@bluedynamics/cdk8s-monitoring 0.0.1

package/lib/constructs/prometheus-stack.js

@@ -0,0 +1,477 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrometheusStackConstruct = void 0;
+const cdk8s_1 = require("cdk8s");
+const constructs_1 = require("constructs");
+/**
+ * Creates kube-prometheus-stack HelmChart with Prometheus, Grafana, and Alertmanager.
+ *
+ * This is the core monitoring stack that includes:
+ * - Prometheus (metrics collection, 2 replicas, 3d retention)
+ * - Grafana (visualization, ingress with Let's Encrypt)
+ * - Alertmanager (alert routing, SMTP notifications)
+ * - Prometheus Operator (manages Prometheus CRDs)
+ * - Node Exporter (system metrics DaemonSet)
+ * - kube-state-metrics (Kubernetes resource metrics)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Longhorn storage class available
+ * - cert-manager ClusterIssuer configured
+ * - Thanos S3 secret exists (thanos-objstore-config)
+ *
+ * Sync Wave: 2 (core services - after S3 buckets and secrets)
+ */
+class PrometheusStackConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { namespace, config } = props;
+        // Generate Helm values YAML
+        const helmValues = this.generateHelmValues(config);
+        // Create HelmChart resource (K3S Helm controller)
+        // Wave 2: Core Services - monitoring stack
+        new cdk8s_1.ApiObject(this, 'kube-prometheus-stack', {
+            apiVersion: 'helm.cattle.io/v1',
+            kind: 'HelmChart',
+            metadata: {
+                name: 'kube-prometheus-stack',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'kube-prometheus-stack',
+                    'app.kubernetes.io/component': 'monitoring',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '2',
+                },
+            },
+            spec: {
+                repo: 'https://prometheus-community.github.io/helm-charts',
+                chart: 'kube-prometheus-stack',
+                version: config.versions.prometheusStack === 'latest' ? undefined : config.versions.prometheusStack,
+                targetNamespace: namespace,
+                valuesContent: helmValues,
+            },
+        });
+    }
+    generateHelmValues(config) {
+        return `kubeEtcd:
+  enabled: false
+
+# Disable kube-controller-manager and kube-scheduler monitoring. See https://github.com/cablespaghetti/k3s-monitoring/issues/2
+kubeControllerManager:
+  enabled: false
+kubeScheduler:
+  enabled: false
+
+# Detect PodDisruptionBudgets that would block a node drain during k3s upgrades.
+# Operator-managed PDBs sit at disruptionsAllowed=0 by design (Longhorn instance-managers,
+# CNPG *-primary) and are excluded so the alert only fires on anomalous app PDBs.
+additionalPrometheusRulesMap:
+  pdb-drain-safety:
+    groups:
+      - name: pdb.rules
+        interval: 1m
+        rules:
+          - alert: PodDisruptionBudgetUndrainable
+            expr: kube_poddisruptionbudget_status_pod_disruptions_allowed{namespace!="longhorn-system", poddisruptionbudget!~".*-primary"} == 0
+            for: 15m
+            labels:
+              severity: warning
+              component: cluster-upgrade
+            annotations:
+              summary: "PDB {{ $labels.namespace }}/{{ $labels.poddisruptionbudget }} allows 0 voluntary disruptions"
+              description: |
+                The PodDisruptionBudget {{ $labels.namespace }}/{{ $labels.poddisruptionbudget }}
+                has allowed 0 voluntary disruptions for over 15 minutes. This will block a node
+                drain during k3s upgrades. Operator-managed PDBs (Longhorn, CNPG primaries) are
+                excluded from this alert. Likely a degraded deployment (0 healthy pods) or a
+                single-replica deployment with minAvailable=1.
+                Check: kubectl get pdb -n {{ $labels.namespace }} {{ $labels.poddisruptionbudget }}
+          - alert: PodDisruptionBudgetUndrainableCritical
+            expr: kube_poddisruptionbudget_status_pod_disruptions_allowed{namespace!="longhorn-system", poddisruptionbudget!~".*-primary"} == 0
+            for: 1h
+            labels:
+              severity: critical
+              component: cluster-upgrade
+            annotations:
+              summary: "PDB {{ $labels.namespace }}/{{ $labels.poddisruptionbudget }} undrainable >1h"
+              description: |
+                PDB {{ $labels.namespace }}/{{ $labels.poddisruptionbudget }} has blocked
+                voluntary disruptions for over an hour. A k3s agent upgrade would stall on this node.
+  # Detect an EX dedicated worker stuck NotReady — likely a MicroOS reboot hang
+  # (pings but sshd/kubelet dead). A hung node also holds the cluster-wide kured
+  # lock, blocking all further graceful reboots, so this must be caught fast.
+  ex-worker-reboot:
+    groups:
+      - name: ex-worker.rules
+        interval: 1m
+        rules:
+          - alert: ExWorkerNotReady
+            expr: kube_node_status_condition{condition="Ready",status="true",node=~"kup6s-ex-.*"} == 0
+            for: 15m
+            labels:
+              severity: critical
+              component: node
+            annotations:
+              summary: "EX worker {{ $labels.node }} NotReady for >15m"
+              description: |
+                EX dedicated worker {{ $labels.node }} has been NotReady for over 15 minutes.
+                Possible MicroOS reboot hang (pings but sshd/kubelet/longhorn-manager dead) — the
+                node may still hold the cluster-wide kured lock, blocking all further reboots.
+                Recovery: Hetzner Robot hardware reset. Do NOT force-detach Longhorn volumes.
+              runbook_url: "https://docs.kup6s.com/how-to/troubleshooting/ex-worker-ping-but-dead.html"
+
+# Drop high-cardinality API server and etcd histogram buckets to reduce memory usage
+# These metrics alone account for ~200k series (47% of total cardinality)
+# We keep _sum and _count suffixes which are sufficient for rate calculations
+kubeApiServer:
+  serviceMonitor:
+    metricRelabelings:
+      - sourceLabels: [__name__]
+        regex: 'apiserver_request_duration_seconds_bucket'
+        action: drop
+      - sourceLabels: [__name__]
+        regex: 'apiserver_request_sli_duration_seconds_bucket'
+        action: drop
+      - sourceLabels: [__name__]
+        regex: 'apiserver_request_body_size_bytes_bucket'
+        action: drop
+      - sourceLabels: [__name__]
+        regex: 'apiserver_response_sizes_bucket'
+        action: drop
+      - sourceLabels: [__name__]
+        regex: 'etcd_request_duration_seconds_bucket'
+        action: drop
+
+# Kubelet also exposes apiserver metrics - apply same filters
+kubelet:
+  serviceMonitor:
+    metricRelabelings:
+      - sourceLabels: [__name__]
+        regex: 'apiserver_request_duration_seconds_bucket'
+        action: drop
+      - sourceLabels: [__name__]
+        regex: 'apiserver_request_sli_duration_seconds_bucket'
+        action: drop
+      - sourceLabels: [__name__]
+        regex: 'apiserver_request_body_size_bytes_bucket'
+        action: drop
+      - sourceLabels: [__name__]
+        regex: 'apiserver_response_sizes_bucket'
+        action: drop
+      - sourceLabels: [__name__]
+        regex: 'etcd_request_duration_seconds_bucket'
+        action: drop
+
+alertmanager:
+  config:
+    global:
+      smtp_from: ${config.smtp.from}
+      smtp_smarthost: ${config.smtp.host}:${config.smtp.port}
+      smtp_require_tls: ${config.smtp.requireTls}
+      smtp_auth_username: ${config.smtp.username || config.smtp.from}
+      smtp_auth_password: ${config.smtp.password || ''}
+    route:
+      group_by: ['job']
+      group_wait: 30s
+      group_interval: 5m
+      repeat_interval: 1h
+      receiver: email
+      routes:
+      - match:
+          alertname: Watchdog
+        receiver: 'null'
+      - match:
+          alertname: CPUThrottlingHigh
+        receiver: 'null'
+      - match:
+          alertname: KubeMemoryOvercommit
+        receiver: 'null'
+      - match:
+          alertname: KubeCPUOvercommit
+        receiver: 'null'
+      - match:
+          alertname: KubeletTooManyPods
+        receiver: 'null'
+
+    receivers:
+    - name: 'null'
+    - name: email
+      email_configs:
+      - send_resolved: true
+        to: ${config.smtp.from}
+
+    # Inhibition rules allow to mute a set of alerts given that another alert is firing.
+    # We use this to mute any warning-level notifications if the same alert is already critical.
+    inhibit_rules:
+    - source_match:
+        severity: 'critical'
+      target_match:
+        severity: 'warning'
+      # Apply inhibition if the alertname is the same.
+      equal: ['alertname', 'namespace']
+
+  alertmanagerSpec:
+    replicas: ${config.replicas.alertmanager}
+    podAntiAffinity: "soft"
+    storage:
+      volumeClaimTemplate:
+        spec:
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: ${config.storage.alertmanager}
+    resources:
+      limits:
+        cpu: ${config.resources.alertmanager.limits.cpu}
+        memory: ${config.resources.alertmanager.limits.memory}
+      requests:
+        cpu: ${config.resources.alertmanager.requests.cpu}
+        memory: ${config.resources.alertmanager.requests.memory}
+    priorityClassName: high-priority
+
+    # Sidecar containers resource requests (added 2025-11-18)
+    containers:
+    - name: config-reloader
+      resources:
+        requests:
+          cpu: ${config.resources.configReloader.requests.cpu}
+          memory: ${config.resources.configReloader.requests.memory}
+        limits:
+          cpu: ${config.resources.configReloader.limits.cpu}
+          memory: ${config.resources.configReloader.limits.memory}
+
+
+prometheus:
+  # Enable Thanos service for gRPC communication
+  # Required for Helm chart to properly render Thanos sidecar configuration
+  thanosService:
+    enabled: true
+
+  prometheusSpec:
+    retention: ${config.retention.prometheus}  # Reduced from 7d - Thanos provides long-term storage in S3
+
+    # Discover ALL ServiceMonitors and PodMonitors in ALL namespaces
+    # Setting NilUsesHelmValues: false means nil selectors = "select all"
+    # Empty namespace selectors {} mean "search all namespaces"
+    # Note: This does NOT affect Thanos sidecar - controlled by thanos.objectStorageConfig
+    serviceMonitorSelectorNilUsesHelmValues: false
+    podMonitorSelectorNilUsesHelmValues: false
+    serviceMonitorNamespaceSelector: {}
+    podMonitorNamespaceSelector: {}
+
+    replicas: ${config.replicas.prometheus}
+    podAntiAffinity: "hard"
+    storageSpec:
+      volumeClaimTemplate:
+        spec:
+          storageClassName: longhorn
+          accessModes: ["ReadWriteOnce"]
+          resources:
+            requests:
+              storage: ${config.storage.prometheus}  # Reduced from 6Gi (3d retention needs less space)
+
+    resources:
+      limits:
+        cpu: ${config.resources.prometheus.limits.cpu}
+        memory: ${config.resources.prometheus.limits.memory}
+      requests:
+        cpu: ${config.resources.prometheus.requests.cpu}
+        memory: ${config.resources.prometheus.requests.memory}
+    priorityClassName: high-priority
+
+    # External labels for multi-cluster identification and Thanos
+    externalLabels:
+      cluster: kup6s
+      replica: "$(POD_NAME)"
+
+    # Thanos sidecar for long-term metrics storage in S3
+    # NOTE: chart >=85.x requires the existingSecret shape. The legacy flat
+    # {name, key} form is silently dropped by the chart, which removes the
+    # sidecar and stops all S3 block uploads (regression seen 2026-03-31).
+    thanos:
+      objectStorageConfig:
+        existingSecret:
+          name: thanos-objstore-config  # ESO-managed secret
+          key: objstore.yml
+
+    # Sidecar containers resource requests (added 2025-11-18)
+    # NOTE: thanos-sidecar is NOT listed here - it's automatically injected by Prometheus Operator
+    # when thanos.objectStorageConfig is set. Specifying it in containers[] would override
+    # the operator's definition and require us to manually specify the image, which breaks
+    # when the operator updates the thanos version.
+    containers:
+    - name: config-reloader
+      resources:
+        requests:
+          cpu: ${config.resources.configReloader.requests.cpu}
+          memory: ${config.resources.configReloader.requests.memory}
+        limits:
+          cpu: ${config.resources.configReloader.limits.cpu}
+          memory: ${config.resources.configReloader.limits.memory}
+
+    service:
+      sessionAffinity: "ClientIP"
+
+
+grafana:
+  # Recreate strategy is required because the storage PVC is RWO:
+  # a RollingUpdate would surge a second pod that cannot mount the
+  # volume (FailedAttachVolume), blocking the rollout indefinitely.
+  deploymentStrategy:
+    type: Recreate
+
+  # Use existing secret for admin credentials (managed by ESO)
+  # This prevents password regeneration on Helm upgrades
+  admin:
+    existingSecret: "grafana-admin-credentials"
+    userKey: "admin-user"
+    passwordKey: "admin-password"
+
+  # Disable default Prometheus datasource (we provide our own pointing to Thanos Query)
+  defaultDatasourceEnabled: false
+
+  # Sidecar containers for dashboard/datasource provisioning
+  sidecar:
+    resources:
+      requests:
+        cpu: 10m
+        memory: 256Mi
+      limits:
+        cpu: 100m
+        memory: 512Mi
+    dashboards:
+      enabled: true
+    datasources:
+      enabled: false  # We manually provision datasources (Prometheus→Thanos, Loki)
+
+  ingress:
+    enabled: true
+    hosts:
+      - ${config.domains.grafana}
+    annotations:
+      cert-manager.io/cluster-issuer: "letsencrypt-cluster-issuer"
+      traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    tls:
+      - secretName: grafana-general-tls
+        hosts:
+        - ${config.domains.grafana}
+
+  resources:
+    limits:
+      cpu: ${config.resources.grafana.limits.cpu}
+      memory: ${config.resources.grafana.limits.memory}
+    requests:
+      cpu: ${config.resources.grafana.requests.cpu}
+      memory: ${config.resources.grafana.requests.memory}
+
+  readinessProbe:
+    httpGet:
+      path: /api/health
+      port: 3000
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 3
+
+  livenessProbe:
+    httpGet:
+      path: /api/health
+      port: 3000
+    initialDelaySeconds: 60
+    periodSeconds: 10
+    timeoutSeconds: 30
+    failureThreshold: 10
+
+  persistence:
+    enabled: true
+    storageClassName: longhorn
+    accessModes:
+      - ReadWriteOnce
+    size: ${config.storage.grafana}
+
+  # Manual datasource provisioning (sidecar disabled)
+  # Thanos Query → long-term/historical metrics (S3 via Store + live sidecar), default
+  # Prometheus → local, recent/high-res only (kept for low-latency recent queries)
+  # Loki for log aggregation
+  datasources:
+    datasources.yaml:
+      apiVersion: 1
+      # Delete any pre-existing Loki datasource (e.g. one created with a
+      # randomly generated UID before we pinned uid: loki). Without this,
+      # Grafana fails provisioning with "data source not found" because
+      # the upsert collides with the existing entry.
+      deleteDatasources:
+      - name: Loki
+        orgId: 1
+      datasources:
+      - name: Thanos
+        type: prometheus
+        uid: thanos
+        access: proxy
+        # thanos-query Service: http port 9090 -> container http 10902
+        url: http://thanos-query.${config.namespace}.svc.cluster.local:9090
+        isDefault: true
+        jsonData:
+          timeInterval: 30s
+      - name: Prometheus
+        type: prometheus
+        uid: prometheus
+        access: proxy
+        url: http://kube-prometheus-stack-prometheus.${config.namespace}.svc.cluster.local:9090
+        isDefault: false
+        jsonData:
+          timeInterval: 30s
+      - name: Loki
+        type: loki
+        uid: loki
+        access: proxy
+        url: http://loki-gateway.${config.namespace}.svc.cluster.local
+        jsonData:
+          maxLines: 1000
+
+prometheusOperator:
+  resources:
+    limits:
+      cpu: 1
+      memory: 512Mi
+    requests:
+      cpu: 50m
+      memory: 128Mi
+  priorityClassName: high-priority
+
+prometheus-node-exporter:
+  # Bind :9100 to the node InternalIP only, not 0.0.0.0. With kubeRBACProxy
+  # disabled the sub-chart sets HOST_IP from fieldRef status.hostIP, which is
+  # the node's InternalIP (EX: vSwitch 10.6.0.x via --node-ip; cloud: hcloud
+  # private IP). node-exporter is hostNetwork, so Prometheus already scrapes
+  # that InternalIP endpoint -> scraping is unaffected, only the public-NIC
+  # exposure of the unauthenticated metrics on the EX public IPs goes away.
+  service:
+    listenOnAllInterfaces: false
+  resources:
+    limits:
+      cpu: 50m
+      memory: 50Mi
+    requests:
+      cpu: 5m
+      memory: 16Mi
+  priorityClassName: high-priority
+
+kube-state-metrics:
+  resources:
+    limits:
+      cpu: 1
+      memory: 512Mi
+    requests:
+      cpu: 5m
+      memory: 128Mi
+  priorityClassName: high-priority
+`;
+    }
+}
+exports.PrometheusStackConstruct = PrometheusStackConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvbWV0aGV1cy1zdGFjay5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb25zdHJ1Y3RzL3Byb21ldGhldXMtc3RhY2sudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsaUNBQWtDO0FBQ2xDLDJDQUF1QztBQVF2Qzs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW1CRztBQUNILE1BQWEsd0JBQXlCLFNBQVEsc0JBQVM7SUFDckQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUEyQjtRQUNuRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRWpCLE1BQU0sRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLEdBQUcsS0FBSyxDQUFDO1FBRXBDLDRCQUE0QjtRQUM1QixNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsTUFBTSxDQUFDLENBQUM7UUFFbkQsa0RBQWtEO1FBQ2xELDJDQUEyQztRQUMzQyxJQUFJLGlCQUFTLENBQUMsSUFBSSxFQUFFLHVCQUF1QixFQUFFO1lBQzNDLFVBQVUsRUFBRSxtQkFBbUI7WUFDL0IsSUFBSSxFQUFFLFdBQVc7WUFDakIsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSx1QkFBdUI7Z0JBQzdCLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsdUJBQXVCO29CQUNqRCw2QkFBNkIsRUFBRSxZQUFZO29CQUMzQyw4QkFBOEIsRUFBRSxPQUFPO29CQUN2QywyQkFBMkIsRUFBRSxZQUFZO2lCQUMxQztnQkFDRCxXQUFXLEVBQUU7b0JBQ1gsOEJBQThCLEVBQUUsR0FBRztpQkFDcEM7YUFDRjtZQUNELElBQUksRUFBRTtnQkFDSixJQUFJLEVBQUUsb0RBQW9EO2dCQUMxRCxLQUFLLEVBQUUsdUJBQXVCO2dCQUM5QixPQUFPLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxlQUFlLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsZUFBZTtnQkFDbkcsZUFBZSxFQUFFLFNBQVM7Z0JBQzFCLGFBQWEsRUFBRSxVQUFVO2FBQzFCO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLGtCQUFrQixDQUFDLE1BQXdCO1FBQ2pELE9BQU87Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7bUJBZ0hRLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSTt3QkFDWCxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUk7MEJBQ2xDLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVTs0QkFDcEIsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJOzRCQUN4QyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsSUFBSSxFQUFFOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztjQTZCeEMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJOzs7Ozs7Ozs7Ozs7O2dCQWFkLE1BQU0sQ0FBQyxRQUFRLENBQUMsWUFBWTs7Ozs7Ozs7eUJBUW5CLE1BQU0sQ0FBQyxPQUFPLENBQUMsWUFBWTs7O2VBR3JDLE1BQU0sQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxHQUFHO2tCQUNyQyxNQUFNLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsTUFBTTs7ZUFFOUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEdBQUc7a0JBQ3ZDLE1BQU0sQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxNQUFNOzs7Ozs7OztpQkFROUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEdBQUc7b0JBQ3pDLE1BQU0sQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxNQUFNOztpQkFFbEQsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLEdBQUc7b0JBQ3ZDLE1BQU0sQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxNQUFNOzs7Ozs7Ozs7O2lCQVVoRCxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVU7Ozs7Ozs7Ozs7O2dCQVc1QixNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVU7Ozs7Ozs7Ozt5QkFTakIsTUFBTSxDQUFDLE9BQU8sQ0FBQyxVQUFVOzs7O2VBSW5DLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxHQUFHO2tCQUNuQyxNQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTTs7ZUFFNUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUc7a0JBQ3JDLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7aUJBMkI1QyxNQUFNLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsR0FBRztvQkFDekMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLE1BQU07O2lCQUVsRCxNQUFNLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsR0FBRztvQkFDdkMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLE1BQU07Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7VUF3Q3ZELE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTzs7Ozs7OztZQU9wQixNQUFNLENBQUMsT0FBTyxDQUFDLE9BQU87Ozs7YUFJckIsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEdBQUc7Z0JBQ2hDLE1BQU0sQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxNQUFNOzthQUV6QyxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRztnQkFDbEMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU07Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7WUF5QjVDLE1BQU0sQ0FBQyxPQUFPLENBQUMsT0FBTzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OzttQ0FzQkMsTUFBTSxDQUFDLFNBQVM7Ozs7Ozs7O3VEQVFJLE1BQU0sQ0FBQyxTQUFTOzs7Ozs7OzttQ0FRcEMsTUFBTSxDQUFDLFNBQVM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0NBeUNsRCxDQUFDO0lBQ0EsQ0FBQztDQUNGO0FBcmNELDREQXFjQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IEFwaU9iamVjdCB9IGZyb20gJ2NkazhzJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgTW9uaXRvcmluZ0NvbmZpZyB9IGZyb20gJy4uL3R5cGVzJztcblxuZXhwb3J0IGludGVyZmFjZSBQcm9tZXRoZXVzU3RhY2tQcm9wcyB7XG4gIG5hbWVzcGFjZTogc3RyaW5nO1xuICBjb25maWc6IE1vbml0b3JpbmdDb25maWc7XG59XG5cbi8qKlxuICogQ3JlYXRlcyBrdWJlLXByb21ldGhldXMtc3RhY2sgSGVsbUNoYXJ0IHdpdGggUHJvbWV0aGV1cywgR3JhZmFuYSwgYW5kIEFsZXJ0bWFuYWdlci5cbiAqXG4gKiBUaGlzIGlzIHRoZSBjb3JlIG1vbml0b3Jpbmcgc3RhY2sgdGhhdCBpbmNsdWRlczpcbiAqIC0gUHJvbWV0aGV1cyAobWV0cmljcyBjb2xsZWN0aW9uLCAyIHJlcGxpY2FzLCAzZCByZXRlbnRpb24pXG4gKiAtIEdyYWZhbmEgKHZpc3VhbGl6YXRpb24sIGluZ3Jlc3Mgd2l0aCBMZXQncyBFbmNyeXB0KVxuICogLSBBbGVydG1hbmFnZXIgKGFsZXJ0IHJvdXRpbmcsIFNNVFAgbm90aWZpY2F0aW9ucylcbiAqIC0gUHJvbWV0aGV1cyBPcGVyYXRvciAobWFuYWdlcyBQcm9tZXRoZXVzIENSRHMpXG4gKiAtIE5vZGUgRXhwb3J0ZXIgKHN5c3RlbSBtZXRyaWNzIERhZW1vblNldClcbiAqIC0ga3ViZS1zdGF0ZS1tZXRyaWNzIChLdWJlcm5ldGVzIHJlc291cmNlIG1ldHJpY3MpXG4gKlxuICogUHJlcmVxdWlzaXRlczpcbiAqIC0gTmFtZXNwYWNlIGV4aXN0c1xuICogLSBQcmlvcml0eUNsYXNzICdoaWdoLXByaW9yaXR5JyBleGlzdHNcbiAqIC0gTG9uZ2hvcm4gc3RvcmFnZSBjbGFzcyBhdmFpbGFibGVcbiAqIC0gY2VydC1tYW5hZ2VyIENsdXN0ZXJJc3N1ZXIgY29uZmlndXJlZFxuICogLSBUaGFub3MgUzMgc2VjcmV0IGV4aXN0cyAodGhhbm9zLW9ianN0b3JlLWNvbmZpZylcbiAqXG4gKiBTeW5jIFdhdmU6IDIgKGNvcmUgc2VydmljZXMgLSBhZnRlciBTMyBidWNrZXRzIGFuZCBzZWNyZXRzKVxuICovXG5leHBvcnQgY2xhc3MgUHJvbWV0aGV1c1N0YWNrQ29uc3RydWN0IGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZywgcHJvcHM6IFByb21ldGhldXNTdGFja1Byb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IHsgbmFtZXNwYWNlLCBjb25maWcgfSA9IHByb3BzO1xuXG4gICAgLy8gR2VuZXJhdGUgSGVsbSB2YWx1ZXMgWUFNTFxuICAgIGNvbnN0IGhlbG1WYWx1ZXMgPSB0aGlzLmdlbmVyYXRlSGVsbVZhbHVlcyhjb25maWcpO1xuXG4gICAgLy8gQ3JlYXRlIEhlbG1DaGFydCByZXNvdXJjZSAoSzNTIEhlbG0gY29udHJvbGxlcilcbiAgICAvLyBXYXZlIDI6IENvcmUgU2VydmljZXMgLSBtb25pdG9yaW5nIHN0YWNrXG4gICAgbmV3IEFwaU9iamVjdCh0aGlzLCAna3ViZS1wcm9tZXRoZXVzLXN0YWNrJywge1xuICAgICAgYXBpVmVyc2lvbjogJ2hlbG0uY2F0dGxlLmlvL3YxJyxcbiAgICAgIGtpbmQ6ICdIZWxtQ2hhcnQnLFxuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ2t1YmUtcHJvbWV0aGV1cy1zdGFjaycsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICdrdWJlLXByb21ldGhldXMtc3RhY2snLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9jb21wb25lbnQnOiAnbW9uaXRvcmluZycsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnknOiAnY2RrOHMnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mJzogJ21vbml0b3JpbmcnLFxuICAgICAgICB9LFxuICAgICAgICBhbm5vdGF0aW9uczoge1xuICAgICAgICAgICdhcmdvY2QuYXJnb3Byb2ouaW8vc3luYy13YXZlJzogJzInLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICAgIHNwZWM6IHtcbiAgICAgICAgcmVwbzogJ2h0dHBzOi8vcHJvbWV0aGV1cy1jb21tdW5pdHkuZ2l0aHViLmlvL2hlbG0tY2hhcnRzJyxcbiAgICAgICAgY2hhcnQ6ICdrdWJlLXByb21ldGhldXMtc3RhY2snLFxuICAgICAgICB2ZXJzaW9uOiBjb25maWcudmVyc2lvbnMucHJvbWV0aGV1c1N0YWNrID09PSAnbGF0ZXN0JyA/IHVuZGVmaW5lZCA6IGNvbmZpZy52ZXJzaW9ucy5wcm9tZXRoZXVzU3RhY2ssXG4gICAgICAgIHRhcmdldE5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICB2YWx1ZXNDb250ZW50OiBoZWxtVmFsdWVzLFxuICAgICAgfSxcbiAgICB9KTtcbiAgfVxuXG4gIHByaXZhdGUgZ2VuZXJhdGVIZWxtVmFsdWVzKGNvbmZpZzogTW9uaXRvcmluZ0NvbmZpZyk6IHN0cmluZyB7XG4gICAgcmV0dXJuIGBrdWJlRXRjZDpcbiAgZW5hYmxlZDogZmFsc2VcblxuIyBEaXNhYmxlIGt1YmUtY29udHJvbGxlci1tYW5hZ2VyIGFuZCBrdWJlLXNjaGVkdWxlciBtb25pdG9yaW5nLiBTZWUgaHR0cHM6Ly9naXRodWIuY29tL2NhYmxlc3BhZ2hldHRpL2szcy1tb25pdG9yaW5nL2lzc3Vlcy8yXG5rdWJlQ29udHJvbGxlck1hbmFnZXI6XG4gIGVuYWJsZWQ6IGZhbHNlXG5rdWJlU2NoZWR1bGVyOlxuICBlbmFibGVkOiBmYWxzZVxuXG4jIERldGVjdCBQb2REaXNydXB0aW9uQnVkZ2V0cyB0aGF0IHdvdWxkIGJsb2NrIGEgbm9kZSBkcmFpbiBkdXJpbmcgazNzIHVwZ3JhZGVzLlxuIyBPcGVyYXRvci1tYW5hZ2VkIFBEQnMgc2l0IGF0IGRpc3J1cHRpb25zQWxsb3dlZD0wIGJ5IGRlc2lnbiAoTG9uZ2hvcm4gaW5zdGFuY2UtbWFuYWdlcnMsXG4jIENOUEcgKi1wcmltYXJ5KSBhbmQgYXJlIGV4Y2x1ZGVkIHNvIHRoZSBhbGVydCBvbmx5IGZpcmVzIG9uIGFub21hbG91cyBhcHAgUERCcy5cbmFkZGl0aW9uYWxQcm9tZXRoZXVzUnVsZXNNYXA6XG4gIHBkYi1kcmFpbi1zYWZldHk6XG4gICAgZ3JvdXBzOlxuICAgICAgLSBuYW1lOiBwZGIucnVsZXNcbiAgICAgICAgaW50ZXJ2YWw6IDFtXG4gICAgICAgIHJ1bGVzOlxuICAgICAgICAgIC0gYWxlcnQ6IFBvZERpc3J1cHRpb25CdWRnZXRVbmRyYWluYWJsZVxuICAgICAgICAgICAgZXhwcjoga3ViZV9wb2RkaXNydXB0aW9uYnVkZ2V0X3N0YXR1c19wb2RfZGlzcnVwdGlvbnNfYWxsb3dlZHtuYW1lc3BhY2UhPVwibG9uZ2hvcm4tc3lzdGVtXCIsIHBvZGRpc3J1cHRpb25idWRnZXQhflwiLiotcHJpbWFyeVwifSA9PSAwXG4gICAgICAgICAgICBmb3I6IDE1bVxuICAgICAgICAgICAgbGFiZWxzOlxuICAgICAgICAgICAgICBzZXZlcml0eTogd2FybmluZ1xuICAgICAgICAgICAgICBjb21wb25lbnQ6IGNsdXN0ZXItdXBncmFkZVxuICAgICAgICAgICAgYW5ub3RhdGlvbnM6XG4gICAgICAgICAgICAgIHN1bW1hcnk6IFwiUERCIHt7ICRsYWJlbHMubmFtZXNwYWNlIH19L3t7ICRsYWJlbHMucG9kZGlzcnVwdGlvbmJ1ZGdldCB9fSBhbGxvd3MgMCB2b2x1bnRhcnkgZGlzcnVwdGlvbnNcIlxuICAgICAgICAgICAgICBkZXNjcmlwdGlvbjogfFxuICAgICAgICAgICAgICAgIFRoZSBQb2REaXNydXB0aW9uQnVkZ2V0IHt7ICRsYWJlbHMubmFtZXNwYWNlIH19L3t7ICRsYWJlbHMucG9kZGlzcnVwdGlvbmJ1ZGdldCB9fVxuICAgICAgICAgICAgICAgIGhhcyBhbGxvd2VkIDAgdm9sdW50YXJ5IGRpc3J1cHRpb25zIGZvciBvdmVyIDE1IG1pbnV0ZXMuIFRoaXMgd2lsbCBibG9jayBhIG5vZGVcbiAgICAgICAgICAgICAgICBkcmFpbiBkdXJpbmcgazNzIHVwZ3JhZGVzLiBPcGVyYXRvci1tYW5hZ2VkIFBEQnMgKExvbmdob3JuLCBDTlBHIHByaW1hcmllcykgYXJlXG4gICAgICAgICAgICAgICAgZXhjbHVkZWQgZnJvbSB0aGlzIGFsZXJ0LiBMaWtlbHkgYSBkZWdyYWRlZCBkZXBsb3ltZW50ICgwIGhlYWx0aHkgcG9kcykgb3IgYVxuICAgICAgICAgICAgICAgIHNpbmdsZS1yZXBsaWNhIGRlcGxveW1lbnQgd2l0aCBtaW5BdmFpbGFibGU9MS5cbiAgICAgICAgICAgICAgICBDaGVjazoga3ViZWN0bCBnZXQgcGRiIC1uIHt7ICRsYWJlbHMubmFtZXNwYWNlIH19IHt7ICRsYWJlbHMucG9kZGlzcnVwdGlvbmJ1ZGdldCB9fVxuICAgICAgICAgIC0gYWxlcnQ6IFBvZERpc3J1cHRpb25CdWRnZXRVbmRyYWluYWJsZUNyaXRpY2FsXG4gICAgICAgICAgICBleHByOiBrdWJlX3BvZGRpc3J1cHRpb25idWRnZXRfc3RhdHVzX3BvZF9kaXNydXB0aW9uc19hbGxvd2Vke25hbWVzcGFjZSE9XCJsb25naG9ybi1zeXN0ZW1cIiwgcG9kZGlzcnVwdGlvbmJ1ZGdldCF+XCIuKi1wcmltYXJ5XCJ9ID09IDBcbiAgICAgICAgICAgIGZvcjogMWhcbiAgICAgICAgICAgIGxhYmVsczpcbiAgICAgICAgICAgICAgc2V2ZXJpdHk6IGNyaXRpY2FsXG4gICAgICAgICAgICAgIGNvbXBvbmVudDogY2x1c3Rlci11cGdyYWRlXG4gICAgICAgICAgICBhbm5vdGF0aW9uczpcbiAgICAgICAgICAgICAgc3VtbWFyeTogXCJQREIge3sgJGxhYmVscy5uYW1lc3BhY2UgfX0ve3sgJGxhYmVscy5wb2RkaXNydXB0aW9uYnVkZ2V0IH19IHVuZHJhaW5hYmxlID4xaFwiXG4gICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiB8XG4gICAgICAgICAgICAgICAgUERCIHt7ICRsYWJlbHMubmFtZXNwYWNlIH19L3t7ICRsYWJlbHMucG9kZGlzcnVwdGlvbmJ1ZGdldCB9fSBoYXMgYmxvY2tlZFxuICAgICAgICAgICAgICAgIHZvbHVudGFyeSBkaXNydXB0aW9ucyBmb3Igb3ZlciBhbiBob3VyLiBBIGszcyBhZ2VudCB1cGdyYWRlIHdvdWxkIHN0YWxsIG9uIHRoaXMgbm9kZS5cbiAgIyBEZXRlY3QgYW4gRVggZGVkaWNhdGVkIHdvcmtlciBzdHVjayBOb3RSZWFkeSDigJQgbGlrZWx5IGEgTWljcm9PUyByZWJvb3QgaGFuZ1xuICAjIChwaW5ncyBidXQgc3NoZC9rdWJlbGV0IGRlYWQpLiBBIGh1bmcgbm9kZSBhbHNvIGhvbGRzIHRoZSBjbHVzdGVyLXdpZGUga3VyZWRcbiAgIyBsb2NrLCBibG9ja2luZyBhbGwgZnVydGhlciBncmFjZWZ1bCByZWJvb3RzLCBzbyB0aGlzIG11c3QgYmUgY2F1Z2h0IGZhc3QuXG4gIGV4LXdvcmtlci1yZWJvb3Q6XG4gICAgZ3JvdXBzOlxuICAgICAgLSBuYW1lOiBleC13b3JrZXIucnVsZXNcbiAgICAgICAgaW50ZXJ2YWw6IDFtXG4gICAgICAgIHJ1bGVzOlxuICAgICAgICAgIC0gYWxlcnQ6IEV4V29ya2VyTm90UmVhZHlcbiAgICAgICAgICAgIGV4cHI6IGt1YmVfbm9kZV9zdGF0dXNfY29uZGl0aW9ue2NvbmRpdGlvbj1cIlJlYWR5XCIsc3RhdHVzPVwidHJ1ZVwiLG5vZGU9flwia3VwNnMtZXgtLipcIn0gPT0gMFxuICAgICAgICAgICAgZm9yOiAxNW1cbiAgICAgICAgICAgIGxhYmVsczpcbiAgICAgICAgICAgICAgc2V2ZXJpdHk6IGNyaXRpY2FsXG4gICAgICAgICAgICAgIGNvbXBvbmVudDogbm9kZVxuICAgICAgICAgICAgYW5ub3RhdGlvbnM6XG4gICAgICAgICAgICAgIHN1bW1hcnk6IFwiRVggd29ya2VyIHt7ICRsYWJlbHMubm9kZSB9fSBOb3RSZWFkeSBmb3IgPjE1bVwiXG4gICAgICAgICAgICAgIGRlc2NyaXB0aW9uOiB8XG4gICAgICAgICAgICAgICAgRVggZGVkaWNhdGVkIHdvcmtlciB7eyAkbGFiZWxzLm5vZGUgfX0gaGFzIGJlZW4gTm90UmVhZHkgZm9yIG92ZXIgMTUgbWludXRlcy5cbiAgICAgICAgICAgICAgICBQb3NzaWJsZSBNaWNyb09TIHJlYm9vdCBoYW5nIChwaW5ncyBidXQgc3NoZC9rdWJlbGV0L2xvbmdob3JuLW1hbmFnZXIgZGVhZCkg4oCUIHRoZVxuICAgICAgICAgICAgICAgIG5vZGUgbWF5IHN0aWxsIGhvbGQgdGhlIGNsdXN0ZXItd2lkZSBrdXJlZCBsb2NrLCBibG9ja2luZyBhbGwgZnVydGhlciByZWJvb3RzLlxuICAgICAgICAgICAgICAgIFJlY292ZXJ5OiBIZXR6bmVyIFJvYm90IGhhcmR3YXJlIHJlc2V0LiBEbyBOT1QgZm9yY2UtZGV0YWNoIExvbmdob3JuIHZvbHVtZXMuXG4gICAgICAgICAgICAgIHJ1bmJvb2tfdXJsOiBcImh0dHBzOi8vZG9jcy5rdXA2cy5jb20vaG93LXRvL3Ryb3VibGVzaG9vdGluZy9leC13b3JrZXItcGluZy1idXQtZGVhZC5odG1sXCJcblxuIyBEcm9wIGhpZ2gtY2FyZGluYWxpdHkgQVBJIHNlcnZlciBhbmQgZXRjZCBoaXN0b2dyYW0gYnVja2V0cyB0byByZWR1Y2UgbWVtb3J5IHVzYWdlXG4jIFRoZXNlIG1ldHJpY3MgYWxvbmUgYWNjb3VudCBmb3IgfjIwMGsgc2VyaWVzICg0NyUgb2YgdG90YWwgY2FyZGluYWxpdHkpXG4jIFdlIGtlZXAgX3N1bSBhbmQgX2NvdW50IHN1ZmZpeGVzIHdoaWNoIGFyZSBzdWZmaWNpZW50IGZvciByYXRlIGNhbGN1bGF0aW9uc1xua3ViZUFwaVNlcnZlcjpcbiAgc2VydmljZU1vbml0b3I6XG4gICAgbWV0cmljUmVsYWJlbGluZ3M6XG4gICAgICAtIHNvdXJjZUxhYmVsczogW19fbmFtZV9fXVxuICAgICAgICByZWdleDogJ2FwaXNlcnZlcl9yZXF1ZXN0X2R1cmF0aW9uX3NlY29uZHNfYnVja2V0J1xuICAgICAgICBhY3Rpb246IGRyb3BcbiAgICAgIC0gc291cmNlTGFiZWxzOiBbX19uYW1lX19dXG4gICAgICAgIHJlZ2V4OiAnYXBpc2VydmVyX3JlcXVlc3Rfc2xpX2R1cmF0aW9uX3NlY29uZHNfYnVja2V0J1xuICAgICAgICBhY3Rpb246IGRyb3BcbiAgICAgIC0gc291cmNlTGFiZWxzOiBbX19uYW1lX19dXG4gICAgICAgIHJlZ2V4OiAnYXBpc2VydmVyX3JlcXVlc3RfYm9keV9zaXplX2J5dGVzX2J1Y2tldCdcbiAgICAgICAgYWN0aW9uOiBkcm9wXG4gICAgICAtIHNvdXJjZUxhYmVsczogW19fbmFtZV9fXVxuICAgICAgICByZWdleDogJ2FwaXNlcnZlcl9yZXNwb25zZV9zaXplc19idWNrZXQnXG4gICAgICAgIGFjdGlvbjogZHJvcFxuICAgICAgLSBzb3VyY2VMYWJlbHM6IFtfX25hbWVfX11cbiAgICAgICAgcmVnZXg6ICdldGNkX3JlcXVlc3RfZHVyYXRpb25fc2Vjb25kc19idWNrZXQnXG4gICAgICAgIGFjdGlvbjogZHJvcFxuXG4jIEt1YmVsZXQgYWxzbyBleHBvc2VzIGFwaXNlcnZlciBtZXRyaWNzIC0gYXBwbHkgc2FtZSBmaWx0ZXJzXG5rdWJlbGV0OlxuICBzZXJ2aWNlTW9uaXRvcjpcbiAgICBtZXRyaWNSZWxhYmVsaW5nczpcbiAgICAgIC0gc291cmNlTGFiZWxzOiBbX19uYW1lX19dXG4gICAgICAgIHJlZ2V4OiAnYXBpc2VydmVyX3JlcXVlc3RfZHVyYXRpb25fc2Vjb25kc19idWNrZXQnXG4gICAgICAgIGFjdGlvbjogZHJvcFxuICAgICAgLSBzb3VyY2VMYWJlbHM6IFtfX25hbWVfX11cbiAgICAgICAgcmVnZXg6ICdhcGlzZXJ2ZXJfcmVxdWVzdF9zbGlfZHVyYXRpb25fc2Vjb25kc19idWNrZXQnXG4gICAgICAgIGFjdGlvbjogZHJvcFxuICAgICAgLSBzb3VyY2VMYWJlbHM6IFtfX25hbWVfX11cbiAgICAgICAgcmVnZXg6ICdhcGlzZXJ2ZXJfcmVxdWVzdF9ib2R5X3NpemVfYnl0ZXNfYnVja2V0J1xuICAgICAgICBhY3Rpb246IGRyb3BcbiAgICAgIC0gc291cmNlTGFiZWxzOiBbX19uYW1lX19dXG4gICAgICAgIHJlZ2V4OiAnYXBpc2VydmVyX3Jlc3BvbnNlX3NpemVzX2J1Y2tldCdcbiAgICAgICAgYWN0aW9uOiBkcm9wXG4gICAgICAtIHNvdXJjZUxhYmVsczogW19fbmFtZV9fXVxuICAgICAgICByZWdleDogJ2V0Y2RfcmVxdWVzdF9kdXJhdGlvbl9zZWNvbmRzX2J1Y2tldCdcbiAgICAgICAgYWN0aW9uOiBkcm9wXG5cbmFsZXJ0bWFuYWdlcjpcbiAgY29uZmlnOlxuICAgIGdsb2JhbDpcbiAgICAgIHNtdHBfZnJvbTogJHtjb25maWcuc210cC5mcm9tfVxuICAgICAgc210cF9zbWFydGhvc3Q6ICR7Y29uZmlnLnNtdHAuaG9zdH06JHtjb25maWcuc210cC5wb3J0fVxuICAgICAgc210cF9yZXF1aXJlX3RsczogJHtjb25maWcuc210cC5yZXF1aXJlVGxzfVxuICAgICAgc210cF9hdXRoX3VzZXJuYW1lOiAke2NvbmZpZy5zbXRwLnVzZXJuYW1lIHx8IGNvbmZpZy5zbXRwLmZyb219XG4gICAgICBzbXRwX2F1dGhfcGFzc3dvcmQ6ICR7Y29uZmlnLnNtdHAucGFzc3dvcmQgfHwgJyd9XG4gICAgcm91dGU6XG4gICAgICBncm91cF9ieTogWydqb2InXVxuICAgICAgZ3JvdXBfd2FpdDogMzBzXG4gICAgICBncm91cF9pbnRlcnZhbDogNW1cbiAgICAgIHJlcGVhdF9pbnRlcnZhbDogMWhcbiAgICAgIHJlY2VpdmVyOiBlbWFpbFxuICAgICAgcm91dGVzOlxuICAgICAgLSBtYXRjaDpcbiAgICAgICAgICBhbGVydG5hbWU6IFdhdGNoZG9nXG4gICAgICAgIHJlY2VpdmVyOiAnbnVsbCdcbiAgICAgIC0gbWF0Y2g6XG4gICAgICAgICAgYWxlcnRuYW1lOiBDUFVUaHJvdHRsaW5nSGlnaFxuICAgICAgICByZWNlaXZlcjogJ251bGwnXG4gICAgICAtIG1hdGNoOlxuICAgICAgICAgIGFsZXJ0bmFtZTogS3ViZU1lbW9yeU92ZXJjb21taXRcbiAgICAgICAgcmVjZWl2ZXI6ICdudWxsJ1xuICAgICAgLSBtYXRjaDpcbiAgICAgICAgICBhbGVydG5hbWU6IEt1YmVDUFVPdmVyY29tbWl0XG4gICAgICAgIHJlY2VpdmVyOiAnbnVsbCdcbiAgICAgIC0gbWF0Y2g6XG4gICAgICAgICAgYWxlcnRuYW1lOiBLdWJlbGV0VG9vTWFueVBvZHNcbiAgICAgICAgcmVjZWl2ZXI6ICdudWxsJ1xuXG4gICAgcmVjZWl2ZXJzOlxuICAgIC0gbmFtZTogJ251bGwnXG4gICAgLSBuYW1lOiBlbWFpbFxuICAgICAgZW1haWxfY29uZmlnczpcbiAgICAgIC0gc2VuZF9yZXNvbHZlZDogdHJ1ZVxuICAgICAgICB0bzogJHtjb25maWcuc210cC5mcm9tfVxuXG4gICAgIyBJbmhpYml0aW9uIHJ1bGVzIGFsbG93IHRvIG11dGUgYSBzZXQgb2YgYWxlcnRzIGdpdmVuIHRoYXQgYW5vdGhlciBhbGVydCBpcyBmaXJpbmcuXG4gICAgIyBXZSB1c2UgdGhpcyB0byBtdXRlIGFueSB3YXJuaW5nLWxldmVsIG5vdGlmaWNhdGlvbnMgaWYgdGhlIHNhbWUgYWxlcnQgaXMgYWxyZWFkeSBjcml0aWNhbC5cbiAgICBpbmhpYml0X3J1bGVzOlxuICAgIC0gc291cmNlX21hdGNoOlxuICAgICAgICBzZXZlcml0eTogJ2NyaXRpY2FsJ1xuICAgICAgdGFyZ2V0X21hdGNoOlxuICAgICAgICBzZXZlcml0eTogJ3dhcm5pbmcnXG4gICAgICAjIEFwcGx5IGluaGliaXRpb24gaWYgdGhlIGFsZXJ0bmFtZSBpcyB0aGUgc2FtZS5cbiAgICAgIGVxdWFsOiBbJ2FsZXJ0bmFtZScsICduYW1lc3BhY2UnXVxuXG4gIGFsZXJ0bWFuYWdlclNwZWM6XG4gICAgcmVwbGljYXM6ICR7Y29uZmlnLnJlcGxpY2FzLmFsZXJ0bWFuYWdlcn1cbiAgICBwb2RBbnRpQWZmaW5pdHk6IFwic29mdFwiXG4gICAgc3RvcmFnZTpcbiAgICAgIHZvbHVtZUNsYWltVGVtcGxhdGU6XG4gICAgICAgIHNwZWM6XG4gICAgICAgICAgYWNjZXNzTW9kZXM6IFtcIlJlYWRXcml0ZU9uY2VcIl1cbiAgICAgICAgICByZXNvdXJjZXM6XG4gICAgICAgICAgICByZXF1ZXN0czpcbiAgICAgICAgICAgICAgc3RvcmFnZTogJHtjb25maWcuc3RvcmFnZS5hbGVydG1hbmFnZXJ9XG4gICAgcmVzb3VyY2VzOlxuICAgICAgbGltaXRzOlxuICAgICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5hbGVydG1hbmFnZXIubGltaXRzLmNwdX1cbiAgICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMuYWxlcnRtYW5hZ2VyLmxpbWl0cy5tZW1vcnl9XG4gICAgICByZXF1ZXN0czpcbiAgICAgICAgY3B1OiAke2NvbmZpZy5yZXNvdXJjZXMuYWxlcnRtYW5hZ2VyLnJlcXVlc3RzLmNwdX1cbiAgICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMuYWxlcnRtYW5hZ2VyLnJlcXVlc3RzLm1lbW9yeX1cbiAgICBwcmlvcml0eUNsYXNzTmFtZTogaGlnaC1wcmlvcml0eVxuXG4gICAgIyBTaWRlY2FyIGNvbnRhaW5lcnMgcmVzb3VyY2UgcmVxdWVzdHMgKGFkZGVkIDIwMjUtMTEtMTgpXG4gICAgY29udGFpbmVyczpcbiAgICAtIG5hbWU6IGNvbmZpZy1yZWxvYWRlclxuICAgICAgcmVzb3VyY2VzOlxuICAgICAgICByZXF1ZXN0czpcbiAgICAgICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5jb25maWdSZWxvYWRlci5yZXF1ZXN0cy5jcHV9XG4gICAgICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMuY29uZmlnUmVsb2FkZXIucmVxdWVzdHMubWVtb3J5fVxuICAgICAgICBsaW1pdHM6XG4gICAgICAgICAgY3B1OiAke2NvbmZpZy5yZXNvdXJjZXMuY29uZmlnUmVsb2FkZXIubGltaXRzLmNwdX1cbiAgICAgICAgICBtZW1vcnk6ICR7Y29uZmlnLnJlc291cmNlcy5jb25maWdSZWxvYWRlci5saW1pdHMubWVtb3J5fVxuXG5cbnByb21ldGhldXM6XG4gICMgRW5hYmxlIFRoYW5vcyBzZXJ2aWNlIGZvciBnUlBDIGNvbW11bmljYXRpb25cbiAgIyBSZXF1aXJlZCBmb3IgSGVsbSBjaGFydCB0byBwcm9wZXJseSByZW5kZXIgVGhhbm9zIHNpZGVjYXIgY29uZmlndXJhdGlvblxuICB0aGFub3NTZXJ2aWNlOlxuICAgIGVuYWJsZWQ6IHRydWVcblxuICBwcm9tZXRoZXVzU3BlYzpcbiAgICByZXRlbnRpb246ICR7Y29uZmlnLnJldGVudGlvbi5wcm9tZXRoZXVzfSAgIyBSZWR1Y2VkIGZyb20gN2QgLSBUaGFub3MgcHJvdmlkZXMgbG9uZy10ZXJtIHN0b3JhZ2UgaW4gUzNcblxuICAgICMgRGlzY292ZXIgQUxMIFNlcnZpY2VNb25pdG9ycyBhbmQgUG9kTW9uaXRvcnMgaW4gQUxMIG5hbWVzcGFjZXNcbiAgICAjIFNldHRpbmcgTmlsVXNlc0hlbG1WYWx1ZXM6IGZhbHNlIG1lYW5zIG5pbCBzZWxlY3RvcnMgPSBcInNlbGVjdCBhbGxcIlxuICAgICMgRW1wdHkgbmFtZXNwYWNlIHNlbGVjdG9ycyB7fSBtZWFuIFwic2VhcmNoIGFsbCBuYW1lc3BhY2VzXCJcbiAgICAjIE5vdGU6IFRoaXMgZG9lcyBOT1QgYWZmZWN0IFRoYW5vcyBzaWRlY2FyIC0gY29udHJvbGxlZCBieSB0aGFub3Mub2JqZWN0U3RvcmFnZUNvbmZpZ1xuICAgIHNlcnZpY2VNb25pdG9yU2VsZWN0b3JOaWxVc2VzSGVsbVZhbHVlczogZmFsc2VcbiAgICBwb2RNb25pdG9yU2VsZWN0b3JOaWxVc2VzSGVsbVZhbHVlczogZmFsc2VcbiAgICBzZXJ2aWNlTW9uaXRvck5hbWVzcGFjZVNlbGVjdG9yOiB7fVxuICAgIHBvZE1vbml0b3JOYW1lc3BhY2VTZWxlY3Rvcjoge31cblxuICAgIHJlcGxpY2FzOiAke2NvbmZpZy5yZXBsaWNhcy5wcm9tZXRoZXVzfVxuICAgIHBvZEFudGlBZmZpbml0eTogXCJoYXJkXCJcbiAgICBzdG9yYWdlU3BlYzpcbiAgICAgIHZvbHVtZUNsYWltVGVtcGxhdGU6XG4gICAgICAgIHNwZWM6XG4gICAgICAgICAgc3RvcmFnZUNsYXNzTmFtZTogbG9uZ2hvcm5cbiAgICAgICAgICBhY2Nlc3NNb2RlczogW1wiUmVhZFdyaXRlT25jZVwiXVxuICAgICAgICAgIHJlc291cmNlczpcbiAgICAgICAgICAgIHJlcXVlc3RzOlxuICAgICAgICAgICAgICBzdG9yYWdlOiAke2NvbmZpZy5zdG9yYWdlLnByb21ldGhldXN9ICAjIFJlZHVjZWQgZnJvbSA2R2kgKDNkIHJldGVudGlvbiBuZWVkcyBsZXNzIHNwYWNlKVxuXG4gICAgcmVzb3VyY2VzOlxuICAgICAgbGltaXRzOlxuICAgICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5wcm9tZXRoZXVzLmxpbWl0cy5jcHV9XG4gICAgICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLnByb21ldGhldXMubGltaXRzLm1lbW9yeX1cbiAgICAgIHJlcXVlc3RzOlxuICAgICAgICBjcHU6ICR7Y29uZmlnLnJlc291cmNlcy5wcm9tZXRoZXVzLnJlcXVlc3RzLmNwdX1cbiAgICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMucHJvbWV0aGV1cy5yZXF1ZXN0cy5tZW1vcnl9XG4gICAgcHJpb3JpdHlDbGFzc05hbWU6IGhpZ2gtcHJpb3JpdHlcblxuICAgICMgRXh0ZXJuYWwgbGFiZWxzIGZvciBtdWx0aS1jbHVzdGVyIGlkZW50aWZpY2F0aW9uIGFuZCBUaGFub3NcbiAgICBleHRlcm5hbExhYmVsczpcbiAgICAgIGNsdXN0ZXI6IGt1cDZzXG4gICAgICByZXBsaWNhOiBcIiQoUE9EX05BTUUpXCJcblxuICAgICMgVGhhbm9zIHNpZGVjYXIgZm9yIGxvbmctdGVybSBtZXRyaWNzIHN0b3JhZ2UgaW4gUzNcbiAgICAjIE5PVEU6IGNoYXJ0ID49ODUueCByZXF1aXJlcyB0aGUgZXhpc3RpbmdTZWNyZXQgc2hhcGUuIFRoZSBsZWdhY3kgZmxhdFxuICAgICMge25hbWUsIGtleX0gZm9ybSBpcyBzaWxlbnRseSBkcm9wcGVkIGJ5IHRoZSBjaGFydCwgd2hpY2ggcmVtb3ZlcyB0aGVcbiAgICAjIHNpZGVjYXIgYW5kIHN0b3BzIGFsbCBTMyBibG9jayB1cGxvYWRzIChyZWdyZXNzaW9uIHNlZW4gMjAyNi0wMy0zMSkuXG4gICAgdGhhbm9zOlxuICAgICAgb2JqZWN0U3RvcmFnZUNvbmZpZzpcbiAgICAgICAgZXhpc3RpbmdTZWNyZXQ6XG4gICAgICAgICAgbmFtZTogdGhhbm9zLW9ianN0b3JlLWNvbmZpZyAgIyBFU08tbWFuYWdlZCBzZWNyZXRcbiAgICAgICAgICBrZXk6IG9ianN0b3JlLnltbFxuXG4gICAgIyBTaWRlY2FyIGNvbnRhaW5lcnMgcmVzb3VyY2UgcmVxdWVzdHMgKGFkZGVkIDIwMjUtMTEtMTgpXG4gICAgIyBOT1RFOiB0aGFub3Mtc2lkZWNhciBpcyBOT1QgbGlzdGVkIGhlcmUgLSBpdCdzIGF1dG9tYXRpY2FsbHkgaW5qZWN0ZWQgYnkgUHJvbWV0aGV1cyBPcGVyYXRvclxuICAgICMgd2hlbiB0aGFub3Mub2JqZWN0U3RvcmFnZUNvbmZpZyBpcyBzZXQuIFNwZWNpZnlpbmcgaXQgaW4gY29udGFpbmVyc1tdIHdvdWxkIG92ZXJyaWRlXG4gICAgIyB0aGUgb3BlcmF0b3IncyBkZWZpbml0aW9uIGFuZCByZXF1aXJlIHVzIHRvIG1hbnVhbGx5IHNwZWNpZnkgdGhlIGltYWdlLCB3aGljaCBicmVha3NcbiAgICAjIHdoZW4gdGhlIG9wZXJhdG9yIHVwZGF0ZXMgdGhlIHRoYW5vcyB2ZXJzaW9uLlxuICAgIGNvbnRhaW5lcnM6XG4gICAgLSBuYW1lOiBjb25maWctcmVsb2FkZXJcbiAgICAgIHJlc291cmNlczpcbiAgICAgICAgcmVxdWVzdHM6XG4gICAgICAgICAgY3B1OiAke2NvbmZpZy5yZXNvdXJjZXMuY29uZmlnUmVsb2FkZXIucmVxdWVzdHMuY3B1fVxuICAgICAgICAgIG1lbW9yeTogJHtjb25maWcucmVzb3VyY2VzLmNvbmZpZ1JlbG9hZGVyLnJlcXVlc3RzLm1lbW9yeX1cbiAgICAgICAgbGltaXRzOlxuICAgICAgICAgIGNwdTogJHtjb25maWcucmVzb3VyY2VzLmNvbmZpZ1JlbG9hZGVyLmxpbWl0cy5jcHV9XG4gICAgICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMuY29uZmlnUmVsb2FkZXIubGltaXRzLm1lbW9yeX1cblxuICAgIHNlcnZpY2U6XG4gICAgICBzZXNzaW9uQWZmaW5pdHk6IFwiQ2xpZW50SVBcIlxuXG5cbmdyYWZhbmE6XG4gICMgUmVjcmVhdGUgc3RyYXRlZ3kgaXMgcmVxdWlyZWQgYmVjYXVzZSB0aGUgc3RvcmFnZSBQVkMgaXMgUldPOlxuICAjIGEgUm9sbGluZ1VwZGF0ZSB3b3VsZCBzdXJnZSBhIHNlY29uZCBwb2QgdGhhdCBjYW5ub3QgbW91bnQgdGhlXG4gICMgdm9sdW1lIChGYWlsZWRBdHRhY2hWb2x1bWUpLCBibG9ja2luZyB0aGUgcm9sbG91dCBpbmRlZmluaXRlbHkuXG4gIGRlcGxveW1lbnRTdHJhdGVneTpcbiAgICB0eXBlOiBSZWNyZWF0ZVxuXG4gICMgVXNlIGV4aXN0aW5nIHNlY3JldCBmb3IgYWRtaW4gY3JlZGVudGlhbHMgKG1hbmFnZWQgYnkgRVNPKVxuICAjIFRoaXMgcHJldmVudHMgcGFzc3dvcmQgcmVnZW5lcmF0aW9uIG9uIEhlbG0gdXBncmFkZXNcbiAgYWRtaW46XG4gICAgZXhpc3RpbmdTZWNyZXQ6IFwiZ3JhZmFuYS1hZG1pbi1jcmVkZW50aWFsc1wiXG4gICAgdXNlcktleTogXCJhZG1pbi11c2VyXCJcbiAgICBwYXNzd29yZEtleTogXCJhZG1pbi1wYXNzd29yZFwiXG5cbiAgIyBEaXNhYmxlIGRlZmF1bHQgUHJvbWV0aGV1cyBkYXRhc291cmNlICh3ZSBwcm92aWRlIG91ciBvd24gcG9pbnRpbmcgdG8gVGhhbm9zIFF1ZXJ5KVxuICBkZWZhdWx0RGF0YXNvdXJjZUVuYWJsZWQ6IGZhbHNlXG5cbiAgIyBTaWRlY2FyIGNvbnRhaW5lcnMgZm9yIGRhc2hib2FyZC9kYXRhc291cmNlIHByb3Zpc2lvbmluZ1xuICBzaWRlY2FyOlxuICAgIHJlc291cmNlczpcbiAgICAgIHJlcXVlc3RzOlxuICAgICAgICBjcHU6IDEwbVxuICAgICAgICBtZW1vcnk6IDI1Nk1pXG4gICAgICBsaW1pdHM6XG4gICAgICAgIGNwdTogMTAwbVxuICAgICAgICBtZW1vcnk6IDUxMk1pXG4gICAgZGFzaGJvYXJkczpcbiAgICAgIGVuYWJsZWQ6IHRydWVcbiAgICBkYXRhc291cmNlczpcbiAgICAgIGVuYWJsZWQ6IGZhbHNlICAjIFdlIG1hbnVhbGx5IHByb3Zpc2lvbiBkYXRhc291cmNlcyAoUHJvbWV0aGV1c+KGklRoYW5vcywgTG9raSlcblxuICBpbmdyZXNzOlxuICAgIGVuYWJsZWQ6IHRydWVcbiAgICBob3N0czpcbiAgICAgIC0gJHtjb25maWcuZG9tYWlucy5ncmFmYW5hfVxuICAgIGFubm90YXRpb25zOlxuICAgICAgY2VydC1tYW5hZ2VyLmlvL2NsdXN0ZXItaXNzdWVyOiBcImxldHNlbmNyeXB0LWNsdXN0ZXItaXNzdWVyXCJcbiAgICAgIHRyYWVmaWsuaW5ncmVzcy5rdWJlcm5ldGVzLmlvL3JvdXRlci5lbnRyeXBvaW50czogd2Vic2VjdXJlXG4gICAgdGxzOlxuICAgICAgLSBzZWNyZXROYW1lOiBncmFmYW5hLWdlbmVyYWwtdGxzXG4gICAgICAgIGhvc3RzOlxuICAgICAgICAtICR7Y29uZmlnLmRvbWFpbnMuZ3JhZmFuYX1cblxuICByZXNvdXJjZXM6XG4gICAgbGltaXRzOlxuICAgICAgY3B1OiAke2NvbmZpZy5yZXNvdXJjZXMuZ3JhZmFuYS5saW1pdHMuY3B1fVxuICAgICAgbWVtb3J5OiAke2NvbmZpZy5yZXNvdXJjZXMuZ3JhZmFuYS5saW1pdHMubWVtb3J5fVxuICAgIHJlcXVlc3RzOlxuICAgICAgY3B1OiAke2NvbmZpZy5yZXNvdXJjZXMuZ3JhZmFuYS5yZXF1ZXN0cy5jcHV9XG4gICAgICBtZW1vcnk6ICR7Y29uZmlnLnJlc291cmNlcy5ncmFmYW5hLnJlcXVlc3RzLm1lbW9yeX1cblxuICByZWFkaW5lc3NQcm9iZTpcbiAgICBodHRwR2V0OlxuICAgICAgcGF0aDogL2FwaS9oZWFsdGhcbiAgICAgIHBvcnQ6IDMwMDBcbiAgICBpbml0aWFsRGVsYXlTZWNvbmRzOiAzMFxuICAgIHBlcmlvZFNlY29uZHM6IDEwXG4gICAgdGltZW91dFNlY29uZHM6IDVcbiAgICBmYWlsdXJlVGhyZXNob2xkOiAzXG5cbiAgbGl2ZW5lc3NQcm9iZTpcbiAgICBodHRwR2V0OlxuICAgICAgcGF0aDogL2FwaS9oZWFsdGhcbiAgICAgIHBvcnQ6IDMwMDBcbiAgICBpbml0aWFsRGVsYXlTZWNvbmRzOiA2MFxuICAgIHBlcmlvZFNlY29uZHM6IDEwXG4gICAgdGltZW91dFNlY29uZHM6IDMwXG4gICAgZmFpbHVyZVRocmVzaG9sZDogMTBcblxuICBwZXJzaXN0ZW5jZTpcbiAgICBlbmFibGVkOiB0cnVlXG4gICAgc3RvcmFnZUNsYXNzTmFtZTogbG9uZ2hvcm5cbiAgICBhY2Nlc3NNb2RlczpcbiAgICAgIC0gUmVhZFdyaXRlT25jZVxuICAgIHNpemU6ICR7Y29uZmlnLnN0b3JhZ2UuZ3JhZmFuYX1cblxuICAjIE1hbnVhbCBkYXRhc291cmNlIHByb3Zpc2lvbmluZyAoc2lkZWNhciBkaXNhYmxlZClcbiAgIyBUaGFub3MgUXVlcnkg4oaSIGxvbmctdGVybS9oaXN0b3JpY2FsIG1ldHJpY3MgKFMzIHZpYSBTdG9yZSArIGxpdmUgc2lkZWNhciksIGRlZmF1bHRcbiAgIyBQcm9tZXRoZXVzIOKGkiBsb2NhbCwgcmVjZW50L2hpZ2gtcmVzIG9ubHkgKGtlcHQgZm9yIGxvdy1sYXRlbmN5IHJlY2VudCBxdWVyaWVzKVxuICAjIExva2kgZm9yIGxvZyBhZ2dyZWdhdGlvblxuICBkYXRhc291cmNlczpcbiAgICBkYXRhc291cmNlcy55YW1sOlxuICAgICAgYXBpVmVyc2lvbjogMVxuICAgICAgIyBEZWxldGUgYW55IHByZS1leGlzdGluZyBMb2tpIGRhdGFzb3VyY2UgKGUuZy4gb25lIGNyZWF0ZWQgd2l0aCBhXG4gICAgICAjIHJhbmRvbWx5IGdlbmVyYXRlZCBVSUQgYmVmb3JlIHdlIHBpbm5lZCB1aWQ6IGxva2kpLiBXaXRob3V0IHRoaXMsXG4gICAgICAjIEdyYWZhbmEgZmFpbHMgcHJvdmlzaW9uaW5nIHdpdGggXCJkYXRhIHNvdXJjZSBub3QgZm91bmRcIiBiZWNhdXNlXG4gICAgICAjIHRoZSB1cHNlcnQgY29sbGlkZXMgd2l0aCB0aGUgZXhpc3RpbmcgZW50cnkuXG4gICAgICBkZWxldGVEYXRhc291cmNlczpcbiAgICAgIC0gbmFtZTogTG9raVxuICAgICAgICBvcmdJZDogMVxuICAgICAgZGF0YXNvdXJjZXM6XG4gICAgICAtIG5hbWU6IFRoYW5vc1xuICAgICAgICB0eXBlOiBwcm9tZXRoZXVzXG4gICAgICAgIHVpZDogdGhhbm9zXG4gICAgICAgIGFjY2VzczogcHJveHlcbiAgICAgICAgIyB0aGFub3MtcXVlcnkgU2VydmljZTogaHR0cCBwb3J0IDkwOTAgLT4gY29udGFpbmVyIGh0dHAgMTA5MDJcbiAgICAgICAgdXJsOiBodHRwOi8vdGhhbm9zLXF1ZXJ5LiR7Y29uZmlnLm5hbWVzcGFjZX0uc3ZjLmNsdXN0ZXIubG9jYWw6OTA5MFxuICAgICAgICBpc0RlZmF1bHQ6IHRydWVcbiAgICAgICAganNvbkRhdGE6XG4gICAgICAgICAgdGltZUludGVydmFsOiAzMHNcbiAgICAgIC0gbmFtZTogUHJvbWV0aGV1c1xuICAgICAgICB0eXBlOiBwcm9tZXRoZXVzXG4gICAgICAgIHVpZDogcHJvbWV0aGV1c1xuICAgICAgICBhY2Nlc3M6IHByb3h5XG4gICAgICAgIHVybDogaHR0cDovL2t1YmUtcHJvbWV0aGV1cy1zdGFjay1wcm9tZXRoZXVzLiR7Y29uZmlnLm5hbWVzcGFjZX0uc3ZjLmNsdXN0ZXIubG9jYWw6OTA5MFxuICAgICAgICBpc0RlZmF1bHQ6IGZhbHNlXG4gICAgICAgIGpzb25EYXRhOlxuICAgICAgICAgIHRpbWVJbnRlcnZhbDogMzBzXG4gICAgICAtIG5hbWU6IExva2lcbiAgICAgICAgdHlwZTogbG9raVxuICAgICAgICB1aWQ6IGxva2lcbiAgICAgICAgYWNjZXNzOiBwcm94eVxuICAgICAgICB1cmw6IGh0dHA6Ly9sb2tpLWdhdGV3YXkuJHtjb25maWcubmFtZXNwYWNlfS5zdmMuY2x1c3Rlci5sb2NhbFxuICAgICAgICBqc29uRGF0YTpcbiAgICAgICAgICBtYXhMaW5lczogMTAwMFxuXG5wcm9tZXRoZXVzT3BlcmF0b3I6XG4gIHJlc291cmNlczpcbiAgICBsaW1pdHM6XG4gICAgICBjcHU6IDFcbiAgICAgIG1lbW9yeTogNTEyTWlcbiAgICByZXF1ZXN0czpcbiAgICAgIGNwdTogNTBtXG4gICAgICBtZW1vcnk6IDEyOE1pXG4gIHByaW9yaXR5Q2xhc3NOYW1lOiBoaWdoLXByaW9yaXR5XG5cbnByb21ldGhldXMtbm9kZS1leHBvcnRlcjpcbiAgIyBCaW5kIDo5MTAwIHRvIHRoZSBub2RlIEludGVybmFsSVAgb25seSwgbm90IDAuMC4wLjAuIFdpdGgga3ViZVJCQUNQcm94eVxuICAjIGRpc2FibGVkIHRoZSBzdWItY2hhcnQgc2V0cyBIT1NUX0lQIGZyb20gZmllbGRSZWYgc3RhdHVzLmhvc3RJUCwgd2hpY2ggaXNcbiAgIyB0aGUgbm9kZSdzIEludGVybmFsSVAgKEVYOiB2U3dpdGNoIDEwLjYuMC54IHZpYSAtLW5vZGUtaXA7IGNsb3VkOiBoY2xvdWRcbiAgIyBwcml2YXRlIElQKS4gbm9kZS1leHBvcnRlciBpcyBob3N0TmV0d29yaywgc28gUHJvbWV0aGV1cyBhbHJlYWR5IHNjcmFwZXNcbiAgIyB0aGF0IEludGVybmFsSVAgZW5kcG9pbnQgLT4gc2NyYXBpbmcgaXMgdW5hZmZlY3RlZCwgb25seSB0aGUgcHVibGljLU5JQ1xuICAjIGV4cG9zdXJlIG9mIHRoZSB1bmF1dGhlbnRpY2F0ZWQgbWV0cmljcyBvbiB0aGUgRVggcHVibGljIElQcyBnb2VzIGF3YXkuXG4gIHNlcnZpY2U6XG4gICAgbGlzdGVuT25BbGxJbnRlcmZhY2VzOiBmYWxzZVxuICByZXNvdXJjZXM6XG4gICAgbGltaXRzOlxuICAgICAgY3B1OiA1MG1cbiAgICAgIG1lbW9yeTogNTBNaVxuICAgIHJlcXVlc3RzOlxuICAgICAgY3B1OiA1bVxuICAgICAgbWVtb3J5OiAxNk1pXG4gIHByaW9yaXR5Q2xhc3NOYW1lOiBoaWdoLXByaW9yaXR5XG5cbmt1YmUtc3RhdGUtbWV0cmljczpcbiAgcmVzb3VyY2VzOlxuICAgIGxpbWl0czpcbiAgICAgIGNwdTogMVxuICAgICAgbWVtb3J5OiA1MTJNaVxuICAgIHJlcXVlc3RzOlxuICAgICAgY3B1OiA1bVxuICAgICAgbWVtb3J5OiAxMjhNaVxuICBwcmlvcml0eUNsYXNzTmFtZTogaGlnaC1wcmlvcml0eVxuYDtcbiAgfVxufVxuIl19

package/lib/constructs/thanos-compactor.d.ts

@@ -0,0 +1,35 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface ThanosCompactorProps {
+    namespace: string;
+    config: MonitoringConfig;
+}
+/**
+ * Creates Thanos Compactor StatefulSet and Service.
+ *
+ * Thanos Compactor performs:
+ * - Downsampling: Creates 5-minute and 1-hour resolution data from raw blocks
+ * - Compaction: Merges small blocks into larger ones for better query performance
+ * - Retention enforcement: Deletes blocks older than configured retention
+ *
+ * Retention Strategy:
+ * - Raw (15s resolution): 30 days
+ * - 5-minute resolution: 180 days (6 months)
+ * - 1-hour resolution: 730 days (2 years)
+ *
+ * Components:
+ * - StatefulSet (1 replica - singleton, 20Gi PVC for working directory)
+ * - HTTP Service (for metrics and debugging)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Longhorn storage class available
+ * - Thanos S3 secret exists (thanos-objstore-config)
+ * - S3 bucket contains Prometheus data blocks
+ *
+ * Sync Wave: 3 (compaction - can run alongside Store Gateway)
+ */
+export declare class ThanosCompactorConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: ThanosCompactorProps);
+}