From 81849ca568069a0291aa10d17a1eb9ad7d174e13 Mon Sep 17 00:00:00 2001 From: Jeev B Date: Thu, 15 Dec 2022 09:38:05 -0800 Subject: [PATCH] Add support for authentication in flyte-binary chart (#3155) Signed-off-by: Jeev B Signed-off-by: Jeev B --- charts/flyte-binary/README.md | 11 +++ charts/flyte-binary/templates/_helpers.tpl | 14 ++++ .../templates/admin-auth-secret.yaml | 16 ++++ .../templates/auth-client-secret.yaml | 19 +++++ charts/flyte-binary/templates/configmap.yaml | 76 ++++++++++++++++++ charts/flyte-binary/templates/deployment.yaml | 54 +++++++++++++ charts/flyte-binary/values.yaml | 32 ++++++++ charts/flyte-sandbox/Chart.lock | 2 +- .../charts/flyte-binary-0.1.0.tgz | Bin 9178 -> 10353 bytes .../sandbox-bundled/manifests/compiled.yaml | 4 +- 10 files changed, 225 insertions(+), 3 deletions(-) create mode 100644 charts/flyte-binary/templates/admin-auth-secret.yaml create mode 100644 charts/flyte-binary/templates/auth-client-secret.yaml diff --git a/charts/flyte-binary/README.md b/charts/flyte-binary/README.md index 0a8f1f2e1b..35c2e73780 100644 --- a/charts/flyte-binary/README.md +++ b/charts/flyte-binary/README.md @@ -16,6 +16,12 @@ Chart for basic single Flyte executable deployment | commonAnnotations | object | `{}` | | | commonLabels | object | `{}` | | | configuration.annotations | object | `{}` | | +| configuration.auth.enabled | bool | `false` | | +| configuration.auth.internal.clientSecret | string | `""` | | +| configuration.auth.internal.clientSecretHash | string | `""` | | +| configuration.auth.oidc.baseUrl | string | `""` | | +| configuration.auth.oidc.clientId | string | `""` | | +| configuration.auth.oidc.clientSecret | string | `""` | | | configuration.database.dbname | string | `"flyte"` | | | configuration.database.host | string | `"127.0.0.1"` | | | configuration.database.options | string | `"sslmode=disable"` | | @@ -54,6 +60,11 @@ Chart for basic single Flyte executable deployment | deployment.extraPodSpec | object | `{}` | | | deployment.extraVolumeMounts | list | `[]` | | | deployment.extraVolumes | list | `[]` | | +| deployment.genAdminAuthSecret.args | list | `[]` | | +| deployment.genAdminAuthSecret.command | list | `[]` | | +| deployment.genAdminAuthSecret.image.pullPolicy | string | `"IfNotPresent"` | | +| deployment.genAdminAuthSecret.image.repository | string | `"cr.flyte.org/flyteorg/flyteadmin"` | | +| deployment.genAdminAuthSecret.image.tag | string | `"v1.1.57"` | | | deployment.image.pullPolicy | string | `"IfNotPresent"` | | | deployment.image.repository | string | `"ghcr.io/flyteorg/flyte-sandbox"` | | | deployment.image.tag | string | `"flytebinary_1007"` | | diff --git a/charts/flyte-binary/templates/_helpers.tpl b/charts/flyte-binary/templates/_helpers.tpl index 4f0b160eb2..c97d89f4cf 100644 --- a/charts/flyte-binary/templates/_helpers.tpl +++ b/charts/flyte-binary/templates/_helpers.tpl @@ -132,6 +132,20 @@ templates: {{- toYaml .custom | nindent 2 -}} {{- end -}} {{- end -}} +{{/* +Get the Secret name for Flyte admin authentication secrets. +*/}} +{{- define "flyte-binary.configuration.auth.adminAuthSecretName" -}} +{{- printf "%s-admin-auth" (include "flyte-binary.fullname" .) -}} +{{- end -}} + +{{/* +Get the Secret name for Flyte authentication client secrets. +*/}} +{{- define "flyte-binary.configuration.auth.clientSecretName" -}} +{{- printf "%s-client-secrets" (include "flyte-binary.fullname" .) -}} +{{- end -}} + {{/* Get the Flyte cluster resource templates ConfigMap name. */}} diff --git a/charts/flyte-binary/templates/admin-auth-secret.yaml b/charts/flyte-binary/templates/admin-auth-secret.yaml new file mode 100644 index 0000000000..55cdeb4564 --- /dev/null +++ b/charts/flyte-binary/templates/admin-auth-secret.yaml @@ -0,0 +1,16 @@ +{{- if .Values.configuration.auth.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "flyte-binary.configuration.auth.adminAuthSecretName" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "flyte-binary.labels" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "flyte-binary.renderTemplate" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "flyte-binary.renderTemplate" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +{{- end }} diff --git a/charts/flyte-binary/templates/auth-client-secret.yaml b/charts/flyte-binary/templates/auth-client-secret.yaml new file mode 100644 index 0000000000..d58fecc193 --- /dev/null +++ b/charts/flyte-binary/templates/auth-client-secret.yaml @@ -0,0 +1,19 @@ +{{- if .Values.configuration.auth.enabled }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "flyte-binary.configuration.auth.clientSecretName" . }} + namespace: {{ .Release.Namespace | quote }} + labels: {{- include "flyte-binary.labels" . | nindent 4 }} + {{- if .Values.commonLabels }} + {{- include "flyte-binary.renderTemplate" ( dict "value" .Values.commonLabels "context" $ ) | nindent 4 }} + {{- end }} + annotations: + {{- if .Values.commonAnnotations }} + {{- include "flyte-binary.renderTemplate" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 4 }} + {{- end }} +type: Opaque +stringData: + client_secret: {{ required "Internal client secret required when authentication is enabled" .Values.configuration.auth.internal.clientSecret | quote }} + oidc_client_secret: {{ required "OIDC client secret required when authentication is enabled" .Values.configuration.auth.oidc.clientSecret | quote }} +{{- end }} diff --git a/charts/flyte-binary/templates/configmap.yaml b/charts/flyte-binary/templates/configmap.yaml index fa993ff18d..77af0868a9 100644 --- a/charts/flyte-binary/templates/configmap.yaml +++ b/charts/flyte-binary/templates/configmap.yaml @@ -108,6 +108,82 @@ data: {{- end }} container: {{ required "Metadata container required" .metadataContainer }} {{- end }} + {{- if.Values.configuration.auth.enabled }} + 004-auth.yaml: | + auth: + appAuth: + selfAuthServer: + staticClients: + flytepropeller: + client_secret: {{ required "Internal client secret hash required when authentication is enabled" .Values.configuration.auth.internal.clientSecretHash | quote }} + grant_types: + - refresh_token + - client_credentials + id: flytepropeller + response_types: + - token + scopes: + - all + - offline + - access_token + flyte-cli: + grant_types: + - refresh_token + - authorization_code + id: flyte-cli + public: true + redirect_uris: + - http://localhost:53593/callback + - http://localhost:12345/callback + response_types: + - code + - token + scopes: + - all + - offline + - access_token + flytectl: + grant_types: + - refresh_token + - authorization_code + id: flytectl + public: true + redirect_uris: + - http://localhost:53593/callback + - http://localhost:12345/callback + response_types: + - code + - token + scopes: + - all + - offline + - access_token + thirdPartyConfig: + flyteClient: + clientId: flytectl + redirectUri: http://localhost:53593/callback + scopes: + - offline + - all + authorizedUris: + {{- if .Values.ingress.host }} + - https://{{ include "flyte-binary.renderTemplate" ( dict "value" .Values.ingress.host "context" $ ) }} + {{- end }} + - http://{{ include "flyte-binary.fullname" . }}:{{ include "flyte-binary.service.httpPort" . }} + - http://{{ include "flyte-binary.fullname" . }}.{{ .Release.Namespace }}:{{ include "flyte-binary.service.httpPort" . }} + - http://{{ include "flyte-binary.fullname" . }}.{{ .Release.Namespace }}.svc:{{ include "flyte-binary.service.httpPort" . }} + - http://{{ include "flyte-binary.fullname" . }}.{{ .Release.Namespace }}.svc.cluster.local:{{ include "flyte-binary.service.httpPort" . }} + userAuth: + openId: + baseUrl: {{ required "OIDC base URL required when authentication is enabled" .Values.configuration.auth.oidc.baseUrl | quote }} + clientId: {{ required "OIDC client ID required when authentication is enabled" .Values.configuration.auth.oidc.clientId | quote }} + scopes: + - profile + - openid + server: + security: + useAuth: true + {{- end }} {{- if .Values.configuration.inline }} 010-inline-config.yaml: | {{- include "flyte-binary.renderTemplate" ( dict "value" .Values.configuration.inline "context" $ ) | nindent 4 }} diff --git a/charts/flyte-binary/templates/deployment.yaml b/charts/flyte-binary/templates/deployment.yaml index 438b5985e3..3959c8511d 100644 --- a/charts/flyte-binary/templates/deployment.yaml +++ b/charts/flyte-binary/templates/deployment.yaml @@ -42,6 +42,10 @@ spec: {{- if and .Values.configuration.database.password (not .Values.configuration.externalConfigMap) }} checksum/db-password-secret: {{ include (print $.Template.BasePath "/db-password-secret.yaml") . | sha256sum }} {{- end }} + {{- if .Values.configuration.auth.enabled }} + checksum/admin-auth-secret: {{ include (print $.Template.BasePath "/admin-auth-secret.yaml") . | sha256sum }} + checksum/auth-client-secret: {{ include (print $.Template.BasePath "/auth-client-secret.yaml") . | sha256sum }} + {{- end }} {{- if .Values.commonAnnotations }} {{- include "flyte-binary.renderTemplate" ( dict "value" .Values.commonAnnotations "context" $ ) | nindent 8 }} {{- end }} @@ -91,6 +95,43 @@ spec: resources: {{- toYaml .Values.deployment.resources | nindent 12 }} {{- end }} {{- end }} + {{- if .Values.configuration.auth.enabled }} + - name: gen-admin-auth-secret + {{- with .Values.deployment.genAdminAuthSecret.image }} + image: {{ printf "%s:%s" .repository .tag | quote }} + imagePullPolicy: {{ .pullPolicy | quote }} + {{- end }} + command: + {{- if .Values.deployment.genAdminAuthSecret.command }} + {{- include "flyte-binary.renderTemplate" (dict "value" .Values.deployment.genAdminAuthSecret.command "context" $) | nindent 12 }} + {{- else }} + - sh + - -ec + {{- end }} + args: + {{- if .Values.deployment.genAdminAuthSecret.args }} + {{- include "flyte-binary.renderTemplate" (dict "value" .Values.deployment.genAdminAuthSecret.args "context" $) | nindent 12 }} + {{- else }} + - | + flyteadmin --config=/etc/flyte/config.d/*.yaml \ + secrets init --localPath /tmp/admin-auth-secret + flyteadmin --config=/etc/flyte/config.d/*.yaml \ + secrets create \ + --name {{ include "flyte-binary.configuration.auth.adminAuthSecretName" . }} \ + --fromPath /tmp/admin-auth-secret + {{- end }} + env: + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace + volumeMounts: + - name: config + mountPath: /etc/flyte/config.d + {{- if .Values.deployment.resources }} + resources: {{- toYaml .Values.deployment.resources | nindent 12 }} + {{- end }} + {{- end }} {{- if .Values.deployment.initContainers }} {{- include "flyte-binary.renderTemplate" ( dict "value" .Values.deployment.initContainers "context" $ ) | nindent 8 }} {{- end }} @@ -168,6 +209,10 @@ spec: lifecycle: {{- include "flyte-binary.renderTemplate" (dict "value" .Values.deployment.lifecycleHooks "context" $) | nindent 12 }} {{- end }} volumeMounts: + {{- if .Values.configuration.auth.enabled }} + - name: auth + mountPath: /etc/secrets + {{- end }} - name: cluster-resource-templates mountPath: /etc/flyte/cluster-resource-templates - name: config @@ -186,6 +231,15 @@ spec: {{- include "flyte-binary.renderTemplate" ( dict "value" .Values.deployment.sidecars "context" $ ) | nindent 8 }} {{- end }} volumes: + {{- if .Values.configuration.auth.enabled }} + - name: auth + projected: + sources: + - secret: + name: {{ include "flyte-binary.configuration.auth.adminAuthSecretName" . }} + - secret: + name: {{ include "flyte-binary.configuration.auth.clientSecretName" . }} + {{- end }} - name: cluster-resource-templates configMap: name: {{ include "flyte-binary.clusterResourceTemplates.configMapName" . }} diff --git a/charts/flyte-binary/values.yaml b/charts/flyte-binary/values.yaml index 39140a97f0..7ed6180e21 100644 --- a/charts/flyte-binary/values.yaml +++ b/charts/flyte-binary/values.yaml @@ -73,6 +73,24 @@ configuration: enabled: false templateUri: "" custom: [] + # auth Specify configuration for Flyte authentication + auth: + # enabled Enable Flyte authentication + enabled: false + # oidc OIDC configuration for Flyte authentication + oidc: + # baseUrl URL for OIDC provider + baseUrl: "" + # clientId Flyte application client ID + clientId: "" + # clientSecret Flyte application client secret + clientSecret: "" + # internal Configuration for internal authentication + internal: + # clientSecret Client secret for internal authentication + clientSecret: "" + # clientSecretHash Bcrypt hash of of clientSecret + clientSecretHash: "" # externalConfigMap Specify an existing, external ConfigMap to use as configuration for Flyte # If set, this no ConfigMap generated by this chart externalConfigMap: "" @@ -156,6 +174,20 @@ deployment: command: [] # args Override default init container args args: [] + # genAdminAuthSecret Configure init container to generate secrets for internal use + genAdminAuthSecret: + # image Configure image to use for gen-admin-auth-secret init container + image: + # repository Init container image repository + repository: cr.flyte.org/flyteorg/flyteadmin + # tag Init container image tag + tag: v1.1.57 + # pullPolicy Init container image pull policy + pullPolicy: IfNotPresent + # command Override default init container command + command: [] + # args Override default init container args + args: [] # labels Add labels to Flyte deployment labels: {} # annotations Add annotations to Flyte deployment diff --git a/charts/flyte-sandbox/Chart.lock b/charts/flyte-sandbox/Chart.lock index 115e6f3883..9b192cad1d 100644 --- a/charts/flyte-sandbox/Chart.lock +++ b/charts/flyte-sandbox/Chart.lock @@ -15,4 +15,4 @@ dependencies: repository: https://charts.bitnami.com/bitnami version: 12.1.0 digest: sha256:ce2d6bd1488364f3ca98cc306554e479f1190ac828925af78a468a52f752449c -generated: "2022-12-14T12:10:02.400116-08:00" +generated: "2022-12-14T20:07:29.49547-08:00" diff --git a/charts/flyte-sandbox/charts/flyte-binary-0.1.0.tgz b/charts/flyte-sandbox/charts/flyte-binary-0.1.0.tgz index a3b36300edfa8c358c31ec6fd78a58820d55ad51..9e4bbebd6ed700d832caf14c43a23700426858f2 100644 GIT binary patch literal 10353 zcmV-%D2~@3iwG0|00000|0w_~VMtOiV@ORlOnEsqVl!4SWK%V1T2nbTPgYhoO;>Dc zVQyr3R8em|NM&qo0PKDHbKEx4;Qso}Ux6KGzqNBFXGSl3rz&?ROOB&j$5B~!wzhIx z4u-_cV8tOA0F7OtnBgB0WtgN>aIrIhS!Vy7gp-4CJctpCD9*TiCnW^T2?aCAa0D1m z7YPF23Mm5UGm3H!X9)r^$`W$5LMb1laD}G8m9qiA%Fq(VlsdOAp!tvm@ zZk5OLl*a!BOmf6Ft^nG{|IXgtc&9S{_r`nM@&6#t6ClRt4;P4193ybXDNYxF6F|%> zS3*Kj7;v=863EfO1)YN7aPS1o^CVddqX8(eR#9lo5m~KB`WDVm!oXo1gGBx01i&N# zd}*`}iUCE87D6KMf{+ zT2zopFatCN8DV@u5!2W*$k-*JF*r3p8W3G#zSJ-$bHEUP4j?!~5k(wa;v@kx1R{zc zN3kpm_!2W9wGV)43|1sh#Wzm0Wywe^@fixFNR){>g?tIV7l4`gMdo0R6WKf*;#7!W z=1@ID0LHOfg=4YYngm*>wk2U4d`B3UtxDzv&p2fqrV)|_MX@QE?7Rra;W(TaQVHeY zRQ%J_0lIEN`4sH$?e1v6cvf_xTPG)?vt%JvMB7;nMlvhjSp0$sh!TuaZodeLFao3o zslhE#=wegASh6B9`X| z$rh0yx?@Z^304D|g5l~aAans!{2y6$pwvrbN(`N`aNMIlIYMlOHK_g-W|Umu7*X(p z(+luOG+I-T2 z;p#bnQG^&fM_12m-KOR#7-G08(IgB19bJJ#`3sz*D@lP%Tfg?Rs48qTspUl#THoKk z3X96A;)xg^Z4&zC=*%agi-@^0no%N)ydgwPUyc%z$Mz*o+r?Fv^C*Hvlm+_hQ0mBp zEEa;>W*wQ31p{b>x#-#1mG%vQfi%i8K^G_iXF^*ok@%?I$glF(6j&>hY^=~B8(MN)*Ta}t|+iq!_=1)UsQIZ#DC@LG#C;!sMeghzom zP9sja@Te0jAVnM4Po8El-==<&j$8sdku?xk#rhp&OYkb9R~ZLO@te%We{K;EIsv6o zJ^|>nqCzqIJOGpL5 zHJU87I8AVhe9E#+gK%f{e3TUgJ=b%I6{3q`E`xxXnU$O_Rh679O3fjslXBW(YL_z? z>D^EiaYC;|wbg0NeUezvWE&{)O}NeE&9U7`{HD>SSfHUesvK6n7Nl4TEzz?M|dTs&IP#o+nEy>eJ4K{Q%q4t z7?usH>Qi9FYgw-Na|#yAh=!PqKb6nR$|&k_1O(Qp9VJ$@j{;w8f_2Wd4ruQ;L{cW08Z2!q@4=kB~BONGZHh>Pfx_ zD80axq_QzDAjQJFP)l=hv23H{+hVb9kNdJ1BxV7{3{?N{wAG7hS*bU?XkE)^ziK00 zt5LsSzq*p)R*RT0je%WfjnN$DiN%blDKY@&SK$=W1#5#8--YbcMbV-OzCbBr?39uj zY6CU}h31+mlYNHJ6f8N<*mN{1CILb)V-m3uhwPkQ#d&W~2Nb~=%U_H` z%5ypGnjtn4W8Njy4t)#JNxv;=87RXRiceLo5LzW_UMpzF(X}#`qHE!7wE<&d%jAb-N4kUPmIg@Lz6#bGT z##sa97Fg*d1!z3f6 zLqUmJ2fnL7nF<13fsmRyJ=3OH4b9U-_K_hv1qb{4yL-jUH83fAHXET zDYB4``SK#D+Obwk)~b&yeOoBys#<|+73wH^OT_}E0Ti%-n2QE_l6ueb5z$b3E1`9C><>xH+H!L-2`AzHi$Ac`cs*&) zhS++Jvr5EmZzagyQDf^!4OEYd( zvuX}lfs5f7MZzugFHk6I>bMM;#Uq5_s3`BjRu-2!$})yBv!^5$7`sXuwuu?VJO zW-d*X+$)GdEQAZ0R!1k|{3Vndy2;>{JlN&&}Xe(@jDtVi`## zv&Bd?@bdpkH40b9uGuYU7TI|~N@8>>iFik1UANQBh9*2OaU&dppWkWFpM~%E^IHPr zS1^HTgy_!$P$2H2ATkXiwlUl6yTDn@4s=(H)Cx#o$PNTs z!A#dNdZG!$=_24u6etD)#Xx{FXR)coupKnDwmy@f?_s(?vhyfn%&gc!iU3R!a%o&! zE6W}2?;@@0DKR>nZF4nTDr*YPMq~jc5eKG4cg@Ski_Z+!=xywrG4H_5XvoM-)Ti;^|u15m|aF$;at53?xg!(72o z&|EsN!wHz-G;V55b!ulg6#YzRFmgKCu?p{B9UeKIEeiU2T8sR9lBhFH&fl-FQu#h1 z;52WM0a+)O!uk!p` zpTPWWpVIkXyX-!C_rr(RXCeR0H&I8|`G4`deExTT=f(E??}I!I{r_o+k_=H6^6c(M z!Q1(7}mQGAJjIoB$F%N@jU@b&1|UkBIMftbAD z6oFywMEDQ{MG?995UNljx&0CTsKN?L$HH%f)=wjFuq%J!)mc8DWsU2_(`Xkk3J4O%;EuZuK(@6+fBvv|Ie3{1c2->U_UwkZ^n@V#m$1#9Rmy>-!t1Ac{>Cqe?+GsTK4Q5$bp48f?vFmFO$PM@6MazTz#VKpnXW2)GsA}3S=aFeUCg-- z_PZu!RW26lNkYYJJoU3)XuiP9ox$Y(k@hmZKL$g6zVcRYGRF}O0oct56 zl4o_OGOvMU_KiMm?Aa-Fwif$Xu@bEQ>wB0r%1XI>{mfP1Fj?r$;ac#v!TiVqg=5%D zB!f!(t=E<|oW}+z>Fu)ho7SKT4Jx&5S8iyB$#@oslDFgX4xGsVFL_LCBmBt?m{Z7? zbw_kKx`1><^K_&)I@NyQ$a3zNnOa5id|RIuu;D`>qiBvlug9Q{kqS-N(W%5yu=Q0v zifQ_dJZFI^iox)st=&D)qP{lqTCKA{?F>!y3mCH9E)+JnsVZx1cRCvVg^dJhLmwBV zA*t(IM2-E^S>b~9t+3~qHAni(bgb368bzo>E{a~2r{4UGR$xln(s2RIA${?=cpcc& zD{_g=`Cv>{kW(yuhC+mlT>>B9pA@evr)$dr4#N^HPFzCOuo%jVz>5;)#p?>?&WBr3 zUPOM>DR*e;LAev4Q6k-WU!mRoax3E95R)49EA2+ZG^cEiBdZ;>`LxnCdtz!rFEqkD=H_XKByAK~u z<)&ppYs03s^f1h{*V4?(*Hv9m*y6CFaTZp|KP=>s{eQPUTpRMLp)!I{;$t< zx61#Isr=Q>*0Gip)$gB}4sI>2h@F^dq|!=CQ9#AJl^0zwGZA}DE5}mYOrTRq?#iM> za2$PVBTwCGvT@Qxy^UmT-f}kR|K?gUSn#W<^)@gruC+gSh1nB3diybpu`?933 zk&%eXW?~9%io+;+f2k+78j0@aa3>PyP8tjRH2fAPh=p$wGFu13v+z*g^-0tF?N2 zHqSNg@{@2;3Dx&qhUYKUF-&Xri$(r*48MPaU~A^P&5Ufh&6;!<%=$ zb7Aj)3_yZe@ki!ds~Uhjiv`qL#AYP!u0KWzx-~iGPkGp9J>t*>N_#X@om^P-uhA?d~{OqZNN9Kdv zNtR*Sw-8D{CGiR~K?X$&%s6#Tn4h9m&gEs*dLzBGShMM&@>}hRbo+lZ6|H=K>;F5u z2Yc1^|GjPgmxp<@<%4PL^#MDhH*W7C>L~bi97X5s2l(~Z(s_|Ui|N*5+y(x_RxX%X|n&) z*IB`A6UpE@;{OkXv9HAc?@zY-{}1x`_J2B}=Qg|P(-s=IT>|R1Je6>v&2I1ba6eWP zU)ig_hkcyJ3U0A^GaiqFh)`78hmof&&4jhcTa}OqCi3#Dm*baz)1PrFuSqVhX96IC z942HDL@-*S4m6WyH0CBnL8?Zn&?`6MQ*9>BI80-hkQ5yk*XWm$;TXfEvIL9}k93%4 z^S+COOvqwUWZGd%a;a~#E0L=cEL~sQD1}K!w4O@WqzS<*t8_D>0=jhRs`jDQfB6-(Q{uhwtAX{?oqI zT`aG(mQ@R3ZNfiosLHMn3gq^k`U*Bq2{nF4$JcfmlBs8qNGHrJ_bfkK7b_;cr5Im2g9 z2cWi6=jRh>i*kvbXDmbCn;u+4l0sqI#nwR>cQ<~!|Z{($fDVyOxy^%lk@^6Smy_A zLS9QldX=FNy#Ab_h@%*gR9*)3w31u&Ihf@fEC`I zr>jlU;c6e-E-CkMt$!V7sMLtx>qP+nO(gZ~&p!N0Z}baJ5SD3AhAfunJT{dj05HoA zoj=8JP39`kKM3M0SFicpbh!|Jp#;O!h*WWYLRKKrYJ%VawVUpC|k@-9+ zvc5QFrDF52r89XaxQhP{%~V=!{}hq9N{?+OQE}y4md_F#m1cD2p-83I`;=4cAxd7@ zKN=O2^8MZYzwM49m?Se8op+a??CkFCHt`Vwd``?8^w>RVDI=HO+Y ziDW1}iCyux*|+QQadJWDzfe9Pql8{4xH{i(N}l%(_=34eg&Wlj3u zZnSUU09d>J-+8fr@S=MD>&4zy|3Ap%>SmZ_tT?J&oVB?95$&xGZa-7x471Ii+^Qpf ztjD&TmbiyATMgLPXl#}tnLm&snU0gG1o<*P2`%*0Pualt$VM2Mgd*zm3i4?AwsYjv z6Rs4L9e`5!zQ*eed+~G+&bBIE`ZlRs2I|8N)*5C0-D^*u+XU6OB)Utc3j7Tc)lPbC z7(3jwIq{froGy;c8F06bXo;e8maj%7n36$wDz_uSSD|4vdWf-ymn5!Ht^b0>yS7?`S$<&Cd?$r^ck+8^)dnv5GGUB%J2R!+_@(`o4KY%x zpn;8pmYto}emK*s&qoSvef+U<0p%Bv73TdAf}ve!H_53yr%AnZ*Mq`t8$o8EP|zx_ZS6`>N5!!$1Mvo=d?!ITE9 zo^{#axU1LIF!)?4c37<(;#0lJmX#L)it3s&NC&RaKIbP?e`E&<6y*aYO3Vk%3rW zTc-x!y_7j2{UdtGc~+sznmBd+z{~N=mtN2X&7w}wzj;CR{Ri#Pe^VD9 zboYYPig|WQ$*g*;*!i+q`y?;mJaa3)i>XTR1xgWPiqKw6mq0utd_xB!O0}%RqQ`y- zS$l(cbsS{M;awt_@TJ@^suqyqP?1z`J5mH=yk>i97R`A zg1#f+xU-% zc&_~y5cn_nPZ7T)^c<&)+Qt4S3h)lM`Rk>ZZM;ZJFoWry%?689us+sE5i9!}Ai1@j zTPeQ-;bH{cBiU8-w+V7lNv!Ne7uqytkT0D?Ix`rZqw)zBeTZ`{|Em^?Ry=aasN(yk z`D&&wF>AjkL$pKfo(#KAB|&hU*y8fohE9A?D*Qo4^_;A-1PO;iw(41iB0R^@BWR1! z*N?q5)ZM1!^VL>5yzQ}-5HXQA_b6_Kq^U`^a&jVXVB}jx;%$ycCm(Xwt~SiVi%IyM z{IzWZzFb!l8XRr+dOmw2`#oRGcYQxMQ+2HW2rvDf*MBCv_4_|w?2NbhpC07-a@K$J z2L5*aXS@EhUH`ci;bH{cBiU8-k9GaWdrzwMJ0g-YlKk;p@LpX10X^+@zF~$RAIFcb zmwjgs9|z|blSkLt;U!9v;5;Rl>Eq@6(e-*l7WlFCx8(UT_B6@)qh$Kg^>r$wd)mh_x^J`lI2Ejqbsxtx!#!O0?n8ZxZ4h;zyK_f^!OLwX>*7X> zr|1`dx#3#^<5w_&X@uzTSxdopBu3K2YO7=-gg#I>pX12AT&Du>Em*0lb(IyJz(Ybg@f`-=nFy4E&4)$Jy2gX zSSo#wH{}~QR1W5~+yR?lq=k~UWFLE9)Ffy7G(H{kKYgju-KKyY^S_<(?m>0_cd)me z|2@dFsrjD~6fHR0G>qG+;C3q5dn#!C3BMa%zFJOsZ^cD&u18js+*~Hn|Lp)EwDdZf{ zlmSkF>U(gxL@Ai%IEit(02z$V;R3O6@C1BVVg^{ANhcMsB}x*oNXSg(pvCFpIiM(k z9A6;0Q}4WoX*_rWQnZjF4xVNd&GBaxt8@Z?einis(&P$|R6+`pK!zwtaEih~czpKh zj1!6mPr#8J>EOqsGZ16S2H^tpk^EPYKL}_4p(FXPd9hrK#6RXwc9D(>L^Bwj=NXve z1hK)_A-l{5UxzbzKKMH1EAg99ycm4_{|8UNkC0-LGjMYJnhipI$KN2tF@hsioRWVJ z!V4CW7>#}p?sIAUe-F=*Xod~f(dGZ`)%?HR-JR|F&x1UJH?QBlet-Dk_3@`~Pu{-% zX1GAWYpexUpn;XDsjx-v9-$CP{!^P$OY!Qa1-~I6JpHm=68%X+qC3Wy$;$NEt8>nUo zIOBo3_YZ_45Tq(63JAnYVdvB6D#)`K>UXnz0fInz&VhAiK>z`r!ARbjNhto0x-8L# z(TeZB@Y<0MtQFs3hS6t^QsIR&r^u1KxZT`!d5q>b#Zt%q?|Rb~Eg)J|a&3O-mJokd zTS9UyKFAiBtG^?jh*v5N)9%-&kUx%xBvvqXD|L^VYPpbNV zvbUZ8Kgjb0xDqfJ{P`z4%^!!8aQv^QOU^Sk9gXm65waylNh}B048{vI(uD(AHo)ne z(3Kp*F!?`>UnS_9c>;OBe#s$4&%mF5Qb#vomL)in1v@GbXb$s)%U>*_IFpL%W^faTNBwL5SNbLY8r*=!3y_0q$-VCrv~d9R7k+A2X)9qyt{W0}%r z*nN;T-Y9+pW`rc7{2V3>wSnMN^-AgH?PiAi!G8x?OQY3r5FAJ03^MeQChLN!YEReU6}S^S4x&4=!#Ir2V~Q^jy(3jFrnSlHV`fU_IiYZYLbE?&GkBK4S62a{3z+Ij zP@o($n?S4!dq&9xj;l!7ZeKVx48ujl%)(YXd5b6ubip;NV7noVBE*<-f!1h2529R! z1C{Y$xLO~T*2rgPZ+i+=Gb)tE8Bq%4PTWznkbazxOv|mp7>onuZ{2k$^6fu-?Z<97+bkYx(Fh(?#@*5JmP#25ZA2PMhdbOy; z#t!<6NjM4jUwE3NLZcZ*C=HC)}{HmY&EQ{^i2^v7gBfJuf^XX>+k0_s1o=EeLN_xAccrTxEH?Lx4YbhabAb=&_? zaM$^-$#}QC|F^SyFy8L}J;>ud*K5z(dXDt|_4>Lvq6>cg^{?BJwSBhF_Srta$LD_n P0096053sD*06+l%2)Dc zVQyr3R8em|NM&qo0PKBjciXtpXum%C6{xa(n(PfJ$!|$@&fa^yPB!&vHtQ2-x2LDK zCkv4fg_oU9<_ z;Wb>RzuV?Bold7m2M6;1bULm7pYH7){cd)!e{giLcXYJB|GVjI|7bS*9hhzvi;+)GgDIs7Hn87EfCwf0_g7ldwa9}y;}c2m>#^?_5X)>o&eE5f4D@H;uwK*PH~n1P5?1U zu7rdlGvH{Qr;wwOTXYV_vjVvbS)7QU;FW7^Lcz69Cf` z@RiXzCf6(kU%oLh~oG_kH#5A-VGIm9149?6;3!p2^SGvsU5-`M{0|?GhL=gv9I8DIrO#-Y_+lnv_{!AE`TqVnrW}Gn&vk1wIBHJ9y_Fjb3a2n1Gs)TZI zCjPWFfUcWRJ_m;f`+K@zyeJ#dt&!E3i-ur-OB^8!w}d(e zOPDg`)QGY;CphEa$M*oMQ5n}8DT|cvRo0{ifjN!V1lg#`VbPbN>8@NE%5(5{vVf?e8YGgC1AWf#}lHUOriQI;vXL@78I+G>TwN0lPK%C|YNqfA;PIAgX>SZWD_ zj?SVKfqE}Bz(uh@G(#LQaH7#gwUR@P8s?I+S#2>hii{|d6zfsjP{{9asf#?$#)?BJ^`yS?{Tx0-!!c6qW=QbNC^JxVIS*r!>+IP}| z%ZO7xK^dY@i?#e5tsoT^P6H>6{u6++6lcgMx>X#6aiM1itVHO!w(Qo3CZ%PGfU%P+ zL!hckn(ne4rExEfNK?DCBjs2_QN#(o7S+~`%KJpI#K|%!^-X__DQ)>F^hY`4k($4I zw&Q~UJrkU?U>wo+dMflm3t*{hxJ?lhJDR}Go&aA#4%mtmY3xn|ME(q28GBzTQ8sF; zaehbPc3MzZVNrC5u$-~zS;QVx_FFN$A35%-?pG(1<-E<&zx62{FqW|DTIB~NM|dqJ zGG%e~+p*A$zLOu!m`qVl7?uoG^{HZI@<ak)9DK{<`-#tMp7JAQ4z@?m+5M(x7p_4boq|(Gm4m+@ygCb z;p^=3CrBAMrW9T)^(4~)$}TY_nPlcAq*#ndYM~@9C(%m2EfjYUvWaCUG1FPoQT^T1 zRxhe$mDccrwPNXh)wXD(MxDNSb*iAPOH4mt76ZHL6{96AQVSVTlVt?Vo8=Cq3F|5; zz6;r>Ny*U^U!n{#c1Fnpbrm)lh2~nQA^RMmIaqO?v-xCFnq)#SV-m3mhwOq)%wU9q zoW$ki)=4*@1Bzgb-IbVvx!_*EOhPOC(FhqCHm zR#_Z21D6+!8Nu`zHaiSpn&S-FlFsnu1yCQyI!CfjeOznXQYqKfa=T)#fzaByuAhB2 zk!PWKGn2>zpl%WMRIa*gPU5$>sMr>+?|s;S;%A;=_3G?H^7OSb)24!%vK50B$@0o%}l&9VvTwfKR2CIO&kcNh~*@c z#FjnPl$ZaN5)^}$T{}r=9$AYnBQZLYNW3GluG?X=!3i%b)Ckr7^E+MiXJG~W{FcD@ zTbRNuLiFbmC;|6j5E+KZWj`kRTLezeyj5D}i5hId?ipHz5OzyloBDa!~z1g)B#U?07A$1GC4ajj7W!kc+W_UaGFLd5aA-aMY4`;JCE}x+x}VE*luM z13^}>&~;3nXasSV1bl@8ML?hk2ypH!8&n9kouop+vlsV6b!4^3iz(=4C!9o`LWEfvj@)ZKcuT8wmJ*#l^_2kQ!(dW;Bm}KD$ zfpNnlbPR$ri(DiL)lmYu;2!>@+=?r1p*Lc5$|7*IFJJNcyjU*rCom4iK*K^=EM7+v zMLp_4Tf?$Q(`)cc0aG~z1TfDf^5N*ONWqr*xu`)9!oUJWuwV!Qd?g8(e>1#QOB^jL6p-+};*%+|5}ker%6R$(FYbpbINAbGNN)xORBGFW!AD?>-4y+R`2>? z2DkwfT~eH;^RPPkwx>oufA$o)0lyT4qZ$XAP}VSm35tWowE|=$ zNn5yH4xVe|hw-pZYT(5~Iqq%v)upn!oAg6F5YcdUL!{dCM?Aut32W4-(0s z#=p&YY2Eql0R`pxdJEPXP@w^({1mE;c8H7@fyj9~D(^sHBT|j zzmYrpn4%brf3&r`E)?o(8?E&^OVCc&M8AMB+wTKm4>#0hjqT4TlRvPDKyB=!qS7UG zeM!{XKD`wtY-oi8`>b*4t>Up!<7yD0cDXKFRr*=^39Xf>XiLWg(2f!EbD11ie+ju1 z=zK6kRZvhYZH7{W%(w)8e1BRd*ZeuF4$k8WE{$d`24pykQO3bu zXIJSR5Zb+KH?$#IJb{Op6KzFrVOeYjs@KR+-~z)PD%0ArFvi{$$m~L@9M9==u-qDNw>iYlQ-t=g?TmOHEM-P=5;kOy%Gw1(6L^n8H2CDvo?(M(v1(nHeRN;#o3Q?Pc@rS;d&6X zbKP}l*)Ho{$oIv6cqi;PYXs=0r;i-dU5ApS53Wf-)nQ@|Zpy_-J--+Tt%0JuIM55k zIR$46KMlXbDPrN9lq@!Z@GLymr;93+qAF7UTFjbr*LXVlTC!@~TTNq0dMoKXs{kM?Tg|LnzVcDNh=AL6NXa%E%Ny%~3Km!Dw4SA^>O4#JCb7!2A0Wsb7Ta-C87%lgwh4}XM(tWPcbWhaxsYZ*4l>Ubp%=@PTy2bt`WcZlwYSA> z#KW98pN2CO=2%P{GckrRJz)6BQwz`LgIocU#|dsBlzvR&HD&@0iW1B?b%!uNM(cvh z%Zl^@SY=~o+g)YbcHPjY-~L-DulhTffqm;g`$q@0^`Gg%;m-f_K^{Hw!7TRLfW6*3 zx3>`WX^l+`MQ6^d2n*Yt3-j(MLxBG$(O)nYyt; zUc)DwHqfvehlYA9@Oc-8hS*Jd`oC*{{gpp$}Nl>w0zTk8Zuq6=XuP~hh>&>jmL+VNs zMN0(J6GV9h_tLkgLkasFfvk}QfaA+F2#DkP)P!;-FSkE9*q1^&3$$ZvMNZ{?8isc9 zBdFa{Y;OWN#}Ug<3;QaV=qg7U%X_2s@H3fVWijOm9|Br+a~QpRex%cX&G6 z!vdOuYAg$2?;9%#C<9dpv%to>upB5=xIKU1e5*!y7-*pMA3*r3UcY-P$6Igpj6uD0 zRzX@_r6CH*8#r9BL?6kMUXJb;6Bc<)E0RqdC5_mO6Ldf>ZOlkzvff;}k zgr$^D6V;&N<^5hoM5y?8pYPjP8m7iE2zBfPw;k2hf&pWxZp<<=f=A|U6a(j5Ias&P z=zGj73$|)bb&IXTbqv>I5ZdSnP9~8Sa8KZZ`neDr^I!m=GH>}=-P3e|u4|3s1VtFo zKxHrmr)o8VdSE-z5C*_5qbT$!6W8YpA z6afCoWPp)zB~f4I{Sn8t#(HydW}`t=TITPVBq}s-f_H~S*3KPHA ziva$UXwB$9KKPweFxT&FI-3USw?4SpusrTKne0CwCi(KYbonE zj)fIG204$ltpDlbk-{p`e*gEk|2I3V`+x0C_YQaQ{~qM=?Em#xyx{2ui-pfxR}0mE zc>ATo&ZEw|g~Ns_{jILVDLdeY9R4EDQc|2HudIXemga1tJ@wR6Ny@;U@E@?f)TaOK zLfaNLfV%bn-rkF8+M}Mb~?CwPr>PC+ugZo0)DL9 zHV!B5Vb7)o`UcEqIgQY5d9W-26y^iM>IUb|Ie;Co~}49$g7>hl`%X!W+Y=QJWyyf zP}60^tLR84#s|c$BU+*8f)(pYHGH)@AUu`J5#X!P5E_09nVRN~YmO!3XHrDi3ho^q zv0^=}AqE~+9YjUz{@?~Ab)S{K9gX)oA#1RqIo%&le#=t9?a1yOU>-YH!+oHB$bujEfG?wpoNU1)-~mxcBqAtviJ5lThrB8QxY6mV?GQZ7;A`Q zd(EC_U(}0t)4lPwzL1s&g!-_q1**BF%BTga*`Jh+yc=XLm$sd_S0RT3psfJEYdOqf~3MRV^VvQL|{BE*U>-V;0F6T@S$@S<#)Dv!M?} z$-APfQwRP_$A3^Kh2P zEhs}%BPUA{%E2_8HGpQQUtC&}+hwKrH)MELTl6Mzh+I|-f~`5Z9@ufQ6p`rr|+z4?^(faN38}b7H56f z(R;zQWY;}Z?G?xR5{`cLg0jnb4V;qjvmai4e0Ti)>zXc;gnviLdfrffGU9+fpX2?e z9K_5bjJ%(^v+DD+H8C)N;R7aQcLgl8_@n3);$@u*H2x9nhi3H zjb7^+7>`r+$=jl(1K=$y=oo_g(e`nnyma7B2>U^|wr(TQi3M5Wr7B->p4afQL!5GA zemQ;l(pxm4dDL64^ z#mQPVzj{{w>ZTaoouLxOzSg(&x2-CGT8($<{BF2tzmo1b-%~zo?pp zvbHRJ!{vjl?YnsECHi*6x9CaJSR-J?V(XPycby?dis1s|kk?ls+{UXMt=h!QsYE@$ zXG^zI*Imrr4x_=uM!%=!2Mhmp3lBQZdvlRtP-nJwa#f#f_iEZ2UUjW;OB@EAl&&=G zgQ%Hy6{GhNDaC+Xo^@>UzoA!*``+v3g|LHK! z6ETyyvjDtL$6ob;r5 z=P%gd%x0QryUv0&sE^fC(8~T6Q10Y&C+2rRydLg<%V^iZ-^R&NU1BN*W--&YN4p_k zITtA|V03}1`{mm8VIza7;fh>7a@3WF?yOK%h{uA?C=VuX>gH| ztL*Vo{^(jgB?*3P?Ja43j4e$H{wRrlbZs5MG!+CqQnDXid#@kiyvy}1eN03@I^ia; z;H$kyN%U^t=Dwbm{U6;plQqQIef$3&&h`%){=d8XKOg34xtm$J5$x{$yr+E}qx-hI zk5hyCSod)Z8}8w{Pao)8Y=fx#Je||+1}?XeOv<|mo}yp;`NnSvjK75`%pyd`&pI-` zBe9ITHP)k&Inwii!sQZ2?zJej^4^@)uKU>&umNWA26$(LgQxOHPE(YftmpFV)q9vF zh&|Jkw0-vy)0X*x={P;}VSjqoi}UGOH>UNn`qbL#SqBX#CXbN~TgZz}39^ZabC-hW z4h0*Z>K4`@hcrR_tbRhiEd*6eQ1OaoM#qR*TYapsGcd(~oPq0iNrIDIYU zt1T0bUg5^#G<+?>y=G=|oyJx`DJ^n*=)%YD(fcxVAy_g-=$N$5lUHrcX zdHf1fUoqcu44`f&=-iu_3msS4@2rLX0nN0}y%-HO;E&vPFxagq^=wy9%!^#Am5zpnoerhBuU{(p$)2{?nCBbqV52~cehu2v`mivp)H&JvKr z=mI8)g`+3n!wNINid-70fUQuPf+Qsi6@v_C$#Xza3OT++a;M%&hgm#&0y31Sz~fJI z8Py-f>LU2xKMTPRS$ZwQQs)XKkRu9GoS|?OzB>PS&Iv`MC*VZ(bnw&3IfyZ3qcFjI zBL6D%N8#dMbRz$ngjF&Tf6PyInN3PS3m9D#IauNpvC-EdyUIsjhYNTy`a0xm@lGgC zMqmH`(G&0!q?i;8oW6R^MkdDhD8w;>6P2Bke~!XS7LgcDehcPvrT>2qFOXovmh0%V z{|*}V-~RsIZvE#$p3$4v?_R$@{_y(M$L~(xzW!#MplqVV;o}-+c!`*f=QVou`uiU~ z`m)DpO=@{ZQHo$DhLic|zy9yvL9hg0J*}2~2L1v5`@aEQd%oP<08R^}!3g*c7!MvU zEbnIvFg*M75AXgq2LiQ`#1B|hNB<@M+8~HPu_54$2kN3e5Kcglsc04;5Q$=(&!X#~ z$YZF}7DWPrKv~X#HD*Bo0bRf-gauy_ivOiE*v_pgs%eg8UK$J?!==luWP(a~OA|IZHhcKZJzo+rSSfYIppf49^8X*dg~ z|9HCMJZJOC1h12jtuRVs*})btPS8YW4rJZ{XG=oYvJ1oX|1f@?qHmTdMMYyMT<omJidvJe(4xB)+Z{_-=p0id&NGiu)rP$BpQgz>l^0?vf} zzH!BR>0#4i>bHzb+J^Ng*(=9=C8gVOrQB@q zMK}$o;jFhT$qlYfamLa$iP1MPW zSE(o`j0+Q@t-|55Un$lj@RhthQeMqVl0;ZQDY`^yN&l=Td!7~v&R7_wq=>J?T--)K zy#WhC1gM{vFlA_SK*l=!k>X*zX~2>O8n^)|mSX(#-~TbNwwS%X4*s#l-Xbd6ZJvQDY?XP z9Vpu$T26JtFo~F1cIiehiSj^a+^`C^AHpa?jHv;70}grs73#1`6%K~$%|U66e186R zpis4gLRp*>r9kdP9Yu+>Qd}qn3lL;HXdQpr!KvT?8*^Q#_g7nxTQ?|S|4?2JVdzz2 zp0JI5`6}V;Hp$#OPIX668(7GM=s*&9lVyfmJU4iEPa1{S78c6{gZKQgJE`ij>A zqV==N#tjQoyvCe`YqV|%_3RDyN?%!+qF)NcI18h^@R^vt7(RW%T8Ti|Pf0D_b|3U+ z`10W;?x;cPfZB9PbDq%wq@h1%hXG7;oH;WwbJFgIOGGJ-QJd;EM^gt3X0=-%+qzff zuxn4P-AZZ*{%TpcA9v^e8Olk)!dg`bhiRsCm4~Cl$hRGZDd3m~{p4sQB(arLjCsm7p`aN&F zkhi=^QCa_w)hZJL}TQ|d<0{i?wX4C!Z`v2bk(RAnk_aKkguh070d0hJb`1y0` kq6fZw`Qu~UHQPPAXZP%$-~RJI0RRC1|I>9~`T!IG0QGO^cmMzZ diff --git a/docker/sandbox-bundled/manifests/compiled.yaml b/docker/sandbox-bundled/manifests/compiled.yaml index 25723382e0..842449edad 100644 --- a/docker/sandbox-bundled/manifests/compiled.yaml +++ b/docker/sandbox-bundled/manifests/compiled.yaml @@ -698,7 +698,7 @@ type: Opaque --- apiVersion: v1 data: - haSharedSecret: TmlVTUpabjh5RGI5c3E3Mg== + haSharedSecret: ZzBxYVNHclBTTWtBWnFHNw== proxyPassword: "" proxyUsername: "" kind: Secret @@ -1000,7 +1000,7 @@ spec: metadata: annotations: checksum/config: 044987b193c168f87ad6b75510b710dae15de36461cb822559e13e6f3bf1789a - checksum/secret: 5bd04f7a79cf46595637b045ca93a072b7add79ded27415becc6db6b01cdcc42 + checksum/secret: 72a6bbe72d54584038d8aa7f79754ee807898053f9564c2beeede9fab93b7c25 labels: app: docker-registry release: sandbox