@bluedynamics/cdk8s-monitoring 0.0.1

package/CLAUDE.md

@@ -0,0 +1,76 @@
+# Claude Code Project Guide
+
+Context and guidelines for Claude Code when working on **@bluedynamics/cdk8s-monitoring**.
+
+## Project Overview
+
+A generic, application-agnostic cdk8s construct library for a Kubernetes monitoring stack (Prometheus, Thanos, Loki, Grafana, Alloy) with Thanos long-term storage on S3. It is consumed by per-cluster integration charts (e.g. kup6s `dp-infra/monitoring`, helix `helix-infra-charts/monitoring`), which provide cluster-specific config and attach their own app dashboards and alert rules.
+
+TypeScript only — no JSII, no Python binding.
+
+## Build System
+
+This project uses **projen**. Do not edit generated files directly (`package.json`, `tsconfig.json`, `.eslintrc.json`, GitHub workflows, etc.).
+
+1. Edit `.projenrc.ts` for project configuration changes.
+2. Run `npx projen` to regenerate files.
+3. Make code changes in `src/`.
+4. Run `npx projen test`; update Jest snapshots with `npx projen test -- -u` if needed.
+
+### Common commands
+
+```shell
+npx projen          # regenerate project files after editing .projenrc.ts
+npx projen build    # compile + test + lint + package
+npx projen test     # run tests
+npx projen eslint   # lint (uses the projen eslint compat task, not bare eslint)
+```
+
+Note: bare `eslint` fails (eslint v9 flat-config vs. projen's `.eslintrc.json`); always lint via `npx projen eslint`.
+
+## Project Structure
+
+```
+src/
+  index.ts            # public exports
+  monitoring-chart.ts # orchestrator (sync-waves); app-agnostic
+  types.ts            # config interfaces + DeepPartial + MonitoringConfigInput
+  default-config.ts   # DEFAULT_CONFIG + mergeConfig (deep-merge)
+  constructs/         # the 12 generic stack constructs
+  imports/            # generated cdk8s imports (k8s, ESO, S3); excluded from lint
+test/                 # Jest tests, one per construct + orchestrator + default-config
+examples/synth.ts     # minimal synthesizable integration
+documentation/        # Sphinx/MyST docs (Diataxis, plone-doc-style)
+```
+
+## Design Rules
+
+- **App-agnostic**: never add cluster- or application-specific resources (dashboards, alert rules, domains) to this library. Integration charts attach those beside `MonitoringChart`.
+- **Defaults in the package, overrides in the chart**: universal values live in `DEFAULT_CONFIG`; cluster-specific values are required input. `mergeConfig` deep-merges.
+- **Generated `imports/` are not hand-edited** and are excluded from lint/style.
+
+## Git Workflow
+
+Never merge directly to `main`. Use feature branches and pull requests:
+
+```shell
+git checkout -b feat/description   # or fix/, docs/, chore/, refactor/, test/
+```
+
+## Documentation
+
+Sphinx with the Diataxis framework, authored in plone-doc-style (American English, one sentence per line, sentence-case headings, dash filenames, sparse admonitions).
+
+```shell
+cd documentation
+make docs        # build HTML (must be warning-free)
+make docs-live   # live-reload server
+```
+
+## Publishing
+
+Releases go to npm as `@bluedynamics/cdk8s-monitoring` via the projen release flow. Do not hand-publish unless explicitly asked.
+
+## Maintainer
+
+Jens W. Klein (jk@kleinundpartner.at), Blue Dynamics Alliance.

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,87 @@
+# @bluedynamics/cdk8s-monitoring
+
+A generic [cdk8s](https://cdk8s.io/) construct library for a complete Kubernetes monitoring stack: Prometheus, Thanos, Loki, Grafana, and Alloy, with Thanos long-term storage on S3-compatible object storage.
+
+The library is **application-agnostic**. It synthesizes the stack itself; your own dashboards and alert rules live in your integration chart and attach beside the stack (the Grafana sidecar discovers `ConfigMap`s labeled `grafana_dashboard: "1"`).
+
+## Features
+
+- Prometheus + Alertmanager + Grafana via the kube-prometheus-stack Helm chart.
+- Thanos Query, Store, and Compactor for long-term metrics with downsampling.
+- Loki + Alloy for log aggregation and collection.
+- S3 buckets and credentials wired through Crossplane and External Secrets Operator.
+- ArgoCD sync-wave ordering baked in.
+- Sensible production defaults you override only where needed (deep-merge).
+
+## Install
+
+```shell
+npm install @bluedynamics/cdk8s-monitoring
+```
+
+Peer dependencies: `cdk8s`, `cdk8s-plus-33`, `constructs`.
+
+## Usage
+
+Provide your cluster-specific values and let `mergeConfig` fill in the defaults:
+
+```typescript
+import { App } from 'cdk8s';
+import { MonitoringChart, mergeConfig } from '@bluedynamics/cdk8s-monitoring';
+
+const app = new App();
+
+const config = mergeConfig({
+  namespace: 'monitoring',
+  domains: { grafana: 'grafana.example.com' },
+  s3: {
+    endpoint: 'https://s3.example.com',
+    endpointNoProtocol: 's3.example.com',
+    region: 'eu',
+    buckets: { thanos: 'metrics-thanos', loki: 'logs-loki' },
+  },
+  smtp: { host: 'mail.example.com', port: 587, from: 'monitoring@example.com', requireTls: true },
+  // Override any default, e.g. storage: { prometheus: '30Gi' }
+});
+
+new MonitoringChart(app, 'monitoring', config);
+app.synth();
+```
+
+### Required vs. defaulted configuration
+
+- **Required (`RequiredClusterConfig`)**: `namespace`, `domains`, `s3`, `smtp`. No universal default exists, so you must provide them.
+- **Defaulted (`DefaultableConfig`)**: `versions`, `retention`, `storage`, `replicas`, `resources`. Shipped in `DEFAULT_CONFIG`; override any subset via `mergeConfig` (deep-merged).
+
+### Adding application dashboards and alerts
+
+The library does not ship app-specific dashboards. Attach your own construct beside the chart:
+
+```typescript
+const chart = new MonitoringChart(app, 'monitoring', config);
+new MyAppDashboardConstruct(chart, 'my-app-dashboard', { namespace: config.namespace });
+```
+
+A dashboard construct is a `ConfigMap` (use the re-exported `KubeConfigMap`) labeled `grafana_dashboard: "1"` so the Grafana sidecar discovers it. Alert rules are plain `PrometheusRule` resources you manage in your integration repo.
+
+## Prerequisites
+
+The stack expects these to exist in the cluster:
+
+- External Secrets Operator (for S3 credentials and the Grafana admin secret).
+- Crossplane with an S3 provider config (for bucket provisioning).
+- The prometheus-operator CRDs, applied server-side (they are not Helm-managed).
+
+## Development
+
+This project is managed with [projen](https://projen.io/). Do not edit generated files directly.
+
+```shell
+npx projen          # regenerate project files after editing .projenrc.ts
+npx projen build    # compile + test + lint + package
+npx projen test     # run tests
+```
+
+## License
+
+Apache-2.0

package/examples/synth.ts

@@ -0,0 +1,17 @@
+import { App } from 'cdk8s';
+import { MonitoringChart, mergeConfig } from '../src';
+
+const app = new App();
+const config = mergeConfig({
+  namespace: 'monitoring',
+  domains: { grafana: 'grafana.example.com' },
+  s3: {
+    endpoint: 'https://s3.example.com',
+    endpointNoProtocol: 's3.example.com',
+    region: 'eu',
+    buckets: { thanos: 'example-thanos', loki: 'example-loki' },
+  },
+  smtp: { host: 'mail.example.com', port: 587, from: 'monitoring@example.com', requireTls: true },
+});
+new MonitoringChart(app, 'monitoring', config);
+app.synth();

package/lib/constructs/alloy.d.ts

@@ -0,0 +1,29 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface AlloyProps {
+    namespace: string;
+    config: MonitoringConfig;
+}
+/**
+ * Creates Alloy (Grafana Agent) HelmChart for log collection.
+ *
+ * This construct deploys Alloy as a DaemonSet that:
+ * - Runs on every node in the cluster
+ * - Collects logs from all pods via Kubernetes API
+ * - Parses JSON structured logs
+ * - Extracts structured metadata (trace_id, request_id, etc.)
+ * - Tags logs with cluster=kup6s label
+ * - Forwards logs to Loki gateway
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Loki gateway service exists
+ * - RBAC permissions for pod log access
+ *
+ * Sync Wave: 3 (log collection - after Loki is ready)
+ */
+export declare class AlloyConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: AlloyProps);
+    private generateHelmValues;
+}

package/lib/constructs/alloy.js

@@ -0,0 +1,214 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AlloyConstruct = void 0;
+const cdk8s_1 = require("cdk8s");
+const constructs_1 = require("constructs");
+/**
+ * Creates Alloy (Grafana Agent) HelmChart for log collection.
+ *
+ * This construct deploys Alloy as a DaemonSet that:
+ * - Runs on every node in the cluster
+ * - Collects logs from all pods via Kubernetes API
+ * - Parses JSON structured logs
+ * - Extracts structured metadata (trace_id, request_id, etc.)
+ * - Tags logs with cluster=kup6s label
+ * - Forwards logs to Loki gateway
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Loki gateway service exists
+ * - RBAC permissions for pod log access
+ *
+ * Sync Wave: 3 (log collection - after Loki is ready)
+ */
+class AlloyConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { namespace, config } = props;
+        // Generate Helm values YAML with embedded Alloy configuration
+        const helmValues = this.generateHelmValues(config);
+        // Create HelmChart resource (K3S Helm controller)
+        // Wave 3: Log Collection - after Loki is ready
+        new cdk8s_1.ApiObject(this, 'alloy', {
+            apiVersion: 'helm.cattle.io/v1',
+            kind: 'HelmChart',
+            metadata: {
+                name: 'alloy',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'alloy',
+                    'app.kubernetes.io/component': 'log-collector',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                repo: 'https://grafana.github.io/helm-charts',
+                chart: 'alloy',
+                version: config.versions.alloy === 'latest' ? undefined : config.versions.alloy,
+                targetNamespace: namespace,
+                valuesContent: helmValues,
+            },
+        });
+    }
+    generateHelmValues(config) {
+        // Alloy configuration is written in Alloy's HCL-like syntax
+        // This is embedded in the Helm values as a multi-line string
+        return `controller:
+  type: daemonset
+
+alloy:
+  configMap:
+    create: true
+    content: |-
+      logging {
+        level  = "info"
+        format = "logfmt"
+      }
+
+      discovery.kubernetes "pods" {
+        role = "pod"
+        selectors {
+          role  = "pod"
+          field = "spec.nodeName=" + sys.env("HOSTNAME")
+        }
+      }
+
+      // __meta_kubernetes_* labels live on discovery targets only —
+      // loki.source.kubernetes does not propagate them to log streams.
+      // Relabel here so namespace/pod/container/etc become real labels.
+      discovery.relabel "pod_logs" {
+        targets = discovery.kubernetes.pods.targets
+
+        // Skip terminally Failed pods and Unknown-state pods.
+        // Old crashed pods otherwise pin loki.source.kubernetes in a
+        // retry loop, blocking it from tailing the running replica.
+        // CrashLoopBackOff pods stay phase=Running — we keep tailing those.
+        rule {
+          source_labels = ["__meta_kubernetes_pod_phase"]
+          regex         = "Failed|Unknown"
+          action        = "drop"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          target_label  = "namespace"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          target_label  = "pod"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          target_label  = "container"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_label_app"]
+          target_label  = "app"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_component"]
+          target_label  = "component"
+        }
+      }
+
+      loki.source.kubernetes "pods" {
+        targets    = discovery.relabel.pod_logs.output
+        forward_to = [loki.process.logs.receiver]
+      }
+
+      loki.process "logs" {
+        forward_to = [loki.write.default.receiver]
+
+        stage.json {
+          expressions = {
+            timestamp    = "timestamp",
+            level        = "level",
+            event        = "event",
+            component    = "component",
+            connector_id = "connector_id",
+            user_id      = "user_id",
+            request_id   = "request_id",
+            trace_id     = "trace_id",
+            kafka        = "kafka",
+          }
+        }
+
+        stage.labels {
+          values = {
+            level = "level",
+          }
+        }
+
+        stage.structured_metadata {
+          values = {
+            connector_id = "connector_id",
+            user_id      = "user_id",
+            request_id   = "request_id",
+            trace_id     = "trace_id",
+          }
+        }
+
+        stage.timestamp {
+          source = "timestamp"
+          format = "RFC3339"
+        }
+
+        stage.output {
+          source = "event"
+        }
+      }
+
+      loki.write "default" {
+        endpoint {
+          url = "http://loki-gateway.${config.namespace}.svc.cluster.local/loki/api/v1/push"
+        }
+        external_labels = {
+          cluster = "kup6s",
+        }
+      }
+
+  extraEnv:
+    - name: HOSTNAME
+      valueFrom:
+        fieldRef:
+          fieldPath: spec.nodeName
+
+resources:
+  limits:
+    cpu: ${config.resources.alloy.limits.cpu}
+    memory: ${config.resources.alloy.limits.memory}
+  requests:
+    cpu: ${config.resources.alloy.requests.cpu}
+    memory: ${config.resources.alloy.requests.memory}
+
+# Config-reloader sidecar resources (added 2025-11-18)
+configReloader:
+  resources:
+    limits:
+      cpu: ${config.resources.configReloader.limits.cpu}
+      memory: ${config.resources.configReloader.limits.memory}
+    requests:
+      cpu: ${config.resources.configReloader.requests.cpu}
+      memory: ${config.resources.configReloader.requests.memory}
+
+rbac:
+  create: true
+
+serviceAccount:
+  create: true
+
+priorityClassName: high-priority
+`;
+    }
+}
+exports.AlloyConstruct = AlloyConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWxsb3kuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvY29uc3RydWN0cy9hbGxveS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSxpQ0FBa0M7QUFDbEMsMkNBQXVDO0FBUXZDOzs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FrQkc7QUFDSCxNQUFhLGNBQWUsU0FBUSxzQkFBUztJQUMzQyxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQWlCO1FBQ3pELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFcEMsOERBQThEO1FBQzlELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUVuRCxrREFBa0Q7UUFDbEQsK0NBQStDO1FBQy9DLElBQUksaUJBQVMsQ0FBQyxJQUFJLEVBQUUsT0FBTyxFQUFFO1lBQzNCLFVBQVUsRUFBRSxtQkFBbUI7WUFDL0IsSUFBSSxFQUFFLFdBQVc7WUFDakIsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSxPQUFPO2dCQUNiLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsT0FBTztvQkFDakMsNkJBQTZCLEVBQUUsZUFBZTtvQkFDOUMsOEJBQThCLEVBQUUsT0FBTztvQkFDdkMsMkJBQTJCLEVBQUUsWUFBWTtpQkFDMUM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osSUFBSSxFQUFFLHVDQUF1QztnQkFDN0MsS0FBSyxFQUFFLE9BQU87Z0JBQ2QsT0FBTyxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUs7Z0JBQy9FLGVBQWUsRUFBRSxTQUFTO2dCQUMxQixhQUFhLEVBQUUsVUFBVTthQUMxQjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTyxrQkFBa0IsQ0FBQyxNQUF3QjtRQUNqRCw0REFBNEQ7UUFDNUQsNkRBQTZEO1FBQzdELE9BQU87Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozt1Q0ErRzRCLE1BQU0sQ0FBQyxTQUFTOzs7Ozs7Ozs7Ozs7Ozs7V0FlNUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUc7Y0FDOUIsTUFBTSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU07O1dBRXZDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxHQUFHO2NBQ2hDLE1BQU0sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxNQUFNOzs7Ozs7YUFNdkMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLEdBQUc7Z0JBQ3ZDLE1BQU0sQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxNQUFNOzthQUVoRCxNQUFNLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDekMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLE1BQU07Ozs7Ozs7OztDQVM5RCxDQUFDO0lBQ0EsQ0FBQztDQUNGO0FBL0xELHdDQStMQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEFwaU9iamVjdCB9IGZyb20gJ2NkazhzJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgTW9uaXRvcmluZ0NvbmZpZyB9IGZyb20gJy4uL3R5cGVzJztcblxuZXhwb3J0IGludGVyZmFjZSBBbGxveVByb3BzIHtcbiAgbmFtZXNwYWNlOiBzdHJpbmc7XG4gIGNvbmZpZzogTW9uaXRvcmluZ0NvbmZpZztcbn1cblxuLyoqXG4gKiBDcmVhdGVzIEFsbG95IChHcmFmYW5hIEFnZW50KSBIZWxtQ2hhcnQgZm9yIGxvZyBjb2xsZWN0aW9uLlxuICpcbiAqIFRoaXMgY29uc3RydWN0IGRlcGxveXMgQWxsb3kgYXMgYSBEYWVtb25TZXQgdGhhdDpcbiAqIC0gUnVucyBvbiBldmVyeSBub2RlIGluIHRoZSBjbHVzdGVyXG4gKiAtIENvbGxlY3RzIGxvZ3MgZnJvbSBhbGwgcG9kcyB2aWEgS3ViZXJuZXRlcyBBUElcbiAqIC0gUGFyc2VzIEpTT04gc3RydWN0dXJlZCBsb2dzXG4gKiAtIEV4dHJhY3RzIHN0cnVjdHVyZWQgbWV0YWRhdGEgKHRyYWNlX2lkLCByZXF1ZXN0X2lkLCBldGMuKVxuICogLSBUYWdzIGxvZ3Mgd2l0aCBjbHVzdGVyPWt1cDZzIGxhYmVsXG4gKiAtIEZvcndhcmRzIGxvZ3MgdG8gTG9raSBnYXRld2F5XG4gKlxuICogUHJlcmVxdWlzaXRlczpcbiAqIC0gTmFtZXNwYWNlIGV4aXN0c1xuICogLSBQcmlvcml0eUNsYXNzICdoaWdoLXByaW9yaXR5JyBleGlzdHNcbiAqIC0gTG9raSBnYXRld2F5IHNlcnZpY2UgZXhpc3RzXG4gKiAtIFJCQUMgcGVybWlzc2lvbnMgZm9yIHBvZCBsb2cgYWNjZXNzXG4gKlxuICogU3luYyBXYXZlOiAzIChsb2cgY29sbGVjdGlvbiAtIGFmdGVyIExva2kgaXMgcmVhZHkpXG4gKi9cbmV4cG9ydCBjbGFzcyBBbGxveUNvbnN0cnVjdCBleHRlbmRzIENvbnN0cnVjdCB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBBbGxveVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IHsgbmFtZXNwYWNlLCBjb25maWcgfSA9IHByb3BzO1xuXG4gICAgLy8gR2VuZXJhdGUgSGVsbSB2YWx1ZXMgWUFNTCB3aXRoIGVtYmVkZGVkIEFsbG95IGNvbmZpZ3VyYXRpb25cbiAgICBjb25zdCBoZWxtVmFsdWVzID0gdGhpcy5nZW5lcmF0ZUhlbG1WYWx1ZXMoY29uZmlnKTtcblxuICAgIC8vIENyZWF0ZSBIZWxtQ2hhcnQgcmVzb3VyY2UgKEszUyBIZWxtIGNvbnRyb2xsZXIpXG4gICAgLy8gV2F2ZSAzOiBMb2cgQ29sbGVjdGlvbiAtIGFmdGVyIExva2kgaXMgcmVhZHlcbiAgICBuZXcgQXBpT2JqZWN0KHRoaXMsICdhbGxveScsIHtcbiAgICAgIGFwaVZlcnNpb246ICdoZWxtLmNhdHRsZS5pby92MScsXG4gICAgICBraW5kOiAnSGVsbUNoYXJ0JyxcbiAgICAgIG1ldGFkYXRhOiB7XG4gICAgICAgIG5hbWU6ICdhbGxveScsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICdhbGxveScsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudCc6ICdsb2ctY29sbGVjdG9yJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbWFuYWdlZC1ieSc6ICdjZGs4cycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2YnOiAnbW9uaXRvcmluZycsXG4gICAgICAgIH0sXG4gICAgICAgIGFubm90YXRpb25zOiB7XG4gICAgICAgICAgJ2FyZ29jZC5hcmdvcHJvai5pby9zeW5jLXdhdmUnOiAnMycsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgICAgc3BlYzoge1xuICAgICAgICByZXBvOiAnaHR0cHM6Ly9ncmFmYW5hLmdpdGh1Yi5pby9oZWxtLWNoYXJ0cycsXG4gICAgICAgIGNoYXJ0OiAnYWxsb3knLFxuICAgICAgICB2ZXJzaW9uOiBjb25maWcudmVyc2lvbnMuYWxsb3kgPT09ICdsYXRlc3QnID8gdW5kZWZpbmVkIDogY29uZmlnLnZlcnNpb25zLmFsbG95LFxuICAgICAgICB0YXJnZXROYW1lc3BhY2U6IG5hbWVzcGFjZSxcbiAgICAgICAgdmFsdWVzQ29udGVudDogaGVsbVZhbHVlcyxcbiAgICAgIH0sXG4gICAgfSk7XG4gIH1cblxuICBwcml2YXRlIGdlbmVyYXRlSGVsbVZhbHVlcyhjb25maWc6IE1vbml0b3JpbmdDb25maWcpOiBzdHJpbmcge1xuICAgIC8vIEFsbG95IGNvbmZpZ3VyYXRpb24gaXMgd3JpdHRlbiBpbiBBbGxveSdzIEhDTC1saWtlIHN5bnRheFxuICAgIC8vIFRoaXMgaXMgZW1iZWRkZWQgaW4gdGhlIEhlbG0gdmFsdWVzIGFzIGEgbXVsdGktbGluZSBzdHJpbmdcbiAgICByZXR1cm4gYGNvbnRyb2xsZXI6XG4gIHR5cGU6IGRhZW1vbnNldFxuXG5hbGxveTpcbiAgY29uZmlnTWFwOlxuICAgIGNyZWF0ZTogdHJ1ZVxuICAgIGNvbnRlbnQ6IHwtXG4gICAgICBsb2dnaW5nIHtcbiAgICAgICAgbGV2ZWwgID0gXCJpbmZvXCJcbiAgICAgICAgZm9ybWF0ID0gXCJsb2dmbXRcIlxuICAgICAgfVxuXG4gICAgICBkaXNjb3Zlcnkua3ViZXJuZXRlcyBcInBvZHNcIiB7XG4gICAgICAgIHJvbGUgPSBcInBvZFwiXG4gICAgICAgIHNlbGVjdG9ycyB7XG4gICAgICAgICAgcm9sZSAgPSBcInBvZFwiXG4gICAgICAgICAgZmllbGQgPSBcInNwZWMubm9kZU5hbWU9XCIgKyBzeXMuZW52KFwiSE9TVE5BTUVcIilcbiAgICAgICAgfVxuICAgICAgfVxuXG4gICAgICAvLyBfX21ldGFfa3ViZXJuZXRlc18qIGxhYmVscyBsaXZlIG9uIGRpc2NvdmVyeSB0YXJnZXRzIG9ubHkg4oCUXG4gICAgICAvLyBsb2tpLnNvdXJjZS5rdWJlcm5ldGVzIGRvZXMgbm90IHByb3BhZ2F0ZSB0aGVtIHRvIGxvZyBzdHJlYW1zLlxuICAgICAgLy8gUmVsYWJlbCBoZXJlIHNvIG5hbWVzcGFjZS9wb2QvY29udGFpbmVyL2V0YyBiZWNvbWUgcmVhbCBsYWJlbHMuXG4gICAgICBkaXNjb3ZlcnkucmVsYWJlbCBcInBvZF9sb2dzXCIge1xuICAgICAgICB0YXJnZXRzID0gZGlzY292ZXJ5Lmt1YmVybmV0ZXMucG9kcy50YXJnZXRzXG5cbiAgICAgICAgLy8gU2tpcCB0ZXJtaW5hbGx5IEZhaWxlZCBwb2RzIGFuZCBVbmtub3duLXN0YXRlIHBvZHMuXG4gICAgICAgIC8vIE9sZCBjcmFzaGVkIHBvZHMgb3RoZXJ3aXNlIHBpbiBsb2tpLnNvdXJjZS5rdWJlcm5ldGVzIGluIGFcbiAgICAgICAgLy8gcmV0cnkgbG9vcCwgYmxvY2tpbmcgaXQgZnJvbSB0YWlsaW5nIHRoZSBydW5uaW5nIHJlcGxpY2EuXG4gICAgICAgIC8vIENyYXNoTG9vcEJhY2tPZmYgcG9kcyBzdGF5IHBoYXNlPVJ1bm5pbmcg4oCUIHdlIGtlZXAgdGFpbGluZyB0aG9zZS5cbiAgICAgICAgcnVsZSB7XG4gICAgICAgICAgc291cmNlX2xhYmVscyA9IFtcIl9fbWV0YV9rdWJlcm5ldGVzX3BvZF9waGFzZVwiXVxuICAgICAgICAgIHJlZ2V4ICAgICAgICAgPSBcIkZhaWxlZHxVbmtub3duXCJcbiAgICAgICAgICBhY3Rpb24gICAgICAgID0gXCJkcm9wXCJcbiAgICAgICAgfVxuXG4gICAgICAgIHJ1bGUge1xuICAgICAgICAgIHNvdXJjZV9sYWJlbHMgPSBbXCJfX21ldGFfa3ViZXJuZXRlc19uYW1lc3BhY2VcIl1cbiAgICAgICAgICB0YXJnZXRfbGFiZWwgID0gXCJuYW1lc3BhY2VcIlxuICAgICAgICB9XG5cbiAgICAgICAgcnVsZSB7XG4gICAgICAgICAgc291cmNlX2xhYmVscyA9IFtcIl9fbWV0YV9rdWJlcm5ldGVzX3BvZF9uYW1lXCJdXG4gICAgICAgICAgdGFyZ2V0X2xhYmVsICA9IFwicG9kXCJcbiAgICAgICAgfVxuXG4gICAgICAgIHJ1bGUge1xuICAgICAgICAgIHNvdXJjZV9sYWJlbHMgPSBbXCJfX21ldGFfa3ViZXJuZXRlc19wb2RfY29udGFpbmVyX25hbWVcIl1cbiAgICAgICAgICB0YXJnZXRfbGFiZWwgID0gXCJjb250YWluZXJcIlxuICAgICAgICB9XG5cbiAgICAgICAgcnVsZSB7XG4gICAgICAgICAgc291cmNlX2xhYmVscyA9IFtcIl9fbWV0YV9rdWJlcm5ldGVzX3BvZF9sYWJlbF9hcHBcIl1cbiAgICAgICAgICB0YXJnZXRfbGFiZWwgID0gXCJhcHBcIlxuICAgICAgICB9XG5cbiAgICAgICAgcnVsZSB7XG4gICAgICAgICAgc291cmNlX2xhYmVscyA9IFtcIl9fbWV0YV9rdWJlcm5ldGVzX3BvZF9sYWJlbF9hcHBfa3ViZXJuZXRlc19pb19jb21wb25lbnRcIl1cbiAgICAgICAgICB0YXJnZXRfbGFiZWwgID0gXCJjb21wb25lbnRcIlxuICAgICAgICB9XG4gICAgICB9XG5cbiAgICAgIGxva2kuc291cmNlLmt1YmVybmV0ZXMgXCJwb2RzXCIge1xuICAgICAgICB0YXJnZXRzICAgID0gZGlzY292ZXJ5LnJlbGFiZWwucG9kX2xvZ3Mub3V0cHV0XG4gICAgICAgIGZvcndhcmRfdG8gPSBbbG9raS5wcm9jZXNzLmxvZ3MucmVjZWl2ZXJdXG4gICAgICB9XG5cbiAgICAgIGxva2kucHJvY2VzcyBcImxvZ3NcIiB7XG4gICAgICAgIGZvcndhcmRfdG8gPSBbbG9raS53cml0ZS5kZWZhdWx0LnJlY2VpdmVyXVxuXG4gICAgICAgIHN0YWdlLmpzb24ge1xuICAgICAgICAgIGV4cHJlc3Npb25zID0ge1xuICAgICAgICAgICAgdGltZXN0YW1wICAgID0gXCJ0aW1lc3RhbXBcIixcbiAgICAgICAgICAgIGxldmVsICAgICAgICA9IFwibGV2ZWxcIixcbiAgICAgICAgICAgIGV2ZW50ICAgICAgICA9IFwiZXZlbnRcIixcbiAgICAgICAgICAgIGNvbXBvbmVudCAgICA9IFwiY29tcG9uZW50XCIsXG4gICAgICAgICAgICBjb25uZWN0b3JfaWQgPSBcImNvbm5lY3Rvcl9pZFwiLFxuICAgICAgICAgICAgdXNlcl9pZCAgICAgID0gXCJ1c2VyX2lkXCIsXG4gICAgICAgICAgICByZXF1ZXN0X2lkICAgPSBcInJlcXVlc3RfaWRcIixcbiAgICAgICAgICAgIHRyYWNlX2lkICAgICA9IFwidHJhY2VfaWRcIixcbiAgICAgICAgICAgIGthZmthICAgICAgICA9IFwia2Fma2FcIixcbiAgICAgICAgICB9XG4gICAgICAgIH1cblxuICAgICAgICBzdGFnZS5sYWJlbHMge1xuICAgICAgICAgIHZhbHVlcyA9IHtcbiAgICAgICAgICAgIGxldmVsID0gXCJsZXZlbFwiLFxuICAgICAgICAgIH1cbiAgICAgICAgfVxuXG4gICAgICAgIHN0YWdlLnN0cnVjdHVyZWRfbWV0YWRhdGEge1xuICAgICAgICAgIHZhbHVlcyA9IHtcbiAgICAgICAgICAgIGNvbm5lY3Rvcl9pZCA9IFwiY29ubmVjdG9yX2lkXCIsXG4gICAgICAgICAgICB1c2VyX2lkICAgICAgPSBcInVzZXJfaWRcIixcbiAgICAgICAgICAgIHJlcXVlc3RfaWQgICA9IFwicmVxdWVzdF9pZFwiLFxuICAgICAgICAgICAgdHJhY2VfaWQgICAgID0gXCJ0cmFjZV9pZFwiLFxuICAgICAgICAgIH1cbiAgICAgICAgfVxuXG4gICAgICAgIHN0YWdlLnRpbWVzdGFtcCB7XG4gICAgICAgICAgc291cmNlID0gXCJ0aW1lc3RhbXBcIlxuICAgICAgICAgIGZvcm1hdCA9IFwiUkZDMzMzOVwiXG4gICAgICAgIH1cblxuICAgICAgICBzdGFnZS5vdXRwdXQge1xuICAgICAgICAgIHNvdXJjZSA9IFwiZXZlbnRcIlxuICAgICAgICB9XG4gICAgICB9XG5cbiAgICAgIGxva2kud3JpdGUgXCJkZWZhdWx0XCIge1xuICAgICAgICBlbmRwb2ludCB7XG4gICAgICAgICAgdXJsID0gXCJodHRwOi8vbG9raS1nYXRld2F5LiR7Y29uZmlnLm5hbWVzcGFjZX0uc3ZjLmNsdXN0ZXIubG9jYWwvbG9raS9hcGkvdjEvcHVzaFwiXG4gICAgICAgIH1cbiAgICAgICAgZXh0ZXJuYWxfbGFiZWxzID0ge1xuICAgICAgICAgIGNsdXN0ZXIgPSBcImt1cDZzXCIsXG4gICAgICAgIH1cbiAgICAgIH1cblxuICBleHRyYUVudjpcbiAgICAtIG5hbWU6IEhPU1ROQU1FXG4gICAgICB2YWx1ZUZyb206XG4gICAgICAgIGZpZWxkUmVmOlxuICAgICAgICAgIGZpZWxkUGF0aDogc3BlYy5ub2RlTmFtZVxuXG5yZXNvdXJjZXM6XG4gIGxpbWl0czpcbiAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5hbGxveS5saW1pdHMuY3B1fVxuICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLmFsbG95LmxpbWl0cy5tZW1vcnl9XG4gIHJlcXVlc3RzOlxuICAgIGNwdTogJHtjb25maWcucmVzb3VyY2VzLmFsbG95LnJlcXVlc3RzLmNwdX1cbiAgICBtZW1vcnk6ICR7Y29uZmlnLnJlc291cmNlcy5hbGxveS5yZXF1ZXN0cy5tZW1vcnl9XG5cbiMgQ29uZmlnLXJlbG9hZGVyIHNpZGVjYXIgcmVzb3VyY2VzIChhZGRlZCAyMDI1LTExLTE4KVxuY29uZmlnUmVsb2FkZXI6XG4gIHJlc291cmNlczpcbiAgICBsaW1pdHM6XG4gICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5jb25maWdSZWxvYWRlci5saW1pdHMuY3B1fVxuICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMuY29uZmlnUmVsb2FkZXIubGltaXRzLm1lbW9yeX1cbiAgICByZXF1ZXN0czpcbiAgICAgIGNwdTogJHtjb25maWcucmVzb3VyY2VzLmNvbmZpZ1JlbG9hZGVyLnJlcXVlc3RzLmNwdX1cbiAgICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLmNvbmZpZ1JlbG9hZGVyLnJlcXVlc3RzLm1lbW9yeX1cblxucmJhYzpcbiAgY3JlYXRlOiB0cnVlXG5cbnNlcnZpY2VBY2NvdW50OlxuICBjcmVhdGU6IHRydWVcblxucHJpb3JpdHlDbGFzc05hbWU6IGhpZ2gtcHJpb3JpdHlcbmA7XG4gIH1cbn1cbiJdfQ==