@bluedynamics/cdk8s-monitoring 0.0.1

package/lib/constructs/thanos-compactor.js

@@ -0,0 +1,198 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ThanosCompactorConstruct = void 0;
+const constructs_1 = require("constructs");
+const k8s_1 = require("../imports/k8s");
+/**
+ * Creates Thanos Compactor StatefulSet and Service.
+ *
+ * Thanos Compactor performs:
+ * - Downsampling: Creates 5-minute and 1-hour resolution data from raw blocks
+ * - Compaction: Merges small blocks into larger ones for better query performance
+ * - Retention enforcement: Deletes blocks older than configured retention
+ *
+ * Retention Strategy:
+ * - Raw (15s resolution): 30 days
+ * - 5-minute resolution: 180 days (6 months)
+ * - 1-hour resolution: 730 days (2 years)
+ *
+ * Components:
+ * - StatefulSet (1 replica - singleton, 20Gi PVC for working directory)
+ * - HTTP Service (for metrics and debugging)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Longhorn storage class available
+ * - Thanos S3 secret exists (thanos-objstore-config)
+ * - S3 bucket contains Prometheus data blocks
+ *
+ * Sync Wave: 3 (compaction - can run alongside Store Gateway)
+ */
+class ThanosCompactorConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { namespace, config } = props;
+        // Create StatefulSet
+        // Wave 3: Compaction - after S3 bucket and credentials are ready
+        new k8s_1.KubeStatefulSet(this, 'statefulset', {
+            metadata: {
+                name: 'thanos-compactor',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos-compactor',
+                    'app.kubernetes.io/component': 'compactor',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                serviceName: 'thanos-compactor',
+                replicas: 1, // Singleton - only one compactor should run
+                selector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': 'thanos-compactor',
+                    },
+                },
+                template: {
+                    metadata: {
+                        labels: {
+                            'app.kubernetes.io/name': 'thanos-compactor',
+                            'app.kubernetes.io/component': 'compactor',
+                        },
+                    },
+                    spec: {
+                        // No arch nodeSelector: Thanos images are multi-arch; let the
+                        // scheduler place this on any worker (legacy ARM64 pin removed).
+                        // Fix volume permissions for Thanos user (UID 10001)
+                        securityContext: {
+                            fsGroup: 10001,
+                            runAsUser: 10001,
+                            runAsNonRoot: true,
+                        },
+                        containers: [
+                            {
+                                name: 'thanos-compactor',
+                                image: `quay.io/thanos/thanos:${config.versions.thanos}`,
+                                args: [
+                                    'compact',
+                                    '--log.level=info',
+                                    '--data-dir=/var/thanos/compactor',
+                                    '--objstore.config-file=/etc/thanos/objstore.yml',
+                                    '--wait', // Wait for other compactors to finish (prevents conflicts)
+                                    // Downsampling configuration
+                                    `--retention.resolution-raw=${config.retention.prometheusS3Raw}d`, // Keep raw data for 30 days
+                                    `--retention.resolution-5m=${config.retention.prometheusS35m}d`, // Keep 5m data for 180 days (6 months)
+                                    `--retention.resolution-1h=${config.retention.prometheusS31h}d`, // Keep 1h data for 730 days (2 years)
+                                    // Compaction configuration
+                                    '--compact.concurrency=1',
+                                    '--delete-delay=48h', // Wait 48h before deleting blocks (safety margin)
+                                ],
+                                ports: [
+                                    {
+                                        name: 'http',
+                                        containerPort: 10902,
+                                    },
+                                ],
+                                volumeMounts: [
+                                    {
+                                        name: 'objstore-config',
+                                        mountPath: '/etc/thanos',
+                                        readOnly: true,
+                                    },
+                                    {
+                                        name: 'data',
+                                        mountPath: '/var/thanos/compactor',
+                                    },
+                                ],
+                                livenessProbe: {
+                                    httpGet: {
+                                        path: '/-/healthy',
+                                        port: k8s_1.IntOrString.fromString('http'),
+                                    },
+                                    initialDelaySeconds: 30,
+                                    periodSeconds: 30,
+                                },
+                                readinessProbe: {
+                                    httpGet: {
+                                        path: '/-/ready',
+                                        port: k8s_1.IntOrString.fromString('http'),
+                                    },
+                                    initialDelaySeconds: 30,
+                                    periodSeconds: 5,
+                                },
+                                resources: {
+                                    requests: {
+                                        cpu: k8s_1.Quantity.fromString(config.resources.thanosCompactor.requests.cpu),
+                                        memory: k8s_1.Quantity.fromString(config.resources.thanosCompactor.requests.memory),
+                                    },
+                                    limits: {
+                                        cpu: k8s_1.Quantity.fromString(config.resources.thanosCompactor.limits.cpu),
+                                        memory: k8s_1.Quantity.fromString(config.resources.thanosCompactor.limits.memory),
+                                    },
+                                },
+                            },
+                        ],
+                        volumes: [
+                            {
+                                name: 'objstore-config',
+                                secret: {
+                                    secretName: 'thanos-objstore-config',
+                                },
+                            },
+                        ],
+                        priorityClassName: 'high-priority',
+                    },
+                },
+                volumeClaimTemplates: [
+                    {
+                        metadata: {
+                            name: 'data',
+                        },
+                        spec: {
+                            accessModes: ['ReadWriteOnce'],
+                            storageClassName: 'longhorn',
+                            resources: {
+                                requests: {
+                                    storage: k8s_1.Quantity.fromString(config.storage.thanosCompactor), // Working directory for compaction operations
+                                },
+                            },
+                        },
+                    },
+                ],
+            },
+        });
+        // Create HTTP Service (for metrics/debugging)
+        new k8s_1.KubeService(this, 'service', {
+            metadata: {
+                name: 'thanos-compactor',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos-compactor',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                ports: [
+                    {
+                        name: 'http',
+                        port: 10902,
+                        targetPort: 'http',
+                        protocol: 'TCP',
+                    },
+                ],
+                selector: {
+                    'app.kubernetes.io/name': 'thanos-compactor',
+                },
+            },
+        });
+    }
+}
+exports.ThanosCompactorConstruct = ThanosCompactorConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGhhbm9zLWNvbXBhY3Rvci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9jb25zdHJ1Y3RzL3RoYW5vcy1jb21wYWN0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkNBQXVDO0FBQ3ZDLHdDQUFxRjtBQVFyRjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXlCRztBQUNILE1BQWEsd0JBQXlCLFNBQVEsc0JBQVM7SUFDckQsWUFBWSxLQUFnQixFQUFFLEVBQVUsRUFBRSxLQUEyQjtRQUNuRSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRWpCLE1BQU0sRUFBRSxTQUFTLEVBQUUsTUFBTSxFQUFFLEdBQUcsS0FBSyxDQUFDO1FBRXBDLHFCQUFxQjtRQUNyQixpRUFBaUU7UUFDakUsSUFBSSxxQkFBZSxDQUFDLElBQUksRUFBRSxhQUFhLEVBQUU7WUFDdkMsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSxrQkFBa0I7Z0JBQ3hCLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsa0JBQWtCO29CQUM1Qyw2QkFBNkIsRUFBRSxXQUFXO29CQUMxQyw4QkFBOEIsRUFBRSxPQUFPO29CQUN2QywyQkFBMkIsRUFBRSxZQUFZO2lCQUMxQztnQkFDRCxXQUFXLEVBQUU7b0JBQ1gsOEJBQThCLEVBQUUsR0FBRztpQkFDcEM7YUFDRjtZQUNELElBQUksRUFBRTtnQkFDSixXQUFXLEVBQUUsa0JBQWtCO2dCQUMvQixRQUFRLEVBQUUsQ0FBQyxFQUFFLDRDQUE0QztnQkFDekQsUUFBUSxFQUFFO29CQUNSLFdBQVcsRUFBRTt3QkFDWCx3QkFBd0IsRUFBRSxrQkFBa0I7cUJBQzdDO2lCQUNGO2dCQUNELFFBQVEsRUFBRTtvQkFDUixRQUFRLEVBQUU7d0JBQ1IsTUFBTSxFQUFFOzRCQUNOLHdCQUF3QixFQUFFLGtCQUFrQjs0QkFDNUMsNkJBQTZCLEVBQUUsV0FBVzt5QkFDM0M7cUJBQ0Y7b0JBQ0QsSUFBSSxFQUFFO3dCQUNKLDhEQUE4RDt3QkFDOUQsaUVBQWlFO3dCQUVqRSxxREFBcUQ7d0JBQ3JELGVBQWUsRUFBRTs0QkFDZixPQUFPLEVBQUUsS0FBSzs0QkFDZCxTQUFTLEVBQUUsS0FBSzs0QkFDaEIsWUFBWSxFQUFFLElBQUk7eUJBQ25CO3dCQUVELFVBQVUsRUFBRTs0QkFDVjtnQ0FDRSxJQUFJLEVBQUUsa0JBQWtCO2dDQUN4QixLQUFLLEVBQUUseUJBQXlCLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFO2dDQUN4RCxJQUFJLEVBQUU7b0NBQ0osU0FBUztvQ0FDVCxrQkFBa0I7b0NBQ2xCLGtDQUFrQztvQ0FDbEMsaURBQWlEO29DQUNqRCxRQUFRLEVBQUUsMkRBQTJEO29DQUNyRSw2QkFBNkI7b0NBQzdCLDhCQUE4QixNQUFNLENBQUMsU0FBUyxDQUFDLGVBQWUsR0FBRyxFQUFFLDRCQUE0QjtvQ0FDL0YsNkJBQTZCLE1BQU0sQ0FBQyxTQUFTLENBQUMsY0FBYyxHQUFHLEVBQUUsdUNBQXVDO29DQUN4Ryw2QkFBNkIsTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLEdBQUcsRUFBRSxzQ0FBc0M7b0NBQ3ZHLDJCQUEyQjtvQ0FDM0IseUJBQXlCO29DQUN6QixvQkFBb0IsRUFBRSxrREFBa0Q7aUNBQ3pFO2dDQUNELEtBQUssRUFBRTtvQ0FDTDt3Q0FDRSxJQUFJLEVBQUUsTUFBTTt3Q0FDWixhQUFhLEVBQUUsS0FBSztxQ0FDckI7aUNBQ0Y7Z0NBQ0QsWUFBWSxFQUFFO29DQUNaO3dDQUNFLElBQUksRUFBRSxpQkFBaUI7d0NBQ3ZCLFNBQVMsRUFBRSxhQUFhO3dDQUN4QixRQUFRLEVBQUUsSUFBSTtxQ0FDZjtvQ0FDRDt3Q0FDRSxJQUFJLEVBQUUsTUFBTTt3Q0FDWixTQUFTLEVBQUUsdUJBQXVCO3FDQUNuQztpQ0FDRjtnQ0FDRCxhQUFhLEVBQUU7b0NBQ2IsT0FBTyxFQUFFO3dDQUNQLElBQUksRUFBRSxZQUFZO3dDQUNsQixJQUFJLEVBQUUsaUJBQVcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDO3FDQUNyQztvQ0FDRCxtQkFBbUIsRUFBRSxFQUFFO29DQUN2QixhQUFhLEVBQUUsRUFBRTtpQ0FDbEI7Z0NBQ0QsY0FBYyxFQUFFO29DQUNkLE9BQU8sRUFBRTt3Q0FDUCxJQUFJLEVBQUUsVUFBVTt3Q0FDaEIsSUFBSSxFQUFFLGlCQUFXLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQztxQ0FDckM7b0NBQ0QsbUJBQW1CLEVBQUUsRUFBRTtvQ0FDdkIsYUFBYSxFQUFFLENBQUM7aUNBQ2pCO2dDQUNELFNBQVMsRUFBRTtvQ0FDVCxRQUFRLEVBQUU7d0NBQ1IsR0FBRyxFQUFFLGNBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQzt3Q0FDdkUsTUFBTSxFQUFFLGNBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQztxQ0FDOUU7b0NBQ0QsTUFBTSxFQUFFO3dDQUNOLEdBQUcsRUFBRSxjQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUM7d0NBQ3JFLE1BQU0sRUFBRSxjQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7cUNBQzVFO2lDQUNGOzZCQUNGO3lCQUNGO3dCQUVELE9BQU8sRUFBRTs0QkFDUDtnQ0FDRSxJQUFJLEVBQUUsaUJBQWlCO2dDQUN2QixNQUFNLEVBQUU7b0NBQ04sVUFBVSxFQUFFLHdCQUF3QjtpQ0FDckM7NkJBQ0Y7eUJBQ0Y7d0JBRUQsaUJBQWlCLEVBQUUsZUFBZTtxQkFDbkM7aUJBQ0Y7Z0JBQ0Qsb0JBQW9CLEVBQUU7b0JBQ3BCO3dCQUNFLFFBQVEsRUFBRTs0QkFDUixJQUFJLEVBQUUsTUFBTTt5QkFDYjt3QkFDRCxJQUFJLEVBQUU7NEJBQ0osV0FBVyxFQUFFLENBQUMsZUFBZSxDQUFDOzRCQUM5QixnQkFBZ0IsRUFBRSxVQUFVOzRCQUM1QixTQUFTLEVBQUU7Z0NBQ1QsUUFBUSxFQUFFO29DQUNSLE9BQU8sRUFBRSxjQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLEVBQUUsOENBQThDO2lDQUM3Rzs2QkFDRjt5QkFDRjtxQkFDRjtpQkFDRjthQUNGO1NBQ0YsQ0FBQyxDQUFDO1FBRUgsOENBQThDO1FBQzlDLElBQUksaUJBQVcsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFO1lBQy9CLFFBQVEsRUFBRTtnQkFDUixJQUFJLEVBQUUsa0JBQWtCO2dCQUN4QixTQUFTLEVBQUUsU0FBUztnQkFDcEIsTUFBTSxFQUFFO29CQUNOLHdCQUF3QixFQUFFLGtCQUFrQjtvQkFDNUMsOEJBQThCLEVBQUUsT0FBTztpQkFDeEM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osS0FBSyxFQUFFO29CQUNMO3dCQUNFLElBQUksRUFBRSxNQUFNO3dCQUNaLElBQUksRUFBRSxLQUFLO3dCQUNYLFVBQVUsRUFBRSxNQUFhO3dCQUN6QixRQUFRLEVBQUUsS0FBSztxQkFDaEI7aUJBQ0Y7Z0JBQ0QsUUFBUSxFQUFFO29CQUNSLHdCQUF3QixFQUFFLGtCQUFrQjtpQkFDN0M7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQTNLRCw0REEyS0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDb25zdHJ1Y3QgfSBmcm9tICdjb25zdHJ1Y3RzJztcbmltcG9ydCB7IEt1YmVTdGF0ZWZ1bFNldCwgS3ViZVNlcnZpY2UsIFF1YW50aXR5LCBJbnRPclN0cmluZyB9IGZyb20gJy4uL2ltcG9ydHMvazhzJztcbmltcG9ydCB7IE1vbml0b3JpbmdDb25maWcgfSBmcm9tICcuLi90eXBlcyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgVGhhbm9zQ29tcGFjdG9yUHJvcHMge1xuICBuYW1lc3BhY2U6IHN0cmluZztcbiAgY29uZmlnOiBNb25pdG9yaW5nQ29uZmlnO1xufVxuXG4vKipcbiAqIENyZWF0ZXMgVGhhbm9zIENvbXBhY3RvciBTdGF0ZWZ1bFNldCBhbmQgU2VydmljZS5cbiAqXG4gKiBUaGFub3MgQ29tcGFjdG9yIHBlcmZvcm1zOlxuICogLSBEb3duc2FtcGxpbmc6IENyZWF0ZXMgNS1taW51dGUgYW5kIDEtaG91ciByZXNvbHV0aW9uIGRhdGEgZnJvbSByYXcgYmxvY2tzXG4gKiAtIENvbXBhY3Rpb246IE1lcmdlcyBzbWFsbCBibG9ja3MgaW50byBsYXJnZXIgb25lcyBmb3IgYmV0dGVyIHF1ZXJ5IHBlcmZvcm1hbmNlXG4gKiAtIFJldGVudGlvbiBlbmZvcmNlbWVudDogRGVsZXRlcyBibG9ja3Mgb2xkZXIgdGhhbiBjb25maWd1cmVkIHJldGVudGlvblxuICpcbiAqIFJldGVudGlvbiBTdHJhdGVneTpcbiAqIC0gUmF3ICgxNXMgcmVzb2x1dGlvbik6IDMwIGRheXNcbiAqIC0gNS1taW51dGUgcmVzb2x1dGlvbjogMTgwIGRheXMgKDYgbW9udGhzKVxuICogLSAxLWhvdXIgcmVzb2x1dGlvbjogNzMwIGRheXMgKDIgeWVhcnMpXG4gKlxuICogQ29tcG9uZW50czpcbiAqIC0gU3RhdGVmdWxTZXQgKDEgcmVwbGljYSAtIHNpbmdsZXRvbiwgMjBHaSBQVkMgZm9yIHdvcmtpbmcgZGlyZWN0b3J5KVxuICogLSBIVFRQIFNlcnZpY2UgKGZvciBtZXRyaWNzIGFuZCBkZWJ1Z2dpbmcpXG4gKlxuICogUHJlcmVxdWlzaXRlczpcbiAqIC0gTmFtZXNwYWNlIGV4aXN0c1xuICogLSBQcmlvcml0eUNsYXNzICdoaWdoLXByaW9yaXR5JyBleGlzdHNcbiAqIC0gTG9uZ2hvcm4gc3RvcmFnZSBjbGFzcyBhdmFpbGFibGVcbiAqIC0gVGhhbm9zIFMzIHNlY3JldCBleGlzdHMgKHRoYW5vcy1vYmpzdG9yZS1jb25maWcpXG4gKiAtIFMzIGJ1Y2tldCBjb250YWlucyBQcm9tZXRoZXVzIGRhdGEgYmxvY2tzXG4gKlxuICogU3luYyBXYXZlOiAzIChjb21wYWN0aW9uIC0gY2FuIHJ1biBhbG9uZ3NpZGUgU3RvcmUgR2F0ZXdheSlcbiAqL1xuZXhwb3J0IGNsYXNzIFRoYW5vc0NvbXBhY3RvckNvbnN0cnVjdCBleHRlbmRzIENvbnN0cnVjdCB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBUaGFub3NDb21wYWN0b3JQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBjb25zdCB7IG5hbWVzcGFjZSwgY29uZmlnIH0gPSBwcm9wcztcblxuICAgIC8vIENyZWF0ZSBTdGF0ZWZ1bFNldFxuICAgIC8vIFdhdmUgMzogQ29tcGFjdGlvbiAtIGFmdGVyIFMzIGJ1Y2tldCBhbmQgY3JlZGVudGlhbHMgYXJlIHJlYWR5XG4gICAgbmV3IEt1YmVTdGF0ZWZ1bFNldCh0aGlzLCAnc3RhdGVmdWxzZXQnLCB7XG4gICAgICBtZXRhZGF0YToge1xuICAgICAgICBuYW1lOiAndGhhbm9zLWNvbXBhY3RvcicsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3MtY29tcGFjdG9yJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vY29tcG9uZW50JzogJ2NvbXBhY3RvcicsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnknOiAnY2RrOHMnLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mJzogJ21vbml0b3JpbmcnLFxuICAgICAgICB9LFxuICAgICAgICBhbm5vdGF0aW9uczoge1xuICAgICAgICAgICdhcmdvY2QuYXJnb3Byb2ouaW8vc3luYy13YXZlJzogJzMnLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICAgIHNwZWM6IHtcbiAgICAgICAgc2VydmljZU5hbWU6ICd0aGFub3MtY29tcGFjdG9yJyxcbiAgICAgICAgcmVwbGljYXM6IDEsIC8vIFNpbmdsZXRvbiAtIG9ubHkgb25lIGNvbXBhY3RvciBzaG91bGQgcnVuXG4gICAgICAgIHNlbGVjdG9yOiB7XG4gICAgICAgICAgbWF0Y2hMYWJlbHM6IHtcbiAgICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9uYW1lJzogJ3RoYW5vcy1jb21wYWN0b3InLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHRlbXBsYXRlOiB7XG4gICAgICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgICAgIGxhYmVsczoge1xuICAgICAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3MtY29tcGFjdG9yJyxcbiAgICAgICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudCc6ICdjb21wYWN0b3InLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHNwZWM6IHtcbiAgICAgICAgICAgIC8vIE5vIGFyY2ggbm9kZVNlbGVjdG9yOiBUaGFub3MgaW1hZ2VzIGFyZSBtdWx0aS1hcmNoOyBsZXQgdGhlXG4gICAgICAgICAgICAvLyBzY2hlZHVsZXIgcGxhY2UgdGhpcyBvbiBhbnkgd29ya2VyIChsZWdhY3kgQVJNNjQgcGluIHJlbW92ZWQpLlxuXG4gICAgICAgICAgICAvLyBGaXggdm9sdW1lIHBlcm1pc3Npb25zIGZvciBUaGFub3MgdXNlciAoVUlEIDEwMDAxKVxuICAgICAgICAgICAgc2VjdXJpdHlDb250ZXh0OiB7XG4gICAgICAgICAgICAgIGZzR3JvdXA6IDEwMDAxLFxuICAgICAgICAgICAgICBydW5Bc1VzZXI6IDEwMDAxLFxuICAgICAgICAgICAgICBydW5Bc05vblJvb3Q6IHRydWUsXG4gICAgICAgICAgICB9LFxuXG4gICAgICAgICAgICBjb250YWluZXJzOiBbXG4gICAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgICBuYW1lOiAndGhhbm9zLWNvbXBhY3RvcicsXG4gICAgICAgICAgICAgICAgaW1hZ2U6IGBxdWF5LmlvL3RoYW5vcy90aGFub3M6JHtjb25maWcudmVyc2lvbnMudGhhbm9zfWAsXG4gICAgICAgICAgICAgICAgYXJnczogW1xuICAgICAgICAgICAgICAgICAgJ2NvbXBhY3QnLFxuICAgICAgICAgICAgICAgICAgJy0tbG9nLmxldmVsPWluZm8nLFxuICAgICAgICAgICAgICAgICAgJy0tZGF0YS1kaXI9L3Zhci90aGFub3MvY29tcGFjdG9yJyxcbiAgICAgICAgICAgICAgICAgICctLW9ianN0b3JlLmNvbmZpZy1maWxlPS9ldGMvdGhhbm9zL29ianN0b3JlLnltbCcsXG4gICAgICAgICAgICAgICAgICAnLS13YWl0JywgLy8gV2FpdCBmb3Igb3RoZXIgY29tcGFjdG9ycyB0byBmaW5pc2ggKHByZXZlbnRzIGNvbmZsaWN0cylcbiAgICAgICAgICAgICAgICAgIC8vIERvd25zYW1wbGluZyBjb25maWd1cmF0aW9uXG4gICAgICAgICAgICAgICAgICBgLS1yZXRlbnRpb24ucmVzb2x1dGlvbi1yYXc9JHtjb25maWcucmV0ZW50aW9uLnByb21ldGhldXNTM1Jhd31kYCwgLy8gS2VlcCByYXcgZGF0YSBmb3IgMzAgZGF5c1xuICAgICAgICAgICAgICAgICAgYC0tcmV0ZW50aW9uLnJlc29sdXRpb24tNW09JHtjb25maWcucmV0ZW50aW9uLnByb21ldGhldXNTMzVtfWRgLCAvLyBLZWVwIDVtIGRhdGEgZm9yIDE4MCBkYXlzICg2IG1vbnRocylcbiAgICAgICAgICAgICAgICAgIGAtLXJldGVudGlvbi5yZXNvbHV0aW9uLTFoPSR7Y29uZmlnLnJldGVudGlvbi5wcm9tZXRoZXVzUzMxaH1kYCwgLy8gS2VlcCAxaCBkYXRhIGZvciA3MzAgZGF5cyAoMiB5ZWFycylcbiAgICAgICAgICAgICAgICAgIC8vIENvbXBhY3Rpb24gY29uZmlndXJhdGlvblxuICAgICAgICAgICAgICAgICAgJy0tY29tcGFjdC5jb25jdXJyZW5jeT0xJyxcbiAgICAgICAgICAgICAgICAgICctLWRlbGV0ZS1kZWxheT00OGgnLCAvLyBXYWl0IDQ4aCBiZWZvcmUgZGVsZXRpbmcgYmxvY2tzIChzYWZldHkgbWFyZ2luKVxuICAgICAgICAgICAgICAgIF0sXG4gICAgICAgICAgICAgICAgcG9ydHM6IFtcbiAgICAgICAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgICAgICAgbmFtZTogJ2h0dHAnLFxuICAgICAgICAgICAgICAgICAgICBjb250YWluZXJQb3J0OiAxMDkwMixcbiAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgICAgICB2b2x1bWVNb3VudHM6IFtcbiAgICAgICAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgICAgICAgbmFtZTogJ29ianN0b3JlLWNvbmZpZycsXG4gICAgICAgICAgICAgICAgICAgIG1vdW50UGF0aDogJy9ldGMvdGhhbm9zJyxcbiAgICAgICAgICAgICAgICAgICAgcmVhZE9ubHk6IHRydWUsXG4gICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgICAge1xuICAgICAgICAgICAgICAgICAgICBuYW1lOiAnZGF0YScsXG4gICAgICAgICAgICAgICAgICAgIG1vdW50UGF0aDogJy92YXIvdGhhbm9zL2NvbXBhY3RvcicsXG4gICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgIF0sXG4gICAgICAgICAgICAgICAgbGl2ZW5lc3NQcm9iZToge1xuICAgICAgICAgICAgICAgICAgaHR0cEdldDoge1xuICAgICAgICAgICAgICAgICAgICBwYXRoOiAnLy0vaGVhbHRoeScsXG4gICAgICAgICAgICAgICAgICAgIHBvcnQ6IEludE9yU3RyaW5nLmZyb21TdHJpbmcoJ2h0dHAnKSxcbiAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgICBpbml0aWFsRGVsYXlTZWNvbmRzOiAzMCxcbiAgICAgICAgICAgICAgICAgIHBlcmlvZFNlY29uZHM6IDMwLFxuICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgcmVhZGluZXNzUHJvYmU6IHtcbiAgICAgICAgICAgICAgICAgIGh0dHBHZXQ6IHtcbiAgICAgICAgICAgICAgICAgICAgcGF0aDogJy8tL3JlYWR5JyxcbiAgICAgICAgICAgICAgICAgICAgcG9ydDogSW50T3JTdHJpbmcuZnJvbVN0cmluZygnaHR0cCcpLFxuICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICAgIGluaXRpYWxEZWxheVNlY29uZHM6IDMwLFxuICAgICAgICAgICAgICAgICAgcGVyaW9kU2Vjb25kczogNSxcbiAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgIHJlc291cmNlczoge1xuICAgICAgICAgICAgICAgICAgcmVxdWVzdHM6IHtcbiAgICAgICAgICAgICAgICAgICAgY3B1OiBRdWFudGl0eS5mcm9tU3RyaW5nKGNvbmZpZy5yZXNvdXJjZXMudGhhbm9zQ29tcGFjdG9yLnJlcXVlc3RzLmNwdSksXG4gICAgICAgICAgICAgICAgICAgIG1lbW9yeTogUXVhbnRpdHkuZnJvbVN0cmluZyhjb25maWcucmVzb3VyY2VzLnRoYW5vc0NvbXBhY3Rvci5yZXF1ZXN0cy5tZW1vcnkpLFxuICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICAgIGxpbWl0czoge1xuICAgICAgICAgICAgICAgICAgICBjcHU6IFF1YW50aXR5LmZyb21TdHJpbmcoY29uZmlnLnJlc291cmNlcy50aGFub3NDb21wYWN0b3IubGltaXRzLmNwdSksXG4gICAgICAgICAgICAgICAgICAgIG1lbW9yeTogUXVhbnRpdHkuZnJvbVN0cmluZyhjb25maWcucmVzb3VyY2VzLnRoYW5vc0NvbXBhY3Rvci5saW1pdHMubWVtb3J5KSxcbiAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIF0sXG5cbiAgICAgICAgICAgIHZvbHVtZXM6IFtcbiAgICAgICAgICAgICAge1xuICAgICAgICAgICAgICAgIG5hbWU6ICdvYmpzdG9yZS1jb25maWcnLFxuICAgICAgICAgICAgICAgIHNlY3JldDoge1xuICAgICAgICAgICAgICAgICAgc2VjcmV0TmFtZTogJ3RoYW5vcy1vYmpzdG9yZS1jb25maWcnLFxuICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICBdLFxuXG4gICAgICAgICAgICBwcmlvcml0eUNsYXNzTmFtZTogJ2hpZ2gtcHJpb3JpdHknLFxuICAgICAgICAgIH0sXG4gICAgICAgIH0sXG4gICAgICAgIHZvbHVtZUNsYWltVGVtcGxhdGVzOiBbXG4gICAgICAgICAge1xuICAgICAgICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgICAgICAgbmFtZTogJ2RhdGEnLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIHNwZWM6IHtcbiAgICAgICAgICAgICAgYWNjZXNzTW9kZXM6IFsnUmVhZFdyaXRlT25jZSddLFxuICAgICAgICAgICAgICBzdG9yYWdlQ2xhc3NOYW1lOiAnbG9uZ2hvcm4nLFxuICAgICAgICAgICAgICByZXNvdXJjZXM6IHtcbiAgICAgICAgICAgICAgICByZXF1ZXN0czoge1xuICAgICAgICAgICAgICAgICAgc3RvcmFnZTogUXVhbnRpdHkuZnJvbVN0cmluZyhjb25maWcuc3RvcmFnZS50aGFub3NDb21wYWN0b3IpLCAvLyBXb3JraW5nIGRpcmVjdG9yeSBmb3IgY29tcGFjdGlvbiBvcGVyYXRpb25zXG4gICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgXSxcbiAgICAgIH0sXG4gICAgfSk7XG5cbiAgICAvLyBDcmVhdGUgSFRUUCBTZXJ2aWNlIChmb3IgbWV0cmljcy9kZWJ1Z2dpbmcpXG4gICAgbmV3IEt1YmVTZXJ2aWNlKHRoaXMsICdzZXJ2aWNlJywge1xuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ3RoYW5vcy1jb21wYWN0b3InLFxuICAgICAgICBuYW1lc3BhY2U6IG5hbWVzcGFjZSxcbiAgICAgICAgbGFiZWxzOiB7XG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL25hbWUnOiAndGhhbm9zLWNvbXBhY3RvcicsXG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL21hbmFnZWQtYnknOiAnY2RrOHMnLFxuICAgICAgICB9LFxuICAgICAgICBhbm5vdGF0aW9uczoge1xuICAgICAgICAgICdhcmdvY2QuYXJnb3Byb2ouaW8vc3luYy13YXZlJzogJzMnLFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICAgIHNwZWM6IHtcbiAgICAgICAgcG9ydHM6IFtcbiAgICAgICAgICB7XG4gICAgICAgICAgICBuYW1lOiAnaHR0cCcsXG4gICAgICAgICAgICBwb3J0OiAxMDkwMixcbiAgICAgICAgICAgIHRhcmdldFBvcnQ6ICdodHRwJyBhcyBhbnksXG4gICAgICAgICAgICBwcm90b2NvbDogJ1RDUCcsXG4gICAgICAgICAgfSxcbiAgICAgICAgXSxcbiAgICAgICAgc2VsZWN0b3I6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3MtY29tcGFjdG9yJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/constructs/thanos-query.d.ts

@@ -0,0 +1,30 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface ThanosQueryProps {
+    namespace: string;
+    config: MonitoringConfig;
+}
+/**
+ * Creates Thanos Query Deployment and Services.
+ *
+ * Thanos Query provides a unified query interface for:
+ * - Local Prometheus data (3-day retention)
+ * - Historical S3 data (via Thanos Store Gateway)
+ * - Automatic deduplication across Prometheus replicas
+ *
+ * Components:
+ * - Deployment (2 replicas with anti-affinity)
+ * - HTTP Service (port 9090 for Grafana queries)
+ * - gRPC Service (headless, for future Query Frontend)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Prometheus with Thanos sidecar running
+ * - Thanos Store Gateway running
+ *
+ * Sync Wave: 3 (query layer - after Prometheus and Store)
+ */
+export declare class ThanosQueryConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: ThanosQueryProps);
+}

package/lib/constructs/thanos-query.js

@@ -0,0 +1,205 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ThanosQueryConstruct = void 0;
+const constructs_1 = require("constructs");
+const k8s_1 = require("../imports/k8s");
+/**
+ * Creates Thanos Query Deployment and Services.
+ *
+ * Thanos Query provides a unified query interface for:
+ * - Local Prometheus data (3-day retention)
+ * - Historical S3 data (via Thanos Store Gateway)
+ * - Automatic deduplication across Prometheus replicas
+ *
+ * Components:
+ * - Deployment (2 replicas with anti-affinity)
+ * - HTTP Service (port 9090 for Grafana queries)
+ * - gRPC Service (headless, for future Query Frontend)
+ *
+ * Prerequisites:
+ * - Namespace exists
+ * - PriorityClass 'high-priority' exists
+ * - Prometheus with Thanos sidecar running
+ * - Thanos Store Gateway running
+ *
+ * Sync Wave: 3 (query layer - after Prometheus and Store)
+ */
+class ThanosQueryConstruct extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const { namespace, config } = props;
+        // Create Deployment
+        // Wave 3: Query Layer - after Prometheus and Store are ready
+        new k8s_1.KubeDeployment(this, 'deployment', {
+            metadata: {
+                name: 'thanos-query',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos-query',
+                    'app.kubernetes.io/component': 'query',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                    'app.kubernetes.io/part-of': 'monitoring',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                replicas: config.replicas.thanosQuery,
+                selector: {
+                    matchLabels: {
+                        'app.kubernetes.io/name': 'thanos-query',
+                    },
+                },
+                template: {
+                    metadata: {
+                        labels: {
+                            'app.kubernetes.io/name': 'thanos-query',
+                            'app.kubernetes.io/component': 'query',
+                        },
+                    },
+                    spec: {
+                        // No arch nodeSelector: Thanos images are multi-arch; let the
+                        // scheduler place these on any worker (legacy ARM64 pin removed).
+                        // Spread replicas across different nodes for HA
+                        affinity: {
+                            podAntiAffinity: {
+                                preferredDuringSchedulingIgnoredDuringExecution: [
+                                    {
+                                        weight: 100,
+                                        podAffinityTerm: {
+                                            labelSelector: {
+                                                matchLabels: {
+                                                    'app.kubernetes.io/name': 'thanos-query',
+                                                },
+                                            },
+                                            topologyKey: 'kubernetes.io/hostname',
+                                        },
+                                    },
+                                ],
+                            },
+                        },
+                        containers: [
+                            {
+                                name: 'thanos-query',
+                                image: `quay.io/thanos/thanos:${config.versions.thanos}`,
+                                args: [
+                                    'query',
+                                    '--log.level=info',
+                                    '--query.replica-label=replica',
+                                    '--query.replica-label=prometheus_replica',
+                                    // Connect to Prometheus sidecars via gRPC.
+                                    // The sidecar gRPC port is exposed by the operator's thanos
+                                    // discovery service (thanosService.enabled=true), NOT by
+                                    // prometheus-operated (which only exposes http-web:9090).
+                                    `--endpoint=dnssrv+_grpc._tcp.kube-prometheus-stack-thanos-discovery.${namespace}.svc.cluster.local`,
+                                    // Connect to Thanos Store Gateway
+                                    `--endpoint=dnssrv+_grpc._tcp.thanos-store-grpc.${namespace}.svc.cluster.local`,
+                                ],
+                                ports: [
+                                    {
+                                        name: 'http',
+                                        containerPort: 10902,
+                                    },
+                                    {
+                                        name: 'grpc',
+                                        containerPort: 10901,
+                                    },
+                                ],
+                                livenessProbe: {
+                                    httpGet: {
+                                        path: '/-/healthy',
+                                        port: k8s_1.IntOrString.fromNumber(10902), // HTTP port (named 'http' in ports list)
+                                    },
+                                    initialDelaySeconds: 10,
+                                    periodSeconds: 30,
+                                },
+                                readinessProbe: {
+                                    httpGet: {
+                                        path: '/-/ready',
+                                        port: k8s_1.IntOrString.fromNumber(10902), // HTTP port (named 'http' in ports list)
+                                    },
+                                    initialDelaySeconds: 15,
+                                    periodSeconds: 5,
+                                },
+                                resources: {
+                                    requests: {
+                                        cpu: k8s_1.Quantity.fromString(config.resources.thanosQuery.requests.cpu),
+                                        memory: k8s_1.Quantity.fromString(config.resources.thanosQuery.requests.memory),
+                                    },
+                                    limits: {
+                                        cpu: k8s_1.Quantity.fromString(config.resources.thanosQuery.limits.cpu),
+                                        memory: k8s_1.Quantity.fromString(config.resources.thanosQuery.limits.memory),
+                                    },
+                                },
+                            },
+                        ],
+                        priorityClassName: 'high-priority',
+                    },
+                },
+            },
+        });
+        // Create HTTP Service (for Grafana)
+        new k8s_1.KubeService(this, 'service-http', {
+            metadata: {
+                name: 'thanos-query',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos-query',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                ports: [
+                    {
+                        name: 'http',
+                        port: 9090,
+                        // Container http port is 10902. A bare string is dropped by cdk8s
+                        // (targetPort expects IntOrString), which silently defaulted
+                        // targetPort to 9090 and made the Service refuse connections.
+                        targetPort: k8s_1.IntOrString.fromString('http'),
+                        protocol: 'TCP',
+                    },
+                ],
+                selector: {
+                    'app.kubernetes.io/name': 'thanos-query',
+                },
+                sessionAffinity: 'ClientIP',
+            },
+        });
+        // Create gRPC Service (headless, for future Query Frontend)
+        new k8s_1.KubeService(this, 'service-grpc', {
+            metadata: {
+                name: 'thanos-query-grpc',
+                namespace: namespace,
+                labels: {
+                    'app.kubernetes.io/name': 'thanos-query',
+                    'app.kubernetes.io/managed-by': 'cdk8s',
+                },
+                annotations: {
+                    'argocd.argoproj.io/sync-wave': '3',
+                },
+            },
+            spec: {
+                type: 'ClusterIP',
+                clusterIp: 'None', // Headless service for DNS-based discovery
+                ports: [
+                    {
+                        name: 'grpc',
+                        port: 10901,
+                        targetPort: k8s_1.IntOrString.fromString('grpc'),
+                        protocol: 'TCP',
+                    },
+                ],
+                selector: {
+                    'app.kubernetes.io/name': 'thanos-query',
+                },
+            },
+        });
+    }
+}
+exports.ThanosQueryConstruct = ThanosQueryConstruct;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGhhbm9zLXF1ZXJ5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2NvbnN0cnVjdHMvdGhhbm9zLXF1ZXJ5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQUFBLDJDQUF1QztBQUN2Qyx3Q0FBb0Y7QUFRcEY7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBb0JHO0FBQ0gsTUFBYSxvQkFBcUIsU0FBUSxzQkFBUztJQUNqRCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXVCO1FBQy9ELEtBQUssQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7UUFFakIsTUFBTSxFQUFFLFNBQVMsRUFBRSxNQUFNLEVBQUUsR0FBRyxLQUFLLENBQUM7UUFFcEMsb0JBQW9CO1FBQ3BCLDZEQUE2RDtRQUM3RCxJQUFJLG9CQUFjLENBQUMsSUFBSSxFQUFFLFlBQVksRUFBRTtZQUNyQyxRQUFRLEVBQUU7Z0JBQ1IsSUFBSSxFQUFFLGNBQWM7Z0JBQ3BCLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsY0FBYztvQkFDeEMsNkJBQTZCLEVBQUUsT0FBTztvQkFDdEMsOEJBQThCLEVBQUUsT0FBTztvQkFDdkMsMkJBQTJCLEVBQUUsWUFBWTtpQkFDMUM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsV0FBVztnQkFDckMsUUFBUSxFQUFFO29CQUNSLFdBQVcsRUFBRTt3QkFDWCx3QkFBd0IsRUFBRSxjQUFjO3FCQUN6QztpQkFDRjtnQkFDRCxRQUFRLEVBQUU7b0JBQ1IsUUFBUSxFQUFFO3dCQUNSLE1BQU0sRUFBRTs0QkFDTix3QkFBd0IsRUFBRSxjQUFjOzRCQUN4Qyw2QkFBNkIsRUFBRSxPQUFPO3lCQUN2QztxQkFDRjtvQkFDRCxJQUFJLEVBQUU7d0JBQ0osOERBQThEO3dCQUM5RCxrRUFBa0U7d0JBRWxFLGdEQUFnRDt3QkFDaEQsUUFBUSxFQUFFOzRCQUNSLGVBQWUsRUFBRTtnQ0FDZiwrQ0FBK0MsRUFBRTtvQ0FDL0M7d0NBQ0UsTUFBTSxFQUFFLEdBQUc7d0NBQ1gsZUFBZSxFQUFFOzRDQUNmLGFBQWEsRUFBRTtnREFDYixXQUFXLEVBQUU7b0RBQ1gsd0JBQXdCLEVBQUUsY0FBYztpREFDekM7NkNBQ0Y7NENBQ0QsV0FBVyxFQUFFLHdCQUF3Qjt5Q0FDdEM7cUNBQ0Y7aUNBQ0Y7NkJBQ0Y7eUJBQ0Y7d0JBRUQsVUFBVSxFQUFFOzRCQUNWO2dDQUNFLElBQUksRUFBRSxjQUFjO2dDQUNwQixLQUFLLEVBQUUseUJBQXlCLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUFFO2dDQUN4RCxJQUFJLEVBQUU7b0NBQ0osT0FBTztvQ0FDUCxrQkFBa0I7b0NBQ2xCLCtCQUErQjtvQ0FDL0IsMENBQTBDO29DQUMxQywyQ0FBMkM7b0NBQzNDLDREQUE0RDtvQ0FDNUQseURBQXlEO29DQUN6RCwwREFBMEQ7b0NBQzFELHVFQUF1RSxTQUFTLG9CQUFvQjtvQ0FDcEcsa0NBQWtDO29DQUNsQyxrREFBa0QsU0FBUyxvQkFBb0I7aUNBQ2hGO2dDQUNELEtBQUssRUFBRTtvQ0FDTDt3Q0FDRSxJQUFJLEVBQUUsTUFBTTt3Q0FDWixhQUFhLEVBQUUsS0FBSztxQ0FDckI7b0NBQ0Q7d0NBQ0UsSUFBSSxFQUFFLE1BQU07d0NBQ1osYUFBYSxFQUFFLEtBQUs7cUNBQ3JCO2lDQUNGO2dDQUNELGFBQWEsRUFBRTtvQ0FDYixPQUFPLEVBQUU7d0NBQ1AsSUFBSSxFQUFFLFlBQVk7d0NBQ2xCLElBQUksRUFBRSxpQkFBVyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSx5Q0FBeUM7cUNBQy9FO29DQUNELG1CQUFtQixFQUFFLEVBQUU7b0NBQ3ZCLGFBQWEsRUFBRSxFQUFFO2lDQUNsQjtnQ0FDRCxjQUFjLEVBQUU7b0NBQ2QsT0FBTyxFQUFFO3dDQUNQLElBQUksRUFBRSxVQUFVO3dDQUNoQixJQUFJLEVBQUUsaUJBQVcsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEVBQUUseUNBQXlDO3FDQUMvRTtvQ0FDRCxtQkFBbUIsRUFBRSxFQUFFO29DQUN2QixhQUFhLEVBQUUsQ0FBQztpQ0FDakI7Z0NBQ0QsU0FBUyxFQUFFO29DQUNULFFBQVEsRUFBRTt3Q0FDUixHQUFHLEVBQUUsY0FBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO3dDQUNuRSxNQUFNLEVBQUUsY0FBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO3FDQUMxRTtvQ0FDRCxNQUFNLEVBQUU7d0NBQ04sR0FBRyxFQUFFLGNBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQzt3Q0FDakUsTUFBTSxFQUFFLGNBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztxQ0FDeEU7aUNBQ0Y7NkJBQ0Y7eUJBQ0Y7d0JBRUQsaUJBQWlCLEVBQUUsZUFBZTtxQkFDbkM7aUJBQ0Y7YUFDRjtTQUNGLENBQUMsQ0FBQztRQUVILG9DQUFvQztRQUNwQyxJQUFJLGlCQUFXLENBQUMsSUFBSSxFQUFFLGNBQWMsRUFBRTtZQUNwQyxRQUFRLEVBQUU7Z0JBQ1IsSUFBSSxFQUFFLGNBQWM7Z0JBQ3BCLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsY0FBYztvQkFDeEMsOEJBQThCLEVBQUUsT0FBTztpQkFDeEM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osS0FBSyxFQUFFO29CQUNMO3dCQUNFLElBQUksRUFBRSxNQUFNO3dCQUNaLElBQUksRUFBRSxJQUFJO3dCQUNWLGtFQUFrRTt3QkFDbEUsNkRBQTZEO3dCQUM3RCw4REFBOEQ7d0JBQzlELFVBQVUsRUFBRSxpQkFBVyxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUM7d0JBQzFDLFFBQVEsRUFBRSxLQUFLO3FCQUNoQjtpQkFDRjtnQkFDRCxRQUFRLEVBQUU7b0JBQ1Isd0JBQXdCLEVBQUUsY0FBYztpQkFDekM7Z0JBQ0QsZUFBZSxFQUFFLFVBQVU7YUFDNUI7U0FDRixDQUFDLENBQUM7UUFFSCw0REFBNEQ7UUFDNUQsSUFBSSxpQkFBVyxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUU7WUFDcEMsUUFBUSxFQUFFO2dCQUNSLElBQUksRUFBRSxtQkFBbUI7Z0JBQ3pCLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixNQUFNLEVBQUU7b0JBQ04sd0JBQXdCLEVBQUUsY0FBYztvQkFDeEMsOEJBQThCLEVBQUUsT0FBTztpQkFDeEM7Z0JBQ0QsV0FBVyxFQUFFO29CQUNYLDhCQUE4QixFQUFFLEdBQUc7aUJBQ3BDO2FBQ0Y7WUFDRCxJQUFJLEVBQUU7Z0JBQ0osSUFBSSxFQUFFLFdBQVc7Z0JBQ2pCLFNBQVMsRUFBRSxNQUFNLEVBQUUsMkNBQTJDO2dCQUM5RCxLQUFLLEVBQUU7b0JBQ0w7d0JBQ0UsSUFBSSxFQUFFLE1BQU07d0JBQ1osSUFBSSxFQUFFLEtBQUs7d0JBQ1gsVUFBVSxFQUFFLGlCQUFXLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQzt3QkFDMUMsUUFBUSxFQUFFLEtBQUs7cUJBQ2hCO2lCQUNGO2dCQUNELFFBQVEsRUFBRTtvQkFDUix3QkFBd0IsRUFBRSxjQUFjO2lCQUN6QzthQUNGO1NBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztDQUNGO0FBdkxELG9EQXVMQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgS3ViZURlcGxveW1lbnQsIEt1YmVTZXJ2aWNlLCBRdWFudGl0eSwgSW50T3JTdHJpbmcgfSBmcm9tICcuLi9pbXBvcnRzL2s4cyc7XG5pbXBvcnQgeyBNb25pdG9yaW5nQ29uZmlnIH0gZnJvbSAnLi4vdHlwZXMnO1xuXG5leHBvcnQgaW50ZXJmYWNlIFRoYW5vc1F1ZXJ5UHJvcHMge1xuICBuYW1lc3BhY2U6IHN0cmluZztcbiAgY29uZmlnOiBNb25pdG9yaW5nQ29uZmlnO1xufVxuXG4vKipcbiAqIENyZWF0ZXMgVGhhbm9zIFF1ZXJ5IERlcGxveW1lbnQgYW5kIFNlcnZpY2VzLlxuICpcbiAqIFRoYW5vcyBRdWVyeSBwcm92aWRlcyBhIHVuaWZpZWQgcXVlcnkgaW50ZXJmYWNlIGZvcjpcbiAqIC0gTG9jYWwgUHJvbWV0aGV1cyBkYXRhICgzLWRheSByZXRlbnRpb24pXG4gKiAtIEhpc3RvcmljYWwgUzMgZGF0YSAodmlhIFRoYW5vcyBTdG9yZSBHYXRld2F5KVxuICogLSBBdXRvbWF0aWMgZGVkdXBsaWNhdGlvbiBhY3Jvc3MgUHJvbWV0aGV1cyByZXBsaWNhc1xuICpcbiAqIENvbXBvbmVudHM6XG4gKiAtIERlcGxveW1lbnQgKDIgcmVwbGljYXMgd2l0aCBhbnRpLWFmZmluaXR5KVxuICogLSBIVFRQIFNlcnZpY2UgKHBvcnQgOTA5MCBmb3IgR3JhZmFuYSBxdWVyaWVzKVxuICogLSBnUlBDIFNlcnZpY2UgKGhlYWRsZXNzLCBmb3IgZnV0dXJlIFF1ZXJ5IEZyb250ZW5kKVxuICpcbiAqIFByZXJlcXVpc2l0ZXM6XG4gKiAtIE5hbWVzcGFjZSBleGlzdHNcbiAqIC0gUHJpb3JpdHlDbGFzcyAnaGlnaC1wcmlvcml0eScgZXhpc3RzXG4gKiAtIFByb21ldGhldXMgd2l0aCBUaGFub3Mgc2lkZWNhciBydW5uaW5nXG4gKiAtIFRoYW5vcyBTdG9yZSBHYXRld2F5IHJ1bm5pbmdcbiAqXG4gKiBTeW5jIFdhdmU6IDMgKHF1ZXJ5IGxheWVyIC0gYWZ0ZXIgUHJvbWV0aGV1cyBhbmQgU3RvcmUpXG4gKi9cbmV4cG9ydCBjbGFzcyBUaGFub3NRdWVyeUNvbnN0cnVjdCBleHRlbmRzIENvbnN0cnVjdCB7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBDb25zdHJ1Y3QsIGlkOiBzdHJpbmcsIHByb3BzOiBUaGFub3NRdWVyeVByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IHsgbmFtZXNwYWNlLCBjb25maWcgfSA9IHByb3BzO1xuXG4gICAgLy8gQ3JlYXRlIERlcGxveW1lbnRcbiAgICAvLyBXYXZlIDM6IFF1ZXJ5IExheWVyIC0gYWZ0ZXIgUHJvbWV0aGV1cyBhbmQgU3RvcmUgYXJlIHJlYWR5XG4gICAgbmV3IEt1YmVEZXBsb3ltZW50KHRoaXMsICdkZXBsb3ltZW50Jywge1xuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ3RoYW5vcy1xdWVyeScsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3MtcXVlcnknLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9jb21wb25lbnQnOiAncXVlcnknLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZic6ICdtb25pdG9yaW5nJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICczJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBzcGVjOiB7XG4gICAgICAgIHJlcGxpY2FzOiBjb25maWcucmVwbGljYXMudGhhbm9zUXVlcnksXG4gICAgICAgIHNlbGVjdG9yOiB7XG4gICAgICAgICAgbWF0Y2hMYWJlbHM6IHtcbiAgICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9uYW1lJzogJ3RoYW5vcy1xdWVyeScsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAgdGVtcGxhdGU6IHtcbiAgICAgICAgICBtZXRhZGF0YToge1xuICAgICAgICAgICAgbGFiZWxzOiB7XG4gICAgICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9uYW1lJzogJ3RoYW5vcy1xdWVyeScsXG4gICAgICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9jb21wb25lbnQnOiAncXVlcnknLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICB9LFxuICAgICAgICAgIHNwZWM6IHtcbiAgICAgICAgICAgIC8vIE5vIGFyY2ggbm9kZVNlbGVjdG9yOiBUaGFub3MgaW1hZ2VzIGFyZSBtdWx0aS1hcmNoOyBsZXQgdGhlXG4gICAgICAgICAgICAvLyBzY2hlZHVsZXIgcGxhY2UgdGhlc2Ugb24gYW55IHdvcmtlciAobGVnYWN5IEFSTTY0IHBpbiByZW1vdmVkKS5cblxuICAgICAgICAgICAgLy8gU3ByZWFkIHJlcGxpY2FzIGFjcm9zcyBkaWZmZXJlbnQgbm9kZXMgZm9yIEhBXG4gICAgICAgICAgICBhZmZpbml0eToge1xuICAgICAgICAgICAgICBwb2RBbnRpQWZmaW5pdHk6IHtcbiAgICAgICAgICAgICAgICBwcmVmZXJyZWREdXJpbmdTY2hlZHVsaW5nSWdub3JlZER1cmluZ0V4ZWN1dGlvbjogW1xuICAgICAgICAgICAgICAgICAge1xuICAgICAgICAgICAgICAgICAgICB3ZWlnaHQ6IDEwMCxcbiAgICAgICAgICAgICAgICAgICAgcG9kQWZmaW5pdHlUZXJtOiB7XG4gICAgICAgICAgICAgICAgICAgICAgbGFiZWxTZWxlY3Rvcjoge1xuICAgICAgICAgICAgICAgICAgICAgICAgbWF0Y2hMYWJlbHM6IHtcbiAgICAgICAgICAgICAgICAgICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL25hbWUnOiAndGhhbm9zLXF1ZXJ5JyxcbiAgICAgICAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICAgICAgICB0b3BvbG9neUtleTogJ2t1YmVybmV0ZXMuaW8vaG9zdG5hbWUnLFxuICAgICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICBdLFxuICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgfSxcblxuICAgICAgICAgICAgY29udGFpbmVyczogW1xuICAgICAgICAgICAgICB7XG4gICAgICAgICAgICAgICAgbmFtZTogJ3RoYW5vcy1xdWVyeScsXG4gICAgICAgICAgICAgICAgaW1hZ2U6IGBxdWF5LmlvL3RoYW5vcy90aGFub3M6JHtjb25maWcudmVyc2lvbnMudGhhbm9zfWAsXG4gICAgICAgICAgICAgICAgYXJnczogW1xuICAgICAgICAgICAgICAgICAgJ3F1ZXJ5JyxcbiAgICAgICAgICAgICAgICAgICctLWxvZy5sZXZlbD1pbmZvJyxcbiAgICAgICAgICAgICAgICAgICctLXF1ZXJ5LnJlcGxpY2EtbGFiZWw9cmVwbGljYScsXG4gICAgICAgICAgICAgICAgICAnLS1xdWVyeS5yZXBsaWNhLWxhYmVsPXByb21ldGhldXNfcmVwbGljYScsXG4gICAgICAgICAgICAgICAgICAvLyBDb25uZWN0IHRvIFByb21ldGhldXMgc2lkZWNhcnMgdmlhIGdSUEMuXG4gICAgICAgICAgICAgICAgICAvLyBUaGUgc2lkZWNhciBnUlBDIHBvcnQgaXMgZXhwb3NlZCBieSB0aGUgb3BlcmF0b3IncyB0aGFub3NcbiAgICAgICAgICAgICAgICAgIC8vIGRpc2NvdmVyeSBzZXJ2aWNlICh0aGFub3NTZXJ2aWNlLmVuYWJsZWQ9dHJ1ZSksIE5PVCBieVxuICAgICAgICAgICAgICAgICAgLy8gcHJvbWV0aGV1cy1vcGVyYXRlZCAod2hpY2ggb25seSBleHBvc2VzIGh0dHAtd2ViOjkwOTApLlxuICAgICAgICAgICAgICAgICAgYC0tZW5kcG9pbnQ9ZG5zc3J2K19ncnBjLl90Y3Aua3ViZS1wcm9tZXRoZXVzLXN0YWNrLXRoYW5vcy1kaXNjb3ZlcnkuJHtuYW1lc3BhY2V9LnN2Yy5jbHVzdGVyLmxvY2FsYCxcbiAgICAgICAgICAgICAgICAgIC8vIENvbm5lY3QgdG8gVGhhbm9zIFN0b3JlIEdhdGV3YXlcbiAgICAgICAgICAgICAgICAgIGAtLWVuZHBvaW50PWRuc3NyditfZ3JwYy5fdGNwLnRoYW5vcy1zdG9yZS1ncnBjLiR7bmFtZXNwYWNlfS5zdmMuY2x1c3Rlci5sb2NhbGAsXG4gICAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgICAgICBwb3J0czogW1xuICAgICAgICAgICAgICAgICAge1xuICAgICAgICAgICAgICAgICAgICBuYW1lOiAnaHR0cCcsXG4gICAgICAgICAgICAgICAgICAgIGNvbnRhaW5lclBvcnQ6IDEwOTAyLFxuICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgICAgICAgbmFtZTogJ2dycGMnLFxuICAgICAgICAgICAgICAgICAgICBjb250YWluZXJQb3J0OiAxMDkwMSxcbiAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgICAgICBsaXZlbmVzc1Byb2JlOiB7XG4gICAgICAgICAgICAgICAgICBodHRwR2V0OiB7XG4gICAgICAgICAgICAgICAgICAgIHBhdGg6ICcvLS9oZWFsdGh5JyxcbiAgICAgICAgICAgICAgICAgICAgcG9ydDogSW50T3JTdHJpbmcuZnJvbU51bWJlcigxMDkwMiksIC8vIEhUVFAgcG9ydCAobmFtZWQgJ2h0dHAnIGluIHBvcnRzIGxpc3QpXG4gICAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgICAgaW5pdGlhbERlbGF5U2Vjb25kczogMTAsXG4gICAgICAgICAgICAgICAgICBwZXJpb2RTZWNvbmRzOiAzMCxcbiAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgIHJlYWRpbmVzc1Byb2JlOiB7XG4gICAgICAgICAgICAgICAgICBodHRwR2V0OiB7XG4gICAgICAgICAgICAgICAgICAgIHBhdGg6ICcvLS9yZWFkeScsXG4gICAgICAgICAgICAgICAgICAgIHBvcnQ6IEludE9yU3RyaW5nLmZyb21OdW1iZXIoMTA5MDIpLCAvLyBIVFRQIHBvcnQgKG5hbWVkICdodHRwJyBpbiBwb3J0cyBsaXN0KVxuICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICAgIGluaXRpYWxEZWxheVNlY29uZHM6IDE1LFxuICAgICAgICAgICAgICAgICAgcGVyaW9kU2Vjb25kczogNSxcbiAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICAgIHJlc291cmNlczoge1xuICAgICAgICAgICAgICAgICAgcmVxdWVzdHM6IHtcbiAgICAgICAgICAgICAgICAgICAgY3B1OiBRdWFudGl0eS5mcm9tU3RyaW5nKGNvbmZpZy5yZXNvdXJjZXMudGhhbm9zUXVlcnkucmVxdWVzdHMuY3B1KSxcbiAgICAgICAgICAgICAgICAgICAgbWVtb3J5OiBRdWFudGl0eS5mcm9tU3RyaW5nKGNvbmZpZy5yZXNvdXJjZXMudGhhbm9zUXVlcnkucmVxdWVzdHMubWVtb3J5KSxcbiAgICAgICAgICAgICAgICAgIH0sXG4gICAgICAgICAgICAgICAgICBsaW1pdHM6IHtcbiAgICAgICAgICAgICAgICAgICAgY3B1OiBRdWFudGl0eS5mcm9tU3RyaW5nKGNvbmZpZy5yZXNvdXJjZXMudGhhbm9zUXVlcnkubGltaXRzLmNwdSksXG4gICAgICAgICAgICAgICAgICAgIG1lbW9yeTogUXVhbnRpdHkuZnJvbVN0cmluZyhjb25maWcucmVzb3VyY2VzLnRoYW5vc1F1ZXJ5LmxpbWl0cy5tZW1vcnkpLFxuICAgICAgICAgICAgICAgICAgfSxcbiAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgXSxcblxuICAgICAgICAgICAgcHJpb3JpdHlDbGFzc05hbWU6ICdoaWdoLXByaW9yaXR5JyxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgfSxcbiAgICB9KTtcblxuICAgIC8vIENyZWF0ZSBIVFRQIFNlcnZpY2UgKGZvciBHcmFmYW5hKVxuICAgIG5ldyBLdWJlU2VydmljZSh0aGlzLCAnc2VydmljZS1odHRwJywge1xuICAgICAgbWV0YWRhdGE6IHtcbiAgICAgICAgbmFtZTogJ3RoYW5vcy1xdWVyeScsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3MtcXVlcnknLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICczJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBzcGVjOiB7XG4gICAgICAgIHBvcnRzOiBbXG4gICAgICAgICAge1xuICAgICAgICAgICAgbmFtZTogJ2h0dHAnLFxuICAgICAgICAgICAgcG9ydDogOTA5MCxcbiAgICAgICAgICAgIC8vIENvbnRhaW5lciBodHRwIHBvcnQgaXMgMTA5MDIuIEEgYmFyZSBzdHJpbmcgaXMgZHJvcHBlZCBieSBjZGs4c1xuICAgICAgICAgICAgLy8gKHRhcmdldFBvcnQgZXhwZWN0cyBJbnRPclN0cmluZyksIHdoaWNoIHNpbGVudGx5IGRlZmF1bHRlZFxuICAgICAgICAgICAgLy8gdGFyZ2V0UG9ydCB0byA5MDkwIGFuZCBtYWRlIHRoZSBTZXJ2aWNlIHJlZnVzZSBjb25uZWN0aW9ucy5cbiAgICAgICAgICAgIHRhcmdldFBvcnQ6IEludE9yU3RyaW5nLmZyb21TdHJpbmcoJ2h0dHAnKSxcbiAgICAgICAgICAgIHByb3RvY29sOiAnVENQJyxcbiAgICAgICAgICB9LFxuICAgICAgICBdLFxuICAgICAgICBzZWxlY3Rvcjoge1xuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9uYW1lJzogJ3RoYW5vcy1xdWVyeScsXG4gICAgICAgIH0sXG4gICAgICAgIHNlc3Npb25BZmZpbml0eTogJ0NsaWVudElQJyxcbiAgICAgIH0sXG4gICAgfSk7XG5cbiAgICAvLyBDcmVhdGUgZ1JQQyBTZXJ2aWNlIChoZWFkbGVzcywgZm9yIGZ1dHVyZSBRdWVyeSBGcm9udGVuZClcbiAgICBuZXcgS3ViZVNlcnZpY2UodGhpcywgJ3NlcnZpY2UtZ3JwYycsIHtcbiAgICAgIG1ldGFkYXRhOiB7XG4gICAgICAgIG5hbWU6ICd0aGFub3MtcXVlcnktZ3JwYycsXG4gICAgICAgIG5hbWVzcGFjZTogbmFtZXNwYWNlLFxuICAgICAgICBsYWJlbHM6IHtcbiAgICAgICAgICAnYXBwLmt1YmVybmV0ZXMuaW8vbmFtZSc6ICd0aGFub3MtcXVlcnknLFxuICAgICAgICAgICdhcHAua3ViZXJuZXRlcy5pby9tYW5hZ2VkLWJ5JzogJ2NkazhzJyxcbiAgICAgICAgfSxcbiAgICAgICAgYW5ub3RhdGlvbnM6IHtcbiAgICAgICAgICAnYXJnb2NkLmFyZ29wcm9qLmlvL3N5bmMtd2F2ZSc6ICczJyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgICBzcGVjOiB7XG4gICAgICAgIHR5cGU6ICdDbHVzdGVySVAnLFxuICAgICAgICBjbHVzdGVySXA6ICdOb25lJywgLy8gSGVhZGxlc3Mgc2VydmljZSBmb3IgRE5TLWJhc2VkIGRpc2NvdmVyeVxuICAgICAgICBwb3J0czogW1xuICAgICAgICAgIHtcbiAgICAgICAgICAgIG5hbWU6ICdncnBjJyxcbiAgICAgICAgICAgIHBvcnQ6IDEwOTAxLFxuICAgICAgICAgICAgdGFyZ2V0UG9ydDogSW50T3JTdHJpbmcuZnJvbVN0cmluZygnZ3JwYycpLFxuICAgICAgICAgICAgcHJvdG9jb2w6ICdUQ1AnLFxuICAgICAgICAgIH0sXG4gICAgICAgIF0sXG4gICAgICAgIHNlbGVjdG9yOiB7XG4gICAgICAgICAgJ2FwcC5rdWJlcm5ldGVzLmlvL25hbWUnOiAndGhhbm9zLXF1ZXJ5JyxcbiAgICAgICAgfSxcbiAgICAgIH0sXG4gICAgfSk7XG4gIH1cbn1cbiJdfQ==

package/lib/constructs/thanos-s3-bucket.d.ts

@@ -0,0 +1,24 @@
+import { Construct } from 'constructs';
+import { MonitoringConfig } from '../types';
+export interface ThanosS3BucketProps {
+    config: MonitoringConfig;
+}
+/**
+ * Creates Crossplane Bucket resources for Thanos long-term metrics storage.
+ *
+ * This construct generates:
+ * - S3 Bucket (via Crossplane Upbound provider-aws-s3)
+ * - BucketVersioning (for recovery)
+ * - BucketLifecycleConfiguration (2-year retention)
+ *
+ * Prerequisites:
+ * - Crossplane operator installed
+ * - Upbound provider-aws-s3 installed
+ * - ProviderConfig 'hetzner-s3' configured (points to Hetzner S3)
+ * - Hetzner S3 credentials secret exists in crossplane-system
+ *
+ * Sync Wave: 1 (external dependencies - must exist before pods access S3)
+ */
+export declare class ThanosS3BucketConstruct extends Construct {
+    constructor(scope: Construct, id: string, props: ThanosS3BucketProps);
+}