traffic + +## Get Repo Info + +```bash +helm repo add speedscale https://speedscale.github.io/operator-helm/ +helm repo update +``` + +_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._ + +## Install Chart + +An API key is required. Sign up for a [free Speedscale trial](https://speedscale.com/free-trial/) if you do not have one. + +```bash +helm install speedscale-operator speedscale/speedscale-operator \ + -n speedscale \ + --create-namespace \ + --set apiKey= \ + --set clusterName= +``` + +_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ + +### Pre-install job failure + +We use pre-install job to check provided API key and provision some of the required resources. + +If the job failed during the installation, you'll see the following error during install: + +``` +Error: INSTALLATION FAILED: failed pre-install: job failed: BackoffLimitExceeded +``` + +You can inspect the logs using this command: + +```bash +kubectl -n speedscale logs job/speedscale-operator-pre-install +``` + +After fixing the error, uninstall the helm release, delete the failed job +and try installing again: + +```bash +helm -n speedscale uninstall speedscale-operator +kubectl -n speedscale delete job speedscale-operator-pre-install +``` + +## Uninstall Chart + +```bash +helm -n speedscale uninstall speedscale-operator +``` + +This removes all the Kubernetes components associated with the chart and deletes the release. + +_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ + +CRDs created by this chart are not removed by default and should be manually cleaned up: + +```bash +kubectl delete crd trafficreplays.speedscale.com +``` + +## Upgrading Chart + +```bash +helm repo update +helm -n speedscale upgrade speedscale-operator speedscale/speedscale-operator +``` + +Resources capturing traffic will need to be rolled to pick up the latest +Speedscale sidecar. Use the rollout restart command for each namespace and +resource type: + +```bash +kubectl -n rollout restart deployment +``` + +With Helm v3, CRDs created by this chart are not updated by default +and should be manually updated. +Consult also the [Helm Documentation on CRDs](https://helm.sh/docs/chart_best_practices/custom_resource_definitions). + +_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ + +### Upgrading an existing Release to a new version + +A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an +incompatible breaking change needing manual actions. + + +## Help + +Speedscale docs information available at [docs.speedscale.com](https://docs.speedscale.com) or join us +on the [Speedscale community Slack](https://join.slack.com/t/speedscalecommunity/shared_invite/zt-x5rcrzn4-XHG1QqcHNXIM~4yozRrz8A)! diff --git a/charts/speedscale/speedscale-operator/2.2.419/app-readme.md b/charts/speedscale/speedscale-operator/2.2.419/app-readme.md new file mode 100644 index 000000000..6ca25eed9 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/app-readme.md @@ -0,0 +1,111 @@ +![GitHub Tag](https://img.shields.io/github/v/tag/speedscale/operator-helm) + + +# Speedscale Operator + +The [Speedscale](https://www.speedscale.com) Operator is a [Kubernetes operator](https://kubernetes.io/docs/concepts/extend-kubernetes/operator/) +that watches for deployments to be applied to the cluster and takes action based on annotations. The operator +can inject a proxy to capture traffic into or out of applications, or setup an isolation test environment around +a deployment for testing. The operator itself is a deployment that will be always present on the cluster once +the helm chart is installed. + +## Prerequisites + +- Kubernetes 1.20+ +- Helm 3+ +- Appropriate [network and firewall configuration](https://docs.speedscale.com/reference/networking) for Speedscale cloud and webhook traffic + +## Get Repo Info + +```bash +helm repo add speedscale https://speedscale.github.io/operator-helm/ +helm repo update +``` + +_See [helm repo](https://helm.sh/docs/helm/helm_repo/) for command documentation._ + +## Install Chart + +An API key is required. Sign up for a [free Speedscale trial](https://speedscale.com/free-trial/) if you do not have one. + +```bash +helm install speedscale-operator speedscale/speedscale-operator \ + -n speedscale \ + --create-namespace \ + --set apiKey= \ + --set clusterName= +``` + +_See [helm install](https://helm.sh/docs/helm/helm_install/) for command documentation._ + +### Pre-install job failure + +We use pre-install job to check provided API key and provision some of the required resources. + +If the job failed during the installation, you'll see the following error during install: + +``` +Error: INSTALLATION FAILED: failed pre-install: job failed: BackoffLimitExceeded +``` + +You can inspect the logs using this command: + +```bash +kubectl -n speedscale logs job/speedscale-operator-pre-install +``` + +After fixing the error, uninstall the helm release, delete the failed job +and try installing again: + +```bash +helm -n speedscale uninstall speedscale-operator +kubectl -n speedscale delete job speedscale-operator-pre-install +``` + +## Uninstall Chart + +```bash +helm -n speedscale uninstall speedscale-operator +``` + +This removes all the Kubernetes components associated with the chart and deletes the release. + +_See [helm uninstall](https://helm.sh/docs/helm/helm_uninstall/) for command documentation._ + +CRDs created by this chart are not removed by default and should be manually cleaned up: + +```bash +kubectl delete crd trafficreplays.speedscale.com +``` + +## Upgrading Chart + +```bash +helm repo update +helm -n speedscale upgrade speedscale-operator speedscale/speedscale-operator +``` + +Resources capturing traffic will need to be rolled to pick up the latest +Speedscale sidecar. Use the rollout restart command for each namespace and +resource type: + +```bash +kubectl -n rollout restart deployment +``` + +With Helm v3, CRDs created by this chart are not updated by default +and should be manually updated. +Consult also the [Helm Documentation on CRDs](https://helm.sh/docs/chart_best_practices/custom_resource_definitions). + +_See [helm upgrade](https://helm.sh/docs/helm/helm_upgrade/) for command documentation._ + +### Upgrading an existing Release to a new version + +A major chart version change (like v1.2.3 -> v2.0.0) indicates that there is an +incompatible breaking change needing manual actions. + + +## Help + +Speedscale docs information available at [docs.speedscale.com](https://docs.speedscale.com) or join us +on the [Speedscale community Slack](https://join.slack.com/t/speedscalecommunity/shared_invite/zt-x5rcrzn4-XHG1QqcHNXIM~4yozRrz8A)! diff --git a/charts/speedscale/speedscale-operator/2.2.419/questions.yaml b/charts/speedscale/speedscale-operator/2.2.419/questions.yaml new file mode 100644 index 000000000..29aee3895 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/questions.yaml @@ -0,0 +1,9 @@ +questions: +- variable: apiKey + default: "fffffffffffffffffffffffffffffffffffffffffffff" + description: "An API key is required to connect to the Speedscale cloud." + required: true + type: string + label: API Key + group: Authentication + diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/NOTES.txt b/charts/speedscale/speedscale-operator/2.2.419/templates/NOTES.txt new file mode 100644 index 000000000..cabb59b17 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/NOTES.txt @@ -0,0 +1,12 @@ +Thank you for installing the Speedscale Operator! + +Next you'll need to add the Speedscale Proxy Sidecar to your deployments. +See https://docs.speedscale.com/setup/sidecar/install/ + +If upgrading use the rollout restart command for each namespace and resource +type to ensure Speedscale sidecars are updated: + + kubectl -n rollout restart deployment + +Once your deployment is running the sidecar your service will show up on +https://app.speedscale.com/. diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/admission.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/admission.yaml new file mode 100644 index 000000000..301748a61 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/admission.yaml @@ -0,0 +1,209 @@ +{{- $cacrt := "" -}} +{{- $crt := "" -}} +{{- $key := "" -}} +{{- $s := (lookup "v1" "Secret" .Release.Namespace "speedscale-webhook-certs") -}} +{{- if $s -}} +{{- $cacrt = index $s.data "ca.crt" | default (index $s.data "tls.crt") | b64dec -}} +{{- $crt = index $s.data "tls.crt" | b64dec -}} +{{- $key = index $s.data "tls.key" | b64dec -}} +{{ else }} +{{- $altNames := list ( printf "speedscale-operator.%s" .Release.Namespace ) ( printf "speedscale-operator.%s.svc" .Release.Namespace ) -}} +{{- $ca := genCA "speedscale-operator" 3650 -}} +{{- $cert := genSignedCert "speedscale-operator" nil $altNames 3650 $ca -}} +{{- $cacrt = $ca.Cert -}} +{{- $crt = $cert.Cert -}} +{{- $key = $cert.Key -}} +{{- end -}} +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + creationTimestamp: null + name: speedscale-operator + annotations: + argocd.argoproj.io/hook: PreSync + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + caBundle: {{ $cacrt | b64enc }} + service: + name: speedscale-operator + namespace: {{ .Release.Namespace }} + path: /mutate + failurePolicy: Ignore + name: sidecar.speedscale.com + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: "NotIn" + values: + - kube-system + - kube-node-lease + {{- if .Values.namespaceSelector }} + - key: kubernetes.io/metadata.name + operator: "In" + values: + {{- range .Values.namespaceSelector }} + - {{ . | quote }} + {{- end }} + {{- end }} + reinvocationPolicy: IfNeeded + rules: + - apiGroups: + - apps + - batch + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + - DELETE + resources: + - deployments + - statefulsets + - daemonsets + - jobs + - replicasets + - apiGroups: + - "" + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + - DELETE + resources: + - pods + - apiGroups: + - argoproj.io + apiVersions: + - "*" + operations: + - CREATE + - UPDATE + - DELETE + resources: + - rollouts + sideEffects: None + timeoutSeconds: 10 +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: MutatingWebhookConfiguration +metadata: + creationTimestamp: null + name: speedscale-operator-replay + annotations: + argocd.argoproj.io/hook: PreSync + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + caBundle: {{ $cacrt | b64enc }} + service: + name: speedscale-operator + namespace: {{ .Release.Namespace }} + path: /mutate-speedscale-com-v1-trafficreplay + failurePolicy: Fail + name: replay.speedscale.com + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: "NotIn" + values: + - kube-system + - kube-node-lease + {{- if .Values.namespaceSelector }} + - key: kubernetes.io/metadata.name + operator: "In" + values: + {{- range .Values.namespaceSelector }} + - {{ . | quote }} + {{- end }} + {{- end }} + rules: + - apiGroups: + - speedscale.com + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + resources: + - trafficreplays + sideEffects: None + timeoutSeconds: 10 +--- +apiVersion: admissionregistration.k8s.io/v1 +kind: ValidatingWebhookConfiguration +metadata: + creationTimestamp: null + name: speedscale-operator-replay + annotations: + argocd.argoproj.io/hook: PreSync + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} +webhooks: +- admissionReviewVersions: + - v1 + clientConfig: + caBundle: {{ $cacrt | b64enc }} + service: + name: speedscale-operator + namespace: {{ .Release.Namespace }} + path: /validate-speedscale-com-v1-trafficreplay + failurePolicy: Fail + name: replay.speedscale.com + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: "NotIn" + values: + - kube-system + - kube-node-lease + {{- if .Values.namespaceSelector }} + - key: kubernetes.io/metadata.name + operator: "In" + values: + {{- range .Values.namespaceSelector }} + - {{ . | quote }} + {{- end }} + {{- end }} + rules: + - apiGroups: + - speedscale.com + apiVersions: + - v1 + operations: + - CREATE + - UPDATE + - DELETE + resources: + - trafficreplays + sideEffects: None + timeoutSeconds: 10 +--- +apiVersion: v1 +kind: Secret +metadata: + annotations: + helm.sh/hook: pre-install + helm.sh/hook-delete-policy: before-hook-creation + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} + creationTimestamp: null + name: speedscale-webhook-certs + namespace: {{ .Release.Namespace }} +type: kubernetes.io/tls +data: + ca.crt: {{ $cacrt | b64enc }} + tls.crt: {{ $crt | b64enc }} + tls.key: {{ $key | b64enc }} diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/configmap.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/configmap.yaml new file mode 100644 index 000000000..04dfda91a --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/configmap.yaml @@ -0,0 +1,43 @@ +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: speedscale-operator + namespace: {{ .Release.Namespace }} + annotations: + argocd.argoproj.io/hook: PreSync + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} +data: + CLUSTER_NAME: {{ .Values.clusterName }} + IMAGE_PULL_POLICY: {{ .Values.image.pullPolicy }} + IMAGE_PULL_SECRETS: "" + IMAGE_REGISTRY: {{ .Values.image.registry }} + IMAGE_TAG: {{ .Values.image.tag }} + INSTANCE_ID: '{{- $cm := (lookup "v1" "ConfigMap" .Release.Namespace "speedscale-operator") -}}{{ if $cm }}{{ $cm.data.INSTANCE_ID }}{{ else }}{{ ( printf "%s-%s" .Values.clusterName uuidv4 ) }}{{ end }}' + LOG_LEVEL: {{ .Values.logLevel }} + SPEEDSCALE_DLP_CONFIG: {{ .Values.dlp.config }} + SPEEDSCALE_FILTER_RULE: {{ .Values.filterRule }} + TELEMETRY_INTERVAL: 1s + WITH_DLP: {{ .Values.dlp.enabled | quote }} + WITH_INSPECTOR: {{ .Values.dashboardAccess | quote }} + API_KEY_SECRET_NAME: {{ .Values.apiKeySecret | quote }} + DEPLOY_DEMO: {{ .Values.deployDemo | quote }} + GLOBAL_ANNOTATIONS: {{ .Values.globalAnnotations | toJson | quote }} + GLOBAL_LABELS: {{ .Values.globalLabels | toJson | quote }} + {{- if .Values.http_proxy }} + HTTP_PROXY: {{ .Values.http_proxy }} + {{- end }} + {{- if .Values.https_proxy }} + HTTPS_PROXY: {{ .Values.https_proxy }} + {{- end }} + {{- if .Values.no_proxy }} + NO_PROXY: {{ .Values.no_proxy }} + {{- end }} + PRIVILEGED_SIDECARS: {{ .Values.privilegedSidecars | quote }} + DISABLE_SMARTDNS: {{ .Values.disableSidecarSmartReverseDNS | quote }} + SIDECAR_CONFIG: {{ .Values.sidecar | toJson | quote }} + FORWARDER_CONFIG: {{ .Values.forwarder | toJson | quote }} + TEST_PREP_TIMEOUT: {{ .Values.operator.test_prep_timeout }} + CONTROL_PLANE_TIMEOUT: {{ .Values.operator.control_plane_timeout }} diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/crds/trafficreplays.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/crds/trafficreplays.yaml new file mode 100644 index 000000000..1bee7e157 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/crds/trafficreplays.yaml @@ -0,0 +1,523 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.15.0 + creationTimestamp: null + name: trafficreplays.speedscale.com +spec: + group: speedscale.com + names: + kind: TrafficReplay + listKind: TrafficReplayList + plural: trafficreplays + shortNames: + - replay + singular: trafficreplay + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .status.active + name: Active + type: boolean + - jsonPath: .spec.mode + name: Mode + type: string + - jsonPath: .status.conditions[-1:].message + name: Status + type: string + - jsonPath: .metadata.creationTimestamp + name: Age + type: date + name: v1 + schema: + openAPIV3Schema: + description: TrafficReplay is the Schema for the trafficreplays API + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: TrafficReplaySpec defines the desired state of TrafficReplay + properties: + buildTag: + description: |- + BuildTag links a unique tag, build hash, etc. to the generated + traffic replay report. That way you can connect the report results to the + version of the code that was tested. + type: string + cleanup: + description: |- + Cleanup is the name of cleanup mode used for this + TrafficReplay. + enum: + - inventory + - all + - none + type: string + collectLogs: + description: |- + CollectLogs enables or disables log collection from target + workload. Defaults to true. + DEPRECATED: use TestReport.ActualConfig.Cluster.CollectLogs + type: boolean + configChecksum: + description: |- + ConfigChecksum, managed my the operator, is the SHA1 checksum of the + configuration. + type: string + customURL: + description: |- + CustomURL specifies a custom URL to send *ALL* traffic to. Use + Workload.CustomURI to send traffic to a specific URL for only that + workload. + type: string + generatorLowData: + description: |- + GeneratorLowData forces the generator into a high + efficiency/low data output mode. This is ideal for high volume + performance tests. Defaults to false. + DEPRECATED + type: boolean + mode: + description: Mode is the name of replay mode used for this TrafficReplay. + enum: + - full-replay + - responder-only + - generator-only + type: string + needsReport: + description: Indicates whether a responder-only replay needs a report. + type: boolean + proxyMode: + description: |- + ProxyMode defines proxy operational mode used with injected sidecar. + DEPRECATED + type: string + responderLowData: + description: |- + ResponderLowData forces the responder into a high + efficiency/low data output mode. This is ideal for high volume + performance tests. Defaults to false. + DEPRECATED + type: boolean + secretRefs: + description: |- + SecretRefs hold the references to the secrets which contain + various secrets like (e.g. short-lived JWTs to be used by the generator + for authorization with HTTP calls). + items: + description: |- + LocalObjectReference contains enough information to locate the referenced + Kubernetes resource object. + properties: + name: + description: Name of the referent. + type: string + required: + - name + type: object + type: array + sidecar: + description: |- + Sidecar defines sidecar specific configuration. + DEPRECATED: use Workloads + properties: + inject: + description: 'DEPRECATED: do not use' + type: boolean + patch: + description: Patch is .yaml file patch for the Workload + format: byte + type: string + tls: + properties: + in: + description: In provides configuration for sidecar inbound + TLS. + properties: + private: + description: Private is the filename of the TLS inbound + private key. + type: string + public: + description: Public is the filename of the TLS inbound + public key. + type: string + secret: + description: Secret is a secret with the TLS keys to use + for inbound traffic. + type: string + type: object + mutual: + description: Mutual provides configuration for sidecar mutual + TLS. + properties: + private: + description: Private is the filename of the mutual TLS + private key. + type: string + public: + description: Public is the filename of the mutual TLS + public key. + type: string + secret: + description: Secret is a secret with the mutual TLS keys. + type: string + type: object + out: + description: |- + Out enables or disables TLS out on the + sidecar during replay. + type: boolean + type: object + type: object + snapshotID: + description: |- + SnapshotID is the id of the traffic snapshot for this + TrafficReplay. + type: string + testConfigID: + description: |- + TestConfigID is the id of the replay configuration to be used + by the generator and responder for the TrafficReplay. + type: string + timeout: + description: |- + Timeout is the time to wait for replay test to finish. Defaults + to value of the `TIMEOUT` setting of the operator. + type: string + ttlAfterReady: + description: |- + TTLAfterReady provides a TTL (time to live) mechanism to limit + the lifetime of TrafficReplay object that have finished the execution and + reached its final state (either complete or failed). + type: string + workloadRef: + description: |- + WorkloadRef is the reference to the target workload (SUT) for + TrafficReplay. The operations will be performed in the namespace of the + target object. + DEPRECATED: use Workloads + properties: + apiVersion: + description: API version of the referenced object. + type: string + kind: + description: Kind of the referenced object. Defaults to "Deployment". + type: string + name: + description: |- + Name of the referenced object. Required when defining for a test unless a + custom URI is provided. Always required when defining mocks. + type: string + namespace: + description: Namespace of the referenced object. Defaults to the + TrafficReplay namespace. + type: string + required: + - name + type: object + workloads: + description: |- + Workloads define target workloads (SUT) for a TrafficReplay. Many + workloads may be provided, or none. Workloads may be modified and + restarted during replay to configure communication with a responder. + items: + description: |- + Workload represents a Kubernetes workload to be targeted during replay and + associated settings. + properties: + customURI: + description: |- + CustomURI will be target of the traffic instead of directly targeting + workload. This is required if a Ref is not specified. + type: string + inTrafficKey: + description: 'DEPRECATED: use Tests' + type: string + inTrafficKeys: + description: 'DEPRECATED: use Tests' + items: + type: string + type: array + mocks: + description: |- + Mocks are strings used to identify slices of outbound snapshot traffic to + mock for this workload and maps directly to a snapshot's `OutTraffic` + field. Snapshot egress traffic can be split across multiple slices where + each slice contains part of the traffic. A workload may specify multiple + keys and multiple workloads may specify the same key. + + + Only the traffic slices defined here will be mocked. A workload with no + keys defined will not mock any traffic. Pass '*' to mock all traffic. + + + Mock strings may only match part of the snapshot's `OutTraffic` key if the + string matches exactly one key. For example, the test string + `foo.example.com` would match the `OutTraffic` key of + my-service:foo.example.com:8080, as long as no other keys would match + `foo.example.com`. Multiple mocks must be specified for multiple keys + unless using '*'. + items: + type: string + type: array + outTrafficKeys: + description: 'DEPRECATED: use Mocks' + items: + type: string + type: array + ref: + description: |- + Ref is a reference to a cluster workload, like a deployment or a + statefulset. This is required unless a CustomURI is specified. + properties: + apiVersion: + description: API version of the referenced object. + type: string + kind: + description: Kind of the referenced object. Defaults to + "Deployment". + type: string + name: + description: |- + Name of the referenced object. Required when defining for a test unless a + custom URI is provided. Always required when defining mocks. + type: string + namespace: + description: Namespace of the referenced object. Defaults + to the TrafficReplay namespace. + type: string + required: + - name + type: object + routing: + description: Routing configures how workloads route egress traffic + to responders + enum: + - hostalias + - nat + type: string + sidecar: + description: |- + TODO: this is not implemented, come back and replace deprecated Sidecar with workload specific settings + Sidecar defines sidecar specific configuration. + properties: + inject: + description: 'DEPRECATED: do not use' + type: boolean + patch: + description: Patch is .yaml file patch for the Workload + format: byte + type: string + tls: + properties: + in: + description: In provides configuration for sidecar inbound + TLS. + properties: + private: + description: Private is the filename of the TLS + inbound private key. + type: string + public: + description: Public is the filename of the TLS inbound + public key. + type: string + secret: + description: Secret is a secret with the TLS keys + to use for inbound traffic. + type: string + type: object + mutual: + description: Mutual provides configuration for sidecar + mutual TLS. + properties: + private: + description: Private is the filename of the mutual + TLS private key. + type: string + public: + description: Public is the filename of the mutual + TLS public key. + type: string + secret: + description: Secret is a secret with the mutual + TLS keys. + type: string + type: object + out: + description: |- + Out enables or disables TLS out on the + sidecar during replay. + type: boolean + type: object + type: object + tests: + description: |- + Tests are strings used to identify slices of inbound snapshot traffic this + workload is targeting and maps directly to a snapshot's `InTraffic` field. + Snapshot ingress traffic can be split across multiple slices where each + slice contains part of the traffic. A key must only be specified once + across all workloads, but a workload may specify multiple keys. Pass '*' + to match all keys. + + + Test strings may only match part of the snapshot's `InTraffic` key if the + string matches exactly one key. For example, the test string + `foo.example.com` would match the `InTraffic` key of + my-service:foo.example.com:8080, as long as no other keys would match + `foo.example.com` + + + This field is optional in the spec to provide support for single-workload + and legacy replays, but must be specified for multi-workload replays in + order to provide deterministic replay configuration. + items: + type: string + type: array + type: object + type: array + required: + - snapshotID + - testConfigID + type: object + status: + default: + observedGeneration: -1 + description: TrafficReplayStatus defines the observed state of TrafficReplay + properties: + active: + description: Active indicates whether this traffic replay is currently + underway or not. + type: boolean + conditions: + items: + description: "Condition contains details for one aspect of the current + state of this API Resource.\n---\nThis struct is intended for + direct use as an array at the field path .status.conditions. For + example,\n\n\n\ttype FooStatus struct{\n\t // Represents the + observations of a foo's current state.\n\t // Known .status.conditions.type + are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // + +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t + \ // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" + patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t + \ // other fields\n\t}" + properties: + lastTransitionTime: + description: |- + lastTransitionTime is the last time the condition transitioned from one status to another. + This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + format: date-time + type: string + message: + description: |- + message is a human readable message indicating details about the transition. + This may be an empty string. + maxLength: 32768 + type: string + observedGeneration: + description: |- + observedGeneration represents the .metadata.generation that the condition was set based upon. + For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date + with respect to the current state of the instance. + format: int64 + minimum: 0 + type: integer + reason: + description: |- + reason contains a programmatic identifier indicating the reason for the condition's last transition. + Producers of specific condition types may define expected values and meanings for this field, + and whether the values are considered a guaranteed API. + The value should be a CamelCase string. + This field may not be empty. + maxLength: 1024 + minLength: 1 + pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ + type: string + status: + description: status of the condition, one of True, False, Unknown. + enum: + - "True" + - "False" + - Unknown + type: string + type: + description: |- + type of condition in CamelCase or in foo.example.com/CamelCase. + --- + Many .condition.type values are consistent across resources like Available, but because arbitrary conditions can be + useful (see .node.status.conditions), the ability to deconflict is important. + The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt) + maxLength: 316 + pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ + type: string + required: + - lastTransitionTime + - message + - reason + - status + - type + type: object + type: array + finishedTime: + description: Information when the traffic replay has finished. + format: date-time + type: string + initializedTime: + description: Information when the test environment was successfully + prepared. + format: date-time + type: string + lastHeartbeatTime: + description: 'DEPRECATED: will not be set' + format: date-time + type: string + observedGeneration: + description: ObservedGeneration is the last observed generation. + format: int64 + type: integer + reconcileFailures: + description: |- + ReconcileFailures is the number of times the traffic replay controller + experienced an error during the reconciliation process. The traffic + replay will be deleted if too many errors occur. + format: int64 + type: integer + reportID: + description: The id of the traffic replay report created. + type: string + reportURL: + description: The url to the traffic replay report. + type: string + startedTime: + description: Information when the traffic replay has started. + format: date-time + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/deployments.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/deployments.yaml new file mode 100644 index 000000000..e5f329257 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/deployments.yaml @@ -0,0 +1,132 @@ +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + annotations: + operator.speedscale.com/ignore: "true" + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} + labels: + app: speedscale-operator + controlplane.speedscale.com/component: operator + {{- if .Values.globalLabels }} +{{ toYaml .Values.globalLabels | indent 4}} + {{- end }} + name: speedscale-operator + namespace: {{ .Release.Namespace }} +spec: + replicas: 1 + selector: + matchLabels: + app: speedscale-operator + controlplane.speedscale.com/component: operator + strategy: + type: Recreate + template: + metadata: + annotations: + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 8}} + {{- end }} + labels: + app: speedscale-operator + controlplane.speedscale.com/component: operator + {{- if .Values.globalLabels }} +{{ toYaml .Values.globalLabels | indent 8}} + {{- end }} + spec: + containers: + - command: + - /operator + env: + - name: POD_NAME + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.name + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + envFrom: + - configMapRef: + name: speedscale-operator + # https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.23/#container-v1-core + # When a key exists in multiple sources, the value associated with the last source will take precedence. + # Values defined by an Env with a duplicate key will take precedence. + - configMapRef: + name: speedscale-operator-override + optional: true + - secretRef: + name: '{{ ne .Values.apiKeySecret "" | ternary .Values.apiKeySecret "speedscale-apikey" }}' + optional: false + image: '{{ .Values.image.registry }}/operator:{{ .Values.image.tag }}' + imagePullPolicy: {{ .Values.image.pullPolicy }} + livenessProbe: + failureThreshold: 5 + httpGet: + path: /healthz + port: health-check + scheme: HTTP + initialDelaySeconds: 30 + periodSeconds: 30 + successThreshold: 1 + timeoutSeconds: 5 + name: operator + ports: + - containerPort: 443 + name: webhook-server + - containerPort: 8081 + name: health-check + readinessProbe: + failureThreshold: 10 + httpGet: + path: /readyz + port: health-check + scheme: HTTP + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + resources: {{- toYaml .Values.operator.resources | nindent 10 }} + securityContext: + allowPrivilegeEscalation: false + privileged: false + readOnlyRootFilesystem: true + runAsNonRoot: false + # Run as root to bind 443 https://github.com/kubernetes/kubernetes/issues/56374 + runAsUser: 0 + volumeMounts: + - mountPath: /tmp + name: tmp + - mountPath: /tmp/k8s-webhook-server/serving-certs + name: webhook-certs + readOnly: true + - mountPath: /etc/ssl/speedscale + name: speedscale-tls-out + readOnly: true + hostNetwork: {{ .Values.hostNetwork }} + securityContext: + runAsNonRoot: true + serviceAccountName: speedscale-operator + terminationGracePeriodSeconds: 10 + volumes: + - emptyDir: {} + name: tmp + - name: webhook-certs + secret: + secretName: speedscale-webhook-certs + - name: speedscale-tls-out + secret: + secretName: speedscale-certs + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/hooks.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/hooks.yaml new file mode 100644 index 000000000..3e8231f19 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/hooks.yaml @@ -0,0 +1,73 @@ +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + helm.sh/hook: pre-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "4" + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} + creationTimestamp: null + name: speedscale-operator-pre-install + namespace: {{ .Release.Namespace }} + labels: + {{- if .Values.globalLabels }} +{{ toYaml .Values.globalLabels | indent 4}} + {{- end }} +spec: + backoffLimit: 0 + ttlSecondsAfterFinished: 30 + template: + metadata: + annotations: + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 8}} + {{- end }} + creationTimestamp: null + labels: + {{- if .Values.globalLabels }} +{{ toYaml .Values.globalLabels | indent 8}} + {{- end }} + spec: + containers: + - args: + - |- + # ensure valid settings before the chart reports a successfull install + {{- if .Values.http_proxy }} + HTTP_PROXY={{ .Values.http_proxy | quote }} \ + {{- end }} + {{- if .Values.https_proxy }} + HTTPS_PROXY={{ .Values.https_proxy | quote }} \ + {{- end }} + {{- if .Values.no_proxy }} + NO_PROXY={{ .Values.no_proxy | quote }} \ + {{- end }} + speedctl init --overwrite --no-rcfile-update \ + --api-key $SPEEDSCALE_API_KEY \ + --app-url $SPEEDSCALE_APP_URL + + # in case we're in istio + curl -X POST http://127.0.0.1:15000/quitquitquit || true + command: + - sh + - -c + envFrom: + - secretRef: + name: '{{ ne .Values.apiKeySecret "" | ternary .Values.apiKeySecret "speedscale-apikey" }}' + optional: false + image: '{{ .Values.image.registry }}/speedscale-cli:{{ .Values.image.tag }}' + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: speedscale-cli + resources: {} + restartPolicy: Never + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/rbac.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/rbac.yaml new file mode 100644 index 000000000..e1ea42d99 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/rbac.yaml @@ -0,0 +1,244 @@ +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + creationTimestamp: null + name: speedscale-operator + {{- if .Values.globalAnnotations }} + annotations: {{ toYaml .Values.globalAnnotations | nindent 4 }} + {{- end }} +rules: +- apiGroups: + - apps + resources: + - deployments + - statefulsets + - daemonsets + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - apps + resources: + - replicasets + verbs: + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - batch + resources: + - jobs + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - get + - list +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - get + - list +- apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterrolebindings + - clusterroles + verbs: + - get + - list +- apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - configmaps + - secrets + - pods + - services + - serviceaccounts + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - "" + resources: + - pods/log + verbs: + - get + - list +- apiGroups: + - "" + resources: + - events + verbs: + - get + - list + - watch +- apiGroups: + - "" + resources: + - nodes + verbs: + - get + - list + - watch +- apiGroups: + - metrics.k8s.io + resources: + - pods + verbs: + - get + - list + - watch +- apiGroups: + - rbac.authorization.k8s.io + resources: + - rolebindings + - roles + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - networking.istio.io + resources: + - envoyfilters + - sidecars + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - security.istio.io + resources: + - peerauthentications + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - speedscale.com + resources: + - trafficreplays + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - speedscale.com + resources: + - trafficreplays/status + verbs: + - get + - update + - patch +- apiGroups: + - argoproj.io + resources: + - rollouts + verbs: + - get + - list + - patch + - update + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: speedscale-operator + {{- if .Values.globalAnnotations }} + annotations: {{ toYaml .Values.globalAnnotations | nindent 4 }} + {{- end }} +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: speedscale-operator +subjects: +- kind: ServiceAccount + name: speedscale-operator + namespace: {{ .Release.Namespace }} +--- +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + creationTimestamp: null + labels: + app: speedscale-operator + controlplane.speedscale.com/component: operator + name: speedscale-operator + namespace: {{ .Release.Namespace }} + {{- if .Values.globalAnnotations }} + annotations: {{ toYaml .Values.globalAnnotations | nindent 4 }} + {{- end }} diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/secrets.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/secrets.yaml new file mode 100644 index 000000000..1fb6999e4 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/secrets.yaml @@ -0,0 +1,18 @@ +--- +{{ if .Values.apiKey }} +apiVersion: v1 +kind: Secret +metadata: + name: speedscale-apikey + namespace: {{ .Release.Namespace }} + annotations: + helm.sh/hook: pre-install + helm.sh/hook-weight: "3" + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} +type: Opaque +data: + SPEEDSCALE_API_KEY: {{ .Values.apiKey | b64enc }} + SPEEDSCALE_APP_URL: {{ .Values.appUrl | b64enc }} +{{ end }} diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/services.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/services.yaml new file mode 100644 index 000000000..f9da2c25c --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/services.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: v1 +kind: Service +metadata: + creationTimestamp: null + labels: + app: speedscale-operator + controlplane.speedscale.com/component: operator + name: speedscale-operator + namespace: {{ .Release.Namespace }} + {{- if .Values.globalAnnotations }} + annotations: {{ toYaml .Values.globalAnnotations | nindent 4 }} + {{- end }} +spec: + ports: + - port: 443 + protocol: TCP + selector: + app: speedscale-operator + controlplane.speedscale.com/component: operator +status: + loadBalancer: {} diff --git a/charts/speedscale/speedscale-operator/2.2.419/templates/tls.yaml b/charts/speedscale/speedscale-operator/2.2.419/templates/tls.yaml new file mode 100644 index 000000000..4a2456288 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/templates/tls.yaml @@ -0,0 +1,183 @@ +{{- $crt := "" -}} +{{- $key := "" -}} +{{- $s := (lookup "v1" "Secret" .Release.Namespace "speedscale-certs") -}} +{{- if $s -}} +{{- $crt = index $s.data "tls.crt" | b64dec -}} +{{- $key = index $s.data "tls.key" | b64dec -}} +{{ else }} +{{- $cert := genCA "Speedscale" 3650 -}} +{{- $crt = $cert.Cert -}} +{{- $key = $cert.Key -}} +{{- end -}} +--- +apiVersion: batch/v1 +kind: Job +metadata: + annotations: + helm.sh/hook: pre-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "5" + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} + creationTimestamp: null + name: speedscale-operator-create-jks + namespace: {{ .Release.Namespace }} + labels: + {{- if .Values.globalLabels }} +{{ toYaml .Values.globalLabels | indent 4}} + {{- end }} +spec: + backoffLimit: 0 + ttlSecondsAfterFinished: 30 + template: + metadata: + annotations: + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 8}} + {{- end }} + creationTimestamp: null + labels: + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 8}} + {{- end }} + spec: + containers: + - args: + - |- + keytool -keystore /usr/lib/jvm/jre/lib/security/cacerts -importcert -noprompt -trustcacerts -storepass changeit -alias speedscale -file /etc/ssl/speedscale/tls.crt + kubectl -n ${POD_NAMESPACE} delete secret speedscale-jks || true + kubectl -n ${POD_NAMESPACE} create secret generic speedscale-jks --from-file=cacerts.jks=/usr/lib/jvm/jre/lib/security/cacerts + + # in case we're in istio + curl -X POST http://127.0.0.1:15000/quitquitquit || true + command: + - sh + - -c + volumeMounts: + - mountPath: /etc/ssl/speedscale + name: speedscale-tls-out + readOnly: true + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + apiVersion: v1 + fieldPath: metadata.namespace + envFrom: + - secretRef: + name: '{{ ne .Values.apiKeySecret "" | ternary .Values.apiKeySecret "speedscale-apikey" }}' + optional: false + image: '{{ .Values.image.registry }}/amazoncorretto' + imagePullPolicy: {{ .Values.image.pullPolicy }} + name: create-jks + resources: {} + restartPolicy: Never + serviceAccountName: speedscale-operator-provisioning + volumes: + - name: speedscale-tls-out + secret: + secretName: speedscale-certs + {{- if .Values.affinity }} + affinity: {{ toYaml .Values.affinity | nindent 8 }} + {{- end }} + {{- if .Values.tolerations }} + tolerations: {{ toYaml .Values.tolerations | nindent 8 }} + {{- end }} + {{- if .Values.nodeSelector }} + nodeSelector: {{ toYaml .Values.nodeSelector | nindent 8 }} + {{- end }} +--- +apiVersion: v1 +automountServiceAccountToken: true +kind: ServiceAccount +metadata: + annotations: + helm.sh/hook: pre-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "1" + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} + creationTimestamp: null + labels: + app: speedscale-operator + controlplane.speedscale.com/component: operator + name: speedscale-operator-provisioning + namespace: {{ .Release.Namespace }} +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + annotations: + helm.sh/hook: pre-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "2" + creationTimestamp: null + name: speedscale-operator-provisioning +rules: +- apiGroups: + - "" + resources: + - secrets + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +- apiGroups: + - admissionregistration.k8s.io + resources: + - mutatingwebhookconfigurations + - validatingwebhookconfigurations + verbs: + - create + - delete + - deletecollection + - get + - list + - patch + - update + - watch +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + annotations: + helm.sh/hook: pre-install + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + helm.sh/hook-weight: "3" + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} + creationTimestamp: null + name: speedscale-operator-provisioning +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: speedscale-operator-provisioning +subjects: +- kind: ServiceAccount + name: speedscale-operator-provisioning + namespace: {{ .Release.Namespace }} +--- +apiVersion: v1 +kind: Secret +metadata: + annotations: + helm.sh/hook: pre-install + helm.sh/hook-delete-policy: before-hook-creation + {{- if .Values.globalAnnotations }} +{{ toYaml .Values.globalAnnotations | indent 4}} + {{- end }} + creationTimestamp: null + name: speedscale-certs + namespace: {{ .Release.Namespace }} +type: kubernetes.io/tls +data: + tls.crt: {{ $crt | b64enc }} + tls.key: {{ $key | b64enc }} diff --git a/charts/speedscale/speedscale-operator/2.2.419/values.yaml b/charts/speedscale/speedscale-operator/2.2.419/values.yaml new file mode 100644 index 000000000..199752a36 --- /dev/null +++ b/charts/speedscale/speedscale-operator/2.2.419/values.yaml @@ -0,0 +1,138 @@ +# An API key is required to connect to the Speedscale cloud. +# If you need a key email support@speedscale.com. +apiKey: "" + +# A secret name can be referenced instead of the api key itself. +# The secret must be of the format: +# +# type: Opaque +# data: +# SPEEDSCALE_API_KEY: +# SPEEDSCALE_APP_URL: +apiKeySecret: "" + +# Speedscale domain to use. +appUrl: "app.speedscale.com" + +# The name of your cluster. +clusterName: "my-cluster" + +# Speedscale components image settings. +image: + registry: gcr.io/speedscale + tag: v2.2.419 + pullPolicy: Always + +# Log level for Speedscale components. +logLevel: "info" + +# Namespaces to be watched by Speedscale Operator as a list of names. +namespaceSelector: [] + +# Instructs operator to deploy resources necessary to interact with your cluster from the Speedscale dashboard. +dashboardAccess: true + +# Filter Rule to apply to the Speedscale Forwarder +filterRule: "standard" + +# Data Loss Prevention settings. +dlp: + # Instructs operator to enable data loss prevention features + enabled: false + + # Configuration for data loss prevention + config: "standard" + +# If the operator pod/webhooks need to be on the host network. +# This is only needed if the control plane cannot connect directly to a pod +# for eg. if Calico is used as EKS's default networking +# https://docs.tigera.io/calico/3.25/getting-started/kubernetes/managed-public-cloud/eks#install-eks-with-calico-networking +hostNetwork: false + +# A set of annotations to be applied to all Speedscale related deployments, +# services, jobs, pods, etc. +# +# Example: +# annotation.first: value +# annotation.second: value +globalAnnotations: {} + +# A set of labels to be applied to all Speedscale related deployments, +# services, jobs, pods, etc. +# +# Example: +# label1: value +# label2: value +globalLabels: {} + +# A full affinity object as detailed: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity +affinity: {} + +# The list of tolerations as detailed: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/ +tolerations: [] + +# A nodeselector object as detailed: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes/ +nodeSelector: {} + +# Deploy a demo app at startup. Set this to an empty string to not deploy. +# Valid values: ["java", ""] +deployDemo: "java" + +# Proxy connection settings if required by your network. These translate to standard proxy environment +# variables HTTP_PROXY, HTTPS_PROXY, and NO_PROXY +http_proxy: "" +https_proxy: "" +no_proxy: "" + +# control if sidecar init containers should run with privileged set +privilegedSidecars: false + +# control if the sidecar should enable/disable use of the smart dns lookup feature (requires NET_ADMIN) +disableSidecarSmartReverseDNS: false + +# Operator settings. These limits are recommended unless you have a cluster +# with a very large number of workloads (for eg. 10k+ deployments, replicasets, etc.). +operator: + resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + # how long to wait for the SUT to become ready + test_prep_timeout: 10m + # timeout for deploying & upgrading control plane components + control_plane_timeout: 5m + + +# Default sidecar settings. Example: +# sidecar: +# resources: +# limits: +# cpu: 500m +# memory: 512Mi +# ephemeral-storage: 100Mi +# requests: +# cpu: 10m +# memory: 32Mi +# ephemeral-storage: 100Mi +# ignore_src_hosts: example.com, example.org +# ignore_src_ips: 8.8.8.8, 1.1.1.1 +# ignore_dst_hosts: example.com, example.org +# ignore_dst_ips: 8.8.8.8, 1.1.1.1 +# insert_init_first: false +# tls_out: false +# reinitialize_iptables: false +sidecar: {} + +# Forwarder settings +# forwarder: +# resources: +# limits: +# cpu: 500m +# memory: 500M +# requests: +# cpu: 300m +# memory: 250M +forwarder: {} diff --git a/index.yaml b/index.yaml index 1fa59ad5b..4baf3fdeb 100644 --- a/index.yaml +++ b/index.yaml @@ -4107,6 +4107,38 @@ entries: - assets/cerbos/cerbos-0.37.0.tgz version: 0.37.0 cf-runtime: + - annotations: + artifacthub.io/changes: | + - kind: fixed + description: "engine image upgraded to v1.174.12 with fix to codefresh run --local command" + artifacthub.io/containsSecurityUpdates: "false" + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Codefresh + catalog.cattle.io/kube-version: '>=1.18-0' + catalog.cattle.io/release-name: cf-runtime + apiVersion: v2 + created: "2024-09-17T00:42:16.609860495Z" + dependencies: + - name: cf-common + repository: file://./charts/cf-common + version: 0.16.0 + description: A Helm chart for Codefresh Runner + digest: e31afe9412ca377375289eebdf98b57ff92f658f8781b0a27d72f5acb065cb7e + home: https://codefresh.io/ + icon: file://assets/icons/cf-runtime.png + keywords: + - codefresh + - runner + kubeVersion: '>=1.18-0' + maintainers: + - name: codefresh + url: https://codefresh-io.github.io/ + name: cf-runtime + sources: + - https://github.com/codefresh-io/venona + urls: + - assets/codefresh/cf-runtime-6.3.61.tgz + version: 6.3.61 - annotations: artifacthub.io/changes: | - kind: fixed @@ -6012,6 +6044,33 @@ entries: - assets/mongodb/community-operator-0.8.1.tgz version: 0.8.1 confluent-for-kubernetes: + - annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Confluent for Kubernetes + catalog.cattle.io/kube-version: '>=1.15-0' + catalog.cattle.io/release-name: confluent-for-kubernetes + apiVersion: v1 + appVersion: 2.9.3 + created: "2024-09-17T00:42:16.659953014Z" + description: A Helm chart to deploy Confluent for Kubernetes + digest: a4aa16b75470a0aaabfe17cbd549df7c3b8b62a8d508d6f17912d44b06b951ec + home: https://www.confluent.io/ + icon: file://assets/icons/confluent-for-kubernetes.png + keywords: + - Confluent + - Confluent Operator + - Confluent Platform + - CFK + kubeVersion: '>=1.15-0' + maintainers: + - email: operator@confluent.io + name: Confluent Operator + name: confluent-for-kubernetes + sources: + - https://docs.confluent.io/current/index.html + urls: + - assets/confluent/confluent-for-kubernetes-0.1033.33.tgz + version: 0.1033.33 - annotations: catalog.cattle.io/certified: partner catalog.cattle.io/display-name: Confluent for Kubernetes @@ -35839,6 +35898,37 @@ entries: - assets/btp/sextant-2.2.21.tgz version: 2.2.21 speedscale-operator: + - annotations: + catalog.cattle.io/certified: partner + catalog.cattle.io/display-name: Speedscale Operator + catalog.cattle.io/kube-version: '>= 1.17.0-0' + catalog.cattle.io/release-name: speedscale-operator + apiVersion: v1 + appVersion: 2.2.419 + created: "2024-09-17T00:42:20.831602454Z" + description: Stress test your APIs with real world scenarios. Collect and replay + traffic without scripting. + digest: 767122b99337e1b3e1398fdbf3aeaf17b9694ab7b7d36e2da05033772509e6fc + home: https://speedscale.com + icon: file://assets/icons/speedscale-operator.png + keywords: + - speedscale + - test + - testing + - regression + - reliability + - load + - replay + - network + - traffic + kubeVersion: '>= 1.17.0-0' + maintainers: + - email: support@speedscale.com + name: Speedscale Support + name: speedscale-operator + urls: + - assets/speedscale/speedscale-operator-2.2.419.tgz + version: 2.2.419 - annotations: catalog.cattle.io/certified: partner catalog.cattle.io/display-name: Speedscale Operator @@ -42399,4 +42489,4 @@ entries: urls: - assets/netfoundry/ziti-host-1.5.1.tgz version: 1.5.1 -generated: "2024-09-14T00:51:02.883174568Z" +generated: "2024-09-17T00:42:16.129150033Z"