alasio 6.0.0 → 7.0.0

package/dist/cli/src/manifests/network-policies.js

@@ -1,10 +1,13 @@
+import { COMPUTE_PORT } from "../../../neon/control/branches.js";
 import { BRANCH_FORK_PORT } from "../../../src/branch/names.js";
+import { NODE_AGENT_PORT } from "../../../src/node-agent/names.js";
 import { forksForBranches, sessionsNamespace } from "./alasio.js";
-import { BRANCH_LABEL, COLLECTOR_PORT, collectorRuns, componentName, given, grafanaRuns, labels, MAIN_ENVIRONMENT, NAMESPACE, RELEASE, selectorLabels, } from "./common.js";
+import { BRANCH_LABEL, COLLECTOR_PORT, collectorRuns, componentName, given, grafanaRuns, labels, MAIN_ENVIRONMENT, NAMESPACE, nodeAgentRuns, RELEASE, selectorLabels, } from "./common.js";
 import { replicated } from "./disruption.js";
 import { GOSSIP_PORT } from "./grafana.js";
 import { LAKE_QUERY_PORT } from "./lake.js";
 import { BACKUP_COMPONENT, COMPONENTS, FILER, FILER_STORE, GATEWAY, LIFECYCLE_COMPONENT, MASTER, METRICS_PORT, RESTORE_COMPONENTS, RESTORE_SOURCE, VOLUME_SERVER, } from "./object-store.js";
+import { PROXY_PORT } from "./neon.js";
 import { CONTROLLER_POD_LABELS, JOB_POD_SELECTOR, MOUNT_POD_LABELS, NODE_POD_LABELS } from "./juicefs-csi.js";
 import { VALKEY_PORT } from "./valkey.js";
 import { JUICEFS_ADMIN } from "./workspace-storage.js";
@@ -18,6 +21,13 @@ const alasioOf = ({ namespace }) => ({ namespaceSelector: namespaceNamed(namespa
 const BRANCH_NAMESPACES = { matchExpressions: [{ key: BRANCH_LABEL, operator: "Exists" }] };
 /** The labels of the data stack's pods, which its policy admits each other by. */
 const STACK = { "app.kubernetes.io/instance": RELEASE, "alasio.dev/stack": "neon" };
+/** The node agents' pods, as a peer. */
+const NODE_AGENT = { podSelector: { matchLabels: selectorLabels("node-agent") } };
+/** The cluster's DNS, as an egress rule. */
+const CLUSTER_DNS = {
+    to: [{ namespaceSelector: namespaceNamed("kube-system"), podSelector: { matchLabels: { "k8s-app": "kube-dns" } } }],
+    ports: [{ protocol: "UDP", port: 53 }, { protocol: "TCP", port: 53 }],
+};
 /** A NetworkPolicy of `name` in `namespace`, labelled as `component`'s. */
 function policy(name, namespace, component, spec) {
     return { apiVersion: "networking.k8s.io/v1", kind: "NetworkPolicy", metadata: { name, namespace, labels: labels(component) }, spec };
@@ -53,40 +63,66 @@ function sessionPolicies(config, environment) {
 }
 /** The object store's parts, of the stack, to each of which partPolicies and gatewayPolicy admit what talks to it alone. */
 const PARTS = [COMPONENTS.gateway, COMPONENTS.master, COMPONENTS.volumeServer, COMPONENTS.filer];
+/** A component of main's, as a peer from any namespace. */
+const ofMain = (component) => ({ namespaceSelector: namespaceNamed(NAMESPACE), podSelector: { matchLabels: selectorLabels(component) } });
 /**
- * Neon's services, the lake and their jobs reach each other; alasio reaches the compute,
- * its database. In a branch environment, its compute and its lake reach each other, and
- * its alasio its compute, as main's do. The object store's parts, of the stack too, are
- * reached as partPolicies and gatewayPolicy say alone.
+ * Neon's services, the lake and their jobs reach each other, but the compute, which
+ * takes its clients' sessions from main's Neon proxy alone, which every client connects
+ * through, neon-control's, which wakes it and counts its sessions, and the collector's
+ * scrapes of compute_ctl's metrics. In a branch environment, its lake and compute
+ * likewise, but for the scrapes, as the collector scrapes main's compute alone. The object
+ * store's parts, of the stack too, are reached as partPolicies and gatewayPolicy say alone.
  */
 function neonPolicies({ namespace }) {
     return [
         policy(componentName("neon"), namespace, "neon", {
-            podSelector: { matchLabels: STACK, matchExpressions: [{ key: "app.kubernetes.io/component", operator: "NotIn", values: PARTS }] },
+            podSelector: { matchLabels: STACK, matchExpressions: [{ key: "app.kubernetes.io/component", operator: "NotIn", values: [...PARTS, "neon-compute"] }] },
             policyTypes: ["Ingress"],
             ingress: [{ from: [{ podSelector: { matchLabels: STACK } }] }],
         }),
         policy(componentName("neon-compute"), namespace, "neon", {
             podSelector: { matchLabels: selectorLabels("neon-compute") },
             policyTypes: ["Ingress"],
-            ingress: [{ from: [{ podSelector: { matchLabels: selectorLabels("alasio") } }], ports: [{ protocol: "TCP", port: 55433 }] }],
+            ingress: [
+                { from: [ofMain("neon-proxy"), ofMain("neon-control")], ports: [{ protocol: "TCP", port: COMPUTE_PORT }] },
+                // The collector scrapes main's compute_ctl alone (collector.ts).
+                ...(namespace === NAMESPACE ? [{ from: [ofMain("collector")], ports: [{ protocol: "TCP", port: 3080 }] }] : []),
+            ],
         }),
     ];
 }
+/**
+ * Neon's proxy takes the sessions of every client of a compute: the stack's own pods of
+ * main's (neonPolicies), alasio, and branch environments' alasio (their lakes reach it as
+ * what branches share, branchStoragePolicy; Grafana as grafanaPolicies admit it).
+ */
+function proxyPolicy() {
+    return policy(componentName("neon-proxy"), NAMESPACE, "neon", {
+        podSelector: { matchLabels: selectorLabels("neon-proxy") },
+        policyTypes: ["Ingress"],
+        ingress: [{
+                from: [
+                    { podSelector: { matchLabels: selectorLabels("alasio") } },
+                    { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: selectorLabels("alasio") } },
+                ],
+                ports: [{ protocol: "TCP", port: PROXY_PORT }],
+            }],
+    });
+}
 /**
  * Branch environments' computes and lakes reach main's storage, which they share: the
  * pageserver and safekeepers their timelines are on, neon-control their specs are
- * served by, and the object store the lake's files are in; nothing else of main's, nor
- * its compute, which is main's database.
+ * served by, the proxy their lakes reach their computes through, and the object store the
+ * lake's files are in; nothing else of main's, nor its compute, which is main's database.
  */
 function branchStoragePolicy(config) {
-    const shared = ["neon-pageserver", "neon-safekeeper", "neon-control", ...(config.objectStore.bundled.enabled ? ["seaweedfs"] : [])];
+    const shared = ["neon-pageserver", "neon-safekeeper", "neon-control", "neon-proxy", ...(config.objectStore.bundled.enabled ? ["seaweedfs"] : [])];
     return policy(componentName("neon-branches"), NAMESPACE, "neon", {
         podSelector: { matchLabels: { "app.kubernetes.io/instance": RELEASE }, matchExpressions: [{ key: "app.kubernetes.io/component", operator: "In", values: shared }] },
         policyTypes: ["Ingress"],
         ingress: [{
                 from: [{ namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: STACK } }],
-                ports: [6400, 5454, 8080, 8333].map((port) => ({ protocol: "TCP", port })),
+                ports: [6400, 5454, 8080, PROXY_PORT, 8333].map((port) => ({ protocol: "TCP", port })),
             }],
     });
 }
@@ -196,18 +232,20 @@ function filerStorePolicies() {
     ];
 }
 /**
- * The telemetry collector takes OTLP from alasio and folder workspaces' bayma, beside the
- * stack's own pods (neonPolicies), and from branch environments' alasio, compute and
- * lake, and from nothing else: sessions' telemetry reaches it through their alasio's
- * receiver alone.
+ * The telemetry collector takes OTLP from alasio, the node agents and folder workspaces'
+ * bayma, beside the stack's own pods (neonPolicies), and from branch environments'
+ * alasio, compute and lake, and from nothing else: sessions' telemetry reaches it through
+ * their alasio's receiver alone.
  */
-function collectorPolicy({ host }) {
+function collectorPolicy(config) {
+    const { host } = config;
     return policy(componentName("collector"), NAMESPACE, "collector", {
         podSelector: { matchLabels: selectorLabels("collector") },
         policyTypes: ["Ingress"],
         ingress: [{
                 from: [
                     { podSelector: { matchLabels: selectorLabels("alasio") } },
+                    ...(nodeAgentRuns(config) ? [NODE_AGENT] : []),
                     ...(host.enabled ? [{ namespaceSelector: namespaceNamed(host.namespace) }] : []),
                     { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: selectorLabels("alasio") } },
                     { namespaceSelector: BRANCH_NAMESPACES, podSelector: { matchLabels: STACK } },
@@ -219,10 +257,10 @@ function collectorPolicy({ host }) {
 /**
  * Grafana takes no connection but its replicas' gossip, where it may run several:
  * `alasio grafana` reaches it through the API server's port-forward, which no
- * NetworkPolicy sees. It reaches the cluster's DNS, its database on the compute and the
- * lake's query endpoint, each of which admits it, its replicas, and Telegram's Bot API, as
- * alasio does, on the internet's HTTPS port; nothing else, and no other address of the
- * cluster or its network.
+ * NetworkPolicy sees. It reaches the cluster's DNS, its database through Neon's proxy and
+ * the lake's query endpoint, each of which admits it, its replicas, and Telegram's Bot
+ * API, as alasio does, on the internet's HTTPS port; nothing else, and no other address
+ * of the cluster or its network.
  */
 function grafanaPolicies({ sessions, grafana: { scaling } }) {
     const grafana = { podSelector: { matchLabels: selectorLabels("grafana") } };
@@ -239,20 +277,50 @@ function grafanaPolicies({ sessions, grafana: { scaling } }) {
             ...(gossip.length > 0 ? { ingress: [{ from: [grafana], ports: gossip }] } : {}),
             egress: [
                 ...(gossip.length > 0 ? [{ to: [grafana], ports: gossip }] : []),
-                {
-                    to: [{ namespaceSelector: { matchLabels: { "kubernetes.io/metadata.name": "kube-system" } }, podSelector: { matchLabels: { "k8s-app": "kube-dns" } } }],
-                    ports: [{ protocol: "UDP", port: 53 }, { protocol: "TCP", port: 53 }],
-                },
-                { to: [{ podSelector: { matchLabels: selectorLabels("neon-compute") } }], ports: [{ protocol: "TCP", port: 55433 }] },
+                CLUSTER_DNS,
+                { to: [{ podSelector: { matchLabels: selectorLabels("neon-proxy") } }], ports: [{ protocol: "TCP", port: PROXY_PORT }] },
                 { to: [{ podSelector: { matchLabels: selectorLabels("lake") } }], ports: [{ protocol: "TCP", port: LAKE_QUERY_PORT }] },
                 // The addresses sessions with internet may not reach, the cluster's and its network's, are Grafana's too.
                 { to: [{ ipBlock: { cidr: "0.0.0.0/0", except: [...sessions.blockedCidrs] } }], ports: [{ protocol: "TCP", port: 443 }] },
             ],
         }),
-        admitted("neon-compute", 55433),
+        admitted("neon-proxy", PROXY_PORT),
         admitted("lake", LAKE_QUERY_PORT),
     ];
 }
+/**
+ * The node agents take alasio's calls, on their API's port, and nothing else; they reach
+ * the cluster's DNS, the object store's S3 port, the bundled one's or the operator's at
+ * any address, and the collector where it runs, and nothing else. The bundled object
+ * store admits them.
+ */
+function nodeAgentPolicies(config) {
+    const { bundled, external } = config.objectStore;
+    const seaweedfs = { podSelector: { matchLabels: selectorLabels("seaweedfs") } };
+    const endpoint = bundled.enabled ? null : new URL(external.endpoint);
+    const objectStore = endpoint
+        ? { to: [{ ipBlock: { cidr: "0.0.0.0/0" } }], ports: [{ protocol: "TCP", port: Number(endpoint.port) || (endpoint.protocol === "https:" ? 443 : 80) }] }
+        : { to: [seaweedfs], ports: [{ protocol: "TCP", port: 8333 }] };
+    return [
+        policy(componentName("node-agent"), NAMESPACE, "node-agent", {
+            ...NODE_AGENT,
+            policyTypes: ["Ingress", "Egress"],
+            ingress: [{ from: [{ podSelector: { matchLabels: selectorLabels("alasio") } }], ports: [{ protocol: "TCP", port: NODE_AGENT_PORT }] }],
+            egress: [
+                CLUSTER_DNS,
+                objectStore,
+                ...(collectorRuns(config) ? [{ to: [{ podSelector: { matchLabels: selectorLabels("collector") } }], ports: [{ protocol: "TCP", port: COLLECTOR_PORT }] }] : []),
+            ],
+        }),
+        ...(bundled.enabled
+            ? [policy(componentName("seaweedfs-snapshots"), NAMESPACE, "seaweedfs", {
+                    ...seaweedfs,
+                    policyTypes: ["Ingress"],
+                    ingress: [{ from: [NODE_AGENT], ports: [{ protocol: "TCP", port: 8333 }] }],
+                })]
+            : []),
+    ];
+}
 /**
  * alasio takes no connections but its sessions' telemetry, and, main, where it forks
  * sessions for branch environments, their alasio's asking it to (src/branch/fork.ts).
@@ -299,11 +367,12 @@ export function networkPolicyObjects(config, environment = MAIN_ENVIRONMENT) {
                 })]
             : []),
         alasioPolicy(config, environment),
-        ...(config.neon.enabled ? [...neonPolicies(environment), branchStoragePolicy(config)] : []),
+        ...(config.neon.enabled ? [...neonPolicies(environment), proxyPolicy(), branchStoragePolicy(config)] : []),
         ...(config.neon.enabled && config.objectStore.bundled.enabled ? [gatewayPolicy(), ...partPolicies(), ...filerStorePolicies()] : []),
         ...(collectorRuns(config) ? [collectorPolicy(config)] : []),
         ...(grafanaRuns(config) ? grafanaPolicies(config) : []),
         ...(config.workspaceStorage.enabled ? workspaceStoragePolicies(config) : []),
+        ...(nodeAgentRuns(config) ? nodeAgentPolicies(config) : []),
     ];
 }
 //# sourceMappingURL=network-policies.js.map

package/dist/cli/src/manifests/network-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-policies.js","sourceRoot":"","sources":["../../../../src/manifests/network-policies.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,aAAa,EAEb,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,OAAO,EACP,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,EACL,WAAW,EACX,OAAO,EACP,mBAAmB,EACnB,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAUvD,+DAA+D;AAC/D,MAAM,OAAO,GAAG,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC;AAErD,kDAAkD;AAClD,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,6BAA6B,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAEpG,kDAAkD;AAClD,MAAM,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAe,EAAuB,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;AAEjL,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAE5F,kFAAkF;AAClF,MAAM,KAAK,GAAG,EAAE,4BAA4B,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;AAEpF,2EAA2E;AAC3E,SAAS,MAAM,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAiB,EAAE,IAAuB;IACzF,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AACvI,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAqB,EAAE,WAAwB;IACtE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrC,OAAO;QACL,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrG,MAAM,CAAC,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE;YAChD,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YACrC,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SACxE,CAAC;QACF,MAAM,CAAC,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE;YAClD,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YACrC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;SAC9F,CAAC;QACF,MAAM,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE;YAC5C,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE;YAC3E,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;SAClF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,4HAA4H;AAC5H,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;AAEjG;;;;;GAKG;AACH,SAAS,YAAY,CAAC,EAAE,SAAS,EAAe;IAC9C,OAAO;QACL,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;YAC/C,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE;YACjI,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;SAC/D,CAAC;QACF,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;YACvD,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,cAAc,CAAC,EAAE;YAC5D,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;SAC7H,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,MAAqB;IAChD,MAAM,MAAM,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACpI,OAAO,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;QAC/D,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,4BAA4B,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE;QACnK,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrF,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;aAC3E,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,MAAqB;IACrD,MAAM,eAAe,GAAG,EAAE,WAAW,EAAE,EAAE,6BAA6B,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;IAClH,MAAM,OAAO,GAA0B;QACrC,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE;QACtF,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE;QAC3F,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE;QACrF,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE;QACrE,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,6BAA6B,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE;KAClI,CAAC;IACF,OAAO;QACL,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE;YACnD,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;YACtD,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;gBAClE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;aAC3H;SACF,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO;YACpC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;oBACvE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE;oBACzD,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;iBACxI,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,YAAY;IACnB,MAAM,EAAE,GAAG,CAAC,SAAiB,EAAuB,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACrH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAY,EAAE,IAAuB,EAAE,EAAE,CACtF,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;QACjC,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;QACvD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YAC1C,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE;SAC9E;KACF,CAAC,CAAC;IACL,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAC5D,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACvF,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACpG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,EAAE;QACpD,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QAChE,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE;YAC7F,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;YAC7H,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE;SAC5H;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,MAAM,EAAE,GAAG,CAAC,SAAiB,EAAuB,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAuB,EAAE,EAAE,CAC1E,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;QACjC,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;QACvD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IACL,OAAO;QACL,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC7F,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;KAChF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,EAAE,IAAI,EAAiB;IAC9C,OAAO,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;QAChE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE;QACzD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE;oBACJ,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChF,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAChG,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;iBAC9E;gBACD,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aACnD,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAiB;IACxE,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3H,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAiB,EAAE,CAClE,MAAM,CAAC,aAAa,CAAC,GAAG,SAAS,eAAe,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;QACvE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;QACvD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IACL,OAAO;QACL,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;YACrD,GAAG,OAAO;YACV,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,EAAE;gBACN,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE;oBACE,EAAE,EAAE,CAAC,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,6BAA6B,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;oBACvJ,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;iBACtE;gBACD,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;gBACrH,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBACvH,0GAA0G;gBAC1G,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE;aAC1H;SACF,CAAC;QACF,QAAQ,CAAC,cAAc,EAAE,KAAK,CAAC;QAC/B,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAqB,EAAE,WAAwB;IACnE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,OAAO,GAAkB;QAC7B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;YACzB,CAAC,CAAC,CAAC;oBACD,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;oBAC5H,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;iBAClE,CAAC;YACF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK;YACP,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;YACtK,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE;QACtE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;QACtD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC;KAC7B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,WAAW,GAAgB,gBAAgB;IACrG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,yFAAyF;QACzF,GAAG,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE;oBAC7D,WAAW,EAAE,EAAE;oBACf,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;iBACvF,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,WAAW,CAAC,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"network-policies.js","sourceRoot":"","sources":["../../../../src/manifests/network-policies.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,cAAc,EACd,aAAa,EACb,aAAa,EAEb,KAAK,EACL,WAAW,EACX,MAAM,EACN,gBAAgB,EAChB,SAAS,EACT,aAAa,EACb,OAAO,EACP,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,KAAK,EACL,WAAW,EACX,OAAO,EACP,mBAAmB,EACnB,MAAM,EACN,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC9G,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAUvD,+DAA+D;AAC/D,MAAM,OAAO,GAAG,EAAE,qBAAqB,EAAE,SAAS,EAAE,CAAC;AAErD,kDAAkD;AAClD,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,6BAA6B,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAEpG,kDAAkD;AAClD,MAAM,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAe,EAAuB,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;AAEjL,yFAAyF;AACzF,MAAM,iBAAiB,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAE5F,kFAAkF;AAClF,MAAM,KAAK,GAAG,EAAE,4BAA4B,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;AAEpF,wCAAwC;AACxC,MAAM,UAAU,GAAG,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;AAElF,4CAA4C;AAC5C,MAAM,WAAW,GAA8B;IAC7C,EAAE,EAAE,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACnH,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;CACtE,CAAC;AAEF,2EAA2E;AAC3E,SAAS,MAAM,CAAC,IAAY,EAAE,SAAiB,EAAE,SAAiB,EAAE,IAAuB;IACzF,OAAO,EAAE,UAAU,EAAE,sBAAsB,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AACvI,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAqB,EAAE,WAAwB;IACtE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;IACzC,MAAM,SAAS,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrC,OAAO;QACL,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACrG,MAAM,CAAC,mBAAmB,EAAE,SAAS,EAAE,SAAS,EAAE;YAChD,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YACrC,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;SACxE,CAAC;QACF,MAAM,CAAC,qBAAqB,EAAE,SAAS,EAAE,SAAS,EAAE;YAClD,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE;YACrC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;SAC9F,CAAC;QACF,MAAM,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE;YAC5C,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,GAAG,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,EAAE;YAC3E,WAAW,EAAE,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;SAClF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,4HAA4H;AAC5H,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;AAEjG,2DAA2D;AAC3D,MAAM,MAAM,GAAG,CAAC,SAAiB,EAAuB,EAAE,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AAEvK;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,EAAE,SAAS,EAAe;IAC9C,OAAO;QACL,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;YAC/C,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,EAAE;YACtJ,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;SAC/D,CAAC;QACF,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;YACvD,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,cAAc,CAAC,EAAE;YAC5D,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE;gBAC1G,iEAAiE;gBACjE,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChH;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;QAC5D,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE;QAC1D,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE;oBACJ,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC1D,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE;iBACjG;gBACD,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;aAC/C,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,MAAqB;IAChD,MAAM,MAAM,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAClJ,OAAO,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE;QAC/D,WAAW,EAAE,EAAE,WAAW,EAAE,EAAE,4BAA4B,EAAE,OAAO,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,GAAG,EAAE,6BAA6B,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE;QACnK,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrF,KAAK,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;aACvF,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,wBAAwB,CAAC,MAAqB;IACrD,MAAM,eAAe,GAAG,EAAE,WAAW,EAAE,EAAE,6BAA6B,EAAE,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC;IAClH,MAAM,OAAO,GAA0B;QACrC,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,EAAE;QACtF,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,EAAE;QAC3F,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE;QACrF,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,gBAAgB,EAAE;QACrE,EAAE,iBAAiB,EAAE,EAAE,WAAW,EAAE,EAAE,6BAA6B,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE;KAClI,CAAC;IACF,OAAO;QACL,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE;YACnD,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;YACtD,WAAW,EAAE,CAAC,SAAS,CAAC;YACxB,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;gBAClE,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;aAC3H;SACF,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO;YACpC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;oBACvE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE;oBACzD,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;iBACxI,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,YAAY;IACnB,MAAM,EAAE,GAAG,CAAC,SAAiB,EAAuB,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACrH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAY,EAAE,IAAuB,EAAE,EAAE,CACtF,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;QACjC,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;QACvD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YAC1C,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE;SAC9E;KACF,CAAC,CAAC;IACL,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAC5D,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACvF,IAAI,CAAC,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACpG,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,CAAC;KAChE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,OAAO,EAAE;QACpD,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;QAChE,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE;YACP,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE;YAC7F,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,mBAAmB,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE;YAC7H,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE;SAC5H;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB;IACzB,MAAM,EAAE,GAAG,CAAC,SAAiB,EAAuB,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACrH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAuB,EAAE,EAAE,CAC1E,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE;QACjC,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;QACvD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;KACnF,CAAC,CAAC;IACL,OAAO;QACL,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC;QAC7F,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;KAChF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAqB;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,OAAO,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;QAChE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE;QACzD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE;oBACJ,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAC1D,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9C,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChF,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE;oBAChG,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;iBAC9E;gBACD,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;aACnD,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAiB;IACxE,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3H,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,IAAY,EAAiB,EAAE,CAClE,MAAM,CAAC,aAAa,CAAC,GAAG,SAAS,eAAe,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;QACvE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,SAAS,CAAC,EAAE;QACvD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC;IACL,OAAO;QACL,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;YACrD,GAAG,OAAO;YACV,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM,EAAE;gBACN,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,WAAW;gBACX,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE;gBACxH,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE;gBACvH,0GAA0G;gBAC1G,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,GAAG,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE;aAC1H;SACF,CAAC;QACF,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;QAClC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC;IACjD,MAAM,SAAS,GAAG,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;IAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,WAAW,GAA8B,QAAQ;QACrD,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;QACxJ,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAClE,OAAO;QACL,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE;YAC3D,GAAG,UAAU;YACb,WAAW,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;YAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;YACtI,MAAM,EAAE;gBACN,WAAW;gBACX,WAAW;gBACX,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAChK;SACF,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,OAAO;YACjB,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE;oBACtE,GAAG,SAAS;oBACZ,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;iBAC5E,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAqB,EAAE,WAAwB;IACnE,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,KAAK,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,OAAO,GAAkB;QAC7B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;YACzB,CAAC,CAAC,CAAC;oBACD,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,cAAc,CAAC,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;oBAC5H,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;iBAClE,CAAC;YACF,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK;YACP,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC;YACtK,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE;QACtE,WAAW,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE;QACtD,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,GAAG,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC;KAC7B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAqB,EAAE,WAAW,GAAgB,gBAAgB;IACrG,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC/C,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IAClC,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO;QACL,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,yFAAyF;QACzF,GAAG,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE;oBAC7D,WAAW,EAAE,EAAE;oBACf,WAAW,EAAE,CAAC,SAAS,CAAC;oBACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;iBACvF,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,CAAC,MAAM,EAAE,WAAW,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnI,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;AACJ,CAAC"}

package/dist/cli/src/manifests/node-agent.js

@@ -0,0 +1,107 @@
+import { CONTAINERD, CPU_FEATURES_CONTAINER, GVISOR_RELEASES, NODE_AGENT_PORT, NODE_AGENT_TOKEN_VARIABLE, OPERATION_LIMIT_SECONDS, SNAPSHOT_CACHE_BYTES_VARIABLE, SNAPSHOT_CACHE_DIR, } from "../../../src/node-agent/names.js";
+import { currentGvisorRelease } from "../cluster/node.js";
+import { imageReference } from "../images.js";
+import { componentName, given, imagePullSecrets, labels, NAMESPACE, nodeAgentRuns, otelEnv, selectorLabels } from "./common.js";
+import { priority } from "./priorities.js";
+import { verticalPodAutoscaler } from "./sizing.js";
+/** The Secret of the snapshots bucket, its endpoint, region and name and the agents' keys to it. */
+const SNAPSHOTS_SECRET = componentName("snapshots");
+/** The Secret of the token alasio presents to the node agents, under `token`. */
+const NODE_AGENT_SECRET = componentName("node-agent");
+/** The node's paths the agent has at the same paths: each one's volume, what must be there, and whether the agent only reads it. */
+const HOST_PATHS = [
+    // The shims' runsc root (/run/containerd/runsc) and, where systemd runs the node, its bus.
+    { name: "run", path: "/run", type: "Directory" },
+    { name: "gvisor", path: GVISOR_RELEASES, type: "DirectoryOrCreate", readOnly: true },
+    { name: "containerd", path: CONTAINERD, type: "DirectoryOrCreate", readOnly: true },
+    { name: "snapshots", path: SNAPSHOT_CACHE_DIR, type: "DirectoryOrCreate" },
+];
+/** What each suffix of a size multiplies it by, as Kubernetes counts a quantity. */
+const SIZE_UNITS = { Ki: 2 ** 10, Mi: 2 ** 20, Gi: 2 ** 30, Ti: 2 ** 40, Pi: 2 ** 50, k: 1e3, M: 1e6, G: 1e9, T: 1e12, P: 1e15 };
+/** The bytes of a size as the configuration takes one (5Gi, 1.5G, 500000). */
+function sizeBytes(size) {
+    // A size, as the configuration checks it (config.ts Size).
+    const [, amount = "0", unit = ""] = /^([0-9.]+)([A-Za-z]*)$/u.exec(size) ?? [];
+    return Math.floor(Number(amount) * (SIZE_UNITS[unit] ?? 1));
+}
+/** The node agents' DaemonSet. */
+function daemonSet(config) {
+    const { sessions } = config;
+    const volumes = HOST_PATHS.map(({ name, path, type }) => ({ name, hostPath: { path, type } }));
+    const volumeMounts = HOST_PATHS.map(({ name, path, readOnly }) => ({
+        name,
+        mountPath: path,
+        ...(readOnly ? { readOnly } : {}),
+        // What is mounted under the node's /run after the agent starts is the agent's too.
+        ...(name === "run" ? { mountPropagation: "HostToContainer" } : {}),
+    }));
+    return {
+        apiVersion: "apps/v1",
+        kind: "DaemonSet",
+        metadata: { name: componentName("node-agent"), namespace: NAMESPACE, labels: labels("node-agent") },
+        spec: {
+            selector: { matchLabels: selectorLabels("node-agent") },
+            // A node's agent replaced once the old one is gone, as two would act on one cache, and
+            // one node's at a time, each as long as the old one's operations take to end (below).
+            updateStrategy: { type: "RollingUpdate", rollingUpdate: { maxUnavailable: 1, maxSurge: 0 } },
+            template: {
+                metadata: { labels: labels("node-agent") },
+                spec: {
+                    // A restore waits on it, as a turn does.
+                    ...priority("floor"),
+                    // Stopped, it lets the checkpoints and prepares it runs end, rather than end a
+                    // sandbox unsaved or leave its cache half written (src/node-agent/operations.ts).
+                    terminationGracePeriodSeconds: OPERATION_LIMIT_SECONDS,
+                    hostPID: true,
+                    // It speaks to nothing of the cluster's but alasio, which calls it.
+                    automountServiceAccountToken: false,
+                    enableServiceLinks: false,
+                    ...imagePullSecrets(config),
+                    ...given("nodeSelector", { ...sessions.nodeSelector }),
+                    ...given("tolerations", [...sessions.tolerations]),
+                    // What the node's CPU has under the current release, said in the pod's status
+                    // before the agent starts, for alasio up to hold sessions to (../cpu-baseline.ts).
+                    initContainers: [{
+                            name: CPU_FEATURES_CONTAINER,
+                            image: imageReference(config.images.alasio),
+                            imagePullPolicy: config.images.pullPolicy,
+                            command: ["node", "/opt/alasio/src/node-agent/cpu-features.ts", currentGvisorRelease()],
+                            securityContext: { privileged: true, runAsUser: 0 },
+                            resources: sessions.snapshots.nodeAgent.resources,
+                            volumeMounts: volumeMounts.filter(({ name }) => name !== "snapshots"),
+                        }],
+                    containers: [{
+                            name: "node-agent",
+                            image: imageReference(config.images.alasio),
+                            imagePullPolicy: config.images.pullPolicy,
+                            command: ["node", "/opt/alasio/src/node-agent/main.ts"],
+                            env: [
+                                { name: "NODE_NAME", valueFrom: { fieldRef: { fieldPath: "spec.nodeName" } } },
+                                { name: NODE_AGENT_TOKEN_VARIABLE, valueFrom: { secretKeyRef: { name: NODE_AGENT_SECRET, key: "token" } } },
+                                { name: SNAPSHOT_CACHE_BYTES_VARIABLE, value: String(sizeBytes(sessions.snapshots.nodeCache)) },
+                                ...(otelEnv(config).length > 0 ? [{ name: "OTEL_SERVICE_NAME", value: "alasio-node-agent" }, ...otelEnv(config)] : []),
+                            ],
+                            envFrom: [{ secretRef: { name: SNAPSHOTS_SECRET } }],
+                            ports: [{ name: "api", containerPort: NODE_AGENT_PORT }],
+                            readinessProbe: { httpGet: { path: "/healthz", port: "api" }, periodSeconds: 10 },
+                            securityContext: { privileged: true, runAsUser: 0 },
+                            resources: sessions.snapshots.nodeAgent.resources,
+                            volumeMounts,
+                        }],
+                    volumes,
+                },
+            },
+        },
+    };
+}
+/**
+ * The node agents, where they run, and their sizing: recommended, not applied in place, as
+ * a resize would restart an agent in the middle of a snapshot's upload.
+ */
+export function nodeAgentObjects(config) {
+    if (!nodeAgentRuns(config))
+        return [];
+    const agents = daemonSet(config);
+    return [agents, verticalPodAutoscaler(agents, "Recommended")];
+}
+//# sourceMappingURL=node-agent.js.map

package/dist/cli/src/manifests/node-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-agent.js","sourceRoot":"","sources":["../../../../src/manifests/node-agent.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,uBAAuB,EACvB,6BAA6B,EAC7B,kBAAkB,GACnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEhI,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,oGAAoG;AACpG,MAAM,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;AACpD,iFAAiF;AACjF,MAAM,iBAAiB,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;AAEtD,oIAAoI;AACpI,MAAM,UAAU,GAAiH;IAC/H,2FAA2F;IAC3F,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;IAChD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACpF,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE;IACnF,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,mBAAmB,EAAE;CAC3E,CAAC;AAEF,oFAAoF;AACpF,MAAM,UAAU,GAAqC,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;AAEnK,8EAA8E;AAC9E,SAAS,SAAS,CAAC,IAAY;IAC7B,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,IAAI,GAAG,EAAE,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,kCAAkC;AAClC,SAAS,SAAS,CAAC,MAAqB;IACtC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,MAAM,OAAO,GAAe,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3G,MAAM,YAAY,GAAoB,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI;QACJ,SAAS,EAAE,IAAI;QACf,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,mFAAmF;QACnF,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC,CAAC,CAAC;IACJ,OAAO;QACL,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;QACnG,IAAI,EAAE;YACJ,QAAQ,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,YAAY,CAAC,EAAE;YACvD,uFAAuF;YACvF,sFAAsF;YACtF,cAAc,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,EAAE,cAAc,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE;YAC5F,QAAQ,EAAE;gBACR,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;gBAC1C,IAAI,EAAE;oBACJ,yCAAyC;oBACzC,GAAG,QAAQ,CAAC,OAAO,CAAC;oBACpB,+EAA+E;oBAC/E,kFAAkF;oBAClF,6BAA6B,EAAE,uBAAuB;oBACtD,OAAO,EAAE,IAAI;oBACb,oEAAoE;oBACpE,4BAA4B,EAAE,KAAK;oBACnC,kBAAkB,EAAE,KAAK;oBACzB,GAAG,gBAAgB,CAAC,MAAM,CAAC;oBAC3B,GAAG,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC;oBACtD,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;oBAClD,8EAA8E;oBAC9E,mFAAmF;oBACnF,cAAc,EAAE,CAAC;4BACf,IAAI,EAAE,sBAAsB;4BAC5B,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;4BAC3C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;4BACzC,OAAO,EAAE,CAAC,MAAM,EAAE,4CAA4C,EAAE,oBAAoB,EAAE,CAAC;4BACvF,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;4BACnD,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS;4BACjD,YAAY,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,WAAW,CAAC;yBACtE,CAAC;oBACF,UAAU,EAAE,CAAC;4BACX,IAAI,EAAE,YAAY;4BAClB,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;4BAC3C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;4BACzC,OAAO,EAAE,CAAC,MAAM,EAAE,oCAAoC,CAAC;4BACvD,GAAG,EAAE;gCACH,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,EAAE,EAAE;gCAC9E,EAAE,IAAI,EAAE,yBAAyB,EAAE,SAAS,EAAE,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;gCAC3G,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE;gCAC/F,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;6BACvH;4BACD,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,CAAC;4BACpD,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;4BACxD,cAAc,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE;4BACjF,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE;4BACnD,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS;4BACjD,YAAY;yBACb,CAAC;oBACF,OAAO;iBACR;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,CAAC,MAAM,EAAE,qBAAqB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/cli/src/manifests/object-store.js

@@ -1,6 +1,6 @@
 import { HISTORY_DAYS } from "../../../neon/control/branches.js";
 import { imageReference } from "../images.js";
-import { claimSpec, componentName, labels, NAMESPACE, neonName, replicasOf, restrictedContainer, scaled, script, selectorLabels, stackLabels, stackPodSpec } from "./common.js";
+import { claimSpec, componentName, labels, NAMESPACE, neonName, replicasOf, restrictedContainer, sandboxSnapshots, scaled, script, selectorLabels, stackLabels, stackPodSpec } from "./common.js";
 import { filerStoreMaxmemoryBytes } from "./config.js";
 import { replicaBudget, spread } from "./disruption.js";
 import { priority } from "./priorities.js";
@@ -75,7 +75,7 @@ const WAL_SEGMENT_BYTES = 16 * 1024 * 1024;
  * An operator's store (objectStore.external) is given none of this: its operator gives
  * Neon's bucket these rules.
  */
-const LIFECYCLE = {
+const NEON_LIFECYCLE = {
     Rules: [
         {
             ID: "expire-noncurrent",
@@ -99,6 +99,16 @@ const LIFECYCLE = {
         },
     ],
 };
+/**
+ * The lifecycle rule of the snapshots bucket. A node agent puts a file larger than a
+ * part in parts (src/node-agent/s3.ts), and aborts an upload that fails; one it could not
+ * abort, ended mid-upload, leaves the parts it had sent, which this aborts after a day,
+ * the least S3 allows. An external store is given no rule by alasio: its operator gives
+ * the bucket this one.
+ */
+const SNAPSHOTS_LIFECYCLE = {
+    Rules: [{ ID: "abort-incomplete-uploads", Status: "Enabled", Filter: { Prefix: "" }, AbortIncompleteMultipartUpload: { DaysAfterInitiation: 1 } }],
+};
 /** The address of the pod `ordinal` of the StatefulSet `name`, by its headless Service `service`, at `port`. */
 const podAddress = (name, service, ordinal, port) => `${name}-${ordinal}.${service}.${NAMESPACE}.svc.cluster.local:${port}`;
 /** The addresses of the `count` pods of the StatefulSet `name`, by `service`, at `port`, as SeaweedFS takes a list of them. */
@@ -121,7 +131,7 @@ function headless(name, component, ports) {
         spec: { clusterIP: "None", publishNotReadyAddresses: true, selector: selectorLabels(component), ports: [...ports, { name: "metrics", port: METRICS_PORT }] },
     };
 }
-/** The StatefulSet `name` of `component`, of `scale`, running `containers`, as every part of the store's is: on the floor, as the data stack's user. */
+/** The StatefulSet `name` of `component`, of `scale`, running `containers`, as every part of the store's is: on the floor, above it where its claims hold it to a node, as the data stack's user. */
 function partStatefulSet(config, name, component, scale, pod, storage, { service = name, ordered = false, strictly = false } = {}) {
     return {
         apiVersion: "apps/v1",
@@ -135,7 +145,7 @@ function partStatefulSet(config, name, component, scale, pod, storage, { service
             template: {
                 metadata: { labels: stackLabels(component) },
                 spec: {
-                    ...priority("floor"),
+                    ...priority(storage ? "bound" : "floor"),
                     ...stackPodSpec(config),
                     ...spread(component, scale, strictly),
                     terminationGracePeriodSeconds: 30,
@@ -294,13 +304,20 @@ function filerStoreObjects(config) {
     });
 }
 /**
- * The S3 gateways, on the filers, each making the buckets and Neon's lifecycle rules as
+ * The S3 gateways, on the filers, each making the buckets and their lifecycle rules as
  * it starts, in sidecars, and ready only once they are made.
  */
 function gatewayObjects(config) {
     const { bundled, buckets } = config.objectStore;
     const { scaling } = bundled.gateways;
-    const made = [buckets.neon, buckets.lake, buckets.backups, ...(config.workspaceStorage.enabled ? [buckets.workspaces] : [])];
+    const snapshots = sandboxSnapshots(config);
+    const made = [buckets.neon, buckets.lake, buckets.backups, ...(config.workspaceStorage.enabled ? [buckets.workspaces] : []), ...(snapshots ? [buckets.snapshots] : [])];
+    // Each bucket's rules given as its admin: Neon's as the admin's, the snapshots' as their own
+    // identity's, as nothing else may write that bucket (neon/control/secrets.ts s3Identities).
+    const lifecycles = [
+        { bucket: buckets.neon, rules: NEON_LIFECYCLE, as: "ADMIN" },
+        ...(snapshots ? [{ bucket: buckets.snapshots, rules: SNAPSHOTS_LIFECYCLE, as: "SNAPSHOTS" }] : []),
+    ];
     const image = imageReference(bundled.image);
     const ready = { exec: { command: ["test", "-f", "/tmp/ready"] }, periodSeconds: 5 };
     const service = {
@@ -366,7 +383,7 @@ function gatewayObjects(config) {
                             resources: { requests: { cpu: "10m", memory: "32Mi" }, limits: { memory: "256Mi" } },
                             volumeMounts: [{ name: "shell-tmp", mountPath: "/tmp" }],
                         },
-                        // Gives Neon's bucket its lifecycle rules once it exists.
+                        // Gives each bucket with lifecycle rules its rules once it exists.
                         {
                             name: "lifecycle",
                             image: imageReference(config.neon.image),
@@ -374,10 +391,25 @@ function gatewayObjects(config) {
                             command: [
                                 "/bin/sh",
                                 "-c",
-                                script("set -e", `until aws s3api --endpoint-url http://127.0.0.1:8333 head-bucket --bucket ${buckets.neon} 2>/dev/null; do sleep 2; done`, `aws s3api --endpoint-url http://127.0.0.1:8333 put-bucket-lifecycle-configuration --bucket ${buckets.neon} --lifecycle-configuration '${JSON.stringify(LIFECYCLE)}'`, "touch /tmp/ready", "exec sleep infinity"),
+                                script("set -e", ...lifecycles.flatMap(({ bucket, rules, as }) => {
+                                    const aws = `AWS_ACCESS_KEY_ID="$${as}_KEY_ID" AWS_SECRET_ACCESS_KEY="$${as}_SECRET" aws s3api --endpoint-url http://127.0.0.1:8333`;
+                                    return [
+                                        `until ${aws} head-bucket --bucket ${bucket} 2>/dev/null; do sleep 2; done`,
+                                        `${aws} put-bucket-lifecycle-configuration --bucket ${bucket} --lifecycle-configuration '${JSON.stringify(rules)}'`,
+                                    ];
+                                }), "touch /tmp/ready", "exec sleep infinity"),
+                            ],
+                            env: [
+                                { name: "AWS_DEFAULT_REGION", value: "us-east-1" },
+                                { name: "HOME", value: "/tmp" },
+                                ...lifecycles.flatMap(({ as }) => {
+                                    const secret = as === "ADMIN" ? neonName("s3-admin") : componentName("snapshots");
+                                    return [
+                                        { name: `${as}_KEY_ID`, valueFrom: { secretKeyRef: { name: secret, key: "AWS_ACCESS_KEY_ID" } } },
+                                        { name: `${as}_SECRET`, valueFrom: { secretKeyRef: { name: secret, key: "AWS_SECRET_ACCESS_KEY" } } },
+                                    ];
+                                }),
                             ],
-                            env: [{ name: "AWS_DEFAULT_REGION", value: "us-east-1" }, { name: "HOME", value: "/tmp" }],
-                            envFrom: [{ secretRef: { name: neonName("s3-admin") } }],
                             readinessProbe: ready,
                             securityContext: restrictedContainer(),
                             resources: { requests: { cpu: "10m", memory: "64Mi" }, limits: { memory: "256Mi" } },