@rio-cloud/cdk-v2-constructs 6.1.0 → 6.2.1

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 All notable changes to this project will be documented in this file. See [commit-and-tag-version](https://github.com/absolute-version/commit-and-tag-version) for commit guidelines.
 
+## [6.2.1](https://bitbucket.collaboration-man.com/projects/RIODEV/repos/cdk-v2-constructs/compare/commits?targetBranch=refs%2Ftags%2Fv6.2.0&sourceBranch=refs%2Ftags%2Fv6.2.1) (2024-07-19)
+
+
+### Bug Fixes
+
+* restore the absent files from the previous commit that caused a faulty release ([3f2d0ad](https://bitbucket.collaboration-man.com/projects/RIODEV/repos/cdk-v2-constructs/commits/3f2d0add3ba07e68cf6cd5d9d9d0c557c91f01eb))
+
+## [6.2.0](https://bitbucket.collaboration-man.com/projects/RIODEV/repos/cdk-v2-constructs/compare/commits?targetBranch=refs%2Ftags%2Fv6.1.0&sourceBranch=refs%2Ftags%2Fv6.2.0) (2024-07-19)
+
+
+### Features
+
+* Adding GitLabRunner, RunnerRoles, and SpotServiceLinkedRole constructs as SmartRoute contribution ([d426937](https://bitbucket.collaboration-man.com/projects/RIODEV/repos/cdk-v2-constructs/commits/d4269373e4cf90e3d8803e0755b15c5fdb808ee1))
+* Bump version in prep vor release of GitLab constructs ([7e75755](https://bitbucket.collaboration-man.com/projects/RIODEV/repos/cdk-v2-constructs/commits/7e75755e9cd42fb85187b9e37a4f9e1b27a253e1))
+
 ## [6.1.0](https://bitbucket.collaboration-man.com/projects/RIODEV/repos/cdk-v2-constructs/compare/commits?targetBranch=refs%2Ftags%2Fv6.0.1&sourceBranch=refs%2Ftags%2Fv6.1.0) (2024-07-11)
 
 

package/lib/contributions/smart-route/gitlab-runner/autoscaling-runner.d.ts

@@ -0,0 +1,87 @@
+import { Environment, Stack } from 'aws-cdk-lib';
+import { InstanceType } from 'aws-cdk-lib/aws-ec2';
+import { IRole } from 'aws-cdk-lib/aws-iam';
+import { StringParameter } from 'aws-cdk-lib/aws-ssm';
+import { Construct } from 'constructs';
+/**
+ * The GitLabRunnerProps require the VPC ID, a defined environment of account and region, optional
+ * runner configuration and optionally the GitLab Runner Manager instance type. By default, a T3 Micro instance will be used.
+ * For larger workloads and very active teams it is recommended to use T3 Small for the manager instead.
+ */
+export interface GitLabRunnerProps {
+    readonly env: Environment;
+    readonly runnersWorkerProps?: GitlabRunnerWorkerProps[];
+    readonly managerInstanceType?: InstanceType;
+}
+/**
+ * The GitlabRunnerWorkerProps interface provides a simplified GitLab Runner worker configuration
+ * requiring a token as an SSM parameter, one of the valid gitlab URLs, instance of you choice, the desired max spot price,
+ * whether to use spot instance or not and a default role.
+ * It is recommended to use the RunnerRoles construct, and it's exposed default runner role.
+ */
+export interface GitlabRunnerWorkerProps {
+    /** The SSM StringParameter with the registered runner token  */
+    token: StringParameter;
+    /** The GitLab instance URL, either https://gitlab.cicd.man or https://gitlab.collaborationlayer-traton.com */
+    gitInstanceUrl: GitlabInstanceUrl;
+    /** The instance type for the runner worker */
+    instanceType: InstanceType;
+    /** The desired max spot price */
+    spotPrice: number;
+    /** Whether to use spot instance or not, Requires ServiceLinked Role for EC2 Spot to be deployed in the account */
+    requestSpotPrice: boolean;
+    /** The default role for the runner worker when spawned */
+    defaultWorkerRole: IRole;
+    /** The maximum number of builds for an instance before it has to be decommissioned. Default 10 */
+    maxBuilds?: number;
+    /** The maximum number of instances to keep idle for new incoming jobs. Default 5 */
+    maxIdleInstance?: number;
+    /** The maximum idle time seconds for an instance. Default 900 seconds */
+    maxIdleTime?: number;
+}
+export type GitlabInstanceUrl = 'https://gitlab.cicd.man' | 'https://gitlab.collaborationlayer-traton.com';
+/**
+ * The construct create the GitLabRunner Manager instance which will autoscale Runner instances based on the configuration.
+ * By default, the construct will create a Runner with a manager T3 Micro instance which will be enabled to spawn T3 Large Runner
+ * worker spot instance. The default runner Role has only the permissions to upload and download from the S3 runner cache.
+ *
+ * minimal configuration with runner spot instance:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'}
+ * });
+ *```
+ * recommended:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * const runnerRoles = new RunnerRoles(stack, 'RunnerRoles', {env: {account: '123456789012', region: 'eu-west-1'}});
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'},
+ *  runnersWorkerProps: [
+ *    {
+ *      token: myTokenForTaggedRunner1, // with this runner we only want to run jobs that require more power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.M7I_FLEX, InstanceSize.XLARGE), // exemplary larger runner
+ *      spotPrice: 0.2, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *    {
+ *      token: myTokenForTaggedRunner2, // with this runner we want to run all generic jobs that do not require much processing power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MEDIUM), // exemplary smaller runner
+ *      spotPrice: 0.044, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *  ],
+ * });
+ * ```
+ */
+export declare class GitlabRunner extends Construct {
+    private autoscalingConfig;
+    constructor(scope: Stack, id: string, props: GitLabRunnerProps);
+    private createWorkerConfigurations;
+    private getDefaultRunnerWorkerConfig;
+}

package/lib/contributions/smart-route/gitlab-runner/autoscaling-runner.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitlabRunner = void 0;
+// eslint-disable-next-line import/no-extraneous-dependencies
+const cdk_autoscaling_gitlab_runner_1 = require("@pepperize/cdk-autoscaling-gitlab-runner");
+const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
+const aws_ssm_1 = require("aws-cdk-lib/aws-ssm");
+const constructs_1 = require("constructs");
+const rio_landing_zone_1 = require("../../../rio-landing-zone");
+/**
+ * The construct create the GitLabRunner Manager instance which will autoscale Runner instances based on the configuration.
+ * By default, the construct will create a Runner with a manager T3 Micro instance which will be enabled to spawn T3 Large Runner
+ * worker spot instance. The default runner Role has only the permissions to upload and download from the S3 runner cache.
+ *
+ * minimal configuration with runner spot instance:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'}
+ * });
+ *```
+ * recommended:
+ * ```ts
+ * new SpotServiceLinkedRole(stack, 'SpotLinkedRole');
+ * const runnerRoles = new RunnerRoles(stack, 'RunnerRoles', {env: {account: '123456789012', region: 'eu-west-1'}});
+ * new GitlabRunner(stack, 'GitLabRunner', {
+ *  env: {account: '123456789012', region: 'eu-west-1'},
+ *  runnersWorkerProps: [
+ *    {
+ *      token: myTokenForTaggedRunner1, // with this runner we only want to run jobs that require more power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.M7I_FLEX, InstanceSize.XLARGE), // exemplary larger runner
+ *      spotPrice: 0.2, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *    {
+ *      token: myTokenForTaggedRunner2, // with this runner we want to run all generic jobs that do not require much processing power
+ *      gitInstanceUrl: 'https://gitlab.cicd.man', // or the Traton GitLab
+ *      instanceType: InstanceType.of(InstanceClass.T3, InstanceSize.MEDIUM), // exemplary smaller runner
+ *      spotPrice: 0.044, // exemplary spot price
+ *      requestSpotPrice: true,
+ *      defaultWorkerRole: runnerRoles.runnerBaseRole, // use the base role
+ *    },
+ *  ],
+ * });
+ * ```
+ */
+class GitlabRunner extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        this.autoscalingConfig = [{
+                periods: ['* * 7-24 * * mon-fri *'],
+                timezone: 'Europe/Berlin',
+            }];
+        const vpc = rio_landing_zone_1.RioLandingZone.getDefaultVpc(scope);
+        const runnerConfig = props.runnersWorkerProps ?
+            this.createWorkerConfigurations(props.runnersWorkerProps, props.env) :
+            this.getDefaultRunnerWorkerConfig(props.env);
+        const managerInstance = props.managerInstanceType ?? aws_ec2_1.InstanceType.of(aws_ec2_1.InstanceClass.T3, aws_ec2_1.InstanceSize.MICRO);
+        new cdk_autoscaling_gitlab_runner_1.GitlabRunnerAutoscaling(scope, `GLR${scope.stackName}`, {
+            runners: runnerConfig,
+            network: {
+                vpc: vpc,
+            },
+            manager: {
+                instanceType: managerInstance,
+            },
+            checkInterval: 30, // check every 30s for pending jobs
+            concurrent: 300, // Global limit of concurrent jobs,
+        });
+    }
+    createWorkerConfigurations(workerProps, env) {
+        return workerProps.map(val => ({
+            token: val.token,
+            role: val.defaultWorkerRole,
+            configuration: {
+                url: val.gitInstanceUrl,
+                machine: {
+                    autoscaling: this.autoscalingConfig,
+                    maxBuilds: val.maxBuilds ?? 10,
+                    idleCount: val.maxIdleInstance ?? 5,
+                    idleTime: val.maxIdleTime ?? 900,
+                    machineOptions: {
+                        requestSpotInstance: val.requestSpotPrice,
+                        spotPrice: val.spotPrice,
+                    },
+                },
+                environment: [
+                    'DOCKER_DRIVER=overlay2',
+                    'DOCKER_TLS_DIRCE=/certs',
+                    `DOCKER_AUTH_CONFIG={"credHelpers": { "public.ecr.aws": "ecr-login", "${env.account}.dkr.ecr.<region>.amazonaws.com": "ecr-login" } }`,
+                ],
+            },
+            instanceType: val.instanceType,
+        }));
+    }
+    getDefaultRunnerWorkerConfig(env) {
+        const gitLabRunnerTokenParameter = aws_ssm_1.StringParameter.fromStringParameterAttributes(this, 'RunnerToken', {
+            parameterName: '/config/gitlab-runner-cdk/token',
+        });
+        return [{
+                token: gitLabRunnerTokenParameter,
+                configuration: {
+                    url: 'https://gitlab.cicd.man',
+                    limit: 0,
+                    machine: {
+                        maxBuilds: 10,
+                        autoscaling: this.autoscalingConfig,
+                        idleCount: 5,
+                        idleTime: 900,
+                        machineOptions: {
+                            requestSpotInstance: true,
+                            spotPrice: 0.09,
+                        },
+                    },
+                    environment: [
+                        'DOCKER_DRIVER=overlay2',
+                        'DOCKER_TLS_DIRCE=/certs',
+                        `DOCKER_AUTH_CONFIG={"credHelpers": { "public.ecr.aws": "ecr-login", "${env.account}.dkr.ecr.<region>.amazonaws.com": "ecr-login" } }`,
+                    ],
+                },
+                instanceType: aws_ec2_1.InstanceType.of(aws_ec2_1.InstanceClass.T3, aws_ec2_1.InstanceSize.LARGE),
+            }];
+    }
+}
+exports.GitlabRunner = GitlabRunner;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXV0b3NjYWxpbmctcnVubmVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NvbnRyaWJ1dGlvbnMvc21hcnQtcm91dGUvZ2l0bGFiLXJ1bm5lci9hdXRvc2NhbGluZy1ydW5uZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkRBQTZEO0FBQzdELDRGQUlrRDtBQUVsRCxpREFBZ0Y7QUFFaEYsaURBQXNEO0FBQ3RELDJDQUF1QztBQUN2QyxnRUFBMkQ7QUE0QzNEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQXNDRztBQUNILE1BQWEsWUFBYSxTQUFRLHNCQUFTO0lBS3pDLFlBQVksS0FBWSxFQUFFLEVBQVcsRUFBRSxLQUF3QjtRQUM3RCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBTFgsc0JBQWlCLEdBQStCLENBQUM7Z0JBQ3ZELE9BQU8sRUFBRSxDQUFDLHdCQUF3QixDQUFDO2dCQUNuQyxRQUFRLEVBQUUsZUFBZTthQUMxQixDQUFDLENBQUM7UUFJRCxNQUFNLEdBQUcsR0FBRyxpQ0FBYyxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUVoRCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUM3QyxJQUFJLENBQUMsMEJBQTBCLENBQUMsS0FBSyxDQUFDLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3RFLElBQUksQ0FBQyw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFFL0MsTUFBTSxlQUFlLEdBQUcsS0FBSyxDQUFDLG1CQUFtQixJQUFJLHNCQUFZLENBQUMsRUFBRSxDQUFDLHVCQUFhLENBQUMsRUFBRSxFQUFFLHNCQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFM0csSUFBSSx1REFBdUIsQ0FBQyxLQUFLLEVBQUUsTUFBTSxLQUFLLENBQUMsU0FBUyxFQUFFLEVBQUU7WUFDMUQsT0FBTyxFQUFFLFlBQVk7WUFDckIsT0FBTyxFQUFFO2dCQUNQLEdBQUcsRUFBRSxHQUFHO2FBQ1Q7WUFDRCxPQUFPLEVBQUU7Z0JBQ1AsWUFBWSxFQUFFLGVBQWU7YUFDOUI7WUFDRCxhQUFhLEVBQUUsRUFBRSxFQUFFLG1DQUFtQztZQUN0RCxVQUFVLEVBQUUsR0FBRyxFQUFFLG1DQUFtQztTQUNyRCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU8sMEJBQTBCLENBQUMsV0FBc0MsRUFBRSxHQUFnQjtRQUN6RixPQUFPLFdBQVcsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUM1QjtZQUNFLEtBQUssRUFBRSxHQUFHLENBQUMsS0FBSztZQUNoQixJQUFJLEVBQUUsR0FBRyxDQUFDLGlCQUFpQjtZQUMzQixhQUFhLEVBQUU7Z0JBQ2IsR0FBRyxFQUFFLEdBQUcsQ0FBQyxjQUFjO2dCQUN2QixPQUFPLEVBQUU7b0JBQ1AsV0FBVyxFQUFFLElBQUksQ0FBQyxpQkFBaUI7b0JBQ25DLFNBQVMsRUFBRSxHQUFHLENBQUMsU0FBUyxJQUFJLEVBQUU7b0JBQzlCLFNBQVMsRUFBRSxHQUFHLENBQUMsZUFBZSxJQUFJLENBQUM7b0JBQ25DLFFBQVEsRUFBRSxHQUFHLENBQUMsV0FBVyxJQUFJLEdBQUc7b0JBQ2hDLGNBQWMsRUFBRTt3QkFDZCxtQkFBbUIsRUFBRSxHQUFHLENBQUMsZ0JBQWdCO3dCQUN6QyxTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVM7cUJBQ3pCO2lCQUNGO2dCQUNELFdBQVcsRUFBRTtvQkFDWCx3QkFBd0I7b0JBQ3hCLHlCQUF5QjtvQkFDekIsd0VBQ0UsR0FBRyxDQUFDLE9BQ04sbURBQW1EO2lCQUNwRDthQUNGO1lBQ0QsWUFBWSxFQUFFLEdBQUcsQ0FBQyxZQUFZO1NBQy9CLENBQ0YsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLDRCQUE0QixDQUFDLEdBQWdCO1FBQ25ELE1BQU0sMEJBQTBCLEdBQUcseUJBQWUsQ0FBQyw2QkFBNkIsQ0FBQyxJQUFJLEVBQUUsYUFBYSxFQUFFO1lBQ3BHLGFBQWEsRUFBRSxpQ0FBaUM7U0FDakQsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxDQUFDO2dCQUNOLEtBQUssRUFBRSwwQkFBMEI7Z0JBQ2pDLGFBQWEsRUFBRTtvQkFDYixHQUFHLEVBQUUseUJBQXlCO29CQUM5QixLQUFLLEVBQUUsQ0FBQztvQkFDUixPQUFPLEVBQUU7d0JBQ1AsU0FBUyxFQUFFLEVBQUU7d0JBQ2IsV0FBVyxFQUFFLElBQUksQ0FBQyxpQkFBaUI7d0JBQ25DLFNBQVMsRUFBRSxDQUFDO3dCQUNaLFFBQVEsRUFBRSxHQUFHO3dCQUNiLGNBQWMsRUFBRTs0QkFDZCxtQkFBbUIsRUFBRSxJQUFJOzRCQUN6QixTQUFTLEVBQUUsSUFBSTt5QkFDaEI7cUJBQ0Y7b0JBQ0QsV0FBVyxFQUFFO3dCQUNYLHdCQUF3Qjt3QkFDeEIseUJBQXlCO3dCQUN6Qix3RUFDRSxHQUFHLENBQUMsT0FDTixtREFBbUQ7cUJBQ3BEO2lCQUNGO2dCQUNELFlBQVksRUFBRSxzQkFBWSxDQUFDLEVBQUUsQ0FBQyx1QkFBYSxDQUFDLEVBQUUsRUFBRSxzQkFBWSxDQUFDLEtBQUssQ0FBQzthQUNwRSxDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUF6RkQsb0NBeUZDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gZXNsaW50LWRpc2FibGUtbmV4dC1saW5lIGltcG9ydC9uby1leHRyYW5lb3VzLWRlcGVuZGVuY2llc1xuaW1wb3J0IHtcbiAgQXV0b3NjYWxpbmdDb25maWd1cmF0aW9uLFxuICBHaXRsYWJSdW5uZXJBdXRvc2NhbGluZyxcbiAgR2l0bGFiUnVubmVyQXV0b3NjYWxpbmdKb2JSdW5uZXJQcm9wcyxcbn0gZnJvbSAnQHBlcHBlcml6ZS9jZGstYXV0b3NjYWxpbmctZ2l0bGFiLXJ1bm5lcic7XG5pbXBvcnQgeyBFbnZpcm9ubWVudCwgU3RhY2sgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBJbnN0YW5jZUNsYXNzLCBJbnN0YW5jZVNpemUsIEluc3RhbmNlVHlwZSB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1lYzInO1xuaW1wb3J0IHsgSVJvbGUgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IFN0cmluZ1BhcmFtZXRlciB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1zc20nO1xuaW1wb3J0IHsgQ29uc3RydWN0IH0gZnJvbSAnY29uc3RydWN0cyc7XG5pbXBvcnQgeyBSaW9MYW5kaW5nWm9uZSB9IGZyb20gJy4uLy4uLy4uL3Jpby1sYW5kaW5nLXpvbmUnO1xuXG5cbi8qKlxuICogVGhlIEdpdExhYlJ1bm5lclByb3BzIHJlcXVpcmUgdGhlIFZQQyBJRCwgYSBkZWZpbmVkIGVudmlyb25tZW50IG9mIGFjY291bnQgYW5kIHJlZ2lvbiwgb3B0aW9uYWxcbiAqIHJ1bm5lciBjb25maWd1cmF0aW9uIGFuZCBvcHRpb25hbGx5IHRoZSBHaXRMYWIgUnVubmVyIE1hbmFnZXIgaW5zdGFuY2UgdHlwZS4gQnkgZGVmYXVsdCwgYSBUMyBNaWNybyBpbnN0YW5jZSB3aWxsIGJlIHVzZWQuXG4gKiBGb3IgbGFyZ2VyIHdvcmtsb2FkcyBhbmQgdmVyeSBhY3RpdmUgdGVhbXMgaXQgaXMgcmVjb21tZW5kZWQgdG8gdXNlIFQzIFNtYWxsIGZvciB0aGUgbWFuYWdlciBpbnN0ZWFkLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIEdpdExhYlJ1bm5lclByb3BzIHtcbiAgcmVhZG9ubHkgZW52OiBFbnZpcm9ubWVudDtcbiAgcmVhZG9ubHkgcnVubmVyc1dvcmtlclByb3BzPzogR2l0bGFiUnVubmVyV29ya2VyUHJvcHNbXTtcbiAgcmVhZG9ubHkgbWFuYWdlckluc3RhbmNlVHlwZT86IEluc3RhbmNlVHlwZTtcbn1cblxuLyoqXG4gKiBUaGUgR2l0bGFiUnVubmVyV29ya2VyUHJvcHMgaW50ZXJmYWNlIHByb3ZpZGVzIGEgc2ltcGxpZmllZCBHaXRMYWIgUnVubmVyIHdvcmtlciBjb25maWd1cmF0aW9uXG4gKiByZXF1aXJpbmcgYSB0b2tlbiBhcyBhbiBTU00gcGFyYW1ldGVyLCBvbmUgb2YgdGhlIHZhbGlkIGdpdGxhYiBVUkxzLCBpbnN0YW5jZSBvZiB5b3UgY2hvaWNlLCB0aGUgZGVzaXJlZCBtYXggc3BvdCBwcmljZSxcbiAqIHdoZXRoZXIgdG8gdXNlIHNwb3QgaW5zdGFuY2Ugb3Igbm90IGFuZCBhIGRlZmF1bHQgcm9sZS5cbiAqIEl0IGlzIHJlY29tbWVuZGVkIHRvIHVzZSB0aGUgUnVubmVyUm9sZXMgY29uc3RydWN0LCBhbmQgaXQncyBleHBvc2VkIGRlZmF1bHQgcnVubmVyIHJvbGUuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgR2l0bGFiUnVubmVyV29ya2VyUHJvcHMge1xuICAvKiogVGhlIFNTTSBTdHJpbmdQYXJhbWV0ZXIgd2l0aCB0aGUgcmVnaXN0ZXJlZCBydW5uZXIgdG9rZW4gICovXG4gIHRva2VuOiBTdHJpbmdQYXJhbWV0ZXI7XG4gIC8qKiBUaGUgR2l0TGFiIGluc3RhbmNlIFVSTCwgZWl0aGVyIGh0dHBzOi8vZ2l0bGFiLmNpY2QubWFuIG9yIGh0dHBzOi8vZ2l0bGFiLmNvbGxhYm9yYXRpb25sYXllci10cmF0b24uY29tICovXG4gIGdpdEluc3RhbmNlVXJsOiBHaXRsYWJJbnN0YW5jZVVybDtcbiAgLyoqIFRoZSBpbnN0YW5jZSB0eXBlIGZvciB0aGUgcnVubmVyIHdvcmtlciAqL1xuICBpbnN0YW5jZVR5cGU6IEluc3RhbmNlVHlwZTtcbiAgLyoqIFRoZSBkZXNpcmVkIG1heCBzcG90IHByaWNlICovXG4gIHNwb3RQcmljZTogbnVtYmVyO1xuICAvKiogV2hldGhlciB0byB1c2Ugc3BvdCBpbnN0YW5jZSBvciBub3QsIFJlcXVpcmVzIFNlcnZpY2VMaW5rZWQgUm9sZSBmb3IgRUMyIFNwb3QgdG8gYmUgZGVwbG95ZWQgaW4gdGhlIGFjY291bnQgKi9cbiAgcmVxdWVzdFNwb3RQcmljZTogYm9vbGVhbjtcbiAgLyoqIFRoZSBkZWZhdWx0IHJvbGUgZm9yIHRoZSBydW5uZXIgd29ya2VyIHdoZW4gc3Bhd25lZCAqL1xuICBkZWZhdWx0V29ya2VyUm9sZTogSVJvbGU7XG4gIC8qKiBUaGUgbWF4aW11bSBudW1iZXIgb2YgYnVpbGRzIGZvciBhbiBpbnN0YW5jZSBiZWZvcmUgaXQgaGFzIHRvIGJlIGRlY29tbWlzc2lvbmVkLiBEZWZhdWx0IDEwICovXG4gIG1heEJ1aWxkcz86IG51bWJlcjtcbiAgLyoqIFRoZSBtYXhpbXVtIG51bWJlciBvZiBpbnN0YW5jZXMgdG8ga2VlcCBpZGxlIGZvciBuZXcgaW5jb21pbmcgam9icy4gRGVmYXVsdCA1ICovXG4gIG1heElkbGVJbnN0YW5jZT86IG51bWJlcjtcbiAgLyoqIFRoZSBtYXhpbXVtIGlkbGUgdGltZSBzZWNvbmRzIGZvciBhbiBpbnN0YW5jZS4gRGVmYXVsdCA5MDAgc2Vjb25kcyAqL1xuICBtYXhJZGxlVGltZT86IG51bWJlcjtcbn1cblxuZXhwb3J0IHR5cGUgR2l0bGFiSW5zdGFuY2VVcmwgPSAnaHR0cHM6Ly9naXRsYWIuY2ljZC5tYW4nIHwgJ2h0dHBzOi8vZ2l0bGFiLmNvbGxhYm9yYXRpb25sYXllci10cmF0b24uY29tJ1xuXG5cbi8qKlxuICogVGhlIGNvbnN0cnVjdCBjcmVhdGUgdGhlIEdpdExhYlJ1bm5lciBNYW5hZ2VyIGluc3RhbmNlIHdoaWNoIHdpbGwgYXV0b3NjYWxlIFJ1bm5lciBpbnN0YW5jZXMgYmFzZWQgb24gdGhlIGNvbmZpZ3VyYXRpb24uXG4gKiBCeSBkZWZhdWx0LCB0aGUgY29uc3RydWN0IHdpbGwgY3JlYXRlIGEgUnVubmVyIHdpdGggYSBtYW5hZ2VyIFQzIE1pY3JvIGluc3RhbmNlIHdoaWNoIHdpbGwgYmUgZW5hYmxlZCB0byBzcGF3biBUMyBMYXJnZSBSdW5uZXJcbiAqIHdvcmtlciBzcG90IGluc3RhbmNlLiBUaGUgZGVmYXVsdCBydW5uZXIgUm9sZSBoYXMgb25seSB0aGUgcGVybWlzc2lvbnMgdG8gdXBsb2FkIGFuZCBkb3dubG9hZCBmcm9tIHRoZSBTMyBydW5uZXIgY2FjaGUuXG4gKlxuICogbWluaW1hbCBjb25maWd1cmF0aW9uIHdpdGggcnVubmVyIHNwb3QgaW5zdGFuY2U6XG4gKiBgYGB0c1xuICogbmV3IFNwb3RTZXJ2aWNlTGlua2VkUm9sZShzdGFjaywgJ1Nwb3RMaW5rZWRSb2xlJyk7XG4gKiBuZXcgR2l0bGFiUnVubmVyKHN0YWNrLCAnR2l0TGFiUnVubmVyJywge1xuICogIGVudjoge2FjY291bnQ6ICcxMjM0NTY3ODkwMTInLCByZWdpb246ICdldS13ZXN0LTEnfVxuICogfSk7XG4gKmBgYFxuICogcmVjb21tZW5kZWQ6XG4gKiBgYGB0c1xuICogbmV3IFNwb3RTZXJ2aWNlTGlua2VkUm9sZShzdGFjaywgJ1Nwb3RMaW5rZWRSb2xlJyk7XG4gKiBjb25zdCBydW5uZXJSb2xlcyA9IG5ldyBSdW5uZXJSb2xlcyhzdGFjaywgJ1J1bm5lclJvbGVzJywge2Vudjoge2FjY291bnQ6ICcxMjM0NTY3ODkwMTInLCByZWdpb246ICdldS13ZXN0LTEnfX0pO1xuICogbmV3IEdpdGxhYlJ1bm5lcihzdGFjaywgJ0dpdExhYlJ1bm5lcicsIHtcbiAqICBlbnY6IHthY2NvdW50OiAnMTIzNDU2Nzg5MDEyJywgcmVnaW9uOiAnZXUtd2VzdC0xJ30sXG4gKiAgcnVubmVyc1dvcmtlclByb3BzOiBbXG4gKiAgICB7XG4gKiAgICAgIHRva2VuOiBteVRva2VuRm9yVGFnZ2VkUnVubmVyMSwgLy8gd2l0aCB0aGlzIHJ1bm5lciB3ZSBvbmx5IHdhbnQgdG8gcnVuIGpvYnMgdGhhdCByZXF1aXJlIG1vcmUgcG93ZXJcbiAqICAgICAgZ2l0SW5zdGFuY2VVcmw6ICdodHRwczovL2dpdGxhYi5jaWNkLm1hbicsIC8vIG9yIHRoZSBUcmF0b24gR2l0TGFiXG4gKiAgICAgIGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlLm9mKEluc3RhbmNlQ2xhc3MuTTdJX0ZMRVgsIEluc3RhbmNlU2l6ZS5YTEFSR0UpLCAvLyBleGVtcGxhcnkgbGFyZ2VyIHJ1bm5lclxuICogICAgICBzcG90UHJpY2U6IDAuMiwgLy8gZXhlbXBsYXJ5IHNwb3QgcHJpY2VcbiAqICAgICAgcmVxdWVzdFNwb3RQcmljZTogdHJ1ZSxcbiAqICAgICAgZGVmYXVsdFdvcmtlclJvbGU6IHJ1bm5lclJvbGVzLnJ1bm5lckJhc2VSb2xlLCAvLyB1c2UgdGhlIGJhc2Ugcm9sZVxuICogICAgfSxcbiAqICAgIHtcbiAqICAgICAgdG9rZW46IG15VG9rZW5Gb3JUYWdnZWRSdW5uZXIyLCAvLyB3aXRoIHRoaXMgcnVubmVyIHdlIHdhbnQgdG8gcnVuIGFsbCBnZW5lcmljIGpvYnMgdGhhdCBkbyBub3QgcmVxdWlyZSBtdWNoIHByb2Nlc3NpbmcgcG93ZXJcbiAqICAgICAgZ2l0SW5zdGFuY2VVcmw6ICdodHRwczovL2dpdGxhYi5jaWNkLm1hbicsIC8vIG9yIHRoZSBUcmF0b24gR2l0TGFiXG4gKiAgICAgIGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlLm9mKEluc3RhbmNlQ2xhc3MuVDMsIEluc3RhbmNlU2l6ZS5NRURJVU0pLCAvLyBleGVtcGxhcnkgc21hbGxlciBydW5uZXJcbiAqICAgICAgc3BvdFByaWNlOiAwLjA0NCwgLy8gZXhlbXBsYXJ5IHNwb3QgcHJpY2VcbiAqICAgICAgcmVxdWVzdFNwb3RQcmljZTogdHJ1ZSxcbiAqICAgICAgZGVmYXVsdFdvcmtlclJvbGU6IHJ1bm5lclJvbGVzLnJ1bm5lckJhc2VSb2xlLCAvLyB1c2UgdGhlIGJhc2Ugcm9sZVxuICogICAgfSxcbiAqICBdLFxuICogfSk7XG4gKiBgYGBcbiAqL1xuZXhwb3J0IGNsYXNzIEdpdGxhYlJ1bm5lciBleHRlbmRzIENvbnN0cnVjdCB7XG4gIHByaXZhdGUgYXV0b3NjYWxpbmdDb25maWc6IEF1dG9zY2FsaW5nQ29uZmlndXJhdGlvbltdID0gW3tcbiAgICBwZXJpb2RzOiBbJyogKiA3LTI0ICogKiBtb24tZnJpIConXSxcbiAgICB0aW1lem9uZTogJ0V1cm9wZS9CZXJsaW4nLFxuICB9XTtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IFN0YWNrLCBpZCA6IHN0cmluZywgcHJvcHM6IEdpdExhYlJ1bm5lclByb3BzKSB7XG4gICAgc3VwZXIoc2NvcGUsIGlkKTtcblxuICAgIGNvbnN0IHZwYyA9IFJpb0xhbmRpbmdab25lLmdldERlZmF1bHRWcGMoc2NvcGUpO1xuXG4gICAgY29uc3QgcnVubmVyQ29uZmlnID0gcHJvcHMucnVubmVyc1dvcmtlclByb3BzID9cbiAgICAgIHRoaXMuY3JlYXRlV29ya2VyQ29uZmlndXJhdGlvbnMocHJvcHMucnVubmVyc1dvcmtlclByb3BzLCBwcm9wcy5lbnYpIDpcbiAgICAgIHRoaXMuZ2V0RGVmYXVsdFJ1bm5lcldvcmtlckNvbmZpZyhwcm9wcy5lbnYpO1xuXG4gICAgY29uc3QgbWFuYWdlckluc3RhbmNlID0gcHJvcHMubWFuYWdlckluc3RhbmNlVHlwZSA/PyBJbnN0YW5jZVR5cGUub2YoSW5zdGFuY2VDbGFzcy5UMywgSW5zdGFuY2VTaXplLk1JQ1JPKTtcblxuICAgIG5ldyBHaXRsYWJSdW5uZXJBdXRvc2NhbGluZyhzY29wZSwgYEdMUiR7c2NvcGUuc3RhY2tOYW1lfWAsIHtcbiAgICAgIHJ1bm5lcnM6IHJ1bm5lckNvbmZpZyxcbiAgICAgIG5ldHdvcms6IHtcbiAgICAgICAgdnBjOiB2cGMsXG4gICAgICB9LFxuICAgICAgbWFuYWdlcjoge1xuICAgICAgICBpbnN0YW5jZVR5cGU6IG1hbmFnZXJJbnN0YW5jZSxcbiAgICAgIH0sXG4gICAgICBjaGVja0ludGVydmFsOiAzMCwgLy8gY2hlY2sgZXZlcnkgMzBzIGZvciBwZW5kaW5nIGpvYnNcbiAgICAgIGNvbmN1cnJlbnQ6IDMwMCwgLy8gR2xvYmFsIGxpbWl0IG9mIGNvbmN1cnJlbnQgam9icyxcbiAgICB9KTtcbiAgfVxuXG4gIHByaXZhdGUgY3JlYXRlV29ya2VyQ29uZmlndXJhdGlvbnMod29ya2VyUHJvcHM6IEdpdGxhYlJ1bm5lcldvcmtlclByb3BzW10sIGVudjogRW52aXJvbm1lbnQpOiBHaXRsYWJSdW5uZXJBdXRvc2NhbGluZ0pvYlJ1bm5lclByb3BzW10ge1xuICAgIHJldHVybiB3b3JrZXJQcm9wcy5tYXAodmFsID0+IChcbiAgICAgIHtcbiAgICAgICAgdG9rZW46IHZhbC50b2tlbixcbiAgICAgICAgcm9sZTogdmFsLmRlZmF1bHRXb3JrZXJSb2xlLFxuICAgICAgICBjb25maWd1cmF0aW9uOiB7XG4gICAgICAgICAgdXJsOiB2YWwuZ2l0SW5zdGFuY2VVcmwsXG4gICAgICAgICAgbWFjaGluZToge1xuICAgICAgICAgICAgYXV0b3NjYWxpbmc6IHRoaXMuYXV0b3NjYWxpbmdDb25maWcsXG4gICAgICAgICAgICBtYXhCdWlsZHM6IHZhbC5tYXhCdWlsZHMgPz8gMTAsXG4gICAgICAgICAgICBpZGxlQ291bnQ6IHZhbC5tYXhJZGxlSW5zdGFuY2UgPz8gNSxcbiAgICAgICAgICAgIGlkbGVUaW1lOiB2YWwubWF4SWRsZVRpbWUgPz8gOTAwLFxuICAgICAgICAgICAgbWFjaGluZU9wdGlvbnM6IHtcbiAgICAgICAgICAgICAgcmVxdWVzdFNwb3RJbnN0YW5jZTogdmFsLnJlcXVlc3RTcG90UHJpY2UsXG4gICAgICAgICAgICAgIHNwb3RQcmljZTogdmFsLnNwb3RQcmljZSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgfSxcbiAgICAgICAgICBlbnZpcm9ubWVudDogW1xuICAgICAgICAgICAgJ0RPQ0tFUl9EUklWRVI9b3ZlcmxheTInLFxuICAgICAgICAgICAgJ0RPQ0tFUl9UTFNfRElSQ0U9L2NlcnRzJyxcbiAgICAgICAgICAgIGBET0NLRVJfQVVUSF9DT05GSUc9e1wiY3JlZEhlbHBlcnNcIjogeyBcInB1YmxpYy5lY3IuYXdzXCI6IFwiZWNyLWxvZ2luXCIsIFwiJHtcbiAgICAgICAgICAgICAgZW52LmFjY291bnRcbiAgICAgICAgICAgIH0uZGtyLmVjci48cmVnaW9uPi5hbWF6b25hd3MuY29tXCI6IFwiZWNyLWxvZ2luXCIgfSB9YCxcbiAgICAgICAgICBdLFxuICAgICAgICB9LFxuICAgICAgICBpbnN0YW5jZVR5cGU6IHZhbC5pbnN0YW5jZVR5cGUsXG4gICAgICB9XG4gICAgKSk7XG4gIH1cblxuICBwcml2YXRlIGdldERlZmF1bHRSdW5uZXJXb3JrZXJDb25maWcoZW52OiBFbnZpcm9ubWVudCk6IEdpdGxhYlJ1bm5lckF1dG9zY2FsaW5nSm9iUnVubmVyUHJvcHNbXSB7XG4gICAgY29uc3QgZ2l0TGFiUnVubmVyVG9rZW5QYXJhbWV0ZXIgPSBTdHJpbmdQYXJhbWV0ZXIuZnJvbVN0cmluZ1BhcmFtZXRlckF0dHJpYnV0ZXModGhpcywgJ1J1bm5lclRva2VuJywge1xuICAgICAgcGFyYW1ldGVyTmFtZTogJy9jb25maWcvZ2l0bGFiLXJ1bm5lci1jZGsvdG9rZW4nLFxuICAgIH0pO1xuICAgIHJldHVybiBbe1xuICAgICAgdG9rZW46IGdpdExhYlJ1bm5lclRva2VuUGFyYW1ldGVyLFxuICAgICAgY29uZmlndXJhdGlvbjoge1xuICAgICAgICB1cmw6ICdodHRwczovL2dpdGxhYi5jaWNkLm1hbicsXG4gICAgICAgIGxpbWl0OiAwLFxuICAgICAgICBtYWNoaW5lOiB7XG4gICAgICAgICAgbWF4QnVpbGRzOiAxMCxcbiAgICAgICAgICBhdXRvc2NhbGluZzogdGhpcy5hdXRvc2NhbGluZ0NvbmZpZyxcbiAgICAgICAgICBpZGxlQ291bnQ6IDUsXG4gICAgICAgICAgaWRsZVRpbWU6IDkwMCxcbiAgICAgICAgICBtYWNoaW5lT3B0aW9uczoge1xuICAgICAgICAgICAgcmVxdWVzdFNwb3RJbnN0YW5jZTogdHJ1ZSxcbiAgICAgICAgICAgIHNwb3RQcmljZTogMC4wOSxcbiAgICAgICAgICB9LFxuICAgICAgICB9LFxuICAgICAgICBlbnZpcm9ubWVudDogW1xuICAgICAgICAgICdET0NLRVJfRFJJVkVSPW92ZXJsYXkyJyxcbiAgICAgICAgICAnRE9DS0VSX1RMU19ESVJDRT0vY2VydHMnLFxuICAgICAgICAgIGBET0NLRVJfQVVUSF9DT05GSUc9e1wiY3JlZEhlbHBlcnNcIjogeyBcInB1YmxpYy5lY3IuYXdzXCI6IFwiZWNyLWxvZ2luXCIsIFwiJHtcbiAgICAgICAgICAgIGVudi5hY2NvdW50XG4gICAgICAgICAgfS5ka3IuZWNyLjxyZWdpb24+LmFtYXpvbmF3cy5jb21cIjogXCJlY3ItbG9naW5cIiB9IH1gLFxuICAgICAgICBdLFxuICAgICAgfSxcbiAgICAgIGluc3RhbmNlVHlwZTogSW5zdGFuY2VUeXBlLm9mKEluc3RhbmNlQ2xhc3MuVDMsIEluc3RhbmNlU2l6ZS5MQVJHRSksXG4gICAgfV07XG4gIH1cbn0iXX0=

package/lib/contributions/smart-route/gitlab-runner/index.d.ts

@@ -0,0 +1,3 @@
+export * from './autoscaling-runner';
+export * from './runner-roles';
+export * from './spot-role';

package/lib/contributions/smart-route/gitlab-runner/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./autoscaling-runner"), exports);
+__exportStar(require("./runner-roles"), exports);
+__exportStar(require("./spot-role"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvY29udHJpYnV0aW9ucy9zbWFydC1yb3V0ZS9naXRsYWItcnVubmVyL2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSx1REFBcUM7QUFDckMsaURBQStCO0FBQy9CLDhDQUE0QiIsInNvdXJjZXNDb250ZW50IjpbImV4cG9ydCAqIGZyb20gJy4vYXV0b3NjYWxpbmctcnVubmVyJztcbmV4cG9ydCAqIGZyb20gJy4vcnVubmVyLXJvbGVzJztcbmV4cG9ydCAqIGZyb20gJy4vc3BvdC1yb2xlJzsiXX0=

package/lib/contributions/smart-route/gitlab-runner/runner-roles.d.ts

@@ -0,0 +1,20 @@
+import { Environment, Stack } from 'aws-cdk-lib';
+import { Role } from 'aws-cdk-lib/aws-iam';
+import { Construct } from 'constructs';
+export interface RunnerRoleProps {
+    env: Environment;
+}
+/**
+ * This construct provides a set of base roles for gitlab runners in order to build, test, validate and deploy applications
+ * on RIO. The roles need to be assumed during job runtime to perform more permissive actions, such as creating certificates to
+ * authenticate towards the RIO MSK, pushing docker images to ECR, performing a secrets backup, deploying stacks,
+ * or to publish an SPA to a S3 bucket. Do not assume the deployment role unless needed.
+ * The base role can be the default role attached to GitLab runners.
+ * The role allows to read various basic parameters such as the NIST data mirror, the OSS license bucket, DataDog keys
+ * and to pull ECR images form public Gallery or the specified account in the environment.
+ * The Role ARNs are export using CFNOutputs. Use the outputs to configure environment variables in your GitLab group.
+ */
+export declare class RunnerRoles extends Construct {
+    readonly runnerBaseRole: Role;
+    constructor(scope: Stack, id: string, props: RunnerRoleProps);
+}

package/lib/contributions/smart-route/gitlab-runner/runner-roles.js

@@ -0,0 +1,330 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RunnerRoles = void 0;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_ecr_1 = require("aws-cdk-lib/aws-ecr");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const aws_s3_1 = require("aws-cdk-lib/aws-s3");
+const aws_ssm_1 = require("aws-cdk-lib/aws-ssm");
+const constructs_1 = require("constructs");
+const rio_landing_zone_1 = require("../../../rio-landing-zone");
+/**
+ * This construct provides a set of base roles for gitlab runners in order to build, test, validate and deploy applications
+ * on RIO. The roles need to be assumed during job runtime to perform more permissive actions, such as creating certificates to
+ * authenticate towards the RIO MSK, pushing docker images to ECR, performing a secrets backup, deploying stacks,
+ * or to publish an SPA to a S3 bucket. Do not assume the deployment role unless needed.
+ * The base role can be the default role attached to GitLab runners.
+ * The role allows to read various basic parameters such as the NIST data mirror, the OSS license bucket, DataDog keys
+ * and to pull ECR images form public Gallery or the specified account in the environment.
+ * The Role ARNs are export using CFNOutputs. Use the outputs to configure environment variables in your GitLab group.
+ */
+class RunnerRoles extends constructs_1.Construct {
+    constructor(scope, id, props) {
+        super(scope, id);
+        const accountNameParameter = rio_landing_zone_1.RioLandingZone.getAccountNameParameter(scope);
+        const teamNameParameter = rio_landing_zone_1.RioLandingZone.getTeamIdentifierParameter(scope);
+        const nistMirrorParameter = aws_ssm_1.StringParameter.fromStringParameterName(this, 'NistMirrorParameter', '/config/nist-data-mirror/url');
+        const ossLicensesBucketParameter = aws_ssm_1.StringParameter.fromStringParameterAttributes(this, 'OssLicensesBucketParameter', {
+            parameterName: '/config/oss-licenses/bucket-name',
+        });
+        const ossLicensesBucket = aws_s3_1.Bucket.fromBucketName(this, 'OssLicensesBucket', ossLicensesBucketParameter.stringValue);
+        const ddApiKeyParam = aws_ssm_1.StringParameter.fromStringParameterAttributes(this, 'DataDogApiKeyParam', {
+            parameterName: '/rio/config/datadog-integration/api-key',
+        });
+        const ddSiteParam = aws_ssm_1.StringParameter.fromStringParameterAttributes(this, 'DataDogSiteParam', {
+            parameterName: '/rio/config/datadog-integration/site',
+        });
+        const kafkaIntegrationPolicy = aws_iam_1.ManagedPolicy.fromManagedPolicyArn(this, 'KafkaIntegrationPolicy', aws_cdk_lib_1.Fn.importValue('kafka-integration-policy-arn'));
+        this.runnerBaseRole = new aws_iam_1.Role(this, 'GlRunnerBuildRole', {
+            assumedBy: new aws_iam_1.ServicePrincipal('ec2.amazonaws.com', {}),
+            inlinePolicies: {
+                CdkSynthLookUp: aws_iam_1.PolicyDocument.fromJson({
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Action: ['s3:*Object', 's3:ListBucket', 's3:GetBucketLocation'],
+                            Resource: ['arn:aws:s3:::cdktoolkit-*'],
+                        },
+                        {
+                            Sid: 'assumerole',
+                            Effect: 'Allow',
+                            Action: ['sts:AssumeRole', 'iam:PassRole'],
+                            Resource: ['arn:aws:iam::*:role/cdk-readOnlyRole', 'arn:aws:iam::*:role/cdk-hnb659fds-lookup-role-*'],
+                        },
+                        {
+                            Sid: 'pullEcrImages',
+                            Effect: 'Allow',
+                            Action: [
+                                'ecr:BatchCheckLayerAvailability',
+                                'ecr:BatchGetImage',
+                                'ecr:DescribeImages',
+                                'ecr:DescribeRepositories',
+                                'ecr:GetDownloadUrlForLayer',
+                            ],
+                            Resource: [`${props.env.account}.dkr.ecr.${props.env.region}.amazonaws.com/*`],
+                        },
+                    ],
+                }),
+            },
+        });
+        this.runnerBaseRole.node.defaultChild.overrideLogicalId('GlRunnerBuildRole');
+        nistMirrorParameter.grantRead(this.runnerBaseRole);
+        ossLicensesBucketParameter.grantRead(this.runnerBaseRole);
+        ossLicensesBucket.grantReadWrite(this.runnerBaseRole);
+        accountNameParameter.grantRead(this.runnerBaseRole);
+        teamNameParameter.grantRead(this.runnerBaseRole);
+        ddApiKeyParam.grantRead(this.runnerBaseRole);
+        ddSiteParam.grantRead(this.runnerBaseRole);
+        aws_ecr_1.PublicGalleryAuthorizationToken.grantRead(this.runnerBaseRole);
+        const webContentPublishRole = new aws_iam_1.Role(this, 'GlRunnerS3WebContentDeployRole', {
+            roleName: 'gl-runner-web-content-s3-deploy-role',
+            assumedBy: this.runnerBaseRole,
+            inlinePolicies: {
+                PublishWebContentOnS3: aws_iam_1.PolicyDocument.fromJson({
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Action: [
+                                's3:Abort*',
+                                's3:DeleteObject*',
+                                's3:GetBucket*',
+                                's3:GetObject*',
+                                's3:List*',
+                                's3:PutObject',
+                                's3:PutObjectLegalHold',
+                                's3:PutObjectRetention',
+                                's3:PutObjectTagging',
+                                's3:PutObjectVersionTagging',
+                            ],
+                            Resource: ['arn:aws:s3:::*'],
+                        },
+                        {
+                            Action: [
+                                'ssm:DescribeParameters',
+                                'ssm:GetParameter',
+                                'ssm:GetParameterHistory',
+                                'ssm:GetParameters',
+                                'ssm:GetParametersByPath',
+                            ],
+                            Effect: 'Allow',
+                            Resource: [
+                                `arn:aws:ssm:${props.env.region}:${props.env.account}:parameter/config/*`,
+                                `arn:aws:ssm:${props.env.region}:${props.env.account}:parameter/secret/*`,
+                            ],
+                        },
+                    ],
+                }),
+            },
+        });
+        webContentPublishRole.node.defaultChild.overrideLogicalId('GlRunnerS3WebContentDeployRole');
+        const createMSKCertRole = new aws_iam_1.Role(this, 'GlRunnerCreateAndSignCertRole', {
+            roleName: 'gl-runner-create-and-sign-rio-msk-cert-role',
+            assumedBy: this.runnerBaseRole,
+            inlinePolicies: {
+                ParameterStoreReadKeyStore: aws_iam_1.PolicyDocument.fromJson({
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Action: [
+                                'ssm:DescribeParameters',
+                                'ssm:GetParameter',
+                                'ssm:GetParameterHistory',
+                                'ssm:GetParameters',
+                                'ssm:GetParametersByPath',
+                            ],
+                            Effect: 'Allow',
+                            Resource: [
+                                `arn:aws:ssm:${props.env.region}:${props.env.account}:parameter/config/*`,
+                                `arn:aws:ssm:${props.env.region}:${props.env.account}:parameter/secret/*`,
+                            ],
+                        },
+                    ],
+                }),
+                SecretsManagerReadKeyStore: aws_iam_1.PolicyDocument.fromJson({
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Action: [
+                                'secretsmanager:DescribeSecret',
+                                'secretsmanager:GetSecretValue',
+                                'secretsmanager:GetResourcePolicy',
+                                'secretsmanager:ListSecretVersionIds',
+                            ],
+                            Effect: 'Allow',
+                            Resource: [
+                                `arn:aws:secretsmanager:${props.env.region}:${props.env.account}:secret:/secret/*/service-keystore-password-??????`,
+                                `arn:aws:secretsmanager:${props.env.region}:${props.env.account}:secret:/secret/*/service-keystore-password`,
+                                `arn:aws:secretsmanager:${props.env.region}:${props.env.account}:secret:/config/*/service-keystore-password-??????`,
+                                `arn:aws:secretsmanager:${props.env.region}:${props.env.account}:secret:/config/*/service-keystore-password`,
+                            ],
+                        },
+                    ],
+                }),
+            },
+            managedPolicies: [kafkaIntegrationPolicy],
+        });
+        accountNameParameter.grantRead(createMSKCertRole);
+        teamNameParameter.grantRead(this.runnerBaseRole);
+        createMSKCertRole.node.defaultChild.overrideLogicalId('GlRunnerCreateAndSignCertRole');
+        const ecrDeployRole = new aws_iam_1.Role(this, 'GlRunnerECRDeployRole', {
+            roleName: 'gl-runner-deploy-to-ecr-role',
+            assumedBy: this.runnerBaseRole,
+            inlinePolicies: {
+                DeployToECR: aws_iam_1.PolicyDocument.fromJson({
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Action: [
+                                'ecr:BatchCheckLayerAvailability',
+                                'ecr:BatchGetImage',
+                                'ecr:CompleteLayerUpload',
+                                'ecr:GetDownloadUrlForLayer',
+                                'ecr:InitiateLayerUpload',
+                                'ecr:PutImage',
+                                'ecr:UploadLayerPart',
+                                'ecr:GetAuthorizationToken',
+                                'ecr:DescribeRepositories',
+                            ],
+                            Effect: 'Allow',
+                            Resource: [`${props.env.account}.dkr.ecr.${props.env.region}.amazonaws.com/*`],
+                        },
+                    ],
+                }),
+            },
+        });
+        aws_ecr_1.PublicGalleryAuthorizationToken.grantRead(ecrDeployRole);
+        ecrDeployRole.node.defaultChild.overrideLogicalId('GlRunnerECRDeployRole');
+        const iamPolicyKMS = new aws_iam_1.PolicyStatement({
+            actions: ['kms:Decrypt'],
+            resources: ['arn:aws:kms:*:903404386550:key/*', `arn:aws:kms:*:${props.env.account}:key/*`],
+            conditions: {
+                'ForAnyValue:StringLike': {
+                    'kms:ResourceAliases': 'alias/rio-lz-backup-key*',
+                },
+            },
+        });
+        const iamPolicyLambdaExecution = new aws_iam_1.PolicyStatement({
+            actions: ['lambda:InvokeFunction'],
+            resources: [`arn:aws:lambda:eu-west-1:${props.env.account}:function:SecretsRestoreHandler`],
+        });
+        const secretsBackUpRole = new aws_iam_1.Role(this, 'GlRunnerSecretsBackupRole', {
+            roleName: 'gl-runner-secrets-backup-role',
+            assumedBy: this.runnerBaseRole,
+            inlinePolicies: {
+                SecretsBackup: new aws_iam_1.PolicyDocument({ statements: [iamPolicyKMS, iamPolicyLambdaExecution] }),
+            },
+        });
+        secretsBackUpRole.node.defaultChild.overrideLogicalId('GlRunnerSecretsBackupRole');
+        const deployRole = new aws_iam_1.Role(this, 'GlRunnerCDKDeployRole', {
+            roleName: 'gl-runner-cdk-deploy-role',
+            assumedBy: this.runnerBaseRole,
+            managedPolicies: [kafkaIntegrationPolicy], // required to create Kafka topics and publish event specification in deploy jobs
+            inlinePolicies: {
+                CdkDeploy: aws_iam_1.PolicyDocument.fromJson({
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Action: [
+                                'cloudformation:DescribeStacks',
+                                'cloudformation:CreateChangeSet',
+                                'cloudformation:DescribeChangeSet',
+                                'cloudformation:ExecuteChangeSet',
+                                'cloudformation:DescribeStackEvents',
+                                'cloudformation:DeleteChangeSet',
+                                'cloudformation:GetTemplate',
+                            ],
+                            Resource: [`arn:aws:cloudformation:${props.env.region}:${props.env.account}:stack/*`],
+                        },
+                        {
+                            Effect: 'Allow',
+                            Action: ['s3:*Object', 's3:ListBucket', 's3:GetBucketLocation'],
+                            Resource: ['arn:aws:s3:::cdktoolkit-*'],
+                        },
+                        {
+                            Sid: 'assumerole',
+                            Effect: 'Allow',
+                            Action: ['sts:AssumeRole', 'iam:PassRole'],
+                            Resource: [
+                                'arn:aws:iam::*:role/cdk-readOnlyRole',
+                                'arn:aws:iam::*:role/cdk-hnb659fds-deploy-role-*',
+                                'arn:aws:iam::*:role/cdk-hnb659fds-file-publishing-*',
+                                'arn:aws:iam::*:role/cdk-hnb659fds-lookup-role-*',
+                            ],
+                        },
+                    ],
+                }),
+                CfnDeploy: aws_iam_1.PolicyDocument.fromJson({
+                    Version: '2012-10-17',
+                    Statement: [
+                        {
+                            Effect: 'Allow',
+                            Action: ['*'],
+                            Resource: [`arn:aws:cloudformation:${props.env.region}:${props.env.account}:stack/*`],
+                            Condition: {
+                                'ForAnyValue:StringEquals': {
+                                    'aws:CalledVia': 'cloudformation.amazonaws.com',
+                                },
+                            },
+                        },
+                    ],
+                }),
+            },
+        });
+        deployRole.node.defaultChild.overrideLogicalId('GlRunnerCDKDeployRole');
+        const glRunnerCdkDeployRoleArn = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKDeployRoleArn', {
+            value: deployRole.roleArn,
+            exportName: 'gl-runner-cdk-deploy-role-arn',
+        });
+        glRunnerCdkDeployRoleArn.overrideLogicalId('GlRunnerCDKDeployRoleArn');
+        const glRunnerCdkDeployRoleName = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKDeployRoleName', {
+            value: deployRole.roleName,
+            exportName: 'gl-runner-cdk-deploy-role-name',
+        });
+        glRunnerCdkDeployRoleName.overrideLogicalId('GlRunnerCDKDeployRoleName');
+        const glRunnerCdkCreateAndSignCertRoleName = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKCreateAndSignCertRoleName', {
+            value: createMSKCertRole.roleName,
+            exportName: 'gl-runner-cdk-create-and-sign-msk-cert-role-name',
+        });
+        glRunnerCdkCreateAndSignCertRoleName.overrideLogicalId('GlRunnerCDKCreateAndSignCertRoleName');
+        const glRunnerCdkCreateAndSignCertRoleArn = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKCreateAndSignCertRoleArn', {
+            value: createMSKCertRole.roleArn,
+            exportName: 'gl-runner-cdk-create-and-sign-msk-cert-role-arn',
+        });
+        glRunnerCdkCreateAndSignCertRoleArn.overrideLogicalId('GlRunnerCDKCreateAndSignCertRoleArn');
+        const glRunnerCdkPublishWebContentRoleName = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKPublishWebContentRoleName', {
+            value: webContentPublishRole.roleName,
+            exportName: 'gl-runner-cdk-publish-web-content-on-s3-role-name',
+        });
+        glRunnerCdkPublishWebContentRoleName.overrideLogicalId('GlRunnerCDKPublishWebContentRoleName');
+        const glRunnerCdkPublishWebContentRoleArn = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKPublishWebContentRoleArn', {
+            value: webContentPublishRole.roleArn,
+            exportName: 'gl-runner-cdk-publish-web-content-on-s3-role-arn',
+        });
+        glRunnerCdkPublishWebContentRoleArn.overrideLogicalId('GlRunnerCDKPublishWebContentRoleArn');
+        const glRunnerCdkDeployToEcrRoleName = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKDeployToEcrRoleName', {
+            value: ecrDeployRole.roleName,
+            exportName: 'gl-runner-cdk-deploy-to-ecr-role-name',
+        });
+        glRunnerCdkDeployToEcrRoleName.overrideLogicalId('GlRunnerCDKDeployToEcrRoleName');
+        const glRunnerCdkDeployToEcrRoleArn = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKDeployToEcrRoleArn', {
+            value: ecrDeployRole.roleArn,
+            exportName: 'gl-runner-cdk-deploy-to-ecr-role-arn',
+        });
+        glRunnerCdkDeployToEcrRoleArn.overrideLogicalId('GlRunnerCDKDeployToEcrRoleArn');
+        const glRunnerCdkSecretsBackupRoleName = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKSecretsBackupRoleName', {
+            value: secretsBackUpRole.roleName,
+            exportName: 'gl-runner-cdk-secrets-backup-role-name',
+        });
+        glRunnerCdkSecretsBackupRoleName.overrideLogicalId('GlRunnerCDKSecretsBackupRoleName');
+        const glRunnerCdkSecretsBackupRoleArn = new aws_cdk_lib_1.CfnOutput(scope, 'GlRunnerCDKSecretsBackupRoleArn', {
+            value: secretsBackUpRole.roleArn,
+            exportName: 'gl-runner-cdk-secrets-backup-role-arn',
+        });
+        glRunnerCdkSecretsBackupRoleArn.overrideLogicalId('GlRunnerCDKSecretsBackupRoleArn');
+    }
+}
+exports.RunnerRoles = RunnerRoles;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVubmVyLXJvbGVzLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NvbnRyaWJ1dGlvbnMvc21hcnQtcm91dGUvZ2l0bGFiLXJ1bm5lci9ydW5uZXItcm9sZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsNkNBQWdFO0FBQ2hFLGlEQUFzRTtBQUN0RSxpREFPNkI7QUFDN0IsK0NBQTRDO0FBQzVDLGlEQUFzRDtBQUN0RCwyQ0FBdUM7QUFDdkMsZ0VBQTJEO0FBTTNEOzs7Ozs7Ozs7R0FTRztBQUNILE1BQWEsV0FBWSxTQUFRLHNCQUFTO0lBRXhDLFlBQVksS0FBWSxFQUFFLEVBQVUsRUFBRSxLQUFzQjtRQUMxRCxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBQ2pCLE1BQU0sb0JBQW9CLEdBQUcsaUNBQWMsQ0FBQyx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMzRSxNQUFNLGlCQUFpQixHQUFHLGlDQUFjLENBQUMsMEJBQTBCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFFM0UsTUFBTSxtQkFBbUIsR0FBRyx5QkFBZSxDQUFDLHVCQUF1QixDQUNqRSxJQUFJLEVBQ0oscUJBQXFCLEVBQ3JCLDhCQUE4QixDQUMvQixDQUFDO1FBRUYsTUFBTSwwQkFBMEIsR0FBRyx5QkFBZSxDQUFDLDZCQUE2QixDQUM5RSxJQUFJLEVBQ0osNEJBQTRCLEVBQzVCO1lBQ0UsYUFBYSxFQUFFLGtDQUFrQztTQUNsRCxDQUNGLENBQUM7UUFDRixNQUFNLGlCQUFpQixHQUFHLGVBQU0sQ0FBQyxjQUFjLENBQUMsSUFBSSxFQUFFLG1CQUFtQixFQUFFLDBCQUEwQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBRW5ILE1BQU0sYUFBYSxHQUFHLHlCQUFlLENBQUMsNkJBQTZCLENBQUMsSUFBSSxFQUFFLG9CQUFvQixFQUFFO1lBQzlGLGFBQWEsRUFBRSx5Q0FBeUM7U0FDekQsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxXQUFXLEdBQUcseUJBQWUsQ0FBQyw2QkFBNkIsQ0FBQyxJQUFJLEVBQUUsa0JBQWtCLEVBQUU7WUFDMUYsYUFBYSxFQUFFLHNDQUFzQztTQUN0RCxDQUFDLENBQUM7UUFFSCxNQUFNLHNCQUFzQixHQUFHLHVCQUFhLENBQUMsb0JBQW9CLENBQy9ELElBQUksRUFDSix3QkFBd0IsRUFDeEIsZ0JBQUUsQ0FBQyxXQUFXLENBQUMsOEJBQThCLENBQUMsQ0FDL0MsQ0FBQztRQUVGLElBQUksQ0FBQyxjQUFjLEdBQUcsSUFBSSxjQUFJLENBQUMsSUFBSSxFQUFFLG1CQUFtQixFQUFFO1lBQ3hELFNBQVMsRUFBRSxJQUFJLDBCQUFnQixDQUFDLG1CQUFtQixFQUFFLEVBQUUsQ0FBQztZQUN4RCxjQUFjLEVBQUU7Z0JBQ2QsY0FBYyxFQUFFLHdCQUFjLENBQUMsUUFBUSxDQUFDO29CQUN0QyxPQUFPLEVBQUUsWUFBWTtvQkFDckIsU0FBUyxFQUFFO3dCQUNUOzRCQUNFLE1BQU0sRUFBRSxPQUFPOzRCQUNmLE1BQU0sRUFBRSxDQUFDLFlBQVksRUFBRSxlQUFlLEVBQUUsc0JBQXNCLENBQUM7NEJBQy9ELFFBQVEsRUFBRSxDQUFDLDJCQUEyQixDQUFDO3lCQUN4Qzt3QkFDRDs0QkFDRSxHQUFHLEVBQUUsWUFBWTs0QkFDakIsTUFBTSxFQUFFLE9BQU87NEJBQ2YsTUFBTSxFQUFFLENBQUMsZ0JBQWdCLEVBQUUsY0FBYyxDQUFDOzRCQUMxQyxRQUFRLEVBQUUsQ0FBQyxzQ0FBc0MsRUFBRSxpREFBaUQsQ0FBQzt5QkFDdEc7d0JBQ0Q7NEJBQ0UsR0FBRyxFQUFFLGVBQWU7NEJBQ3BCLE1BQU0sRUFBRSxPQUFPOzRCQUNmLE1BQU0sRUFBRTtnQ0FDTixpQ0FBaUM7Z0NBQ2pDLG1CQUFtQjtnQ0FDbkIsb0JBQW9CO2dDQUNwQiwwQkFBMEI7Z0NBQzFCLDRCQUE0Qjs2QkFDN0I7NEJBQ0QsUUFBUSxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sWUFBWSxLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sa0JBQWtCLENBQUM7eUJBQy9FO3FCQUNGO2lCQUNGLENBQUM7YUFDSDtTQUNGLENBQUMsQ0FBQztRQUNGLElBQUksQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQXdCLENBQUMsaUJBQWlCLENBQUMsbUJBQW1CLENBQUMsQ0FBQztRQUMxRixtQkFBbUIsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ25ELDBCQUEwQixDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDMUQsaUJBQWlCLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUN0RCxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ3BELGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDakQsYUFBYSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDN0MsV0FBVyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDM0MseUNBQStCLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUUvRCxNQUFNLHFCQUFxQixHQUFHLElBQUksY0FBSSxDQUFDLElBQUksRUFBRSxnQ0FBZ0MsRUFBRTtZQUM3RSxRQUFRLEVBQUUsc0NBQXNDO1lBQ2hELFNBQVMsRUFBRSxJQUFJLENBQUMsY0FBYztZQUM5QixjQUFjLEVBQUU7Z0JBQ2QscUJBQXFCLEVBQUUsd0JBQWMsQ0FBQyxRQUFRLENBQUM7b0JBQzdDLE9BQU8sRUFBRSxZQUFZO29CQUNyQixTQUFTLEVBQUU7d0JBQ1Q7NEJBQ0UsTUFBTSxFQUFFLE9BQU87NEJBQ2YsTUFBTSxFQUFFO2dDQUNOLFdBQVc7Z0NBQ1gsa0JBQWtCO2dDQUNsQixlQUFlO2dDQUNmLGVBQWU7Z0NBQ2YsVUFBVTtnQ0FDVixjQUFjO2dDQUNkLHVCQUF1QjtnQ0FDdkIsdUJBQXVCO2dDQUN2QixxQkFBcUI7Z0NBQ3JCLDRCQUE0Qjs2QkFDN0I7NEJBQ0QsUUFBUSxFQUFFLENBQUMsZ0JBQWdCLENBQUM7eUJBQzdCO3dCQUNEOzRCQUNFLE1BQU0sRUFBRTtnQ0FDTix3QkFBd0I7Z0NBQ3hCLGtCQUFrQjtnQ0FDbEIseUJBQXlCO2dDQUN6QixtQkFBbUI7Z0NBQ25CLHlCQUF5Qjs2QkFDMUI7NEJBQ0QsTUFBTSxFQUFFLE9BQU87NEJBQ2YsUUFBUSxFQUFFO2dDQUNSLGVBQWUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsQ0FBQyxPQUFPLHFCQUFxQjtnQ0FDekUsZUFBZSxLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8scUJBQXFCOzZCQUMxRTt5QkFDRjtxQkFDRjtpQkFDRixDQUFDO2FBQ0g7U0FDRixDQUFDLENBQUM7UUFDRixxQkFBcUIsQ0FBQyxJQUFJLENBQUMsWUFBd0IsQ0FBQyxpQkFBaUIsQ0FBQyxnQ0FBZ0MsQ0FBQyxDQUFDO1FBRXpHLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxjQUFJLENBQUMsSUFBSSxFQUFFLCtCQUErQixFQUFFO1lBQ3hFLFFBQVEsRUFBRSw2Q0FBNkM7WUFDdkQsU0FBUyxFQUFFLElBQUksQ0FBQyxjQUFjO1lBQzlCLGNBQWMsRUFBRTtnQkFDZCwwQkFBMEIsRUFBRSx3QkFBYyxDQUFDLFFBQVEsQ0FBQztvQkFDbEQsT0FBTyxFQUFFLFlBQVk7b0JBQ3JCLFNBQVMsRUFBRTt3QkFDVDs0QkFDRSxNQUFNLEVBQUU7Z0NBQ04sd0JBQXdCO2dDQUN4QixrQkFBa0I7Z0NBQ2xCLHlCQUF5QjtnQ0FDekIsbUJBQW1CO2dDQUNuQix5QkFBeUI7NkJBQzFCOzRCQUNELE1BQU0sRUFBRSxPQUFPOzRCQUNmLFFBQVEsRUFBRTtnQ0FDUixlQUFlLEtBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBTyxxQkFBcUI7Z0NBQ3pFLGVBQWUsS0FBSyxDQUFDLEdBQUcsQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsQ0FBQyxPQUFPLHFCQUFxQjs2QkFDMUU7eUJBQ0Y7cUJBQ0Y7aUJBQ0YsQ0FBQztnQkFDRiwwQkFBMEIsRUFBRSx3QkFBYyxDQUFDLFFBQVEsQ0FBQztvQkFDbEQsT0FBTyxFQUFFLFlBQVk7b0JBQ3JCLFNBQVMsRUFBRTt3QkFDVDs0QkFDRSxNQUFNLEVBQUU7Z0NBQ04sK0JBQStCO2dDQUMvQiwrQkFBK0I7Z0NBQy9CLGtDQUFrQztnQ0FDbEMscUNBQXFDOzZCQUN0Qzs0QkFDRCxNQUFNLEVBQUUsT0FBTzs0QkFDZixRQUFRLEVBQUU7Z0NBQ1IsMEJBQTBCLEtBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBTyxvREFBb0Q7Z0NBQ25ILDBCQUEwQixLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sNkNBQTZDO2dDQUM1RywwQkFBMEIsS0FBSyxDQUFDLEdBQUcsQ0FBQyxNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsQ0FBQyxPQUFPLG9EQUFvRDtnQ0FDbkgsMEJBQTBCLEtBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxJQUFJLEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBTyw2Q0FBNkM7NkJBQzdHO3lCQUNGO3FCQUNGO2lCQUNGLENBQUM7YUFDSDtZQUNELGVBQWUsRUFBRSxDQUFDLHNCQUFzQixDQUFDO1NBQzFDLENBQUMsQ0FBQztRQUNILG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQ2xELGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDaEQsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFlBQXdCLENBQUMsaUJBQWlCLENBQUMsK0JBQStCLENBQUMsQ0FBQztRQUVwRyxNQUFNLGFBQWEsR0FBRyxJQUFJLGNBQUksQ0FBQyxJQUFJLEVBQUUsdUJBQXVCLEVBQUU7WUFDNUQsUUFBUSxFQUFFLDhCQUE4QjtZQUN4QyxTQUFTLEVBQUUsSUFBSSxDQUFDLGNBQWM7WUFDOUIsY0FBYyxFQUFFO2dCQUNkLFdBQVcsRUFBRSx3QkFBYyxDQUFDLFFBQVEsQ0FBQztvQkFDbkMsT0FBTyxFQUFFLFlBQVk7b0JBQ3JCLFNBQVMsRUFBRTt3QkFDVDs0QkFDRSxNQUFNLEVBQUU7Z0NBQ04saUNBQWlDO2dDQUNqQyxtQkFBbUI7Z0NBQ25CLHlCQUF5QjtnQ0FDekIsNEJBQTRCO2dDQUM1Qix5QkFBeUI7Z0NBQ3pCLGNBQWM7Z0NBQ2QscUJBQXFCO2dDQUNyQiwyQkFBMkI7Z0NBQzNCLDBCQUEwQjs2QkFDM0I7NEJBQ0QsTUFBTSxFQUFFLE9BQU87NEJBQ2YsUUFBUSxFQUFFLENBQUMsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sWUFBWSxLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sa0JBQWtCLENBQUM7eUJBQy9FO3FCQUNGO2lCQUNGLENBQUM7YUFDSDtTQUNGLENBQUMsQ0FBQztRQUNILHlDQUErQixDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUN4RCxhQUFhLENBQUMsSUFBSSxDQUFDLFlBQXdCLENBQUMsaUJBQWlCLENBQUMsdUJBQXVCLENBQUMsQ0FBQztRQUV4RixNQUFNLFlBQVksR0FBRyxJQUFJLHlCQUFlLENBQUM7WUFDdkMsT0FBTyxFQUFFLENBQUMsYUFBYSxDQUFDO1lBQ3hCLFNBQVMsRUFBRSxDQUFDLGtDQUFrQyxFQUFFLGlCQUFpQixLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sUUFBUSxDQUFDO1lBQzNGLFVBQVUsRUFBRTtnQkFDVix3QkFBd0IsRUFBRTtvQkFDeEIscUJBQXFCLEVBQUUsMEJBQTBCO2lCQUNsRDthQUNGO1NBQ0YsQ0FBQyxDQUFDO1FBQ0gsTUFBTSx3QkFBd0IsR0FBRyxJQUFJLHlCQUFlLENBQUM7WUFDbkQsT0FBTyxFQUFFLENBQUMsdUJBQXVCLENBQUM7WUFDbEMsU0FBUyxFQUFFLENBQUMsNEJBQTRCLEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBTyxpQ0FBaUMsQ0FBQztTQUM1RixDQUFDLENBQUM7UUFDSCxNQUFNLGlCQUFpQixHQUFHLElBQUksY0FBSSxDQUFDLElBQUksRUFBRSwyQkFBMkIsRUFBRTtZQUNwRSxRQUFRLEVBQUUsK0JBQStCO1lBQ3pDLFNBQVMsRUFBRSxJQUFJLENBQUMsY0FBYztZQUM5QixjQUFjLEVBQUU7Z0JBQ2QsYUFBYSxFQUFFLElBQUksd0JBQWMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxDQUFDLFlBQVksRUFBRSx3QkFBd0IsQ0FBQyxFQUFFLENBQUM7YUFDNUY7U0FDRixDQUFDLENBQUM7UUFDRixpQkFBaUIsQ0FBQyxJQUFJLENBQUMsWUFBd0IsQ0FBQyxpQkFBaUIsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1FBRWhHLE1BQU0sVUFBVSxHQUFHLElBQUksY0FBSSxDQUFDLElBQUksRUFBRSx1QkFBdUIsRUFBRTtZQUN6RCxRQUFRLEVBQUUsMkJBQTJCO1lBQ3JDLFNBQVMsRUFBRSxJQUFJLENBQUMsY0FBYztZQUM5QixlQUFlLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLGlGQUFpRjtZQUM1SCxjQUFjLEVBQUU7Z0JBQ2QsU0FBUyxFQUFFLHdCQUFjLENBQUMsUUFBUSxDQUFDO29CQUNqQyxPQUFPLEVBQUUsWUFBWTtvQkFDckIsU0FBUyxFQUFFO3dCQUNUOzRCQUNFLE1BQU0sRUFBRSxPQUFPOzRCQUNmLE1BQU0sRUFBRTtnQ0FDTiwrQkFBK0I7Z0NBQy9CLGdDQUFnQztnQ0FDaEMsa0NBQWtDO2dDQUNsQyxpQ0FBaUM7Z0NBQ2pDLG9DQUFvQztnQ0FDcEMsZ0NBQWdDO2dDQUNoQyw0QkFBNEI7NkJBQzdCOzRCQUNELFFBQVEsRUFBRSxDQUFDLDBCQUEwQixLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sVUFBVSxDQUFDO3lCQUN0Rjt3QkFDRDs0QkFDRSxNQUFNLEVBQUUsT0FBTzs0QkFDZixNQUFNLEVBQUUsQ0FBQyxZQUFZLEVBQUUsZUFBZSxFQUFFLHNCQUFzQixDQUFDOzRCQUMvRCxRQUFRLEVBQUUsQ0FBQywyQkFBMkIsQ0FBQzt5QkFDeEM7d0JBQ0Q7NEJBQ0UsR0FBRyxFQUFFLFlBQVk7NEJBQ2pCLE1BQU0sRUFBRSxPQUFPOzRCQUNmLE1BQU0sRUFBRSxDQUFDLGdCQUFnQixFQUFFLGNBQWMsQ0FBQzs0QkFDMUMsUUFBUSxFQUFFO2dDQUNSLHNDQUFzQztnQ0FDdEMsaURBQWlEO2dDQUNqRCxxREFBcUQ7Z0NBQ3JELGlEQUFpRDs2QkFDbEQ7eUJBQ0Y7cUJBQ0Y7aUJBQ0YsQ0FBQztnQkFDRixTQUFTLEVBQUUsd0JBQWMsQ0FBQyxRQUFRLENBQUM7b0JBQ2pDLE9BQU8sRUFBRSxZQUFZO29CQUNyQixTQUFTLEVBQUU7d0JBQ1Q7NEJBQ0UsTUFBTSxFQUFFLE9BQU87NEJBQ2YsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDOzRCQUNiLFFBQVEsRUFBRSxDQUFDLDBCQUEwQixLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sSUFBSSxLQUFLLENBQUMsR0FBRyxDQUFDLE9BQU8sVUFBVSxDQUFDOzRCQUNyRixTQUFTLEVBQUU7Z0NBQ1QsMEJBQTBCLEVBQUU7b0NBQzFCLGVBQWUsRUFBRSw4QkFBOEI7aUNBQ2hEOzZCQUNGO3lCQUNGO3FCQUNGO2lCQUNGLENBQUM7YUFDSDtTQUNGLENBQUMsQ0FBQztRQUNGLFVBQVUsQ0FBQyxJQUFJLENBQUMsWUFBd0IsQ0FBQyxpQkFBaUIsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1FBRXJGLE1BQU0sd0JBQXdCLEdBQUcsSUFBSSx1QkFBUyxDQUFDLEtBQUssRUFBRSwwQkFBMEIsRUFBRTtZQUNoRixLQUFLLEVBQUUsVUFBVSxDQUFDLE9BQU87WUFDekIsVUFBVSxFQUFFLCtCQUErQjtTQUM1QyxDQUFDLENBQUM7UUFDSCx3QkFBd0IsQ0FBQyxpQkFBaUIsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0seUJBQXlCLEdBQUcsSUFBSSx1QkFBUyxDQUFDLEtBQUssRUFBRSwyQkFBMkIsRUFBRTtZQUNsRixLQUFLLEVBQUUsVUFBVSxDQUFDLFFBQVE7WUFDMUIsVUFBVSxFQUFFLGdDQUFnQztTQUM3QyxDQUFDLENBQUM7UUFDSCx5QkFBeUIsQ0FBQyxpQkFBaUIsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1FBRXpFLE1BQU0sb0NBQW9DLEdBQUcsSUFBSSx1QkFBUyxDQUFDLEtBQUssRUFBRSxzQ0FBc0MsRUFBRTtZQUN4RyxLQUFLLEVBQUUsaUJBQWlCLENBQUMsUUFBUTtZQUNqQyxVQUFVLEVBQUUsa0RBQWtEO1NBQy9ELENBQUMsQ0FBQztRQUNILG9DQUFvQyxDQUFDLGlCQUFpQixDQUFDLHNDQUFzQyxDQUFDLENBQUM7UUFDL0YsTUFBTSxtQ0FBbUMsR0FBRyxJQUFJLHVCQUFTLENBQUMsS0FBSyxFQUFFLHFDQUFxQyxFQUFFO1lBQ3RHLEtBQUssRUFBRSxpQkFBaUIsQ0FBQyxPQUFPO1lBQ2hDLFVBQVUsRUFBRSxpREFBaUQ7U0FDOUQsQ0FBQyxDQUFDO1FBQ0gsbUNBQW1DLENBQUMsaUJBQWlCLENBQUMscUNBQXFDLENBQUMsQ0FBQztRQUU3RixNQUFNLG9DQUFvQyxHQUFHLElBQUksdUJBQVMsQ0FBQyxLQUFLLEVBQUUsc0NBQXNDLEVBQUU7WUFDeEcsS0FBSyxFQUFFLHFCQUFxQixDQUFDLFFBQVE7WUFDckMsVUFBVSxFQUFFLG1EQUFtRDtTQUNoRSxDQUFDLENBQUM7UUFDSCxvQ0FBb0MsQ0FBQyxpQkFBaUIsQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO1FBQy9GLE1BQU0sbUNBQW1DLEdBQUcsSUFBSSx1QkFBUyxDQUFDLEtBQUssRUFBRSxxQ0FBcUMsRUFBRTtZQUN0RyxLQUFLLEVBQUUscUJBQXFCLENBQUMsT0FBTztZQUNwQyxVQUFVLEVBQUUsa0RBQWtEO1NBQy9ELENBQUMsQ0FBQztRQUNILG1DQUFtQyxDQUFDLGlCQUFpQixDQUFDLHFDQUFxQyxDQUFDLENBQUM7UUFFN0YsTUFBTSw4QkFBOEIsR0FBRyxJQUFJLHVCQUFTLENBQUMsS0FBSyxFQUFFLGdDQUFnQyxFQUFFO1lBQzVGLEtBQUssRUFBRSxhQUFhLENBQUMsUUFBUTtZQUM3QixVQUFVLEVBQUUsdUNBQXVDO1NBQ3BELENBQUMsQ0FBQztRQUNILDhCQUE4QixDQUFDLGlCQUFpQixDQUFDLGdDQUFnQyxDQUFDLENBQUM7UUFDbkYsTUFBTSw2QkFBNkIsR0FBRyxJQUFJLHVCQUFTLENBQUMsS0FBSyxFQUFFLCtCQUErQixFQUFFO1lBQzFGLEtBQUssRUFBRSxhQUFhLENBQUMsT0FBTztZQUM1QixVQUFVLEVBQUUsc0NBQXNDO1NBQ25ELENBQUMsQ0FBQztRQUNILDZCQUE2QixDQUFDLGlCQUFpQixDQUFDLCtCQUErQixDQUFDLENBQUM7UUFFakYsTUFBTSxnQ0FBZ0MsR0FBRyxJQUFJLHVCQUFTLENBQUMsS0FBSyxFQUFFLGtDQUFrQyxFQUFFO1lBQ2hHLEtBQUssRUFBRSxpQkFBaUIsQ0FBQyxRQUFRO1lBQ2pDLFVBQVUsRUFBRSx3Q0FBd0M7U0FDckQsQ0FBQyxDQUFDO1FBQ0gsZ0NBQWdDLENBQUMsaUJBQWlCLENBQUMsa0NBQWtDLENBQUMsQ0FBQztRQUN2RixNQUFNLCtCQUErQixHQUFHLElBQUksdUJBQVMsQ0FBQyxLQUFLLEVBQUUsaUNBQWlDLEVBQUU7WUFDOUYsS0FBSyxFQUFFLGlCQUFpQixDQUFDLE9BQU87WUFDaEMsVUFBVSxFQUFFLHVDQUF1QztTQUNwRCxDQUFDLENBQUM7UUFDSCwrQkFBK0IsQ0FBQyxpQkFBaUIsQ0FBQyxpQ0FBaUMsQ0FBQyxDQUFDO0lBQ3ZGLENBQUM7Q0FDRjtBQS9VRCxrQ0ErVUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgeyBDZm5PdXRwdXQsIEVudmlyb25tZW50LCBGbiwgU3RhY2sgfSBmcm9tICdhd3MtY2RrLWxpYic7XG5pbXBvcnQgeyBQdWJsaWNHYWxsZXJ5QXV0aG9yaXphdGlvblRva2VuIH0gZnJvbSAnYXdzLWNkay1saWIvYXdzLWVjcic7XG5pbXBvcnQge1xuICBDZm5Sb2xlLFxuICBNYW5hZ2VkUG9saWN5LFxuICBQb2xpY3lEb2N1bWVudCxcbiAgUG9saWN5U3RhdGVtZW50LFxuICBSb2xlLFxuICBTZXJ2aWNlUHJpbmNpcGFsLFxufSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IEJ1Y2tldCB9IGZyb20gJ2F3cy1jZGstbGliL2F3cy1zMyc7XG5pbXBvcnQgeyBTdHJpbmdQYXJhbWV0ZXIgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3Mtc3NtJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuaW1wb3J0IHsgUmlvTGFuZGluZ1pvbmUgfSBmcm9tICcuLi8uLi8uLi9yaW8tbGFuZGluZy16b25lJztcblxuZXhwb3J0IGludGVyZmFjZSBSdW5uZXJSb2xlUHJvcHMge1xuICBlbnY6IEVudmlyb25tZW50O1xufVxuXG4vKipcbiAqIFRoaXMgY29uc3RydWN0IHByb3ZpZGVzIGEgc2V0IG9mIGJhc2Ugcm9sZXMgZm9yIGdpdGxhYiBydW5uZXJzIGluIG9yZGVyIHRvIGJ1aWxkLCB0ZXN0LCB2YWxpZGF0ZSBhbmQgZGVwbG95IGFwcGxpY2F0aW9uc1xuICogb24gUklPLiBUaGUgcm9sZXMgbmVlZCB0byBiZSBhc3N1bWVkIGR1cmluZyBqb2IgcnVudGltZSB0byBwZXJmb3JtIG1vcmUgcGVybWlzc2l2ZSBhY3Rpb25zLCBzdWNoIGFzIGNyZWF0aW5nIGNlcnRpZmljYXRlcyB0b1xuICogYXV0aGVudGljYXRlIHRvd2FyZHMgdGhlIFJJTyBNU0ssIHB1c2hpbmcgZG9ja2VyIGltYWdlcyB0byBFQ1IsIHBlcmZvcm1pbmcgYSBzZWNyZXRzIGJhY2t1cCwgZGVwbG95aW5nIHN0YWNrcyxcbiAqIG9yIHRvIHB1Ymxpc2ggYW4gU1BBIHRvIGEgUzMgYnVja2V0LiBEbyBub3QgYXNzdW1lIHRoZSBkZXBsb3ltZW50IHJvbGUgdW5sZXNzIG5lZWRlZC5cbiAqIFRoZSBiYXNlIHJvbGUgY2FuIGJlIHRoZSBkZWZhdWx0IHJvbGUgYXR0YWNoZWQgdG8gR2l0TGFiIHJ1bm5lcnMuXG4gKiBUaGUgcm9sZSBhbGxvd3MgdG8gcmVhZCB2YXJpb3VzIGJhc2ljIHBhcmFtZXRlcnMgc3VjaCBhcyB0aGUgTklTVCBkYXRhIG1pcnJvciwgdGhlIE9TUyBsaWNlbnNlIGJ1Y2tldCwgRGF0YURvZyBrZXlzXG4gKiBhbmQgdG8gcHVsbCBFQ1IgaW1hZ2VzIGZvcm0gcHVibGljIEdhbGxlcnkgb3IgdGhlIHNwZWNpZmllZCBhY2NvdW50IGluIHRoZSBlbnZpcm9ubWVudC5cbiAqIFRoZSBSb2xlIEFSTnMgYXJlIGV4cG9ydCB1c2luZyBDRk5PdXRwdXRzLiBVc2UgdGhlIG91dHB1dHMgdG8gY29uZmlndXJlIGVudmlyb25tZW50IHZhcmlhYmxlcyBpbiB5b3VyIEdpdExhYiBncm91cC5cbiAqL1xuZXhwb3J0IGNsYXNzIFJ1bm5lclJvbGVzIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgcmVhZG9ubHkgcnVubmVyQmFzZVJvbGU6IFJvbGU7XG4gIGNvbnN0cnVjdG9yKHNjb3BlOiBTdGFjaywgaWQ6IHN0cmluZywgcHJvcHM6IFJ1bm5lclJvbGVQcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgY29uc3QgYWNjb3VudE5hbWVQYXJhbWV0ZXIgPSBSaW9MYW5kaW5nWm9uZS5nZXRBY2NvdW50TmFtZVBhcmFtZXRlcihzY29wZSk7XG4gICAgY29uc3QgdGVhbU5hbWVQYXJhbWV0ZXIgPSBSaW9MYW5kaW5nWm9uZS5nZXRUZWFtSWRlbnRpZmllclBhcmFtZXRlcihzY29wZSk7XG5cbiAgICBjb25zdCBuaXN0TWlycm9yUGFyYW1ldGVyID0gU3RyaW5nUGFyYW1ldGVyLmZyb21TdHJpbmdQYXJhbWV0ZXJOYW1lKFxuICAgICAgdGhpcyxcbiAgICAgICdOaXN0TWlycm9yUGFyYW1ldGVyJyxcbiAgICAgICcvY29uZmlnL25pc3QtZGF0YS1taXJyb3IvdXJsJyxcbiAgICApO1xuXG4gICAgY29uc3Qgb3NzTGljZW5zZXNCdWNrZXRQYXJhbWV0ZXIgPSBTdHJpbmdQYXJhbWV0ZXIuZnJvbVN0cmluZ1BhcmFtZXRlckF0dHJpYnV0ZXMoXG4gICAgICB0aGlzLFxuICAgICAgJ09zc0xpY2Vuc2VzQnVja2V0UGFyYW1ldGVyJyxcbiAgICAgIHtcbiAgICAgICAgcGFyYW1ldGVyTmFtZTogJy9jb25maWcvb3NzLWxpY2Vuc2VzL2J1Y2tldC1uYW1lJyxcbiAgICAgIH0sXG4gICAgKTtcbiAgICBjb25zdCBvc3NMaWNlbnNlc0J1Y2tldCA9IEJ1Y2tldC5mcm9tQnVja2V0TmFtZSh0aGlzLCAnT3NzTGljZW5zZXNCdWNrZXQnLCBvc3NMaWNlbnNlc0J1Y2tldFBhcmFtZXRlci5zdHJpbmdWYWx1ZSk7XG5cbiAgICBjb25zdCBkZEFwaUtleVBhcmFtID0gU3RyaW5nUGFyYW1ldGVyLmZyb21TdHJpbmdQYXJhbWV0ZXJBdHRyaWJ1dGVzKHRoaXMsICdEYXRhRG9nQXBpS2V5UGFyYW0nLCB7XG4gICAgICBwYXJhbWV0ZXJOYW1lOiAnL3Jpby9jb25maWcvZGF0YWRvZy1pbnRlZ3JhdGlvbi9hcGkta2V5JyxcbiAgICB9KTtcbiAgICBjb25zdCBkZFNpdGVQYXJhbSA9IFN0cmluZ1BhcmFtZXRlci5mcm9tU3RyaW5nUGFyYW1ldGVyQXR0cmlidXRlcyh0aGlzLCAnRGF0YURvZ1NpdGVQYXJhbScsIHtcbiAgICAgIHBhcmFtZXRlck5hbWU6ICcvcmlvL2NvbmZpZy9kYXRhZG9nLWludGVncmF0aW9uL3NpdGUnLFxuICAgIH0pO1xuXG4gICAgY29uc3Qga2Fma2FJbnRlZ3JhdGlvblBvbGljeSA9IE1hbmFnZWRQb2xpY3kuZnJvbU1hbmFnZWRQb2xpY3lBcm4oXG4gICAgICB0aGlzLFxuICAgICAgJ0thZmthSW50ZWdyYXRpb25Qb2xpY3knLFxuICAgICAgRm4uaW1wb3J0VmFsdWUoJ2thZmthLWludGVncmF0aW9uLXBvbGljeS1hcm4nKSxcbiAgICApO1xuXG4gICAgdGhpcy5ydW5uZXJCYXNlUm9sZSA9IG5ldyBSb2xlKHRoaXMsICdHbFJ1bm5lckJ1aWxkUm9sZScsIHtcbiAgICAgIGFzc3VtZWRCeTogbmV3IFNlcnZpY2VQcmluY2lwYWwoJ2VjMi5hbWF6b25hd3MuY29tJywge30pLFxuICAgICAgaW5saW5lUG9saWNpZXM6IHtcbiAgICAgICAgQ2RrU3ludGhMb29rVXA6IFBvbGljeURvY3VtZW50LmZyb21Kc29uKHtcbiAgICAgICAgICBWZXJzaW9uOiAnMjAxMi0xMC0xNycsXG4gICAgICAgICAgU3RhdGVtZW50OiBbXG4gICAgICAgICAgICB7XG4gICAgICAgICAgICAgIEVmZmVjdDogJ0FsbG93JyxcbiAgICAgICAgICAgICAgQWN0aW9uOiBbJ3MzOipPYmplY3QnLCAnczM6TGlzdEJ1Y2tldCcsICdzMzpHZXRCdWNrZXRMb2NhdGlvbiddLFxuICAgICAgICAgICAgICBSZXNvdXJjZTogWydhcm46YXdzOnMzOjo6Y2RrdG9vbGtpdC0qJ10sXG4gICAgICAgICAgICB9LFxuICAgICAgICAgICAge1xuICAgICAgICAgICAgICBTaWQ6ICdhc3N1bWVyb2xlJyxcbiAgICAgICAgICAgICAgRWZmZWN0OiAnQWxsb3cnLFxuICAgICAgICAgICAgICBBY3Rpb246IFsnc3RzOkFzc3VtZVJvbGUnLCAnaWFtOlBhc3NSb2xlJ10sXG4gICAgICAgICAgICAgIFJlc291cmNlOiBbJ2Fybjphd3M6aWFtOjoqOnJvbGUvY2RrLXJlYWRPbmx5Um9sZScsICdhcm46YXdzOmlhbTo6Kjpyb2xlL2Nkay1obmI2NTlmZHMtbG9va3VwLXJvbGUtKiddLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgU2lkOiAncHVsbEVjckltYWdlcycsXG4gICAgICAgICAgICAgIEVmZmVjdDogJ0FsbG93JyxcbiAgICAgICAgICAgICAgQWN0aW9uOiBbXG4gICAgICAgICAgICAgICAgJ2VjcjpCYXRjaENoZWNrTGF5ZXJBdmFpbGFiaWxpdHknLFxuICAgICAgICAgICAgICAgICdlY3I6QmF0Y2hHZXRJbWFnZScsXG4gICAgICAgICAgICAgICAgJ2VjcjpEZXNjcmliZUltYWdlcycsXG4gICAgICAgICAgICAgICAgJ2VjcjpEZXNjcmliZVJlcG9zaXRvcmllcycsXG4gICAgICAgICAgICAgICAgJ2VjcjpHZXREb3dubG9hZFVybEZvckxheWVyJyxcbiAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgICAgUmVzb3VyY2U6IFtgJHtwcm9wcy5lbnYuYWNjb3VudH0uZGtyLmVjci4ke3Byb3BzLmVudi5yZWdpb259LmFtYXpvbmF3cy5jb20vKmBdLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSxcbiAgICAgIH0sXG4gICAgfSk7XG4gICAgKHRoaXMucnVubmVyQmFzZVJvbGUubm9kZS5kZWZhdWx0Q2hpbGQgYXMgQ2ZuUm9sZSkub3ZlcnJpZGVMb2dpY2FsSWQoJ0dsUnVubmVyQnVpbGRSb2xlJyk7XG4gICAgbmlzdE1pcnJvclBhcmFtZXRlci5ncmFudFJlYWQodGhpcy5ydW5uZXJCYXNlUm9sZSk7XG4gICAgb3NzTGljZW5zZXNCdWNrZXRQYXJhbWV0ZXIuZ3JhbnRSZWFkKHRoaXMucnVubmVyQmFzZVJvbGUpO1xuICAgIG9zc0xpY2Vuc2VzQnVja2V0LmdyYW50UmVhZFdyaXRlKHRoaXMucnVubmVyQmFzZVJvbGUpO1xuICAgIGFjY291bnROYW1lUGFyYW1ldGVyLmdyYW50UmVhZCh0aGlzLnJ1bm5lckJhc2VSb2xlKTtcbiAgICB0ZWFtTmFtZVBhcmFtZXRlci5ncmFudFJlYWQodGhpcy5ydW5uZXJCYXNlUm9sZSk7XG4gICAgZGRBcGlLZXlQYXJhbS5ncmFudFJlYWQodGhpcy5ydW5uZXJCYXNlUm9sZSk7XG4gICAgZGRTaXRlUGFyYW0uZ3JhbnRSZWFkKHRoaXMucnVubmVyQmFzZVJvbGUpO1xuICAgIFB1YmxpY0dhbGxlcnlBdXRob3JpemF0aW9uVG9rZW4uZ3JhbnRSZWFkKHRoaXMucnVubmVyQmFzZVJvbGUpO1xuXG4gICAgY29uc3Qgd2ViQ29udGVudFB1Ymxpc2hSb2xlID0gbmV3IFJvbGUodGhpcywgJ0dsUnVubmVyUzNXZWJDb250ZW50RGVwbG95Um9sZScsIHtcbiAgICAgIHJvbGVOYW1lOiAnZ2wtcnVubmVyLXdlYi1jb250ZW50LXMzLWRlcGxveS1yb2xlJyxcbiAgICAgIGFzc3VtZWRCeTogdGhpcy5ydW5uZXJCYXNlUm9sZSxcbiAgICAgIGlubGluZVBvbGljaWVzOiB7XG4gICAgICAgIFB1Ymxpc2hXZWJDb250ZW50T25TMzogUG9saWN5RG9jdW1lbnQuZnJvbUpzb24oe1xuICAgICAgICAgIFZlcnNpb246ICcyMDEyLTEwLTE3JyxcbiAgICAgICAgICBTdGF0ZW1lbnQ6IFtcbiAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgRWZmZWN0OiAnQWxsb3cnLFxuICAgICAgICAgICAgICBBY3Rpb246IFtcbiAgICAgICAgICAgICAgICAnczM6QWJvcnQqJyxcbiAgICAgICAgICAgICAgICAnczM6RGVsZXRlT2JqZWN0KicsXG4gICAgICAgICAgICAgICAgJ3MzOkdldEJ1Y2tldConLFxuICAgICAgICAgICAgICAgICdzMzpHZXRPYmplY3QqJyxcbiAgICAgICAgICAgICAgICAnczM6TGlzdConLFxuICAgICAgICAgICAgICAgICdzMzpQdXRPYmplY3QnLFxuICAgICAgICAgICAgICAgICdzMzpQdXRPYmplY3RMZWdhbEhvbGQnLFxuICAgICAgICAgICAgICAgICdzMzpQdXRPYmplY3RSZXRlbnRpb24nLFxuICAgICAgICAgICAgICAgICdzMzpQdXRPYmplY3RUYWdnaW5nJyxcbiAgICAgICAgICAgICAgICAnczM6UHV0T2JqZWN0VmVyc2lvblRhZ2dpbmcnLFxuICAgICAgICAgICAgICBdLFxuICAgICAgICAgICAgICBSZXNvdXJjZTogWydhcm46YXdzOnMzOjo6KiddLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgQWN0aW9uOiBbXG4gICAgICAgICAgICAgICAgJ3NzbTpEZXNjcmliZVBhcmFtZXRlcnMnLFxuICAgICAgICAgICAgICAgICdzc206R2V0UGFyYW1ldGVyJyxcbiAgICAgICAgICAgICAgICAnc3NtOkdldFBhcmFtZXRlckhpc3RvcnknLFxuICAgICAgICAgICAgICAgICdzc206R2V0UGFyYW1ldGVycycsXG4gICAgICAgICAgICAgICAgJ3NzbTpHZXRQYXJhbWV0ZXJzQnlQYXRoJyxcbiAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgICAgRWZmZWN0OiAnQWxsb3cnLFxuICAgICAgICAgICAgICBSZXNvdXJjZTogW1xuICAgICAgICAgICAgICAgIGBhcm46YXdzOnNzbToke3Byb3BzLmVudi5yZWdpb259OiR7cHJvcHMuZW52LmFjY291bnR9OnBhcmFtZXRlci9jb25maWcvKmAsXG4gICAgICAgICAgICAgICAgYGFybjphd3M6c3NtOiR7cHJvcHMuZW52LnJlZ2lvbn06JHtwcm9wcy5lbnYuYWNjb3VudH06cGFyYW1ldGVyL3NlY3JldC8qYCxcbiAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgXSxcbiAgICAgICAgfSksXG4gICAgICB9LFxuICAgIH0pO1xuICAgICh3ZWJDb250ZW50UHVibGlzaFJvbGUubm9kZS5kZWZhdWx0Q2hpbGQgYXMgQ2ZuUm9sZSkub3ZlcnJpZGVMb2dpY2FsSWQoJ0dsUnVubmVyUzNXZWJDb250ZW50RGVwbG95Um9sZScpO1xuXG4gICAgY29uc3QgY3JlYXRlTVNLQ2VydFJvbGUgPSBuZXcgUm9sZSh0aGlzLCAnR2xSdW5uZXJDcmVhdGVBbmRTaWduQ2VydFJvbGUnLCB7XG4gICAgICByb2xlTmFtZTogJ2dsLXJ1bm5lci1jcmVhdGUtYW5kLXNpZ24tcmlvLW1zay1jZXJ0LXJvbGUnLFxuICAgICAgYXNzdW1lZEJ5OiB0aGlzLnJ1bm5lckJhc2VSb2xlLFxuICAgICAgaW5saW5lUG9saWNpZXM6IHtcbiAgICAgICAgUGFyYW1ldGVyU3RvcmVSZWFkS2V5U3RvcmU6IFBvbGljeURvY3VtZW50LmZyb21Kc29uKHtcbiAgICAgICAgICBWZXJzaW9uOiAnMjAxMi0xMC0xNycsXG4gICAgICAgICAgU3RhdGVtZW50OiBbXG4gICAgICAgICAgICB7XG4gICAgICAgICAgICAgIEFjdGlvbjogW1xuICAgICAgICAgICAgICAgICdzc206RGVzY3JpYmVQYXJhbWV0ZXJzJyxcbiAgICAgICAgICAgICAgICAnc3NtOkdldFBhcmFtZXRlcicsXG4gICAgICAgICAgICAgICAgJ3NzbTpHZXRQYXJhbWV0ZXJIaXN0b3J5JyxcbiAgICAgICAgICAgICAgICAnc3NtOkdldFBhcmFtZXRlcnMnLFxuICAgICAgICAgICAgICAgICdzc206R2V0UGFyYW1ldGVyc0J5UGF0aCcsXG4gICAgICAgICAgICAgIF0sXG4gICAgICAgICAgICAgIEVmZmVjdDogJ0FsbG93JyxcbiAgICAgICAgICAgICAgUmVzb3VyY2U6IFtcbiAgICAgICAgICAgICAgICBgYXJuOmF3czpzc206JHtwcm9wcy5lbnYucmVnaW9ufToke3Byb3BzLmVudi5hY2NvdW50fTpwYXJhbWV0ZXIvY29uZmlnLypgLFxuICAgICAgICAgICAgICAgIGBhcm46YXdzOnNzbToke3Byb3BzLmVudi5yZWdpb259OiR7cHJvcHMuZW52LmFjY291bnR9OnBhcmFtZXRlci9zZWNyZXQvKmAsXG4gICAgICAgICAgICAgIF0sXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIF0sXG4gICAgICAgIH0pLFxuICAgICAgICBTZWNyZXRzTWFuYWdlclJlYWRLZXlTdG9yZTogUG9saWN5RG9jdW1lbnQuZnJvbUpzb24oe1xuICAgICAgICAgIFZlcnNpb246ICcyMDEyLTEwLTE3JyxcbiAgICAgICAgICBTdGF0ZW1lbnQ6IFtcbiAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgQWN0aW9uOiBbXG4gICAgICAgICAgICAgICAgJ3NlY3JldHNtYW5hZ2VyOkRlc2NyaWJlU2VjcmV0JyxcbiAgICAgICAgICAgICAgICAnc2VjcmV0c21hbmFnZXI6R2V0U2VjcmV0VmFsdWUnLFxuICAgICAgICAgICAgICAgICdzZWNyZXRzbWFuYWdlcjpHZXRSZXNvdXJjZVBvbGljeScsXG4gICAgICAgICAgICAgICAgJ3NlY3JldHNtYW5hZ2VyOkxpc3RTZWNyZXRWZXJzaW9uSWRzJyxcbiAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgICAgRWZmZWN0OiAnQWxsb3cnLFxuICAgICAgICAgICAgICBSZXNvdXJjZTogW1xuICAgICAgICAgICAgICAgIGBhcm46YXdzOnNlY3JldHNtYW5hZ2VyOiR7cHJvcHMuZW52LnJlZ2lvbn06JHtwcm9wcy5lbnYuYWNjb3VudH06c2VjcmV0Oi9zZWNyZXQvKi9zZXJ2aWNlLWtleXN0b3JlLXBhc3N3b3JkLT8/Pz8/P2AsXG4gICAgICAgICAgICAgICAgYGFybjphd3M6c2VjcmV0c21hbmFnZXI6JHtwcm9wcy5lbnYucmVnaW9ufToke3Byb3BzLmVudi5hY2NvdW50fTpzZWNyZXQ6L3NlY3JldC8qL3NlcnZpY2Uta2V5c3RvcmUtcGFzc3dvcmRgLFxuICAgICAgICAgICAgICAgIGBhcm46YXdzOnNlY3JldHNtYW5hZ2VyOiR7cHJvcHMuZW52LnJlZ2lvbn06JHtwcm9wcy5lbnYuYWNjb3VudH06c2VjcmV0Oi9jb25maWcvKi9zZXJ2aWNlLWtleXN0b3JlLXBhc3N3b3JkLT8/Pz8/P2AsXG4gICAgICAgICAgICAgICAgYGFybjphd3M6c2VjcmV0c21hbmFnZXI6JHtwcm9wcy5lbnYucmVnaW9ufToke3Byb3BzLmVudi5hY2NvdW50fTpzZWNyZXQ6L2NvbmZpZy8qL3NlcnZpY2Uta2V5c3RvcmUtcGFzc3dvcmRgLFxuICAgICAgICAgICAgICBdLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSxcbiAgICAgIH0sXG4gICAgICBtYW5hZ2VkUG9saWNpZXM6IFtrYWZrYUludGVncmF0aW9uUG9saWN5XSxcbiAgICB9KTtcbiAgICBhY2NvdW50TmFtZVBhcmFtZXRlci5ncmFudFJlYWQoY3JlYXRlTVNLQ2VydFJvbGUpO1xuICAgIHRlYW1OYW1lUGFyYW1ldGVyLmdyYW50UmVhZCh0aGlzLnJ1bm5lckJhc2VSb2xlKTtcbiAgICAoY3JlYXRlTVNLQ2VydFJvbGUubm9kZS5kZWZhdWx0Q2hpbGQgYXMgQ2ZuUm9sZSkub3ZlcnJpZGVMb2dpY2FsSWQoJ0dsUnVubmVyQ3JlYXRlQW5kU2lnbkNlcnRSb2xlJyk7XG5cbiAgICBjb25zdCBlY3JEZXBsb3lSb2xlID0gbmV3IFJvbGUodGhpcywgJ0dsUnVubmVyRUNSRGVwbG95Um9sZScsIHtcbiAgICAgIHJvbGVOYW1lOiAnZ2wtcnVubmVyLWRlcGxveS10by1lY3Itcm9sZScsXG4gICAgICBhc3N1bWVkQnk6IHRoaXMucnVubmVyQmFzZVJvbGUsXG4gICAgICBpbmxpbmVQb2xpY2llczoge1xuICAgICAgICBEZXBsb3lUb0VDUjogUG9saWN5RG9jdW1lbnQuZnJvbUpzb24oe1xuICAgICAgICAgIFZlcnNpb246ICcyMDEyLTEwLTE3JyxcbiAgICAgICAgICBTdGF0ZW1lbnQ6IFtcbiAgICAgICAgICAgIHtcbiAgICAgICAgICAgICAgQWN0aW9uOiBbXG4gICAgICAgICAgICAgICAgJ2VjcjpCYXRjaENoZWNrTGF5ZXJBdmFpbGFiaWxpdHknLFxuICAgICAgICAgICAgICAgICdlY3I6QmF0Y2hHZXRJbWFnZScsXG4gICAgICAgICAgICAgICAgJ2VjcjpDb21wbGV0ZUxheWVyVXBsb2FkJyxcbiAgICAgICAgICAgICAgICAnZWNyOkdldERvd25sb2FkVXJsRm9yTGF5ZXInLFxuICAgICAgICAgICAgICAgICdlY3I6SW5pdGlhdGVMYXllclVwbG9hZCcsXG4gICAgICAgICAgICAgICAgJ2VjcjpQdXRJbWFnZScsXG4gICAgICAgICAgICAgICAgJ2VjcjpVcGxvYWRMYXllclBhcnQnLFxuICAgICAgICAgICAgICAgICdlY3I6R2V0QXV0aG9yaXphdGlvblRva2VuJyxcbiAgICAgICAgICAgICAgICAnZWNyOkRlc2NyaWJlUmVwb3NpdG9yaWVzJyxcbiAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgICAgRWZmZWN0OiAnQWxsb3cnLFxuICAgICAgICAgICAgICBSZXNvdXJjZTogW2Ake3Byb3BzLmVudi5hY2NvdW50fS5ka3IuZWNyLiR7cHJvcHMuZW52LnJlZ2lvbn0uYW1hem9uYXdzLmNvbS8qYF0sXG4gICAgICAgICAgICB9LFxuICAgICAgICAgIF0sXG4gICAgICAgIH0pLFxuICAgICAgfSxcbiAgICB9KTtcbiAgICBQdWJsaWNHYWxsZXJ5QXV0aG9yaXphdGlvblRva2VuLmdyYW50UmVhZChlY3JEZXBsb3lSb2xlKTtcbiAgICAoZWNyRGVwbG95Um9sZS5ub2RlLmRlZmF1bHRDaGlsZCBhcyBDZm5Sb2xlKS5vdmVycmlkZUxvZ2ljYWxJZCgnR2xSdW5uZXJFQ1JEZXBsb3lSb2xlJyk7XG5cbiAgICBjb25zdCBpYW1Qb2xpY3lLTVMgPSBuZXcgUG9saWN5U3RhdGVtZW50KHtcbiAgICAgIGFjdGlvbnM6IFsna21zOkRlY3J5cHQnXSxcbiAgICAgIHJlc291cmNlczogWydhcm46YXdzOmttczoqOjkwMzQwNDM4NjU1MDprZXkvKicsIGBhcm46YXdzOmttczoqOiR7cHJvcHMuZW52LmFjY291bnR9OmtleS8qYF0sXG4gICAgICBjb25kaXRpb25zOiB7XG4gICAgICAgICdGb3JBbnlWYWx1ZTpTdHJpbmdMaWtlJzoge1xuICAgICAgICAgICdrbXM6UmVzb3VyY2VBbGlhc2VzJzogJ2FsaWFzL3Jpby1sei1iYWNrdXAta2V5KicsXG4gICAgICAgIH0sXG4gICAgICB9LFxuICAgIH0pO1xuICAgIGNvbnN0IGlhbVBvbGljeUxhbWJkYUV4ZWN1dGlvbiA9IG5ldyBQb2xpY3lTdGF0ZW1lbnQoe1xuICAgICAgYWN0aW9uczogWydsYW1iZGE6SW52b2tlRnVuY3Rpb24nXSxcbiAgICAgIHJlc291cmNlczogW2Bhcm46YXdzOmxhbWJkYTpldS13ZXN0LTE6JHtwcm9wcy5lbnYuYWNjb3VudH06ZnVuY3Rpb246U2VjcmV0c1Jlc3RvcmVIYW5kbGVyYF0sXG4gICAgfSk7XG4gICAgY29uc3Qgc2VjcmV0c0JhY2tVcFJvbGUgPSBuZXcgUm9sZSh0aGlzLCAnR2xSdW5uZXJTZWNyZXRzQmFja3VwUm9sZScsIHtcbiAgICAgIHJvbGVOYW1lOiAnZ2wtcnVubmVyLXNlY3JldHMtYmFja3VwLXJvbGUnLFxuICAgICAgYXNzdW1lZEJ5OiB0aGlzLnJ1bm5lckJhc2VSb2xlLFxuICAgICAgaW5saW5lUG9saWNpZXM6IHtcbiAgICAgICAgU2VjcmV0c0JhY2t1cDogbmV3IFBvbGljeURvY3VtZW50KHsgc3RhdGVtZW50czogW2lhbVBvbGljeUtNUywgaWFtUG9saWN5TGFtYmRhRXhlY3V0aW9uXSB9KSxcbiAgICAgIH0sXG4gICAgfSk7XG4gICAgKHNlY3JldHNCYWNrVXBSb2xlLm5vZGUuZGVmYXVsdENoaWxkIGFzIENmblJvbGUpLm92ZXJyaWRlTG9naWNhbElkKCdHbFJ1bm5lclNlY3JldHNCYWNrdXBSb2xlJyk7XG5cbiAgICBjb25zdCBkZXBsb3lSb2xlID0gbmV3IFJvbGUodGhpcywgJ0dsUnVubmVyQ0RLRGVwbG95Um9sZScsIHtcbiAgICAgIHJvbGVOYW1lOiAnZ2wtcnVubmVyLWNkay1kZXBsb3ktcm9sZScsXG4gICAgICBhc3N1bWVkQnk6IHRoaXMucnVubmVyQmFzZVJvbGUsXG4gICAgICBtYW5hZ2VkUG9saWNpZXM6IFtrYWZrYUludGVncmF0aW9uUG9saWN5XSwgLy8gcmVxdWlyZWQgdG8gY3JlYXRlIEthZmthIHRvcGljcyBhbmQgcHVibGlzaCBldmVudCBzcGVjaWZpY2F0aW9uIGluIGRlcGxveSBqb2JzXG4gICAgICBpbmxpbmVQb2xpY2llczoge1xuICAgICAgICBDZGtEZXBsb3k6IFBvbGljeURvY3VtZW50LmZyb21Kc29uKHtcbiAgICAgICAgICBWZXJzaW9uOiAnMjAxMi0xMC0xNycsXG4gICAgICAgICAgU3RhdGVtZW50OiBbXG4gICAgICAgICAgICB7XG4gICAgICAgICAgICAgIEVmZmVjdDogJ0FsbG93JyxcbiAgICAgICAgICAgICAgQWN0aW9uOiBbXG4gICAgICAgICAgICAgICAgJ2Nsb3VkZm9ybWF0aW9uOkRlc2NyaWJlU3RhY2tzJyxcbiAgICAgICAgICAgICAgICAnY2xvdWRmb3JtYXRpb246Q3JlYXRlQ2hhbmdlU2V0JyxcbiAgICAgICAgICAgICAgICAnY2xvdWRmb3JtYXRpb246RGVzY3JpYmVDaGFuZ2VTZXQnLFxuICAgICAgICAgICAgICAgICdjbG91ZGZvcm1hdGlvbjpFeGVjdXRlQ2hhbmdlU2V0JyxcbiAgICAgICAgICAgICAgICAnY2xvdWRmb3JtYXRpb246RGVzY3JpYmVTdGFja0V2ZW50cycsXG4gICAgICAgICAgICAgICAgJ2Nsb3VkZm9ybWF0aW9uOkRlbGV0ZUNoYW5nZVNldCcsXG4gICAgICAgICAgICAgICAgJ2Nsb3VkZm9ybWF0aW9uOkdldFRlbXBsYXRlJyxcbiAgICAgICAgICAgICAgXSxcbiAgICAgICAgICAgICAgUmVzb3VyY2U6IFtgYXJuOmF3czpjbG91ZGZvcm1hdGlvbjoke3Byb3BzLmVudi5yZWdpb259OiR7cHJvcHMuZW52LmFjY291bnR9OnN0YWNrLypgXSxcbiAgICAgICAgICAgIH0sXG4gICAgICAgICAgICB7XG4gICAgICAgICAgICAgIEVmZmVjdDogJ0FsbG93JyxcbiAgICAgICAgICAgICAgQWN0aW9uOiBbJ3MzOipPYmplY3QnLCAnczM6TGlzdEJ1Y2tldCcsICdzMzpHZXRCdWNrZXRMb2NhdGlvbiddLFxuICAgICAgICAgICAgICBSZXNvdXJjZTogWydhcm46YXdzOnMzOjo6Y2RrdG9vbGtpdC0qJ10sXG4gICAgICAgICAgICB9LFxuICAgICAgICAgICAge1xuICAgICAgICAgICAgICBTaWQ6ICdhc3N1bWVyb2xlJyxcbiAgICAgICAgICAgICAgRWZmZWN0OiAnQWxsb3cnLFxuICAgICAgICAgICAgICBBY3Rpb246IFsnc3RzOkFzc3VtZVJvbGUnLCAnaWFtOlBhc3NSb2xlJ10sXG4gICAgICAgICAgICAgIFJlc291cmNlOiBbXG4gICAgICAgICAgICAgICAgJ2Fybjphd3M6aWFtOjoqOnJvbGUvY2RrLXJlYWRPbmx5Um9sZScsXG4gICAgICAgICAgICAgICAgJ2Fybjphd3M6aWFtOjoqOnJvbGUvY2RrLWhuYjY1OWZkcy1kZXBsb3ktcm9sZS0qJyxcbiAgICAgICAgICAgICAgICAnYXJuOmF3czppYW06Oio6cm9sZS9jZGstaG5iNjU5ZmRzLWZpbGUtcHVibGlzaGluZy0qJyxcbiAgICAgICAgICAgICAgICAnYXJuOmF3czppYW06Oio6cm9sZS9jZGstaG5iNjU5ZmRzLWxvb2t1cC1yb2xlLSonLFxuICAgICAgICAgICAgICBdLFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSxcbiAgICAgICAgQ2ZuRGVwbG95OiBQb2xpY3lEb2N1bWVudC5mcm9tSnNvbih7XG4gICAgICAgICAgVmVyc2lvbjogJzIwMTItMTAtMTcnLFxuICAgICAgICAgIFN0YXRlbWVudDogW1xuICAgICAgICAgICAge1xuICAgICAgICAgICAgICBFZmZlY3Q6ICdBbGxvdycsXG4gICAgICAgICAgICAgIEFjdGlvbjogWycqJ10sXG4gICAgICAgICAgICAgIFJlc291cmNlOiBbYGFybjphd3M6Y2xvdWRmb3JtYXRpb246JHtwcm9wcy5lbnYucmVnaW9ufToke3Byb3BzLmVudi5hY2NvdW50fTpzdGFjay8qYF0sXG4gICAgICAgICAgICAgIENvbmRpdGlvbjoge1xuICAgICAgICAgICAgICAgICdGb3JBbnlWYWx1ZTpTdHJpbmdFcXVhbHMnOiB7XG4gICAgICAgICAgICAgICAgICAnYXdzOkNhbGxlZFZpYSc6ICdjbG91ZGZvcm1hdGlvbi5hbWF6b25hd3MuY29tJyxcbiAgICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgICB9LFxuICAgICAgICAgICAgfSxcbiAgICAgICAgICBdLFxuICAgICAgICB9KSxcbiAgICAgIH0sXG4gICAgfSk7XG4gICAgKGRlcGxveVJvbGUubm9kZS5kZWZhdWx0Q2hpbGQgYXMgQ2ZuUm9sZSkub3ZlcnJpZGVMb2dpY2FsSWQoJ0dsUnVubmVyQ0RLRGVwbG95Um9sZScpO1xuXG4gICAgY29uc3QgZ2xSdW5uZXJDZGtEZXBsb3lSb2xlQXJuID0gbmV3IENmbk91dHB1dChzY29wZSwgJ0dsUnVubmVyQ0RLRGVwbG95Um9sZUFybicsIHtcbiAgICAgIHZhbHVlOiBkZXBsb3lSb2xlLnJvbGVBcm4sXG4gICAgICBleHBvcnROYW1lOiAnZ2wtcnVubmVyLWNkay1kZXBsb3ktcm9sZS1hcm4nLFxuICAgIH0pO1xuICAgIGdsUnVubmVyQ2RrRGVwbG95Um9sZUFybi5vdmVycmlkZUxvZ2ljYWxJZCgnR2xSdW5uZXJDREtEZXBsb3lSb2xlQXJuJyk7XG4gICAgY29uc3QgZ2xSdW5uZXJDZGtEZXBsb3lSb2xlTmFtZSA9IG5ldyBDZm5PdXRwdXQoc2NvcGUsICdHbFJ1bm5lckNES0RlcGxveVJvbGVOYW1lJywge1xuICAgICAgdmFsdWU6IGRlcGxveVJvbGUucm9sZU5hbWUsXG4gICAgICBleHBvcnROYW1lOiAnZ2wtcnVubmVyLWNkay1kZXBsb3ktcm9sZS1uYW1lJyxcbiAgICB9KTtcbiAgICBnbFJ1bm5lckNka0RlcGxveVJvbGVOYW1lLm92ZXJyaWRlTG9naWNhbElkKCdHbFJ1bm5lckNES0RlcGxveVJvbGVOYW1lJyk7XG5cbiAgICBjb25zdCBnbFJ1bm5lckNka0NyZWF0ZUFuZFNpZ25DZXJ0Um9sZU5hbWUgPSBuZXcgQ2ZuT3V0cHV0KHNjb3BlLCAnR2xSdW5uZXJDREtDcmVhdGVBbmRTaWduQ2VydFJvbGVOYW1lJywge1xuICAgICAgdmFsdWU6IGNyZWF0ZU1TS0NlcnRSb2xlLnJvbGVOYW1lLFxuICAgICAgZXhwb3J0TmFtZTogJ2dsLXJ1bm5lci1jZGstY3JlYXRlLWFuZC1zaWduLW1zay1jZXJ0LXJvbGUtbmFtZScsXG4gICAgfSk7XG4gICAgZ2xSdW5uZXJDZGtDcmVhdGVBbmRTaWduQ2VydFJvbGVOYW1lLm92ZXJyaWRlTG9naWNhbElkKCdHbFJ1bm5lckNES0NyZWF0ZUFuZFNpZ25DZXJ0Um9sZU5hbWUnKTtcbiAgICBjb25zdCBnbFJ1bm5lckNka0NyZWF0ZUFuZFNpZ25DZXJ0Um9sZUFybiA9IG5ldyBDZm5PdXRwdXQoc2NvcGUsICdHbFJ1bm5lckNES0NyZWF0ZUFuZFNpZ25DZXJ0Um9sZUFybicsIHtcbiAgICAgIHZhbHVlOiBjcmVhdGVNU0tDZXJ0Um9sZS5yb2xlQXJuLFxuICAgICAgZXhwb3J0TmFtZTogJ2dsLXJ1bm5lci1jZGstY3JlYXRlLWFuZC1zaWduLW1zay1jZXJ0LXJvbGUtYXJuJyxcbiAgICB9KTtcbiAgICBnbFJ1bm5lckNka0NyZWF0ZUFuZFNpZ25DZXJ0Um9sZUFybi5vdmVycmlkZUxvZ2ljYWxJZCgnR2xSdW5uZXJDREtDcmVhdGVBbmRTaWduQ2VydFJvbGVBcm4nKTtcblxuICAgIGNvbnN0IGdsUnVubmVyQ2RrUHVibGlzaFdlYkNvbnRlbnRSb2xlTmFtZSA9IG5ldyBDZm5PdXRwdXQoc2NvcGUsICdHbFJ1bm5lckNES1B1Ymxpc2hXZWJDb250ZW50Um9sZU5hbWUnLCB7XG4gICAgICB2YWx1ZTogd2ViQ29udGVudFB1Ymxpc2hSb2xlLnJvbGVOYW1lLFxuICAgICAgZXhwb3J0TmFtZTogJ2dsLXJ1bm5lci1jZGstcHVibGlzaC13ZWItY29udGVudC1vbi1zMy1yb2xlLW5hbWUnLFxuICAgIH0pO1xuICAgIGdsUnVubmVyQ2RrUHVibGlzaFdlYkNvbnRlbnRSb2xlTmFtZS5vdmVycmlkZUxvZ2ljYWxJZCgnR2xSdW5uZXJDREtQdWJsaXNoV2ViQ29udGVudFJvbGVOYW1lJyk7XG4gICAgY29uc3QgZ2xSdW5uZXJDZGtQdWJsaXNoV2ViQ29udGVudFJvbGVBcm4gPSBuZXcgQ2ZuT3V0cHV0KHNjb3BlLCAnR2xSdW5uZXJDREtQdWJsaXNoV2ViQ29udGVudFJvbGVBcm4nLCB7XG4gICAgICB2YWx1ZTogd2ViQ29udGVudFB1Ymxpc2hSb2xlLnJvbGVBcm4sXG4gICAgICBleHBvcnROYW1lOiAnZ2wtcnVubmVyLWNkay1wdWJsaXNoLXdlYi1jb250ZW50LW9uLXMzLXJvbGUtYXJuJyxcbiAgICB9KTtcbiAgICBnbFJ1bm5lckNka1B1Ymxpc2hXZWJDb250ZW50Um9sZUFybi5vdmVycmlkZUxvZ2ljYWxJZCgnR2xSdW5uZXJDREtQdWJsaXNoV2ViQ29udGVudFJvbGVBcm4nKTtcblxuICAgIGNvbnN0IGdsUnVubmVyQ2RrRGVwbG95VG9FY3JSb2xlTmFtZSA9IG5ldyBDZm5PdXRwdXQoc2NvcGUsICdHbFJ1bm5lckNES0RlcGxveVRvRWNyUm9sZU5hbWUnLCB7XG4gICAgICB2YWx1ZTogZWNyRGVwbG95Um9sZS5yb2xlTmFtZSxcbiAgICAgIGV4cG9ydE5hbWU6ICdnbC1ydW5uZXItY2RrLWRlcGxveS10by1lY3Itcm9sZS1uYW1lJyxcbiAgICB9KTtcbiAgICBnbFJ1bm5lckNka0RlcGxveVRvRWNyUm9sZU5hbWUub3ZlcnJpZGVMb2dpY2FsSWQoJ0dsUnVubmVyQ0RLRGVwbG95VG9FY3JSb2xlTmFtZScpO1xuICAgIGNvbnN0IGdsUnVubmVyQ2RrRGVwbG95VG9FY3JSb2xlQXJuID0gbmV3IENmbk91dHB1dChzY29wZSwgJ0dsUnVubmVyQ0RLRGVwbG95VG9FY3JSb2xlQXJuJywge1xuICAgICAgdmFsdWU6IGVjckRlcGxveVJvbGUucm9sZUFybixcbiAgICAgIGV4cG9ydE5hbWU6ICdnbC1ydW5uZXItY2RrLWRlcGxveS10by1lY3Itcm9sZS1hcm4nLFxuICAgIH0pO1xuICAgIGdsUnVubmVyQ2RrRGVwbG95VG9FY3JSb2xlQXJuLm92ZXJyaWRlTG9naWNhbElkKCdHbFJ1bm5lckNES0RlcGxveVRvRWNyUm9sZUFybicpO1xuXG4gICAgY29uc3QgZ2xSdW5uZXJDZGtTZWNyZXRzQmFja3VwUm9sZU5hbWUgPSBuZXcgQ2ZuT3V0cHV0KHNjb3BlLCAnR2xSdW5uZXJDREtTZWNyZXRzQmFja3VwUm9sZU5hbWUnLCB7XG4gICAgICB2YWx1ZTogc2VjcmV0c0JhY2tVcFJvbGUucm9sZU5hbWUsXG4gICAgICBleHBvcnROYW1lOiAnZ2wtcnVubmVyLWNkay1zZWNyZXRzLWJhY2t1cC1yb2xlLW5hbWUnLFxuICAgIH0pO1xuICAgIGdsUnVubmVyQ2RrU2VjcmV0c0JhY2t1cFJvbGVOYW1lLm92ZXJyaWRlTG9naWNhbElkKCdHbFJ1bm5lckNES1NlY3JldHNCYWNrdXBSb2xlTmFtZScpO1xuICAgIGNvbnN0IGdsUnVubmVyQ2RrU2VjcmV0c0JhY2t1cFJvbGVBcm4gPSBuZXcgQ2ZuT3V0cHV0KHNjb3BlLCAnR2xSdW5uZXJDREtTZWNyZXRzQmFja3VwUm9sZUFybicsIHtcbiAgICAgIHZhbHVlOiBzZWNyZXRzQmFja1VwUm9sZS5yb2xlQXJuLFxuICAgICAgZXhwb3J0TmFtZTogJ2dsLXJ1bm5lci1jZGstc2VjcmV0cy1iYWNrdXAtcm9sZS1hcm4nLFxuICAgIH0pO1xuICAgIGdsUnVubmVyQ2RrU2VjcmV0c0JhY2t1cFJvbGVBcm4ub3ZlcnJpZGVMb2dpY2FsSWQoJ0dsUnVubmVyQ0RLU2VjcmV0c0JhY2t1cFJvbGVBcm4nKTtcbiAgfVxufSJdfQ==

package/lib/contributions/smart-route/gitlab-runner/spot-role.d.ts

@@ -0,0 +1,7 @@
+import { Construct } from 'constructs';
+/**
+ * The construct creates a service linked role required to run GitLab Runners using Spot EC2 instances.
+ */
+export declare class SpotServiceLinkedRole extends Construct {
+    constructor(scope: Construct, id: string);
+}

package/lib/contributions/smart-route/gitlab-runner/spot-role.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SpotServiceLinkedRole = void 0;
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const constructs_1 = require("constructs");
+/**
+ * The construct creates a service linked role required to run GitLab Runners using Spot EC2 instances.
+ */
+class SpotServiceLinkedRole extends constructs_1.Construct {
+    constructor(scope, id) {
+        super(scope, id);
+        new aws_iam_1.CfnServiceLinkedRole(scope, 'Ec2SpotServiceLinkedRole', {
+            awsServiceName: 'spot.amazonaws.com',
+        });
+    }
+}
+exports.SpotServiceLinkedRole = SpotServiceLinkedRole;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic3BvdC1yb2xlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vLi4vc3JjL2NvbnRyaWJ1dGlvbnMvc21hcnQtcm91dGUvZ2l0bGFiLXJ1bm5lci9zcG90LXJvbGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsaURBQTJEO0FBQzNELDJDQUF1QztBQUd2Qzs7R0FFRztBQUNILE1BQWEscUJBQXNCLFNBQVEsc0JBQVM7SUFDbEQsWUFBWSxLQUFnQixFQUFFLEVBQVU7UUFDdEMsS0FBSyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNqQixJQUFJLDhCQUFvQixDQUFDLEtBQUssRUFBRSwwQkFBMEIsRUFBRTtZQUMxRCxjQUFjLEVBQUUsb0JBQW9CO1NBQ3JDLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRjtBQVBELHNEQU9DIiwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHsgQ2ZuU2VydmljZUxpbmtlZFJvbGUgfSBmcm9tICdhd3MtY2RrLWxpYi9hd3MtaWFtJztcbmltcG9ydCB7IENvbnN0cnVjdCB9IGZyb20gJ2NvbnN0cnVjdHMnO1xuXG5cbi8qKlxuICogVGhlIGNvbnN0cnVjdCBjcmVhdGVzIGEgc2VydmljZSBsaW5rZWQgcm9sZSByZXF1aXJlZCB0byBydW4gR2l0TGFiIFJ1bm5lcnMgdXNpbmcgU3BvdCBFQzIgaW5zdGFuY2VzLlxuICovXG5leHBvcnQgY2xhc3MgU3BvdFNlcnZpY2VMaW5rZWRSb2xlIGV4dGVuZHMgQ29uc3RydWN0IHtcbiAgY29uc3RydWN0b3Ioc2NvcGU6IENvbnN0cnVjdCwgaWQ6IHN0cmluZykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG4gICAgbmV3IENmblNlcnZpY2VMaW5rZWRSb2xlKHNjb3BlLCAnRWMyU3BvdFNlcnZpY2VMaW5rZWRSb2xlJywge1xuICAgICAgYXdzU2VydmljZU5hbWU6ICdzcG90LmFtYXpvbmF3cy5jb20nLFxuICAgIH0pO1xuICB9XG59XG4iXX0=

package/package.json

@@ -15,7 +15,7 @@
   ],
   "main": "lib/index.js",
   "license": "Apache-2.0",
-  "version": "6.1.0",
+  "version": "6.2.1",
   "types": "lib/index.d.ts",
   "stability": "stable",
   "exports": {
@@ -51,7 +51,8 @@
     "bump": "commit-and-tag-version -a",
     "test": "jest --coverage",
     "test:watch": "jest --watch",
-    "eslint": "eslint --ext .ts,.tsx --fix --no-error-on-unmatched-pattern src test",
+    "eslint": "eslint --ext .ts,.tsx --no-error-on-unmatched-pattern src test",
+    "eslint-fix": "eslint --ext .ts,.tsx --fix --no-error-on-unmatched-pattern src test",
     "docgen": "jsii-docgen -o ./docs/API.md",
     "cdk": "cdk",
     "release:check": "node release-commit-check.js",
@@ -99,6 +100,9 @@
     "@datadog/datadog-api-client": "^1.24.0",
     "js-yaml": "~4.1.0"
   },
+  "optionalDependencies": {
+    "@pepperize/cdk-autoscaling-gitlab-runner": "^0.2.613"
+  },
   "bundledDependencies": [
     "js-yaml"
   ],

package/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "6.1.0"
+  "version": "6.2.1"
 }