From 97aa089f9d43fc35ec56bfd17ee11459c530fe26 Mon Sep 17 00:00:00 2001 From: root Date: Wed, 8 Jul 2026 20:07:46 +0200 Subject: [PATCH] =?UTF-8?q?ci:=20=E6=B7=BB=E5=8A=A0=20NC01=20v0.2=20PaC=20?= =?UTF-8?q?=E6=B5=81=E6=B0=B4=E7=BA=BF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .tekton/agentrun-nc01-v02.yaml | 253 +++++++++++++++++++++++++++++++++ 1 file changed, 253 insertions(+) create mode 100644 .tekton/agentrun-nc01-v02.yaml diff --git a/.tekton/agentrun-nc01-v02.yaml b/.tekton/agentrun-nc01-v02.yaml new file mode 100644 index 0000000..f128d54 --- /dev/null +++ b/.tekton/agentrun-nc01-v02.yaml @@ -0,0 +1,253 @@ +apiVersion: tekton.dev/v1 +kind: PipelineRun +metadata: + name: "agentrun-nc01-v02-ci-{{ revision }}" + namespace: agentrun-ci + annotations: + pipelinesascode.tekton.dev/on-event: "[push]" + pipelinesascode.tekton.dev/on-target-branch: "[v0.2]" + pipelinesascode.tekton.dev/max-keep-runs: "8" + unidesk.ai/ci-source: pipelines-as-code + unidesk.ai/ci-owner: unidesk + unidesk.ai/ci-path: github-pr-gitea-webhook-pac-tekton + unidesk.ai/ci-retry: gitea-public-read + unidesk.ai/generated-from: "config/agentrun.yaml#controlPlane.lanes.nc01-v02" + labels: + app.kubernetes.io/part-of: agentrun + agentrun.pikastech.local/lane: v0.2 + agentrun.pikastech.local/node: NC01 + agentrun.pikastech.local/source-commit: "{{ revision }}" + agentrun.pikastech.local/trigger: pipelines-as-code +spec: + pipelineSpec: + params: + - name: git-url + type: string + default: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git + - name: git-read-url + type: string + default: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git + - name: git-write-url + type: string + default: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git + - name: source-branch + type: string + default: v0.2 + - name: gitops-branch + type: string + default: nc01-v0.2-gitops + - name: revision + type: string + - name: source-stage-ref + type: string + - name: registry-prefix + type: string + default: 127.0.0.1:5000/agentrun + - name: tools-image + type: string + default: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1 + - name: buildkit-image + type: string + default: 127.0.0.1:5000/hwlab/buildkit:rootless + - name: containerfile + type: string + default: deploy/container/Containerfile + - name: context-dir + type: string + default: "." + - name: image-repository + type: string + default: 127.0.0.1:5000/agentrun/agentrun-mgr-env + - name: build-network + type: string + default: host + - name: build-args-json + type: string + default: "[\"BUN_IMAGE=oven/bun:1-alpine\"]" + - name: build-http-proxy + type: string + default: http://127.0.0.1:10808 + - name: build-https-proxy + type: string + default: http://127.0.0.1:10808 + - name: build-no-proxy + type: string + default: "localhost,127.0.0.1,::1,127.0.0.1:5000,localhost:5000,.svc,.svc.cluster.local,.cluster.local,hyueapi.com,.hyueapi.com" + - name: container-http-proxy + type: string + default: http://127.0.0.1:10808 + - name: container-https-proxy + type: string + default: http://127.0.0.1:10808 + - name: container-no-proxy + type: string + default: "localhost,127.0.0.1,::1,127.0.0.1:5000,localhost:5000,.svc,.svc.cluster.local,.cluster.local,hyueapi.com,.hyueapi.com" + - name: env-identity-files-json + type: string + default: "[\"deploy/container/Containerfile\",\"deploy/runtime/boot/agentrun-boot.sh\",\"deploy/runtime/boot/agentrun-mgr.sh\",\"deploy/runtime/boot/agentrun-runner.sh\",\"src\",\"scripts\",\"package.json\",\"bun.lock\",\"tsconfig.json\"]" + - name: gitops-root + type: string + default: deploy/gitops/node/nc01 + - name: artifact-catalog + type: string + default: deploy/artifact-catalog.nc01-v02.json + workspaces: + - name: source + tasks: + - name: build-publish + workspaces: + - name: source + workspace: source + taskSpec: + params: + - name: git-read-url + - name: git-write-url + - name: source-branch + - name: gitops-branch + - name: revision + - name: source-stage-ref + - name: registry-prefix + - name: tools-image + - name: buildkit-image + - name: containerfile + - name: context-dir + - name: image-repository + - name: build-network + - name: build-args-json + - name: build-http-proxy + - name: build-https-proxy + - name: build-no-proxy + - name: container-http-proxy + - name: container-https-proxy + - name: container-no-proxy + - name: env-identity-files-json + - name: gitops-root + - name: artifact-catalog + workspaces: + - name: source + steps: + - name: source-checkout + image: $(params.tools-image) + script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nrm -rf \"$root/repo\"\ngit clone --no-checkout \"$(params.git-read-url)\" \"$root/repo\"\ncd \"$root/repo\"\ngit fetch origin \"+$(params.source-stage-ref):refs/remotes/origin/unidesk-source-snapshot\"\ngit checkout --detach \"$(params.revision)\"\nactual=$(git rev-parse HEAD)\ntest \"$actual\" = \"$(params.revision)\"\nENV_IDENTITY_FILES='$(params.env-identity-files-json)' BUILD_ARGS_JSON='$(params.build-args-json)' CONTAINER_HTTP_PROXY='$(params.container-http-proxy)' CONTAINER_HTTPS_PROXY='$(params.container-https-proxy)' CONTAINER_NO_PROXY='$(params.container-no-proxy)' node <<'NODE' > \"$root/env-identity\"\nconst { createHash } = require('node:crypto');\nconst { existsSync, lstatSync, readdirSync, readFileSync } = require('node:fs');\nconst { join } = require('node:path');\nconst files = JSON.parse(process.env.ENV_IDENTITY_FILES || '[]');\nconst buildArgs = JSON.parse(process.env.BUILD_ARGS_JSON || '[]');\nconst proxy = [`HTTP_PROXY=${process.env.CONTAINER_HTTP_PROXY || ''}`, `HTTPS_PROXY=${process.env.CONTAINER_HTTPS_PROXY || ''}`, `NO_PROXY=${process.env.CONTAINER_NO_PROXY || ''}`];\nconst skip = new Set(['.git', '.worktree', '.state', 'node_modules', 'coverage', 'tmp', '.tmp']);\nconst hash = createHash('sha256');\nfunction collect(input) {\n if (!existsSync(input)) return [{ path: input, missing: true }];\n const stat = lstatSync(input);\n if (stat.isFile()) return [{ path: input, missing: false }];\n if (!stat.isDirectory()) return [{ path: input, missing: true }];\n const out = [];\n const stack = [input];\n while (stack.length) {\n const dir = stack.pop();\n for (const entry of readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {\n if (entry.isDirectory() && skip.has(entry.name)) continue;\n const child = join(dir, entry.name);\n if (entry.isDirectory()) stack.push(child);\n else if (entry.isFile()) out.push({ path: child, missing: false });\n }\n }\n return out.sort((a, b) => a.path.localeCompare(b.path));\n}\nfor (const item of buildArgs) { hash.update('build-arg\\0'); hash.update(item); hash.update('\\0'); }\nfor (const item of proxy) { hash.update('build-container-proxy\\0'); hash.update(item); hash.update('\\0'); }\nfor (const file of files) for (const entry of collect(file)) { hash.update(entry.path); hash.update('\\0'); if (!entry.missing) hash.update(readFileSync(entry.path)); hash.update('\\0'); }\nprocess.stdout.write(hash.digest('hex').slice(0, 24));\nNODE\nBUILD_ARGS='$(params.build-args-json)' node <<'NODE' > \"$root/build-args.txt\"\nconst values = JSON.parse(process.env.BUILD_ARGS || '[]');\nfor (const value of values) console.log(`build-arg:${value}`);\nNODE\nchmod -R a+rwX \"$root\"\nenv_identity=$(cat \"$root/env-identity\")\nprintf '{\"ok\":true,\"phase\":\"source-checkout\",\"sourceCommit\":\"%s\",\"sourceStageRef\":\"%s\",\"envIdentity\":\"%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$(params.source-stage-ref)\" \"$env_identity\"" + - name: probe-env-image + image: $(params.tools-image) + script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nenv_identity=$(cat \"$root/env-identity\")\nimage_repository='$(params.image-repository)'\nmanifest_accept='application/vnd.oci.image.index.v1+json, application/vnd.oci.image.manifest.v1+json, application/vnd.docker.distribution.manifest.v2+json'\nrepo_path=${image_repository#127.0.0.1:5000/}\nheaders=$(mktemp)\ndigest=''\nif curl -fsSI -H \"Accept: $manifest_accept\" \"http://127.0.0.1:5000/v2/$repo_path/manifests/$env_identity\" >\"$headers\"; then\n digest=$(awk -F': ' 'tolower($1)==\"docker-content-digest\"{print $2}' \"$headers\" | tr -d '\\r' | head -n 1)\nfi\nrm -f \"$headers\"\nif [ -n \"$digest\" ]; then\n image=\"$image_repository:$env_identity\"\n printf '{\"ok\":true,\"status\":\"reused\",\"sourceCommit\":\"%s\",\"envIdentity\":\"%s\",\"image\":\"%s\",\"digest\":\"%s\",\"repositoryDigest\":\"%s@%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$env_identity\" \"$image\" \"$digest\" \"$image_repository\" \"$digest\" > \"$root/build-result.json\"\n touch \"$root/skip-build\"\nelse\n printf '{\"ok\":false,\"status\":\"cache-miss\",\"sourceCommit\":\"%s\",\"envIdentity\":\"%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$env_identity\" > \"$root/build-result.json\"\nfi\nchmod a+rw \"$root/build-result.json\"\ncat \"$root/build-result.json\"" + - name: build-env-image + image: $(params.buildkit-image) + env: + - name: BUILDKITD_FLAGS + value: "--oci-worker-no-process-sandbox --oci-worker-net=host --allow-insecure-entitlement network.host" + - name: HTTP_PROXY + value: $(params.build-http-proxy) + - name: http_proxy + value: $(params.build-http-proxy) + - name: HTTPS_PROXY + value: $(params.build-https-proxy) + - name: https_proxy + value: $(params.build-https-proxy) + - name: ALL_PROXY + value: $(params.build-https-proxy) + - name: all_proxy + value: $(params.build-https-proxy) + - name: NO_PROXY + value: $(params.build-no-proxy) + - name: no_proxy + value: $(params.build-no-proxy) + securityContext: + privileged: true + runAsUser: 1000 + runAsGroup: 1000 + script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nif [ -f \"$root/skip-build\" ]; then cat \"$root/build-result.json\"; exit 0; fi\nenv_identity=$(cat \"$root/env-identity\")\nimage_repository='$(params.image-repository)'\nimage=\"$image_repository:$env_identity\"\ncontext_dir='$(params.context-dir)'\nif [ \"$context_dir\" = \".\" ]; then context_path=\"$root/repo\"; else context_path=\"$root/repo/${context_dir#./}\"; fi\nargs=\"build --allow network.host --frontend dockerfile.v0 --local context=$context_path --local dockerfile=$root/repo --opt filename=$(params.containerfile) --opt network=$(params.build-network)\"\nadd_opt() { args=\"$args --opt $1\"; }\nif [ -n '$(params.container-http-proxy)' ]; then add_opt 'build-arg:HTTP_PROXY=$(params.container-http-proxy)'; add_opt 'build-arg:http_proxy=$(params.container-http-proxy)'; fi\nif [ -n '$(params.container-https-proxy)' ]; then add_opt 'build-arg:HTTPS_PROXY=$(params.container-https-proxy)'; add_opt 'build-arg:https_proxy=$(params.container-https-proxy)'; fi\nif [ -n '$(params.container-https-proxy)' ]; then add_opt 'build-arg:ALL_PROXY=$(params.container-https-proxy)'; add_opt 'build-arg:all_proxy=$(params.container-https-proxy)'; elif [ -n '$(params.container-http-proxy)' ]; then add_opt 'build-arg:ALL_PROXY=$(params.container-http-proxy)'; add_opt 'build-arg:all_proxy=$(params.container-http-proxy)'; fi\nif [ -n '$(params.container-no-proxy)' ]; then add_opt 'build-arg:NO_PROXY=$(params.container-no-proxy)'; add_opt 'build-arg:no_proxy=$(params.container-no-proxy)'; fi\nwhile IFS= read -r opt; do [ -n \"$opt\" ] && add_opt \"$opt\"; done < \"$root/build-args.txt\"\nargs=\"$args --metadata-file $root/build-metadata.json --output type=image,name=$image,push=true,registry.insecure=true\"\nbuildctl-daemonless.sh $args\nmetadata_compact=$(tr -d '\\n' < \"$root/build-metadata.json\")\ndigest=$(printf '%s' \"$metadata_compact\" | sed -n 's/.*\"containerimage.digest\"[[:space:]]*:[[:space:]]*\"\\([^\"]*\\)\".*/\\1/p' | head -n 1)\ntest -n \"$digest\"\nprintf '{\"ok\":true,\"status\":\"built\",\"sourceCommit\":\"%s\",\"envIdentity\":\"%s\",\"image\":\"%s\",\"digest\":\"%s\",\"repositoryDigest\":\"%s@%s\",\"valuesPrinted\":false}\\n' \"$(params.revision)\" \"$env_identity\" \"$image\" \"$digest\" \"$image_repository\" \"$digest\" > \"$root/build-result.json\"\ncat \"$root/build-result.json\"" + - name: publish-gitops + image: $(params.tools-image) + env: + - name: GITEA_TOKEN + valueFrom: + secretKeyRef: + name: pac-gitea-agentrun-nc01-v02 + key: token + optional: true + script: "#!/bin/sh\nset -eu\nroot=\"$(workspaces.source.path)\"\nbuild_result=\"$root/build-result.json\"\ntest -s \"$build_result\"\ntemplates_b64=\"W3sicGF0aCI6InNvdXJjZS5qc29uIiwiY29udGVudCI6IntcbiAgXCJsYW5lXCI6IFwidjAuMlwiLFxuICBcInNvdXJjZUNvbW1pdFwiOiBcIl9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9fXCIsXG4gIFwiZ2VuZXJhdGVkQnlcIjogXCJ1bmlkZXNrIGNvbmZpZy9hZ2VudHJ1bi55YW1sXCIsXG4gIFwiY29uZmlnU291cmNlXCI6IFwiY29uZmlnL2FnZW50cnVuLnlhbWxcIlxufVxuIn0seyJwYXRoIjoiZGVwbG95L2FydGlmYWN0LWNhdGFsb2cubmMwMS12MDIuanNvbiIsImNvbnRlbnQiOiJ7XG4gIFwibGFuZVwiOiBcInYwLjJcIixcbiAgXCJzb3VyY2VCcmFuY2hcIjogXCJ2MC4yXCIsXG4gIFwiZ2l0b3BzQnJhbmNoXCI6IFwibmMwMS12MC4yLWdpdG9wc1wiLFxuICBcInNvdXJjZUNvbW1pdElkXCI6IFwiX19BR0VOVFJVTl9TT1VSQ0VfQ09NTUlUX19cIixcbiAgXCJzdW1tYXJ5XCI6IFwiYnVpbGQ9MSByZXVzZT0wIHBsYWNlaG9sZGVyPTBcIixcbiAgXCJzZXJ2aWNlc1wiOiBbXG4gICAge1xuICAgICAgXCJzZXJ2aWNlSWRcIjogXCJhZ2VudHJ1bi1tZ3JcIixcbiAgICAgIFwiYXJ0aWZhY3RLaW5kXCI6IFwiZW52LXJldXNlXCIsXG4gICAgICBcInN0YXR1c1wiOiBcIl9fQUdFTlRSVU5fSU1BR0VfU1RBVFVTX19cIixcbiAgICAgIFwiaW1hZ2VcIjogXCIxMjcuMC4wLjE6NTAwMC9hZ2VudHJ1bi9hZ2VudHJ1bi1tZ3ItZW52Ol9fQUdFTlRSVU5fRU5WX0lERU5USVRZX19cIixcbiAgICAgIFwiZGlnZXN0XCI6IFwic2hhMjU2OmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFcIixcbiAgICAgIFwicmVwb3NpdG9yeURpZ2VzdFwiOiBcIjEyNy4wLjAuMTo1MDAwL2FnZW50cnVuL2FnZW50cnVuLW1nci1lbnZAc2hhMjU2OmFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFcIixcbiAgICAgIFwiaW1hZ2VUYWdcIjogXCJfX0FHRU5UUlVOX0VOVl9JREVOVElUWV9fXCIsXG4gICAgICBcImVudklkZW50aXR5XCI6IFwiX19BR0VOVFJVTl9FTlZfSURFTlRJVFlfX1wiLFxuICAgICAgXCJlbnZJbWFnZVwiOiBcIjEyNy4wLjAuMTo1MDAwL2FnZW50cnVuL2FnZW50cnVuLW1nci1lbnY6X19BR0VOVFJVTl9FTlZfSURFTlRJVFlfX1wiLFxuICAgICAgXCJlbnZEaWdlc3RcIjogXCJzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYVwiLFxuICAgICAgXCJlbnZSZXBvc2l0b3J5RGlnZXN0XCI6IFwiMTI3LjAuMC4xOjUwMDAvYWdlbnRydW4vYWdlbnRydW4tbWdyLWVudkBzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYVwiLFxuICAgICAgXCJib290Q29tbWl0XCI6IFwiX19BR0VOVFJVTl9TT1VSQ0VfQ09NTUlUX19cIixcbiAgICAgIFwiYm9vdFNjcmlwdFwiOiBcImRlcGxveS9ydW50aW1lL2Jvb3QvYWdlbnRydW4tYm9vdC5zaFwiLFxuICAgICAgXCJwcm92ZW5hbmNlXCI6IHtcbiAgICAgICAgXCJzb3VyY2VDb21taXRJZFwiOiBcIl9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9fXCIsXG4gICAgICAgIFwic291cmNlXCI6IFwidW5pZGVzay15YW1sLW9ubHlcIixcbiAgICAgICAgXCJjb25maWdTb3VyY2VcIjogXCJjb25maWcvYWdlbnRydW4ueWFtbFwiLFxuICAgICAgICBcInZhbHVlc1ByaW50ZWRcIjogZmFsc2VcbiAgICAgIH1cbiAgICB9XG4gIF1cbn1cbiJ9LHsicGF0aCI6ImRlcGxveS9naXRvcHMvbm9kZS9uYzAxL2FyZ29jZC9wcm9qZWN0LnlhbWwiLCJjb250ZW50Ijoie2FwaVZlcnNpb246IGFyZ29wcm9qLmlvL3YxYWxwaGExLGtpbmQ6IEFwcFByb2plY3QsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMixuYW1lc3BhY2U6IGFyZ29jZCxsYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBhZ2VudHJ1bixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbGFuZTogdjAuMixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbm9kZTogTkMwMX19LHNwZWM6IHtkZXNjcmlwdGlvbjogQWdlbnRSdW4gdjAuMiBHaXRPcHMgbGFuZSxzb3VyY2VSZXBvczogW2h0dHA6Ly9naXQtbWlycm9yLWh0dHAuZGV2b3BzLWluZnJhLnN2Yy5jbHVzdGVyLmxvY2FsOjgwODAvcGlrYXNUZWNoL2FnZW50cnVuLmdpdCxodHRwOi8vZ2l0ZWEtaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6MzAwMC9taXJyb3JzL3Bpa2FzVGVjaC1hZ2VudHJ1bi5naXRdLGRlc3RpbmF0aW9uczogW3tzZXJ2ZXI6IGh0dHBzOi8va3ViZXJuZXRlcy5kZWZhdWx0LnN2YyxuYW1lc3BhY2U6IGFnZW50cnVuLXYwMn1dLGNsdXN0ZXJSZXNvdXJjZVdoaXRlbGlzdDogW3tncm91cDogXCJcIixraW5kOiBOYW1lc3BhY2V9XSxuYW1lc3BhY2VSZXNvdXJjZVdoaXRlbGlzdDogW3tncm91cDogXCIqXCIsa2luZDogXCIqXCJ9XX19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9hcmdvY2QvYXBwbGljYXRpb24tdjAyLnlhbWwiLCJjb250ZW50Ijoie2FwaVZlcnNpb246IGFyZ29wcm9qLmlvL3YxYWxwaGExLGtpbmQ6IEFwcGxpY2F0aW9uLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDIsbmFtZXNwYWNlOiBhcmdvY2QsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzcGVjOiB7cHJvamVjdDogYWdlbnRydW4tbmMwMS12MDIsc291cmNlOiB7cmVwb1VSTDogaHR0cDovL2dpdC1taXJyb3ItaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6ODA4MC9waWthc1RlY2gvYWdlbnRydW4uZ2l0LHRhcmdldFJldmlzaW9uOiBuYzAxLXYwLjItZ2l0b3BzLHBhdGg6IGRlcGxveS9naXRvcHMvbm9kZS9uYzAxL3J1bnRpbWUtdjAyfSxkZXN0aW5hdGlvbjoge3NlcnZlcjogaHR0cHM6Ly9rdWJlcm5ldGVzLmRlZmF1bHQuc3ZjLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyfSxzeW5jUG9saWN5OiB7YXV0b21hdGVkOiB7cHJ1bmU6IGZhbHNlLHNlbGZIZWFsOiB0cnVlfSxzeW5jT3B0aW9uczogW0NyZWF0ZU5hbWVzcGFjZT10cnVlLEFwcGx5T3V0T2ZTeW5jT25seT10cnVlXX19fVxuIn0seyJwYXRoIjoiZGVwbG95L2dpdG9wcy9ub2RlL25jMDEvcnVudGltZS12MDIva3VzdG9taXphdGlvbi55YW1sIiwiY29udGVudCI6InthcGlWZXJzaW9uOiBrdXN0b21pemUuY29uZmlnLms4cy5pby92MWJldGExLGtpbmQ6IEt1c3RvbWl6YXRpb24scmVzb3VyY2VzOiBbbmFtZXNwYWNlLnlhbWwsbWdyLnlhbWwscnVubmVyLXJiYWMueWFtbF19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9ydW50aW1lLXYwMi9uYW1lc3BhY2UueWFtbCIsImNvbnRlbnQiOiJ7YXBpVmVyc2lvbjogdjEsa2luZDogTmFtZXNwYWNlLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX19XG4ifSx7InBhdGgiOiJkZXBsb3kvZ2l0b3BzL25vZGUvbmMwMS9ydW50aW1lLXYwMi9tZ3IueWFtbCIsImNvbnRlbnQiOiJ7YXBpVmVyc2lvbjogdjEsa2luZDogU2VydmljZUFjY291bnQsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3IsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fX1cbi0tLVxue2FwaVZlcnNpb246IHYxLGtpbmQ6IFNlcnZpY2UsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1tZ3IsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzcGVjOiB7c2VsZWN0b3I6IHthcHAua3ViZXJuZXRlcy5pby9uYW1lOiBhZ2VudHJ1bi1tZ3J9LHBvcnRzOiBbe25hbWU6IGh0dHAscG9ydDogODA4MCx0YXJnZXRQb3J0OiBodHRwfV19fVxuLS0tXG57YXBpVmVyc2lvbjogYXBwcy92MSxraW5kOiBEZXBsb3ltZW50LG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbWdyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0sc3BlYzoge3JlcGxpY2FzOiAxLHNlbGVjdG9yOiB7bWF0Y2hMYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9uYW1lOiBhZ2VudHJ1bi1tZ3J9fSx0ZW1wbGF0ZToge21ldGFkYXRhOiB7bGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDEsYXBwLmt1YmVybmV0ZXMuaW8vbmFtZTogYWdlbnRydW4tbWdyfSxhbm5vdGF0aW9uczoge2FnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9zb3VyY2UtY29tbWl0OiBfX0FHRU5UUlVOX1NPVVJDRV9DT01NSVRfXyxhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvZW52LWlkZW50aXR5OiBfX0FHRU5UUlVOX0VOVl9JREVOVElUWV9ffX0sc3BlYzoge3NlcnZpY2VBY2NvdW50TmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLGNvbnRhaW5lcnM6IFt7bmFtZTogbWdyLGltYWdlOiAxMjcuMC4wLjE6NTAwMC9hZ2VudHJ1bi9hZ2VudHJ1bi1tZ3ItZW52QHNoYTI1NjphYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhLGltYWdlUHVsbFBvbGljeTogSWZOb3RQcmVzZW50LHBvcnRzOiBbe25hbWU6IGh0dHAsY29udGFpbmVyUG9ydDogODA4MH1dLGVudjogW3tuYW1lOiBBR0VOVFJVTl9MQU5FLHZhbHVlOiB2MC4yfSx7bmFtZTogREFUQUJBU0VfVVJMLHZhbHVlRnJvbToge3NlY3JldEtleVJlZjoge25hbWU6IGFnZW50cnVuLXYwMi1tZ3ItZGIsa2V5OiBEQVRBQkFTRV9VUkx9fX0se25hbWU6IEFHRU5UUlVOX1NPVVJDRV9DT01NSVQsdmFsdWU6IF9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9ffSx7bmFtZTogQUdFTlRSVU5fQk9PVF9DT01NSVQsdmFsdWU6IF9fQUdFTlRSVU5fU09VUkNFX0NPTU1JVF9ffSx7bmFtZTogQUdFTlRSVU5fQk9PVF9NT0RFLHZhbHVlOiBtZ3J9LHtuYW1lOiBBR0VOVFJVTl9CT09UX1JFUE9fVVJMLHZhbHVlOiBodHRwOi8vZ2l0ZWEtaHR0cC5kZXZvcHMtaW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6MzAwMC9taXJyb3JzL3Bpa2FzVGVjaC1hZ2VudHJ1bi5naXR9LHtuYW1lOiBBR0VOVFJVTl9FTlZfSURFTlRJVFksdmFsdWU6IF9fQUdFTlRSVU5fRU5WX0lERU5USVRZX199LHtuYW1lOiBBR0VOVFJVTl9SVU5USU1FX05BTUVTUEFDRSx2YWx1ZTogYWdlbnRydW4tdjAyfSx7bmFtZTogQUdFTlRSVU5fSU5URVJOQUxfTUdSX1VSTCx2YWx1ZTogaHR0cDovL2FnZW50cnVuLW1nci5hZ2VudHJ1bi12MDIuc3ZjLmNsdXN0ZXIubG9jYWw6ODA4MH0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9JTUFHRSx2YWx1ZTogMTI3LjAuMC4xOjUwMDAvYWdlbnRydW4vYWdlbnRydW4tbWdyLWVudkBzaGEyNTY6YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYX0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9TRVJWSUNFX0FDQ09VTlQsdmFsdWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lcn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9KT0JfTkFNRV9QUkVGSVgsdmFsdWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lcn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9JRExFX1RJTUVPVVRfTVMsdmFsdWU6IFwiNjAwMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9CQUNLRU5EX1JFVFJZX01BWF9BVFRFTVBUUyx2YWx1ZTogXCI1XCJ9LHtuYW1lOiBBR0VOVFJVTl9CQUNLRU5EX1JFVFJZX0lOSVRJQUxfQkFDS09GRl9NUyx2YWx1ZTogXCIxMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9CQUNLRU5EX1JFVFJZX01BWF9CQUNLT0ZGX01TLHZhbHVlOiBcIjMwMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfUkVURU5USU9OX01BWF9SVU5ORVJTLHZhbHVlOiBcIjNcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fQ0xFQU5VUF9PUkRFUix2YWx1ZTogb2xkZXN0LWluYWN0aXZlLWxhc3QtYWN0aXZlLWZpcnN0fSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX1JFVEVOVElPTl9BQ1RJVkVfSEVBUlRCRUFUX01BWF9BR0VfTVMsdmFsdWU6IFwiOTAwMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfUkVURU5USU9OX01BVENIX0xBQkVMU19KU09OLHZhbHVlOiBcIntcXFwiYXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZlxcXCI6XFxcImFnZW50cnVuXFxcIixcXFwiYXBwLmt1YmVybmV0ZXMuaW8vbmFtZVxcXCI6XFxcImFnZW50cnVuLXJ1bm5lclxcXCIsXFxcImFwcC5rdWJlcm5ldGVzLmlvL2NvbXBvbmVudFxcXCI6XFxcInJ1bm5lclxcXCJ9XCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfUkVURU5USU9OX0pPQl9OQU1FX1BSRUZJWEVTLHZhbHVlOiBcImFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lcixhZ2VudHJ1bi12MDItcnVubmVyLGFnZW50cnVuLXYwMS1ydW5uZXJcIn0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9SRVRFTlRJT05fQUdFX0JBU0VEX0NMRUFOVVBfRU5BQkxFRCx2YWx1ZTogXCJmYWxzZVwifSx7bmFtZTogQUdFTlRSVU5fUlVOTkVSX1JFVEVOVElPTl9BR0VfQkFTRURfTUFYX0FHRV9IT1VSUyx2YWx1ZTogXCI0OFwifSx7bmFtZTogQUdFTlRSVU5fQ0FOQ0VMX0RFTElWRVJZX01PREUsdmFsdWU6IG1hbmFnZXItZXBvY2h9LHtuYW1lOiBBR0VOVFJVTl9DQU5DRUxfR1JBQ0VGVUxfQUJPUlRfTVMsdmFsdWU6IFwiMTUwMDBcIn0se25hbWU6IEFHRU5UUlVOX0NBTkNFTF9LSUxMX0VTQ0FMQVRJT05fTVMsdmFsdWU6IFwiMzAwMDBcIn0se25hbWU6IEFHRU5UUlVOX0NBTkNFTF9TVEFMRV9IRUFSVEJFQVRfRkVOQ0lOR19NUyx2YWx1ZTogXCI5MDAwMDBcIn0se25hbWU6IEFHRU5UUlVOX0NBTkNFTF9MQVRFX1dSSVRFX0ZFTkNJTkdfRU5BQkxFRCx2YWx1ZTogXCJ0cnVlXCJ9LHtuYW1lOiBBR0VOVFJVTl9DQU5DRUxfRVZFTlRfU1RBR0VTLHZhbHVlOiBcImFjY2VwdGVkLHBlcnNpc3RlZCxkZWxpdmVyZWQsYWJvcnRpbmcsdGVybWluYWxpemVkLGZlbmNlZCxsYXRlLXdyaXRlLXJlamVjdGVkXCJ9LHtuYW1lOiBBR0VOVFJVTl9SVU5ORVJfRUdSRVNTX1BST1hZX1VSTCx2YWx1ZTogaHR0cDovLzEyNy4wLjAuMToxMDgwOH0se25hbWU6IEFHRU5UUlVOX1JVTk5FUl9OT19QUk9YWV9FWFRSQSx2YWx1ZTogXCJsb2NhbGhvc3QsMTI3LjAuMC4xLDo6MSwuc3ZjLC5zdmMuY2x1c3Rlci5sb2NhbCwuY2x1c3Rlci5sb2NhbCxoeXVlYXBpLmNvbSwuaHl1ZWFwaS5jb21cIn0se25hbWU6IEFHRU5UUlVOX0FQSV9LRVksdmFsdWVGcm9tOiB7c2VjcmV0S2V5UmVmOiB7bmFtZTogYWdlbnRydW4tdjAyLWFwaS1rZXksa2V5OiBIV0xBQl9BUElfS0VZfX19LHtuYW1lOiBBR0VOVFJVTl9NQU5BR0VSX1JFQ09OQ0lMRVJfQkFUQ0hfU0laRSx2YWx1ZTogXCIyMFwifSx7bmFtZTogQUdFTlRSVU5fTUFOQUdFUl9SRUNPTkNJTEVSX0VOQUJMRUQsdmFsdWU6IFwidHJ1ZVwifSx7bmFtZTogQUdFTlRSVU5fTUFOQUdFUl9SRUNPTkNJTEVSX0lOVEVSVkFMX01TLHZhbHVlOiBcIjMwMDAwXCJ9LHtuYW1lOiBBR0VOVFJVTl9QT1NUR1JFU19QT09MX01BWCx2YWx1ZTogXCI0XCJ9LHtuYW1lOiBIV0xBQl9SVU5USU1FX0xBTkUsdmFsdWU6IHYwLjN9LHtuYW1lOiBPVEVMX0VYUE9SVEVSX09UTFBfVFJBQ0VTX0VORFBPSU5ULHZhbHVlOiBodHRwOi8vb3RlbC1jb2xsZWN0b3IucGxhdGZvcm0taW5mcmEuc3ZjLmNsdXN0ZXIubG9jYWw6NDMxOC92MS90cmFjZXN9LHtuYW1lOiBPVEVMX1NFUlZJQ0VfTkFNRSx2YWx1ZTogYWdlbnRydW4tbWFuYWdlcn0se25hbWU6IFVOSURFU0tfTk9ERV9JRCx2YWx1ZTogTkMwMX0se25hbWU6IFVOSURFU0tfTUFJTl9TRVJWRVJfSVAsdmFsdWU6IDE1Mi41My4yMjkuMTQ4fV0scmVhZGluZXNzUHJvYmU6IHtodHRwR2V0OiB7cGF0aDogL2hlYWx0aC9yZWFkaW5lc3MscG9ydDogaHR0cH0sdGltZW91dFNlY29uZHM6IDJ9LGxpdmVuZXNzUHJvYmU6IHtodHRwR2V0OiB7cGF0aDogL2hlYWx0aC9saXZlLHBvcnQ6IGh0dHB9LHRpbWVvdXRTZWNvbmRzOiAyfSxzdGFydHVwUHJvYmU6IHtodHRwR2V0OiB7cGF0aDogL2hlYWx0aC9saXZlLHBvcnQ6IGh0dHB9LHBlcmlvZFNlY29uZHM6IDEwLHRpbWVvdXRTZWNvbmRzOiAyLGZhaWx1cmVUaHJlc2hvbGQ6IDkwfSxyZXNvdXJjZXM6IHtyZXF1ZXN0czoge2NwdTogMTAwbSxtZW1vcnk6IDI1Nk1pfSxsaW1pdHM6IHtjcHU6IDgwMG0sbWVtb3J5OiAxR2l9fX1dfX19fVxuLS0tXG57YXBpVmVyc2lvbjogcmJhYy5hdXRob3JpemF0aW9uLms4cy5pby92MSxraW5kOiBSb2xlLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLXJ1bm5lci1qb2ItY29udHJvbGxlcixuYW1lc3BhY2U6IGFnZW50cnVuLXYwMixsYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBhZ2VudHJ1bixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbGFuZTogdjAuMixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbm9kZTogTkMwMX19LHJ1bGVzOiBbe2FwaUdyb3VwczogW2JhdGNoXSxyZXNvdXJjZXM6IFtqb2JzXSx2ZXJiczogW2NyZWF0ZSxkZWxldGUsZ2V0LGxpc3Qsd2F0Y2hdfSx7YXBpR3JvdXBzOiBbXCJcIl0scmVzb3VyY2VzOiBbcG9kc10sdmVyYnM6IFtkZWxldGUsZ2V0LGxpc3Qsd2F0Y2hdfSx7YXBpR3JvdXBzOiBbXCJcIl0scmVzb3VyY2VzOiBbcGVyc2lzdGVudHZvbHVtZWNsYWltc10sdmVyYnM6IFtjcmVhdGUsZ2V0LGxpc3Qsd2F0Y2gsZGVsZXRlXX1dfVxuLS0tXG57YXBpVmVyc2lvbjogcmJhYy5hdXRob3JpemF0aW9uLms4cy5pby92MSxraW5kOiBSb2xlQmluZGluZyxtZXRhZGF0YToge25hbWU6IGFnZW50cnVuLW5jMDEtdjAyLW1nci1ydW5uZXItam9iLWNvbnRyb2xsZXIsbmFtZXNwYWNlOiBhZ2VudHJ1bi12MDIsbGFiZWxzOiB7YXBwLmt1YmVybmV0ZXMuaW8vcGFydC1vZjogYWdlbnRydW4sYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL2xhbmU6IHYwLjIsYWdlbnRydW4ucGlrYXN0ZWNoLmxvY2FsL25vZGU6IE5DMDF9fSxzdWJqZWN0czogW3traW5kOiBTZXJ2aWNlQWNjb3VudCxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3J9XSxyb2xlUmVmOiB7YXBpR3JvdXA6IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8sa2luZDogUm9sZSxuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1tZ3ItcnVubmVyLWpvYi1jb250cm9sbGVyfX1cbi0tLVxue2FwaVZlcnNpb246IHJiYWMuYXV0aG9yaXphdGlvbi5rOHMuaW8vdjEsa2luZDogUm9sZSxtZXRhZGF0YToge25hbWU6IGFnZW50cnVuLW5jMDEtdjAyLW1nci1wcm92aWRlci1zZWNyZXQtbWFuYWdlcixuYW1lc3BhY2U6IGFnZW50cnVuLXYwMixsYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBhZ2VudHJ1bixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbGFuZTogdjAuMixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbm9kZTogTkMwMX19LHJ1bGVzOiBbe2FwaUdyb3VwczogW1wiXCJdLHJlc291cmNlczogW3NlY3JldHNdLHZlcmJzOiBbY3JlYXRlLGRlbGV0ZSxnZXQsbGlzdCxwYXRjaCx1cGRhdGVdfV19XG4tLS1cbnthcGlWZXJzaW9uOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvL3YxLGtpbmQ6IFJvbGVCaW5kaW5nLG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLXByb3ZpZGVyLXNlY3JldC1tYW5hZ2VyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0sc3ViamVjdHM6IFt7a2luZDogU2VydmljZUFjY291bnQsbmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyfV0scm9sZVJlZjoge2FwaUdyb3VwOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvLGtpbmQ6IFJvbGUsbmFtZTogYWdlbnRydW4tbmMwMS12MDItbWdyLXByb3ZpZGVyLXNlY3JldC1tYW5hZ2VyfX1cbiJ9LHsicGF0aCI6ImRlcGxveS9naXRvcHMvbm9kZS9uYzAxL3J1bnRpbWUtdjAyL3J1bm5lci1yYmFjLnlhbWwiLCJjb250ZW50Ijoie2FwaVZlcnNpb246IHYxLGtpbmQ6IFNlcnZpY2VBY2NvdW50LG1ldGFkYXRhOiB7bmFtZTogYWdlbnRydW4tbmMwMS12MDItcnVubmVyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX19XG4tLS1cbnthcGlWZXJzaW9uOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvL3YxLGtpbmQ6IFJvbGUsbWV0YWRhdGE6IHtuYW1lOiBhZ2VudHJ1bi1uYzAxLXYwMi1ydW5uZXItc2VjcmV0LXJlYWRlcixuYW1lc3BhY2U6IGFnZW50cnVuLXYwMixsYWJlbHM6IHthcHAua3ViZXJuZXRlcy5pby9wYXJ0LW9mOiBhZ2VudHJ1bixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbGFuZTogdjAuMixhZ2VudHJ1bi5waWthc3RlY2gubG9jYWwvbm9kZTogTkMwMX19LHJ1bGVzOiBbe2FwaUdyb3VwczogW1wiXCJdLHJlc291cmNlczogW3NlY3JldHNdLHZlcmJzOiBbZ2V0XX1dfVxuLS0tXG57YXBpVmVyc2lvbjogcmJhYy5hdXRob3JpemF0aW9uLms4cy5pby92MSxraW5kOiBSb2xlQmluZGluZyxtZXRhZGF0YToge25hbWU6IGFnZW50cnVuLW5jMDEtdjAyLXJ1bm5lci1zZWNyZXQtcmVhZGVyLG5hbWVzcGFjZTogYWdlbnRydW4tdjAyLGxhYmVsczoge2FwcC5rdWJlcm5ldGVzLmlvL3BhcnQtb2Y6IGFnZW50cnVuLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9sYW5lOiB2MC4yLGFnZW50cnVuLnBpa2FzdGVjaC5sb2NhbC9ub2RlOiBOQzAxfX0sc3ViamVjdHM6IFt7a2luZDogU2VydmljZUFjY291bnQsbmFtZTogYWdlbnRydW4tbmMwMS12MDItcnVubmVyfV0scm9sZVJlZjoge2FwaUdyb3VwOiByYmFjLmF1dGhvcml6YXRpb24uazhzLmlvLGtpbmQ6IFJvbGUsbmFtZTogYWdlbnRydW4tbmMwMS12MDItcnVubmVyLXNlY3JldC1yZWFkZXJ9fVxuIn1d\"\ngit_write_url='$(params.git-write-url)'\ngit_auth_url=\"$git_write_url\"\nif printf '%s' \"$git_write_url\" | grep -q '^http://gitea-http\\.'; then\n test -n \"${GITEA_TOKEN:-}\"\n git_auth_url=$(printf '%s' \"$git_write_url\" | sed \"s#^http://#http://x-access-token:${GITEA_TOKEN}@#\")\nfi\nrm -rf \"$root/gitops\"\ngit clone \"$git_auth_url\" \"$root/gitops\"\ncd \"$root/gitops\"\ngit fetch origin \"$(params.gitops-branch)\" || true\nif git rev-parse --verify \"refs/remotes/origin/$(params.gitops-branch)^{commit}\" >/dev/null 2>&1; then git checkout -B \"$(params.gitops-branch)\" \"refs/remotes/origin/$(params.gitops-branch)\"; else git checkout --orphan \"$(params.gitops-branch)\"; git rm -rf . >/dev/null 2>&1 || true; fi\ngit rm -rf --ignore-unmatch \"$(params.gitops-root)\" \"$(params.artifact-catalog)\" source.json >/dev/null 2>&1 || true\nrm -rf \"$(params.gitops-root)\" \"$(params.artifact-catalog)\" source.json\nTEMPLATES_B64=\"$templates_b64\" BUILD_RESULT=\"$build_result\" node <<'NODE'\nconst { mkdirSync, readFileSync, writeFileSync } = require('node:fs');\nconst { dirname } = require('node:path');\nconst templates = JSON.parse(Buffer.from(process.env.TEMPLATES_B64, 'base64').toString('utf8'));\nconst build = JSON.parse(readFileSync(process.env.BUILD_RESULT, 'utf8'));\nconst replacements = new Map([\n ['__AGENTRUN_SOURCE_COMMIT__', build.sourceCommit],\n ['__AGENTRUN_ENV_IDENTITY__', build.envIdentity],\n ['sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa', build.digest],\n ['__AGENTRUN_IMAGE_STATUS__', build.status],\n]);\nfor (const file of templates) {\n let content = file.content;\n for (const [from, to] of replacements) content = content.split(from).join(to);\n mkdirSync(dirname(file.path), { recursive: true });\n writeFileSync(file.path, content);\n}\nNODE\ngit add source.json \"$(params.artifact-catalog)\" \"$(params.gitops-root)\"\nif git diff --quiet --cached; then changed=false; else changed=true; git -c user.email=agentrun@unidesk.local -c user.name='UniDesk AgentRun PaC' commit -m \"deploy: render AgentRun $(params.gitops-branch) from PaC\"; fi\ngit remote set-url origin \"$git_auth_url\"\ngit push -u origin \"$(params.gitops-branch)\"\ngitops_commit=$(git rev-parse HEAD)\nBUILD_RESULT=\"$build_result\" CHANGED=\"$changed\" GITOPS_COMMIT=\"$gitops_commit\" node <<'NODE'\nconst { readFileSync } = require('node:fs');\nconst build = JSON.parse(readFileSync(process.env.BUILD_RESULT, 'utf8'));\nconsole.log(JSON.stringify({ ok: true, status: 'succeeded', phase: 'gitops-publish', changed: process.env.CHANGED === 'true', gitopsCommit: process.env.GITOPS_COMMIT, sourceCommit: build.sourceCommit, envIdentity: build.envIdentity, imageStatus: build.status, digest: build.digest, valuesPrinted: false }));\nNODE" + params: + - name: git-read-url + value: $(params.git-read-url) + - name: git-write-url + value: $(params.git-write-url) + - name: source-branch + value: $(params.source-branch) + - name: gitops-branch + value: $(params.gitops-branch) + - name: revision + value: $(params.revision) + - name: source-stage-ref + value: $(params.source-stage-ref) + - name: registry-prefix + value: $(params.registry-prefix) + - name: tools-image + value: $(params.tools-image) + - name: buildkit-image + value: $(params.buildkit-image) + - name: containerfile + value: $(params.containerfile) + - name: context-dir + value: $(params.context-dir) + - name: image-repository + value: $(params.image-repository) + - name: build-network + value: $(params.build-network) + - name: build-args-json + value: $(params.build-args-json) + - name: build-http-proxy + value: $(params.build-http-proxy) + - name: build-https-proxy + value: $(params.build-https-proxy) + - name: build-no-proxy + value: $(params.build-no-proxy) + - name: container-http-proxy + value: $(params.container-http-proxy) + - name: container-https-proxy + value: $(params.container-https-proxy) + - name: container-no-proxy + value: $(params.container-no-proxy) + - name: env-identity-files-json + value: $(params.env-identity-files-json) + - name: gitops-root + value: $(params.gitops-root) + - name: artifact-catalog + value: $(params.artifact-catalog) + when: + - input: unidesk-yaml-only + operator: in + values: + - unidesk-yaml-only + taskRunTemplate: + serviceAccountName: "{{ service_account }}" + podTemplate: + hostNetwork: true + dnsPolicy: ClusterFirstWithHostNet + securityContext: + fsGroup: 1000 + params: + - name: git-url + value: "{{ repo_url }}" + - name: git-read-url + value: "{{ git_read_url }}" + - name: git-write-url + value: "{{ git_write_url }}" + - name: source-branch + value: "{{ source_branch }}" + - name: gitops-branch + value: "{{ gitops_branch }}" + - name: revision + value: "{{ revision }}" + - name: source-stage-ref + value: "{{ source_snapshot_prefix }}/{{ revision }}" + workspaces: + - name: source + volumeClaimTemplate: + spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: "{{ workspace_pvc_size }}"